Oxicloud

cjw/Oxicloud

Fork 0

Commit Graph

Author	SHA1	Message	Date
Diocrafts	b81b7f7a0e	fix: eliminate all 420 compiler warnings - Add allow(async_fn_in_trait) in lib.rs for async trait methods - Add integration_tests feature to Cargo.toml for cfg gating - Gate trash_service_test module with cfg(feature = integration_tests) - Remove unused MockFileWritePort from idor_protection_test.rs	2026-03-04 23:29:20 +01:00
Dionisio	4a60fdc984	fix(security): IDOR protection for file operations Adds ownership verification at repository, service, and handler layers for download, rename, move, and delete file operations. - Repository: get_file_for_owner() with AND user_id= SQL filter - Service: _owned() methods with verify_owner() fail-closed guard - Handlers: require AuthUser, delegate to _owned() methods - Tests: 10 IDOR protection tests (all passing) - Cleanup: remove dead OptionalUserId import, gate broken pre-existing test modules behind integration_tests feature flag	2026-03-04 17:18:39 +01:00

Author

SHA1

Message

Date

Diocrafts

b81b7f7a0e

fix: eliminate all 420 compiler warnings

- Add allow(async_fn_in_trait) in lib.rs for async trait methods
- Add integration_tests feature to Cargo.toml for cfg gating
- Gate trash_service_test module with cfg(feature = integration_tests)
- Remove unused MockFileWritePort from idor_protection_test.rs

2026-03-04 23:29:20 +01:00

Dionisio

4a60fdc984

fix(security): IDOR protection for file operations

Adds ownership verification at repository, service, and handler layers
for download, rename, move, and delete file operations.

- Repository: get_file_for_owner() with AND user_id= SQL filter
- Service: _owned() methods with verify_owner() fail-closed guard
- Handlers: require AuthUser, delegate to _owned() methods
- Tests: 10 IDOR protection tests (all passing)
- Cleanup: remove dead OptionalUserId import, gate broken pre-existing
  test modules behind integration_tests feature flag

2026-03-04 17:18:39 +01:00

2 Commits