Repository navigation
Develop - #206
Merged
Merged
Develop#206
Conversation
Supabase stops granting Data API roles access to new public tables on October 30. Grant service_role access to MCP audit records, which migration 0018 omitted, and remove legacy default grants so existing databases match a rebuilt schema: anon only reads published legal releases and authenticated keeps only RLS-evaluated row operations. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Registration consent capture from migration 0026 rejected the synthetic auth users in the account-deletion and retention scripts. Mark them as operator-provisioned so the scripts test their own contracts again. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add SECURITY.md with private vulnerability reporting and the security@tickist.com contact, link it from the README, and record the security invariants that the following hardening commits enforce. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
zod before 4.6.6 can exhaust memory while validating oversized constrained collections (GHSA-mrhx-c7xc-m3w5). The MCP Worker validates tool input with zod; @angular/cli keeps its own bundled copy for tooling. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Port the auth findings of a private security report against the sibling Spendist project: - Migration 0036 caps user metadata at 16 KB, clears the first password when an unconfirmed address signs up again (Supabase Auth keeps it), so only the mailbox owner can claim the account through recovery, clamps usernames copied from metadata, and resolves invitations only for confirmed accounts. - The Supabase client no longer applies email-link sessions on its own. AuthCallbackService applies them before the first navigation and asks at /auth/switch-account before replacing a different signed-in account. Password recovery mode starts only after a recovery token was applied. - Sign-up, sign-in, password reset and the current-password check send a Cloudflare Turnstile token when NG_APP_TURNSTILE_SITE_KEY is set (production key in wrangler.toml). CSP allows challenges.cloudflare.com and production deploys fail without the key. - Local Auth keeps SMS confirmations on so email sign-up does not reveal existing accounts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A project owner could tell whether an invited address had an account, and read its user id, from the pending project_members row. Migration 0037 records every invitation, known address or not, in the owner-only project_invitations table. Pending and declined membership rows are visible only to the invitee. Cancelling an invitation removes the hidden row, and accepting one removes the record. Direct member inserts are limited to existing collaborators and fail the same way for unknown ids. Membership changes, invitation cancellation and the project-invite function reject OAuth-client (MCP) tokens. project-invite answers invite_processed for unknown, pending, declined and recently invited addresses, and cleans the project name it sends. The client reads membership status again, so invitees see pending invitations in Team. Owners see and cancel invitations in the sharing tab. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Migration 0038 rejects infinite reminder, suspension and finish dates, adds length limits to project, task, step and tag text, caps scheduled reminders per task (20) and account (500), and claims at most five due reminders per account per run with 50 reminder emails per account per day. Task-resume notifications stop after 20 per day. Assignee labels and notification text drop control and bidirectional characters. Avatar object names reject dot segments. The digest runner reads every preference in stable pages instead of the first 500, reminder and project notifications clean user text, MCP schemas share the database limits, and the storage backup skips object names with dot segments. tools/security/security-hardening.integration.sql covers migrations 0036-0038. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Document Turnstile rollout (deploy the site key before enabling captcha in Supabase Attack Protection), email-link account switching, repeat sign-up recovery, invitation privacy, data limits and the new integration test. Note that platform-owned pg_net grants cannot be revoked by migrations and that the optional MCP OAuth smoke test needs the secret key once captcha is enabled. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The task editor saves automatically 500 ms after a change. While the year is typed, a date input reports intermediate past values such as 0002-10-31 or 0202-10-31; with a time already set, autosave stored that reminder and the runner emailed it within a minute. Correcting the date later rescheduled the same reminder, so it was sent again on the intended day. Reminder drafts are now valid only when their date and time are in the future, and migration 0039 rejects user-scheduled reminders more than five minutes in the past. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All emails now share supabase/functions/_shared/email-layout.ts: logo, a content card, an indigo call-to-action button and a footer with links to Tickist and the email settings. - send-emails wraps every outbox message in the layout when it sends it, so reminders, daily and weekly summaries, project invitations and task-resume emails look the same; plain-text messages become paragraphs. Reminders link to their project, invitations to Team and summaries to the app. - npm run email:templates renders the Supabase Auth templates (confirmation, recovery, magic link, email change, invite, reauthentication) from the same layout into supabase/templates/. Local Auth reads them through config.toml, and the production deploy pushes subjects and templates to hosted Auth with the existing Management API call. - CI and the deploy check that the generated templates are current. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.