copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,394 Commits 58 Branches 1 Tag
7380bc729bb70440a4dcafd829d61eafa25efafc
Commit Graph
1047 Commits
Author SHA1 Message Date
Jeppe B 7380bc729b Restrict in-progress wash details by lane department 2026-06-02 00:19:55 +02:00
Jeppe B fbad5f767f Merge pull request #258 from copenhagentruckwash/fix-hardcoded-auth-tokens-in-configuration 
Sanitize leaked auth tokens in HTTP test env
 2026-06-02 00:02:06 +02:00
Jeppe B 94d9b347bf Sanitize leaked auth tokens in HTTP test env 2026-06-02 00:01:57 +02:00
Jeppe B f5c1a34c29 Merge pull request #256 from copenhagentruckwash/fix-idor-vulnerability-in-economic-v2-endpoints 
Prevent IDOR on Economic V2 collected-invoice endpoints
 2026-06-01 23:58:41 +02:00
Jeppe B 22ad96bc8e Fix economic v2 invoice endpoint authorization scope 2026-06-01 23:58:30 +02:00
Jeppe B cf5cf8d5eb Merge pull request #254 from copenhagentruckwash/fix-user-search-exposure-vulnerability 
Restrict `users` system-search access to prevent PII leakage
 2026-06-01 23:57:33 +02:00
Jeppe B eb14b7039b Restrict users system search permissions 2026-06-01 23:57:23 +02:00
Jeppe B f09b1263c1 Merge pull request #253 from copenhagentruckwash/fix-stripe-payment-intent-reuse-issue 
Validate Stripe payment intent amount before reuse
 2026-06-01 23:54:32 +02:00
Jeppe B 9ec8499d55 Validate Stripe payment intent amount before reuse 2026-06-01 23:54:04 +02:00
Jeppe B 8d40cd6f9a Merge pull request #252 from copenhagentruckwash/fix-complaint-endpoints-department-access-check 
Require department access for department daily report complaint routes
 2026-06-01 23:53:45 +02:00
Jeppe B ccffad3c7c Fix complaint department authorization 2026-06-01 23:53:36 +02:00
Jeppe B 4697c6b272 Merge pull request #251 from copenhagentruckwash/fix-subuser-management-permission-checks 
Enforce own-scope subuser permissions for classic users in managed customer scope
 2026-06-01 23:53:06 +02:00
Jeppe B 45e17e196c Fix subuser management permission scope 2026-06-01 23:52:57 +02:00
Jeppe B dcc81cbdc7 Merge pull request #250 from copenhagentruckwash/propose-fix-for-privilege-boundary-regression 
Restrict studio simulation to config-version view and prevent auto-creating drafts
 2026-06-01 23:52:28 +02:00
Jeppe B c5cb0a3bfe Fix studio simulation draft access 2026-06-01 23:52:18 +02:00
Jeppe B f6e4d851d3 Merge pull request #248 from copenhagentruckwash/fix-authenticated-ssrf-in-broker-diagnostics 
Prevent SSRF in broker diagnostics by ignoring caller URLs and redacting probe output
 2026-06-01 23:49:24 +02:00
Jeppe B cd4e3faea3 Fix broker diagnostics SSRF 2026-06-01 23:49:10 +02:00
Jeppe B a9ca7b41a7 Merge pull request #246 from copenhagentruckwash/fix-unbounded-relay-timer-vulnerability 
Cap self-serve gate relay timers
 2026-06-01 23:45:39 +02:00
Jeppe B 3b3ed31bb7 Cap self-serve gate relay timers 2026-06-01 23:45:20 +02:00
Jeppe B 4730eebdb4 Merge pull request #245 from copenhagentruckwash/fix-internal-ip-address-leakage 
Stop exposing relay local IPs by default
 2026-06-01 23:44:05 +02:00
Jeppe B b25ce9cb11 Stop exposing relay local IPs by default 2026-06-01 23:43:53 +02:00
Jeppe B fdb98f1399 Merge pull request #244 from copenhagentruckwash/fix-unauthenticated-relay-control-vulnerability 
Require authorization for LAN worker relay endpoints
 2026-06-01 23:43:34 +02:00
Jeppe B 1dc758a3a3 Require authorization for LAN worker relay endpoints 2026-06-01 23:43:23 +02:00
Jeppe B 032ce93d5e Merge pull request #243 from copenhagentruckwash/fix-hardcoded-service-credentials-in-docker-config 
Secure edge gateway service credentials
 2026-06-01 23:42:47 +02:00
Jeppe B f8ced3b8f2 Secure edge gateway service credentials 2026-06-01 23:42:34 +02:00
copilot-swe-agent[bot] 3555904423 Merge origin/master and resolve invoice_period_flag_service conflict 2026-06-01 21:37:53 +00:00
Jeppe B dcd57c7092 Merge pull request #221 from copenhagentruckwash/fix-system-search-associations-vulnerability 
Prevent association expansion from bypassing own-only access
 2026-06-01 23:31:00 +02:00
Jeppe B bd7deaeded Fix invoice period flag cache fallbacks 2026-06-01 23:29:05 +02:00
Jeppe B 07a3ef6418 Merge pull request #237 from copenhagentruckwash/fix-concurrent-access-vulnerability-in-start-command 
Add per-lane START lock to prevent TOCTOU relay replay on wash start
 2026-06-01 23:28:45 +02:00
Jeppe B bffed6f5f3 Fix self-serve start relay race 2026-06-01 23:28:36 +02:00
Jeppe B bfec31f94b Merge pull request #236 from copenhagentruckwash/fix-task-attachment-link-vulnerability 
Enforce lane department authorization for self-serve eligibility
 2026-06-01 23:28:05 +02:00
Jeppe B 2123835aae Fix self-serve eligibility lane authorization 2026-06-01 23:27:56 +02:00
Jeppe B 11f06e8f53 Merge pull request #235 from copenhagentruckwash/investigate-self-serve-path-projection-dos-vulnerability 
Clamp self-serve path projection limits
 2026-06-01 23:27:33 +02:00
Jeppe B 6712368323 Clamp self-serve path projection limits 2026-06-01 23:27:22 +02:00
Jeppe B 99fe659dbc Merge pull request #234 from copenhagentruckwash/propose-fix-for-archived-department-vulnerability 
Fix department archived filter smuggling
 2026-06-01 23:27:06 +02:00
Jeppe B 357cfda46e Fix department archived filter smuggling 2026-06-01 23:26:57 +02:00
Jeppe B 9c85135a07 Merge pull request #233 from copenhagentruckwash/fix-cross-tenant-vehicle-reference-leak 
Restrict vehicle reference suggestions by department context
 2026-06-01 23:26:36 +02:00
Jeppe B a8a47104dd Restrict vehicle reference suggestions by department context 2026-06-01 23:26:27 +02:00
Jeppe B 2c0907c486 Merge pull request #232 from copenhagentruckwash/fix-vulnerability-in-automatic-invoice-flags 
Fix automatic invoice period flag suppression
 2026-06-01 23:26:02 +02:00
Jeppe B 0ae28af309 Fix invoice period automatic flag cache misses 2026-06-01 23:25:54 +02:00
copilot-swe-agent[bot] 64d7e6f061 Merge master into fix-system-search-associations-vulnerability 2026-06-01 21:25:51 +00:00
Jeppe B 4f9a10402b Merge pull request #231 from copenhagentruckwash/fix-exposure-of-private-git-commit-metadata 
Redact GitHub commit metadata from public release runtime
 2026-06-01 23:25:38 +02:00
Jeppe B 5e8ec85943 Redact release GitHub metadata from public runtime 2026-06-01 23:25:28 +02:00
Jeppe B 20d6056e40 Merge pull request #230 from copenhagentruckwash/fix-permission-bypass-for-invoice-flags 
Guard invoice period flags by list permission
 2026-06-01 23:25:02 +02:00
Jeppe B 5be6bc0198 Guard invoice period flags by list permission 2026-06-01 23:24:50 +02:00
Jeppe B 5282ee10ba Merge pull request #229 from copenhagentruckwash/propose-fix-for-booking-po-vulnerability 
Validate booking ownership before defaulting order PO (prevent cross-tenant leak)
 2026-06-01 23:24:00 +02:00
Jeppe B eab8394579 Fix booking PO default tenant validation 2026-06-01 23:23:49 +02:00
Jeppe B b88c2742e8 Merge pull request #228 from copenhagentruckwash/fix-partial-release-tests-bypassing-promotion-gate 
Require app-scoped release gates for bundle promotion
 2026-06-01 23:23:34 +02:00
Jeppe B 4ea5eeb942 Require app-scoped release gates for bundle promotion 2026-06-01 23:23:23 +02:00
Jeppe B 7cb248a112 Merge pull request #226 from copenhagentruckwash/fix-ssrf-vulnerability-in-release-gate 
Harden release gate diagnostics fetches
 2026-06-01 23:17:01 +02:00