Adam Moussa 401a561ae2 fix: re-validate shift holder on swap-accept (sh-security-review RIHB-1) ... reassign_if_held_by trusted 'no override row' as 'still the requester's', but a weekly-held shift also has no override row. An admin clear or weekly edit between swap-init and accept could move the shift to a third party with no override, letting the accept steal it (CWE-367, confirmed HIGH). Re-resolve the current holder at accept and abort if it is no longer the requester. Adds regression test + seeds the holder in existing accept tests.		2026-06-18 11:55:57 -04:00
..
conftest.py	Add pytest suite and wire it into CI (#85) (#86)	2026-06-01 19:07:08 -04:00
test_app_home.py	Add changelog-driven releases and App Home tab (#112)	2026-06-11 19:41:31 -04:00
test_handle_admin.py	Add pytest suite and wire it into CI (#85) (#86)	2026-06-01 19:07:08 -04:00
test_handle_drop.py	Lock shift drops within 24h of start (#84) (#88)	2026-06-01 19:32:40 -04:00
test_handle_holiday.py	Add holiday shifts with 3CX routing and late-pickup approval (#121)	2026-06-17 11:14:29 -04:00
test_handle_holiday_actions.py	Add holiday shifts with 3CX routing and late-pickup approval (#121)	2026-06-17 11:14:29 -04:00
test_handle_pick.py	Add pytest suite and wire it into CI (#85) (#86)	2026-06-01 19:07:08 -04:00
test_handle_register_rate.py	Fix auth and race-condition flaws in shift commands	2026-06-18 11:55:57 -04:00
test_handle_swap.py	Add swap-acceptance (verified-swap) flow (#87)	2026-06-01 19:22:55 -04:00
test_helpers.py	Lock shift drops within 24h of start (#84) (#88)	2026-06-01 19:32:40 -04:00
test_late_pickup.py	Add holiday shifts with 3CX routing and late-pickup approval (#121)	2026-06-17 11:14:29 -04:00
test_parse_date.py	Add pytest suite and wire it into CI (#85) (#86)	2026-06-01 19:07:08 -04:00
test_pickup_button.py	Add pytest suite and wire it into CI (#85) (#86)	2026-06-01 19:07:08 -04:00
test_swap_accept_decline.py	fix: re-validate shift holder on swap-accept (sh-security-review RIHB-1)	2026-06-18 11:55:57 -04:00