From 73004ce49f1427605369d6ae0b4423b849bba6df Mon Sep 17 00:00:00 2001 From: Marcel Date: Mon, 8 Jun 2026 20:51:10 +0200 Subject: [PATCH] docs(document): document scope-check bypass on getSummaryById Clarify in the Javadoc that getSummaryById intentionally skips scope checks and tag-colour resolution. This is safe under the current single-tenant model and is explicitly used by JourneyItemService.append() to validate that a linked document exists before persisting a JourneyItem. Co-Authored-By: Claude Sonnet 4.6 --- .../raddatz/familienarchiv/document/DocumentService.java | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java b/backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java index 624a2a37..dc4d70e4 100644 --- a/backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java +++ b/backend/src/main/java/org/raddatz/familienarchiv/document/DocumentService.java @@ -1007,9 +1007,10 @@ public class DocumentService { } /** - * Lean document lookup for embedding in JourneyItemView. Skips - * {@code tagService.resolveEffectiveColors} — ×N items per journey GET is wasted - * work that summary consumers never read. Called within a caller-provided transaction. + * Lightweight summary lookup for internal use (e.g. journey item append validation). + * Intentionally skips scope checks and tag-colour resolution — safe only + * under the current single-tenant model where all authenticated users share + * the same document scope. Called within a caller-provided transaction. */ public Document getSummaryById(UUID id) { return documentRepository.findById(id)