fred dcb9da14d5 fix(gateway): scope /api/teams endpoints to team membership (#1428) ...

Every teams route sat behind AuthGuard only: any authenticated user
could enumerate all teams and their full member records (webUI audit
A3 F9.2, upgraded to major in cross-review).

- GET /api/teams: members see only their teams (new
  TeamsService.findAllForUser, same two-step pattern as
  brain/projects.findAllForUser); admins keep the full list.
- GET :teamId, :teamId/members: require admin or membership; 404 for a
  missing team, 403 for no access — the projects-controller convention.
- GET :teamId/members/:userId: self-lookup stays open; looking up
  another user is team-scoped like the rest.

No consumers of /api/teams exist in the monorepo, so no caller changes.
New controller spec: 9 tests. Gateway suite 818 passed, typecheck clean.

2026-08-26 17:16:07 -05:00

..

src

fix(gateway): scope /api/teams endpoints to team membership (#1428)

2026-08-26 17:16:07 -05:00

package.json

feat: add Tess runtime provider registry (#722)

2026-07-12 23:53:54 +00:00

tsconfig.json

fix: add vitest.config.ts to eslint allowDefaultProject (#440 build fix) (#441)

2026-04-05 22:01:57 +00:00

tsconfig.typecheck.json

fix: rename all packages from @mosaic/* to @mosaicstack/*

2026-04-04 21:43:23 -05:00

vitest.config.ts

fix: bootstrap hotfix — DTO erasure, wizard failure, port prefill, Pi SDK copy (mosaic-v0.0.26) (#440)

2026-04-05 21:43:30 +00:00