fix(security): harden SSO domain registration, webhook path isolation, and CSV export#4813

Merged

waleedlatif1 merged 17 commits into

waleedlatif1/verify-code-changes

May 31, 2026

Commits on May 30, 2026

fix(security): harden KB file access, SSO domain registration, webhook path isolation, env secrets, and CSV export
waleedlatif1
committed
fix(sso): scope domain conflict query with indexed lower(domain) filter

waleedlatif1
and
claude
committed
chore: condense env route security comments

waleedlatif1
and
claude
committed
icons update
waleedlatif1
committed
chore(security): tighten inline comments in CSV export and KB file authorization

waleedlatif1
and
claude
committed
fix(security): validate internal serve origin in KB file authorization
waleedlatif1
committed
style(sso): use idiomatic sql lower() comparison for domain conflict query

waleedlatif1
and
claude
committed
fix(security): align workspace env admin gate with hasWorkspaceAdminAccess

waleedlatif1
and
claude
committed
fix(sso): rely on lower(domain) match for conflict detection, drop dead in-memory recheck

waleedlatif1
and
claude
committed
fix(security): scope webhook deploy path conflict to active webhooks

waleedlatif1
and
claude
committed
fix(security): exclude archived workflows from webhook deploy path conflict

waleedlatif1
and
claude
committed
fix(security): anchor KB file ownership to earliest document in any state
waleedlatif1
committed
updated greptile icon
waleedlatif1
committed
revert(security): drop KB file authorization changes
waleedlatif1
committed
fix(sso): treat caller's own user-scoped provider as owned during conflict check

waleedlatif1
and
claude
committed

Commits on May 31, 2026