chihlasm ff53ea7da9 fix: return 404 (not 403) for get_documentation cross-user access; add missing Task 6 tests ...

get_documentation was revealing session existence via 403. Added pre-check
query filtering by session_id AND user_id before calling the engine.

Also add cross-tenant isolation tests for steps, tags, step_categories,
and maintenance_schedules endpoints fixed in Task 6 (TDD was skipped).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-04-09 04:12:59 +00:00

..

__init__.py

…

accounts.py

feat(enterprise): add custom branding system — logo, accent color, company name

2026-03-19 20:35:35 +00:00

admin_audit.py

…

admin_categories.py

…

admin_dashboard.py

…

admin_feature_flags.py

…

admin_gallery.py

feat(gallery): add admin gallery curation endpoints and management page (Task 6)

2026-03-19 20:04:40 +00:00

admin_plan_limits.py

…

admin_settings.py

…

admin_survey.py

feat: Flow Transfer, Procedural Assist & UI Design System (#97)

2026-03-07 18:44:14 -05:00

admin.py

feat: super admin promote/demote endpoint + admin panel UI

2026-02-24 23:05:42 -05:00

ai_builder.py

feat: command palette, PSA ticket context, session-to-flow converter (#108)

2026-03-16 13:39:17 -04:00

ai_chat.py

feat: flow export/import + procedural Flow Assist (#96)

2026-03-07 15:51:37 -05:00

ai_fix.py

feat: add POST /ai/fix-tree endpoint for AI-powered validation fixes

2026-02-26 17:25:38 -05:00

ai_sessions.py

fix: return 404 (not 403) for get_documentation cross-user access; add missing Task 6 tests

2026-04-09 04:12:59 +00:00

ai_suggestions.py

feat: flow export/import + procedural Flow Assist (#96)

2026-03-07 15:51:37 -05:00

analytics.py

fix: scope analytics/flows/{tree_id} to requesting account

2026-04-09 03:53:57 +00:00

assistant_chat.py

refactor: remove dead assistant_chat system, consolidate image helpers

2026-03-24 05:28:06 +00:00

auth.py

fix: race condition hardening across auth, counters, and data fetching (#102)

2026-03-10 01:57:22 -04:00

beta_feedback.py

feat: beta feedback widget — frictionless in-session feedback

2026-03-23 13:12:06 +00:00

beta_signup.py

feat: add landing page with beta signup + raise KB node limit to 100

2026-03-12 00:23:29 -04:00

branding.py

feat: add team branding CRUD endpoints with tests

2026-03-17 00:12:00 -04:00

categories.py

fix: scope category tree_count to requesting account

2026-04-09 03:54:01 +00:00

copilot.py

feat: Slate & Ice Modern aesthetic redesign (#94)

2026-03-04 20:44:25 -05:00

feedback.py

feat: add POST /feedback endpoint with DB persistence and dual emails

2026-02-18 17:43:21 -05:00

flow_proposals.py

feat(notifications): add Phase 4 Slice 2 — multi-channel notification system

2026-03-19 12:37:54 +00:00

flowpilot_analytics.py

fix(analytics): fix 6 backend audit issues — domain matching, funnel counts, decimal casts, dead queries

2026-03-20 00:36:30 +00:00

folders.py

…

integrations.py

feat(ai-session): add Phase 2 PSA integration, escalation handoff, and session management

2026-03-19 01:30:05 +00:00

invite.py

…

kb_accelerator.py

feat: enable Markdown (.md) file upload in KB Accelerator

2026-03-11 23:29:51 -04:00

maintenance_schedules.py

fix: return 404 instead of 403 for cross-team tree access in maintenance schedules

2026-04-09 04:02:06 +00:00

notifications.py

feat(notifications): add Phase 4 Slice 2 — multi-channel notification system

2026-03-19 12:37:54 +00:00

onboarding.py

feat: add onboarding status and dismiss endpoints with tests

2026-03-17 00:05:28 -04:00

public_templates.py

feat(public-gallery): add public templates gallery API (Tasks 2 & 3)

2026-03-19 19:12:34 +00:00

ratings.py

feat: analytics dashboards & two-tier feedback system (#78)

2026-02-16 15:23:14 -05:00

script_builder.py

fix: close race conditions in script builder session and slug creation

2026-04-01 05:09:42 +00:00

scripts.py

fix: shared filter returns all when user has no team

2026-03-27 19:58:04 +00:00

session_branches.py

fix: add server_default to script_template columns, refresh fork_point after commit

2026-03-27 18:16:42 +00:00

session_handoffs.py

feat: add handoff API endpoints with queue and integration tests

2026-03-24 08:43:32 +00:00

session_resolutions.py

feat: add resolution output API endpoints

2026-03-24 08:47:09 +00:00

sessions.py

fix: return 404 instead of 403 for cross-tenant session access

2026-04-09 04:01:52 +00:00

shared.py

…

shares.py

fix: return 404 instead of 403 for cross-tenant share access

2026-04-09 04:02:04 +00:00

sidebar.py

fix(escalations): fall back to account_id when team_id is null

2026-03-21 05:04:47 +00:00

step_categories.py

fix: return 404 instead of 403 for cross-account step category access

2026-04-09 04:02:09 +00:00

steps.py

fix: return 404 instead of 403 for cross-tenant step access

2026-04-09 04:02:02 +00:00

supporting_data.py

feat: add supporting data CRUD endpoints with tests

2026-03-17 00:22:40 -04:00

survey.py

feat: AI chat conclusion + survey completion & management (#95)

2026-03-05 22:43:02 -05:00

tags.py

fix: return 404 instead of 403 for cross-account tag access

2026-04-09 04:02:08 +00:00

target_lists.py

fix: apply code review security and robustness fixes

2026-02-17 16:15:19 -05:00

tree_markdown.py

…

tree_transfer.py

feat: flow export/import + procedural Flow Assist (#96)

2026-03-07 15:51:37 -05:00

trees.py

fix: return 404 instead of 403 for cross-tenant tree access

2026-04-09 04:01:57 +00:00

uploads.py

fix: return 404 instead of 403 for cross-tenant upload access

2026-04-09 04:02:04 +00:00

webhooks.py

…