mirror of
https://github.com/pezkuwichain/pwap.git
synced 2026-08-12 20:51:37 +00:00
pezkuwichain
dc8533d707
The web app calls these three from TwoFactorSetup, TwoFactorVerify, NotificationBell, AdminPanel and EmailVerification, but this repo never defined them and they are not deployed to the self-hosted host the app points at. They were left behind on the cloud project when everything else moved, so every one of those calls has been hitting a function that is not there — two-factor auth, notifications and email verification have all been silently dead. Recovered from the deployed bundles on the cloud project and added here so the source is tracked and CI deploys them alongside the rest. The tables they need (two_factor_auth, notifications, activity_logs, profiles, email_verification_tokens) already exist on the self-hosted database, so this is a code move only. Registry on the host now lists all three under this project. NOTE: two-factor-auth and notifications-manager take userId straight from the request body while running with the service role, and neither checks the caller. That is how they run on the cloud project today, so this change does not make it worse, but it does mean anyone can disable another account's 2FA or read and delete their notifications. Fixing it properly needs an admin-role check alongside the JWT, because AdminPanel legitimately creates notifications for other users. Tracked separately rather than folded into a move.