The answer
Membership often belongs to a particular wedding. A person may organize their own wedding and collaborate on another, so permission checks must consider the target wedding.
How should authentication and authorization be represented in the architecture?
Why can one user's role differ between two weddings?
More FAQs in How should authentication and authorization be represented in the architecture?
No. A caller can send requests without using that button. The server must independently verify identity, resource membership, and permission before reading or changing protected data.
Review access after membership removal, cross-wedding resource identifiers, restricted fields, and guest invitation scope. These examples reveal gaps that a successful organizer login does not exercise.
Still have questions?
Browse all our FAQs or reach out to our support team
Want to upskill yourself?
Your learning library
Small steps. Big possibilities.
Find your next course. Build something great.