2 Commits

Author	SHA1	Message	Date
Jakub Zych	2b04cda3ff	test: T-12.1-24 also marshals a user with last_seen and permissions ... The removal check for the json tag of users.last_seen showed that the subtest read the user API payloads only, which are built field by field. It now marshals the model as well, so a tag that would expose an admin column fails it.	2026-10-05 15:46:52 +02:00
Jakub Zych	ba43ad9c03	test: pin every mitigated Phase 12.1 threat of the admin screens in TestPhase121Threats ... - one subtest per threat id T-12.1-18 to T-12.1-25, 27 to 31, 34, 38 and 39 - T-12.1-28 revisits T-12-18: the groups field is the one writer of users_groups - T-12.1-38 and T-12.1-39 cover the takeover guard for privileged-group members	2026-10-05 14:30:31 +02:00