IXG Platform
ixgadmin
b376c30300
A buyer account is a legitimate authenticated user, so IsAuthenticated alone lets it through. Sweep every ModelViewSet endpoint and assert a buyer gets 403 on write, and on read where the API is ops-only; assert ops is not forbidden; and keep an explicit allowlist for the chat, user, notification and subscription reads a buyer may still make. Also assert the escalation is closed: a buyer cannot PATCH their own role to admin, sees only themselves in the user API, and cannot reach another user's notification or subscription. |
||
|---|---|---|
| apps | ||
| docs | ||
| dsp_platform | ||
| nginx | ||
| scripts | ||
| templates | ||
| .dockerignore | ||
| .gitignore | ||
| create_agent.py | ||
| docker-compose.yml | ||
| Dockerfile | ||
| manage.py | ||
| requirements.txt | ||
| SESSION_CHECKPOINT.md | ||