kolaente 935f03e4c0 fix: bound the task ids a bulk update accepts ...

CanUpdate materializes every requested task before any permission check runs,
so an unbounded list let anyone force a giant IN query on ids they cannot see.
Cap it at the schema layer like the bulk create, and keep an empty-list guard
for the v1 route, which binds through Echo and never sees the Huma tags.

Address pr-swarm finding: unbounded bulk update input.

2026-07-26 23:10:02 +02:00

..

_test.go.tpl

…

admin_share_bypass_test.go

test(admin): add webtests for /admin/* endpoints and share bypass

2026-04-20 18:55:06 +00:00

admin_test.go

feat: audit admin reads and denied admin access

2026-07-03 16:56:03 +00:00

api_token_method_matching_test.go

fix: hide license-gated routes from api token scope list (#3216)

2026-07-18 10:00:37 +02:00

api_tokens_test.go

fix(api): derive API-token ownership from a verified user principal (GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

archived_test.go

fix(project): remove non-existent columns from UpdateProject column list

2026-04-03 16:59:05 +00:00

background_test.go

test: verify background removal preserves project title

2026-04-08 09:07:15 +00:00

caldav_test.go

feat(caldav): implement RFC 6578 sync-collection REPORT to sync task deletions

2026-07-07 11:57:04 +00:00

error_responses_test.go

feat: add session-based auth with refresh token rotation

2026-02-25 10:30:25 +01:00

healthcheck_test.go

feat(auth): add OpenID provider availability monitoring and retry logic (#3145)

2026-07-10 17:52:01 +02:00

huma_admin_actions_test.go

fix: dispatch pending events in admin handlers

2026-07-03 16:56:03 +00:00

huma_admin_test.go

test(api/v2): port full v1 admin projects coverage

2026-06-03 19:48:08 +00:00

huma_api_token_test.go

feat(api/v2): add API token list/create/delete on /api/v2

2026-06-05 08:49:23 +00:00

huma_archived_test.go

test(api/v2): isolate project tests per-handler, not via shared harness

2026-06-05 07:40:07 +00:00

huma_auth_login_test.go

fix(auth): build OIDC end-session URL with RP-Initiated Logout params (#2943)

2026-06-19 18:27:33 +02:00

huma_auth_refresh_test.go

feat(api/v2): port refresh-token endpoint to /api/v2

2026-06-17 20:34:38 +00:00

huma_auth_test.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

huma_avatar_test.go

test(api/v2): port full v1 avatar coverage to TestAvatar

2026-06-03 19:58:27 +00:00

huma_avatar_upload_test.go

fix(api/v2): reject non-decodable images (e.g. SVG) on avatar upload with 400

2026-06-02 11:55:25 +00:00

huma_background_download_test.go

test(api/v2): cover background download and unsplash proxy routes

2026-06-17 11:31:50 +00:00

huma_background_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_background_upload_test.go

feat(api/v2): add project background upload on /api/v2

2026-06-12 08:47:08 +00:00

huma_bot_user_test.go

feat(api/v2): add bot user CRUD on /api/v2

2026-06-05 08:51:39 +00:00

huma_bucket_test.go

feat(api/v2): add kanban bucket CRUD endpoints

2026-06-26 08:56:15 +00:00

huma_bulk_task_create_test.go

feat: add an endpoint to create multiple tasks at once

2026-07-26 19:28:17 +02:00

huma_bulk_task_test.go

fix: bound the task ids a bulk update accepts

2026-07-26 23:10:02 +02:00

huma_caldav_token_test.go

feat(api/v2): add CalDAV tokens on /api/v2

2026-06-10 17:55:52 +00:00

huma_errors_test.go

test(api/v2): Label round-trip, ETag, PATCH, error shapes

2026-05-31 12:56:57 +00:00

huma_helpers_test.go

test(api/v2): Label round-trip, ETag, PATCH, error shapes

2026-05-31 12:56:57 +00:00

huma_info_test.go

fix(tasks): add labels sequentially when the backend db serializes writes

2026-06-19 14:19:19 +00:00

huma_label_task_bulk_test.go

feat(api/v2): add bulk label replacement on /api/v2

2026-06-10 11:56:05 +02:00

huma_label_task_test.go

feat(api/v2): add task labels (create/list/delete) on /api/v2

2026-06-05 08:33:47 +00:00

huma_label_test.go

feat(labels): let bot owners manage labels created by their bots

2026-06-09 11:40:04 +00:00

huma_link_sharing_test.go

fix(link-sharing): resolve share read permission via project id so by-id reads work

2026-06-05 09:17:25 +00:00

huma_migration_csv_test.go

test(api/v2): cover the v2 file and CSV migrator endpoints

2026-06-12 08:51:19 +00:00

huma_migration_file_test.go

test(api/v2): cover the v2 file and CSV migrator endpoints

2026-06-12 08:51:19 +00:00

huma_migration_oauth_test.go

feat(api/v2): port OAuth migrators (Todoist, Trello, Microsoft To-Do)

2026-06-11 18:35:55 +00:00

huma_non_crud_aliases_test.go

feat(api/v2): expose websocket endpoint under /api/v2

2026-06-17 20:35:28 +00:00

huma_notification_test.go

fix(api/v2): return 200 from notifications mark-all (creates nothing)

2026-06-07 10:05:24 +00:00

huma_project_duplicate_test.go

fix(projects): enforce write permission on target parent when duplicating a project (GHSA-f27p-pw2p-9pr4)

2026-07-19 18:59:34 +02:00

huma_project_team_test.go

feat(api/v2): add project team shares CRUD on /api/v2

2026-06-07 15:33:20 +00:00

huma_project_test.go

test(api/v2): cover central validation (422, invalid_fields, full-body webhook updates)

2026-06-06 21:09:56 +00:00

huma_project_user_test.go

feat(api/v2): add project user shares CRUD on /api/v2

2026-06-07 10:37:59 +00:00

huma_project_view_test.go

fix(security): reject cross-project views in ProjectView Can{Delete,Update} (GHSA-gg93-x632-9ccv)

2026-07-19 18:59:34 +02:00

huma_reaction_test.go

feat(api/v2): add reactions on /api/v2

2026-06-09 21:34:22 +00:00

huma_richtext_test.go

feat(api): exchange rich-text fields as markdown on v2

2026-06-29 08:12:35 +02:00

huma_saved_filter_test.go

feat(api/v2): add saved filter CRUD on /api/v2

2026-06-07 10:40:20 +00:00

huma_session_test.go

feat(api/v2): add session list/delete on /api/v2

2026-06-05 08:21:48 +00:00

huma_subscription_test.go

docs: trim wordy comments to load-bearing whys

2026-06-07 09:57:51 +00:00

huma_task_assignee_bulk_test.go

feat(api/v2): add bulk assignee replacement on /api/v2

2026-06-09 19:42:16 +00:00

huma_task_assignee_test.go

feat(api/v2): add task assignees (create/list/delete) on /api/v2

2026-06-06 19:06:12 +00:00

huma_task_attachment_test.go

fix(attachments): keep blob mime type so pdf previews open inline (#3157)

2026-07-11 18:53:09 +02:00

huma_task_bucket_test.go

fix(kanban): authorize body task_id when moving a task into a bucket (GHSA-5pg6-m483-7vrg)

2026-07-19 18:59:34 +02:00

huma_task_collection_test.go

feat(api/v2): add task collection (task lists) on /api/v2

2026-06-11 18:31:03 +00:00

huma_task_comment_test.go

test(api/v2): assert task comment max_permission and per-caller ETag

2026-06-05 07:43:38 +00:00

huma_task_duplicate_test.go

test(api/v2): port full v1 TaskDuplicate coverage

2026-06-03 20:29:15 +00:00

huma_task_position_test.go

feat(api/v2): add task position updates on /api/v2

2026-06-10 11:55:51 +02:00

huma_task_relation_test.go

feat(api/v2): add task relations on /api/v2

2026-06-09 20:42:00 +00:00

huma_task_test.go

feat(tasks): soft-delete tasks with permanent deletion after 30 days (#3119)

2026-07-07 11:38:33 +02:00

huma_task_unread_status_test.go

feat(api/v2): add task read-status marking on /api/v2

2026-06-09 19:50:58 +00:00

huma_team_member_test.go

feat(api/v2): add team members (add/remove/admin-toggle) on /api/v2

2026-06-07 10:48:23 +00:00

huma_team_test.go

test(api/v2): assert both ETags non-empty in team permission test

2026-06-05 08:06:54 +00:00

huma_testing_test.go

test(api/v2): use cross-engine datetime literals in testing webtest

2026-06-17 12:13:50 +00:00

huma_time_entry_test.go

test(time-tracking): cover the v2 time-entry routes

2026-06-08 13:54:09 +00:00

huma_user_deletion_test.go

fix(security): hash password-reset, email-confirm and deletion tokens at rest (GHSA-r6w9-259g-gwrv)

2026-07-19 18:59:34 +02:00

huma_user_export_test.go

fix(files): never cache file downloads in v1 or v2

2026-06-17 18:39:38 +00:00

huma_user_search_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_user_settings_test.go

feat(api/v2): add user account/settings on /api/v2

2026-06-11 07:02:31 +00:00

huma_user_totp_test.go

feat(api/v2): add totp qr code endpoint

2026-06-17 18:39:38 +00:00

huma_user_webhook_test.go

feat(api/v2): add user webhooks on /api/v2

2026-06-10 19:12:41 +00:00

huma_webhook_event_test.go

test(api/v2): split the B1 webtests into per-route files

2026-06-11 20:07:43 +00:00

huma_webhook_test.go

test(api/v2): cover central validation (422, invalid_fields, full-body webhook updates)

2026-06-06 21:09:56 +00:00

integrations.go

test(api/v2): isolate project tests per-handler, not via shared harness

2026-06-05 07:40:07 +00:00

kanban_test.go

fix(kanban): prevent cross-tenant bucket relocation via project_view_id mass-assignment (GHSA-569v-q83c-3j3g)

2026-07-19 18:59:34 +02:00

label_task_test.go

test: add web tests for bulk label task endpoint

2026-03-10 23:58:44 +01:00

link_share_avatar_test.go

feat!: rename right to permission (#1277)

2025-08-13 11:05:05 +02:00

link_share_consistency_test.go

fix(api): reject link shares on reaction and task-read endpoints (consistency; GHSA-vvcv-vpph-h844)

2026-07-19 18:59:34 +02:00

link_sharing_auth_test.go

…

link_sharing_test.go

test(security): webtest that a deleted link share rejects its still-valid JWT

2026-04-09 15:38:07 +00:00

login_test.go

fix(auth): return ErrAccountLocked for locked accounts on login

2026-06-17 19:43:41 +00:00

main_test.go

refactor: use Go idioms for running tests

2026-02-17 18:01:05 +01:00

oauth2_test.go

fix(auth): reject API tokens at the OAuth authorize endpoint (GHSA-v3p6-34mc-hj7v)

2026-07-19 18:59:34 +02:00

project_pseudo_parent_test.go

test: guard parent_project_id in project responses

2026-07-26 09:39:41 +00:00

project_test.go

fix(security): require Admin to detach a project from its parent (GHSA-44v6-7fxq-vgf4)

2026-07-19 18:59:34 +02:00

register_test.go

…

sessions_test.go

test: add session lifecycle tests

2026-02-25 10:30:25 +01:00

task_attachment_idor_test.go

test: add IDOR test for task attachment ReadOne (GHSA-jfmm-mjcp-8wq2)

2026-03-23 16:34:07 +00:00

task_attachment_upload_test.go

feat: add session-based auth with refresh token rotation

2026-02-25 10:30:25 +01:00

task_by_index_test.go

test(api): cover positive project-identifier resolution

2026-05-19 08:53:25 +00:00

task_collection_test.go

fix(kanban): pin link-share task collection view to the share's project (GHSA-rj9j-8772-4h6c)

2026-07-19 18:59:34 +02:00

task_comment_test.go

fix: use require.Error instead of assert.Error for error assertions

2026-03-20 11:41:28 +00:00

task_test.go

fix(assignees): resolve 500 error when reading task assignees

2026-05-26 18:59:33 +00:00

token_test.go

…

user_change_password_test.go

test(api): add tests for password validation in reset and update flows

2026-02-25 13:44:56 +01:00

user_confirm_email_test.go

refactor: centralize HTTP error handling (#2062)

2026-01-08 10:02:59 +00:00

user_export_download_test.go

refactor: centralize HTTP error handling (#2062)

2026-01-08 10:02:59 +00:00

user_export_status_test.go

feat: show user export status in settings (#1200)

2025-07-30 15:50:26 +00:00

user_password_request_token_test.go

refactor: centralize HTTP error handling (#2062)

2026-01-08 10:02:59 +00:00

user_password_reset_test.go

test: add web test for disabled user password reset rejection

2026-03-20 11:23:21 +00:00

user_project_test.go

test: verify email masking for external team name search

2026-03-04 20:32:11 +01:00

user_show_test.go

…

user_totp_test.go

fix: update TOTP fixtures and tests to avoid conflicts with existing enrollment tests

2026-03-20 12:22:27 +00:00

webhook_test.go

test: add failing test for webhook BasicAuth credential exposure

2026-03-23 16:35:47 +00:00