Michael Freno 3bb3e80b77 security: lock down public S3 procedures and sanitize keys (p8-001, p8-008) ...

- Convert simpleDeleteImage, deleteImage, getPreSignedURL, listAttachments
  from publicProcedure to csrfProtectedProcedure
- Add S3 type allowlist validation to prevent path traversal
- Sanitize title/filename inputs for S3 key construction
- Add ownership checks on delete operations
- Remove hashPassword/checkPassword procedures (bcrypt internals)
- Add regression tests for sanitization and validation

Fixes: p8-001 (anonymous S3 deletion), p8-008 (public presigned URL with unsanitized type)

2026-07-22 17:37:58 -04:00

..

components

cleanup

2026-05-28 20:22:30 -04:00

context

quick fix

2026-02-02 15:24:28 -05:00

db

checkpoint

2026-01-21 12:22:19 -05:00

env

security cleanup, fix turnstile

2026-05-28 16:48:06 -04:00

lib

cleanup

2026-05-28 20:22:30 -04:00

lineage-json

continued migration

2025-12-16 23:31:12 -05:00

routes

lineage analytics

2026-07-13 13:26:08 -04:00

server

security: lock down public S3 procedures and sanitize keys (p8-001, p8-008)

2026-07-22 17:37:58 -04:00

types

cleanup

2026-05-28 20:22:30 -04:00

app.css

simplifying

2026-01-06 11:13:49 -05:00

app.tsx

somehow this works better

2026-02-10 13:10:12 -05:00

config.ts

turnstile added

2026-05-28 10:24:23 -04:00

entry-client.tsx

hopefully this solves random hanging

2026-01-07 20:53:21 -05:00

entry-server.tsx

color pref persistence

2025-12-31 01:44:00 -05:00

global.d.ts

init

2025-12-16 22:42:05 -05:00