robbond
fef9591b5d
fix(security): protect representation blob deletion against CSRF
2026-11-09 09:31:41 +00:00
robbond
4eba824ac2
fix(security): protect case blob deletion against CSRF
2026-11-09 07:56:59 +00:00
robbond
57e0c62940
fix(storage): constrain recursive blob deletion to resource folders
2026-11-07 11:12:08 +00:00
robbond
1377aebc89
fix: enforce representation blob ownership and secure SSR access
2026-11-06 17:05:40 +00:00
robbond
c49b491698
refactor: migrate myportal viewall account lookup to server helper
2026-11-06 11:58:01 +00:00
robbond
bf2e4a3254
refactor: migrate myportal index account lookup to server helper
2026-11-06 11:33:49 +00:00
robbond
b9be188d27
security: enforce CRM contact ownership and account field allowlist
2026-11-06 10:55:47 +00:00
robbond
71de8a2d14
refactor: extract server-side CRM contact update
2026-11-06 09:58:02 +00:00
robbond
ddcef8f5ea
security: remove obsolete CRM login endpoint
2026-11-06 09:22:29 +00:00
robbond
f7479b72b9
security: remove obsolete CRM password update functionality
2026-11-06 09:14:54 +00:00
robbond
e1f8fb5c96
Revert "security: enforce authenticated CRM contact ownership"
...
This reverts commit e13700ab65
2026-11-06 06:42:16 +00:00
robbond
e13700ab65
security: enforce authenticated CRM contact ownership
2026-11-06 06:36:53 +00:00
robbond
a0a1331a97
fix(security): retire obsolete CRM representation deletion endpoint
2026-11-05 17:18:30 +00:00
robbond
faf3aa3675
fix(security): enforce ownership on private draft case creation
2026-11-05 16:58:35 +00:00
robbond
9b0cb9adc8
fix(security): retire legacy direct CRM case creation endpoint
2026-11-05 16:37:10 +00:00
robbond
93bf7e174f
fix(security): enforce ownership on private draft PDF generation
2026-11-05 14:11:45 +00:00
robbond
8b045ab781
fix(security): enforce ownership across appeal completion
2026-11-05 13:28:43 +00:00
robbond
fc960f907f
fix(security): enforce ownership on private draft blob deletion
2026-11-05 13:04:09 +00:00
robbond
056dace563
fix(security): enforce ownership on draft blob listing proxy
2026-11-05 12:59:55 +00:00
robbond
9d6d3b9f71
fix(security): enforce ownership on appeal and representation blob proxies
2026-11-05 12:53:24 +00:00
robbond
0a115a8808
security: preserve representation history in watched-case upsert
2026-11-05 12:48:45 +00:00
robbond
431c45ba2b
security: enforce CRM watched-case deletion ownership
2026-11-05 10:24:52 +00:00
robbond
eeb4a1f441
fix: restore watched-case deletion through subscriptions facade
2026-11-05 10:02:30 +00:00
robbond
569faa77e5
fix(security): isolate NextAuth email provider from Nodemailer
2026-11-04 11:26:01 +00:00
robbond
16a206ae0f
fix(security): remove obsolete Swagger documentation endpoint
2026-11-04 09:17:23 +00:00
robbond
3f91a3e095
fix(security): replace nookies with patched cookie utility
2026-11-04 06:54:36 +00:00
robbond
bb50b17277
fix(ithc): correct server-side session retrieval for file APIs
2026-11-03 09:25:02 +00:00
robbond
d417860d1d
Merge branch 'SIPS-Development' into feature/ithc-mitigation
2026-11-02 16:05:12 +00:00
Robert Bond
93eabe8e6d
Merged PR 2665: 25470 testing authentication handler
...
Related work items: #25470
2026-11-02 12:41:09 +00:00
robbond
65616f6307
ITHC: enforce container ownership on uploads
2026-10-27 06:05:47 +00:00
robbond
5e98d6e8c2
ITHC: enforce administrative case deletion authorization
2026-10-27 05:40:50 +00:00
robbond
8b607d8134
ITHC: enforce representation completion ownership and admin access
2026-10-26 17:11:38 +00:00
robbond
034b59a981
ITHC: enforce representation blob proxy ownership and admin access
2026-10-26 16:17:52 +00:00
robbond
37aeb03509
ITHC: protect administrative representation unlock endpoint
2026-10-26 15:27:10 +00:00
robbond
0daeb783b9
Stage 3: enforce blob deletion ownership and add admin representation deletion
...
Also repairs two stale Phase 21 fixtures:
- Supplies a valid PDF to exercise the upload dependency-failure path.
- Injects getPersonalAccount into the representation-involvement VM fixture.
2026-10-26 14:39:22 +00:00
robbond
848728584e
Stage 2: integrate administrative login and protect dashboard
2026-10-26 14:31:07 +00:00
robbond
d11c4a868e
Add independent administrative authentication foundation
2026-10-26 12:51:42 +00:00
Robert Bond
fdeff5b898
Merged PR 2605: updated query to include consultationclosed check
...
updated query to include consultationclosed check
Related work items: #24836
2026-09-07 10:46:32 +00:00
Robert Bond
4e9d585566
Merged PR 2596: fix build error
...
fix build error
Related work items: #24648
2026-09-02 12:37:32 +00:00
Robert Bond
b95a20a980
Merged PR 2595: updated regex to exclude bulk annon mailers
...
updated regex to exclude bulk annon mailers
Related work items: #24648
2026-09-02 08:02:38 +00:00
Robert Bond
6462bd5163
Merged PR 2536: updated path to wrapper to fix build error
...
updated path to wrapper to fix build error
Related work items: #24215
2026-08-04 08:30:13 +00:00
Robert Bond
460dfadd1e
Merged PR 2533: made petemail from server side var for logged in
...
made petemail from server side var for logged in
Related work items: #24215
2026-08-04 07:44:08 +00:00
Robert Bond
d74e3fd668
Merged PR 2532: made petemail from serverside env var
...
made petemail from serverside env var
Related work items: #24215
2026-08-04 07:36:57 +00:00
Robert Bond
1258985882
Merged PR 2504: amend paths for reps to exclude long titles
...
amend paths for reps to exclude long titles
Related work items: #24279
2026-07-22 15:51:27 +00:00
Robert Bond
95486f0164
Merged PR 2476: added check for inactive case deadlines
...
added check for inactive case deadlines
Related work items: #24297
2026-07-15 12:41:10 +00:00
Robert Bond
e864049bec
Merged PR 2449: language helper
...
Related work items: #23754
2026-07-01 11:29:15 +00:00
Robert Bond
ff699735c7
Merged PR 2442: remove lodash dependecies on _.has
...
Related work items: #23754
2026-06-29 13:08:06 +00:00
Robert Bond
94b19f9697
Merged PR 2432: Add myportal API grouping facade read slice
...
Add myportal API grouping facade read slice
Related work items: #23754
2026-06-25 09:37:01 +00:00
Robert Bond
a1b89d19b8
Merged PR 2431: Add case details API grouping facade
...
Add case details API grouping facade
Related work items: #23754
2026-06-25 09:22:12 +00:00
Robert Bond
a266fa5428
Merged PR 2429: Add public search API grouping facade slice
...
Add public search API grouping facade slice
Related work items: #23754
2026-06-25 08:48:43 +00:00
robbond
Robert Bond