Update

backend/app/api/routes/external.py

@@ -1,6 +1,6 @@
 from __future__ import annotations
 
-from fastapi import APIRouter, Depends
+from fastapi import APIRouter, Depends, Request
 from sqlalchemy.orm import Session
 
 from app.core.errors import AppError
@@ -43,6 +43,19 @@ def _assert_project_exists(db: Session, project_id):
         raise AppError(code="PROJECT_NOT_FOUND", message="Project not found", status_code=404)
 
 
+def _assert_guest_project_scope(request: Request, project_id) -> None:
+    principal = getattr(request.state, "auth_principal", None)
+    if (
+        getattr(principal, "role", None) == "guest"
+        and getattr(principal, "project_id", None) != project_id
+    ):
+        raise AppError(
+            code="GUEST_PROJECT_SCOPE_REQUIRED",
+            message="Deze gastensessie heeft alleen toegang tot de GeoIntel-demowerkruimte.",
+            status_code=403,
+        )
+
+
 def _normalize_layer_input(layers: list[str] | None) -> list[str]:
     return [layer.strip() for layer in (layers or []) if isinstance(layer, str) and layer.strip()]
 
@@ -66,7 +79,12 @@ def get_coverage_catalog() -> dict:
 
 
 @router.post("/coverage/resolve", response_model=Envelope[CoverageResolveResponse])
-def resolve_project_coverage(payload: CoverageResolveRequest, db: Session = Depends(get_db)) -> dict:
+def resolve_project_coverage(
+    payload: CoverageResolveRequest,
+    request: Request,
+    db: Session = Depends(get_db),
+) -> dict:
+    _assert_guest_project_scope(request, payload.project_id)
     result = CoverageRegistryService.resolve(
         db,
         project_id=payload.project_id,