755c39a0f6
feat : extend export endpoint for multi-user, multi-project, client filters
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-25 18:41:05 +01:00
Matthieu
a8f7c77758
feat : add TimeEntryExportController with auth, validation, and filters
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-03-24 16:03:35 +01:00
Matthieu
fd3097cc26
chore(backend) : rate limiting, cache-control, remove twig, clean deps
...
- Add login_throttling on /login_check (5 attempts/min) with symfony/rate-limiter
- Add Cache-Control: public, max-age=86400 on avatar responses
- Remove symfony/twig-bundle (unused in API-only project)
- Remove unused dev deps: symfony/browser-kit, symfony/css-selector
- Rename API Platform title to "Lesstime API"
Tickets: T-010, T-016, T-022, T-024, T-025
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-17 15:27:16 +01:00
Matthieu
2ac815d074
fix(security) : block SVG upload, enforce ROLE_CLIENT restrictions on documents
...
- Block SVG MIME type in TaskDocumentProcessor upload validation
- Serve existing SVG files as attachment (defense-in-depth) in download controller
- Block ROLE_CLIENT from uploading documents to tasks (only allowed via portal tickets)
- Add Doctrine extension to filter projects by allowedProjects for ROLE_CLIENT
Tickets: T-003, T-005, T-006
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-17 15:27:16 +01:00
e4fc34b90f
refactor : simplify codebase and fix critical issues
...
Backend:
- Add MCP Serializer to centralize entity-to-array conversion (~300 lines deduped)
- Fix race condition in task/ticket number generation (SELECT FOR UPDATE + transaction)
- Add unique constraint on task (project_id, number) with migration
- Fix MIME type validation: use server-detected finfo instead of client-supplied type
- Add allowlist of permitted MIME types for uploads
- Fix TaskDocumentDownloadController: allow ROLE_CLIENT access, add priority:1
- Fix notification sent even when ticket status unchanged
- Remove redundant exception constructors
- Simplify services (BookStackApi double fetch, TokenEncryptor, GiteaApi)
- Consolidate duplicate checks in processors
Frontend:
- Fix useApi isHandlingUnauthorized scope (module-level to prevent double 401 redirect)
- Fix client-tickets toast key copy-paste bug
- Merge duplicated tasks service methods (getByProject + getByProjectArchived)
- Extract shared uploadWithRelation helper in task-documents service
- Extract formatFileSize utility from duplicated component code
- Extract status transition logic into useClientTicketHelpers composable
- Remove dead code (unused router, handleLogout, empty script blocks)
- Merge duplicate watchers and onMounted calls
- Normalize arrow functions to function declarations per convention
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-15 22:09:16 +01:00
a5144443a4
fix(avatar) : address review findings — security and UX fixes
...
- Use getMimeType() instead of getClientMimeType() to prevent MIME spoofing
- Change IsGranted to IS_AUTHENTICATED_FULLY so ROLE_CLIENT can access avatars
- Remove Groups from avatarFileName (only avatarUrl needed by frontend)
- Disable aggressive caching to prevent stale avatar images
- Add error handling to avatar upload in profile page
- Use i18n for "Mon profil" button text
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-15 22:02:27 +01:00
4d0aa65920
feat(avatar) : add avatar upload/serve/delete controller
...
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-15 21:54:23 +01:00
2c28a4ad1d
fix(notification) : add route priority to prevent API Platform conflict
...
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-15 19:59:47 +01:00
ce2eaa03e1
feat(notification) : add unread-count and mark-all-read custom controllers
2026-03-15 19:46:10 +01:00
06832c24e1
feat : add document upload processor, download controller and cleanup listener
...
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com >
2026-03-15 18:05:58 +01:00
