root/sase.tr
1
0
Fork 0
Code Issues 5 Pull Requests 3 Actions 7 Packages Projects Releases Wiki Activity

feat(internal-admin): InternalTokenGuard for SP + roll-up of FN-411..FN-420 #22

Merged
root merged 41 commits from dev into main 2026-05-18 00:31:38 +03:00
Conversation 0 Commits 41 Files Changed 8 +752
root commented 2026-05-18 00:31:29 +03:00
Owner
Copy Link

Summary

  • Adds InternalTokenGuard for /internal/admin/* endpoints (foundation for Süper Panel mutation calls)
  • Rolls up all dev commits since last main merge (FN-411, FN-412, FN-415, FN-420, etc.)

Merged from dev. Backup of pre-reset local dev kept at tag local-fn290-338-backup (22 commits not pushed).

## Summary - Adds `InternalTokenGuard` for `/internal/admin/*` endpoints (foundation for Süper Panel mutation calls) - Rolls up all dev commits since last main merge (FN-411, FN-412, FN-415, FN-420, etc.) Merged from `dev`. Backup of pre-reset local dev kept at tag `local-fn290-338-backup` (22 commits not pushed).
root added 41 commits 2026-05-18 00:31:30 +03:00
fix(vehicles): make decoded vehicles readable by any authenticated user 497e03a231 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file 83f790d02f 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user d1c698da47 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file 6b83cfe77d 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user bd8e405843 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file a8a2f7f58e 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 4539ab82c8 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file e8510eedcf 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user fae930ac23 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file aa40fa55a5 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 5c6588efd7 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file ee38119031 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 358783663a 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file f91b55a185 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 64d99456a3 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file 2cbb86e5de 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 087f4b27cf 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
chore: remove playwright repro scratch file cff689d34f 
Fusion-Task-Id: FN-406
Fusion-Task-Lineage: 9616ae1a-9fa5-47cc-bf0d-3616eb4a0877
fix(vehicles): make decoded vehicles readable by any authenticated user 90e101875f 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file a3b7d3caff 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user a1efedb1d8 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 3774fe36e3 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 048d244883 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 823d51fc5a 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 5d0580e5c9 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 19fbc7c90f 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 557080619e 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 7bc92ced59 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 81dd9c23b6 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 036ec80d60 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 8d7fd42fb7 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file b8c9fa17ae 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 89232179b0 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file 36fbc08508 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
fix(vehicles): make decoded vehicles readable by any authenticated user 03beff1931 
Decoded vehicle data is shared across the platform — once any user
decodes a VIN, the vehicle, its categories, and its parts should be
visible to every authenticated user. The previous getById enforced a
user↔vehicle junction via inner join, returning 404 "Araç bulunamadı"
when a user tried to view a vehicle they hadn't decoded themselves.
This surfaced as "Veriler yüklenirken bir hata oluştu" on the category
detail page for any vehicle the current user wasn't linked to.

Drop the ownership filter from getById; the userVehicles junction is
now used only for per-user history listing and delete operations.
Verified with Playwright: GET /api/vehicles/.../categories/... was
returning 404 from the ownership check for non-owner users.

Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
chore: remove playwright repro scratch file d4baececee 
Fusion-Task-Id: FN-409
Fusion-Task-Lineage: eb556004-b8b9-4586-b1c3-c4577bf56036
feat(FN-411): Merge pull request 'dev' (#3) from dev into main (+16 more) 78ab45d512 
Commits merged:
- docs(FN-411): scoping output — spawned FN-415 (FN-367 mechanical verification) and FN-416 (FN-368 mechanical verification)
- Merge pull request #21 — feat(FN-403): parts panel manifest
- Merge pull request #20 — feat(FN-401): blocker note
- Merge pull request #19 — feat(FN-400): selector manifest
- Merge pull request #18 — feat(FN-399): PostHog cross-session funnel audit
- Merge pull request #17 — chore(payments): Stripe-only
- Merge pull request #16 — feat(FN-395): P1 candidate shortlist
- Merge pull request #15 — broaden leaf detection
- fix(categories): broaden leaf detection to all /extern/*/{vin,mdl}_items endpoints
- Merge pull request #14 — fix(pl24): Ford VIN flow
- Merge pull request 'dev' (#13) from dev into main
- Merge pull request 'feat(FN-367): add inline retry affordance after VIN decode failure (FN-367, gitea #11)' (#12) from dev into main
- Merge pull request 'dev' (#9) from dev into main
- Merge pull request 'dev' (#8) from dev into main
- Merge pull request 'docs(readme): spacing tweak — measure cache-enabled dev deploy speed' (#7) from dev into main
- Merge pull request 'docs(readme): add staging URL — gitea deploy flow smoke test' (#4) from dev into main
- Merge pull request 'dev' (#3) from dev into main

Files changed:
SCOPING-FN-411.md                             | 85 +++++++++++++++++++++++++++
 apps/api/src/catalog/catalog.service.ts       |  8 ++-
 apps/api/src/categories/categories.service.ts | 23 +++++---
 3 files changed, 107 insertions(+), 9 deletions(-)

Fusion-Task-Id: FN-411
feat(FN-412): merge fusion/fn-412 9b1fc48a54
feat(FN-415): add locator-stability + hit-target verification tests 5118c8e5e9 
Commits merged:
- feat(FN-415): add locator-stability + hit-target verification tests

Files changed:
apps/api/src/telemetry/__tests__/telemetry.spec.ts |  8 +++
 .../src/routes/__tests__/dashboard-search.test.tsx | 67 ++++++++++++++++++++++
 2 files changed, 75 insertions(+)

Fusion-Task-Id: FN-415

Fusion-Task-Lineage: 01e6f3d2-cd2e-4023-b538-ea54926b4f87
feat(FN-420): UX spec for VIN-decode error branches (subscription-wall, unknown-VIN) 4fc7d35c7a 
Commits merged:
- feat(FN-420): UX spec for VIN-decode error branches (subscription-wall, unknown-VIN)

Files changed:
.../FN-420-vin-decode-error-branches-ux-spec.md    | 280 +++++++++++++++++++++
 1 file changed, 280 insertions(+)

Fusion-Task-Id: FN-420
feat(internal-admin): add InternalTokenGuard for Süper Panel admin calls
Some checks failed
QA Gate (P0/P1) / Test affected app (pull_request) Has been cancelled
Details
d1c78f7b89 
Foundation guard for /internal/admin/* endpoints called from Süper Panel
(sp.semih.ai) over Coolify internal network. Verifies X-Internal-Token
header against INTERNAL_API_TOKEN env with constant-time compare.

Not yet wired to any endpoint — internal-admin module/controllers will
land in follow-up commits as panel-side mutation features ship.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
root merged commit 79a261612f into main 2026-05-18 00:31:38 +03:00
Sign in to join this conversation.
Reviewers
No Reviewers
Labels
Clear labels
bug
catalog
cro
frontend
insight-driven
pricing
sase-pilot
severity-P2
severity-P3
type-catalog_coverage_gap
type-ux_friction
ux
validation
vin-decode
web
No Label
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
root
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: root/sase.tr#22
Delete Branch "dev"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?