copenhagentruckwash/api
1
0
Fork 0
Code Issues Pull Requests 1 Actions 2 Packages Projects Releases Wiki Activity
1,255 Commits 58 Branches 1 Tag
fe6eae862f64e8a29fd6bfe0500b3b41a468e359
Commit Graph
943 Commits
Author SHA1 Message Date
copilot-swe-agent[bot] 2782afde2e Merge master into branch and re-apply department access checks on Stripe payment-intent routes 2026-06-01 20:40:30 +00:00
Jeppe B b3225c8d8b Merge pull request #195 from copenhagentruckwash/fix-sql-injection-in-filter-handling 
Fix SQL injection in array-based pagination filters
 2026-06-01 22:37:38 +02:00
Jeppe B 0f96247bf3 Fix SQL injection in array pagination filters 2026-06-01 22:37:28 +02:00
Jeppe B 4703e07951 Enforce department access on Stripe payment intent order routes 2026-06-01 22:36:49 +02:00
copilot-swe-agent[bot] 4e9575cd87 Merge master and resolve conflict: use rawToken in get_user() exception-handled lookup 2026-06-01 20:35:51 +00:00
Jeppe B 1616bd431a Merge pull request #192 from copenhagentruckwash/fix-subuser-permission-evaluation-vulnerability 
Use resolved customer context in subuser permission checks
 2026-06-01 22:34:56 +02:00
Jeppe B 22dd9f9c07 Fix subuser permission checks to use resolved customer context 2026-06-01 22:34:45 +02:00
Jeppe B 5684da1bc7 Merge pull request #191 from copenhagentruckwash/fix-sql-injection-in-gate/relay-creation 
Escape JSON-encoded values in add_object to prevent SQL injection
 2026-06-01 22:34:00 +02:00
Jeppe B 69cd039322 Escape JSON values in add_object inserts 2026-06-01 22:33:49 +02:00
Jeppe B 0dc7f813a8 Merge pull request #188 from copenhagentruckwash/propose-fix-for-relay-control-bypass-vulnerability 
Fix self-serve relay sync to enforce lane safety guards
 2026-06-01 22:33:11 +02:00
copilot-swe-agent[bot] 8d2e71aaf3 Merge origin/master and resolve self-serve relay sync conflicts 2026-06-01 20:23:09 +00:00
Jeppe B 721e2670dd Reject 2FA verification tokens for API authentication 2026-06-01 22:22:42 +02:00
Jeppe B b03500d2d1 Merge pull request #189 from copenhagentruckwash/fix-subuser-token-authorization-vulnerability 
Validate subuser grants before resolving subuser customer context
 2026-06-01 22:21:58 +02:00
Jeppe B ed9ebc2ac8 Validate subuser grants before resolving customer user 2026-06-01 22:21:44 +02:00
Jeppe B 64beb38bae Fix self-serve relay sync to enforce lane safety guards 2026-06-01 22:19:34 +02:00
copilot-swe-agent[bot] 2ba87a4850 Start merge conflict resolution 2026-06-01 20:06:07 +00:00
Jeppe B 61a09dce87 Remove insecure default edge broker secret fallback 2026-06-01 22:01:39 +02:00
Jeppe B 3b132cad95 Merge pull request #176 from copenhagentruckwash/fix-property-gate-command-authorization-bypass 
Restore explicit permissions for property gate commands to fix authorization bypass
 2026-06-01 21:03:30 +02:00
copilot-swe-agent[bot] b8f65f242f Merge origin/master and resolve property gate conflict 2026-06-01 19:02:11 +00:00
Jeppe B 688cb0a664 Merge pull request #173 from copenhagentruckwash/fix-cross-tenant-certificate-attachment-vulnerability 
Validate booking order context before certificates
 2026-06-01 21:00:33 +02:00
Jeppe B 6eb4171fea Merge pull request #172 from copenhagentruckwash/propose-fix-for-automation-permission-bug 
Prevent XL Vask list automation execution
 2026-06-01 21:00:21 +02:00
copilot-swe-agent[bot] 933b18b988 Merge origin/master and resolve booking conflict files 2026-06-01 18:59:05 +00:00
Jeppe B 18c6852865 Merge pull request #177 from copenhagentruckwash/fix-broker-secret-vulnerability-in-api 
Harden edge broker shared-secret handling
 2026-06-01 20:58:58 +02:00
Jeppe B 77403965f8 Harden edge broker shared-secret handling 2026-06-01 20:58:45 +02:00
copilot-swe-agent[bot] a3e2765ad4 Merge origin/master and resolve XLVask route contract conflict 2026-06-01 18:57:46 +00:00
Jeppe B 787db994dd Fix property gate command authorization bypass 2026-06-01 20:57:21 +02:00
Jeppe B f8f603a38e Merge pull request #175 from copenhagentruckwash/fix-vulnerability-in-studio-graph-edits 
Fix authorization boundary for studio graph lane operations
 2026-06-01 20:56:51 +02:00
Jeppe B 31a7224272 Fix studio graph lane operations permission checks 2026-06-01 20:56:38 +02:00
Jeppe B 492c81e27c Merge pull request #174 from copenhagentruckwash/fix-vulnerability-in-studio-action-conditions 
Fix fail-open condition gating in self-serve Studio action runner
 2026-06-01 20:56:21 +02:00
Jeppe B 45bfb1525a Fix studio action conditions to fail closed without results 2026-06-01 20:56:04 +02:00
Jeppe B 71ffa20811 Validate booking order context before certificates 2026-06-01 20:55:26 +02:00
Jeppe B a466c6291c Prevent XL Vask list automation execution 2026-06-01 20:54:44 +02:00
Jeppe B 9606d3b11d Merge pull request #171 from copenhagentruckwash/fix-sensitive-data-exposure-vulnerability 
Remove committed replication bootstrap snapshot with secrets
 2026-06-01 20:54:25 +02:00
Jeppe B 03b7fcd1b1 Remove committed replication bootstrap snapshot 2026-06-01 20:54:10 +02:00
Jeppe B 0c21f6e3a1 Merge pull request #169 from copenhagentruckwash/fix-gateway-auto-provision-deployment-vulnerability 
Pin gateway auto-provision deployments to source commit
 2026-06-01 20:53:22 +02:00
Jeppe B f1e5cacd0c Pin gateway auto-provision deployments to source commit 2026-06-01 20:53:10 +02:00
Jeppe B a8d5320ae5 Merge pull request #168 from copenhagentruckwash/fix-auto-promotion-vulnerability-in-release-gate 
Prevent auto-sync promotion when release gate `required_checks` is empty
 2026-06-01 20:52:52 +02:00
Jeppe B 95ac0d3a2c Block release gate auto-sync when required checks are empty 2026-06-01 20:52:39 +02:00
Jeppe B 1ed27dd467 Merge pull request #167 from copenhagentruckwash/fix-superuser-invite-resend-security-flaw 
Scope superuser subuser invite resends
 2026-06-01 20:52:23 +02:00
Jeppe B c4bb7bbb8b Scope superuser subuser invite resends 2026-06-01 20:52:08 +02:00
Jeppe B c09b7ebe76 Merge pull request #166 from copenhagentruckwash/fix-pathoutcomespayload-argument-type-error 
Accept null confirmation rows in pathOutcomesPayload
 2026-06-01 19:56:09 +02:00
Jeppe B 8e528f3eae Fix null path confirmation rows 2026-06-01 19:53:40 +02:00
copilot-swe-agent[bot] 160772b832 Merge origin/master and resolve invoice billing test conflict 2026-06-01 17:52:21 +00:00
Jeppe B c8a5c3969d Fix self-serve invoice customer attribution 2026-06-01 19:48:10 +02:00
Jeppe B fe3719530a Fix edge gateway PHP image extensions 2026-06-01 19:19:01 +02:00
Jeppe B da05c5adb7 Restore selected orders API coverage 2026-06-01 16:31:06 +02:00
Jeppe B 707cf67d5c Remove OrdersApiTest to clean up obsolete test cases 2026-06-01 13:07:21 +02:00
Jeppe B 235e0268c2 Fix backend CI gate failures 2026-05-29 14:36:18 +02:00
Jeppe Bundgaard 3ee5b789ce Update setMachineRelayStatusHard method to use MACHINE_PROGRAM_PICKER constant for relay status setting 2026-05-28 21:08:37 +02:00
Jeppe Bundgaard 7f5722ff75 Add exception handling for cleaner relay activation in self-serve lanes 
- Include `\Throwable` in docstring for better error documentation.
- Implement `turnOnCleanerRelayForWashStart` in the wash start process.
 2026-05-28 20:40:08 +02:00