tessera-ctl

Files

T

schalli 96161556db feat(17-02): delete protection and 20-feed cap for personal RSS feeds

- remove(id, {userId, isAdmin}) replaces remove(id): single conditional
  deleteMany (id AND (owned-by-caller OR admin-on-platform-feed)) — no
  TOCTOU window, ownership check lives in the DB condition. Deletes
  nothing -> NotFoundException (never Forbidden, no existence leak)
- createForUser rejects a caller's 21st personal feed with a clear
  German message (T-17-10); platform-wide feeds are not counted
- DELETE /rss-feeds/:feedId moves from @Roles(ADMIN,SUPER_ADMIN) to
  @UseModule('tender-radar') — ownership check does the gating now
- Tests use a Prisma double that actually evaluates the where condition
  (not a double that always "succeeds") for both deleteMany and count

- Files modified: apps/api/src/tenders/tender-rss-feed.service.ts, apps/api/src/tenders/tenders.controller.ts, apps/api/src/tenders/tender-rss-feed.service.spec.ts, apps/api/src/tenders/tenders.controller.spec.ts

2026-08-12 11:41:55 +02:00

prisma

feat(17-02): RSS feeds get an owner — platform-wide vs personal (D-02)

2026-08-12 11:37:56 +02:00

src

feat(17-02): delete protection and 20-feed cap for personal RSS feeds

2026-08-12 11:41:55 +02:00

Dockerfile

fix(api): create /app/user-files with nestjs ownership in Dockerfile

2026-06-30 08:44:21 +02:00

nest-cli.json

feat(01-01): NestJS API with health endpoint and Prisma schema