From 2684645332b2f72ff003ee97858bd462b61350e9 Mon Sep 17 00:00:00 2001
From: Jared Pereira <jared@awarm.space>
Date: Mon, 23 Feb 2026 18:06:08 -0500
Subject: [PATCH] add check for ownership for standalone

---
 actions/publishToPublication.ts | 15 +++++++++++++++
 1 file changed, 15 insertions(+)

diff --git a/actions/publishToPublication.ts b/actions/publishToPublication.ts
index cbd43c55..8f5075c0 100644
--- a/actions/publishToPublication.ts
+++ b/actions/publishToPublication.ts
@@ -143,6 +143,21 @@ export async function publishToPublication({
       .single();
     draft = data;
     existingDocUri = draft?.document;
+
+    // If updating an existing document, verify the current user is the owner
+    if (existingDocUri) {
+      let docOwner = new AtUri(existingDocUri).host;
+      if (docOwner !== identity.atp_did) {
+        return {
+          success: false,
+          error: {
+            type: "oauth_session_expired" as const,
+            message: "Not the document owner",
+            did: identity.atp_did,
+          },
+        };
+      }
+    }
   }
 
   // Heuristic: Remove title entities if this is the first time publishing
-- 
2.51.2