[yashranaway]

sharing a cap checked that you're in the space's organisation, but not that you can actually get into the space. so any org member could put their own video into a private space they weren't part of.

now newly added private spaces go through the same access check folder moves already use, so space members, the creator and org admins can still share, and it runs before anything is written. spaces the cap is already in are left alone, so losing access later doesn't block saving the other settings.

Confidence Score: 5/5

The PR appears safe to merge; no new actionable issues were found.

Summary

This PR checks access before adding a Cap to a private space.

• Cap sharing checks access before adding a private space.

_{Reviews (2) · Last reviewed commit: "test(web): cover existing organization s..." · Reviewed by Greptile}

[yashranaway]

@greptileai review

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

1 Skipped Deployment

Project	Deployment	Actions	Updated
cap-status	Skipped		Oct 23, 2026 9:40pm UTC

[greptile-apps]

Existing shares are untested

This denial test starts with no existing organization shares, and the mock always returns an empty result for sharedVideos. Moving the access check below the organization-share writes would therefore still pass this test. Add an existing organization share that the request would remove, then assert that denial leaves it untouched and makes no writes.

Prompt To Fix With AI

This is a comment left during a code review.
Path: apps/web/__tests__/unit/share-cap-authorization.test.ts
Line: 102-106

Comment:
**Existing shares are untested**

This denial test starts with no existing organization shares, and the mock always returns an empty result for `sharedVideos`. Moving the access check below the organization-share writes would therefore still pass this test. Add an existing organization share that the request would remove, then assert that denial leaves it untouched and makes no writes.

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Note: If this suggestion doesn't match your team's coding style, reply to this and let me know. I'll remember it for next time!

[yashranaway]

Fair. The denial test now starts with an org share the request would remove and checks it's still there with no writes. Moving the access check below the writes makes it fail (b00b166).

[richiemcilroy]

@greptileai review