Moheeb Zara 705a93291b fix(roles): pin assignCustomRole to the caller's space (D4) ...

assignCustomRole inserted {member_id, custom_role_id} with no space
check on either; the RLS WITH CHECK only validated member_id's space,
so an admin of space A could attach space B's custom role to an A
member. Now both the custom role and the target member are verified
in the caller's space before insert. (Blast radius was bounded by
downstream space re-filtering; this closes the scoping defect.)

2026-05-18 18:32:07 -07:00

..

area-leads.ts

harden: defense-in-depth on vote/signup/area-lead boundaries

2026-05-16 22:21:01 -07:00

areas.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

certifications.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

classes.ts

harden: defense-in-depth on vote/signup/area-lead boundaries

2026-05-16 22:21:01 -07:00

comms.ts

fix(security): close member self-escalation + harden after full audit

2026-05-15 17:35:11 -07:00

contacts.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

door.ts

feat(door): member /doors page (self-entry + my cards + my activity)

2026-05-16 21:45:17 -07:00

equipment.ts

fix(equipment): DB-enforced reservation no-overlap (D1, P0)

2026-05-18 18:26:19 -07:00

forms.ts

fix(forms): link by an email collected as a form field, not only submitter_email

2026-05-17 00:31:33 -07:00

forum.ts

fix(security): close member self-escalation + harden after full audit

2026-05-15 17:35:11 -07:00

imports.ts

feat: import row validation + KB/process per-item ACLs

2026-05-15 18:33:53 -07:00

incidents.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

index.ts

feat(notifications): P2e member self-view on /me + docs

2026-05-17 04:58:46 -07:00

invites.ts

feat(invites): role-granting + usage-capped invites; audit hardening (P7)

2026-05-16 17:34:45 -07:00

knowledge-base.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

member-cards.ts

feat(door): P1 member access cards + door permissions

2026-05-16 20:13:22 -07:00

members.ts

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

notifications.ts

feat(notifications): P2e member self-view on /me + docs

2026-05-17 04:58:46 -07:00

onboarding.ts

test(forms): extract pure decision logic and add exhaustive coverage

2026-05-16 16:40:09 -07:00

payments.ts

feat(me): my-payments self-view in the Membership tab (P3d)

2026-05-18 15:50:34 -07:00

permissions.ts

feat: customizable permissions, per-item Ops ACLs, area-lead roles

2026-05-15 17:15:14 -07:00

policies.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

presence.ts

feat(presence): check-in/out + present/attendance actions

2026-05-16 22:14:02 -07:00

projects.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

proposals.ts

harden: defense-in-depth on vote/signup/area-lead boundaries

2026-05-16 22:21:01 -07:00

roles.ts

fix(roles): pin assignCustomRole to the caller's space (D4)

2026-05-18 18:32:07 -07:00

secrets.ts

fix(secrets): honor ops.secrets.read permission for reveal/list

2026-05-16 19:07:06 -07:00

settings.ts

fix(security): vault integration secrets instead of plaintext config (R1)

2026-05-18 13:08:17 -07:00

stripe.ts

fix(billing): deep-audit P0/P1 fixes for the pinned Stripe API (2026-04-22.dahlia)

2026-05-17 03:46:08 -07:00

tasks.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

tiers.ts

feat: forum, polymorphic comments, custom tiers, multi-invite, secrets encryption

2026-05-14 17:47:52 -07:00