Danijel Martinek 68a142fa6b fix(core-consent): validate migrated categories against an allow-list ...

The anonymous consent cookie is client-controlled, yet its categories
were granted verbatim at sign-up migration (audit finding A12; the
migration itself is already invoked in the auth sign-up use case and
bindAllProduction now threads a consentFactory so it runs in
production). Adds KNOWN_CONSENT_CATEGORIES + isKnownConsentCategory to
core-consent, filters in extractAnonymousConsent and
migrateAnonymousConsent, and mirrors the allow-list in the auth
sign-up cookie extractor.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 18:25:46 +02:00

..

src

fix(core-consent): validate migrated categories against an allow-list

2026-07-10 18:25:46 +02:00

tests

feat(auth): add signIn rate-limit backfill with dual ip/account budgets

2026-05-20 09:22:41 +00:00

AGENTS.md

docs(adr): rename ADR-012 — drop Lazar; update title + content + cross-refs

2026-05-13 10:07:37 +02:00

CHANGELOG.md

feat: hybrid versioning + automated CHANGELOG via release-please

2026-05-13 17:17:16 +02:00

eslint.config.js

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

package.json

build: align @trpc/* on a single workspace version

2026-07-10 18:25:46 +02:00

stryker.config.json

feat(coverage): pnpm mutate (Stryker) + L3 implementation

2026-05-13 16:31:30 +02:00

tsconfig.json

refactor: rename eslint-config + typescript-config to core-eslint + core-typescript

2026-05-05 10:37:07 +02:00

turbo.json

feat(auth): scaffold empty package with feature tag + path aliases

2026-05-05 00:37:13 +02:00

vitest.config.ts

feat(core-shared/conformance): manifest coverage schema + vitest helper

2026-05-13 13:51:13 +02:00