Andrey Antukh 9b1e18a478 🐛 Validate binfile library relations against the package (#12862) ...

Ignore imported library relations that point outside the
package or self-link a file on the v3 import path. Delete
leftover cross-team and self relations from file_library_rel
and their matching file_library_sync rows with migration
0158, sync rows first.

Move the get-files-rels SQL to a var, without behaviour change.

Cover the write-side invariants with state-based tests:
tampered manifests, package containment, self links and the
migration cleanup.

AI-assisted-by: deepseek-v4.1-flash
AI-assisted-by: muse-spark-1.3-contributor
(cherry picked from commit 0b8a428d6b28c35601793f8d05570dae614a2fd5)

2026-11-09 08:46:19 +00:00

..

test_files

🐛 Keep camelCase svg attribute names when importing a penpot file (#11974)

2026-09-29 14:15:21 +02:00

auth_ldap_test.clj

🐛 Escape LDAP filter values and use directory email in retrieve-user (#11085)

2026-09-10 16:39:35 +02:00

auth_oidc_test.clj

🐛 Fix nitrate sso failure message (#11214)

2026-08-26 17:24:59 +02:00

binfile_svg_test.clj

🐛 Confine upload paths to temp dirs (#12772)

2026-11-03 12:07:52 +01:00

binfile_test.clj

🐛 Validate binfile library relations against the package (#12862)

2026-11-09 08:46:19 +00:00

bounce_handling_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

climit_test.clj

✨ Add tail buckets and update-file validation timings (#12409)

2026-10-19 13:01:35 +02:00

db_test.clj

⬆️ Update JVM, pnpm and node dependencies (#11404)

2026-09-01 12:01:35 +02:00

demo_test.clj

✨ Add several improvements for demo profile creation mechanism (#11257)

2026-09-01 08:46:28 +02:00

email_blacklist_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

email_sending_test.clj

♻️ Normalize organization naming across Penpot (#10977)

2026-07-31 12:04:10 +02:00

file_change_retention_test.clj

🐛 Keep file_change revisions on their own deletion schedule (#12419)

2026-10-19 14:00:13 +02:00

files_update_validation_timing_test.clj

✨ Add tail buckets and update-file validation timings (#12409)

2026-10-19 13:01:35 +02:00

health_test.clj

🎉 Add graceful instance drain via /readyz

2026-10-13 14:33:32 +02:00

helpers.clj

✨ Count the application logs as a metric, by logger and level (#12313)

2026-10-15 19:50:06 +02:00

http_assets_test.clj

🐛 Enforce ownership check on tempfile bucket access (#11270)

2026-08-26 13:05:36 +02:00

http_client_test.clj

🐛 Add ssrf check for nitrate sso and add timeouts to http client (#11576)

2026-09-09 11:23:53 +02:00

http_management_test.clj

🐛 Use constant-time comparison for management API shared key auth (#11534)

2026-09-14 13:26:16 +02:00

http_metrics_test.clj

✨ Make the CLIMIT queue visible with an accumulated gauge

2026-10-13 14:33:32 +02:00

http_middleware_security.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

http_middleware_test.clj

🐛 Use constant-time comparison for management API shared key auth (#11534)

2026-09-14 13:26:16 +02:00

loggers_metrics_test.clj

✨ Count the application logs as a metric, by logger and level (#12313)

2026-10-15 19:50:06 +02:00

loggers_webhooks_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

logical_deletion_test.clj

✨ Inherit subscriptions perks to Nitrate

2026-06-02 09:33:02 +02:00

media_remote_test.clj

🐛 Add ssrf check for nitrate sso and add timeouts to http client (#11576)

2026-09-09 11:23:53 +02:00

media_sanitize_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

media_test.clj

🐛 Sanitize SVG namespace-prefixed elements and attributes (#12073)

2026-10-05 11:56:59 +02:00

media_validation_test.clj

🐛 Confine upload paths to temp dirs (#12772)

2026-11-03 12:07:52 +01:00

metrics_test.clj

✨ Add tail buckets and update-file validation timings (#12409)

2026-10-19 13:01:35 +02:00

objects_gc_test.clj

🐛 Keep objects-gc running past a blocked chunk

2026-10-13 14:33:32 +02:00

passwords_test.clj

⬆️ Update JVM, pnpm and node dependencies (#11404)

2026-09-01 12:01:35 +02:00

redis_test.clj

🐛 Fix the key reported when a redis DEL times out

2026-10-20 15:33:37 +00:00

restore_storage_objects_test.clj

🐛 Unmark the storage objects that a restore brings back

2026-10-13 14:33:32 +02:00

rpc_access_tokens_test.clj

🐛 Prevent MCP tokens from being used as access tokens (#10962)

2026-07-31 13:19:45 +02:00

rpc_audit_test.clj

✨ Make the CLIMIT queue visible with an accumulated gauge

2026-10-13 14:33:32 +02:00

rpc_auth_test.clj

🐛 Fix session invalidation on logout to prevent token replay (#11317)

2026-08-21 12:55:24 +02:00

rpc_binfile_test.clj

🐛 Validate version parameter in import-binfile (#11107)

2026-08-18 15:13:49 +02:00

rpc_climit_test.clj

🐛 Keep concurrency limits from deadlocking on nested calls

2026-10-13 14:33:32 +02:00

rpc_commands_error_reports_test.clj

🐛 Attribute audit events to the caller, not the response (#11952)

2026-09-29 09:47:07 +02:00

rpc_comment_test.clj

🐛 Enforce share-link comment permissions and page scope (#11371)

2026-09-01 08:48:55 +02:00

rpc_cond_middleware_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_demo_test.clj

✨ Add expires-in TTL option to demo profile creation (#11574)

2026-09-14 13:24:38 +02:00

rpc_doc_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_feedback_test.clj

🐛 Add size limit and rate limiting to send-user-feedback (#10979) (#10990)

2026-08-05 17:35:59 +02:00

rpc_file_snapshot_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

rpc_file_test.clj

✨ Restrict optional RPC ids to user-provided UUIDs (#11777)

2026-09-22 09:45:50 +02:00

rpc_file_thumbnails_test.clj

🐛 Confine upload paths to temp dirs (#12772)

2026-11-03 12:07:52 +01:00

rpc_font_test.clj

✨ Add several improvements for demo profile creation mechanism (#11257)

2026-09-01 08:46:28 +02:00

rpc_management_nitrate_test.clj

🐛 Store audit initiator as plain string for shared-key callers (#11629)

2026-09-22 19:44:44 +02:00

rpc_management_test.clj

🐛 Validate content-type on management upload endpoints (#11026)

2026-08-17 12:13:56 +02:00

rpc_media_test.clj

✨ Restrict optional RPC ids to user-provided UUIDs (#11777)

2026-09-22 09:45:50 +02:00

rpc_nitrate_test.clj

🐛 Fix missing warning when moving a team (#11357)

2026-08-26 08:08:40 +02:00

rpc_organization_owner_permissions_test.clj

⚡ Fetch team organization in a single batch (#11140)

2026-08-10 13:43:27 +02:00

rpc_profile_test.clj

🐛 Attribute audit events to the caller, not the response (#11952)

2026-09-29 09:47:07 +02:00

rpc_project_test.clj

✨ Restrict optional RPC ids to user-provided UUIDs (#11777)

2026-09-22 09:45:50 +02:00

rpc_quotes_test.clj

🚑 Disable media storage quota check on upload

2026-10-19 15:22:10 +00:00

rpc_rlimit_test.clj

🐛 Normalize fractional rate-limit reset durations (#11254)

2026-08-17 15:27:06 +02:00

rpc_team_test.clj

🚑 Revoke file access when a member leaves the team (#12097)

2026-10-05 16:47:07 +02:00

rpc_viewer_test.clj

🐛 Filter share-link tokens in get-view-only-bundle response (#11286)

2026-09-01 08:46:59 +02:00

rpc_webhooks_test.clj

🐛 Restrict webhook creation/edit/delete to team members only (#11029)

2026-08-05 17:42:49 +02:00

scripts_decode_file_data_test.clj

✨ Add tail buckets and update-file validation timings (#12409)

2026-10-19 13:01:35 +02:00

shell_test.clj

🐛 Fix backend util shell tests

2026-07-09 19:34:15 +02:00

srepl_main_test.clj

♻️ Make cascade helpers stream rows and enqueue tasks

2026-10-13 14:33:32 +02:00

storage_gc_deleted_test.clj

⚡ Chunk storage-gc-deleted reads with a keyset cursor

2026-10-16 15:57:32 +02:00

storage_test.clj

✨ Add media-processor service for image and font processing (#10767)

2026-08-05 09:41:48 +02:00

storage_tmp_test.clj

🐛 Reserve S3 download path without creating the file

2026-10-05 17:16:47 +02:00

tasks_telemetry_test.clj

🐛 Emit the accept-organization-invitation audit event once

2026-09-29 22:40:03 +02:00

util_blob_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_objects_map_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_pointer_map_test.clj

📎 Update Kaleidos Copyright (#9929)

2026-05-29 11:24:58 +02:00

util_ssrf_test.clj

🐛 Block IPv6 transition addresses in SSRF guard (#11320)

2026-09-01 08:47:46 +02:00