einundzwanzig-app

mirror of https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git synced 2026-05-05 04:54:53 +00:00

Files

T

Claude 90835f8b1f security: critical fixes (test route, edit authz, nostr signature, calendar IDOR)

- Remove unauthenticated /test route that dispatched FetchNostrProfileJob
  for a hardcoded user (routes/web.php).
- Enforce created_by ownership check in meetup and lecturer Livewire edit
  components; mirror the existing services/edit pattern.
- Replace blind-trust nostrLoggedIn handler with NIP-42-style signed event
  verification: server-issued challenge stored in session, client signs a
  kind:22242 event, server verifies signature via swentel/nostr-php and
  derives npub. Challenge is single-use with 5-minute TTL.
- Validate the ?my[] parameter on the calendar download endpoint as an
  array of integers and intersect with the authenticated user's meetups.

2026-05-03 12:51:10 +00:00

Attributes

🔄 Refactor domain image helper to return attributes array

2025-12-11 16:35:46 +01:00

Console/Commands

🌍 Update timezone fallback for Nostr publishing command to use Europe/Berlin

2025-12-11 02:13:17 +01:00

Enums

🔥 Remove unused tests, update factories, and introduce recurrence features

2026-01-17 21:00:46 +01:00

Http

security: critical fixes (test route, edit authz, nostr signature, calendar IDOR)