devv-eve 8c0708bb5d fix(server): validate workspace membership for subscriptions and uploads (#935) ...

* fix(server): validate workspace membership for subscription targets and file uploads

Closes MED-1 (cross-workspace subscription injection) and MED-2 (file upload
missing workspace member validation) from the security audit.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* test(server): add negative tests for cross-workspace subscription and upload

Address PR review feedback:
- Add tests verifying cross-workspace user_id is rejected with 403 on
  subscribe and unsubscribe
- Add test verifying upload with foreign workspace_id is rejected with 403
- Make isWorkspaceEntity explicitly enumerate "member"/"agent" and reject
  unknown user types

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Devv <devv@Devvs-Mac-mini.local>
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-04-13 20:22:03 -07:00

..

activity_test.go

…

activity.go

feat(assign): sort members & agents by user's assignment frequency (#652)

2026-04-10 18:45:08 +08:00

agent.go

fix(daemon): embed triggering comment content in agent prompt

2026-04-13 14:20:26 +08:00

auth.go

fix(auth): increase email verification code resend cooldown to 60s (#912)

2026-04-14 02:35:34 +08:00

chat.go

feat(chat): add session history panel to view archived conversations (#602)

2026-04-10 02:40:55 +08:00

comment.go

fix(comment): set trigger_comment_id to actual reply, not thread root (#871)

2026-04-13 19:53:23 +08:00

daemon_test.go

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

daemon.go

fix(daemon): prevent duplicate runtime registration on profile switch (#906)

2026-04-14 01:52:34 +08:00

file_test.go

fix(server): validate workspace membership for subscriptions and uploads (#935)

2026-04-13 20:22:03 -07:00

file.go

fix(server): validate workspace membership for subscriptions and uploads (#935)

2026-04-13 20:22:03 -07:00

handler_test.go

test(issue): cover explicit sub-issue project

2026-04-14 01:51:48 +08:00

handler.go

fix(server): validate workspace membership for subscriptions and uploads (#935)

2026-04-13 20:22:03 -07:00

inbox.go

fix(inbox): archive all items for the same issue instead of just one

2026-04-04 00:18:14 +08:00

issue_reaction.go

…

issue.go

fix(issue): inherit parent project for sub-issues

2026-04-14 01:30:40 +08:00

personal_access_token.go

…

pin.go

feat: add pin to sidebar for issues and projects (#653)

2026-04-10 19:00:25 +08:00

project.go

fix(web): correct project kanban issue counts (#667)

2026-04-10 21:13:25 +08:00

reaction.go

…

runtime_ping.go

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

runtime_update.go

fix(security): add workspace ownership checks to daemon API routes (#684)

2026-04-11 12:49:23 +08:00

runtime.go

fix(daemon): prevent duplicate runtime registration on profile switch (#906)

2026-04-14 01:52:34 +08:00

search_test.go

feat(search): add project search support to Cmd+K search (#663)

2026-04-10 20:59:32 +08:00

skill.go

fix(handler): add .claude/skills/ candidate path for skills.sh import (#792)

2026-04-12 23:39:46 +08:00

subscriber_test.go

fix(server): validate workspace membership for subscriptions and uploads (#935)

2026-04-13 20:22:03 -07:00

subscriber.go

fix(server): validate workspace membership for subscriptions and uploads (#935)

2026-04-13 20:22:03 -07:00

trigger_test.go

refactor: remove agent triggers config field (#469)

2026-04-07 22:02:28 +08:00

workspace.go

fix(workspace): surface slug conflicts (#895)

2026-04-14 00:09:12 +08:00