45f823a84e
Some checks failed
CI / Lint (pull_request) Has been cancelled
CI / Schema map up to date (pull_request) Has been cancelled
CI / Forbidden patterns (9 checks) (pull_request) Has been cancelled
CI / Migrations apply (node-pg-migrate) (pull_request) Has been cancelled
CI / Unit tests (vitest) (pull_request) Has been cancelled
Convoy metrics gate / Require role-event telemetry on convoy PRs (pull_request) Has been cancelled
PR Health rollup / Aggregate gate status (pull_request) Has been cancelled
Preview smoke / Should run? (pull_request) Has been cancelled
Preview smoke / Playwright smoke (pull_request) Has been cancelled
- lib/card-import/lorcana-bulk.js: Lorcast per-card pricing via api.lorcast.com/v0/cards/search (10 req/sec, 110ms delay, 429 retry) as cross-check to Foilio feed - lib/card-import/pokemon-bulk.js: TCGdex pricing (already wired via lib/pricing/tcgdex-client.js) - test/lib/card-import-lorcana-bulk.test.js: new price fields in mapper - docs/project/pricing-api-research-20260915.md: final verified source matrix - docs/DOKPLOY_DEPLOY.md: pricing API env vars
816 B
816 B
Security Audit Implementation — 2026-09-15
Fixes needed before adapter PR (brief-2 / brief-3) per AGENTS.md rule 7.
1. L2: AccessGrant join (AuthZ / IDOR)
Add AccessGrant join to requireAccess query pattern. Every protected resource must verify:
SELECT ... FROM resource r
LEFT JOIN access_grants ag ON ag.resource_id = r.id AND ag.user_id = ?
WHERE r.id = ? AND (ag.status = 'granted' OR r.owner_id = ?)
Files to edit:
lib/auth/requireAccess.tstests/lib/auth/idor.spec.ts(add regression assertions)
2. L5: Adapter isolation (disconnect-route)
Create / fix adapter-route so provider ref stays inside adapter:
- Route:
pages/api/auth/disconnect/route.ts - Adapter:
lib/auth-adapter/disconnect-adapter.js - Route must import ONLY adapter; adapter holds provider reference.