48d29d4a6b
evaluation.getDiscussion and evaluation.addComment were juryProcedure that took projectId+roundId from input but never verified the caller had an Assignment for that project+round. A juror could read foreign deliberations and inject comments into them. evaluation.getCOIStatus was protectedProcedure with no ownership check, returning the full ConflictOfInterest record (including the free-text description that captures personal/financial relationships) for any assignmentId. Both now check that admins are allowed always and otherwise require assignment ownership. getCOIStatus loads the assignment to verify caller ownership before returning the COI record. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>