Paul Nothaft cc49f6997a fix(auth): fail closed when the adminAuth roles join errors (stable) (#975) ...

Closes #968 on stable. Backport of #974.

The roles-join fallback in adminAuth fabricated role_name='super_admin' on ANY database error, so a transient fault silently granted super_admin for its duration. Gate it on isMissingRolesSchema(), moved to utils/dbErrors.js and shared with apiTokenAuth, with the predicate tightened to trust SQLSTATE 42P01/42703 on Postgres and exact driver phrasing on SQLite.

2026-08-03 14:48:33 +02:00

..

adminAuthRoleFallback.test.js

fix(auth): fail closed when the adminAuth roles join errors (stable) (#975)

2026-08-03 14:48:33 +02:00

apiTokenRoleFallback.test.js

fix(auth): fail closed when the adminAuth roles join errors (stable) (#975)

2026-08-03 14:48:33 +02:00

ownership.filterOwnedEventIds.test.js

fix(security): close cross-event thumbnail leak, bulk-op ownership bypass, + hardening

2026-07-03 10:27:28 +02:00

photoAuth.thumbnailScope.test.js

fix(security): close cross-event thumbnail leak, bulk-op ownership bypass, + hardening

2026-07-03 10:27:28 +02:00

sessionTimeout.isSessionExpired.test.js

fix(auth): /auth/session must enforce session timeout symmetrically (#350 recurrence)

2026-05-05 00:12:01 +02:00