2 Commits

Author	SHA1	Message	Date
arnaudne	1dac9690f5	security: SSRF prevention, ownership gaps, host header injection, date validation ... - webhooks: block SSRF — reject localhost/127.x/169.254.x/10.x/192.168.x URLs at creation and silently skip at dispatch time - medication-profiles/last-intakes: add family ownership check on babyId - invite/send-email: build invite URL from NEXTAUTH_URL env only; drop req.headers.get("origin") to prevent host header injection - baby POST: validate birthDate is a real date; add required-fields check - milk POST: validate storedAt before new Date() - journal GET: validate date filter before new Date() Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-15 23:33:45 +02:00
arnaudne	41170d9155	feat: UX improvements, webhooks, invite management ... - Photo lightbox: ArrowLeft/Right/Escape keyboard navigation - Growth chart: persistent WHO percentile legend (not hover-only) - Sleep stats: configurable window selector (18h/19h/20h/21h) - Quick-add FAB: now visible on desktop (bottom-right corner) - Invite code reset button in settings (non-admin, PARENT role only) - Pending email invites: tracked per-token with 7-day expiry, revocable from settings UI; new /auth/invite/t/[token] accept page - Webhooks: Prisma model, CRUD API, HMAC-SHA256 dispatcher wired into event.created / growth.created / doctor_note.created; settings UI - Docker cron service: medication reminders every 15min, milk-expiry and daily-digest daily; secured with CRON_SECRET - Photo uploads persist across redeploys via Docker named volume Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-15 23:14:28 +02:00