fix(security): require org membership for app-scoped role_bindings - #3094

Closed

riderx wants to merge 28 commits into

mainfrom

fix/security-ghsa-9976-role-bindings

Commits on Aug 25, 2026

fix(security): require org membership for scoped role_bindings (GHSA-9976)

cursoragent
and
riderx
committed
52f3503
ci: retrigger pull_request checks

cursoragent
and
riderx
committed
d5c7816
test(db): fix role_bindings membership pgTAP ordering and error code

cursoragent
and
riderx
committed
d201712
fix(security): address CodeRabbit role_bindings follow-ups

cursoragent
and
riderx
committed
a4f8d62
ci: retrigger pull_request checks

cursoragent
and
riderx
committed
14d65dd

Commits on Aug 26, 2026

test(db): address cubic P2 threads for role_bindings membership RLS

cursoragent
and
riderx
committed
d659618
ci: retrigger after cancelled workflow

cursoragent
and
riderx
committed
14c574e
ci: retrigger tests (sequential, no concurrent security PRs)

cursoragent
and
riderx
committed
a779b09
test(db): run apikey reject case before outsider gains org membership

cursoragent
and
riderx
committed
e5238d9
ci: retrigger after queue drain

cursoragent
and
riderx
committed
6a6e9d2
ci: retrigger to validate test ordering fix

cursoragent
and
riderx
committed
4be6a56
ci: retrigger after cancelled workflow

cursoragent
and
riderx
committed
6bcc1e0
ci: retrigger Run tests (CLI integration cancelled)

cursoragent
and
riderx
committed
8f5bf0b
ci: retrigger pull_request after Cloudflare plugin flake

cursoragent
and
riderx
committed
dfde3a7
ci: retrigger pull_request Run tests

cursoragent
and
riderx
committed
6e5ee12
Merge branch 'main' into fix/security-ghsa-9976-role-bindings
TorichanCapgo
authored
2cb4128

Commits on Sep 9, 2026

test(ci): restore stable rate-limit and queue_load helpers from main

cursoragent
and
riderx
committed
9b3fa5a
merge: sync main for migration ordering

cursoragent
and
riderx
committed
b04a624
chore: merge main and bump role_bindings migration timestamp

cursoragent
and
riderx
committed
042abec
test(db): tighten role_bindings membership pgTAP isolation

cursoragent
and
riderx
committed
740c6e4
Fix review feedback on queue load test and RBAC SQL fixtures

cursoragent
and
riderx
committed
0159d65

Commits on Sep 10, 2026

Address remaining CodeRabbit review threads on role bindings PR

cursoragent
and
riderx
committed
5ecdeb9
Fix cubic MFA bypass and invitation pool cleanup

cursoragent
and
riderx
committed
899ecd4
Fix PoolClient typing in accept_invitation transaction

cursoragent
and
riderx
committed
3ce7940
Serialize invitation acceptance and enforce scoped app consistency

cursoragent
and
riderx
committed
f3db020
Serialize invite acceptance with lock_rbac_orgs and cleanup warmup key

cursoragent
and
riderx
committed
65e29c8
Harden invite-role lock ordering and apikeys warmup cleanup

cursoragent
and
riderx
committed
fef069c
Rethrow HTTPException from ensureOrgMembership catch

cursoragent
and
riderx
committed
07ec2ab