Moheeb ZaraandClaude Opus 4.8 7fe3ffc632 fix(invites): block re-arming an admin invite without role change (M1) ...

updateInvite ran the canAssignInviteRole guard only when the payload included
'role', so a board member could re-enable/extend an exhausted admin-granting
invite (is_enabled/max_uses/expires_at) and distribute admin access they cannot
mint. Load the existing invite and require canAssignInviteRole against its
effective role whenever any privilege-affecting field is (re-)armed.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-08-01 21:31:51 -07:00

..

actions.test.ts

test: replace tautological actions.test with real authz/IDOR tests

2026-08-01 21:23:04 -07:00

api-call-logic.test.ts

Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

2026-05-20 20:45:44 -07:00

auth-config.test.ts

feat(auth): gate OAuth buttons on login behind config flags

2026-05-16 18:26:36 -07:00

auth-helpers.test.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

certifications.test.ts

feat(certifications): pure expiry/status logic + Zod schemas

2026-05-16 18:52:53 -07:00

classes-logic.test.ts

test: audit-driven coverage for security-relevant pure logic

2026-05-16 22:29:58 -07:00

components.test.tsx

feat: add comprehensive test suites

2026-03-11 08:00:22 +00:00

door-log-logic.test.ts

fix(door): correct parseHeatSyncLog stale time + token reuse (L5)

2026-08-01 21:31:34 -07:00

door-logic.test.ts

fix(door): block hex IPv4-mapped IPv6 in the SSRF filter (M3)

2026-08-01 21:31:34 -07:00

door-slots-logic.test.ts

feat(door): P3-B pure slot allocator (lowest-free, range-generic) + tests

2026-05-16 21:07:36 -07:00

dues-payments-logic.test.ts

fix(payments): advance-only last_paid_at, no dues regression (M4/M5)

2026-08-01 21:31:34 -07:00

email-send.test.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

equipment-logic.test.ts

feat(equipment): pure overlap/eligibility logic + Zod schemas

2026-05-16 19:50:00 -07:00

forms.test.ts

fix(forms): link by an email collected as a form field, not only submitter_email

2026-05-17 00:31:33 -07:00

governance.test.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

incident-tracking.test.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

invite-claim.test.ts

fix(invites): close single-use invite max_uses TOCTOU (H1)

2026-08-01 21:16:12 -07:00

invite-logic.test.ts

test: audit-driven coverage for security-relevant pure logic

2026-05-16 22:29:58 -07:00

invite-rearm.test.ts

fix(invites): block re-arming an admin invite without role change (M1)

2026-08-01 21:31:51 -07:00

markdown-anchors.test.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

notifications-enqueue.test.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

notifications-logic.test.ts

notifications(P4g): strip URLs from user-controlled render inputs

2026-05-19 17:24:01 -07:00

notifications-prefs-logic.test.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00

observability.test.ts

observability: backend-agnostic error-capture seam (Phase 1, inert until SENTRY_DSN)

2026-05-21 17:00:37 -07:00

paypal-logic.test.ts

refactor(paypal): extract + unit-test sync mapping; reuse auth helper (R3)

2026-05-18 13:13:16 -07:00

permissions-catalog.test.ts

test: audit-driven coverage for security-relevant pure logic

2026-05-16 22:29:58 -07:00

permissions.test.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

presence-logic.test.ts

feat(attendance): richer /attendance (here-now, search, day filter, grouping)

2026-05-16 22:42:07 -07:00

secrets-vault.test.ts

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

security.test.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

stripe-logic.test.ts

feat(billing): P1b pure Stripe dues logic + 10 tests

2026-05-17 02:59:02 -07:00

stripe-webhook-logic.test.ts

fix(money): zero-decimal currency handling (D7)

2026-05-18 18:38:25 -07:00

utils.test.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

validations.test.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00