2 Commits

Author	SHA1	Message	Date
schalli	eebceb298d	fix(08): apply code review findings (CR-01, CR-02, WR-01–05, IN-01) ... - CR-01: fix SSRF bypass — isPrivateIpv6 now delegates ::ffff:<ipv4> to isPrivateIpv4, covering 172.16-31.x and 169.254.x ranges - CR-02: add ParseUUIDPipe to GET /favorites widgetId param + service guard so missing widgetId returns 400 instead of leaking all user favorites - WR-01: link-widget — replace raw 'link.error' key with t('link.error') (4 sites) - WR-02: favorites-widget — fix load-path error to use t('favorites.error') - WR-03: widget-catalog-modal — move aria-hidden from outer wrapper to backdrop - WR-04: calculator — remove duplicate M button (MR clone); MC/MR/M+/M−/MS remain - WR-05: schema — add FavoriteLink→WidgetInstance FK with onDelete:Cascade - IN-01: create-widget.dto.ts — update comment from four to eight supported types Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-01 11:03:16 +02:00
schalli	758d246e98	feat(08-03): FavoriteLink schema + FavoritesModule (CRUD + SSRF icon discovery) ... - Add FavoriteLink Prisma model (userId/tenantId/widgetId scope, iconUrl nullable, position) - IconDiscoveryService: port SSRF-protected icon discovery with redirect: 'manual', private IP / blocked-hostname checks, 4000ms timeout, 200k HTML cap (T-08-05) - FavoritesService: list/create/update/remove all scoped by userId (T-08-06 / Pitfall 3) - FavoritesController: GET /favorites?widgetId, POST, PATCH :id, DELETE :id - FavoritesModule registered in AppModule - tsc --noEmit passes for @tessera/api	2026-07-01 10:25:52 +02:00