kolaente 808ef2534e fix(task-comments): derive update event doer from authenticated user ...

TaskComment.Update used tc.Author as the TaskCommentUpdatedEvent doer, but
that field is bound from the request body. A client could omit it (nil doer,
breaking the event) or spoof another user. Resolve the doer from the session
auth via GetUserOrLinkShareUser instead, mirroring Create and Delete. CanUpdate
already guarantees the authenticated user is the comment's author, so this is
both correct and consistent. Affects v1 and v2, which share the model.

2026-06-03 19:57:26 +00:00

..

admin_bypass_test.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

admin_bypass.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

admin_project_list.go

feat(admin): add users/projects list endpoints and is_admin patch

2026-04-20 18:55:06 +00:00

api_routes_test.go

feat(models): accept v2 PATCH as alias for PUT in API token matcher

2026-05-31 12:56:57 +00:00

api_routes.go

fix(models): validate API token permissions against v1+v2 route union

2026-05-31 12:56:57 +00:00

api_tokens_expiry_cron_test.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_cron.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_notification_test.go

test: add tests for API token expiry notifications and cron

2026-03-30 12:28:15 +00:00

api_tokens_expiry_notification.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

api_tokens_permissions.go

feat(api): bot token support via /tokens CRUD and bot_users_enabled flag

2026-05-01 14:44:10 +00:00

api_tokens_test.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

api_tokens.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

bot_users_permissions.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

bot_users_test.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

bot_users.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

bulk_task_test.go

…

bulk_task.go

…

comment_quotes_test.go

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

comment_quotes.go

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

error.go

feat(tasks): cap repeat_after at 10 years to harden repeating-task handler

2026-04-09 16:07:48 +00:00

events.go

feat(webhook): add WebhookDeliveryEvent for per-webhook fan out

2026-04-09 09:26:04 +00:00

export.go

chore(lint): suppress known gosec false positives

2026-03-23 16:23:15 +01:00

favorites.go

…

kanban_permissions.go

…

kanban_task_bucket_test.go

test(kanban): add failing test for repeating task bucket routing on done (#2573)

2026-04-09 10:45:34 +00:00

kanban_task_bucket.go

fix(kanban): skip upsert when repeating task already in default bucket (#2573)

2026-04-09 10:45:34 +00:00

kanban_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

kanban.go

…

label_permissions.go

fix(labels): derive label max permission from accessible tasks only

2026-04-09 15:43:04 +00:00

label_task_permissions.go

…

label_task_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

label_task.go

…

label_test.go

fix(labels): derive label max permission from accessible tasks only

2026-04-09 15:43:04 +00:00

label.go

docs(api/v2): mark server-controlled label and user fields read-only

2026-05-31 15:27:44 +02:00

link_sharing_permissions.go

…

link_sharing_test.go

fix(security): validate link share JWTs against DB on every request

2026-04-09 15:38:07 +00:00

link_sharing.go

fix(security): validate link share JWTs against DB on every request

2026-04-09 15:38:07 +00:00

listeners.go

refactor(metrics): drop the project/task/team/attachment count listeners

2026-05-30 13:48:01 +00:00

main_test.go

refactor: remove environment variable requirements for go test

2026-02-17 18:01:05 +01:00

mentions_test.go

test: add tests for conversational email system

2026-03-08 16:03:47 +01:00

mentions.go

feat: format user mentions with display names in email notifications (#1930)

2025-12-10 12:39:05 +01:00

message.go

feat(api/v2): upload user avatar via multipart

2026-06-02 11:55:25 +00:00

metrics_count_test.go

test(metrics): verify counts are read from the right table

2026-05-30 13:48:01 +00:00

models.go

feat: add OAuth 2.0 authorization code model and migration

2026-03-27 23:05:04 +00:00

notifications_database.go

…

notifications_test.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

notifications.go

feat: add Atom feed for user notifications with API token auth (#2758)

2026-05-15 17:25:09 +02:00

oauth_codes.go

feat: add OAuth 2.0 authorization code model and migration

2026-03-27 23:05:04 +00:00

permissions.go

…

project_duplicate_test.go

…

project_duplicate.go

refactor(files): derive attachment size from content in sibling callers

2026-04-09 16:22:56 +00:00

project_permissions_multiple_teams_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_repair_test.go

feat: add repair-projects CLI command

2026-02-25 11:56:25 +01:00

project_repair.go

feat: add repair-projects CLI command

2026-02-25 11:56:25 +01:00

project_team_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_team_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_team.go

fix(events): defer event dispatch for project operations

2026-03-03 12:46:34 +01:00

project_test.go

test(project): pin archived propagation aggregation in ReadAll CTE

2026-04-11 17:20:53 +00:00

project_users_permissions_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_users_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

project_users.go

refactor(user): export IsErrUserStatusError for use across packages

2026-03-23 12:06:16 +00:00

project_view_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

project_view.go

fix(api/v2): scope project view delete to its parent project

2026-06-01 13:04:34 +00:00

project.go

feat(api/v2): gate admin routes by feature + instance admin

2026-06-02 07:38:08 +00:00

reaction_permissions.go

…

reaction_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

reaction.go

…

saved_filter_positions_test.go

refactor: use per-view IN clause for filter task deletion instead of batching

2026-04-09 07:25:57 +00:00

saved_filters_permissions.go

…

saved_filters_test.go

…

saved_filters.go

refactor: use per-view IN clause for filter task deletion instead of batching

2026-04-09 07:25:57 +00:00

sessions_permissions.go

feat: add Session model with CRUD, permissions, and cleanup cron

2026-02-25 10:30:25 +01:00

sessions.go

fix: commit transaction in session cleanup cron

2026-02-25 11:03:02 +01:00

setup_tests.go

feat(comments): treat quoted comment authors as implicit mentions

2026-05-20 21:02:14 +00:00

subscription_permissions.go

…

subscription_test.go

fix: prevent session leaks and visibility issues in model tests

2026-02-25 11:03:02 +01:00

subscription.go

…

task_assignees_permissions.go

…

task_assignees.go

fix(assignees): use db.ILIKE helper for assignee search count query

2026-05-26 19:43:16 +00:00

task_attachment_permissions.go

…

task_attachment_test.go

fix(files): derive file size from reader at creation boundary

2026-04-09 16:22:56 +00:00

task_attachment.go

fix(models): allow user-delete cascade to complete for disabled creators

2026-05-06 16:08:16 +02:00

task_collection_filter_test.go

fix(filter): recover from datemath panic on malformed date filter values

2026-02-26 16:09:13 +01:00

task_collection_filter.go

fix(filter): recover from datemath panic on malformed date filter values

2026-02-26 16:09:13 +01:00

task_collection_sort_test.go

…

task_collection_sort.go

…

task_collection_test.go

feat(projects): always store identifiers as uppercase (#2775)

2026-05-19 10:35:43 +02:00

task_collection.go

feat(api/v2): add project view routes

2026-06-01 13:04:34 +00:00

task_comment_permissions.go

…

task_comments_test.go

test: update event assertions to work with deferred dispatch

2026-03-03 12:46:34 +01:00

task_comments.go

fix(task-comments): derive update event doer from authenticated user

2026-06-03 19:57:26 +00:00

task_duplicate_test.go

feat: add task duplicate backend model and tests

2026-03-04 17:20:26 +01:00

task_duplicate.go

feat(api/v2): add task duplicate action (#2815)

2026-06-01 14:13:39 +02:00

task_overdue_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_overdue_reminder.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_position_test.go

fix: catch ErrNeedsFullRecalculation in task creation position conflict resolution

2026-04-09 07:25:57 +00:00

task_position.go

fix: catch ErrNeedsFullRecalculation in task creation position conflict resolution

2026-04-09 07:25:57 +00:00

task_relation_authz_test.go

fix: use recursive CTE in accessibleProjectIDsSubquery for inherited project permissions

2026-04-05 12:20:35 +00:00

task_relation_permissions.go

…

task_relation_test.go

…

task_relation.go

fix(events): defer event dispatch for task sub-entities

2026-03-03 12:46:34 +01:00

task_reminder_test.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_reminder.go

feat: extend WebhookListener for user-level webhooks

2026-03-08 19:45:53 +01:00

task_search_bench_test.go

refactor: remove typesense support

2026-02-25 12:15:28 +01:00

task_search_test.go

…

task_search.go

fix(tasks): include tasks with deleted parents in subtask-expanded queries

2026-04-02 16:30:23 +00:00

task_unread_statuses.go

…

tasks_permissions.go

refactor(models): remove *Arr helper fields now handled by normalizer

2026-05-31 12:56:57 +00:00

tasks_test.go

feat(tasks): enforce unique (project_id, index) via migration

2026-04-11 20:44:28 +00:00

tasks.go

refactor(models): remove *Arr helper fields now handled by normalizer

2026-05-31 12:56:57 +00:00

team_members_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

team_members_test.go

…

team_members.go

refactor(user): export IsErrUserStatusError for use across packages

2026-03-23 12:06:16 +00:00

team_sync.go

…

teams_permissions_test.go

…

teams_permissions.go

feat(permissions): site admins bypass all Can* checks (license-gated)

2026-04-20 18:55:06 +00:00

teams_test.go

…

teams.go

fix(api/v2): keep include_public out of the team body schema

2026-06-03 18:56:12 +00:00

unsplash.go

…

user_delete_test.go

fix(models): allow user-delete cascade to complete for disabled creators

2026-05-06 16:08:16 +02:00

user_delete.go

feat(models): add BotUser CRUD wrapper

2026-05-01 14:44:10 +00:00

user_list_test.go

feat(user): always include own bots in user search

2026-05-01 14:44:10 +00:00

user_project_test.go

…

user_project.go

…

users.go

…

webhooks_permissions.go

feat: add user_id to webhooks and user-directed event infrastructure

2026-03-08 19:45:53 +01:00

webhooks.go

fix(webhook): return error from sendWebhookPayload on non-2xx responses

2026-04-09 09:26:04 +00:00