Commits

7bbbb74

fix(iter-20): replace SELECT * with explicit columns in TaskActivityRepository (task_activity_events, 27 columns)

2026-07-13T20:30:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

086c233

fix(iter-19): replace SELECT * with explicit columns in IntakeItemRepository (intake_items)

2026-07-13T20:25:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

db8ae45

fix(iter-18): replace 3 SELECT * and 2 SELECT es.* with explicit columns in EstimateSetRepository (estimate_sets table)

2026-07-13T20:22:13+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

a939689

fix(iter-17): replace 2 SELECT * with explicit columns in ChatController (teams, chat_messages)

2026-07-13T20:16:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

d87b58a

fix(iter-16): replace all 5 SELECT * with explicit columns in ChatService (chats table)

2026-07-13T20:13:16+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

017eab9

fix(iter-15): replace all 4 SELECT * with explicit columns in KnowledgePageVersionRepository (knowledge_page_versions x3, knowledge_pages x1)

2026-07-13T20:09:09+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

9e9ceeb

fix(iter-14): replace all 4 SELECT * with explicit columns in IdeaService (ideas, idea_answers, idea_analyses, idea_task_drafts)

2026-07-13T20:05:36+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

88199c0

fix(iter-13): replace all 8 SELECT * with explicit columns in KnowledgeRepository (knowledge_* tables: drafts, page_versions, templates, entity_links, page_properties)

2026-07-13T20:01:14+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

dcd9eb6

fix(iter-12): replace all SELECT * with explicit columns in IdeaController.php (33 queries across 10+ idea_* tables, column lists validated against actual CREATE TABLE schemas)

2026-07-13T19:55:18+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

b0074be

fix(iter-11): replace all SELECT * with explicit columns in ConfluenceMigrationRepository and JiraMigrationRepository

2026-07-13T19:40:05+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

75fe2b9

fix(iter-10): replace SELECT * with explicit columns in ChatService loadProjectRows and loadTeamRows

2026-07-13T17:04:55+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

416e950

fix(iter-9): replace SELECT * FROM users with explicit columns in seed_full_demo_entities.php

2026-07-13T16:57:03+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

67a65bb

fix(iter-8): remove baseline regeneration from CI (makes PHPStan useless) — only analyse

2026-07-13T16:54:11+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

f6d55b9

fix(iter-8): remove duplicate paths from phpstan CI command, add baseline regeneration step

2026-07-13T16:53:02+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

9f9e57d

feat(iter-8): add PHPStan level 1 static analysis with CI config; fix .gitignore to track CI files

2026-07-13T16:50:40+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

ec0a096

fix(iter-7): optimize orphan checker SQL — replace LEFT JOIN with NOT EXISTS for faster FK checks

2026-07-13T16:35:08+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

2291944

fix(iter-6): extract hardcoded email domain into constants across 3 seed scripts

2026-07-13T16:29:21+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

1696247

fix(iter-5): replace SELECT * with explicit column lists in CrmEntityConsolidationMigration

2026-07-13T16:23:51+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

181fc16

fix(iter-4): strip sensitive columns from ModuleDataExporter export; add MySQL driver support

2026-07-13T16:19:58+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

840fbc0

fix(iter-3): harden apiRequest() superglobal handling in ai_cron.php — backup/restore, payload key validation, header name sanitization

2026-07-13T16:15:42+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

9fd6041

fix(iter-2): add IP rate limiting and auth failure logging to cron.php

2026-07-13T16:11:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

50ce9ca

Restore PDO::MYSQL_ATTR_INIT_COMMAND define() safety guard; clean up remaining orphaned references in chats, ideas, and knowledge pages

2026-07-13T16:03:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

395f3f2

Fix PHP 8.5 PDO::MYSQL_ATTR_INIT_COMMAND deprecation; clean up 20 orphaned DB records and remove test/smoke data from demo database

2026-07-13T15:56:39+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

b5b9d2f

fix(iter-1): remove empty password default in seed scripts to prevent accidental root DB access

2026-07-13T15:32:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

4955ac5

Fix 3 MEDIUM audit findings: (7) rate limiting on worklog create; (9) remove is_root from MCP user tool schemas; (10) explicit select in ApiClientRepository::findKeyByPublicId to exclude key_hash

2026-07-13T15:11:53+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

8012cd8

Add explicit select() to UserManagementRepository::findByPublicId() and findById() to exclude password_hash/token/secret from SELECT * queries

2026-07-13T15:01:39+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

c212704

Add AGENTS.md rule: invalidate worklog cache when teams/users change to reflect hierarchy changes immediately in reports

2026-07-13T14:58:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

526a24a

Add AGENTS.md rule: never SELECT * from users table — always use explicit select() to avoid loading password_hash/token/secret into memory

2026-07-13T14:56:52+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

3a17c7b

Add AGENTS.md rule: financial data stripping for non-root users in API responses (cost_rate, bill_rate, cost_amount, bill_amount)

2026-07-13T14:51:43+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

f409641

Defense-in-depth: add explicit select([id,public_id,login,full_name]) to WorklogRepository::findUserByPublicId() to prevent SELECT * from loading password_hash, token and other sensitive fields into memory

2026-07-13T14:49:44+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

8d2c398

Security audit fixes: (1) CRITICAL: getVisibleUserIds returns [-1] sentinel for unresolvable non-root actors instead of [] which disabled the visibility filter; (2) HIGH: cacheUserId prefers public_id over id to prevent cache key collisions; (3) HIGH: strip cost_rate/bill_rate from earnings and taskSummary for non-root users in both WorklogController and McpController

2026-07-13T14:37:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

1ff8b02

Invalidate worklog cache when team or user hierarchy changes. TeamController (create/update/delete) and UserController (create/update/delete) now call invalidateCache("worklog") so that hierarchy changes (team manager, members, user tree) are immediately reflected in worklog reports without waiting for TTL expiry.

2026-07-13T14:28:41+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

62491a2

Improve matrix visibility: add id to activeUsers() select, filter $users by $visibleUserIds (integer IDs) instead of $userSetKeys (public_id strings). Now shows all visible users even with zero minutes logged.

2026-07-13T14:24:59+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

5cc2a00

Fix matrix data leak: filter users list by $userSetKeys for non-root actors. Prevents leaking all active user names/logins to non-root users.

2026-07-13T13:27:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

37f33b2

Fix taskSummary: return $rows instead of undefined $breakdown variable - caused user_breakdown to be null

2026-07-13T13:12:24+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

b6cd66f

Fix fatal error in findMemberIdsByManager: ->all() is not a QueryBuilder method, must be ->get(). Only affected non-root users; root bypassed via early return in getVisibleUserIds().

2026-07-13T12:59:33+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

ddc51c6

Fix: resolveActorId() helper resolves internal user ID from public_id when actor['id'] is missing. Fixes getVisibleUserIds() always returning [] for non-root users, create() using 0 as user_id, and canAccessTask() granting no access. Root cause: auth user object lacks 'id' field.

2026-07-13T12:55:44+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

2df3635

Fix taskSummary data leak: add visibility filter (visibleUserIds + actorIsRoot). Extend canAccessWorklog: managers can now GET/UPDATE/DELETE subordinates' and team members' worklogs via getVisibleUserIds()

2026-07-13T12:39:01+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

cdf0ce4

Fix critical regression bugs in WorklogService: earnings missing getVisibleUserIds(), matrix missing actorIsRoot, detail missing repository call. Remove unused actorId variables.

2026-07-13T12:29:24+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

e769ab9

Fix team knowledge materials styling: replace plain links with CRM-styled cards (icon + truncated title + arrow button)

2026-07-13T12:22:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

9cb73e3

Add team-based visibility for time-analytics: team managers see worklogs of their team members. Merges hierarchy (descendantIds) + team members (findMemberIdsByManager) with deduplication. Handles multiple teams, overlapping members.

2026-07-13T12:08:14+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

4a0671a

Implement hierarchical visibility for time-analytics: non-root users see worklogs of their subordinates (recursive through created_by_user_id). Root users see everything. Users without subordinates see only themselves.

2026-07-13T11:56:29+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

aaced52

Fix time-analytics: add local _t definitions to all three load functions (loadEarningsSummary, loadMatrixSummary were missed in first commit)

2026-07-13T11:33:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

d1ee3a9

Fix time-analytics page: add local _t definitions to loadTimeSummary, loadEarningsSummary, loadMatrixSummary — they're siblings of renderTimeAnalyticsPage so _t was undefined, causing ReferenceError before internal try blocks

2026-07-13T11:27:22+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

0e06afe

Fix QueryBuilder::orderBy regex to allow function calls — consistency with groupBy for future developers

2026-07-13T11:03:47+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

9c34259

Fix QueryBuilder::groupBy regex to allow function calls like DATE(w.logged_at) — was rejecting parentheses causing worklogs INTERNAL_ERROR

2026-07-13T10:56:21+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

edc2e5b

Fix worklogs summary/earnings/matrix GROUP BY for MySQL ONLY_FULL_GROUP_BY compliance

2026-07-13T10:52:33+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

106e25a

Cleanup: remove redundant gitignore patterns and untrack root-level .gitleaks.toml, .htaccess, VERSION files

2026-07-13T10:16:00+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

00617e9

Fix security: remove .env, DEPLOY_HASH, storage runtime files from git tracking; set MySQL as default database driver

2026-07-13T10:08:57+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>

ce85207

update

2026-07-13T09:52:28+00:00

Anton Barinov <55404783+Anton-Barinov@users.noreply.github.com>