Dave Horton bff9314622 fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558) ...

- Add precondition support to decorate.js retrieve function
- Fix google-custom-voices.js typo and add delete precondition
- Check ownership via speech_credential for google-custom-voices
- Add retrieve/delete preconditions to lcr-carrier-set-entries.js
- Add retrieve precondition to sip-gateways.js and smpp-gateways.js
- Add scope check to lcr-routes.js custom GET handler
- Add full authorization to tenants.js for all CRUD operations
- Add scoped query methods to tenant model

Co-authored-by: Claude Opus 4.5 <noreply@anthropic.com>

2026-06-27 15:53:51 -04:00

..

auth

Feat/371 view only user implementation using user_permissions (#381)

2025-04-01 09:29:06 -04:00

db

merge of features from hosted branch (#7)

2021-06-17 15:56:21 -04:00

helpers

add new /Callcount endpoint (#480)

2025-07-03 11:49:27 -04:00

models

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

record

Refactor S3MultipartUploadStream to optimize buffer handling and improve upload efficiency (#494)

2025-09-04 07:34:19 -04:00

routes

fix(security): add authorization checks to prevent cross-account access (CWE-639) (#558)

2026-06-27 15:53:51 -04:00

swagger

support list conference (#321)

2024-05-28 10:31:16 -04:00

utils

fix microsoft SST endpoint id is failed on validating speech credential (#554)

2026-06-01 08:38:21 -04:00

logger.js

remove pino.destination (#465)

2025-06-23 09:23:53 -04:00

middleware.js

user should be able to change the temprary password (#407)

2025-04-09 09:32:15 -04:00