Why can one user's role differ between two weddings?
Membership often belongs to a particular wedding. A person may organize their own wedding and collaborate on another, so permission checks must consider the target wedding.
Explore This Question
Search for additional explanations using these tools:
More FAQs in How should authentication and authorization be represented in the architecture?
No. A caller can send requests without using that button. The server must independently verify identity, resource membership, and permission before reading or changing protected data.
Review access after membership removal, cross-wedding resource identifiers, restricted fields, and guest invitation scope. These examples reveal gaps that a successful organizer login does not exercise.
Still have questions?
Browse all our FAQs or reach out to our support team