Skip to content

docs(changelog): cross-tenant security fixes + string-enum API contract#225

Open
iammukeshm wants to merge 1 commit into
mainfrom
docs/billing-tenant-security-audit
Open

docs(changelog): cross-tenant security fixes + string-enum API contract#225
iammukeshm wants to merge 1 commit into
mainfrom
docs/billing-tenant-security-audit

Conversation

@iammukeshm
Copy link
Copy Markdown
Member

Changelog entry (2026-05-30) for the billing/subscription/tenant security audit in fullstackhero/dotnet-starter-kit#1271.

Covers:

  • Cross-tenant read/mutation gating across billing handlers (invoices, subscriptions, usage, generate) and the RoleService privilege-escalation fix.
  • The contract change: the API now serializes enums as string names ("Active" not 0) via a global JsonStringEnumConverter; [Flags] enums stay numeric. Bundled apps updated; external clients should adjust.
  • Billing correctness (usage-invoice skip, renew term drift, provisioning admin-create check, idempotent void, pageSize cap, root-validity guard).
  • Admin/dashboard UX (permission-gating, invoice error state, expiry/validity surfacing, pagination).

🤖 Generated with Claude Code

…ct (2026-05-30)

Documents the billing/subscription/tenant security audit shipped in
fullstackhero/dotnet-starter-kit#1271: cross-tenant read/mutation gating,
the RoleService privilege-escalation fix, the global string-enum API
contract change, billing correctness fixes, and the admin/dashboard UX fixes.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
@cloudflare-workers-and-pages
Copy link
Copy Markdown

Deploying with  Cloudflare Workers  Cloudflare Workers

The latest updates on your project. Learn more about integrating Git with Workers.

Status Name Latest Commit Preview URL Updated (UTC)
✅ Deployment successful!
View logs
fullstackhero 323cc45 Commit Preview URL

Branch Preview URL
May 30 2026, 09:06 AM

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant