Ruben FiszelandClaude Opus 4.8 6156e2372a fix: gate native integration pickers behind non-operator check (#9465) ...

Operators are read-only and cannot create native triggers, yet the
google/github/nextcloud integration picker routes had no authorization
gate, letting any workspace member drive the admin-configured
integration's upstream API and enumerate its data (Drive files, repo
names, calendars, events).

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-07 08:18:14 +00:00

..

fixtures

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

ai_routes.rs

fix(ai): enforce RLS and scope check on user-supplied X-Resource-Path (#9276)

2026-05-21 15:21:27 +00:00

apps.rs

test: add integration test for public_app_by_custom_path endpoint (#8735)

2026-04-06 13:17:00 +00:00

audit.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

capture_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

ci_tests.rs

feat: WM_TESTED_RUNNABLE env var + wildcards in test: annotation (#8926)

2026-04-24 12:52:25 +00:00

concurrency_groups.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

configs.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

drafts.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

favorites.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

flows.rs

fix(auth): filter script/flow listings by token scope (GHSA-2ppx-66jv-wpw5) (#9426)

2026-06-03 08:34:43 +00:00

folder_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

folders.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

granular_acls.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

group_history.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

groups.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

health.rs

test nits

2026-03-27 12:28:54 +00:00

inputs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

job_metrics.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

jobs_authed.rs

test nits

2026-03-27 12:28:54 +00:00

jobs_unauthed.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

native_triggers.rs

fix: gate native integration pickers behind non-operator check (#9465)

2026-06-07 08:18:14 +00:00

npm_proxy.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

offboarding.rs

feat: add user offboarding flow with object reassignment (#8647)

2026-04-09 17:31:36 +00:00

permissions.rs

feat: store hashed tokens instead of plaintext (#8217)

2026-03-17 01:15:38 +00:00

protection_rules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

raw_apps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

resources.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

run_inline.rs

feat: mcp oauth gateway (#8443)

2026-03-20 16:12:59 +00:00

schedules.rs

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

scripts.rs

fix(auth): filter script/flow listings by token scope (GHSA-2ppx-66jv-wpw5) (#9426)

2026-06-03 08:34:43 +00:00

sensitive_log_masking.rs

feat: support assigning a worker tag to app inline scripts (#9002)

2026-05-01 17:21:17 +00:00

service_logs.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

settings.rs

fix: move alert config from config table to global_settings (#8762)

2026-04-08 15:54:44 +00:00

slack_approvals_unauthed.rs

fix: authenticate slack callback payload with per-workspace hmac (#9461)

2026-06-06 08:02:20 +00:00

token_hash.rs

fix(native-triggers): serialize Google channel renewal across replicas (#9060)

2026-05-08 07:59:46 +00:00

token_label_idor.rs

fix: prevent token label collision bypassing job read access control (#9462)

2026-06-06 07:47:52 +00:00

trash.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

trigger_e2e.rs

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00

triggers.rs

fix: replace email with permissioned_as for triggers/schedules (#8439)

2026-03-20 16:28:38 +00:00

users.rs

feat: edit scopes on existing API tokens (#8967)

2026-04-29 19:49:56 +00:00

variables.rs

fix(security): scope variable and resource value caches by caller identity (#9427)

2026-06-03 10:31:45 +00:00

workspace_comparison.rs

fix: fork compare visibility for non-admins and stale-token superadmins (#9283)

2026-05-22 08:03:59 +00:00

workspace_dependencies_git_sync.rs

fix: scope promotion-mode debounce key per repo (#9145)

2026-05-13 11:35:30 +00:00

workspace_deps.rs

chore: upgrade axum 0.7 to 0.8 (#8539)

2026-03-27 09:55:04 +00:00

workspace_encryption_key_git_sync.rs

fix: batch encryption-key rotation into one git-sync job (#9355)

2026-05-29 05:12:35 +00:00

workspaces.rs

feat: add metadata generation model setting (#9418)

2026-06-03 10:33:16 +00:00