Danijel Martinek e2a4657471 fix(core-dsr): scope DSR operations to the caller's own subject ...

Non-admin callers may export/rectify/restrict/delete ONLY their own
subjectId; a mismatch is rejected with FORBIDDEN instead of being
honored verbatim (IDOR, audit finding A1). Cross-subject operations
require the admin role; cascade-hard stays admin-only on top.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-07-10 18:25:46 +02:00

..

src

fix(core-dsr): scope DSR operations to the caller's own subject

2026-07-10 18:25:46 +02:00

AGENTS.md

feat(core-dsr): scaffold package + GDPR DSR interfaces and types

2026-05-19 19:32:03 +00:00

eslint.config.js

feat(core-dsr): scaffold package + GDPR DSR interfaces and types

2026-05-19 19:32:03 +00:00

package.json

build: align @trpc/* on a single workspace version

2026-07-10 18:25:46 +02:00

tsconfig.json

feat(core-dsr): scaffold package + GDPR DSR interfaces and types

2026-05-19 19:32:03 +00:00

turbo.json

feat(core-dsr): scaffold package + GDPR DSR interfaces and types

2026-05-19 19:32:03 +00:00

vitest.config.ts

feat(core-dsr): scaffold package + GDPR DSR interfaces and types

2026-05-19 19:32:03 +00:00