Dustin Healy 2451bf54cf 🛡️ fix: Restrict System Grants to Role Principals (#12491) ... * 🛡️ fix: restrict system grants to role principals only Narrows GrantPrincipalType to PrincipalType.ROLE, rejecting GROUP and USER with 400. Removes grant cascade cleanup from group/user deletion handlers and their route wiring since only roles can hold grants. * 🛡️ fix: address review findings for grants roles-only restriction Add missing GROUP rejection test for revokeGrant (symmetric with getPrincipalGrants and assignGrant coverage), add extensibility comment to GrantPrincipalType, and document the checkRoleExists guard.		2026-03-31 19:25:14 -04:00
..
__test-utils__	🗑️ chore: Remove Action Test Suite and Update Mock Implementations (#12268)	2026-03-21 14:28:55 -04:00
__tests__	⚖️ refactor: Split Config Route into Unauthenticated and Authenticated Paths (#12490)	2026-03-31 19:22:51 -04:00
admin	🛡️ fix: Restrict System Grants to Role Principals (#12491)	2026-03-31 19:25:14 -04:00
agents	🏗️ feat: bulkWrite isolation, pre-auth context, strict-mode fixes (#12445)	2026-03-28 16:43:50 -04:00
assistants	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
files	⚗️ feat: Agent Context Compaction/Summarization (#12287)	2026-03-21 14:28:56 -04:00
types	WIP: Update UI to match Official Style; Vision and Assistants 👷🏽 (#1190)	2023-11-16 10:42:24 -05:00
accessPermissions.js	🛸 feat: Remote Agent Access with External API Support (#11503)	2026-01-28 17:44:33 -05:00
accessPermissions.test.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
actions.js	🛡️ fix: Secure MCP/Actions OAuth Flows, Resolve Race Condition & Tool Cache Cleanup (#11756)	2026-02-12 14:22:05 -05:00
apiKeys.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
auth.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
balance.js	feat: Accurate Token Usage Tracking & Optional Balance (#1018)	2023-10-05 18:34:10 -04:00
banner.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
categories.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
config.js	⚖️ refactor: Split Config Route into Unauthenticated and Authenticated Paths (#12490)	2026-03-31 19:22:51 -04:00
convos.js	🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466)	2026-03-30 16:49:48 -04:00
endpoints.js	🏗️ refactor: Remove Redundant Caching, Migrate Config Services to TypeScript (#12466)	2026-03-30 16:49:48 -04:00
index.js	👨‍👨‍👦‍👦 feat: Admin Users API Endpoints (#12446)	2026-03-30 23:06:50 -04:00
keys.js	🔱 chore: Harden API Routes Against IDOR and DoS Attacks (#11760)	2026-02-12 18:08:24 -05:00
mcp.js	🏗️ feat: 3-Tier MCP Server Architecture with Config-Source Lazy Init (#12435)	2026-03-28 10:36:43 -04:00
memories.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
messages.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
models.js	🛠️ refactor: Model Loading and Custom Endpoint Error Handling (#1849)	2024-02-20 12:57:58 -05:00
oauth.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
presets.js	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
prompts.js	📁 refactor: Prompts UI (#11570)	2026-03-22 16:56:22 -04:00
prompts.test.js	📁 refactor: Prompts UI (#11570)	2026-03-22 16:56:22 -04:00
roles.js	⚗️ feat: Agent Context Compaction/Summarization (#12287)	2026-03-21 14:28:56 -04:00
search.js	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
settings.js	📌 feat: Pin Agents and Models in the Sidebar (#10634)	2025-12-11 16:38:20 -05:00
share.js	🔒 refactor: Set ALLOW_SHARED_LINKS_PUBLIC to false by Default (#12100)	2026-03-06 19:05:56 -05:00
static.js	🧹 chore: Cleanup Logger and Utility Imports (#9935)	2025-10-01 23:30:47 -04:00
tags.js	📦 refactor: Consolidate DB models, encapsulating Mongoose usage in data-schemas (#11830)	2026-03-21 14:28:53 -04:00
user.js	📌 feat: Pin Agents and Models in the Sidebar (#10634)	2025-12-11 16:38:20 -05:00