From 5aed3a5539ef3990ab6c674bc721b217edaaee54 Mon Sep 17 00:00:00 2001
From: mikeyhenein <mikeyhenein@users.noreply.github.com>
Date: Mon, 2 Nov 2026 20:28:37 -0800
Subject: [PATCH] Reject unknown keys in PUT /api/users/:id/permissions (an
 extra key crashes the backend)

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 backend/schema/components/permission-object.json | 1 +
 1 file changed, 1 insertion(+)

diff --git a/backend/schema/components/permission-object.json b/backend/schema/components/permission-object.json
index cae9d26c0..9bb5bfffa 100644
--- a/backend/schema/components/permission-object.json
+++ b/backend/schema/components/permission-object.json
@@ -1,6 +1,7 @@
 {
 	"type": "object",
 	"minProperties": 1,
+	"additionalProperties": false,
 	"properties": {
 		"visibility": {
 			"type": "string",