07c10f6542
Security review: draft customer contact route allowlist for the F13 to F17 fix
...
Routes the client calls for customer contacts, read from raven-client, with the
ownership check each id route needs, and the proposed shape of the fix
(allowlist in the token middleware plus per-route ownership checks).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 20:00:31 -07:00
2fca018add
Security review: F5, F1 and F18 also fixed in 8.3.0; findings gate the release
...
John's decision: 8.3.0 is not released until every finding is fixed or
explicitly accepted. The review therefore runs before the release, not after.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 19:58:31 -07:00
ee6def1932
Security review: F13 to F17 (customer contact isolation) fixed in 8.3.0
...
John's decision: urgent, "next release" cases before 8.3.0; hosted and
self-hosted installations equally. Recorded in SECURITY-REVIEW.md and in the
NET10-PORT.md list of cases for this release.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 19:55:50 -07:00
2004bf197a
Security review pass 3: what customer contact users can reach
...
Confirmed on the local server as the seeded contact: any customer's work order
by id (F13), other customers' service requests (F14), the full customer list
with phones and emails through pick lists (F15), the whole service schedule
(F16). Candidates from code: notification subscriptions for another user (F17),
pick-list search text placed in SQL unescaped (F18). Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 19:50:21 -07:00
26173b3926
Security review pass 2: login, tokens, password reset, 2FA, anonymous routes
...
F5 (critical, confirmed on the local server): the 2FA step accepts an empty or
missing temp token, so users with 2FA on can be logged into without a password.
F1 confirmed: with the placeholder secret a user's current token can be rebuilt.
F8 confirmed. New findings F6, F7, F9 to F12. Review only, no code changes.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 19:24:45 -07:00
2a9664dbe0
Security review pass 1: scope, threat model, attack-surface map, first candidate findings
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 18:00:18 -07:00
67cc5eafad
case 4690 - CLAUDE.md and NET10-PORT: port merged into main; release work continues on main
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 17:24:43 -07:00
3663301101
Merge net10-port: .NET 10 port (case 4690)
2026-10-23 17:23:51 -07:00
4351ee9706
case 4690 - NET10-PORT: tick or reword older open items with current evidence
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 17:07:53 -07:00
181b1e446e
case 4690 - NET10-PORT: Windows LAN installer tested; all five packages installed and started
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 17:02:50 -07:00
daf093d51c
case 4690 - Windows network install: official PostgreSQL download link (installer and manual); examples for PostgreSQL 18
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 16:06:27 -07:00
4ae9d53e72
case 4690 - .NET SDK 10.0.402 on the workstation: standalone and launcher bundle runtime 10.0.13; update-before-release note in BUILD.md
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 15:43:55 -07:00
7eb672bee5
case 4690 - manual: the one-installation-per-computer note applies to AyaNova 8 only (AyaNova 7 can stay)
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 15:41:52 -07:00
67e2a37149
case 4690 - manual: only one type of Windows installation per computer (installers share one AppId by design)
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 14:54:53 -07:00
92b4428146
case 4690 - NET10-PORT: John's decisions on the standalone findings; installer AppId notes
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 14:52:38 -07:00
9fcc70cf1c
case 4690 - NET10-PORT: fix a row reference in the log
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 14:45:04 -07:00
5e64ac3250
case 4690 - NET10-PORT: Windows standalone installer test results; VC++ runtime, launcher shutdown impact and bundled runtime version recorded
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 14:44:50 -07:00
63b2a34cc8
case 4690 - standalone installer: create the empty PostgreSQL folders Git does not keep (fresh installs failed to start the database)
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 14:44:19 -07:00
d81a88b607
case 4690 - NET10-PORT: Linux packages from the release build tested on Ubuntu 24.04; desktop data-path finding deferred
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 12:20:45 -07:00
a223a2bc65
case 4690 - build-release.bat: copy all output to build-output.txt; UTF-8 for MkDocs when piped
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:37:29 -07:00
cc2ccec9b1
case 4690 - build docs: pin MkDocs below 2 (Material is incompatible with 2.0); Zensical move on the roadmap
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:31:49 -07:00
4a011f65bd
case 4690 - manual: fix six broken links (wrong anchors, missing .md) reported by MkDocs
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:31:37 -07:00
b74a97016e
case 4690 - NET10-PORT: customer manual item done
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:17:44 -07:00
ae25111175
case 4690 - BUILD.md: name the backup batch file and rclone remote in the laptop checklist
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:16:20 -07:00
523bb8f10b
case 4690 - BUILD.md: backup laptop catch-up checklist (.NET 10 SDK and tooling changes made on the workstation)
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 11:14:33 -07:00
fba399670d
case 4690 - dev docs: build VM deprecated, releases built on the workstation (backup laptop as fallback)
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:52:17 -07:00
2dbac07bf4
case 4690 - build docs: .NET 10 SDK for the server, launcher and build VM
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:48:06 -07:00
b4cfc54aa2
case 4690 - Windows installers: stop creating unused Chrome folders in the program folder; uninstall removes them
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:47:22 -07:00
afb0791ea8
case 4690 - LAN installer: Hosting Bundle prompt and link to .NET 10
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:44:34 -07:00
85530d36f6
case 4690 - NET10-PORT: release timing; SuperUser delete fixed before 8.3.0
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:43:27 -07:00
111d7922a9
case 4690 - manual: .NET 10 runtime install/upgrade steps, Ubuntu 24.04/26.04, backup password note; changelog 8.3.0 draft
...
Also removes the server-only /var/ayanova chown/chmod lines from the Linux desktop upgrade page.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 10:43:27 -07:00
ce8c4d18a1
case 4690 - NET10-PORT: section 4 results on Ubuntu 26.04
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 09:43:22 -07:00
4d8754f037
case 4690 - NET10-PORT: Ubuntu 26.04 fresh install with the updated setup script
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 09:32:00 -07:00
b0399d93cc
case 4690 - NET10-PORT: setup script plan for 26.04; Sockeye automated provisioning noted as a future case
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 09:10:39 -07:00
d3df5a8606
case 4690 - NET10-PORT: Linux report date format confirmed unchanged from 8.2.4
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 08:13:33 -07:00
bf0555fb31
case 4690 - report browser: launch chrome-headless-shell; writable config/cache folders for the browser; Ubuntu 24.04 droplet results
...
Full Chrome 155 would not start under a Linux service user with no writable
home (chrome_crashpad_handler: --database is required). chrome-headless-shell
starts, and measured on a 1 GB droplet is 3-4x faster and smaller per render.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-23 08:12:21 -07:00
b76cf098b7
case 4690 - NET10-PORT: test project retargeted; InvariantGlobalization left off; subscription setup script added to the port
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:57:38 -07:00
9af1034a88
case 4690 - data-list date filters: >= and < from the start of the minute, != excludes the whole minute; null check first
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:38:23 -07:00
892ef59608
case 4690 - report browser download/launch failures: logged at Error, specific error returned to the client
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:31:29 -07:00
a34e012eee
case 4690 - report browser downloads under the data path, not beside the app; manual updated
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:25:00 -07:00
e8e7a2ec40
case 4690 - erase database: check CREATEDB before dropping, so a failed create can't leave no database
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:15:13 -07:00
78f5863947
case 4690 - backup: run pg_dump without a shell, password in PGPASSWORD, failures detected by exit code
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 20:00:52 -07:00
6db7c12c49
case 4690 - appsettings.json: Debug/Console log levels Trace -> Warning
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 19:47:31 -07:00
86ac9a2b96
case 4690 - remaining packages to current releases (Bogus, jose-jwt, QRCoder); Newtonsoft.Json direct reference
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 19:47:31 -07:00
77b825a064
case 4690 - CA2022: read the PE header with ReadAtLeast for the licence build date
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 19:39:11 -07:00
76dab8d865
case 4690 - remove MiniProfiler (never used): packages, wiring, profiler auth workaround, credits entry
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 18:49:28 -07:00
e55e0d6707
case 4690 - Asp.Versioning 10.2.1 with explicit AddMvc()
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 18:45:40 -07:00
6f3dda117e
case 4690 - NET10-PORT: note report console error detail logging as a follow-up case
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 18:17:32 -07:00
f3e8026501
case 4690 - PuppeteerSharp 25.15.0; launch arguments as separate elements; --lang keeps the server locale as browser default
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 18:12:49 -07:00
91f59d8554
case 4690 - NLog 6.2.2: archive suffix keeps log-ayanova-N.txt names and cleans up old archives; log viewer sorted by date
...
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-22 17:31:01 -07:00
