This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Flea Flicker f7b8b7e668 fix(GRO-634): atomic confirmation token in book.ts, correct RBAC error message ...

- Replace SELECT-then-UPDATE with atomic UPDATE ... WHERE token=? AND status='pending' RETURNING *
  to prevent confirmation token replay attacks (TOCTOU race condition)
- Fix requireRoleOrSuperUser() error message: swap the conditional branches so
  'Forbidden: super user privileges required' is returned when user lacks role,
  and 'Forbidden: role X is not permitted' when user is not superuser
- Add 'and' mock export to confirmation.test.ts and rbac.test.ts for new query patterns
- Update test expectations to match corrected error message semantics

2026-04-14 23:23:48 +00:00

..

api

fix(GRO-634): atomic confirmation token in book.ts, correct RBAC error message

2026-04-14 23:23:48 +00:00

e2e

fix(e2e): use domcontentloaded instead of networkidle in admin invoices test

2026-04-11 16:50:35 +00:00

groombook/overlays/uat

fix(GRO-451): re-seal UAT secrets with correct cluster certificate

2026-04-04 12:27:23 +00:00

web

Merge branch 'main' into feature/gro-631-ci-pnpm-pin

2026-04-14 17:34:02 +00:00