Kevin L'Hereec 3cc189c534 fix(security): close IDOR on computers/components update & destroy ...

- Scope update/destroy queries by userId (Computers & Components), matching
  the pattern already used in index/show/edit
- Add missing auth.authenticate() calls on destroy actions
- handleComponents now requires userId and scopes component lookups to the
  current user, preventing cross-user component takeover
- handleComponents rejects attaching more than one component of the same
  'unique' type to a computer (new InvalidComponentSelectionException, 422)
- handlePictures scopes picture lookups by computerId
- destroy(Computer) now detaches its components (computerId = null) instead
  of losing them to cascade delete, and removes the computer's uploads dir
- Switch store/update actions to request.validateUsing() for consistency
- Fix relative redirects to absolute paths (/computers, /computers/:id)
- Untrack .env.production and add it to .gitignore (secrets must not be
  committed); local file kept on disk

2026-07-23 10:53:13 +02:00

..

handler.ts

Initial commit: PC Builder AdonisJS project

2026-06-28 10:41:51 +02:00

invalid_component_selection_exception.ts

fix(security): close IDOR on computers/components update & destroy

2026-07-23 10:53:13 +02:00