xarmian d895418ea2 fix(server): gate RequireAuth's cloud-secret bypass on validated session (BUG-1944) (#1112) ...

Sibling of TASK-1932's CSRFProtect fix: RequireAuth's isCloudAdminPath +
hasCloudSecretMarker bypass fired on marker presence, not validated secret.
Mirror TASK-1932's currentUser(r) == nil gate exactly. Concretely closes a
disabled-admin gap: without the gate, a marker with the wrong secret let
RequireAuth's own user.IsDisabled() check be skipped whenever a session was
present, reaching handlers that trust a resolved admin session as an
alternative to validateCloudSecret. In-handler validation for every
cloudAdminPaths handler is unchanged and remains the independent layer for
the genuine no-session sidecar case.

2026-08-15 19:18:55 -04:00

..

artifact

feat(artifact): MD+frontmatter export/import core for playbooks & conventions (#754)

2026-06-22 11:07:37 -04:00

attachments

fix(server): force-download unknown and disallowed stored MIME (BUG-2413)

2026-08-08 20:37:39 +00:00

billing

feat(admin): add /api/v1/admin/billing-stats proxy + cloud client (TASK-827) (#266)

2026-04-27 14:42:53 -04:00

cli

feat(cli): markdown output on the remaining list surfaces; broaden ANSI stripping (#1080)

2026-08-14 22:35:23 -04:00

cmdhelp

feat(cmdhelp): tests + golden contract + drift validator (TASK-938) (#332)

2026-05-01 07:17:58 -04:00

collab

fix(collab): op-id durable fence for restore-rollback vs applier-ack race (BUG-2276 residual 2)

2026-07-21 20:51:19 -04:00

collections

feat(collections): add spec workspace template — spec-driven development (IDEA-2527) (#1081)

2026-08-12 14:20:02 -04:00

config

feat(security): enforce session UA binding under strict mode (TASK-2056) (#912)

2026-07-10 23:32:22 -04:00

diff

Initial release

2026-03-26 01:52:36 +00:00

email

feat(store): email_verification_tokens + SendEmailVerification + token reaper (TASK-1936) (#806)

2026-07-04 01:19:41 -04:00

events

fix(store): optimistic concurrency + sibling broadcast for collection settings (BUG-2265) (#989)

2026-07-21 09:43:05 -04:00

items

feat(server): add cross-workspace copy endpoint with post-commit fanout (TASK-2365)

2026-07-31 00:59:25 +00:00

links

feat(backlinks): cross-workspace wiki-links + request-independent ACL (Phase 2b) (#622)

2026-05-24 13:27:40 -04:00

logging

feat: add readiness probe and structured logging (TASK-161)

2026-04-05 15:02:54 +00:00

mcp

feat(mcp,cli): clear_assigned_user / clear_agent_role — a discoverable unassign (IDEA-2584) (#1107)

2026-08-15 13:17:01 -04:00

metrics

feat(metrics): MCP + OAuth observability metrics for /mcp (TASK-961) (#398)

2026-05-03 16:37:49 -04:00

models

feat(server,cli): watches, user-scoped event stream, plugin monitor command — PLAN-2469 Phase 1 (TASK-2533) (#1082)

2026-08-12 15:50:41 -04:00

oauth

perf(test): wire remaining store helpers onto storetest fixture (TASK-1915) (#789)

2026-07-03 12:17:03 -04:00

server

fix(server): gate RequireAuth's cloud-secret bypass on validated session (BUG-1944) (#1112)

2026-08-15 19:18:55 -04:00

store

fix(store): treat empty assignment IDs as clear-to-NULL (BUG-2566) (#1098)

2026-08-14 22:39:39 -04:00

urlimport

feat(urlimport): OpenAPI 3.x → Markdown converter (TASK-1471) (#555)

2026-05-15 00:24:14 -04:00

watchevents

feat(push): session targeting — target_session_id + delivered_sessions (TASK-2588) (#1108)

2026-08-15 14:52:25 -04:00

webhooks

fix(webhooks): track delivery goroutines + bounded retry (BUG-2012) (#864)

2026-07-08 12:02:49 -04:00