Hartmut 93a7fbaa4c security: fail-fast dev-bypass flag in production (#42) ...

Both auth.ts and trpc.ts now delegate the E2E_TEST_MODE-in-production
check to a single shared helper (packages/api/src/lib/runtime-security.ts).
trpc.ts used to only console.warn; it now throws at module load time,
matching the behaviour already enforced by assertSecureRuntimeEnv on the
auth side. A future refactor can no longer silently drop the guard on
either side.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-17 08:56:27 +02:00

..

api

security: fail-fast dev-bypass flag in production (#42)

2026-04-17 08:56:27 +02:00

application

test(application): extend ExcelJS read-workbook timeouts to 30s

2026-04-13 05:24:07 +02:00

db

test(db): clear env before each loadWorkspaceEnv test, not just after

2026-04-12 21:08:37 +02:00

engine

ci: exclude barrel/scaffold files from engine coverage and document runner DNS fix

2026-04-12 18:46:43 +02:00

shared

security: bound JSONB inputs + whitelist batchUpdateCustomFields keys (#48)

2026-04-17 08:44:11 +02:00

staffing

ci: add @vitest/coverage-v8 to workspace packages; set REDIS_URL on build

2026-04-12 18:38:21 +02:00

ui

fix(infra): apply missing migrations, fix Dockerfile.dev ui package reference

2026-04-09 20:29:21 +02:00