xarmian 0c0a71f96b fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796) ...

canEditComment's unconditional u.Role == "admin" bypass let a
bearer-authed (PAT/CLI/MCP) platform admin edit or delete any user's
comment in a workspace where they're a member, contradicting the
BUG-1616/1617 bearer-suppression intent (same family as BUG-1917/1918).
Gate the bypass on !isBearerAuth(r), mirroring the idiom already used
in handlers_collab.go's authorizeCollabAccess. Cookie-session admins
keep the existing behavior, including editing empty-user_id legacy
comments; bearer-authed authors can still edit their own comments.

2026-07-03 18:24:36 -04:00

..

artifact

feat(artifact): MD+frontmatter export/import core for playbooks & conventions (#754)

2026-06-22 11:07:37 -04:00

attachments

fix(ci): gofmt + bump race-detector timeout to 30m (#299)

2026-04-29 15:41:12 -04:00

billing

feat(admin): add /api/v1/admin/billing-stats proxy + cloud client (TASK-827) (#266)

2026-04-27 14:42:53 -04:00

cli

fix(cli): detect machine-level agent tools, not just project-local (BUG-1156) (#783)

2026-07-02 22:05:46 -04:00

cmdhelp

feat(cmdhelp): tests + golden contract + drift validator (TASK-938) (#332)

2026-05-01 07:17:58 -04:00

collab

feat(collab): op-log cursor protocol — force-refresh + watermark advance (TASK-1319) (#472)

2026-05-09 21:45:46 -04:00

collections

test(collections): drift-guard for NL-canonical playbook invocation (TASK-1862) (#752)

2026-06-21 15:36:47 -04:00

config

fix(cli): pin server URL in .pad.toml for remote workspaces (BUG-1535) (#595)

2026-05-19 17:02:46 -04:00

diff

Initial release

2026-03-26 01:52:36 +00:00

email

feat(email): cloud-mode marketing footer in transactional emails (TASK-907) (#317)

2026-04-30 00:09:52 -04:00

events

feat(api): bulk-mutation endpoint + single SSE batch event (TASK-1668) (#669)

2026-05-30 18:41:55 -04:00

items

feat(playbooks): add invocation_slug + arguments schema fields (TASK-1378) (#517)

2026-05-12 17:17:56 -04:00

links

feat(backlinks): cross-workspace wiki-links + request-independent ACL (Phase 2b) (#622)

2026-05-24 13:27:40 -04:00

logging

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

mcp

feat(server): REST endpoints for project next/standup/changelog + WebMCP wiring (TASK-1894) (#791)

2026-07-03 13:51:04 -04:00

metrics

feat(metrics): MCP + OAuth observability metrics for /mcp (TASK-961) (#398)

2026-05-03 16:37:49 -04:00

models

fix(ci): gofmt internal/models/workspace.go to unbreak Go job (BUG-1911) (#784)

2026-07-02 22:45:01 -04:00

oauth

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

server

fix(server): bearer-gate canEditComment's admin bypass (BUG-1919) (#796)

2026-07-03 18:24:36 -04:00

store

perf(test): build the SQLite migration chain once per test binary (IDEA-1914) (#788)

2026-07-03 10:15:49 -04:00

urlimport

feat(urlimport): OpenAPI 3.x → Markdown converter (TASK-1471) (#555)

2026-05-15 00:24:14 -04:00

webhooks

feat: rebrand to Perpetual Software + new tagline (IDEA-832) (#273)

2026-04-28 12:26:39 -04:00