From ba1ac55d503cce3c4cb342bb015ce17948e60ec9 Mon Sep 17 00:00:00 2001
From: Michal Feher <feher@studiotem.com>
Date: Thu, 4 Dec 2025 14:21:44 +0100
Subject: [PATCH] no message

---
 be/routes/api.php | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/be/routes/api.php b/be/routes/api.php
index 27df575..109c178 100644
--- a/be/routes/api.php
+++ b/be/routes/api.php
@@ -87,13 +87,21 @@ Route::middleware(['auth:sanctum', 'abilities:full-access'])->group(function ()
     Route::post('/v1/mastertasks/{id}/subtasks', SubTaskController::class . '@store');
     Route::put('/v1/subtasks/{id}', SubTaskController::class . '@update');
 
-    Route::get('/v1/subtasks/{id}', function ($id) {
+    Route::get('/v1/subtasks/{id}', function ($id, Request $request) {
         $subtask = SubTask::find($id);
         
         if (!$subtask) {
             return response()->json(['message' => 'Subtask not found.'], 404);
         }
         
+        // draft môže vidieť len jeho vlastník
+        if ($subtask->is_draft) {
+            $userId = User::getUserIdFromBearerToken($request->bearerToken());
+            if ($subtask->user_id != $userId && $subtask->created_by != $userId) {
+                return response()->json(['message' => 'Subtask not found.'], 404);
+            }
+        }
+        
         return new SubTaskResource($subtask);
     });
     Route::post('/v1/subtasks/{id}/timesheet', SubTaskController::class . '@submitTimesheet');