Files

T

Gan, Jimmy c5987b1b6b security: fix passkey admin privilege escalation (issue #1 )

CRITICAL: Passkey authentication was hardcoded to always grant admin role,
completely bypassing RBAC and allowing any passkey user to gain full admin access.

Changes:
- Store username and role in passkey credential during registration
- Retrieve and use stored role during authentication (not hardcoded admin)
- Fallback to admin for legacy credentials without role field

Security Impact:
- Prevents privilege escalation via passkey authentication
- Enforces proper RBAC for passkey users
- Maintains backward compatibility with existing passkeys

Tests: 214 passing

2026-04-08 01:02:37 +08:00

backend

security: fix passkey admin privilege escalation (issue #1 )

2026-04-08 01:02:37 +08:00

frontend

fix: add compilerOptions to Svelte plugin in vitest config

2026-04-08 00:47:31 +08:00

.env.example

Add OpenClaw, backup automation, health checks, Telegram notifications

2026-02-19 21:40:34 +08:00

deploy.sh

Use docker save/load for cross-build deploy from M1 to NAS