MechaCat02 bb68e5e50a fix(secrets): composite keyset for group-secret admin list pagination ...

`list_meta` orders by `(name, environment_scope)` — a group secret name
can carry several env-scoped rows — but the cursor encoded only `name`
and paginated with `name > $cursor`. When a name's scopes straddled a
page boundary, the remaining scope rows were silently skipped from the
admin listing. Switch to a composite `(name, environment_scope)` keyset
(base64url of `name \x1f scope`) and a Postgres row-comparison predicate.
App secrets (single `*` scope per name) were unaffected; group secrets
with multi-scope names now page completely. Found in final branch review.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-24 22:13:00 +02:00

..

abandoned_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

admin_session_repo.rs

feat(manager-core): admin auth gate (Phase 3a)

2026-05-25 19:30:25 +02:00

admin_user_repo.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

admin_users_api.rs

fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change

2026-06-12 18:12:54 +02:00

api_key_repo.rs

style: cargo fmt across Phase 3.5 changes

2026-05-26 22:21:37 +02:00

api_keys_api.rs

fix(audit-2026-06-11/revocation-lag): evict PrincipalCache on credential change

2026-06-12 18:12:54 +02:00

api.rs

fix(apply): reject reserved module names in validate_bundle (parity)

2026-06-24 19:06:29 +02:00

app_bootstrap.rs

feat(enabled): scripts/routes enabled column + declarative data path

2026-06-23 19:36:40 +02:00

app_domain_repo.rs

feat(manager-core,orchestrator-core): multi-app scoping (Phase 3b)

2026-05-25 21:03:05 +02:00

app_members_api.rs

fix(api): make app_members POST and PATCH atomic

2026-05-27 22:00:04 +02:00

app_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

app_secrets_repo.rs

fix(audit-2026-06-11/H-D1): bind AES-GCM AAD on secrets + realtime signing key

2026-06-12 17:15:09 +02:00

app_user_invitation_repo.rs

feat(v1.1.8): invitations flow (migration 0030 + accept_invite returns session)

2026-06-06 12:10:32 +02:00

app_user_password_reset_repo.rs

chore(v1.1.8): clippy --all-targets clean (F2)

2026-06-06 18:03:51 +02:00

app_user_repo.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

app_user_role_repo.rs

fix(manager-core): F-P-001 batch app_user_roles lookups in users::list (N+1 → 1)

2026-06-07 20:09:31 +02:00

app_user_session_repo.rs

feat(v1.1.8): app_user_sessions table + repo with sliding TTL

2026-06-05 23:17:24 +02:00

app_user_verification_repo.rs

feat(v1.1.8): email verification flow (migration 0028 + SDK)

2026-06-06 12:04:09 +02:00

apply_api.rs

feat(project-tool): bound-plan staleness check (content fingerprint)

2026-06-22 21:48:27 +02:00

apply_service.rs

feat(secrets): group-owned, env-scoped secrets + inherited resolution

2026-06-24 21:48:33 +02:00

apps_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

auth_api.rs

fix(audit-2026-06-11/H-B1 follow-up): use last X-Forwarded-For hop for login rate-limit key

2026-06-12 18:37:34 +02:00

auth_bootstrap.rs

feat(manager-core,picloud): accept email on admin create + patch

2026-05-27 19:27:52 +02:00

auth_middleware.rs

docs(audit-2026-06-11/tier3): fix stale principal_cache field comment

2026-06-12 19:08:31 +02:00

auth.rs

feat(v1.1.8): app_users table + repo (migration 0026)

2026-06-05 23:15:47 +02:00

authz.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

config_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

config_resolver.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

cron_scheduler.rs

feat(v1.1.4): outbound HTTP SDK + cron triggers

2026-06-03 20:23:18 +02:00

dead_letter_repo.rs

feat(v1.1.1-triggers): triggers + outbox schema + repos

2026-06-01 21:46:45 +02:00

dead_letter_service.rs

feat(v1.1.1-dead-letters): service + Rhai SDK + admin endpoints

2026-06-01 22:17:25 +02:00

dead_letters_api.rs

fix(admin-api): accept slug or UUID on per-app endpoints

2026-06-09 18:34:42 +02:00

dev_email_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

dispatcher.rs

fix(dispatcher): close disabled-execution + cross-app gaps on the async paths

2026-06-24 19:06:21 +02:00

docs_filter.rs

feat(v1.1.2-docs): manager-core docs service + repo + query DSL parser

2026-06-02 19:55:14 +02:00

docs_repo.rs

feat(v1.1.2-docs): manager-core docs service + repo + query DSL parser

2026-06-02 19:55:14 +02:00

docs_service.rs

fix(stage-3): queue DL fan-out + emit-failure visibility

2026-06-10 21:22:15 +02:00

email_inbound_api.rs

style: cargo fmt across audit-2026-06-11 tier-3 changes

2026-06-12 18:38:28 +02:00

email_service.rs

style(email): wrap over-width lines (cargo fmt)

2026-06-24 19:06:52 +02:00

files_api.rs

style: cargo fmt across audit-2026-06-11 tier-3 changes

2026-06-12 18:38:28 +02:00

files_repo.rs

fix(audit-2026-06-11/F-FS-002): belt-and-suspenders collection validation on files read/delete

2026-06-12 18:26:46 +02:00

files_service.rs

fix(audit-2026-06-11/C-2): file download attachment + nosniff + CSP + MIME allowlist

2026-06-11 20:24:55 +02:00

files_sweep.rs

feat(v1.1.6): realtime channels + v1.1.5 follow-ups + version bumps

2026-06-04 20:18:50 +02:00

gc.rs

chore(v1.1.8): GC sweep for app-user sessions + tokens

2026-06-06 15:02:21 +02:00

group_members_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

group_repo.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

groups_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

http_service.rs

fix(stage-1): audit High-severity backend correctness + CI unblocker

2026-06-10 21:03:10 +02:00

invoke_service.rs

fix(enabled): close disabled-script execution on the async paths (review)

2026-06-23 21:59:50 +02:00

kv_api.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

kv_repo.rs

feat(v1.1.1-kv): migrations + KvService trait + Postgres impl

2026-06-01 21:29:59 +02:00

kv_service.rs

fix(stage-3): queue DL fan-out + emit-failure visibility

2026-06-10 21:22:15 +02:00

lib.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

log_sink.rs

feat: E2E #2 (Stash) gap remediation + S6 hardening

2026-06-13 15:01:04 +02:00

login_rate_limit.rs

fix(audit-2026-06-11/H-B1): login rate limit + Argon2 concurrency cap

2026-06-11 20:42:51 +02:00

migrations.rs

feat: versioning scheme — lockstep crates + four independent surfaces

2026-05-23 00:31:08 +02:00

module_source.rs

feat(v1.1.3-modules): shared types, migrations, engine + resolver scaffold

2026-06-02 22:04:21 +02:00

outbox_event_emitter.rs

feat(v1.1.5): files SDK + files:* triggers

2026-06-03 21:18:17 +02:00

outbox_repo.rs

feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types

2026-06-06 19:08:21 +02:00

principal_resolver.rs

feat(v1.1.1-dispatcher): dispatcher loop + retry + depth limit + outbox emitter

2026-06-01 22:01:42 +02:00

pubsub_repo.rs

feat(v1.1.5): pubsub::publish_durable SDK + pubsub:* triggers

2026-06-03 21:37:06 +02:00

pubsub_service.rs

fix(manager-core): F-S-001 cap kv/docs/pubsub/queue payload sizes (default 256 KB)

2026-06-07 20:00:36 +02:00

queue_repo.rs

fix(manager-core): F-P-006 cap queue::depth scans at 10k rows

2026-06-07 20:16:33 +02:00

queue_service.rs

fix(manager-core): F-S-001 cap kv/docs/pubsub/queue payload sizes (default 256 KB)

2026-06-07 20:00:36 +02:00

queues_api.rs

fix: post-review followups on slug-vs-UUID refactor

2026-06-09 20:03:10 +02:00

realtime_authority.rs

feat(sdk): users::email_available for anonymous registration pre-check (S1)

2026-06-12 20:43:18 +02:00

repo.rs

feat(enabled): scripts/routes enabled column + declarative data path

2026-06-23 19:36:40 +02:00

route_admin.rs

feat(enabled): runtime honoring for disabled scripts and routes

2026-06-23 19:42:45 +02:00

route_repo.rs

feat(enabled): scripts/routes enabled column + declarative data path

2026-06-23 19:36:40 +02:00

sandbox.rs

feat: per-script Rhai sandbox overrides with admin ceiling

2026-05-23 16:26:12 +02:00

scheduler.rs

chore: initial scaffold — workspace, docs, blueprint

2026-05-22 23:16:32 +02:00

secrets_api.rs

feat(secrets): group-secrets admin API, masked read, config/effective

2026-06-24 22:00:32 +02:00

secrets_repo.rs

fix(secrets): composite keyset for group-secret admin list pagination

2026-06-24 22:13:00 +02:00

secrets_service.rs

feat(secrets): group-owned, env-scoped secrets + inherited resolution

2026-06-24 21:48:33 +02:00

ssrf.rs

feat(v1.1.4): outbound HTTP SDK + cron triggers

2026-06-03 20:23:18 +02:00

topic_repo.rs

feat(v1.1.8): F3 realtime auth_mode = 'session' (migration 0033)

2026-06-06 15:00:47 +02:00

topics_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

trigger_config.rs

feat(v1.1.9): TriggerEvent::Queue + TriggerKind::Queue + types

2026-06-06 19:08:21 +02:00

trigger_repo.rs

fix(enabled): close disabled-script execution on the async paths (review)

2026-06-23 21:59:50 +02:00

triggers_api.rs

feat(groups): tree repos, hierarchy-aware RBAC, admin API

2026-06-24 19:59:00 +02:00

users_admin_api.rs

fix(manager-core): F-P-012 keyset cursor on app_user_repo::list (created_at, id) tiebreaker

2026-06-07 20:50:25 +02:00

users_service.rs

fix(review): harden the E2E-gap fixes after security/regression review

2026-06-13 09:59:24 +02:00

vars_api.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_repo.rs

feat(vars): admin CRUD API + pic vars CLI

2026-06-24 21:11:46 +02:00

vars_service.rs

feat(vars): VarsService + vars:: SDK + config capabilities

2026-06-24 20:59:23 +02:00