9 Commits (5d38faa2574a9cf8aaddc920bc4ed3dfccc44791)

Author	SHA1	Message	Date
Shlee	5d38faa257	Merge pull request #7166 from shleeable/fix/dangerzone-logout-clear-2fa-session ... Invalidate session on DangerZone forced logout to clear 2FA state	3 weeks ago
Your Name	58e8a4922d	Invalidate session on DangerZone forced logout to clear 2FA state	3 weeks ago
Your Name	742c1a6bc8	Require dangerzone sudo mode on curated register, shadow filter and page admin controllers	3 weeks ago
Your Name	68becbe2cc	lint	3 weeks ago
Your Name	7483a4b05b	Scope DangerZone OIDC sudo bypass to OIDC-registered users	3 weeks ago
Your Name	df1e771f93	Fix admin instance stats endpoint 404 on Postgres via strict is_admin check	3 weeks ago
Your Name	c0cde2f682	refactor: move 52 legacy models from App\ to App\Models\ ... Move all Eloquent models from the app/ root directory to app/Models/ for consistency with modern Laravel conventions. The project already had 54 models in App\Models; this migrates the remaining 52 legacy models. Changes: - Move 52 model files from app/ to app/Models/ - Update namespace declarations in each model - Update all ~1000 import references across the codebase - Add Relation::morphMap() in AppServiceProvider for backward compatibility with existing polymorphic database records - Add missing HasSnowflakePrimary imports for models that relied on same-namespace resolution	1 month ago
Your Name	9f81a5b425	test: un-skip Passport scope tests now that middleware is fixed ... All v1 admin route security tests now pass with proper assertions after the CheckForAnyScope → CheckTokenForAnyScope fix.	1 month ago
Your Name	579a581de8	test: add admin access and API scope security tests (360 total) ... Security/AdminAccessTest: verifies non-admin users are blocked from all admin web routes (dashboard, users, reports, settings, instances, curated onboarding) and admin API endpoints. Security/ApiScopeSecurityTest: verifies read-only tokens cannot write (follow, favourite, delete, mute, block), write tokens can read+write, cross-user access is denied, and private statuses are protected. BUG FOUND: CheckForAnyScope middleware (referenced in v1/admin routes) was removed in Passport 13. All /api/v1/admin/* routes throw BindingResolutionException. 6 tests skipped pending fix.	1 month ago