sandrodachandClaude Opus 5.5 6b56a33500 fix(db): report write errors, multi-step changes all or nothing (FLAW-14) ...

Store.execInTx runs related statements in one transaction and returns
the first error. Used for deleting and moving folders (with the trash),
shared folders, folder shares and mounts, deleting task lists and
accounts, pinning, and the password reset (new password and the end of
all other links together). Writes whose success the API reports now
pass their error to the client (logout, new password, setup, sharing
mode, new group, restore, unlinking a note block), follow-up tasks and
alarm markers log failures. Remaining ignored writes are listed as
intentional in flaws.md.

Found on the way: DeleteTaskList unlinked all tasks before checking
ownership, so a stranger with the list ID could empty it; viewers could
unlink tasks from note blocks. Both fixed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

2026-10-29 14:59:23 +01:00

..

alarm_test.go

feat(tasks): due dates with optional time; alarms at the right moment

2026-10-29 07:48:37 +01:00

alarms.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

clientip.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

demo_test.go

feat(demo): reset the demo instance every 20 minutes with a countdown

2026-10-29 14:22:06 +01:00

demo.go

feat(demo): reset the demo instance every 20 minutes with a countdown

2026-10-29 14:22:06 +01:00

docsync_test.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

docsync.go

feat(notes): compact the operation log and purge old tombstones

2026-10-28 15:08:13 +01:00

handlers_account.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_admin.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

handlers_auth.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

handlers_documents.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_folders.go

refactor: split sqlite.go and server.go by domain (FLAW-20)

2026-10-29 08:14:33 +01:00

handlers_integrations.go

feat(api-keys): scopes for triage, tasks and list items (FLAW-07)

2026-10-29 14:36:17 +01:00

handlers_lists.go

fix(security): list items need write access to their list (FLAW-27)

2026-10-29 14:28:39 +01:00

handlers_tasklists.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

handlers_teams.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

handlers_thoughts.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

loginguard_test.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

loginguard.go

feat(auth): lock logins after repeated failures, trust proxies explicitly (FLAW-09)

2026-10-29 14:26:02 +01:00

mail_test.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

mail.go

fix(smtp): AUTH LOGIN fallback when PLAIN is refused

2026-10-29 00:09:27 +01:00

netguard_test.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

netguard.go

fix(security): SSRF protection for alarm webhooks (FLAW-05)

2026-10-29 07:37:39 +01:00

password_reset.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

realtime_test.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

realtime.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

server_test.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

server.go

fix(db): report write errors, multi-step changes all or nothing (FLAW-14)

2026-10-29 14:59:23 +01:00

streamticket_test.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00

streamticket.go

fix(security): stream tickets instead of session tokens in URLs (FLAW-22)

2026-10-29 14:46:58 +01:00