Paul Nothaft 2d0e6ab2dc fix(projects): stop the cockpit offering email controls the API rejects (stable) (#977) ...

Closes #969 on stable. Backport of #976.

The cockpit's email feed rendered preview/resend/cancel/retry/send-now for every mail regardless of role or permission, producing 404s (CRM document mail has no event_id; project ownership does not imply event ownership) and 403s (preview needs events.view, the write actions need email.send).

getProjectOverview now stamps each email with an authoritative canAct, mirroring filterOwnedEventIds; created_by is selected only for that check and stripped before the response. A missing canAct reads as false.

2026-08-03 14:49:04 +02:00

..

__tests__

fix(projects): stop the cockpit offering email controls the API rejects (stable) (#977)

2026-08-03 14:49:04 +02:00

assets/fonts

feat(crm): backend code — services + routes + utilities + tests

2026-05-26 18:18:51 +02:00

docs

…

migrations

fix(security): enforce project ownership on project + project-email routes (stable) (#966)

2026-08-02 21:24:41 +02:00

scripts

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

src

fix(projects): stop the cockpit offering email controls the API rejects (stable) (#977)

2026-08-03 14:49:04 +02:00

.dockerignore

…

.env.example

feat(auth): admin TOTP MFA — enrollment, login challenge, recovery, CLI reset

2026-07-03 11:33:38 +02:00

.eslintrc.js

…

audit-backend.json

…

dependencies-backend.json

Upgrade nodemailer to 7.0.7 (GHSA-mm7p-fcc7-pg87)

2025-10-13 21:11:38 +02:00

Dockerfile

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00

Dockerfile.dev

fix(security): scan triage cleanup — drop dead deps, harden Docker/nginx/postMessage

2026-05-07 22:31:51 +02:00

ecosystem.config.js

…

jest.config.js

fix(tests): raise jest timeouts to the 120s convention (stable) (#902)

2026-07-29 12:48:50 +02:00

jest.setup.js

…

knexfile.js

…

package-lock.json

fix(security): bump sanitize-html to 2.17.5 (CVE-2026-53606) (stable) (#938)

2026-08-01 17:36:40 +02:00

package.json

chore(stable): release 3.45.12 (#955)

2026-08-02 20:25:40 +02:00

server.js

fix(security): bound inbound-mail resources, redact secrets from logs (stable) (#965)

2026-08-02 21:18:49 +02:00

test-filter.js

…

wait-for-db.sh

fix(security): close 5 Trivy alerts — postcss/tar bumps + drop npm from the runtime image (stable) (#879)

2026-07-27 09:54:43 +02:00