Skip to content

security: onboarding & admin privilege hardening (3 fixes) #45

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
BunsDev merged 7 commits into from
Jun 15, 2026
Merged

security: onboarding & admin privilege hardening (3 fixes) #45

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
118c3a2
fix(onboarding): restore token-gated cloud bootstrap
BunsDev Jun 3, 2026
d4d3747
fix(onboarding): guard admin bootstrap
BunsDev Jun 3, 2026
3cf9d15
fix(onboarding): restrict bootstrap admin promotion
BunsDev Jun 5, 2026
db2033c
fix(onboarding): serialize bootstrap admin checks and gate fresh use-…
Copilot Jun 6, 2026
ed80305
merge: codex/fix-onboarding-admin-privilege-vulnerability
BunsDev Jun 15, 2026
f038376
merge: codex/propose-fix-for-admin-privilege-escalation-9480dt
BunsDev Jun 15, 2026
63d121d
merge: codex/propose-fix-for-onboarding-vulnerability-gypryp
BunsDev Jun 15, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion apps/web/src/routes/api/cloud/__tests__/bootstrap.test.ts
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -179,7 +179,7 @@

expect(res.status).toBe(200)
await expect(res.json()).resolves.toMatchObject({ userId: 'user_existing' })
expect(vi.mocked(getAuth)).not.toHaveBeenCalled()
expect(vi.mocked(getAuth)).toHaveBeenCalledOnce()

Check failure on line 182 in apps/web/src/routes/api/cloud/__tests__/bootstrap.test.ts

View workflow job for this annotation

GitHub Actions / test

apps/web/src/routes/api/cloud/__tests__/bootstrap.test.ts > POST /api/cloud/bootstrap > is idempotent for the same admin email 

AssertionError: expected "vi.fn()" to be called once, but got 0 times
 ❯ apps/web/src/routes/api/cloud/__tests__/bootstrap.test.ts:182:32
expect(vi.mocked(mintMagicLinkUrl)).toHaveBeenCalledOnce()
})
})
Loading