# ResourceKind

**Kind:** Type

**Source:** [`atloria-monorepo/apps/api/src/auth/guards/resource-org.guard.ts`](https://github.com/sherkety/atloria/blob/main/atloria-monorepo/apps/api/src/auth/guards/resource-org.guard.ts#L42)

ResourceOrgGuard — generalized cross-tenant ownership enforcement.

WHY: OrganizationGuard only validates an EXPLICIT `organizationId` present in the request and
no-ops otherwise, so any route scoped only by a child id (`:projectId`, `:versionId`,
`:documentId`, `:id`, …) sails past it. A security audit found this hole recurs across ~16
controllers / 100+ routes, letting any authenticated user read, mutate, or DESTROY another
tenant's data (e.g. DELETE a foreign doc-version and cascade-delete every document in it).
ProjectOrgGuard closed it for `:projectId`; this guard generalizes that to every id type by
resolving the resource → its owning organization and comparing to the caller's.

USAGE (declarative — annotate the route or controller):

## Definition

```ts
| 'project'
  | 'document'
  | 'docVersion'
  | 'documentationJob'
  | 'supportAgentConfig'
  | 'comment'
  | 'suggestion'
  | 'pmeJob'
  | 'pmePage'
  | 'pmeVariant'
  | 'changeRequest'
  | 'scheduledReport'
```