kolaente 8de2bd8ea5 fix(kanban): stop bucket search leaking into other filter buckets ...

In filter bucket mode a bucket's search was written into the shared search options and never reset, so buckets processed afterwards (random map order) inherited it.

2026-11-07 17:38:21 +01:00

..

admin_actions_test.go

fix(user): deliver password reset emails to locked accounts

2026-11-03 20:15:14 +01:00

admin_bypass_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

admin_bypass.go

…

admin_overview.go

feat(projects): exclude trashed projects from instance counts

2026-11-04 23:14:28 +01:00

admin_project_list.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

admin_team_list.go

fix(admin): rank exact and prefix team matches before the page cap

2026-10-01 17:29:10 +02:00

admin_user_actions.go

fix(cli): invalidate sessions when resetting a password directly

2026-11-03 20:15:14 +01:00

admin_user_create.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

api_routes_test.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_routes.go

fix(api-tokens): name non-CRUD permission keys by action across v1 and v2

2026-10-20 15:13:02 +02:00

api_tokens_expiry_cron_test.go

…

api_tokens_expiry_cron.go

…

api_tokens_expiry_notification_test.go

feat: show relative time in api token expiry notifications

2026-08-18 09:44:49 +02:00

api_tokens_expiry_notification.go

feat: show relative time in api token expiry notifications

2026-08-18 09:44:49 +02:00

api_tokens_permissions.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

api_tokens_test.go

fix(models): return 404 for missing api tokens on delete (#3944) (#4119)

2026-10-15 21:01:39 +00:00

api_tokens.go

fix(auth): refuse email-unconfirmed accounts on every credential path

2026-10-20 15:13:02 +02:00

bot_users_permissions.go

fix(bots): 404 unowned bots, require status on PUT, audit owner status changes

2026-10-01 15:27:34 +02:00

bot_users_test.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

bot_users.go

feat(api): include bot owner on bot user endpoints and created_by

2026-10-30 22:57:12 +01:00

bulk_task_create_test.go

feat(tasks): allocate task indexes from the per-project counter

2026-09-11 20:47:11 +02:00

bulk_task_create.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

bulk_task_test.go

test(tasks): cover race move to writable project and bulk update race

2026-11-04 09:08:29 +01:00

bulk_task.go

fix(tasks): reject bulk updates without fields

2026-10-16 15:49:28 +02:00

comment_quotes_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

comment_quotes.go

…

error_i18n_test.go

fix(migration): reject repeated csv column mappings, cap labels per row

2026-11-05 15:42:45 +01:00

error_test.go

fix(migration): reject repeated csv column mappings, cap labels per row

2026-11-05 15:42:45 +01:00

error.go

feat(models): add errors for linking user identities

2026-11-05 12:44:50 +01:00

events.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

export_test.go

fix(export): only replace the export file pointer if it is unchanged

2026-11-03 18:28:14 +01:00

export.go

fix(export): export related tasks as references

2026-11-05 15:42:45 +01:00

favorites.go

…

filter_complexity_test.go

test: pin error values for filter nesting and relation hierarchy limits

2026-11-03 21:04:05 +01:00

hex_color_validation_test.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

kanban_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

kanban_task_bucket_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

kanban_task_bucket.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

kanban_test.go

fix(kanban): stop bucket search leaking into other filter buckets

2026-11-07 17:38:21 +01:00

kanban.go

fix(kanban): stop bucket search leaking into other filter buckets

2026-11-07 17:38:21 +01:00

label_permissions.go

fix(labels): fail closed if the visibility condition degenerates

2026-08-30 17:27:01 +02:00

label_task_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

label_task_test.go

refactor(bots): take a verified user, not any web.Auth

2026-08-29 23:29:46 +02:00

label_task.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

label_test.go

feat(user): attach bot owner to bot users in central loaders

2026-10-30 22:57:12 +01:00

label.go

fix: reject hex_color values that are not hex colors

2026-10-13 23:32:15 +02:00

link_sharing_permissions.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

link_sharing_test.go

fix(link-shares): hide creator emails in the share list

2026-11-05 15:42:45 +01:00

link_sharing.go

fix(link-shares): hide creator emails in the share list

2026-11-05 15:42:45 +01:00

listeners_test.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

listeners.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

main_test.go

test(projects): insert raw test projects through one helper that writes their ancestors

2026-09-10 22:44:26 +02:00

mentions_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

mentions.go

fix(avatar): cancel an avatar decode when the client goes away

2026-10-20 23:05:30 +02:00

message.go

…

metrics_count_test.go

feat(projects): exclude trashed projects from instance counts

2026-11-04 23:14:28 +01:00

models.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

notifications_database.go

feat(notifications): add clearing stored notifications (#2735)

2026-08-29 21:22:43 +00:00

notifications_permissions_test.go

feat(notifications): notify subscribers when a task is created

2026-08-27 15:41:58 +02:00

notifications_permissions.go

perf(projects): filter accessible projects through the memo

2026-08-29 22:51:44 +02:00

notifications_refresh_test.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

notifications_refresh.go

feat(notifications): notify subscribers when a task is created

2026-08-27 15:41:58 +02:00

notifications_task_identifier_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

notifications_test.go

fix(reminders): show due reminders in notifications without email

2026-10-01 15:38:27 +02:00

notifications.go

fix(avatar): cancel an avatar decode when the client goes away

2026-10-20 23:05:30 +02:00

oauth_codes.go

…

permissions_test.go

fix(permissions): decode a null permission as unknown, not read

2026-08-28 23:49:27 +02:00

permissions.go

fix(permissions): decode a null permission as unknown, not read

2026-08-28 23:49:27 +02:00

project_access_cleanup_test.go

test(projects): share trash admin and webhook test setup

2026-11-04 23:14:28 +01:00

project_access_cleanup.go

fix(projects): preserve trashed data during user cleanup

2026-11-04 23:14:28 +01:00

project_access_test.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

project_access.go

fix(projects): only respread positions of projects the user can write

2026-11-05 15:42:45 +01:00

project_ancestor_test.go

feat(projects): audit and announce permanent project deletion

2026-11-04 23:14:28 +01:00

project_ancestor.go

feat(projects): trash and restore project trees

2026-11-04 23:14:28 +01:00

project_duplicate_test.go

fix(projects): never take the background from a project create request

2026-11-05 15:42:45 +01:00

project_duplicate.go

fix(projects): never take the background from a project create request

2026-11-05 15:42:45 +01:00

project_json_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_permissions_multiple_teams_test.go

…

project_permissions_pseudo_test.go

fix(projects): report read for the Favorites pseudo project

2026-08-28 23:49:27 +02:00

project_permissions_subproject_test.go

test(projects): cover the parent owner on member-created subprojects

2026-08-28 23:49:27 +02:00

project_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_purge_test.go

fix(caldav): invalidate sync tokens after permanent deletion

2026-11-04 23:14:28 +01:00

project_purge.go

fix(caldav): invalidate sync tokens after permanent deletion

2026-11-04 23:14:28 +01:00

project_repair_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

project_repair.go

fix(projects): reserve identifiers and repair trashed orphans

2026-11-04 23:14:28 +01:00

project_team_foreign_test.go

fix(assignees): include public team members in project user search

2026-09-07 21:35:17 +02:00

project_team_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_team_test.go

fix(sharing): restrict team attachment visibility

2026-08-31 18:37:03 +02:00

project_team.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_test.go

fix(projects): only respread positions of projects the user can write

2026-11-05 15:42:45 +01:00

project_trash_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

project_trash.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

project_users_permissions_test.go

…

project_users_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_users_test.go

fix(users): reject link shares from user listings

2026-08-31 18:37:03 +02:00

project_users.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

project_view_permissions.go

refactor(projects): centralize trashed project authorization

2026-11-04 23:14:28 +01:00

project_view_test.go

fix(views): cap filter bucket configurations at 50

2026-10-20 15:13:02 +02:00

project_view.go

fix(views): cap filter bucket configurations at 50

2026-10-20 15:13:02 +02:00

project.go

fix(projects): only respread positions of projects the user can write

2026-11-05 15:42:45 +01:00

reaction_permissions.go

…

reaction_test.go

fix(reactions): never return a null user in a reaction list

2026-10-13 23:43:18 +02:00

reaction.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

saved_filter_positions_test.go

feat(tasks): calculate top-of-view positions per batch

2026-08-02 16:21:50 +02:00

saved_filters_permissions.go

fix: report the real link share id in saved filter errors

2026-08-04 13:40:11 +02:00

saved_filters_test.go

perf(filters): look up matching tasks by id set when pruning filter kanban views

2026-11-03 21:04:05 +01:00

saved_filters.go

perf(filters): look up matching tasks by id set when pruning filter kanban views

2026-11-03 21:04:05 +01:00

sessions_permissions.go

…

sessions_test.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

sessions.go

fix(auth): reject user JWTs whose session was revoked on the HTTP path

2026-10-20 15:13:02 +02:00

setup_tests.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

subscription_permissions.go

feat(subscriptions): allow unsubscribing from an inherited subscription

2026-08-29 23:42:41 +02:00

subscription_test.go

test(subscriptions): cover the opt-out paths and the rows they leave behind

2026-08-29 23:42:41 +02:00

subscription.go

fix(subscriptions): subscribe creators and assignees regardless of project subscriptions

2026-10-26 14:47:13 +01:00

task_assignees_archived_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_assignees_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

task_assignees_test.go

fix(subscriptions): subscribe creators and assignees regardless of project subscriptions

2026-10-26 14:47:13 +01:00

task_assignees.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_attachment_permissions.go

feat(tasks): add task trash lifecycle and permissions

2026-11-04 23:14:28 +01:00

task_attachment_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_attachment.go

feat(migration): index the columns that reference stored files

2026-11-05 15:42:45 +01:00

task_collection_filter_test.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

task_collection_filter.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

task_collection_sort_test.go

…

task_collection_sort.go

feat: filter tasks by creator username (#2916)

2026-08-31 10:48:39 +00:00

task_collection_test.go

fix(filters): apply stored search text of saved filters

2026-11-07 12:58:48 +01:00

task_collection.go

fix(filters): apply stored search text of saved filters

2026-11-07 12:58:48 +01:00

task_comment_permissions.go

refactor: drop redundant link share branch in comment permissions

2026-08-04 13:40:11 +02:00

task_comments_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_comments.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_created_notification_test.go

feat(notifications): notify subscribers when a task is created

2026-08-27 15:41:58 +02:00

task_delete_cron_test.go

refactor(trash): share the retention setting

2026-11-04 23:14:28 +01:00

task_delete_cron.go

refactor(trash): share the retention setting

2026-11-04 23:14:28 +01:00

task_duplicate_test.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

task_duplicate.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_index_test.go

test(tasks): grant write access where tests move tasks out of unwritable projects

2026-11-04 09:08:29 +01:00

task_index.go

feat(tasks): add task index counters and historical aliases

2026-09-11 20:47:11 +02:00

task_limits_test.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

task_overdue_reminder_test.go

fix(reminders): limit overdue task events to the recipient's projects

2026-11-05 15:42:45 +01:00

task_overdue_reminder.go

fix(reminders): limit overdue task events to the recipient's projects

2026-11-05 15:42:45 +01:00

task_position_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_position_view_test.go

fix(tasks): validate position target views

2026-08-31 18:37:03 +02:00

task_position.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_relation_authz_test.go

…

task_relation_permissions.go

fix(tasks): authorize both sides of relation deletion

2026-08-31 18:37:03 +02:00

task_relation_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

task_relation_write_race_test.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_relation.go

fix(tasks): recheck child writes and relation endpoints under row locks

2026-11-05 11:29:33 +01:00

task_reminder_test.go

style(projects): simplify and format project trash code

2026-11-04 23:14:28 +01:00

task_reminder.go

feat(projects): skip trashed projects in reminder jobs

2026-11-04 23:14:28 +01:00

task_search_bench_test.go

test(projects): insert raw test projects through one helper that writes their ancestors

2026-09-10 22:44:26 +02:00

task_search_favorites_access_test.go

fix(tasks): require access for favorites

2026-08-31 18:37:03 +02:00

task_search_subtask_access_test.go

fix(tasks): restrict subtask expansion by access

2026-08-31 18:37:03 +02:00

task_search_test.go

fix(tasks): return no tasks when a search has no project scope

2026-10-02 19:08:02 +02:00

task_search.go

fix(tasks): return no tasks when a search has no project scope

2026-10-02 19:08:02 +02:00

task_trash_test.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_trash.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_unread_statuses.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

task_view_lock_test.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

task_write_race_test.go

style(tasks): format literals and trim comments

2026-11-05 11:29:33 +01:00

tasks_permissions.go

fix(tasks): lock views before tasks and recheck restores

2026-11-05 11:29:33 +01:00

tasks_test.go

fix(tasks): keep the deleting user's data out of the task deleted event

2026-11-05 15:42:45 +01:00

tasks.go

fix(caldav): build iCalendar output linearly, cap reminders and titles

2026-11-05 15:42:45 +01:00

team_members_permissions.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

team_members_test.go

fix(teams): require membership for team self-removal

2026-10-20 15:13:02 +02:00

team_members.go

fix(sharing): delete a user's webhooks when they lose project access

2026-10-02 19:08:02 +02:00

team_sync_test.go

fix(teams): only sync external team memberships of the current issuer

2026-11-03 20:15:14 +01:00

team_sync.go

fix(teams): only sync external team memberships of the current issuer

2026-11-03 20:15:14 +01:00

teams_permissions_test.go

…

teams_permissions.go

fix(security): reject link shares at team, bot and webhook permission checks

2026-08-04 13:40:11 +02:00

teams_test.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

teams.go

fix(teams): ignore client-set external_id on team create and update

2026-10-20 15:13:02 +02:00

time_tracking_filter.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

time_tracking_test.go

fix(filters): limit business day offsets in date math

2026-11-05 15:42:45 +01:00

time_tracking.go

fix(time-tracking): enforce project trash container permissions

2026-11-04 23:14:28 +01:00

unsplash.go

…

user_confirmation_test.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

user_delete_test.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

user_delete.go

feat(auth): persist linked OIDC identities and authenticate local accounts

2026-11-05 12:44:49 +01:00

user_invite_link_test.go

fix(db): rank accent-insensitive matches as exact

2026-10-22 11:58:48 +02:00

user_invite_link.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

user_list_test.go

fix(user): match exact username search literally on PostgreSQL

2026-11-03 20:15:14 +01:00

user_project_test.go

…

user_project.go

fix(assignees): include public team members in project user search

2026-09-07 21:35:17 +02:00

user_settings_test.go

fix(user): count wrong passwords on password change toward account lockout

2026-11-03 20:15:14 +01:00

user_settings.go

refactor(user): share password and TOTP reauthentication

2026-11-05 12:44:49 +01:00

users.go

…

webhooks_permissions.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

webhooks_test.go

fix(webhooks): derive user- vs project-level webhooks from the route, never the body

2026-10-20 15:13:02 +02:00

webhooks.go

chore: better wording

2026-10-20 15:13:02 +02:00