Files
Michael Ramos d53cbfb373 fix(annotate): enforce archive read-only surfaces (#1171)
* fix(annotate): enforce archive read-only surfaces

* fix(archive): close remaining read-only leaks
2026-07-31 17:23:44 -07:00

17 lines
495 B
TypeScript

const ARCHIVE_POST_MUTATIONS = new Set([
"/api/approve",
"/api/deny",
"/api/draft",
"/api/save-notes",
"/api/upload",
]);
/**
* Return whether an HTTP request would mutate document-review state and must
* therefore be rejected by the standalone archive server.
*/
export function isArchiveDocumentMutation(method: string, pathname: string): boolean {
return (method === "POST" && ARCHIVE_POST_MUTATIONS.has(pathname))
|| (method === "DELETE" && pathname === "/api/draft");
}