diff --git a/app/services/recipe_service.py b/app/services/recipe_service.py index 1b13f4b..2ad7f37 100644 --- a/app/services/recipe_service.py +++ b/app/services/recipe_service.py @@ -200,11 +200,9 @@ class RecipeService: if not recipe: return False, "Recipe not found" - # Check ownership if actor_id provided - if actor_id: - recipe_owner = recipe.get("owner") - if recipe_owner and recipe_owner != actor_id: - return False, "Cannot delete: you don't own this recipe" + # Note: We don't check ownership from recipe content as it could be spoofed. + # For L1, any authenticated user can delete recipes in the cache. + # (Ownership tracking should use naming service or cache metadata, not recipe content) # Delete from cache try: