einundzwanzig-app

mirror of https://github.com/HolgerHatGarKeineNode/einundzwanzig-app.git synced 2026-05-05 04:54:53 +00:00

Files

T

Claude 90835f8b1f security: critical fixes (test route, edit authz, nostr signature, calendar IDOR)

- Remove unauthenticated /test route that dispatched FetchNostrProfileJob
  for a hardcoded user (routes/web.php).
- Enforce created_by ownership check in meetup and lecturer Livewire edit
  components; mirror the existing services/edit pattern.
- Replace blind-trust nostrLoggedIn handler with NIP-42-style signed event
  verification: server-issued challenge stored in session, client signs a
  kind:22242 event, server verifies signature via swentel/nostr-php and
  derives npub. Challenge is single-use with 5-minute TTL.
- Validate the ?my[] parameter on the calendar download endpoint as an
  array of integers and intersect with the authenticated user's meetups.

2026-05-03 12:51:10 +00:00

create-edit-events.blade.php

✨ **Tests & Nullable Fixes:** Added tests to ensure no crashes when nullable Livewire properties are explicitly set to null. Updated several Livewire components to handle nullable properties gracefully. 🚀

2026-05-02 22:27:06 +01:00

create.blade.php

2026-05-02 22:27:06 +01:00

edit.blade.php

security: critical fixes (test route, edit authz, nostr signature, calendar IDOR)

2026-05-03 12:51:10 +00:00

index.blade.php

🛠️ Replace Livewire\Volt\Component with Livewire\Component across all Blade views for consistency with updated Livewire conventions.

2026-01-17 16:12:07 +01:00