3bb3e80b77
security: lock down public S3 procedures and sanitize keys (p8-001, p8-008)
...
- Convert simpleDeleteImage, deleteImage, getPreSignedURL, listAttachments
from publicProcedure to csrfProtectedProcedure
- Add S3 type allowlist validation to prevent path traversal
- Sanitize title/filename inputs for S3 key construction
- Add ownership checks on delete operations
- Remove hashPassword/checkPassword procedures (bcrypt internals)
- Add regression tests for sanitization and validation
Fixes: p8-001 (anonymous S3 deletion), p8-008 (public presigned URL with unsanitized type)
2026-07-22 17:37:58 -04:00
333ea9a28a
fix(p8-003): enforce club membership checks on 7 community endpoints
...
Enforce requireClubMembership on social.getPost, addComment, comments,
like, unlike, challenges.leave, and challenges.submitProgress so private
club content is not readable/actionable by non-members (was IDOR).
Extract the membership helpers (requireClubMembership,
resolveClubIdFromPost, resolveClubIdFromChallenge) into a shared
dependency-free module (nessa-community-authz.ts) so all membership-gated
endpoints use one implementation and the libsql connection surface is
typed uniformly. Each post/challenge endpoint now resolves the owning
clubId first (NOT_FOUND if the resource is missing) then gates on it.
Add regression tests (nessa-community-authz.test.ts) covering: non-member
FORBIDDEN vs member allowed for all 7 endpoints' resolve→require sequences,
NOT_FOUND for missing post/challenge, and a join→allowed→leave→blocked
integration.
2026-07-22 16:58:08 -04:00
0c29135bad
nessa routes
2026-07-13 14:11:46 -04:00
52174c94dc
lineage analytics
2026-07-13 13:26:08 -04:00
7dc5166e90
missed
2026-05-28 22:23:21 -04:00
30b2d03c68
cleanup
2026-05-28 20:22:30 -04:00
d48bbc0fc3
security cleanup, fix turnstile
2026-05-28 16:48:06 -04:00
b7187721db
reference fixes
2026-05-28 13:59:46 -04:00
fbc8215410
turnstile added
2026-05-28 10:24:23 -04:00
8b6551330f
input halo sections, sparkle handling
2026-04-30 06:38:54 -04:00
3635133994
fix github activity
2026-04-06 14:41:30 -04:00
4dbd0ac965
(sidebar)forget redis, better parallization
2026-04-06 13:32:46 -04:00
67bf77815e
mermaid loading improved
2026-04-03 14:07:42 -04:00
9c48bc61c0
Flip Github/Gitea order - put Gitea above GitHub in sidebar
2026-04-03 14:07:42 -04:00
6a6feade42
update gaze links
2026-03-27 06:59:26 -04:00
1a60e606de
update min version
2026-03-02 13:18:06 -05:00
e045909acb
somehow this works better
2026-02-10 13:10:12 -05:00
40411104d6
gaze pp
2026-02-10 01:06:57 -05:00
c6e9fccc9a
marketing page
2026-02-09 19:53:50 -05:00
ede56e5bbd
missed this one
2026-02-09 01:02:00 -05:00
ef2968707e
simpler
2026-02-09 01:01:26 -05:00
80daaa29dc
quick fix
2026-02-02 15:24:28 -05:00
cda7784298
fix email link
2026-01-25 09:41:50 -05:00
b25fc50156
more endpoints for nessa
2026-01-24 19:51:05 -05:00
d7c91ac6c5
rename
2026-01-24 19:31:14 -05:00
e6d5b40acd
remove test endpoint
2026-01-21 15:50:49 -05:00
3845c768e2
blog data fixed
2026-01-21 14:04:04 -05:00
955c856a85
fix: analytics and deprecated warning
2026-01-21 13:58:34 -05:00
7b60494d6d
fix: duplication error
2026-01-21 12:57:58 -05:00
58d48dac70
checkpoint
2026-01-21 12:22:19 -05:00
1d8ec7a375
temp
2026-01-21 11:29:07 -05:00
6b86d175e8
rename
2026-01-21 08:45:14 -05:00
0abe064afd
fix
2026-01-21 03:03:08 -05:00
5fc082178c
cairn work
2026-01-21 01:56:54 -05:00
0d006e8260
for new app
2026-01-20 18:14:01 -05:00
3981651736
possible sealsession fix
2026-01-16 00:27:04 -05:00
962456985b
fix: layouting fix
2026-01-14 10:35:35 -05:00
0825c02dbc
general: fix no longer needed logs
2026-01-13 22:24:00 -05:00
6325f963ed
general: passing up inverse
2026-01-13 21:24:25 -05:00
48f01b6171
fix: safari cookie issue
2026-01-13 19:19:00 -05:00
b612d12a51
general: for consistency
2026-01-13 10:49:47 -05:00
9d6c32d8b0
fix: corrected github recent commits
2026-01-13 09:48:27 -05:00
53dc7c1aab
fix: next child chain
2026-01-12 21:03:00 -05:00
744a0cd611
fix: remove await
2026-01-12 20:44:55 -05:00
700efe5c6c
fix: not refreshing token
2026-01-12 19:09:15 -05:00
4d35935462
remember me fix
2026-01-12 16:17:22 -05:00
0286fae8aa
make skeleton loader spinner easier to see
2026-01-12 14:20:45 -05:00
e035f3ddc3
general: mostly logs
2026-01-12 10:34:54 -05:00
f68f1f462a
session state simplification
2026-01-12 09:24:58 -05:00
ed16b277f7
general: console cleanup
2026-01-12 00:24:24 -05:00
