🔒 Security: Patch 6 CRITICAL/HIGH IDOR Vulnerabilities#32

Open

DerpcatMusic wants to merge 154 commits into

fix/secure-backend

Commits on Mar 7, 2026

Merge pull request #1 from DerpcatMusic/feature/rapyd-hardening-dashboard-ui
DerpcatMusic
authored

Commits on Mar 8, 2026

Merge branch 'feat/ui-hardening-integration'
Codex Agent
committed

Commits on Mar 9, 2026

Harden Google Calendar sync and add studio support
Codex Agent
committed

Commits on Mar 10, 2026

Fix Convex calendar runtime split
Codex Agent
committed
Fix Convex calendar runtime split
Codex Agent
committed
Merge latest master and finalize UI work
Codex Agent
committed
Harden Android release packaging retry
Codex Agent
committed
Restore animated calendar shell and tab bar background
Codex Agent
committed

Commits on Mar 11, 2026

Add marketplace payment order and payout eligibility workflow
Codex Agent
committed
Add marketplace finance backfill migration and gap report
Codex Agent
committed
Refactor migration helpers to use MutationCtx typings
Codex Agent
committed
Add instructor payout release preference scheduling
Codex Agent
committed

Commits on Mar 12, 2026

Add AI PR freshness guard workflow
Codex Agent
committed
Fix AI guard target branch
Codex Agent
committed
Add noncommercial source-available license
Codex Agent
committed
Reduce dashboard overload and complete i18n coverage
Codex Agent
committed
Deduplicate verified auth accounts by email
Codex Agent
committed
Fallback to browser Didit flow on Android (#4)

DerpcatMusic
and
Codex Agent
authored
Merge branch 'master' into auth-dedupe-fix
DerpcatMusic
authored
Mock i18n in jobs payments contract test
Codex Agent
committed
Fix payments contract test harnesses
Codex Agent
committed
Merge pull request #3 from DerpcatMusic/auth-dedupe-fix
DerpcatMusic
authored

Commits on Mar 13, 2026

ui: remove fake theme split and trim kit dead weight (#5)

DerpcatMusic
and
Codex Agent
authored
ui: cut home chrome and replace feed kit buttons (#6)

DerpcatMusic
and
Codex Agent
authored
UI Cut 03: flatten jobs feeds into list-first boards (#7)

DerpcatMusic
and
Codex Agent
authored
UI Cut 04: simplify auth and onboarding actions (#8)

DerpcatMusic
and
Codex Agent
authored
UI Cut 05: simplify shared actions and job sheet controls (#9)

DerpcatMusic
and
Codex Agent
authored
UI Cut 06: simplify profile action surfaces (#10)

DerpcatMusic
and
Codex Agent
authored
UI Cut 07: simplify profile route form actions (#11)

DerpcatMusic
and
Codex Agent
authored
UI Cut 08: simplify shared surface interactions (#12)

DerpcatMusic
and
Codex Agent
authored
UI Cut 09: simplify calendar action surfaces (#13)

DerpcatMusic
and
Codex Agent
authored
UI Cut 10: simplify map tab action surfaces (#14)

DerpcatMusic
and
Codex Agent
authored
UI Cut 11: simplify instructor payment interactions (#15)

DerpcatMusic
and
Codex Agent
authored
UI Cut 12: remove remaining app wrapper actions (#16)

DerpcatMusic
and
Codex Agent
authored
UI Cut 13: delete dead kit button primitives (#17)

DerpcatMusic
and
Codex Agent
authored
UI Cut 14: compress profile shells (#18)

DerpcatMusic
and
Codex Agent
authored
UI Cut 15: reduce web shell chrome (#19)

DerpcatMusic
and
Codex Agent
authored
UI Cut 16: simplify onboarding chrome (#20)

DerpcatMusic
and
Codex Agent
authored
UI Redesign 01: rebuild home hero surfaces (#21)

DerpcatMusic
and
Codex Agent
authored
UI Redesign 02: normalize instructor location (#22)

DerpcatMusic
and
Codex Agent
authored
UI Redesign 03: normalize calendar settings (#23)

DerpcatMusic
and
Codex Agent
authored
UI Redesign 04: normalize sports board (#24)

DerpcatMusic
and
Codex Agent
authored
UI Redesign 05: redesign sign-in screen (#25)

DerpcatMusic
and
Codex Agent
authored

Commits on Mar 15, 2026

feat: add custom TopSheet with expandable, sticky header, and vibrant purple
Codex Agent
committed
feat: add custom TopSheet with expandable, sticky header, and vibrant purple
Codex Agent
committed
fix: add missing neutral field to CustomSeed and remove invalid secondary reference
Codex Agent
committed
fix: add missing secondary field and add design context docs
Codex Agent
committed
fukloadashet
Codex Agent
committed
fix: add purple topInsetColor to all TopSheets
Codex Agent
committed
fix: ensure status bar background always visible with higher zIndex
Codex Agent
committed
fix: add safeTop to TopSheet and TopSheetSurface to prevent clipping
Codex Agent
committed
fix: restore original fallback colors and simplify safeTop handling
Codex Agent
committed
fix: remove backgroundColor override to restore purple default
Codex Agent
committed
fix: add safeTop to TopSheetSurface to prevent clipping under status bar
Codex Agent
committed
fix: wrap children in SafeAreaView for proper global inset handling
Codex Agent
committed
fix: revert to simple status bar overlay approach
Codex Agent
committed
fix: add guard for undefined gate in session gate
Codex Agent
committed

Commits on Mar 19, 2026

refactor ui system and onboarding chrome
Codex Agent
committed
animate onboarding step transition
Codex Agent
committed
refine onboarding reveal and modernize android switches
Codex Agent
committed
normalize remaining home and profile surfaces
Codex Agent
committed

Commits on Mar 20, 2026

stabilize ui system and split map tab modules
Codex Agent
committed
split tab modules and map controller helpers
Codex Agent
committed
extract top sheet helper modules
Codex Agent
committed
optimize sheet transitions and timeline rendering
Codex Agent
committed
trim sheet churn and map startup latency
Codex Agent
committed
split scroll sheet contexts
Codex Agent
committed
stabilize top sheet step state
Codex Agent
committed
move sheet snap resolution off js thread
Codex Agent
committed
keep expandable sheet content mounted
Codex Agent
committed
reduce native map remount churn
Codex Agent
committed
trim calendar timeline rebuild work
Codex Agent
committed
Merge branch 'feat/calendar-hardening'
Codex Agent
committed

Commits on Mar 21, 2026

Force Android Didit verification through browser flow
Codex Agent
committed
Merge purple mainline into master integration branch
Codex Agent
committed
Fix merge-introduced lint issues
Codex Agent
committed

Commits on Mar 22, 2026

feat: jobs marketplace, rapyd integration, contract tests, and cleanup
Codex Agent
committed
chore: add metro-cache, node-compile-cache, bunx to gitignore
Codex Agent
committed
chore: ignore .sisyphus agent artifacts
Codex Agent
committed
dsadasdas
Codex Agent
committed
feat(jobs): complete marketplace lifecycle and UI states
Codex Agent
committed
Merge pull request #28 from DerpcatMusic/feat/jobs-marketplace-final-wave
DerpcatMusic
authored
STABLE!!!!!!!!!
Codex Agent
committed
babayu
Codex Agent
committed

Commits on Mar 23, 2026

feat: design context, hardcoded audit, status-signal, payments cleanup
Codex Agent
committed
feat: start nativewind v5 migration and token cleanup
Codex Agent
committed
fix: add asset module declarations for nativewind branch
Codex Agent
committed
feat: nativewind v5 theme tokens, streamlined spacing/radius/colors in global.css
Codex Agent
committed
feat(map): show studio markers with logos on the instructor map
Codex Agent
committed
Add branch-aware studio infrastructure
Codex Agent
committed
Guard optional studio branch fields and fix TS inference
Codex Agent
committed
Stabilize studio branches rollout contracts
Codex Agent
committed
Migrate NativeWind styling system and harden calendar sync
Codex Agent
committed
Reduce layout animation overhead in feed surfaces
Codex Agent
committed
Use debugOptimized for Android dev-client installs
Codex Agent
committed
Optimize map tab startup and polish map UI
Codex Agent
committed
Reduce map tab JS cold-start work
Codex Agent
committed
Stabilize profile sheet registration and Android tab icons
Codex Agent
committed
Fix profile sheet transition path and map sheet spacing
Codex Agent
committed
Use native Android tab icons
Codex Agent
committed
Refine MapLibre basemap styling
Codex Agent
committed
Tighten map overlay spacing and collapsed sheet
Codex Agent
committed
feat(jobs,map): add archive sheet and studio markers
Codex Agent
committed
refine archive sheet and overlay spacing
Codex Agent
committed

Commits on Mar 24, 2026

Polish map markers and archive sheet chrome
Codex Agent
committed
Refine archive sheet details and floating controls
Codex Agent
committed
Adjust studio map pin visibility and shape
Codex Agent
committed
Stabilize studio map pin anchoring
Codex Agent
committed
Use view annotations for studio map pins
Codex Agent
committed
Refine studio pin tail geometry
Codex Agent
committed
Use SVG silhouette for studio map pins
Codex Agent
committed
Layer studio pins above zones and frame images
Codex Agent
committed
Mask studio photos inside map pins
Codex Agent
committed
Restore stable studio pin annotation anchoring
Codex Agent
committed
Refine studio pin opening and zone outlines
Codex Agent
committed
Polish studio pin layering and zoom scaling
Codex Agent
committed
Fix studio pin photo mask and zoom sizing
Codex Agent
committed
Fix studio map pins and retune marker accent
Codex Agent
committed
Stabilize studio pins on annotation path
Codex Agent
committed
Render studio pins with symbol layer
Codex Agent
committed
Split studio pin shell and photo symbol layers
Codex Agent
committed
feat(instructor-profile): structured address fields + simplified location UI
Codex Agent
committed
Scale studio map pins with clusters and shell asset
Codex Agent
committed
Simplify studio map pins and add tint support
Codex Agent
committed
Fix studio pin shell transparency
Codex Agent
committed
Refine map styling and pin thresholds
Codex Agent
committed
Normalize map fonts and neutralize basemap tones
Codex Agent
committed
Fix map glyph loading and dark road styling
Codex Agent
committed
Tune map road hierarchy and smoothness
Codex Agent
committed
Polish jobs header motion and loading screen
Codex Agent
committed
feat(home): instructor job carousel + studio review carousel with accept/reject
Codex Agent
committed
refactor(profile,layout): clean up profile index and top sheet
Codex Agent
committed
fix: silent catch in review carousel, loading-screen animation cleanup, kit-switch pressed color
Codex Agent
committed
Merge branch 'feat/nativewind-styling' into integration/nativewind-studio-check
Codex Agent
committed
Merge branch 't3code/studio-branches-system' into integration/nativewind-studio-check
Codex Agent
committed
fix: reconcile studio branch rollout with nativewind jobs ui
Codex Agent
committed
feat: wire studio branches into profile and job posting
Codex Agent
committed
fix: gate studio branch queries by resolved role
Codex Agent
committed
fix: skip wrong-role tab queries during startup
Codex Agent
committed
refactor: shift switching toward separate accounts
Codex Agent
committed
feat: add a reversible add-account handoff flow
Codex Agent
committed
fix: reroute resend test emails for dev account creation
Codex Agent
committed
refactor: simplify add-account into email handoff
Codex Agent
committed
chore: refresh convex generated api types
Codex Agent
committed
feat: unify native google auth with calendar oauth
Codex Agent
committed
fix: recover missing auth emails during google sign-in
Codex Agent
committed
fix: clean up auth linking and studio profile routing
Codex Agent
committed

Commits on Mar 25, 2026

chore: resolve merge conflicts from perf/improve-rendering stash
Codex Agent
committed
fix: improve account switching and job application controls
Codex Agent
committed
fix: align merged auth and profile ui with master
Codex Agent
committed
fix: align native map marker helpers
Codex Agent
committed
MID change
Codex Agent
committed
Feat: Redesign jobs cards
Codex Agent
committed

Commits on Mar 26, 2026

fix(security): patch 6 CRITICAL/HIGH IDOR vulnerabilities
Codex Agent
committed