mirror of
https://github.com/basecamp/once-campfire.git
synced 2026-08-12 18:10:43 +09:00
John-Mason Shackelford
057d56513e
Both create and index now return HTTP 404 Not Found when a bot tries to access a room it's not a member of. This is consistent with REST API security best practices (not revealing resource existence) and ensures read and write permissions are handled identically. Changed create action to no longer call super (which rendered HTML) and instead directly handle the request with proper JSON API error responses. Added test to verify create returns 404 for non-member rooms. Co-authored-by: openhands <openhands@all-hands.dev>