WaleedandClaude Opus 4.7 4cc00b2ef9 fix(security): enforce workspace scope on workflow middleware and validate shopify shop domain (#4535) ...

* fix(security): enforce workspace scope on workflow middleware and validate shopify shop domain

- validateWorkflowAccess now rejects workspace-scoped API keys whose
  workspaceId doesn't match the workflow's workspace, closing a boundary
  leak across /api/workflows/[id]/{log,paused,status} and
  /api/resume/[workflowId]/[executionId]/[contextId]
- shopify authorize route now validates the resolved shop domain against
  shopifyShopDomainSchema before proceeding
- adds middleware tests covering workspace/personal/session auth paths

* fix(shopify): disallow trailing hyphen in shop subdomain regex

* fix(shopify): align shop domain regex with shopify handle rules (3-60 lowercase, no edge hyphens)

* fix(security): widen shopify subdomain regex to allow up to 63 chars

Shopify and RFC 1123 allow labels up to 63 chars; the previous
{1,58} quantifier capped the subdomain at 60 chars and rejected
valid 61–63 char shops with a 400.

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 <noreply@anthropic.com>

2026-05-09 12:19:43 -07:00

..

docs

feat(knowledge): include sourceUrl in KB search results (#4533)

2026-05-08 23:08:52 -07:00

realtime

feat(search-replace): search & replace, cut, deploy modal ui flicker (#4507)

2026-05-07 20:34:53 -07:00

sim

fix(security): enforce workspace scope on workflow middleware and validate shopify shop domain (#4535)

2026-05-09 12:19:43 -07:00