diff --git a/server-rs/crates/api-server/src/editor_project.rs b/server-rs/crates/api-server/src/editor_project.rs
index 07ee7ea07..f74c796a4 100644
--- a/server-rs/crates/api-server/src/editor_project.rs
+++ b/server-rs/crates/api-server/src/editor_project.rs
@@ -4327,6 +4327,10 @@ fn ensure_editor_image_edit_target_matches_source(
     )
 }
 
+/// 定点取一条编辑器引用记录（项目资源或素材）。
+///
+/// 调用方必须传**已认证用户自己的 ID**：这里不做任何授权判断，给什么 owner 就按什么
+/// owner 查，传客户端可控的值等于开了越权读取的口子。
 pub(crate) async fn resolve_editor_reference_record_by_id_for_owner(
     state: &AppState,
     owner_user_id: &str,