rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61)

rename(phase 1): CapaKraken → Nexus across code, UI, docs, CI (#61) Co-authored-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com> Co-committed-by: Hartmut Nörenberg <hn@hartmut-noerenberg.com>
2026-05-21 16:28:40 +02:00
parent d9a7ec0338
commit b41c1d2501
943 changed files with 24548 additions and 16832 deletions
@@ -2,7 +2,7 @@

 ## Scope

-Static security review of the current CapaKraken codebase, focused on:
+Static security review of the current Nexus codebase, focused on:

 - authentication and authorization boundaries
 - sensitive read/write API routes
@@ -15,7 +15,7 @@ This review was done by parallel audit slices across API routes, auth/session co

 ## Executive Summary

-The main security problem is not one isolated bug. It is that CapaKraken currently treats "authenticated" as broadly equivalent to "allowed to see most planning data". That shows up in four places:
+The main security problem is not one isolated bug. It is that Nexus currently treats "authenticated" as broadly equivalent to "allowed to see most planning data". That shows up in four places:

 1. any signed-in user can currently create a vacation request for any `resourceId`
 2. many sensitive read routes are only protected by `protectedProcedure`
@@ -119,7 +119,7 @@ Any signed-in user connected to the timeline SSE endpoint can receive metadata a

 **Impact**

-CapaKraken parses spreadsheet data from files, including browser-side and import-related flows, with a library version that has known high-severity issues when reading crafted workbooks. Export-only flows are lower risk; read/parse flows are the real problem.
+Nexus parses spreadsheet data from files, including browser-side and import-related flows, with a library version that has known high-severity issues when reading crafted workbooks. Export-only flows are lower risk; read/parse flows are the real problem.

 **Recommended fix**

@@ -193,7 +193,7 @@ The caller is limited to their linked resource, which is good, but the endpoint

 **Evidence**

- `packages/db/src/reset-dispo-import.ts:24-31` defaults to `admin@capakraken.dev` / `admin123`
+- `packages/db/src/reset-dispo-import.ts:24-31` defaults to `admin@nexus.dev` / `admin123`
 - `packages/db/src/reset-dispo-import.ts:107-115` uses `prisma.$executeRawUnsafe(...)`

 **Impact**