[doomlab]

This is the combined result of #559, #560 and #561. Those were merged into each other's branches (they were stacked), not into dev, so none of their changes reached dev: only #557 and #558 did. This pull request brings them to dev in one go. It has no conflicts with dev, and I have not changed anything in it beyond what those three already contained.

What it contains (6 commits)

• Writes (Check on the server who may change what (writes) #559): ~50 write endpoints check on the server who may do them (project managers for project structure, assignees or managers for task logs and comments, owners for forms/folders/roles, only-yourself for user-named actions, invite email match); the one-off update migrations are admin-only on the server; updateProjectMember can no longer be used to self-promote.
• Reads (Check on the server who may read what, and lock down the REST routes (reads) #560): every read query narrows the browser's filter to the caller's own projects/forms/roles/invites/widgets, and other people's form responses and task chat are blanked wherever they are included; the unused getUser/getUsers (which returned password hashes) are deleted; send-email (an open mail relay), build-viewer and viewer-downloads (path traversal) now require sign-in and limit what they do.
• Notifications (Stop sendNotification being callable from the browser #561): sendNotification is an internal helper rather than an endpoint any signed-in user could call.

See those three pull requests for the full rules, tables and test notes.

Testing

274 tests pass, including table-driven tests that call each write endpoint as a non-member and as a plain contributor (all refused, nothing written), the read queries' database calls, the REST routes, and a guard that the notification endpoint stays gone. Typecheck (apart from the existing getJsonSchema.test.ts errors) and lint are clean.

Not yet checked in the running app. Please test as a project manager and as a contributor before merging (a checklist is in the earlier pull requests): dashboard and widgets, task board and task pages, milestones and Gantt, contributors and teams, tags, roles, forms and folders, inviting and accepting invites, profile and password emails, feedback, and building and downloading a project summary.

🤖 Generated with Claude Code