Arnaud 2beb23b360 feat: public shopping list links can allow editing ...

Owner opts in per-list via a new "Allow editing" toggle next to the
existing public-link switch. Anonymous writes are scoped to that one
list only — the link id is the sole credential, enforced in
getShoppingListAccess and the item routes (no session required there
now), with an IP rate limit on genuinely anonymous requests. Turning
off the public link also revokes editing.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

2026-07-13 12:53:52 +02:00

apps/web

feat: public shopping list links can allow editing

2026-07-13 12:53:52 +02:00

cron

feat: clear chat history manually, auto-expire old history after 90 days

2026-07-12 23:27:05 +02:00

packages/db

feat: public shopping list links can allow editing

2026-07-13 12:53:52 +02:00

traefik

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.dockerignore

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

.env.example

feat: cooking history/gallery, unit conversion, nutrition diary, pantry scan, digest cron, nutrition-targeted meal plans

2026-07-10 08:06:28 +02:00

.gitignore

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

.npmrc

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

CHANGELOG.md

feat: public shopping list links can allow editing

2026-07-13 12:53:52 +02:00

CLAUDE.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

compose.prod.yml

fix: photo thumbnails always used localhost:9000 in production

2026-07-12 13:53:15 +02:00

compose.yml

fix: MinIO CORS blocking browser uploads, changelog admin-only

2026-07-12 12:33:53 +02:00

DEPLOY.md

chore: move docker/ compose files and infra to repo root

2026-07-11 20:25:38 +02:00

Dockerfile

feat: clear chat history manually, auto-expire old history after 90 days

2026-07-12 23:27:05 +02:00

HANDOFF.md

docs: resolve recipe-quota semantics decision in HANDOFF.md

2026-07-10 08:25:35 +02:00

package.json

feat: public shopping list links can allow editing

2026-07-13 12:53:52 +02:00

pnpm-lock.yaml

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

pnpm-workspace.yaml

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

SECURITY_AUDIT.md

fix: close SSRF/rebinding, IDOR, and stale-session authz gaps found in audit

2026-07-12 19:05:20 +02:00

TODO.md

fix: resolve TODO.md security/perf/test-coverage backlog

2026-07-02 12:12:42 +02:00

tsconfig.base.json

chore: init pnpm monorepo workspace

2026-07-01 08:08:29 +02:00

S

Description

No description provided

12 MiB

Languages

TypeScript 99.2%

JavaScript 0.3%

CSS 0.2%

Dockerfile 0.2%