Jonathan 011852d091 fix(web): close prototype-chain bypass in DELETE /api/config allowlist ...

FIELDS[field] walked the prototype chain, so field=__proto__ (or
constructor, hasOwnProperty, etc.) resolved to a truthy inherited value
whose .key was undefined. Prisma drops undefined filter values, so
deleteMany({ where: { key: undefined } }) collapsed to deleteMany({}),
wiping the entire Config table. Guard with an own-property check before
indexing FIELDS so only real allowlist entries pass.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-07-13 00:27:22 +02:00

..

prisma

feat(discovery): DiscoverySuggestion schema + WatchedArtist.lastDiscoveredAt

2026-07-11 23:58:45 +02:00

public

feat: add worker loop and production Dockerfiles

2026-07-10 17:16:24 +02:00

src

fix(web): close prototype-chain bypass in DELETE /api/config allowlist

2026-07-13 00:27:22 +02:00

.dockerignore

feat: add worker loop and production Dockerfiles

2026-07-10 17:16:24 +02:00

docker-entrypoint.sh

feat: add worker loop and production Dockerfiles

2026-07-10 17:16:24 +02:00

Dockerfile

fix: worker waits for schema before claiming; npm ci for reproducible builds

2026-07-10 17:32:20 +02:00

next.config.ts

chore: scaffold web, worker, and compose stack

2026-07-10 16:33:22 +02:00

package-lock.json

fix: bump next past known CVEs

2026-07-10 16:39:57 +02:00

package.json

fix: guard test cleanup to a dedicated lyra_test DB (never wipe live data)

2026-07-11 16:16:12 +02:00

tsconfig.json

chore: scaffold web, worker, and compose stack

2026-07-10 16:33:22 +02:00

vitest.config.ts

feat: add request create/list API

2026-07-10 16:47:54 +02:00