Dave 2a8d6f2505 fix(security): lock the users collection against privilege escalation ... The users collection kept PocketBase's defaults because the Plan 1a rules migration covered eight collections and missed this one: createRule "" -> anyone could sign up updateRule "id = @request.auth.id" -> anyone could edit their own record `role` is an ordinary field here, so both were escalations. Verified exploitable against the live instance: an anonymous request created an account with role "owner", and a client manager promoted themselves to owner by patching their own record. Either route yields read and write access to every client's board. Create, update and delete are now superuser-only; list and view are owner-or-self. Adds four integration tests so a regression fails loudly. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>		2026-09-16 11:18:13 +02:00
..
seed-demo.ts	fix(seed): spread ColumnInput to satisfy Record type in upsert	2026-09-16 09:47:15 +02:00
setup-remote.ts	fix(security): lock the users collection against privilege escalation	2026-09-16 11:18:13 +02:00