kolaente 43e910025a fix(models): validate API token permissions against v1+v2 route union ...

PermissionsAreValid only consulted apiTokenRoutes, so a v2-only resource
(no v1 counterpart) could never be granted as a token scope even though
CanDoAPIRoute already authorises against both tables. Validate against
the union so the v1+v2 authorization and validation paths agree.

2026-05-31 12:56:57 +00:00

..

caldav

fix(caldav): escape user-controlled strings per RFC 5545 in VCALENDAR output

2026-04-09 15:44:04 +00:00

caldavtests

…

cmd

fix(cli): guard last admin on scheduled CLI deletion path

2026-04-20 18:55:06 +00:00

config

feat: always enable bot users

2026-05-04 10:38:53 +00:00

cron

…

db

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

doctor

…

e2etests

test(webhook): assert bad webhook is retried in no-duplicate test

2026-04-09 09:26:04 +00:00

events

…

files

refactor(metrics): drop inline file count tracking

2026-05-30 13:48:01 +00:00

health

…

i18n

chore(i18n): update translations via Crowdin

2026-05-27 02:31:52 +00:00

initialize

refactor(user): remove the now-empty listeners file

2026-05-30 13:48:01 +00:00

license

fix(license): degrade to free when servers unreachable or key rejected

2026-04-20 18:55:06 +00:00

log

…

mail

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

metrics

refactor(metrics): count entities on demand with a TTL cache

2026-05-30 13:48:01 +00:00

migration

feat(projects): always store identifiers as uppercase (#2775)

2026-05-19 10:35:43 +02:00

models

fix(models): validate API token permissions against v1+v2 route union

2026-05-31 12:56:57 +00:00

modules

feat(auth): add GetAuthFromContext for Huma handlers

2026-05-31 12:56:57 +00:00

notifications

fix(notifications): skip logo attachment for conversational mails

2026-05-18 19:06:49 +00:00

plugins

…

red

…

routes

feat(api/v2): preserve Vikunja numeric error code in problem+json

2026-05-31 12:56:57 +00:00

swagger

[skip ci] Updated swagger docs

2026-05-19 09:43:17 +00:00

user

refactor(user): remove the now-empty listeners file

2026-05-30 13:48:01 +00:00

utils

fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients

2026-04-09 07:31:08 +00:00

version

…

web

refactor(handler): return domain error for forbidden instead of echo.HTTPError

2026-04-21 09:23:13 +00:00

websocket

…

webtests

test(api/v2): Label round-trip, ETag, PATCH, error shapes

2026-05-31 12:56:57 +00:00

yaegi_symbols

refactor(user): remove the now-empty listeners file

2026-05-30 13:48:01 +00:00