forked from mirror/crumbs-original
Frederic CabassutandClaude Opus 4.6
b3d40999c9
- Add userId check to /api/notes/reorder (was completely unprotected) - Scope syncNoteTags by userId to prevent cross-user tag pollution - Verify attachmentId belongs to noteId in attachment operations (IDOR fix) - Remove DEFAULT 0 from userId columns so missing userId fails loudly - Update test helpers and test data to provide required userId Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
684 lines
17 KiB
JSON
684 lines
17 KiB
JSON
{
|
|
"version": "6",
|
|
"dialect": "sqlite",
|
|
"id": "9eb400be-28ff-4b92-be35-1cd0b344f2e3",
|
|
"prevId": "682b02aa-a28d-4904-8996-cbc4d740f626",
|
|
"tables": {
|
|
"attachments": {
|
|
"name": "attachments",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"note_id": {
|
|
"name": "note_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"filename": {
|
|
"name": "filename",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"mime_type": {
|
|
"name": "mime_type",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"size": {
|
|
"name": "size",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"path": {
|
|
"name": "path",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"thumbnail_path": {
|
|
"name": "thumbnail_path",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"featured": {
|
|
"name": "featured",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {
|
|
"attachments_user_id_users_id_fk": {
|
|
"name": "attachments_user_id_users_id_fk",
|
|
"tableFrom": "attachments",
|
|
"tableTo": "users",
|
|
"columnsFrom": [
|
|
"user_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
},
|
|
"attachments_note_id_notes_id_fk": {
|
|
"name": "attachments_note_id_notes_id_fk",
|
|
"tableFrom": "attachments",
|
|
"tableTo": "notes",
|
|
"columnsFrom": [
|
|
"note_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"login_attempts": {
|
|
"name": "login_attempts",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "integer",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": true
|
|
},
|
|
"ip": {
|
|
"name": "ip",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"email": {
|
|
"name": "email",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"success": {
|
|
"name": "success",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"timestamp": {
|
|
"name": "timestamp",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"login_attempts_ip_timestamp_idx": {
|
|
"name": "login_attempts_ip_timestamp_idx",
|
|
"columns": [
|
|
"ip",
|
|
"timestamp"
|
|
],
|
|
"isUnique": false
|
|
}
|
|
},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"note_tags": {
|
|
"name": "note_tags",
|
|
"columns": {
|
|
"note_id": {
|
|
"name": "note_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"tag_id": {
|
|
"name": "tag_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"note_tags_note_id_idx": {
|
|
"name": "note_tags_note_id_idx",
|
|
"columns": [
|
|
"note_id"
|
|
],
|
|
"isUnique": false
|
|
},
|
|
"note_tags_tag_id_idx": {
|
|
"name": "note_tags_tag_id_idx",
|
|
"columns": [
|
|
"tag_id"
|
|
],
|
|
"isUnique": false
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"note_tags_note_id_notes_id_fk": {
|
|
"name": "note_tags_note_id_notes_id_fk",
|
|
"tableFrom": "note_tags",
|
|
"tableTo": "notes",
|
|
"columnsFrom": [
|
|
"note_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
},
|
|
"note_tags_tag_id_tags_id_fk": {
|
|
"name": "note_tags_tag_id_tags_id_fk",
|
|
"tableFrom": "note_tags",
|
|
"tableTo": "tags",
|
|
"columnsFrom": [
|
|
"tag_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "cascade",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"notes": {
|
|
"name": "notes",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"title": {
|
|
"name": "title",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "''"
|
|
},
|
|
"content": {
|
|
"name": "content",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "''"
|
|
},
|
|
"color": {
|
|
"name": "color",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "'default'"
|
|
},
|
|
"pinned": {
|
|
"name": "pinned",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": false
|
|
},
|
|
"archived": {
|
|
"name": "archived",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": false
|
|
},
|
|
"trashed": {
|
|
"name": "trashed",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": false
|
|
},
|
|
"trashed_at": {
|
|
"name": "trashed_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"checklist_mode": {
|
|
"name": "checklist_mode",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": false
|
|
},
|
|
"sort_order": {
|
|
"name": "sort_order",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": 0
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"updated_at": {
|
|
"name": "updated_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"version": {
|
|
"name": "version",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": 1
|
|
}
|
|
},
|
|
"indexes": {
|
|
"notes_user_id_idx": {
|
|
"name": "notes_user_id_idx",
|
|
"columns": [
|
|
"user_id"
|
|
],
|
|
"isUnique": false
|
|
},
|
|
"notes_trashed_archived_idx": {
|
|
"name": "notes_trashed_archived_idx",
|
|
"columns": [
|
|
"trashed",
|
|
"archived"
|
|
],
|
|
"isUnique": false
|
|
},
|
|
"notes_updated_at_idx": {
|
|
"name": "notes_updated_at_idx",
|
|
"columns": [
|
|
"updated_at"
|
|
],
|
|
"isUnique": false
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"notes_user_id_users_id_fk": {
|
|
"name": "notes_user_id_users_id_fk",
|
|
"tableFrom": "notes",
|
|
"tableTo": "users",
|
|
"columnsFrom": [
|
|
"user_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"sessions": {
|
|
"name": "sessions",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "text",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"expires_at": {
|
|
"name": "expires_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"user_agent": {
|
|
"name": "user_agent",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"ip": {
|
|
"name": "ip",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"last_used_at": {
|
|
"name": "last_used_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {
|
|
"sessions_user_id_users_id_fk": {
|
|
"name": "sessions_user_id_users_id_fk",
|
|
"tableFrom": "sessions",
|
|
"tableTo": "users",
|
|
"columnsFrom": [
|
|
"user_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"sync_log": {
|
|
"name": "sync_log",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "integer",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": true
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"note_id": {
|
|
"name": "note_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"operation": {
|
|
"name": "operation",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"timestamp": {
|
|
"name": "timestamp",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"client_id": {
|
|
"name": "client_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"sync_log_timestamp_idx": {
|
|
"name": "sync_log_timestamp_idx",
|
|
"columns": [
|
|
"timestamp"
|
|
],
|
|
"isUnique": false
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"sync_log_user_id_users_id_fk": {
|
|
"name": "sync_log_user_id_users_id_fk",
|
|
"tableFrom": "sync_log",
|
|
"tableTo": "users",
|
|
"columnsFrom": [
|
|
"user_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
},
|
|
"sync_log_note_id_notes_id_fk": {
|
|
"name": "sync_log_note_id_notes_id_fk",
|
|
"tableFrom": "sync_log",
|
|
"tableTo": "notes",
|
|
"columnsFrom": [
|
|
"note_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"tags": {
|
|
"name": "tags",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "integer",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": true
|
|
},
|
|
"user_id": {
|
|
"name": "user_id",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
},
|
|
"name": {
|
|
"name": "name",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {
|
|
"tags_name_user_unique": {
|
|
"name": "tags_name_user_unique",
|
|
"columns": [
|
|
"name",
|
|
"user_id"
|
|
],
|
|
"isUnique": true
|
|
}
|
|
},
|
|
"foreignKeys": {
|
|
"tags_user_id_users_id_fk": {
|
|
"name": "tags_user_id_users_id_fk",
|
|
"tableFrom": "tags",
|
|
"tableTo": "users",
|
|
"columnsFrom": [
|
|
"user_id"
|
|
],
|
|
"columnsTo": [
|
|
"id"
|
|
],
|
|
"onDelete": "no action",
|
|
"onUpdate": "no action"
|
|
}
|
|
},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
},
|
|
"users": {
|
|
"name": "users",
|
|
"columns": {
|
|
"id": {
|
|
"name": "id",
|
|
"type": "integer",
|
|
"primaryKey": true,
|
|
"notNull": true,
|
|
"autoincrement": true
|
|
},
|
|
"email": {
|
|
"name": "email",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "''"
|
|
},
|
|
"display_name": {
|
|
"name": "display_name",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "''"
|
|
},
|
|
"role": {
|
|
"name": "role",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "'user'"
|
|
},
|
|
"password_hash": {
|
|
"name": "password_hash",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"auth_provider": {
|
|
"name": "auth_provider",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false,
|
|
"default": "'password'"
|
|
},
|
|
"provider_id": {
|
|
"name": "provider_id",
|
|
"type": "text",
|
|
"primaryKey": false,
|
|
"notNull": false,
|
|
"autoincrement": false
|
|
},
|
|
"created_at": {
|
|
"name": "created_at",
|
|
"type": "integer",
|
|
"primaryKey": false,
|
|
"notNull": true,
|
|
"autoincrement": false
|
|
}
|
|
},
|
|
"indexes": {},
|
|
"foreignKeys": {},
|
|
"compositePrimaryKeys": {},
|
|
"uniqueConstraints": {},
|
|
"checkConstraints": {}
|
|
}
|
|
},
|
|
"views": {},
|
|
"enums": {},
|
|
"_meta": {
|
|
"schemas": {},
|
|
"tables": {},
|
|
"columns": {}
|
|
},
|
|
"internal": {
|
|
"indexes": {}
|
|
}
|
|
} |