Tree: b1473be414

cached-config-operations

main

revert-7033-patch-1

test_dylint

v2-registration

0.10.0

0.11.0

0.12.0

0.13.0

0.9.0

1.0.0

1.1.0

1.10.0

1.11.0

1.12.0

1.13.0

1.13.1

1.14

1.14.1

1.14.2

1.15.0

1.15.1

1.16.0

1.16.1

1.16.2

1.16.3

1.17.0

1.18.0

1.19.0

1.2.0

1.20.0

1.21.0

1.22.0

1.22.1

1.22.2

1.23.0

1.23.1

1.24.0

1.25.0

1.25.1

1.25.2

1.26.0

1.27.0

1.28.0

1.28.1

1.29.0

1.29.1

1.29.2

1.3.0

1.30.0

1.30.1

1.30.2

1.30.3

1.30.4

1.30.5

1.31.0

1.32.0

1.32.1

1.32.2

1.32.3

1.32.4

1.32.5

1.32.6

1.32.7

1.33.0

1.33.1

1.33.2

1.34.0

1.34.1

1.34.2

1.34.3

1.35.0

1.35.1

1.35.2

1.35.3

1.35.4

1.35.5

1.35.6

1.35.7

1.35.8

1.36.0

1.37.0

1.37.1

1.4.0

1.5.0

1.6.0

1.6.1

1.7.0

1.8.0

1.9.0

1.9.1

Branches Tags

${ item.name }

Create tag ${ searchTerm }

Create branch ${ searchTerm }

from 'b1473be414'

${ noResults }

Commit Graph

2 Commits (b1473be414ad273c60a06a5dea0723efba0699d8)

Author	SHA1	Message	Date
Rune Darrud	b1473be414	Harden the Public API member and group write endpoints Adversarial review of the new endpoints turned up several defects. Ownership is now out of reach of a Public API client. The internal endpoints only let an Owner grant, change or remove Owner, and that check cannot be applied here because there is no user behind the request. Since the organization API key can be created by an Admin, a client could previously promote itself to Owner and take over the organization. Granting the Owner role and acting on an existing owner are both refused now, which subsumes the narrower last confirmed owner guard. An omitted groups list on a member update no longer unassigns every group. Upstream leaves group access untouched when the field is absent and only collections reset on omission, so groups is optional now. An omitted accessAll on a group update no longer clears the flag, and an omitted externalId no longer clears the directory matching key that /public/organization/import relies on to match members and groups. Revoked members are reported with the upstream status of -1 instead of the internal offset encoding, matching every other serializer in the codebase. Restore refuses a member who is not revoked, rather than saving nothing and logging a restore that did not happen, and group creation is logged before its collection associations so a failure cannot leave an unaudited group. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	5 days ago
Rune Darrud	2a9c148f1d	Add smoke test for the Public API member and group write endpoints Boots a throwaway instance against a seeded SQLite database and exercises every member and group write endpoint end to end, asserting on the resulting state rather than just the status code. Covers the guards that protect organization integrity: the last confirmed owner cannot be demoted, revoked or deleted; collections, groups and members from another organization are rejected; ids belonging to another organization return 404; and writes require a token. It also pins two behaviours that are easy to regress: a group update leaves member assignments alone, and every write is recorded in the event log with no acting user and no device type. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>	5 days ago