Moheeb ZaraandClaude Opus 4.8 3243e4ce98 fix(payments): verify member_id belongs to caller's space (IDOR) ...

logCashPayment and linkPaymentToMember accepted a uuid member_id without
checking it belongs to the caller's space (the equipment/class paths were
already hardened for exactly this). Look up the member scoped to the caller's
space and reject a foreign id before writing.

Co-Authored-By: Claude Opus 4.8 (1M context) <[email protected]>

2026-08-04 19:10:42 -07:00

..

classes

refactor(actions): split classes.ts into a folder (slice 3)

2026-08-04 06:01:02 -07:00

door

refactor(actions): split door.ts into a folder (slice 4)

2026-08-04 06:01:02 -07:00

forms

refactor(actions): split forms.ts into a folder (slice 5)

2026-08-04 06:01:02 -07:00

api-buttons.ts

Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

2026-05-20 20:45:44 -07:00

area-leads.ts

fix(ops): route area-lead roster writes through server actions (SoC)

2026-08-04 19:10:42 -07:00

areas.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

certifications.ts

feat(certifications): server actions + page guard

2026-05-16 18:55:17 -07:00

comms.ts

fix(comms): send messages via a server action, derive identity server-side (SoC)

2026-08-04 19:10:42 -07:00

contacts.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

dues-payments.ts

audit: remove duplicate Stripe integration card + tighten input validation

2026-05-20 00:33:08 -07:00

equipment.ts

fix(equipment): verify booked-for member belongs to caller's space (L1)

2026-08-01 21:31:51 -07:00

forum.ts

audit: fix onboarding payment_url XSS + forum comment tenant check + joinSpace rate limit

2026-05-20 02:22:50 -07:00

imports.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

incidents.ts

fix(incidents): restrict appealIncident to admin/board, no orphan proposal (M2)

2026-08-01 21:31:51 -07:00

index.ts

Door epic phases 4-5: inbound access-log ingest + universal API-call buttons

2026-05-20 20:45:44 -07:00

invites.ts

fix(invites): block re-arming an admin invite without role change (M1)

2026-08-01 21:31:51 -07:00

knowledge-base.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

member-cards.ts

feat(door): P1 member access cards + door permissions

2026-05-16 20:13:22 -07:00

members.ts

fix(security): Phase 3 post-deploy audit — 2 P0 + P1 + P2 (R5)

2026-05-18 17:01:25 -07:00

notifications.ts

audit: remove duplicate Stripe integration card + tighten input validation

2026-05-20 00:33:08 -07:00

onboarding.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

payments.ts

fix(payments): verify member_id belongs to caller's space (IDOR)

2026-08-04 19:10:42 -07:00

permissions.ts

feat: customizable permissions, per-item Ops ACLs, area-lead roles

2026-05-15 17:15:14 -07:00

policies.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

presence.ts

feat(presence): check-in/out + present/attendance actions

2026-05-16 22:14:02 -07:00

projects.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

proposals.ts

fix(proposals): block unverified members from governance writes (L2)

2026-08-01 21:31:51 -07:00

roles.ts

fix(roles): pin assignCustomRole to the caller's space (D4)

2026-05-18 18:32:07 -07:00

secrets.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

settings.ts

fix(security): vault integration secrets instead of plaintext config (R1)

2026-05-18 13:08:17 -07:00

stripe.ts

types: clear remaining tsc errors across 41 files (76→14, behavior-preserving)

2026-08-01 18:56:11 -07:00

tasks.ts

feat: governance kernel, deployment hardening, local-dev stack

2026-05-14 04:52:11 -07:00

tiers.ts

feat: forum, polymorphic comments, custom tiers, multi-invite, secrets encryption

2026-05-14 17:47:52 -07:00