5 Commits

Author	SHA1	Message	Date
kolaente	b7a1408098	fix: use require.Error instead of assert.Error for error assertions	2026-03-20 11:41:28 +00:00
kolaente	2da89258e5	test: add failing test for task comment IDOR ... Proves that a user can read a comment from an inaccessible task by supplying an accessible task ID in the URL. Comment 18 belongs to task 34 (owned by user 13), but testuser1 can read it via task 1. Ref: GHSA-mr3j-p26x-72x4	2026-03-20 11:41:28 +00:00
kolaente	39b4568bc5	refactor: centralize HTTP error handling (#2062) ... This changes the error handling to a centralized HTTP error handler in `pkg/routes/error_handler.go` that converts all error types to proper HTTP responses. This simplifies the overall error handling because http handler now only need to return the error instead of calling HandleHTTPError as previously. It also removes the duplication between handling errors with and without Sentry. 🐰 Hop along, dear errors, no more wrapping today! We've centralized handlers in a shiny new way, From scattered to unified, the code flows so clean, ValidationHTTPError marshals JSON supreme! Direct propagation hops forward with glee, A refactor so grand—what a sight to see! 🎉	2026-01-08 10:02:59 +00:00
kolaente	a81a3ee0e5	feat!: rename right to permission (#1277)	2025-08-13 11:05:05 +02:00
kolaente	6671ce38a8	chore: rename API test suites (#938)	2025-06-13 08:23:17 +00:00