affee407ef
Some checks failed
CI / Unit & Component Tests (push) Has been cancelled
CI / Backend Unit Tests (push) Has been cancelled
CI / E2E Tests (push) Has been cancelled
CI / Unit & Component Tests (pull_request) Successful in 2m42s
CI / Backend Unit Tests (pull_request) Successful in 2m21s
CI / E2E Tests (pull_request) Has been cancelled
@RequirePermission on POST and DELETE annotation endpoints previously only listed ANNOTATE_ALL. Users with WRITE_ALL (but not ANNOTATE_ALL) received 403. A user who can write documents should also be able to annotate them — both permissions now accepted on both methods. Also updates canAnnotate in +layout.server.ts to match, so the UI correctly reflects annotation capability for WRITE_ALL users. Tests: AnnotationControllerTest (+2 RED→GREEN). Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>