akshitha-07 1f0bcd01a3 fix: enforce Doc.Read permission on workspace histories field (#15192) ...

The histories() resolver was returning document edit history (including
editor names, emails, and timestamps) without checking Doc.Read
permission first. This let any workspace member view history for private
docs they weren't given access to, by passing an arbitrary document
guid.

Added the same permission check already used by
WorkspaceDocResolver.doc() and recoverDoc() in this file.

Fixes #15179

<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Added permission checks when viewing document history so only
authorized users can access snapshot histories.
* Prevented workspace collaborators without read access from querying
histories for private documents.
* **Tests**
* Added an end-to-end test to verify history access is denied when the
required permission is missing.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

2026-07-03 18:08:24 +08:00

..

backend

fix: enforce Doc.Read permission on workspace histories field (#15192)

2026-07-03 18:08:24 +08:00

common

feat(server): impl storage runtime (#15181)

2026-07-01 22:24:10 +08:00

frontend

fix(core): handle unsupported server error (#15164)

2026-06-29 00:03:02 +08:00