Merge branch 'main' into tofik/cs-189-auditor-view-permission-gating

Author: tofikwest

CHANGELOG.md

@@ -1,3 +1,10 @@
+# [3.26.0](https://github.com/trycompai/comp/compare/v3.25.1...v3.26.0) (2026-04-20)
+
+
+### Features
+
+* **vercel:** add project filter variables and parser helper ([9718d87](https://github.com/trycompai/comp/commit/9718d8704a91afd60a17f74335258e8b5dc89ca7))
+
 ## [3.25.1](https://github.com/trycompai/comp/compare/v3.25.0...v3.25.1) (2026-04-20)
 
 

apps/api/src/policies/policies.service.ts

@@ -1030,6 +1030,11 @@ export class PoliciesService {
 
     if (!policy.pendingVersionId) {
       if (policy.approverId) {
+        if (policy.approverId !== dto.approverId) {
+          throw new BadRequestException(
+            'Only the assigned approver can accept changes',
+          );
+        }
         await db.policy.update({
           where: { id: policyId },
           data: { approverId: null },
@@ -1038,6 +1043,7 @@ export class PoliciesService {
           'This policy has no pending changes to approve. The stale approval request has been cleared — please ask the policy owner to re-submit if a new approval is needed.',
         );
       }
+      }
       throw new BadRequestException('No pending version to approve');
     }