OTWO-7729 Project id and enlistment id relationship not validated in …

[Niharika1117]

…enlistment API

[Copilot]

Pull request overview

This PR fixes an enlistment API integrity issue by ensuring the project_id in the route is actually used to scope the enlistment lookup, preventing cross-project access to enlistments by ID.

Changes:

• Scope enlistment lookup to @project.enlistments so an enlistment from another project returns 404.
• Add a controller test verifying show returns 404 when the enlistment belongs to a different project.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File	Description
app/controllers/concerns/enlistment_filters.rb	Scopes find_enlistment to the current project to enforce the project/enlistment relationship.
test/controllers/enlistments_controller_test.rb	Adds regression coverage for the 404 behavior when project/enlistment mismatch occurs.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.