2 Commits

Author	SHA1	Message	Date
arnaudne	9e32766046	security: second-pass ownership checks + input validation fixes ... - medication-profiles/[id]: verify familyId ownership before PATCH/DELETE - event-templates/[id]: verify familyId ownership before PATCH/DELETE - notify/push: verify baby.familyId matches session family before push - events GET: validate type against ALL_EVENT_TYPES allowlist; sanitize limit (1–500) and offset (≥0) to prevent NaN/unbounded queries - v1/summary: fix operator precedence bug in feeds count calculation Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-15 23:25:34 +02:00
arnaudne	169309af05	security: enforce family ownership on all baby-data API routes ... All collection routes (events, growth, doctor-notes, journal, milestones, vaccinations, milk, reminders, teeth, search, export) now verify the requested babyId belongs to the authenticated user's family before querying or writing. All [id] mutation routes verify record ownership via nested baby→familyId before any PATCH/DELETE. Additional fixes: admin config masks sensitive secrets in GET response, invite send-email enforces PARENT role, photo serving requires authentication, baby PATCH restricted to own-family PARENT. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-06-15 23:22:44 +02:00