mirror of
https://github.com/we-promise/sure.git
synced 2026-05-30 15:59:02 +00:00
65d8129cf2
Addresses PR #2046 review (superagent P1, Codex P2, jjmata): - IDOR (P1): a statement could reference another plan's pension_source via a crafted pension_source_id, leaking the source name + points history. Goal::RetirementStatement now validates the source belongs to the same plan. - Adjustment cap was bypassable: the limit lived only on Goal::Retirement (parent validations don't run on child saves), so the CRUD path allowed an 11th. Goal::RetirementAdjustment now enforces it on create. - Bucket account selection (and the show-page candidate list) now filter through accounts.accessible_by(Current.user), so a private account shared away from the user can't be added via a crafted POST. - Comment clarifying the deliberate update_column in soft_replace!. Tests for the IDOR guard + the child-level cap.