H1K0 a6680b1c05 fix(backend): require owner/admin to read or modify object ACLs ...

GET/PUT /acl/:object_type/:object_id performed no authorization check, so
any authenticated user could read the permission list of, or grant
themselves view/edit on, any file/tag/category/pool. ACLService now
resolves the object's owner and rejects callers who are neither the owner
nor an admin. SetPermissions also wraps its delete+insert replace in a
single transaction so a partial failure can no longer wipe permissions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 13:59:10 +03:00

backend

fix(backend): require owner/admin to read or modify object ACLs

2026-06-10 13:59:10 +03:00

docs

docs(project): add reference Python/Flask implementation

2026-04-03 18:36:05 +03:00

frontend

fix(frontend): use $appSettings.tagRuleApplyToExisting on creating a new tag rule also

2026-04-07 11:59:09 +03:00

.env.example

feat(backend): config, migrations embed, and server entrypoint

2026-04-03 18:57:17 +03:00

.gitattributes

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

.gitignore

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

CLAUDE.md

docs(project): document scoped commit naming convention in CLAUDE.md

2026-04-04 21:41:22 +03:00

openapi.yaml

feat(backend): apply tag rules retroactively to existing files on activation

2026-04-07 00:00:45 +03:00

S

Description

🎋 Tanabata — web file manager with tags!

apicdockerfile-managergolangpythonrestapispasveltetelegram-botwebapp

AGPL-3.0 6.2 MiB

Releases 1

3.0.0 Latest

2026-07-07 11:17:52 +03:00

Languages

Go 48.9%

Svelte 39.9%

TypeScript 8.7%

PLpgSQL 1.3%

Dockerfile 0.5%

Other 0.7%