Ruben FiszelandClaude Opus 4.7 593522033a fix(auth): require workspace membership for g/ owner tokens (WIN-1986) ...

WIN-1978's tightening of the `g/<groupname>` owner branch only verified
that the group exists in the target workspace. The default `all` group
is provisioned in every workspace, so any forged `owner=g/all` token
paired with an arbitrary `workspace_id` still passed the existence check
and authenticated as a group user there — including for an email that
was not a member of that workspace.

Additionally require the token holder's email to be a non-disabled
member of the target workspace, mirroring the spirit of the `u/`
branch's `usr` lookup. Adds an integration regression covering both the
forged non-member case and the legitimate member case.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

2026-05-25 15:05:40 +00:00

..

src

refactor: move integration tests to subcrates to reduce recompilation

2026-02-11 14:04:54 +00:00

tests

fix(auth): require workspace membership for g/ owner tokens (WIN-1986)

2026-05-25 15:05:40 +00:00

Cargo.toml

fix: advance postgres replication slot lsn via periodic standby status updates (#9227)

2026-05-19 05:44:13 +00:00