3bb3e80b77
security: lock down public S3 procedures and sanitize keys (p8-001, p8-008)
...
- Convert simpleDeleteImage, deleteImage, getPreSignedURL, listAttachments
from publicProcedure to csrfProtectedProcedure
- Add S3 type allowlist validation to prevent path traversal
- Sanitize title/filename inputs for S3 key construction
- Add ownership checks on delete operations
- Remove hashPassword/checkPassword procedures (bcrypt internals)
- Add regression tests for sanitization and validation
Fixes: p8-001 (anonymous S3 deletion), p8-008 (public presigned URL with unsanitized type)
2026-07-22 17:37:58 -04:00
333ea9a28a
fix(p8-003): enforce club membership checks on 7 community endpoints
...
Enforce requireClubMembership on social.getPost, addComment, comments,
like, unlike, challenges.leave, and challenges.submitProgress so private
club content is not readable/actionable by non-members (was IDOR).
Extract the membership helpers (requireClubMembership,
resolveClubIdFromPost, resolveClubIdFromChallenge) into a shared
dependency-free module (nessa-community-authz.ts) so all membership-gated
endpoints use one implementation and the libsql connection surface is
typed uniformly. Each post/challenge endpoint now resolves the owning
clubId first (NOT_FOUND if the resource is missing) then gates on it.
Add regression tests (nessa-community-authz.test.ts) covering: non-member
FORBIDDEN vs member allowed for all 7 endpoints' resolve→require sequences,
NOT_FOUND for missing post/challenge, and a join→allowed→leave→blocked
integration.
2026-07-22 16:58:08 -04:00
0c29135bad
nessa routes
2026-07-13 14:11:46 -04:00
52174c94dc
lineage analytics
2026-07-13 13:26:08 -04:00
d48bbc0fc3
security cleanup, fix turnstile
2026-05-28 16:48:06 -04:00
fbc8215410
turnstile added
2026-05-28 10:24:23 -04:00
8b6551330f
input halo sections, sparkle handling
2026-04-30 06:38:54 -04:00
3635133994
fix github activity
2026-04-06 14:41:30 -04:00
4dbd0ac965
(sidebar)forget redis, better parallization
2026-04-06 13:32:46 -04:00
80daaa29dc
quick fix
2026-02-02 15:24:28 -05:00
cda7784298
fix email link
2026-01-25 09:41:50 -05:00
b25fc50156
more endpoints for nessa
2026-01-24 19:51:05 -05:00
d7c91ac6c5
rename
2026-01-24 19:31:14 -05:00
e6d5b40acd
remove test endpoint
2026-01-21 15:50:49 -05:00
955c856a85
fix: analytics and deprecated warning
2026-01-21 13:58:34 -05:00
7b60494d6d
fix: duplication error
2026-01-21 12:57:58 -05:00
58d48dac70
checkpoint
2026-01-21 12:22:19 -05:00
1d8ec7a375
temp
2026-01-21 11:29:07 -05:00
6b86d175e8
rename
2026-01-21 08:45:14 -05:00
0abe064afd
fix
2026-01-21 03:03:08 -05:00
5fc082178c
cairn work
2026-01-21 01:56:54 -05:00
48f01b6171
fix: safari cookie issue
2026-01-13 19:19:00 -05:00
9d6c32d8b0
fix: corrected github recent commits
2026-01-13 09:48:27 -05:00
4d35935462
remember me fix
2026-01-12 16:17:22 -05:00
f68f1f462a
session state simplification
2026-01-12 09:24:58 -05:00
ed16b277f7
general: console cleanup
2026-01-12 00:24:24 -05:00
99e5323871
fix: should fix issues with login/session handling
2026-01-11 20:18:01 -05:00
9cccd0c6b3
feat: auto-update signaler for Gaze
2026-01-11 17:43:04 -05:00
9fc0a73fea
general: hot path cooldown
2026-01-11 14:24:28 -05:00
c8c1b754b1
downloads fix
2026-01-11 13:40:43 -05:00
1fb8f45705
fix: session validation fixes
2026-01-11 11:23:32 -05:00
8f241ce611
adjust email/pass addition flow, blog ttl extended
2026-01-07 21:21:27 -05:00
fa28266bad
revert bundle change
2026-01-07 20:34:23 -05:00
f056cf05d3
hopeful
2026-01-07 20:19:26 -05:00
244c8b6fb5
callback change
2026-01-07 18:53:41 -05:00
1b3c832fc3
change template loading
2026-01-07 18:17:58 -05:00
6a934880f9
mostly working
2026-01-07 17:53:21 -05:00
5b0f6dba0f
fixing things
2026-01-07 16:50:10 -05:00
0a0c0e313e
migrated
2026-01-07 16:22:31 -05:00
041b2f8dc2
oof
2026-01-07 14:37:40 -05:00
5e247e54cb
fix rate limit async issue, kill old code
2026-01-06 23:52:51 -05:00
08a9ad35af
updating auth token security
2026-01-06 23:11:19 -05:00
ea556b3677
fledged out analytics, self gather, remove vercel speed insights
2026-01-06 01:34:55 -05:00
d2ee61b830
analytics page
2026-01-06 00:40:44 -05:00
61303969e8
load previous attachments, video support
2026-01-05 18:52:50 -05:00
7e89e6dda2
removed excess comments
2026-01-04 11:14:54 -05:00
cb33f36377
removed old stuff
2026-01-03 09:56:16 -05:00
0fb071a5d7
password validation meter
2026-01-01 14:51:23 -05:00
8e77727148
config centralized
2026-01-01 02:22:33 -05:00
6e31246060
lockout
2025-12-30 09:50:04 -05:00
