Juan DenisandAlex a92d40a042 fix(workspaces): require admin role to create workspaces ...

POST /api/v1/workspaces/ was gated only by @jwt_required(), so any
authenticated user - including the read-only viewer role - could create
a workspace, automatically become its owner, then add arbitrary members
and mint workspace-scoped API keys (GHSA-r4q7-x795-vr4j, CWE-862).

Add @admin_required, matching the owner/admin checks every other
mutating workspace route already enforces, plus a regression test
asserting viewer and developer JWTs get 403 while an admin still
creates.

Co-authored-by: Alex <134992700+campguyuz@users.noreply.github.com>

2026-08-19 19:16:42 -04:00

..

api

fix(workspaces): require admin role to create workspaces

2026-08-19 19:16:42 -04:00

data

fix(registry): mirror serverkit-localkit into the bundled index

2026-08-16 13:46:17 -04:00

jobs

fix(census): measure only tracked files — the instruments count what ships

2026-08-19 10:06:38 -04:00

middleware

feat(utils): env one-door — env_str/env_bool/env_int (plan 77 F4)

2026-08-19 02:12:45 -04:00

models

feat(databases): ManagedDatabase adopts SoftDelete into the Recycle Bin (plan 77 B5)

2026-08-19 05:43:53 -04:00

notifications

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

plugins

fix(auth): resolve the caller through one identity door, not the raw JWT

2026-08-18 19:33:57 -04:00

plugins_sdk

refactor(remote): close the dispatch_agent_command seam

2026-08-18 23:31:46 -04:00

queue_bus

feat(telemetry): unified system event stream with correlation

2026-06-21 20:19:57 -04:00

services

chore: drop the imports the door migrations orphaned

2026-08-19 10:10:40 -04:00

utils

feat(utils): CachedRemoteIndex — one remote-catalog engine (plan 77 F1)

2026-08-19 05:27:10 -04:00

__init__.py

refactor(app): SERVERKIT_SKIP_BACKGROUND reads through the env door

2026-08-19 10:13:44 -04:00

agent_gateway.py

chore: drop the imports the door migrations orphaned

2026-08-19 10:10:40 -04:00

constants.py

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

core_blueprints.py

feat(realtime): generalized run envelope — one stream door for every run kind (plan 77 E1)

2026-08-19 05:13:02 -04:00

cron_runner.py

chore: drop the imports the door migrations orphaned

2026-08-19 10:10:40 -04:00

error_reporting.py

fix(api): a crash the route caught must still reach /monitoring/errors

2026-08-18 20:38:20 -04:00

exceptions.py

feat(api): centralize typed errors and request correlation

2026-08-18 02:42:25 -04:00

paths.py

feat(wordpress): global plugin library for operator-owned plugins

2026-07-01 01:08:42 -04:00

sockets_rooms.py

feat(realtime): one room grammar + mirrored event constants (plan 77 E3)

2026-08-19 04:58:49 -04:00

sockets.py

feat(realtime): generalized run envelope — one stream door for every run kind (plan 77 E1)

2026-08-19 05:13:02 -04:00