gh-christianlouis-docuelevate

gitea-admin/gh-christianlouis-docuelevate

Author SHA1 Message Date

Author	SHA1	Message	Date
copilot-swe-agent[bot]	11a49eb7fd	fix(migrations): restore accidentally deleted migration files 038-042 Migration files 038-042 were accidentally deleted by commit `d2217531` ("Sentinel: Fix SSRF in IMAP connections"), which broke container startup because existing databases had alembic_version stamped to 042_add_file_shares — a revision Alembic could no longer find. Restored from the parent of that commit: - 038_add_api_token_expires_at.py - 039_add_classification_rules.py - 040_add_automation_hooks.py - 041_add_document_comments_and_annotations.py - 042_add_file_shares.py Alembic now resolves a clean single-head chain (001→042). Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com> Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/f6165a49-2ec0-4158-9f1f-d508bb0489fe	2026-03-23 23:36:45 +00:00
google-labs-jules[bot]	d22175310a	🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections 🚨 Severity: HIGH 💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk. 🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services. 🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs. ✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit. Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>	2026-03-23 14:45:22 +00:00
copilot-swe-agent[bot]	1afd42bc57	fix: merge main (v0.161.0) into classification feature branch Resolve all 40 merge conflicts from merging origin/main into the classification feature branch. Key resolutions: - Auto-generated files (BUILD_DATE, VERSION, etc.): use main's version - API tokens: take main's version (token expiry, reactivation, hard-delete) - Auth: take main's Dropbox credential sharing + token expiry checking - Config: take main's social_auth_dropbox_use_global_credentials option - Files API: take main's improved duplicate handling + rate limiting - Models: keep ClassificationRuleModel alongside main's new models - Mobile: take main's mature implementation - Templates/translations: take main's versions (device deletion, reactivation keys) - Migration: renumber 038_add_classification_rules → 039_add_classification_rules to chain after main's 038_add_api_token_expires_at - Requirements: take main's version (adds segno QR library) - Tests: take main's more complete token tests, keep classification imports	2026-03-20 13:08:41 +00:00

copilot-swe-agent[bot]

11a49eb7fd

fix(migrations): restore accidentally deleted migration files 038-042

Migration files 038-042 were accidentally deleted by commit d2217531
("Sentinel: Fix SSRF in IMAP connections"), which broke container
startup because existing databases had alembic_version stamped to
042_add_file_shares — a revision Alembic could no longer find.

Restored from the parent of that commit:
- 038_add_api_token_expires_at.py
- 039_add_classification_rules.py
- 040_add_automation_hooks.py
- 041_add_document_comments_and_annotations.py
- 042_add_file_shares.py

Alembic now resolves a clean single-head chain (001→042).

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>
Agent-Logs-Url: https://github.com/christianlouis/DocuElevate/sessions/f6165a49-2ec0-4158-9f1f-d508bb0489fe

2026-03-23 23:36:45 +00:00

google-labs-jules[bot]

d22175310a

🛡️ Sentinel: [HIGH] Fix Server-Side Request Forgery in IMAP connections

🚨 Severity: HIGH
💡 Vulnerability: User-provided IMAP `host` in `_test_imap_connection` and `pull_inbox` was not validated against private IPs, creating an SSRF risk.
🎯 Impact: Attackers could abuse the endpoints to port-scan or interact with internal/private network services.
🔧 Fix: Integrated `is_private_ip` from `app.utils.network` to block connections resolving to private, loopback, link-local, or reserved IPs.
✅ Verification: Ran `test_imap_tasks.py` and `test_api_imap_accounts.py` successfully. Checked `ruff` output and diffs. Removed all scratch files from the commit.

Co-authored-by: christianlouis <361235+christianlouis@users.noreply.github.com>

2026-03-23 14:45:22 +00:00

copilot-swe-agent[bot]

1afd42bc57

fix: merge main (v0.161.0) into classification feature branch

Resolve all 40 merge conflicts from merging origin/main into the
classification feature branch. Key resolutions:

- Auto-generated files (BUILD_DATE, VERSION, etc.): use main's version
- API tokens: take main's version (token expiry, reactivation, hard-delete)
- Auth: take main's Dropbox credential sharing + token expiry checking
- Config: take main's social_auth_dropbox_use_global_credentials option
- Files API: take main's improved duplicate handling + rate limiting
- Models: keep ClassificationRuleModel alongside main's new models
- Mobile: take main's mature implementation
- Templates/translations: take main's versions (device deletion, reactivation keys)
- Migration: renumber 038_add_classification_rules → 039_add_classification_rules
  to chain after main's 038_add_api_token_expires_at
- Requirements: take main's version (adds segno QR library)
- Tests: take main's more complete token tests, keep classification imports

2026-03-20 13:08:41 +00:00

3 Commits