Maurice 0f0bf50cd3 fix(assignments): guard the per-assignment routes like the day routes ...

AssignmentOpsController declared @RequirePermission('day_edit') on its
mutations but carried only JwtAuthGuard. TripAccessGuard is what reads that
decorator and what resolves :tripId, so on this controller the permission
markers were metadata nobody looked at and the trip in the URL was never
matched against the caller. Its sibling, DayAssignmentsController, has had the
pair since the migration.

The two participants handlers also went straight to the service with the id
from the path, unlike move/time/transport, which ask getAssignmentForTrip
first. They ask now too.

2026-08-16 21:57:21 +02:00

..

app-config

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

budget

refactor(server): delete trips.bridge via leaf membership reads and prompt relocation

2026-08-11 20:28:49 +02:00

days

Give day notes a domain of their own

2026-08-10 13:38:26 +02:00

db

fix(reservations): scope the per-day position write to the trip

2026-08-16 21:57:21 +02:00

files

Split PluginsModule into four, and gate coverage per domain

2026-08-09 18:44:59 +02:00

mcp

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

middleware

Pin the request body ceiling instead of inheriting it

2026-08-10 13:38:26 +02:00

nest

fix(assignments): guard the per-assignment routes like the day routes

2026-08-16 21:57:21 +02:00

packing

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

places

feat(places): link an expense to a place, the way bookings already do (#1917)

2026-08-12 21:37:12 +02:00

plugins

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

reservations

fix: eleven reported bugs across atlas, budget, collections, journey, vacay and the LLM settings (#1923)

2026-08-13 14:06:35 +02:00

services

fix(packing): authorize every single-item path against the item, not just the trip

2026-08-14 22:09:21 +02:00

systemNotices

feat(config): put the operator-owned surfaces behind TREK_MANAGED (#1946)

2026-08-15 16:42:27 +02:00

tags

Finish the contract ratchet, the upload bridge and the client leftovers

2026-08-10 19:54:46 +02:00

todo

Split PluginsModule into four, and gate coverage per domain

2026-08-09 18:44:59 +02:00

trips

Split the trip aggregate root into its parts

2026-08-10 13:38:26 +02:00

utils

v3.4.0 (#1540)

2026-07-18 22:13:52 +02:00

auto-backup.test.ts

refactor(server): migrate plugin jobs off node-cron

2026-08-10 22:16:22 +02:00

idempotency-cleanup.test.ts

Type the cron registrar stub so the tests typecheck again

2026-08-11 09:58:37 +02:00

shared-contract.test.ts

Release 3.1.0 (#1185)

2026-06-16 22:22:45 +02:00

uploads-dirs.test.ts

test(uploads): pin the uploads subdir list across Dockerfile and boot

2026-07-31 15:41:02 +02:00