A project member can be a GUEST. In a private project a guest only sees
the tickets they take part in (opened, assigned or followed): every other
ticket answers 404, also in my work, realtime changes, blockers and
linked tickets, and project-wide views (activity, statistics, dashboard,
releases, sprints, epics, trash) answer 403. Guests open tickets without
assigning or planning them, and comment, attach, follow and vote on their
own; they change nothing else. In a public project they see what anyone
does. The web gives them only Tablero, Lista and Miembros and loads none
of the project-wide data.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- Query DTO properties with a default value (limit, offset, days, perColumn,
assignedToMe, search, archived, requiresReason, force) were documented as
`object` in openapi.json, which broke generated clients. They now declare
their type explicitly.
- Reading a private project, ticket, release or its comments without access
answered "Project <internal id> not found", confirming the project exists.
ReadAccess now reports what the caller asked for (e2e covered).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
