ffc4062eba
- Add path exemption in TenantValidationMiddleware for /api/clubs/me - Change authorization policy from RequireMember to RequireViewer - Fix KEYCLOAK_CLIENT_ID in docker-compose.yml (workclub-app not workclub-api) - Endpoint now works without X-Tenant-Id header as intended - Other endpoints still protected by tenant validation This fixes the chicken-and-egg problem where frontend needs to call /api/clubs/me to discover available clubs before selecting a tenant.
3 lines
403 B
JSON
3 lines
403 B
JSON
{"id":"83a4bad2-2ad4-4b0f-8950-2a8336c53d5b","title":"Test\"; DROP TABLE work_items; --","description":"SQL injection test","status":"Open","assigneeId":null,"createdById":"0fae5846-067b-4671-9eb9-d50d21d18dfe","clubId":"00000000-0000-0000-0000-000000000000","dueDate":"2026-03-20T23:59:59+00:00","createdAt":"2026-03-05T20:10:56.6975154+00:00","updatedAt":"2026-03-05T20:10:56.6975154+00:00"}
|
|
HTTP:201
|