H1K0 a6680b1c05 fix(backend): require owner/admin to read or modify object ACLs ...

GET/PUT /acl/:object_type/:object_id performed no authorization check, so
any authenticated user could read the permission list of, or grant
themselves view/edit on, any file/tag/category/pool. ACLService now
resolves the object's owner and rejects callers who are neither the owner
nor an admin. SetPermissions also wraps its delete+insert replace in a
single transaction so a partial failure can no longer wipe permissions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 13:59:10 +03:00

backend

fix(backend): require owner/admin to read or modify object ACLs

2026-06-10 13:59:10 +03:00

docs

docs(project): add reference Python/Flask implementation

2026-04-03 18:36:05 +03:00

frontend

fix(frontend): use $appSettings.tagRuleApplyToExisting on creating a new tag rule also

2026-04-07 11:59:09 +03:00

.env.example

feat(backend): config, migrations embed, and server entrypoint

2026-04-03 18:57:17 +03:00

.gitattributes

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

.gitignore

chore(project): add .gitignore and .gitattributes

2026-04-03 18:35:22 +03:00

CLAUDE.md

docs(project): document scoped commit naming convention in CLAUDE.md

2026-04-04 21:41:22 +03:00

openapi.yaml

feat(backend): apply tag rules retroactively to existing files on activation

2026-04-07 00:00:45 +03:00

S

Description

🎋Tanabata — web file manager with tags!

apicfile-managergolangpythonrestapitelegram-botwebapp

5.6 MiB

Languages

Go 50%

Svelte 38.6%

TypeScript 8.8%

PLpgSQL 1.4%

Dockerfile 0.5%

Other 0.7%