kolaente 2b1558e8df test: cover link share principal confusion at the HTTP layer ...

A link share JWT reaches every authenticated route; nothing rejects it at the
route group.

2026-08-04 13:40:11 +02:00

..

_test.go.tpl

…

admin_share_bypass_test.go

…

admin_test.go

…

api_token_method_matching_test.go

…

api_tokens_test.go

fix(api tokens): guard GetTokenFromTokenString against short token strings

2026-07-28 06:59:04 +00:00

archived_test.go

…

background_test.go

…

caldav_test.go

fix(caldav): don't wipe fields the parser doesn't understand on update

2026-07-30 11:32:24 +02:00

error_responses_test.go

…

healthcheck_test.go

…

huma_admin_actions_test.go

…

huma_admin_test.go

…

huma_api_token_test.go

…

huma_archived_test.go

…

huma_auth_login_test.go

fix(auth): gate the v2 login route on local or ldap auth being enabled

2026-07-28 17:25:37 +02:00

huma_auth_refresh_test.go

…

huma_auth_test.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

huma_avatar_test.go

…

huma_avatar_upload_test.go

…

huma_background_download_test.go

…

huma_background_test.go

…

huma_background_upload_test.go

…

huma_bot_user_test.go

…

huma_bucket_test.go

…

huma_bulk_task_test.go

…

huma_caldav_token_test.go

…

huma_errors_test.go

fix(api/v2): stop leaking the healthcheck cause to unauthenticated callers

2026-07-28 19:26:15 +02:00

huma_helpers_test.go

…

huma_info_test.go

…

huma_label_task_bulk_test.go

…

huma_label_task_test.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

huma_label_test.go

fix(labels): allow attaching labels via inherited child-project access (#3374)

2026-07-30 12:03:30 +02:00

huma_link_sharing_test.go

…

huma_migration_csv_test.go

…

huma_migration_file_test.go

…

huma_migration_oauth_test.go

…

huma_non_crud_aliases_test.go

…

huma_notification_permissions_test.go

fix(notifications): check project access when reading notifications

2026-07-29 07:58:17 +00:00

huma_notification_test.go

…

huma_project_duplicate_test.go

fix(projects): enforce write permission on target parent when duplicating a project (GHSA-f27p-pw2p-9pr4)

2026-07-19 18:59:34 +02:00

huma_project_team_test.go

…

huma_project_test.go

…

huma_project_user_test.go

…

huma_project_view_test.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

huma_rate_limit_test.go

test(ratelimit): assert exact statuses instead of absence of 500

2026-07-27 22:31:06 +00:00

huma_reaction_test.go

…

huma_richtext_test.go

…

huma_saved_filter_test.go

…

huma_session_test.go

…

huma_subscription_test.go

…

huma_task_assignee_bulk_test.go

…

huma_task_assignee_test.go

…

huma_task_attachment_test.go

…

huma_task_bucket_test.go

fix(kanban): authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)

2026-07-19 18:59:34 +02:00

huma_task_bulk_create_test.go

feat(api/v2): add bulk task creation endpoint

2026-08-02 16:21:50 +02:00

huma_task_collection_test.go

…

huma_task_comment_test.go

…

huma_task_duplicate_test.go

…

huma_task_patch_subscription_test.go

fix(subscriptions): declare subscription entity as string enum in v2 OpenAPI schema

2026-07-29 22:28:31 +02:00

huma_task_position_test.go

…

huma_task_relation_test.go

…

huma_task_test.go

…

huma_task_unread_status_test.go

…

huma_team_member_test.go

…

huma_team_test.go

…

huma_testing_test.go

…

huma_time_entry_test.go

…

huma_user_deletion_test.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

huma_user_export_test.go

…

huma_user_search_test.go

…

huma_user_settings_test.go

…

huma_user_totp_test.go

…

huma_user_webhook_test.go

…

huma_webhook_event_test.go

…

huma_webhook_test.go

…

integrations.go

…

kanban_test.go

fix(kanban): prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)

2026-07-19 18:59:34 +02:00

label_task_test.go

…

link_share_avatar_test.go

…

link_share_consistency_test.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

link_sharing_auth_test.go

…

link_sharing_test.go

test: cover link share principal confusion at the HTTP layer

2026-08-04 13:40:11 +02:00

login_test.go

…

main_test.go

…

oauth2_test.go

fix(oauth2): burn authorization code even when validation fails (#3350)

2026-07-28 17:13:15 +02:00

project_pseudo_parent_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

register_test.go

…

sessions_test.go

…

task_attachment_idor_test.go

…

task_attachment_upload_test.go

…

task_by_index_test.go

…

task_collection_test.go

fix(kanban): pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)

2026-07-19 18:59:34 +02:00

task_comment_test.go

…

task_test.go

…

token_test.go

…

user_change_password_test.go

…

user_confirm_email_test.go

…

user_export_download_test.go

…

user_export_status_test.go

…

user_password_request_token_test.go

…

user_password_reset_test.go

…

user_project_test.go

…

user_show_test.go

…

user_totp_test.go

…

webhook_test.go

…

ws_rate_limit_test.go

fix(security): rate limit the websocket upgrade endpoint (#3348)

2026-07-28 17:12:18 +02:00