ashim-hq bf73150301 fix: prevent admin escalation when AUTH_ENABLED=false ...

When auth was disabled, the backend middleware attached the first admin
user from the database to every request, and the frontend granted all 12
permissions. This gave every unauthenticated visitor full admin access
to user management, settings, teams, branding, and feature installation.

Now both layers use role "user" with user-level permissions so tools,
files, and pipelines still work without login while admin-only routes
correctly return 403.

Closes #72

2026-04-21 23:38:42 +08:00

..

public

Refactor code structure for improved readability and maintainability

2026-04-17 17:07:31 +08:00

src

fix: prevent admin escalation when AUTH_ENABLED=false

2026-04-21 23:38:42 +08:00

index.html

chore: rename Stirling-Image to ashim across entire codebase

2026-04-14 20:55:42 +08:00

package.json

chore: add @use-gesture/react for collage touch interactions

2026-04-19 15:46:02 +08:00

postcss.config.js

feat: add Vite + React SPA with Tailwind CSS and routing

2026-03-22 02:57:49 +08:00

tsconfig.json

feat: add Vite + React SPA with Tailwind CSS and routing

2026-03-22 02:57:49 +08:00

vite.config.ts

fix(docker): fix TDZ crash, icon bundle bloat, rate-limit on static assets

2026-04-15 18:52:36 +08:00