3 Commits

Author	SHA1	Message	Date
sepehr	fa72672aac	security: fix critical auth gaps, SSRF, IDOR, and embedding error handling ... CRITICAL: - Add auth + admin check to 10 unprotected API routes (test-*, debug/*, config, models, fix-labels) - Add CRON_SECRET bearer auth to /api/cron/reminders (was fully open) - Add SSRF protection to getOllamaModels (blocks private/internal IPs) HIGH: - Fix getAllLabels() missing userId filter (leaked all users' labels) - Fix /api/labels OR clause leaking other users' labels - Fix IDOR in toggleAgent/getAgentActions (add ownership check) - Fix getEmbeddings() returning [] on error in all 5 providers (corrupted semantic search with NaN cosine similarity) — now throws instead Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-30 21:02:13 +02:00
sepehr	6ff8088cc2	fix: label management - transaction safety, deletion sync, error handling ... - Use prisma.$transaction in auto-label-creation.service with tx client - Fix DELETE /api/labels to properly JSON.parse + disconnect labelRelations - Fix PUT /api/labels rename to handle JSON labels - Graceful error handling in /api/ai/tags and /api/ai/auto-labels - Client-side label-deleted event in home-client, notes-tabs-view, label-management-dialog Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-27 00:09:31 +02:00
Sepehr Ramezani	e4d4e23dc7	chore: clean up repo for public release ... - Remove BMAD framework, IDE configs, dev screenshots, test files, internal docs, and backup files - Rename keep-notes/ to memento-note/ - Update all references from keep-notes to memento-note - Add Apache 2.0 license with Commons Clause (non-commercial restriction) - Add clean .gitignore and .env.docker.example	2026-04-20 22:48:06 +02:00