fix: 53 verified bugs (auth, security/IDOR, scoring, brackets, websocket, nav, DB)#21

Open

itkujo wants to merge 26 commits into

feature/logto-integrationfrom

fix/bug-sweep

Commits on Jun 30, 2026

fix(infra): decouple WS lifetime from request timeout, fix rate-limiter refill, trim CORS origins

Daniel Velez
and
claude
committed
fix(db): use partial unique indexes so soft-deleted rows free their slug/email/name

Daniel Velez
and
claude
committed
fix(scoring-ui): disable keyboard scoring during game/match-over confirmation windows

Daniel Velez
and
claude
committed
fix(overlay-ui): per-run WS cancellation + predicate cache write

Daniel Velez
and
claude
committed
fix(league/standings): forfeits, capacity, overrides, queue order, season check

Daniel Velez
and
claude
committed
fix(auth): close Logto role-elevation gaps and revoke API keys for inactive users

Daniel Velez
and
claude
committed
fix(tournaments-ui): announcement cache invalidation, full-division bulk no-show, render-phase setState

Daniel Velez
and
claude
committed
fix(components): Bearer-auth uploads, by-id venue lookup, MapView XSS, date-only TZ

Daniel Velez
and
claude
committed
fix(navigation): route dashboard/search/division links through sport-scoped routes with correct ids

Daniel Velez
and
claude
committed
fix(handlers/security): close upload XSS, authz gaps, IDORs, and public pagination

Daniel Velez
and
claude
committed
fix(scoring/bracket): correct LB wiring, set-aware match-over, undo, lost-update race, series + event validation

Daniel Velez
and
claude
committed
merge B2-match-engine-bracket
Daniel Velez
committed
merge B6-sql-migrations
Daniel Velez
committed
merge B7-fe-scoring
Daniel Velez
committed
merge B8-fe-overlay
Daniel Velez
committed
merge B9-fe-tourn
Daniel Velez
committed
merge B10-fe-nav
Daniel Velez
committed
merge B11-fe-infra
Daniel Velez
committed
merge B5-infra-config
Daniel Velez
committed
merge B1-auth-logto
Daniel Velez
committed
merge B3-league-standings
Daniel Velez
committed
merge B4-handlers-security
Daniel Velez
committed

Commits on Jul 1, 2026

fix(scoring): per-run cancellation in useMatchWebSocket to kill reconnect race
Daniel Velez
committed
fix(authz): gate registration mutations + court update/delete ownership
Daniel Velez
committed
merge fix/residual-be (registration auth + court ownership)
Daniel Velez
committed
merge fix/residual-fe (useMatchWebSocket race)
Daniel Velez
committed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

fix: 53 verified bugs (auth, security/IDOR, scoring, brackets, websocket, nav, DB)#21

fix: 53 verified bugs (auth, security/IDOR, scoring, brackets, websocket, nav, DB)#21
itkujo wants to merge 26 commits into
feature/logto-integrationfrom
fix/bug-sweep

Commits on Jun 30, 2026

fix(infra): decouple WS lifetime from request timeout, fix rate-limiter refill, trim CORS origins

fix(db): use partial unique indexes so soft-deleted rows free their slug/email/name

fix(scoring-ui): disable keyboard scoring during game/match-over confirmation windows

fix(overlay-ui): per-run WS cancellation + predicate cache write

fix(league/standings): forfeits, capacity, overrides, queue order, season check

fix(auth): close Logto role-elevation gaps and revoke API keys for inactive users

fix(tournaments-ui): announcement cache invalidation, full-division bulk no-show, render-phase setState

fix(components): Bearer-auth uploads, by-id venue lookup, MapView XSS, date-only TZ

fix(navigation): route dashboard/search/division links through sport-scoped routes with correct ids

fix(handlers/security): close upload XSS, authz gaps, IDORs, and public pagination

fix(scoring/bracket): correct LB wiring, set-aware match-over, undo, lost-update race, series + event validation

merge B2-match-engine-bracket

merge B6-sql-migrations

merge B7-fe-scoring

merge B8-fe-overlay

merge B9-fe-tourn

merge B10-fe-nav

merge B11-fe-infra

merge B5-infra-config

merge B1-auth-logto

merge B3-league-standings

merge B4-handlers-security

Commits on Jul 1, 2026

fix(scoring): per-run cancellation in useMatchWebSocket to kill reconnect race

fix(authz): gate registration mutations + court update/delete ownership

merge fix/residual-be (registration auth + court ownership)

merge fix/residual-fe (useMatchWebSocket race)