UMBRA

History

Kyle Pope 925c9caf91 Fix QA and pentest findings for event invitations

C-01: Use func.count() for invitation cap instead of loading all rows
C-02: Remove unused display_calendar_id from EventInvitationResponse
F-01: Add field allowlist for invited editors (blocks is_starred,
      recurrence_rule, calendar_id mutations)
W-02: Memoize existingInviteeIds Set in EventDetailPanel
W-03: Block per-occurrence overrides on declined/pending invitations
S-01: Make can_modify non-optional in EventInvitation TypeScript type

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

2026-03-17 01:28:01 +08:00

audit.py

Extract real client IP from proxy headers instead of Docker bridge IP

2026-03-01 19:20:07 +08:00

auth.py

Address code review findings across all phases

2026-03-13 00:19:33 +08:00

calendar_sharing.py

Fix CompoundSelect chaining: use standalone union_all()

2026-03-16 20:39:40 +08:00

connection.py

Action QA findings: refactor sync to accept resolved values