H1K0 a6680b1c05 fix(backend): require owner/admin to read or modify object ACLs ...

GET/PUT /acl/:object_type/:object_id performed no authorization check, so
any authenticated user could read the permission list of, or grant
themselves view/edit on, any file/tag/category/pool. ACLService now
resolves the object's owner and rejects callers who are neither the owner
nor an admin. SetPermissions also wraps its delete+insert replace in a
single transaction so a partial failure can no longer wipe permissions.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-06-10 13:59:10 +03:00

..

acl_service.go

fix(backend): require owner/admin to read or modify object ACLs

2026-06-10 13:59:10 +03:00

audit_service.go

feat(backend): implement audit repo and service

2026-04-04 01:19:24 +03:00

auth_service.go

feat(backend): implement auth service with JWT and session management

2026-04-04 00:38:21 +03:00

category_service.go

feat(backend): implement category stack

2026-04-04 21:50:57 +03:00

file_service.go

feat(backend): implement full tag stack (repo, service, handler, routes)

2026-04-04 21:29:20 +03:00

pool_service.go

feat(backend): implement pool stack

2026-04-04 22:04:27 +03:00

tag_service.go

feat(backend): apply tag rules retroactively to existing files on activation

2026-04-07 00:00:45 +03:00

user_service.go

feat(backend): implement user, ACL, and audit stacks

2026-04-05 02:25:16 +03:00