zooqueenandHanzo Dev d3c1ee3dd3 the route guard sees our own hosts ...

The ban matched a bare `/api/` path and nothing else, so the same segment
reached through an absolute URL at one of our hosts read exactly like the
third-party URLs the rule deliberately permits, and passed —
`https://hanzo.id/api/login/...` and `https://api.hanzo.ai/api/v1/...` were
both clean to it. A second pattern names our hosts. gitlab.com/api/v4 and its
neighbours still pass, which is what the first pattern's non-word lookbehind is
for.

Co-authored-by: Hanzo Dev <[email protected]>

2026-08-24 21:47:56 -07:00

..

backup_test.go

one statement omits every nested store, so the next level is not forgotten

2026-08-13 17:09:48 -07:00

base_encrypted_test.go

an org's Base is encrypted with the org's own key

2026-08-11 12:42:00 -07:00

base_test.go

a username is what an account is filed under, not what a UI shows

2026-08-24 03:32:16 -07:00

base.go

an archive carries what it can quiesce, and a limiter counts what it admits

2026-08-13 14:59:41 -07:00

bases_test.go

a request reaches the Base of the org its token carries

2026-08-11 11:57:25 -07:00

compliance.go

a Base is addressed at /v1/bases, and Base stops running a second auth

2026-08-10 19:18:08 -07:00

cron_test.go

a hook is about a Base, and which Base arrives with the event

2026-08-13 19:56:46 -07:00

iam_proxy_test.go

Base does not authenticate a request it hands to IAM

2026-08-11 12:46:17 -07:00

iam_proxy.go

a proxy forwards the query it judged the credential on

2026-08-24 07:14:53 -07:00

iam_transport_test.go

address IAM by its nouns, and present a credential when doing it

2026-08-24 01:47:45 -07:00

iam_transport.go

address IAM by its nouns, and present a credential when doing it

2026-08-24 01:47:45 -07:00

iam.go

truncate clips runes, because the thing it clips is another service's bytes

2026-08-24 10:34:54 -07:00

idv_proxy.go

a proxy forwards the query it judged the credential on

2026-08-24 07:14:53 -07:00

kms_helpers.go

a Base is addressed at /v1/bases, and Base stops running a second auth

2026-08-10 19:18:08 -07:00

kms_test.go

one org owns one KMS path, and it composes or it does not

2026-08-24 03:40:03 -07:00

kms.go

one org owns one KMS path, and it composes or it does not

2026-08-24 03:40:03 -07:00

limit_test.go

an archive carries what it can quiesce, and a limiter counts what it admits

2026-08-13 14:59:41 -07:00

open_test.go

an archive carries what it can quiesce, and a limiter counts what it admits

2026-08-13 14:59:41 -07:00

org_collections.go

what a credential reaches is a property of the address

2026-08-11 16:08:25 -07:00

org_db_test.go

a request reaches the Base of the org its token carries

2026-08-11 11:57:25 -07:00

org_db.go

one statement omits every nested store, so the next level is not forgotten

2026-08-13 17:09:48 -07:00

org_dek_test.go

a Base is addressed at /v1/bases, and Base stops running a second auth

2026-08-10 19:18:08 -07:00

org_isolation.go

a Base is addressed at /v1/bases, and Base stops running a second auth

2026-08-10 19:18:08 -07:00

org_routes_test.go

the create exception names a route, not a family of routes

2026-08-24 03:43:14 -07:00

org_routes.go

what a publishable key reaches is a list, not what no rule covered

2026-08-24 06:02:17 -07:00

org_storage.go

the object store is ours, and the protocol is not named after a vendor

2026-08-14 09:11:45 -07:00

org_test.go

what a credential reaches is a property of the address

2026-08-11 16:08:25 -07:00

org.go

one org owns one KMS path, and it composes or it does not

2026-08-24 03:40:03 -07:00

plugin_test.go

the org a request names is the org it acts in

2026-08-11 12:45:45 -07:00

plugin.go

one reader answers what credential a request carries

2026-08-24 06:47:32 -07:00

publishable_test.go

a publishable key is refused wherever it sits, not where it was read

2026-08-24 07:23:11 -07:00

publishable.go

a publishable key is refused wherever it sits, not where it was read

2026-08-24 07:23:11 -07:00

pure_test.go

repair the tests I rebased onto deletions

2026-08-24 10:39:10 -07:00

realtime_test.go

realtime is a property of a Base, so every Base has it

2026-08-13 16:13:04 -07:00

route_prefix_test.go

the route guard sees our own hosts

2026-08-24 21:47:56 -07:00

stream_test.go

a stream is opened with a grant, because a stream cannot carry a header

2026-08-13 17:09:34 -07:00