pastilhasandClaude Fable 5
6071ded175
TODO.md had reached 1050 lines and 72 open items across 28 sections, read mostly on a phone. It is now a directory: todo/<theme>/<item>.md, one card per file, with frontmatter carrying id, status, created date and order, and the prose body copied across verbatim. TODO.md becomes a generated index (bun run todo:index). Dates: where an item's prose stated one it is used; otherwise its old section's; otherwise 2026-08-20, floored at the day before the split rather than invented. date_source records which. Shaped for a two-way Kanban board, filed as todo/tooling — a card is a file, id is the identity, frontmatter is the machine's half and the body is the owner's. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
17 lines
745 B
Markdown
17 lines
745 B
Markdown
---
|
|
id: multi-user/cross-user-writes-in-the-notify-sidecar
|
|
title: "Cross-user writes in the notify sidecar"
|
|
theme: multi-user
|
|
status: done
|
|
created: 2026-08-07
|
|
date_source: stated
|
|
order: 19
|
|
---
|
|
|
|
**Cross-user writes in the notify sidecar** (fixed 2026-08-07, this session).
|
|
`DELETE /_officer/devices/:token` deleted by token with no user predicate, so any account with the
|
|
`notify` permission could deregister another's device; and `POST /_officer/notify` let a request
|
|
body's `userId` override the proxy-injected `X-Officer-User`, so the same account could push to
|
|
another's devices. `deletePushDevice` now takes an optional `userId` (the route passes it, the
|
|
APNs/FCM dead-token paths deliberately do not) and the header now wins over the body.
|