4df79aafd3
test(server): batch 5 authorization, transclusion, search & comment coverage
...
Test-only. Fills the authorization / data-integrity gaps from the strategy
report. Full server suite: 100 suites / 1031 passed + 1 todo, green.
Authorization (privilege-escalation catches):
- workspace/space ability factories: exact can/cannot per (action,subject) —
admin cannot Manage Audit, writer/reader cannot Manage Settings/Member, etc.
- findHighestUserSpaceRole, isAdminActingOnOwner.
- WorkspaceService role guards: last-owner lockout, admin-over-owner, self-target.
- SpaceMemberService.validateLastAdmin: never orphan a space without an admin.
- GroupService: default-group immutability, name uniqueness.
Access / data integrity:
- PageAccessService: restriction-vs-space-ability branches for view/edit/comment.
- TransclusionService.unsyncReference: cross-workspace/NotFound boundary asserts
NO attachment write or ref-row delete on rejection; lookupWithAccessSet
positional status mapping; listReferences drops private/cross-ws/deleted refs;
syncPageTransclusions/References diff (no-op on unchanged content).
- SearchService.searchPage: query-mode scoping; leakage modes return empty
before executing the query.
- CommentService: reply-to-reply guard, agent provenance, self-mention filter,
no double-notify.
Pure helpers:
- prosemirror extractors (mention dedup-key id-vs-entityId, attachment UUID
validation, removeMarkTypeFromDoc), collaboration.util (getPageId,
isEmptyParagraphDoc, stripUnknownNodes unwrap, prosemirrorNodeToYElement).
Reviewed (APPROVE WITH SUGGESTIONS): mutation-resistant, not vacuous.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 18:40:07 +03:00
c486750b2a
test-infra: re-enable 16 disabled server suites (jest DI + lib0 ESM) ( #56 )
...
16 suites were disabled via testPathIgnorePatterns due to two root causes: lib0
ESM not transformed (the @hocuspocus/server -> lib0/decoding.js chain) and stock
'should be defined' specs built via Test.createTestingModule without providers.
Add lib0 to transformIgnorePatterns; convert the 14 DI placeholders to direct
new X(...) instantiation with stub deps (keeping a real construct smoke test);
re-enable the suites. Also updates the public-share limiter test to assert the
fail-closed behavior from #62 (surfaced now that the suite runs). Full server
suite: 67 passed, 689 tests.
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com >
2026-06-21 03:40:40 +03:00
641ce142df
feat(ee): SCIM ( #1347 )
...
* SCIM - init (EE)
* accept db transaction
* sync
* Content parser support for scim+json
* patch scimmy
* sync
* return early if userIds is empty
* sync
* SCIM db table
* fixes
* scim tokens
* backfill
* feat(audit): add scim token events
* rename scim migration
* fix
* fix translation
* cleanup
2026-05-01 14:53:30 +01:00
d42091ccb1
feat: favorites ( #2103 )
...
* feat: favorites and templates(ee)
* rename migrations
* fix sidebar
* cleanup tabs
* fix
* turn off templates
* cleanup
* uuid validation
2026-04-12 22:06:25 +01:00
69d7532c6c
feat(ee): audit logs ( #1977 )
...
feat: clickhouse driver
* sync
* updates
2026-03-01 01:29:03 +00:00
05b3c65b0f
feat: notifications ( #1947 )
...
* feat: notifications
* feat: watchers
* improvements
* handle page move for watchers
* make watchers non-blocking
* more
2026-02-14 20:00:38 -08:00
78b1c1a453
feat: switch to cursor pagination ( #1884 )
...
* add cursor pagination function
* support custom order modifier
* refactor returned object
* feat(db): migrate paginated endpoints to cursor-based pagination
* sync
* support hasPrevPage boolean
* feat(client): migrate pagination from offset to cursor-based
* support beforeCursor/prevCursor
* wrap search results in items array for API consistency
2026-01-30 19:28:54 +00:00
8fc8422fbc
fix: increase max length for groups and spaces ( #1840 )
2026-01-13 15:31:03 +00:00
36e720920b
fix: bug fixes ( #397 )
...
* Add more html page titles
* Make tables responsive
* fix react query keys
* Add tooltip to sidebar toggle
* fix: trim inputs
* fix inputs
2024-10-13 17:09:45 +01:00
aea37eecda
use uuid7
2024-06-27 01:53:32 +01:00
d4eefa48a8
restructure directories
...
* set log level based on env
2024-06-09 15:57:52 +01:00
886d9591fa
frontend permissions
...
* rework backend workspace permissions
2024-06-03 02:54:12 +01:00
eefe63d1cd
implement new invitation system
...
* fix comments on the frontend
* move jwt token service to its own module
* other fixes and updates
2024-05-14 22:55:11 +01:00
fece460051
Implement password change endpoint
...
* move email templates to server
2024-05-04 15:46:11 +01:00
90ae750d48
space updates
...
* space UI
* space management
* space permissions
* other fixes
2024-04-12 19:38:58 +01:00
7d14a353cc
Work on groups
...
* add batch group member insertion
* allow adding members on group creation
* fixes
2024-04-04 21:17:28 +01:00
4913975e99
server: refactor pagination
...
* fix transaction usgae in repos
* other bug fixes
2024-04-01 01:23:52 +01:00
82da4ffdc2
fix workspace setup
2024-03-29 02:19:24 +00:00
c18c9ae02b
Refactoring
...
* replace TypeORM with Kysely query builder
* refactor migrations
* other changes and fixes
2024-03-29 01:46:11 +00:00
51baf30f0d
Use polymorphic table for space membership
2024-03-22 00:40:13 +00:00
51b9808382
Implement Space membership by group
...
* Add all users to default group
* Fixes and updates
2024-03-20 01:26:03 +00:00
a821e37028
Refactoring
...
* Refactor workspace membership system
* Create setup endpoint
* Use Passport.js
* Several updates and fixes
2024-03-16 22:58:12 +00:00
b42fe48e9b
feat: role authorizations - WIP
2024-03-08 23:55:42 +00:00
3e174b3838
fix groups
2024-03-06 17:18:37 +00:00
528b9d70b1
feat: groups
2024-03-05 16:22:24 +00:00
claude_code
Philip Okugbe
Philip Okugbe