Devin FoleyandPaperclip 09a82c271e fix(authz): preserve board org-membership check in assertBoardOrAgent ...

Greptile flagged that swapping `assertBoardOrgAccess` → `assertBoardOrAgent`
on `GET /api/plugins/tools` and `POST /api/plugins/tools/execute` silently
dropped the org-membership check for board actors. `GET /api/plugins/tools`
has no downstream company-scope guard, so memberless board users could
enumerate every installed plugin tool.

Tighten `assertBoardOrAgent` to delegate the board branch back to
`assertBoardOrgAccess` (require company membership or instance-admin) while
keeping the new agent-JWT path. Adds a regression test asserting a board
user with no memberships gets 403 on tool listing.

Co-Authored-By: Paperclip <noreply@paperclip.ing>

2026-06-03 20:42:47 -07:00

..

scripts

fix(server): use stable tsx/cli entry point in dev-watch

2026-03-28 06:42:03 +07:00

src

fix(authz): preserve board org-membership check in assertBoardOrAgent

2026-06-03 20:42:47 -07:00

CHANGELOG.md

chore: release v0.3.1

2026-03-12 13:09:22 -05:00

package.json

Add built-in grok_local adapter (#6087)

2026-05-16 09:51:09 -07:00

tsconfig.json

Fix root TypeScript solution config

2026-03-09 14:09:30 -05:00

vitest.config.ts

Stabilize serialized server route tests (#4448)

2026-04-24 19:27:00 -05:00