vantage

T

mrhid6 dff3668a25 fix(server): validate cross-org resource ownership

Review of the org-scoping pass found that org_id on a query filter
protects the row you look up, but does nothing when a handler accepts a
foreign resource ID as data and a downstream unscoped query consumes it.

- AssignKey: verify key and server both belong to the org
- BuildAuthorizedKeys: resolve server first, scope assignments and keys
  to that server's org (was honouring foreign assignment rows)
- Workflows: validate TargetServerIDs on create/update and re-check at
  trigger time
- Monitor incidents/uptime handlers: gate on org-scoped GetMonitor
- GetChannels: take orgID; validate channel_ids on monitor create/update
- Secret and default-step unique indexes: scope to org_id so a second
  org no longer hits E11000
- DeleteServer/DeleteMonitor: scope cascading deletes

2026-07-22 09:28:43 +01:00

.gitea/workflows

fix: Ci and agent update

2026-07-17 16:43:57 +01:00

agent

feat: edit monitors + notification channels; HTTP monitor insecure-TLS option

2026-07-21 14:55:41 +01:00

deploy

fix(web): move autosave hooks above early return (React #310 )

2026-07-21 11:55:20 +01:00

docs/superpowers

docs(plan): saas auth + orgs implementation plan