aeca9eae99
This Edge Function grants platform-admin power (list every user across every workspace, ban/unban accounts, trigger password resets for any user_id) but answered with Access-Control-Allow-Origin: '*', unlike the sibling caterium-create-employee function which already uses an origin allowlist. Authorization itself was never bypassable this way (the function still requires the caller's own Bearer token and re-checks sun_is_platform_admin() server-side), but a wildcard CORS response removes a real layer of defense-in-depth if a platform-admin token were ever exposed to another origin. Applies the same allowedOrigin()/corsHeaders() pattern already proven in caterium-create-employee, and extends edge-security-v1774.mjs (which already asserted the wildcard was gone from create-employee, but never checked this function) to cover both. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| app.spec.mjs | ||
| auth-security-v1774.mjs | ||
| branding-v1774.mjs | ||
| edge-security-v1774.mjs | ||
| employee-create-v1774.mjs | ||
| html-integrity-v1774.mjs | ||
| order-enhancements-v1775.mjs | ||
| playwright.config.mjs | ||
| release-check.mjs | ||
| static-security.mjs | ||