From ba039f9872939645e21b654499852f5c4b119c2c Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 10:10:37 +0000
Subject: [PATCH 1/2] Initial plan


From 7a07c1246b53fb1f75b63d089f4b0d24e60a0068 Mon Sep 17 00:00:00 2001
From: "copilot-swe-agent[bot]" <198982749+Copilot@users.noreply.github.com>
Date: Fri, 28 Nov 2025 10:16:10 +0000
Subject: [PATCH 2/2] Add RBAC middleware to activity log API endpoints for
 consistency

Co-authored-by: QingSH-J <112738576+QingSH-J@users.noreply.github.com>
---
 backend/routes/routes.go | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/backend/routes/routes.go b/backend/routes/routes.go
index 34f42ec..1282130 100644
--- a/backend/routes/routes.go
+++ b/backend/routes/routes.go
@@ -201,10 +201,16 @@ func SetupRoutes(db *gorm.DB, cfg *config.Config) *gin.Engine {
 		)
 
 		// 看板活动日志
-		protected.GET("/boards/:boardId/activities", boardActivitiesHandler.GetBoardActivities)
+		protected.GET("/boards/:boardId/activities",
+			rbac.RequireProjectAccess("view", "boardId", "board"),
+			boardActivitiesHandler.GetBoardActivities,
+		)
 
 		// 任务活动日志
-		protected.GET("/tasks/:taskId/activities", taskActivitiesHandler.GetTaskActivities)
+		protected.GET("/tasks/:taskId/activities",
+			rbac.RequireProjectAccess("view", "taskId", "task"),
+			taskActivitiesHandler.GetTaskActivities,
+		)
 	}
 
 	return r