admin/raven
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Release 8.3.0 cases: John's edits of 2026-10-24

Browse Source 
4713 takes F28; 4698 folded into 4711; F2 moved into 4579 (now priority 00);
4665 moved to the release after.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
This commit is contained in:
John Cardinal
2026-10-24 10:42:32 -07:00
parent 229fe208a7
commit 27e187bac6
2 changed files with 9 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
devdocs/modernization/NET10-PORT.md
View File

@@ -178,8 +178,9 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| Case | Name | Findings |
|---|---|---|
| 4710 | 2FA step requires the temp token (raven and sockeye) | F5, F41 |
| 4711 | Placeholder/short JWT secret treated as unset | F1 |
| 4711 | Placeholder/short JWT secret treated as unset (4698 folded in: random secret generated at install, server ignores a leftover placeholder) | F1 |
| 4712 | Customer contact route allowlist + ownership checks | F13, F14, F15, F16, F17 |
| 4713 | Contact users limited to customer roles | F28 |
| 4715 | Download file names checked (one helper) | F21 |
| 4716 | Pick-list search text as SQL parameters | F18 |
| 4717 | KPI interval allowlist | F26 |
@@ -192,9 +193,8 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4724 | SMTP: certificate checked, password never returned | F30, F31 |
| 4725 | Sessions: password change ends sessions, exact-path token exemption, default SuperUser refused when licensed | F7, F8, F9 |
| 4726 | Login throttling/lockout | F6 |
| 4727 | Low severity hardening | F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) |
| 4727 | Low severity hardening | F10, F11, F12, F22, F23, F25, F29, F35, F36, F38; the AyaNova half of F39 (DB ID not shown anonymously) |
| 4681 | Sockeye: licence/trial request hardening (tagged sockeye, rockfish) | F40; the Sockeye half of F39 (repeatable licence fetch) |
| (none yet) | Contact users limited to customer roles | **F28** |
**From the port and earlier triage**
@@ -207,7 +207,6 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4695 | Shipping the Visual C++ runtime DLLs with the standalone install | 1 |
| 4696 | JWT secret missing from the standalone config.json | 1 |
| 4697 | Relative date filters using the server's time zone | 1 |
| 4698 | JWT placeholder in the LAN and Linux templates (same subject as 4711) | 1 |
| 4699 | Linux desktop data-path note in the manual | 1, docs |
| 4700 | Restore note for customers with a dedicated database role | 1, docs |
| 4703 | Report JS console error logging | 1 |
@@ -216,20 +215,21 @@ John's "next release" cases for AyaNova (exported 2026-10-24). Each is its own s
| 4707 | Stray cypress.json in raven-client | 1, investigate |
| 4687 | Generator polls every second (raven and sockeye) | 1 |
| 4682 | Time-only picker keeps the old date's DST offset | 1 |
| 4665 | Health route: does it check the database? | 1, feature |
| 4661 | Docs: password guidance | 1, docs |
| 4636 | Docs: turn off 2FA before v7 to v8 migration | 1, docs |
| 4634 | Docs: custom checkbox shows nothing for older records | 1, docs |
| 4633 | Docs: pg_dump path quoting on Windows (likely fixed by the port; confirm) | 1, docs |
| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports | 1, investigate |
| 4632 | AYANOVA_REPORT_RENDER_API_URL_OVERRIDE breaks customer notification reports (do before or with 4719) | 1, investigate |
| 4628 | Deleting a work order tied to a CSR gives a raw server error | 1, bug |
| 4623 | Docs: migration, what is erased and what is kept | 1, docs |
| 4602 | Logo upload UI: hide Upload and Delete until usable | 1, client |
| 4579 | Windows permissions on folders AyaNova writes to (installers, docs, code) | 1, investigate |
| 4579 | Windows installer modify rights: only the folders AyaNova writes to, only for the account it runs as (includes F2) | 00 |
| 4690 | .NET 10 port umbrella case | 1 |
Sockeye cases (exported 2026-10-24): 4710 (also in the table above) and 4681. 4681 predates the review: a trial request with a made-up address made Sockeye send its verification email, which bounced to support@ (Fastmail notice, 2026-10-16).
Moved out of 8.3.0 by John (2026-10-24): 4665 (health route checks the database) goes to the release after.
Later, not 8.3.0: F42 (move the licence signing key out of Sockeye source) and F32 (rotate the
FastMail password after the old Sockeye server is retired), John's cases.

4
devdocs/modernization/SECURITY-REVIEW.md
View File

@@ -851,8 +851,8 @@ by a customer contact. Pass 8: confirmed from code (`NotifyController.SendNotify
John's cases for the findings (created 2026-10-24; full list in `NET10-PORT.md`, "Release 8.3.0
cases"): 4710 (F5, F41), 4711 (F1), 4712 (F13 to F17), 4715 (F21), 4716 (F18), 4717 (F26),
4718 (F19, F24), 4719 (F20), 4720 (F27), 4721 (F33), 4722 (F34), 4723 (F3, F4), 4724 (F30, F31),
4725 (F7, F8, F9), 4726 (F6), 4727 (F2, F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and
the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). **F28 has no case yet.** Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
4725 (F7, F8, F9), 4726 (F6), 4579 (F2), 4713 (F28), 4727 (F10, F11, F12, F22, F23, F25, F29, F35, F36, F38, and
the AyaNova half of F39), Sockeye 4681 (F40 and the Sockeye half of F39). Not in 8.3.0: F32, F42 (John's later cases); F37 accepted. When a
case is done, its findings' status becomes *fixed in case NNNN*.
## Customer contact route allowlist (draft, for the F13 to F17 fix)