kolaente c8893f4533 fix(cli): guard last admin on scheduled CLI deletion path ...

The last-admin guard was only enforced in the --now branch of 'user delete'. The default scheduled path called user.RequestDeletion without the guard, letting an operator schedule deletion of the last reachable admin via the CLI; the cron flow would then confirm and execute it, violating the invariant the HTTP admin API already enforces.

2026-04-20 18:55:06 +00:00

..

caldav

fix(caldav): escape user-controlled strings per RFC 5545 in VCALENDAR output

2026-04-09 15:44:04 +00:00

caldavtests

fix(caldav): skip tests for known CalDAV bugs and fix timing issues

2026-04-02 11:34:55 +00:00

cmd

fix(cli): guard last admin on scheduled CLI deletion path

2026-04-20 18:55:06 +00:00

config

feat: add license comments for agents and humans

2026-04-15 10:32:37 +00:00

cron

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

db

feat(license): add runtime state snapshot and reload helpers

2026-04-20 18:55:06 +00:00

doctor

feat(auth): enforce OpenID Connect issuer uniqueness across providers

2026-03-30 22:41:50 +00:00

e2etests

test(webhook): assert bad webhook is retried in no-duplicate test

2026-04-09 09:26:04 +00:00

events

feat: add InitEventsForTesting and Unfake for real event dispatch in tests

2026-03-05 12:49:27 +01:00

files

fix(files): derive file size from reader at creation boundary

2026-04-09 16:22:56 +00:00

health

feat: introduce shared health check logic (#1073)

2025-07-02 21:01:41 +00:00

i18n

chore(i18n): update translations via Crowdin

2026-04-16 01:46:56 +00:00

initialize

feat: add license comments for agents and humans

2026-04-15 10:32:37 +00:00

license

feat(license): add runtime state snapshot and reload helpers

2026-04-20 18:55:06 +00:00

log

fix(mail): guard log calls in GetMailDomain and fix hostname-dependent tests

2026-04-03 18:30:39 +00:00

mail

fix(mail): guard log calls in GetMailDomain and fix hostname-dependent tests

2026-04-03 18:30:39 +00:00

metrics

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

migration

feat(db): add is_admin column to users

2026-04-20 18:55:06 +00:00

models

feat(user): extract last-admin guard and close invariant gaps

2026-04-20 18:55:06 +00:00

modules

feat(auth): include is_admin in JWT claims

2026-04-20 18:55:06 +00:00

notifications

fix(notifications): escape markdown in user-controlled strings in email lines

2026-04-09 15:44:04 +00:00

plugins

test(plugins): add yaegi plugin integration tests

2026-03-30 20:44:46 +00:00

red

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

routes

fix(admin): reload created user before returning in admin create handler

2026-04-20 18:55:06 +00:00

swagger

[skip ci] Updated swagger docs

2026-04-13 16:21:02 +00:00

user

feat(user): extract last-admin guard and close invariant gaps

2026-04-20 18:55:06 +00:00

utils

fix: add timeouts to Gravatar, Unsplash, and SSRF-safe HTTP clients

2026-04-09 07:31:08 +00:00

version

fix: correct license header references (#882)

2025-06-10 12:18:38 +02:00

web

feat(handlers): dispatch pending events after transaction commit

2026-03-03 12:46:34 +01:00

websocket

feat(websocket): add notification event with XORM AfterInsert dispatch

2026-04-02 16:30:23 +00:00

webtests

test(admin): add webtests for /admin/* endpoints and share bypass

2026-04-20 18:55:06 +00:00

yaegi_symbols

feat(user): extract last-admin guard and close invariant gaps

2026-04-20 18:55:06 +00:00