Moheeb ZaraandClaude Opus 4.8 3243e4ce98 fix(payments): verify member_id belongs to caller's space (IDOR) ...

logCashPayment and linkPaymentToMember accepted a uuid member_id without
checking it belongs to the caller's space (the equipment/class paths were
already hardened for exactly this). Look up the member scoped to the caller's
space and reject a foreign id before writing.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-04 19:10:42 -07:00

..

actions

fix(payments): verify member_id belongs to caller's space (IDOR)

2026-08-04 19:10:42 -07:00

door

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

email

feat(notifications): P2b email transport seam (Resend via fetch)

2026-05-17 04:50:34 -07:00

notifications

observability: backend-agnostic error-capture seam (Phase 1, inert until SENTRY_DSN)

2026-05-21 17:00:37 -07:00

observability

observability: backend-agnostic error-capture seam (Phase 1, inert until SENTRY_DSN)

2026-05-21 17:00:37 -07:00

secrets

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

stripe

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

supabase

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

validations

fix(comms): send messages via a server action, derive identity server-side (SoC)

2026-08-04 19:10:42 -07:00

api-call-logic.ts

Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

2026-05-20 20:45:44 -07:00

auth-actions.ts

fix(invites): close single-use invite max_uses TOCTOU (H1)

2026-08-01 21:16:12 -07:00

auth-config.ts

feat(auth): gate OAuth buttons on login behind config flags

2026-05-16 18:26:36 -07:00

auth-helpers.ts

types: restore Supabase row typing, fix parseInput inference (586→76 tsc errors)

2026-08-01 18:40:33 -07:00

certifications-guard.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

certifications-logic.ts

feat(certifications): pure expiry/status logic + Zod schemas

2026-05-16 18:52:53 -07:00

classes-guard.ts

feat(classes): server actions + page guard

2026-05-16 19:32:17 -07:00

classes-logic.ts

feat(classes): optional required-form gate at signup (waiver-on-file)

2026-05-16 21:41:01 -07:00

door-guard.ts

feat(door): P2 connections + SSRF-safe executor + native adapter + audit

2026-05-16 20:31:43 -07:00

door-log-logic.ts

fix(door): correct parseHeatSyncLog stale time + token reuse (L5)

2026-08-01 21:31:34 -07:00

door-logic.ts

fix(door): block hex IPv4-mapped IPv6 in the SSRF filter (M3)

2026-08-01 21:31:34 -07:00

door-slots-logic.ts

feat(door): P3-B pure slot allocator (lowest-free, range-generic) + tests

2026-05-16 21:07:36 -07:00

dues-payments-logic.ts

fix(payments): advance-only last_paid_at, no dues regression (M4/M5)

2026-08-01 21:31:34 -07:00

equipment-guard.ts

feat(equipment): server actions + page guard

2026-05-16 19:51:51 -07:00

equipment-logic.ts

feat(equipment): pure overlap/eligibility logic + Zod schemas

2026-05-16 19:50:00 -07:00

form-templates.ts

feat(forms): obvious publish flow, member Forms surface, templates (P8)

2026-05-16 17:41:16 -07:00

forms-guard.ts

feat(forms): space-scoped public URL /f/[space]/[slug] (P6)

2026-05-16 17:21:39 -07:00

forms-logic.ts

fix(forms): link by an email collected as a form field, not only submitter_email

2026-05-17 00:31:33 -07:00

forms-schema.ts

feat(forms): server actions, Zod schemas, and dynamic answer validation (Phase 2)

2026-05-16 14:51:20 -07:00

import-logic.ts

fix(import): guard unparseable CSV dates and never wedge the button (L7)

2026-08-01 21:31:51 -07:00

incident-logic.ts

feat(incidents): anonymous report tracking by token + public /track

2026-05-16 18:13:09 -07:00

invite-claim.ts

fix(invites): close single-use invite max_uses TOCTOU (H1)

2026-08-01 21:16:12 -07:00

invite-logic.ts

feat(invites): role-granting + usage-capped invites; audit hardening (P7)

2026-05-16 17:34:45 -07:00

markdown-anchors.ts

feat(markdown): KB/process render + working in-document anchor links

2026-05-16 19:11:49 -07:00

notifications-logic.ts

notifications(P4g): strip URLs from user-controlled render inputs

2026-05-19 17:24:01 -07:00

notifications-prefs-logic.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00

paypal-logic.ts

refactor(paypal): extract + unit-test sync mapping; reuse auth helper (R3)

2026-05-18 13:13:16 -07:00

permissions-cache.ts

perf(ux): request-cached permission checks (dedupe RPC fan-out)

2026-05-17 01:36:54 -07:00

permissions-catalog.ts

Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

2026-05-20 20:45:44 -07:00

permissions.ts

fix(auth): unverified members cannot exercise roles; single-membership join (D2)

2026-05-18 18:30:20 -07:00

presence-logic.ts

feat(attendance): richer /attendance (here-now, search, day filter, grouping)

2026-05-16 22:42:07 -07:00

profile-presets.ts

Add notification preferences and alternate dues payment options

2026-05-19 20:26:32 -07:00

role-labels.ts

refactor: dead-code cleanup + drop the lib/types shim (slice 9)

2026-08-04 06:19:11 -07:00

security.ts

refactor: dead-code cleanup + drop the lib/types shim (slice 9)

2026-08-04 06:19:11 -07:00

stripe-logic.ts

feat(billing): P1b pure Stripe dues logic + 10 tests

2026-05-17 02:59:02 -07:00

utils.ts

Initial commit from v0

2026-03-11 04:44:48 +00:00