dextmorgn dd9caf2cb1 fix(api): enforce object-level authorization on Flow update/delete/read ...

Flow update, delete, and ID-based read never checked caller identity
against the target record, so any authenticated user could tamper with
or delete another user's Flow by UUID, and the list endpoint returned
every user's flows unfiltered. Added a nullable owner_id column (NULL
= pre-existing flows, readable by all but not editable via the API),
stamp it on create, and check ownership in FlowService before mutating
or returning a single Flow.

Fixes GHSA-qvx2-6v5v-wwrg.

2026-08-23 13:10:11 +02:00

..

core

test(core): factor out env-independent no-connection repo setup

2026-06-05 15:26:08 +02:00

import

feat(types): detect MD5/SHA1/SHA256 file hashes on import

2026-06-09 11:30:37 +05:30

repositories

fix(core/tests): update failing test

2026-04-11 14:44:29 +02:00

services

fix(api): enforce object-level authorization on Flow update/delete/read

2026-08-23 13:10:11 +02:00

templates

feat: progress on enricher templates

2026-02-12 22:03:28 +01:00

utils

feat(core): cleaner code separation + usage of nodeLabel

2026-01-21 17:17:13 +01:00

vault

Fix zip alignment mismatch, phone validation return value, and vault owner_id type matching

2026-06-04 21:46:44 +03:00

__init__.py

fix(core): keys for transforms are now only fetched from vault

2025-11-01 12:51:32 +01:00

conftest.py

test: provide dummy Neo4j credentials in conftest

2026-06-05 15:34:58 +02:00

factories.py

Use timezone-aware Scan start defaults

2026-07-25 00:30:50 +08:00