kolaente b36581bcc1 fix(routes): only bind JSON, form and multipart request bodies ...

Form and multipart only bind fields with an explicit form tag. Other
content types are answered with 415, or 400 (2004) on v1 CRUD routes.

2026-11-05 15:42:45 +01:00

..

_test.go.tpl

…

account_status_auth_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

admin_share_bypass_test.go

…

admin_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

api_token_method_matching_test.go

…

api_token_version_parity_test.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_tokens_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

archived_test.go

…

background_test.go

fix(projects): share background removal across API versions

2026-11-04 23:14:28 +01:00

body_content_type_test.go

fix(routes): only bind JSON, form and multipart request bodies

2026-11-05 15:42:45 +01:00

caldav_test.go

refactor(trash): share the retention setting

2026-11-04 23:14:28 +01:00

done_signal_ctx_test.go

fix(background): decode backgrounds before opening the write session

2026-10-20 23:05:30 +02:00

error_responses_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

expand_scope_routes_test.go

…

form_content_type_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

healthcheck_test.go

feat: add basic auth config for health endpoints

2026-11-03 09:12:02 +01:00

huma_admin_actions_test.go

…

huma_admin_test.go

…

huma_api_token_patch_test.go

…

huma_api_token_test.go

fix(models): return 404 for missing api tokens on delete (#3944) (#4119)

2026-10-15 21:01:39 +00:00

huma_archived_test.go

…

huma_auth_login_test.go

refactor(user): share password and TOTP reauthentication

2026-11-05 12:44:49 +01:00

huma_auth_refresh_test.go

…

huma_auth_test.go

fix(routes): reject form-encoded bodies outside the OAuth token endpoint

2026-10-20 15:13:02 +02:00

huma_avatar_test.go

…

huma_avatar_upload_test.go

fix(avatar): remove a replaced avatar's blob only after commit

2026-10-20 23:05:30 +02:00

huma_background_download_test.go

…

huma_background_test.go

test(projects): share trash admin and webhook test setup

2026-11-04 23:14:28 +01:00

huma_background_upload_test.go

fix(images): limit the side length of decoded images

2026-11-05 15:42:45 +01:00

huma_bot_user_test.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

huma_bucket_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

huma_bulk_task_test.go

fix(tasks): reject bulk updates without fields

2026-10-16 15:49:28 +02:00

huma_caldav_token_test.go

fix(caldav-tokens): honour page in the v2 token list

2026-10-01 17:29:11 +02:00

huma_errors_test.go

…

huma_helpers_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_info_test.go

feat(api): return all legal links from /info

2026-10-28 23:02:31 +01:00

huma_invite_links_test.go

…

huma_label_task_bulk_test.go

…

huma_label_task_test.go

…

huma_label_test.go

…

huma_link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

huma_migration_csv_test.go

fix(migration): reject repeated csv column mappings, cap labels per row

2026-11-05 15:42:45 +01:00

huma_migration_file_test.go

fix(migration): reject wekan boards with duplicate ids or too many items

2026-10-20 15:13:02 +02:00

huma_migration_oauth_test.go

fix(migration): bind oauth migration callbacks to the user who requested the auth url

2026-10-20 15:13:02 +02:00

huma_migration_planka_test.go

…

huma_non_crud_aliases_test.go

…

huma_notification_permissions_test.go

…

huma_notification_test.go

…

huma_pagination_test.go

…

huma_project_duplicate_test.go

…

huma_project_team_test.go

…

huma_project_test.go

…

huma_project_trash_test.go

feat(projects): count trash and preserve other users deletions

2026-11-04 23:14:28 +01:00

huma_project_user_test.go

…

huma_project_view_test.go

…

huma_rate_limit_test.go

…

huma_reaction_test.go

…

huma_richtext_test.go

fix(richtext): bound the cells tables expand to during conversion

2026-11-05 15:42:45 +01:00

huma_saved_filter_test.go

…

huma_session_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

huma_subscription_test.go

…

huma_task_assignee_bulk_test.go

…

huma_task_assignee_test.go

…

huma_task_attachment_test.go

fix(images): limit the side length of decoded images

2026-11-05 15:42:45 +01:00

huma_task_bucket_test.go

fix(kanban): only move tasks into buckets of their own project's view

2026-10-20 15:13:02 +02:00

huma_task_bulk_create_test.go

feat(api): return per-view positions from task create

2026-10-13 11:54:08 +02:00

huma_task_collection_test.go

…

huma_task_comment_test.go

…

huma_task_duplicate_test.go

feat(api): return per-view positions from task create

2026-10-13 11:54:08 +02:00

huma_task_patch_subscription_test.go

…

huma_task_position_test.go

…

huma_task_relation_test.go

…

huma_task_test.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

huma_task_trash_test.go

fix(tasks): preserve project trash details in task errors

2026-11-04 23:14:28 +01:00

huma_task_unread_status_test.go

…

huma_team_member_test.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

huma_team_test.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

huma_testing_test.go

…

huma_time_entry_test.go

feat(frontend): log and edit private time entries

2026-11-04 23:14:28 +01:00

huma_user_deletion_test.go

…

huma_user_export_test.go

…

huma_user_identity_test.go

feat(auth): preview verified OIDC accounts and reject unavailable identities

2026-11-05 12:44:50 +01:00

huma_user_search_link_share_test.go

…

huma_user_search_test.go

…

huma_user_settings_test.go

feat(api): read the current user's general settings on v2

2026-10-02 09:47:32 +02:00

huma_user_totp_test.go

refactor(user): share password and TOTP reauthentication

2026-11-05 12:44:49 +01:00

huma_user_webhook_test.go

…

huma_webhook_event_test.go

…

huma_webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

integrations.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

json_nul_test.go

test(api): cover NUL rejection in comment bodies on v1 and v2

2026-11-02 11:58:07 +01:00

kanban_test.go

fix(kanban): reject bucket actions through another view's url

2026-10-20 15:13:02 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

…

link_sharing_auth_test.go

…

link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

login_test.go

…

main_test.go

…

mcp_catalog_test.go

fix(mcp): hint at listing all actions when find_action matches nothing

2026-11-05 13:34:47 +01:00

mcp_info_test.go

…

mcp_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_tools_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

mcp_transport_test.go

…

oauth2_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

project_access_cleanup_test.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_pseudo_parent_test.go

…

project_test.go

fix(api): treat page=0 as the first page on v1 list endpoints

2026-10-20 15:13:02 +02:00

reauth_throttle_test.go

feat(api): add reauthenticated OIDC identity management endpoints

2026-11-05 12:44:50 +01:00

register_test.go

…

session_check_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

session_revocation_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

sessions_test.go

…

task_attachment_idor_test.go

…

task_attachment_upload_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_by_index_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

task_collection_test.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

task_comment_test.go

…

task_limits_test.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

task_test.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

token_refresh_rate_limit_test.go

fix(routes): send and expose Retry-After on rate-limited responses

2026-10-01 17:34:38 +02:00

token_test.go

…

unauth_rate_limit_test.go

…

user_change_password_test.go

…

user_confirm_email_test.go

…

user_default_project_test.go

fix(projects): count a project as default only for its owner

2026-10-02 19:08:02 +02:00

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

…

user_totp_test.go

fix(totp): require the current password to enroll and enable totp

2026-10-20 15:13:02 +02:00

webhook_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

ws_rate_limit_test.go

…