Files

T

genichin 2e1298a978 fix: enforce trade-write permission check on v1 ledger trade endpoint

Security Fix:
- Update v1_ledger.py to require trade_write permission instead of read
- Fix authentication dependency from require_read to require_trade_write
- Ensure trade operations cannot be performed with read-only service tokens

Test Coverage:
- Add test_v1_ledger_trade_requires_trade_write_permission() to verify permission boundary
- Confirm read-only tokens are rejected with 403 Forbidden status
- Validate repository methods are not called on permission failure

Documentation:
- Add new Discovery dcy-005 for production admin bootstrap and operator access
- Update docs/discovery/index.md with dcy-005 entry
- Update release rel-001 with additional verification notes and issue references

2026-05-11 14:17:27 +00:00

1.4 KiB

Raw Blame History

Discovery 전체 인덱스

Discovery 목록

ID	날짜	이슈명	문서	상태
dcy-001_20260430_real-db-migration-validation-and-operations-readiness	20260430	실DB 마이그레이션 검증 및 운영 준비	Discovery	confirmed
dcy-002_20260502_trex-basic-consumer-api-contract	20260502	trex-basic Consumer-Driven Contract 반영 — service-token runtime_id 발급 및 v1 API 엔드포인트 구현	Discovery	confirmed
dcy-003_20260502_portfolio-list-user-required	20260502	CLI `pfhub portfolio list` — `--user` 옵션 필수화 및 소유자 기반 조회 강제	Discovery	confirmed
dcy-004_20260511_portfolio-id-uuid-migration-and-user-scoped-name-resolution	20260511	portfolio_id UUID 교체 및 CLI 사용자 범위 기반 자산 식별 구조 전환	Discovery	confirmed
dcy-005_20260511_production-admin-bootstrap-and-operator-access	20260511	실배포 admin bootstrap 및 operator access 경로 정립	Discovery	draft

1.4 KiB Raw Blame History

Discovery 전체 인덱스

Discovery 목록

1.4 KiB

Raw Blame History