Xiangzhe 49a4ad31e4 fix(security): require auth for db-backups export/import under requireLogin=false ...

/api/db-backups/export and /import sat outside ALWAYS_PROTECTED_API_PATHS, so with
requireLogin=false an anonymous caller could stream the full SQLite database
(api_keys, provider credentials, OAuth tokens) or replace it wholesale. Adding
/api/db-backups to the Tier-2 allowlist requires a credential for all three
sibling routes, matching the trade-off /api/settings/database already makes.

Reported by @ntdat812 via GHSA-mghq-58h3-qcqj.

2026-08-21 13:05:05 -03:00

..

classify.test.ts

fix: Stabilize live dashboard WebSocket routing (#6335)

2026-07-09 23:19:32 -03:00

client-api-policy-fallback.test.ts

…

client-api-policy.test.ts

feat(api): accept x-goog-api-key header for client-facing auth (#7034) (#7236)

2026-07-17 10:48:14 -03:00

csrf.test.ts

…

discovery-routes-local-only.test.ts

…

ip-filter-enforcement-6131.test.ts

…

management-policy.test.ts

fix(mcp): preserve caller identity for internal REST hops (#9260)

2026-08-05 21:45:27 -03:00

pipeline.test.ts

feat: add Kiro API key authentication (#6587)

2026-07-09 22:49:06 -03:00

probe-9033-repro.test.ts

fix(db): add transient-error retry to corruption probe to prevent data loss under concurrent load (#9541)

2026-08-06 22:55:10 -03:00

proxy-contract.test.ts

…

public-origin.test.ts

…

public-policy.test.ts

…

route-guard-local-prefix.test.ts

…

route-guard-skills-collect.test.ts

…

route-guard-version-get-exemption.test.ts

…

route-guard-vnc-session-local-only.test.ts

feat(vnc-session): persistent noVNC browser login for web-cookie providers (#7892)

2026-07-22 10:46:04 -03:00

routeGuard.test.ts

fix(security): require auth for db-backups export/import under requireLogin=false

2026-08-21 13:05:05 -03:00

spawn-capable-prefixes-client-safe.test.ts

feat: add Video Bridge frame sampling (#10483)

2026-08-15 14:23:29 -03:00