kolaente 60e543777b fix(sharing): require project admin to manage link shares ...

The delete permission check read the share's tier from the URL-bound
struct, which is always the zero value (read), so a write member could
delete any link share, including admin ones.

Creating, changing or deleting link shares now requires project admin,
whatever the share's tier. Listing and reading by ID already did. Shares
created by write members stay valid. Deleting a share that does not exist
in the project in the path now returns 404.

Changelog: Creating, changing or deleting link shares now requires project admin.

2026-10-02 19:08:02 +02:00

..

_test.go.tpl

…

admin_share_bypass_test.go

…

admin_test.go

test: cover the v2 admin license gate

2026-08-29 21:47:07 +02:00

api_token_method_matching_test.go

fix: hide license-gated routes from api token scope list (#3216)

2026-07-18 10:00:37 +02:00

api_tokens_test.go

fix(api tokens): guard GetTokenFromTokenString against short token strings

2026-07-28 06:59:04 +00:00

archived_test.go

fix(projects): sub-resource permission checks no longer get the un-archive exception

2026-08-20 11:58:06 +02:00

background_test.go

…

caldav_test.go

fix(caldav): don't wipe fields the parser doesn't understand on update

2026-07-30 11:32:24 +02:00

error_responses_test.go

…

expand_scope_routes_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

healthcheck_test.go

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

huma_admin_actions_test.go

feat(admin): port GET /admin/users to /api/v2 (#3676)

2026-08-31 09:33:47 +02:00

huma_admin_test.go

test(admin): make admin project search tests ParadeDB independent

2026-10-01 03:18:23 +02:00

huma_api_token_patch_test.go

fix(api/v2): don't require read_one for autopatch's internal GET

2026-08-19 13:01:59 +02:00

huma_api_token_test.go

fix(api-tokens): order token list by id before paging

2026-10-01 17:29:11 +02:00

huma_archived_test.go

fix(projects): reject un-archiving a child while its parent is archived

2026-08-20 11:58:06 +02:00

huma_auth_login_test.go

refactor(auth): migrate session operations to the v2 SDK

2026-09-30 10:42:33 +02:00

huma_auth_refresh_test.go

feat(auth): return error code 16005 when the refresh cookie is missing

2026-09-29 22:54:20 +02:00

huma_auth_test.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

huma_avatar_test.go

…

huma_avatar_upload_test.go

feat(api): generate canonical v2 frontend client

2026-08-31 20:10:49 +02:00

huma_background_download_test.go

test(api/v2): cover background download and unsplash proxy routes

2026-06-17 11:31:50 +00:00

huma_background_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_background_upload_test.go

fix(images): bound decode and resize dimensions

2026-08-31 18:37:03 +02:00

huma_bot_user_test.go

fix(bots): order the bot list by id so pages are stable

2026-10-01 17:29:11 +02:00

huma_bucket_test.go

feat(api/v2): add kanban bucket CRUD endpoints

2026-06-26 08:56:15 +00:00

huma_bulk_task_test.go

feat(api/v2): add bulk task updates on /api/v2

2026-06-09 20:13:02 +00:00

huma_caldav_token_test.go

fix(caldav-tokens): honour page in the v2 token list

2026-10-01 17:29:11 +02:00

huma_errors_test.go

fix(api/v2): stop leaking the healthcheck cause to unauthenticated callers

2026-07-28 19:26:15 +02:00

huma_helpers_test.go

…

huma_info_test.go

fix(tasks): add labels sequentially when the backend db serializes writes

2026-06-19 14:19:19 +00:00

huma_invite_links_test.go

feat(invites): add admin-managed user invite links

2026-09-12 18:21:35 +02:00

huma_label_task_bulk_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_label_task_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_label_test.go

perf(labels): list a user's labels without joining label_tasks

2026-08-30 17:04:35 +02:00

huma_link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

huma_migration_csv_test.go

fix(migration): run file imports in the background

2026-09-15 16:59:37 +02:00

huma_migration_file_test.go

fix(migration): run file imports in the background

2026-09-15 16:59:37 +02:00

huma_migration_oauth_test.go

fix(migration): bound vikunja file imports

2026-08-31 18:37:03 +02:00

huma_migration_planka_test.go

feat(migration): add planka migrator routes on v2

2026-08-20 08:45:42 +02:00

huma_non_crud_aliases_test.go

feat(api/v2): expose websocket endpoint under /api/v2

2026-06-17 20:35:28 +00:00

huma_notification_permissions_test.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

huma_notification_test.go

feat(notifications): add clearing stored notifications (#2735)

2026-08-29 21:22:43 +00:00

huma_pagination_test.go

fix(api): respect service.maxitemsperpage in v2 list endpoints

2026-09-21 18:23:31 +02:00

huma_project_duplicate_test.go

fix(projects): report null for a max_permission nobody computed

2026-08-28 23:49:27 +02:00

huma_project_team_test.go

fix(sharing): restrict team attachment visibility

2026-08-31 18:37:03 +02:00

huma_project_test.go

test(projects): assert search stays within the accessible set

2026-08-29 22:51:44 +02:00

huma_project_user_test.go

feat(api/v2): add project user shares CRUD on /api/v2

2026-06-07 10:37:59 +00:00

huma_project_view_test.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

huma_rate_limit_test.go

test(ratelimit): assert exact statuses instead of absence of 500

2026-07-27 22:31:06 +00:00

huma_reaction_test.go

feat(api/v2): add reactions on /api/v2

2026-06-09 21:34:22 +00:00

huma_richtext_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_saved_filter_test.go

feat(api/v2): add saved filter CRUD on /api/v2

2026-06-07 10:40:20 +00:00

huma_session_test.go

fix(sessions): break last_active ties by id so pages stay stable

2026-10-01 00:06:26 +02:00

huma_subscription_test.go

test(subscriptions): cover the opt-out paths and the rows they leave behind

2026-08-29 23:42:41 +02:00

huma_task_assignee_bulk_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_task_assignee_test.go

feat(api/v2): add task assignees (create/list/delete) on /api/v2

2026-06-06 19:06:12 +00:00

huma_task_attachment_test.go

fix(attachments): keep blob mime type so pdf previews open inline (#3157)

2026-07-11 18:53:09 +02:00

huma_task_bucket_test.go

fix(kanban): authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)

2026-07-19 18:59:34 +02:00

huma_task_bulk_create_test.go

feat(api): redirect historical task indexes on v2

2026-09-11 20:47:11 +02:00

huma_task_collection_test.go

feat(api/v2): add task collection (task lists) on /api/v2

2026-06-11 18:31:03 +00:00

huma_task_comment_test.go

…

huma_task_duplicate_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_task_patch_subscription_test.go

fix(subscriptions): declare subscription entity as string enum in v2 OpenAPI schema

2026-07-29 22:28:31 +02:00

huma_task_position_test.go

feat(api/v2): add task position updates on /api/v2

2026-06-10 11:55:51 +02:00

huma_task_relation_test.go

feat(api/v2): add task relations on /api/v2

2026-06-09 20:42:00 +00:00

huma_task_test.go

refactor(api-v2): rename the projecttask path parameter to task

2026-09-15 11:41:34 +02:00

huma_task_unread_status_test.go

feat(api/v2): add task read-status marking on /api/v2

2026-06-09 19:50:58 +00:00

huma_team_member_test.go

feat(api/v2): add team members (add/remove/admin-toggle) on /api/v2

2026-06-07 10:48:23 +00:00

huma_team_test.go

test(api/v2): assert both ETags non-empty in team permission test

2026-06-05 08:06:54 +00:00

huma_testing_test.go

test(api/v2): use cross-engine datetime literals in testing webtest

2026-06-17 12:13:50 +00:00

huma_time_entry_test.go

test(time-tracking): cover the v2 time-entry routes

2026-06-08 13:54:09 +00:00

huma_user_deletion_test.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

huma_user_export_test.go

feat(api): generate canonical v2 frontend client

2026-08-31 20:10:49 +02:00

huma_user_search_link_share_test.go

fix(users): reject link shares from user listings

2026-08-31 18:37:03 +02:00

huma_user_search_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_user_settings_test.go

feat(api): read the current user's general settings on v2

2026-10-02 09:47:32 +02:00

huma_user_totp_test.go

fix(auth): hide enabled totp secrets

2026-08-31 18:37:03 +02:00

huma_user_webhook_test.go

feat(api/v2): add user webhooks on /api/v2

2026-06-10 19:12:41 +00:00

huma_webhook_event_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_webhook_test.go

fix(webhooks): add stable id ordering to Webhook.ReadAll

2026-10-01 17:29:11 +02:00

integrations.go

fix(caldav): encode task uids in hrefs instead of interpolating them raw (#3560)

2026-08-19 20:13:06 +00:00

kanban_test.go

fix(kanban): prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)

2026-07-19 18:59:34 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

link_sharing_auth_test.go

…

link_sharing_test.go

fix(sharing): require project admin to manage link shares

2026-10-02 19:08:02 +02:00

login_test.go

fix(auth): return ErrAccountLocked for locked accounts on login

2026-06-17 19:43:41 +00:00

main_test.go

…

mcp_catalog_test.go

feat(routes): serve the MCP endpoint at /api/v2/mcp

2026-09-15 11:41:34 +02:00

mcp_info_test.go

feat(mcp): expose connection settings and token presets

2026-09-15 11:41:34 +02:00

mcp_test.go

feat(routes): serve the MCP endpoint at /api/v2/mcp

2026-09-15 11:41:34 +02:00

mcp_tools_test.go

feat(routes): serve the MCP endpoint at /api/v2/mcp

2026-09-15 11:41:34 +02:00

mcp_transport_test.go

feat(routes): serve the MCP endpoint at /api/v2/mcp

2026-09-15 11:41:34 +02:00

oauth2_test.go

test(api-tokens): cover sha256 fast path, legacy backfill and null legacy columns

2026-09-06 20:29:27 +02:00

project_pseudo_parent_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_test.go

test(projects): assert search stays within the accessible set

2026-08-29 22:51:44 +02:00

register_test.go

fix(user): keep email confirmation status after registration

2026-08-18 11:30:03 +02:00

sessions_test.go

feat(auth): return error code 16005 when the refresh cookie is missing

2026-09-29 22:54:20 +02:00

task_attachment_idor_test.go

…

task_attachment_upload_test.go

fix(errors): update the attachment size webtest and yaegi symbols for the moved codes

2026-09-06 00:12:30 +02:00

task_by_index_test.go

…

task_collection_test.go

perf(tasks): index (project_id, done, due_date) instead of (done, due_date)

2026-09-04 10:32:56 +02:00

task_comment_test.go

…

task_test.go

…

token_refresh_rate_limit_test.go

fix(routes): send and expose Retry-After on rate-limited responses

2026-10-01 17:34:38 +02:00

token_test.go

…

unauth_rate_limit_test.go

test(ratelimit): align basic auth rate limit webtests to a fresh window

2026-09-18 15:59:07 +02:00

user_change_password_test.go

…

user_confirm_email_test.go

…

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

feat(api/v2): expose pending email, add cancel and resend endpoints

2026-08-18 22:03:38 +02:00

user_totp_test.go

fix(auth): hide enabled totp secrets

2026-08-31 18:37:03 +02:00

webhook_test.go

…

ws_rate_limit_test.go

fix(security): rate limit the websocket upgrade endpoint (#3348)

2026-07-28 17:12:18 +02:00