Anso 8d1304b0df fix(hub-only-guard): reject hub-only collection paths without trailing slash (#1142) ...

HUB_ONLY_PREFIXES entries are stored with a trailing slash, but
isHubOnlyPath() used a bare startsWith(). The collection paths
/api/scheduled-tasks, /api/audit-log, and /api/notification-routes
(no trailing slash) silently fell through the guard and could be
forwarded by the remote proxy, bypassing the hub-only boundary on
three path families.

The matcher now accepts the exact prefix (slash stripped) in addition
to the slash-suffixed prefix. Adds three regression tests covering
the bare-collection-path 403 for each hub-only family. Confirmed the
new tests fail without the matcher change and pass with it.

2026-05-21 16:42:18 -04:00

..

scripts

fix(fleet): resolve getSenchoVersion crash in Docker containers (#396)

2026-04-06 00:44:36 -04:00

src

fix(hub-only-guard): reject hub-only collection paths without trailing slash (#1142)

2026-05-21 16:42:18 -04:00

.npmrc

chore(deps): upgrade major dependencies (ESLint 10, recharts 3, TS 6, Vite 8) (#130)

2026-03-25 00:03:08 -04:00

eslint.config.mjs

refactor(backend): collapse entitlement provider abstraction back to LicenseService (#889)

2026-05-02 23:45:44 -04:00

package-lock.json

chore(deps): bump the all-npm-backend group in /backend with 10 updates (#1131)

2026-05-21 01:02:49 -04:00

package.json

chore(deps): bump the all-npm-backend group across 1 directory with 8 updates (#943)

2026-05-07 23:36:45 -04:00

tsconfig.json

perf(build): enable incremental tsc (#827)

2026-04-28 09:15:54 -04:00

vitest.config.ts

perf(test): build baseline DB once via vitest globalSetup (#829)

2026-04-28 10:08:39 -04:00