Moheeb Zara 705a93291b fix(roles): pin assignCustomRole to the caller's space (D4) ...

assignCustomRole inserted {member_id, custom_role_id} with no space
check on either; the RLS WITH CHECK only validated member_id's space,
so an admin of space A could attach space B's custom role to an A
member. Now both the custom role and the target member are verified
in the caller's space before insert. (Blast radius was bounded by
downstream space re-filtering; this closes the scoping defect.)

2026-05-18 18:32:07 -07:00

..

actions

fix(roles): pin assignCustomRole to the caller's space (D4)

2026-05-18 18:32:07 -07:00

door

feat(door): P2 connections + SSRF-safe executor + native adapter + audit

2026-05-16 20:31:43 -07:00

email

feat(notifications): P2b email transport seam (Resend via fetch)

2026-05-17 04:50:34 -07:00

secrets

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

stripe

refactor(stripe): extract + unit-test webhook decision logic (R2)

2026-05-18 13:11:09 -07:00

supabase

refactor: generate and use Supabase TypeScript types

2026-03-11 08:12:39 +00:00

auth-actions.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

auth-config.ts

feat(auth): gate OAuth buttons on login behind config flags

2026-05-16 18:26:36 -07:00

auth-helpers.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

certifications-guard.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

certifications-logic.ts

feat(certifications): pure expiry/status logic + Zod schemas

2026-05-16 18:52:53 -07:00

classes-guard.ts

feat(classes): server actions + page guard

2026-05-16 19:32:17 -07:00

classes-logic.ts

feat(classes): optional required-form gate at signup (waiver-on-file)

2026-05-16 21:41:01 -07:00

door-guard.ts

feat(door): P2 connections + SSRF-safe executor + native adapter + audit

2026-05-16 20:31:43 -07:00

door-logic.ts

harden(door): correct IPv6 pin handling via pure normalizeHost

2026-05-16 22:39:25 -07:00

door-slots-logic.ts

feat(door): P3-B pure slot allocator (lowest-free, range-generic) + tests

2026-05-16 21:07:36 -07:00

equipment-guard.ts

feat(equipment): server actions + page guard

2026-05-16 19:51:51 -07:00

equipment-logic.ts

feat(equipment): pure overlap/eligibility logic + Zod schemas

2026-05-16 19:50:00 -07:00

form-templates.ts

feat(forms): obvious publish flow, member Forms surface, templates (P8)

2026-05-16 17:41:16 -07:00

forms-guard.ts

feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

2026-05-16 17:21:39 -07:00

forms-logic.ts

fix(forms): link by an email collected as a form field, not only submitter_email

2026-05-17 00:31:33 -07:00

forms-schema.ts

feat(forms): server actions, Zod schemas, and dynamic answer validation (Phase 2)

2026-05-16 14:51:20 -07:00

incident-logic.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

invite-logic.ts

feat(invites): role-granting + usage-capped invites; audit hardening (P7)

2026-05-16 17:34:45 -07:00

markdown-anchors.ts

feat(markdown): KB/process render + working in-document anchor links

2026-05-16 19:11:49 -07:00

notifications-logic.ts

fix(notifications): P2 extreme-audit P1 fixes before deploy

2026-05-17 05:06:02 -07:00

paypal-logic.ts

refactor(paypal): extract + unit-test sync mapping; reuse auth helper (R3)

2026-05-18 13:13:16 -07:00

permissions-cache.ts

perf(ux): request-cached permission checks (dedupe RPC fan-out)

2026-05-17 01:36:54 -07:00

permissions-catalog.ts

feat(door): P1 member access cards + door permissions

2026-05-16 20:13:22 -07:00

permissions.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

presence-logic.ts

feat(attendance): richer /attendance (here-now, search, day filter, grouping)

2026-05-16 22:42:07 -07:00

role-labels.ts

feat: Customize hub + roles editor, terminal logo, invite links

2026-05-15 16:03:52 -07:00

security.ts

feat: comprehensive application audit and fixes

2026-03-11 08:18:57 +00:00

stripe-logic.ts

feat(billing): P1b pure Stripe dues logic + 10 tests

2026-05-17 02:59:02 -07:00

types.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

utils.ts

Initial commit from v0

2026-03-11 04:44:48 +00:00

validations.ts

feat(me): self-service email change, verified (P3e)

2026-05-18 15:53:39 -07:00