Enforce lead contact-info privacy rights

FeatureSecurityService
Shipped
July 7, 2026 at 12:33 AM UTC
Author
Kamo
Commit
e1745a8

getAllLeads now returns the lean LeadListDTO and hides unassigned leads from members without VIEW_UNASSIGNED_LEADS. getLeadById masks contact info (state preserved) for leads not assigned to the caller unless they hold VIEW_LEAD_CONTACT_INFO_OTHERS, and 403s unassigned leads for those lacking VIEW_UNASSIGNED_LEADS. updateLead gates manual reassignment (ASSIGN_LEADS) and contact-info edits **************** counting mortgage property fields only when actually changed. God bypass.

All changes

Like what you see shipping?

Every one of these updates lands in your workspace automatically. Start free and watch it grow week after week.

Start Free ForeverView Pricing