Jeppe B
d9a36e4050
Merge pull request #201 from copenhagentruckwash/fix-idor-vulnerability-in-attachment-endpoints
...
Ensure attachment belongs to task before download/delete (fix IDOR)
2026-06-01 22:48:14 +02:00
Jeppe B
a5019efbda
Fix task attachment IDOR in self-serve endpoints
2026-06-01 22:48:04 +02:00
Jeppe Bundgaard
76729f1b99
Add department self-serve config versioning routes with lifecycle actions (list, validate, publish, rollback) and associated logic for managing config versions.
2026-03-25 17:54:41 +01:00
Jeppe Bundgaard
b547a8b029
Refactor permission handling to leverage standardized "forbidden" responses and enhance unit test coverage.
2026-03-19 15:59:25 +01:00
Jeppe Bundgaard
d890d589ff
Add reusable routes for department self-serve machine types, n8n workflows, and executions, with corresponding unit tests and service integration.
2026-03-16 11:36:48 +01:00
Jeppe B
3ec338457e
Clarify self-serve entity relationships and naming intent
2026-03-11 13:54:11 +01:00
Jeppe Bundgaard
73ac77a2f5
Add support for dynamic image buttons and vehicle type selection in self-serve tasks
...
- Extend `department_selfserve_tasks_o` with `buttons` and `dynamic_images_vehicle_type` properties.
- Add normalization/validation methods for `buttons` and `dynamic_images_vehicle_type` parameters.
- Update `departmentSelfserveTasksRoute` to handle new fields in task creation and update.
- Add OpenAPI specifications for `buttons` and `dynamic_images_vehicle_type`.
- Include comprehensive tests for button normalization and vehicle type selection.
2026-02-18 16:34:58 +01:00
Jeppe Bundgaard
008e2af09a
Add support for self-serve task services and validation logic
...
- Introduce `services` property to `department_selfserve_tasks_o` for task-specific functionalities.
- Add service validation and normalization via `selfserve_lane_services` enum.
- Extend `departmentSelfserveTasksRoute` to handle `services` input for add/edit operations.
- Create `selfserve_lane_services` enum to define and validate service types.
2026-02-18 12:47:00 +01:00
Jeppe Bundgaard
09b5c618ed
Add fine-grained permission checks for viewing department self-serve tasks and implement password reset endpoints (validate and set) in authentication routes; update OpenAPI spec accordingly.
2026-01-19 10:57:09 +01:00
Jeppe Bundgaard
6cc5344fc2
Refactor department-level permission checks and enhance handling of empty department filters across routes and related object methods.
2026-01-15 11:28:44 +01:00
Jeppe Bundgaard
ed7299fc43
Add lane reservation support: implement reservation timer, expiration logic, and new self-serve lane commands (RESERVE and RELEASE); enhance permission checks across routes for global and department-level operations.
2026-01-15 11:22:02 +01:00
Jeppe Bundgaard
d576a4741b
Replace question with condition_id across department_selfserve_tasks logic, routes, OpenAPI spec, and associated methods for improved consistency and clarity.
2026-01-09 13:47:10 +01:00
Jeppe Bundgaard
5b364e2141
Add attachment management endpoints to departmentSelfserveTasksRoute and update OpenAPI spec for attachments
2026-01-09 09:29:12 +01:00
Jeppe Bundgaard
c7e5e037bc
Update field handling in self-serve modules and add deleted_at to searchable fields in tasks and questions routes
2026-01-08 14:19:20 +01:00
Jeppe Bundgaard
8514d0e1d7
Implement departmentSelfserveTasksRoute with CRUD operations and department-level access control
2026-01-08 13:54:13 +01:00
Jeppe B