5 Commits

Include renames

Author	SHA1	Message	Date
Hein	ca89cb8a73	fix(common): harden CORS, sort, raw-SQL WHERE and x-custom-sql-or ... Add a `hardening` config section (RESOLVESPEC_HARDENING_*) so each fix can be switched off to restore the previous behaviour: - cors_strict_origins: only reflect origins listed in cors.allowed_origins / server URLs, with credentials; `*` never sends credentials; fix shared-slice append of expose headers. - sort_strict: join aliases must match `alias.identifier` (empty alias no longer matches everything); sort expressions reject dangerous functions/catalogs; cql* columns must be identifier-safe. - sql_strict: client raw-SQL fragments must have balanced parens and quotes, no comments/`;`/`$$`, DML keywords, dangerous functions or system catalogs; a rejected fragment now fails closed ("(1=0)") instead of dropping the filter. Subqueries stay allowed unless sql_block_subqueries is set. - x-custom-sql-or is grouped together with the client's own conditions (new optional WhereGrouper, implemented for bun and gorm) so it can no longer OR past server-side filters.	2026-10-01 13:46:01 +02:00
Hein	1ce0ab1ab4	fix(validation): improve preload column validation logic	2026-05-21 20:18:01 +02:00
Hein	c12c045db1	feat(validation): ✨ Clear JoinAliases in FilterRequestOptions ... * Implemented logic to clear JoinAliases after filtering. * Added unit test to verify JoinAliases is nil post-filtering. * Ensured other fields are correctly filtered.	2026-01-15 14:43:11 +02:00
Hein	9351093e2a	Fixed order by. Added OrderExpr to database interface	2025-12-17 16:50:33 +02:00
Hein	f518a3c73c	Some validation and header decoding	2025-11-07 13:31:48 +02:00