Commit Graph

Select branches

Hide Pull Requests

main

Mono Color

• d81a49175b Updated main Superminaren 2026-10-14 23:30:02 +02:00
• 04145e5985 Merge #9: single-tenant mode + setup CLI + drop unsafe signup trigger Moheeb Zara 2026-08-05 13:20:36 -07:00
• c0d5ffd8fc audit: implement --force admin password reset + update HANDOFF Moheeb Zara 2026-08-05 13:15:27 -07:00
• 7b8d2ae167 feat(tenant): setup CLI, CD glue, bundled compose, docs + security fix Moheeb Zara 2026-08-05 13:02:18 -07:00
• 646d2e542c feat(tenant): single-tenant mode core (config SSOT + server/UI guards + branding) Moheeb Zara 2026-08-05 12:43:11 -07:00
• 85f3655e6f docs: update HANDOFF with shipped docs state + the proxy public-route fix Moheeb Zara 2026-08-05 11:39:46 -07:00
• 877f787383 fix(proxy): make /docs public so the docs site is reachable without a session Moheeb Zara 2026-08-05 03:26:26 -07:00
• 08290302a5 Merge #8: public docs section (Diátaxis) + homepage fix for signed-in users Moheeb Zara 2026-08-05 03:20:11 -07:00
• 8edc9da611 docs: audit corrections, coverage pages, screenshots, and em-dash removal Moheeb Zara 2026-08-05 03:15:07 -07:00
• 16229ae523 feat(docs): add a Diátaxis documentation section to the public site Moheeb Zara 2026-08-05 00:42:42 -07:00
• fc6adaf16e fix(landing): let signed-in users browse the marketing site instead of bouncing to /dashboard Moheeb Zara 2026-08-05 00:02:35 -07:00
• 1b0794d8ff Merge #7: audit, cleanup & architecture refactor — type-safety, bug fixes, decomposition, DB-backed CI Moheeb Zara 2026-08-04 23:48:21 -07:00
• 7a5d99cf01 test(e2e): tolerate the /login redirect on protected-route load checks Moheeb Zara 2026-08-04 23:43:28 -07:00
• 5047aef0da ci: run DB-backed integration + Playwright e2e with a Supabase service Moheeb Zara 2026-08-04 22:53:48 -07:00
• 4aa6646499 fix(onboarding): atomic DB append for step completion (deferred bug L3) Moheeb Zara 2026-08-04 22:36:12 -07:00
• b2b463491a refactor(types): regenerate database types from canonical schema; drop TODO(types) join casts Moheeb Zara 2026-08-04 22:21:29 -07:00
• 4f4e3096ca docs: add HANDOFF-audit-cleanup.md (state, verify steps, follow-ups, merge path) Moheeb ZaraandClaude Opus 4.8 2026-08-04 21:27:26 -07:00
• 2226f8f746 polish(ops): friendly not-found message on cross-space area-lead update Moheeb ZaraandClaude Opus 4.8 2026-08-04 21:26:55 -07:00
• 8ddc8b7b88 docs: record the SoC pass + browser smoke test; update known limitations Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:12:28 -07:00
• 61ffc2e01f fix(invites): distinguish CAS contention from a real use-cap (retry vs reject) Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:52 -07:00
• 33b2475e67 fix: revalidate /customize (not /settings) after customize-panel mutations Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:52 -07:00
• 2dbd52e2e4 test: add authz/scope/anti-impersonation tests for the new actions Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:42 -07:00
• 3243e4ce98 fix(payments): verify member_id belongs to caller's space (IDOR) Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:42 -07:00
• 1aa0cd818a fix(comms): send messages via a server action, derive identity server-side (SoC) Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:42 -07:00
• 510187a58d fix(ops): route area-lead roster writes through server actions (SoC) Moheeb ZaraandClaude Opus 4.8 2026-08-04 19:10:42 -07:00
• 46ea2f1cce docs: add ARCHITECTURE.md; mark Phase C+D complete in the audit log (Phase D) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:20:38 -07:00
• f775f954ad refactor: dead-code cleanup + drop the lib/types shim (slice 9) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:19:11 -07:00
• 71ba558522 fix(secrets): store ops-created secrets encrypted via createSecret (security) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:15:45 -07:00
• 9100532bef refactor(members): decompose members-client + fix form-field focus bug (slice 8) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:14:25 -07:00
• 543b1d65eb refactor(settings): decompose settings-client into panels (slice 7) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:14:24 -07:00
• 7bc6609ac2 refactor(ops): decompose ops-client into panels + components (slice 6) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:14:24 -07:00
• f86fff62d0 refactor(actions): split forms.ts into a folder (slice 5) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:01:02 -07:00
• 39bcdd9677 refactor(actions): split door.ts into a folder (slice 4) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:01:02 -07:00
• dbaae4851b refactor(actions): split classes.ts into a folder (slice 3) Moheeb ZaraandClaude Opus 4.8 2026-08-04 06:01:02 -07:00
• e205ce54c0 docs: record CI + Phase C slices 0-2 in the audit log Moheeb ZaraandClaude Opus 4.8 2026-08-02 04:22:32 -07:00
• 3f7e9d96fa refactor(types): move hand-written domain types to types/domain/* (slice 2) Moheeb ZaraandClaude Opus 4.8 2026-08-02 04:21:19 -07:00
• 18d5e22ad4 refactor(validations): split lib/validations.ts into a barrel'd folder (slice 1) Moheeb ZaraandClaude Opus 4.8 2026-08-02 04:19:11 -07:00
• c8c60358c7 refactor(types): mark types/database.ts as generated (slice 0) Moheeb ZaraandClaude Opus 4.8 2026-08-02 04:11:25 -07:00
• f571001ac2 ci: add a checks-only workflow (typecheck + lint + unit tests) Moheeb ZaraandClaude Opus 4.8 2026-08-02 04:10:57 -07:00
• edffb2780c docs: record Phase A + Phase B progress in the audit log Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:33:40 -07:00
• ad010edb41 test: cover the authz primitives (getAuthMember/requireMember/requireMemberWithRole) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:33:15 -07:00
• 9bd21b185d fix(import): guard unparseable CSV dates and never wedge the button (L7) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:51 -07:00
• 8274af7d5c fix(equipment): verify booked-for member belongs to caller's space (L1) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:51 -07:00
• c7a6cd3853 fix(proposals): block unverified members from governance writes (L2) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:51 -07:00
• 7fc08c5165 fix(incidents): restrict appealIncident to admin/board, no orphan proposal (M2) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:51 -07:00
• 7fe3ffc632 fix(invites): block re-arming an admin invite without role change (M1) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:51 -07:00
• 4b98c21e2b fix(payments): advance-only last_paid_at, no dues regression (M4/M5) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:34 -07:00
• 90c68faa25 fix(door): correct parseHeatSyncLog stale time + token reuse (L5) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:34 -07:00
• a3e9b97292 fix(door): block hex IPv4-mapped IPv6 in the SSRF filter (M3) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:31:34 -07:00
• f337a85682 build: remove typescript.ignoreBuildErrors now that tsc is clean Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:23:22 -07:00
• d18d6acaff test: replace tautological actions.test with real authz/IDOR tests Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:23:04 -07:00
• 0913346741 fix(payments): guard nullable display_name in the link-payment picker (L6) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:19:29 -07:00
• 70b85a20fa fix(members): repair broken member-directory visibility gate Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:19:29 -07:00
• da11127ca4 fix(members): guard nullable display_name/email in the members list (M6) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:19:29 -07:00
• 2ee929658e fix(invites): close single-use invite max_uses TOCTOU (H1) Moheeb ZaraandClaude Opus 4.8 2026-08-01 21:16:12 -07:00
• 624a708d8c tooling: add ESLint 9 flat config and a typecheck script Moheeb ZaraandClaude Opus 4.8 2026-08-01 20:37:56 -07:00
• b1edb5c460 types: clear remaining tsc errors across 41 files (76→14, behavior-preserving) Moheeb ZaraandClaude Opus 4.8 2026-08-01 18:56:11 -07:00
• 1766780bca types: restore Supabase row typing, fix parseInput inference (586→76 tsc errors) Moheeb ZaraandClaude Opus 4.8 2026-08-01 18:40:33 -07:00
• 9ac0c2486c Use the real hack.build logo mark (wrench-in-ring), not a reconstruction Moheeb Zara 2026-07-29 02:34:26 -07:00
• ec923a845e Use the real hack.build logo and fix the showcase grid Moheeb Zara 2026-07-29 02:11:35 -07:00
• 3f1ce77900 Add the talk to the landing showcase; point Atlas at its subdomain Moheeb Zara 2026-07-28 23:37:46 -07:00
• b6e50c0950 Add talk to resources, public-site nav, and homepage link Moheeb Zara 2026-07-28 23:18:50 -07:00
• 62c1c5f4b7 glitchtip: pin image to 6.1.6 for reproducibility; HANDOFF observability complete Moheeb Zara 2026-05-22 01:17:41 -07:00
• 65458b71ec docs: HANDOFF observability Phase 2 complete (GlitchTip live on prod, DSN wired) Moheeb Zara 2026-05-22 01:09:16 -07:00
• ad4b9f5a12 glitchtip: default to port 8100 to avoid Supabase Kong (8000) collision Moheeb Zara 2026-05-21 17:39:00 -07:00
• b72e628c14 observability Phase 2: optional self-hosted GlitchTip as a committed one-command compose Moheeb Zara 2026-05-21 17:30:49 -07:00
• c89e4d95e1 observability: backend-agnostic error-capture seam (Phase 1, inert until SENTRY_DSN) Moheeb Zara 2026-05-21 17:00:37 -07:00
• 95f79771ec docs: record spine A1+A2 prod provisioning; fix crontab CRON_SECRET footgun Moheeb Zara 2026-05-21 00:29:05 -07:00
• 0b6ef20891 add spine-validation owner runbook; lock privilege-escalation RLS test Moheeb Zara 2026-05-20 23:22:48 -07:00
• 32934124c2 mobile: fix flex-row text overflow; parallelize door-ingest poll; docs refresh Moheeb Zara 2026-05-20 21:55:49 -07:00
• 0ac69abc8e door ingest: anchor card matching to the HeatSync hex-uid model Moheeb Zara 2026-05-20 21:31:11 -07:00
• 7ec90b0f1e Door epic phases 4-5: inbound access-log ingest + universal API-call buttons Moheeb Zara 2026-05-20 20:45:44 -07:00
• 6a892cbad5 docs: HANDOFF session closeout for the passes 56-62 arc + recalibrated backlog Moheeb Zara 2026-05-20 16:22:59 -07:00
• 5f22ac4cfa docs: HANDOFF deploy state for passes 60-62 (run 26153548195) Moheeb Zara 2026-05-20 02:24:51 -07:00
• c0d6d496f8 audit: fix onboarding payment_url XSS + forum comment tenant check + joinSpace rate limit Moheeb Zara 2026-05-20 02:22:50 -07:00
• 36afa7ea2c audit: remove duplicate Stripe integration card + tighten input validation Moheeb Zara 2026-05-20 00:33:08 -07:00
• 49d8805b4c settings: move dues config (Stripe + payment links) into its own Dues tab Moheeb Zara 2026-05-20 00:11:06 -07:00
• be756035d5 docs: HANDOFF deploy state for pass-59 (run 26144230714) Moheeb Zara 2026-05-19 22:56:12 -07:00
• 5d153b4d68 In-app notification inbox, consolidate /profile into /me, theme realign Moheeb Zara 2026-05-19 22:51:44 -07:00
• a7d880d747 hotfix: drop notification_preferences.space_id FK breaking auth (PGRST201) Moheeb Zara 2026-05-19 22:07:40 -07:00
• ef34089e57 harden: isSafeDuesUrl requires literal https:// so app and DB CHECK agree Moheeb Zara 2026-05-19 21:49:51 -07:00
• bcbe86424d docs: HANDOFF deploy state for the audit follow-up (run 26141570221) Moheeb Zara 2026-05-19 21:37:42 -07:00
• f2534323da security: enforce https on dues_payment_methods.url at the data layer Moheeb Zara 2026-05-19 21:35:49 -07:00
• 5ce6b29d4a test: integration coverage for dues_payment_methods RLS and dispatcher skip Moheeb Zara 2026-05-19 20:44:08 -07:00
• 897ff99726 docs: HANDOFF deploy state for pass-57/58 (run 26139360768, ab8c22a) Moheeb Zara 2026-05-19 20:28:48 -07:00
• ab8c22ae1d Add notification preferences and alternate dues payment options Moheeb Zara 2026-05-19 20:26:32 -07:00
• addedfdb0f docs: HANDOFF pass-56 closeout, recalibrated backlog for the next session Moheeb Zara 2026-05-19 18:33:15 -07:00
• febd0a8c11 docs: HANDOFF pass-56 deploy state, run 26135623172 success Moheeb Zara 2026-05-19 18:30:15 -07:00
• a61e34d98d docs: HANDOFF pass-56, record P4g phishing-defense audit fix Moheeb Zara 2026-05-19 17:24:42 -07:00
• 09f293e3c1 notifications(P4g): strip URLs from user-controlled render inputs Moheeb Zara 2026-05-19 17:24:01 -07:00
• 47e2b4614d docs: pass-56 second-audit touchups, lockdown note + style nit Moheeb Zara 2026-05-19 16:18:47 -07:00
• 3dead56e5c docs: HANDOFF pass-56 addendum, audit findings + P4f hardening commit Moheeb Zara 2026-05-19 16:13:04 -07:00
• bd8f22a3ff notifications(P4f): audit fixes, lock down 047 + best-effort enqueue paths Moheeb Zara 2026-05-19 16:12:03 -07:00
• 6abac53380 docs: HANDOFF pass-56, Phase 4 notification breadth + migration 047 Moheeb Zara 2026-05-19 15:32:39 -07:00
• a2ea7675e7 notifications(P4d): form submission submitter + admin alerts Moheeb Zara 2026-05-19 15:28:21 -07:00
• 105b62f28a notifications(P4c): class signup registered/waitlisted/promoted + session-cancelled Moheeb Zara 2026-05-19 15:22:50 -07:00
• 64ffa4ea63 notifications(P4b): equipment booking confirmed + cancelled emails Moheeb Zara 2026-05-19 15:19:53 -07:00
• 84d31ee74b notifications(P4a): shared enqueue helper, refactor stripe webhook to use it Moheeb Zara 2026-05-19 15:17:15 -07:00
• 792534ee7b docs: HANDOFF pass-55 — session closeout + prioritized backlog for the next session Moheeb Zara 2026-05-19 14:39:10 -07:00
• 19dc6321be docs: fix doc drift from D/F/G work — migration 046, harness, subsystem-level facts Moheeb Zara 2026-05-19 14:19:44 -07:00