fix(server): owner-trust sweep — close dashboard privilege escalation + 4 cross-tenant holes - #291

Open

sebbsssss wants to merge 8 commits into

fix/owner-trust-sweep

Commits on Jun 20, 2026

fix(server): close dashboard owner-gate privilege escalation

sebbsssss
and
claude
committed
a38cb06
fix(server): require proven wallet ownership on chat/topup/upload/encryption

sebbsssss
and
claude
committed
998534b
test(server): prove encryption revoke routes depend on requireOwnership

sebbsssss
and
claude
committed
e2b8449
test(server): regression for chat ?wallet= owner-trust fix

sebbsssss
and
claude
committed
53e172a
test(server): extend dashboard owner-gate regression to mutation routes

sebbsssss
and
claude
committed
b7c517e
test(server): pin topup owner-trust fix — forged ?wallet= cannot read victim billing

sebbsssss
and
claude
committed
a72f37f
test(server): forged-wallet regression for upload.routes owner-trust fix

sebbsssss
and
claude
committed
6752a37
test(server): owner-trust regression for memory-packs + wiki-packs (confirmed safe)

sebbsssss
and
claude
committed
0408293