Jakub Zych b6b7ac7534 fix: registration fills only an explicit allow-list and never takes the IP columns from the body ...

User.RegisterFillable lists what a registration body may set: name,
surname, email, password, preferred_locale and marketing_consent.
RegisterUser fills from it instead of Fillable, so organisation_id,
organisation_role, is_onboarded and must_change_password can no longer be
mass-assigned through POST /register, and created_ip_address and
last_ip_address come only from RegisterOptions.IP. Fillable is unchanged
for the admin form and trusted application code.

2026-10-22 03:03:18 +02:00

..

organisation

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

user

feat: manage a user's groups from the user form, privileged groups locked

2026-10-05 13:44:15 +02:00

usergroup

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

admin_models_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

api_token.go

feat: own shared user API tokens

2026-10-04 22:30:20 +02:00

frontend_permission.go

feat: frontend permissions and the merged-permission resolver

2026-10-05 13:21:51 +02:00

oauth_identity.go

fix(14.1): omit OAuth identity profile_data from JSON marshaling

2026-10-05 21:46:59 +02:00

organisation.go

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

permission_set_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

permission_set.go

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

registry.go

feat(05-01): restructure fonoteka plugins into Winter directories

2026-09-18 18:43:31 +02:00

slug_test.go

test: unit tests for the admin class functions, the models and the admin registration

2026-10-05 15:15:28 +02:00

slug.go

feat: Organisations admin screen with the avatar and the members manager

2026-10-05 13:58:54 +02:00

throttle.go

feat(07-02): add user session schema, throttle table, and jwt config

2026-09-22 13:53:16 +02:00

user_group.go

feat: User Groups admin screen with the users count and privileged codes protected

2026-10-05 13:52:26 +02:00

user.go

fix: registration fills only an explicit allow-list and never takes the IP columns from the body

2026-10-22 03:03:18 +02:00

users_group.go

feat: manage a user's groups from the user form, privileged groups locked

2026-10-05 13:44:15 +02:00