Fringg 641da949a9 fix: enforce promo group authorization on country/server selection ...

Previously, users could retain access to servers removed from their
promo group by re-submitting already-connected UUIDs in country
selection requests. The validation allowed any UUID present in
current connected_squads, bypassing promo group checks.

Now all selected server UUIDs must be in the user's allowed promo
group set. Unauthorized servers are rejected (cabinet/bot) or
filtered out (miniapp). Fixes authorization bypass across all 3
surfaces: cabinet, Telegram bot, and miniapp.

2026-03-17 22:30:57 +03:00

..

background

fix: complete datetime.utcnow() → datetime.now(UTC) migration

2026-02-17 04:45:40 +03:00

routes

fix: enforce promo group authorization on country/server selection

2026-03-17 22:30:57 +03:00

schemas

fix PR problems

2026-03-10 14:29:29 +05:00

__init__.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

app.py

fix: add X-CSRF-Token and X-Telegram-Init-Data to CORS allow_headers

2026-03-07 04:30:29 +03:00

dependencies.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

docs.py

chore: add uv package manager and ruff linter configuration

2026-01-24 17:45:27 +03:00

middleware.py

fix: use sync context manager for structlog bound_contextvars

2026-02-16 09:23:22 +03:00

server.py

refactor: complete structlog migration with contextvars, kwargs, and logging hardening

2026-02-16 09:18:12 +03:00