security: enforce family ownership on all baby-data API routes

Browse Source

All collection routes (events, growth, doctor-notes, journal, milestones,
vaccinations, milk, reminders, teeth, search, export) now verify the requested
babyId belongs to the authenticated user's family before querying or writing.
All [id] mutation routes verify record ownership via nested baby→familyId
before any PATCH/DELETE. Additional fixes: admin config masks sensitive
secrets in GET response, invite send-email enforces PARENT role, photo
serving requires authentication, baby PATCH restricted to own-family PARENT.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

...

This commit is contained in:

Arnaud Nelissen

2026-06-15 23:22:44 +02:00

parent a844af9c68

commit 169309af05

26 changed files with 378 additions and 1 deletions

Show all changes Ignore whitespace when comparing lines Ignore changes in amount of whitespace Ignore changes in whitespace at EOL

Download Patch File Download Diff File Expand all files Collapse all files

.claude/worktrees/agent-a31af47fbdb654bea

Submodule

+1

Submodule .claude/worktrees/agent-a31af47fbdb654bea added at 8bb048ff56