2 Commits

Author	SHA1	Message	Date
Marcel Raddatz	40a6a0e92d	fix(security): use generic forbidden message to avoid leaking required role ... Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-06 19:46:24 +02:00
Marcel Raddatz	3be9f502c6	feat(auth): add @RequiresHouseholdRole annotation with interceptor ... Reusable annotation for planner-only endpoints. Uses a HandlerInterceptor that resolves the household role from the authenticated user and throws 403 if the role doesn't match. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-04-04 18:22:47 +02:00