🐛 Fix SNS signature verification field sets per AWS spec

V1 and V2 use the same field sets (only hash algorithm differs).
The AWS documentation explicitly shows that SigningCertURL and
SignatureVersion are metadata fields, not part of the signed content.

Changes:
- Remove V2-specific field lists (SigningCertURL, SignatureVersion)
- Simplify build-string-to-sign to use unified field sets
- Fix resource leak in fetch-certificate (close stream on non-200)
- Fix missing Message field returning 200 instead of 400
- Stub fetch-certificate in network-dependent test
- Update V2 test to reflect correct field sets

Reference: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message-verify-message-signature.html

AI-assisted-by: qwen3.7-plus

backend/deps.edn

@@ -48,7 +48,6 @@
 
   buddy/buddy-hashers {:mvn/version "2.0.167"}
   buddy/buddy-sign {:mvn/version "3.6.1-359"}
-  org.passay/passay {:mvn/version "1.6.6"}
 
   com.github.ben-manes.caffeine/caffeine {:mvn/version "3.2.4"}
 
@@ -78,7 +77,7 @@
     org.clojure/data.csv {:mvn/version "1.1.1"}
     com.clojure-goes-fast/clj-async-profiler {:mvn/version "2.0.0-beta1"}
     mockery/mockery {:mvn/version "0.1.4"}}
-   :extra-paths ["test" "dev"]}
+    :extra-paths ["test" "test/resources" "dev"]}
 
   :build
   {:extra-deps

backend/resources/climit.edn

@@ -39,10 +39,4 @@
  {:permits 3}
 
  :create-file-snapshot/by-profile
- {:permits 1 :queue 2 :timeout 60000}
-
- :send-user-feedback/global
- {:permits 4}
-
- :send-user-feedback/by-profile
- {:permits 1 :queue 3}}
+ {:permits 1 :queue 2 :timeout 60000}}

backend/src/app/auth/oidc.clj

@@ -776,7 +776,7 @@
 
 (defn prepare-organization-sso-provider
   "Build an OIDC provider map dynamically from the Nitrate organization SSO config.
-   Uses OIDC discovery via :issuer when token/auth/user URIs are absent."
+  Uses OIDC discovery via :issuer when token/auth/user URIs are absent."
   [cfg {:keys [client-id client-secret issuer]}]
   (prepare-oidc-provider cfg
                          {:type             "oidc"
@@ -785,7 +785,8 @@
                           :base-uri         (some-> (non-blank-uri issuer)
                                                     (str/rtrim "/")
                                                     (str "/"))
-                          :scopes           default-oidc-scopes}))
+                          :scopes           default-oidc-scopes
+                          :skip-ssrf-check? true}))
 
 (defn build-organization-sso-auth-redirect-uri
   "Build the OIDC authorization redirect URI for an organization SSO config.

backend/src/app/auth/passwords.clj

@@ -1,53 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
-
-(ns app.auth.passwords
-  "Password strength validation using Passay library."
-  (:require
-   [app.common.exceptions :as ex])
-  (:import
-   [org.passay CharacterCharacteristicsRule CharacterRule EnglishCharacterData PasswordData]))
-
-(defonce ^:private passay-code->translation-key
-  {"INSUFFICIENT_LOWERCASE"   "errors.weak-password.insufficient-lowercase"
-   "INSUFFICIENT_UPPERCASE"   "errors.weak-password.insufficient-uppercase"
-   "INSUFFICIENT_DIGIT"       "errors.weak-password.insufficient-digits"
-   "INSUFFICIENT_SPECIAL"     "errors.weak-password.insufficient-special"})
-
-(defonce ^:private character-characteristics-rule
-  (doto (CharacterCharacteristicsRule.)
-    (.setRules [(CharacterRule. EnglishCharacterData/LowerCase 1)
-                (CharacterRule. EnglishCharacterData/UpperCase 1)
-                (CharacterRule. EnglishCharacterData/Digit 1)
-                (CharacterRule. EnglishCharacterData/Special 1)])
-    (.setNumberOfCharacteristics 4)))
-
-(defn validate-password
-  "Validates password strength.
-   Returns nil if valid, or raises exception if invalid.
-   Checks:
-   - Minimum length of 8 characters
-   - At least 1 lowercase letter
-   - At least 1 uppercase letter
-   - At least 1 digit
-   - At least 1 special character"
-  [password]
-  (when (< (count password) 8)
-    (ex/raise :type :validation
-              :code :weak-password
-              :hint "password must be at least 8 characters"
-              :details ["errors.weak-password.too-short"]))
-
-  (let [password-data (PasswordData. password)
-        char-result   (.validate character-characteristics-rule password-data)]
-    (when-not (.isValid char-result)
-      (ex/raise :type :validation
-                :code :weak-password
-                :hint "password must contain at least 1 lowercase letter, 1 uppercase letter, 1 digit, and 1 special character"
-                :details (->> (.getDetails char-result)
-                              (mapv #(.getErrorCode %))
-                              (mapv passay-code->translation-key)
-                              (filterv some?))))))

backend/src/app/binfile/common.clj

@@ -748,17 +748,9 @@
     (fmigr/upsert-migrations! conn file))
 
   (let [file (encode-file cfg file)]
-    (try
-      (db/insert! conn :file
-                  (file->params file)
-                  (assoc opts ::db/return-keys false))
-      (catch org.postgresql.util.PSQLException cause
-        (if (db/duplicate-key-error? cause)
-          (ex/raise :type :not-found
-                    :code :object-not-found
-                    :hint "file already exists"
-                    :cause cause)
-          (throw cause))))
+    (db/insert! conn :file
+                (file->params file)
+                (assoc opts ::db/return-keys false))
 
     (->> (file->file-data-params file)
          (fdata/upsert! cfg))

backend/src/app/binfile/v1.clj

@@ -174,10 +174,6 @@
     (assert-mark m :obj)
     (let [size (read-long! input)]
       (assert (pos? size) "incorrect header size found on reading header")
-      (when (> size bfc/max-object-size)
-        (ex/raise :type :validation
-                  :code :max-file-size-reached
-                  :hint (dm/str "unable to import object with size " size " bytes")))
       (let [buff (byte-array size)]
         (read-bytes! input buff)
         (fres/decode buff)))))

backend/src/app/http/assets.clj

@@ -7,7 +7,6 @@
 (ns app.http.assets
   "Assets related handlers."
   (:require
-   [app.binfile.common :as bfc]
    [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.time :as ct]
@@ -43,7 +42,7 @@
 
 (defn- get-file-media-object
   [pool id]
-  (db/get* pool :file-media-object {:id id} {::db/remove-deleted false}))
+  (db/get pool :file-media-object {:id id} {::db/remove-deleted false}))
 
 (defn- serve-object-from-s3
   [{:keys [::sto/storage ::signature-max-age ::cache-max-age] :as cfg} obj]
@@ -110,21 +109,13 @@
 (defn- generic-handler
   "A generic handler helper/common code for file-media based handlers."
   [{:keys [::sto/storage] :as cfg} request kf]
-  (let [pool       (::db/pool storage)
-        id         (get-id request)
-        mobj       (get-file-media-object pool id)]
-    (if (nil? mobj)
-      {::yres/status 404}
-      (let [file-id    (:file-id mobj)
-            profile-id (or (::session/profile-id request)
-                           (::actoken/profile-id request))
-            perms      (bfc/get-file-permissions pool profile-id file-id)]
-        (if-not (:can-read perms)
-          {::yres/status 404}
-          (let [sobj (sto/get-object storage (kf mobj))]
-            (if sobj
-              (serve-object cfg sobj)
-              {::yres/status 404})))))))
+  (let [pool (::db/pool storage)
+        id   (get-id request)
+        mobj (get-file-media-object pool id)
+        sobj (sto/get-object storage (kf mobj))]
+    (if sobj
+      (serve-object cfg sobj)
+      {::yres/status 404})))
 
 (defn file-objects-handler
   "Handler that serves storage objects by file media id."

backend/src/app/http/awsns.clj

@@ -21,13 +21,158 @@
    [cuerdas.core :as str]
    [integrant.core :as ig]
    [yetti.request :as yreq]
-   [yetti.response :as-alias yres]))
+   [yetti.response :as-alias yres])
+  (:import
+   java.net.URI
+   java.security.cert.CertificateFactory
+   java.security.Signature
+   java.util.Base64))
 
 (declare parse-json)
 (declare handle-request)
 (declare parse-notification)
 (declare process-report)
 
+(defn- valid-sns-url?
+  "Validates that a URL originates from an SNS endpoint.
+   Only accepts sns.<region>.amazonaws.com hosts.
+   See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html"
+  [url]
+  (when (string? url)
+    (try
+      (let [uri  (URI. url)
+            host (.getHost uri)]
+        (and (= "https" (.getScheme uri))
+             (boolean
+              (re-matches
+               #"(?i)sns\.[a-z0-9-]+\.amazonaws\.com"
+               host))))
+      (catch Exception _
+        false))))
+
+;; AWS SNS Signature Verification Field Sets
+;; See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message-verify-message-signature.html
+;;
+;; V1 and V2 use the SAME field sets (only the hash algorithm differs: SHA1 vs SHA256)
+;; The "Signature" field is NEVER part of the string-to-sign (it's the output, not input)
+;; "SigningCertURL" and "SignatureVersion" are metadata, not signed
+
+;; Notification: Message, MessageId, Subject (if present), Timestamp, TopicArn, Type
+(def ^:private notification-fields
+  ["Message" "MessageId" "Subject" "Timestamp" "TopicArn" "Type"])
+
+;; SubscriptionConfirmation: Message, MessageId, SubscribeURL, Timestamp, Token, TopicArn, Type
+(def ^:private subscription-fields
+  ["Message" "MessageId" "SubscribeURL" "Timestamp" "Token" "TopicArn" "Type"])
+
+(defn- build-string-to-sign
+  "Builds the string-to-sign for AWS SNS signature verification.
+   V1 and V2 use the same field sets (only hash algorithm differs: SHA1 vs SHA256).
+   See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message-verify-message-signature.html"
+  [body]
+  (let [msg-type (get body "Type")
+        fields   (if (= "SubscriptionConfirmation" msg-type)
+                   subscription-fields
+                   notification-fields)]
+    (->> fields
+         (filter #(contains? body %))
+         (map #(str % "\n" (get body %) "\n"))
+         (apply str))))
+
+(defn- fetch-certificate
+  "Fetches the X.509 certificate from the given URL.
+   Returns an InputStream that must be closed by the caller.
+   See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html"
+  [cfg cert-url]
+  (let [response (http/req cfg {:uri cert-url :method :get :timeout 10000}
+                           {:sync? true :response-type :input-stream})]
+    (when-not (= 200 (:status response))
+      (when-let [body (:body response)]
+        (.close ^java.io.Closeable body))
+      (l/wrn :hint "failed to fetch SNS signing certificate"
+             :action "sns-cert-fetch-failed"
+             :status (:status response)
+             :cert-url cert-url)
+      (ex/raise :type :internal :code :cert-fetch-failed))
+    (:body response)))
+
+(defn- verify-signature
+  "Verifies the RSA signature of the message.
+   See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html"
+  [cfg body]
+  (let [cert-url      (get body "SigningCertURL")
+        signature     (get body "Signature")
+        sig-version   (get body "SignatureVersion")
+        algorithm     (case sig-version
+                        "1" "SHA1withRSA"
+                        "2" "SHA256withRSA"
+                        nil)]
+    (when-not algorithm
+      (throw (ex-info "Unsupported SNS signature version"
+                      {:type :validation :version sig-version})))
+    (when (and cert-url signature)
+      (try
+        (let [string-sign (build-string-to-sign body)]
+          (with-open [cert-stream (fetch-certificate cfg cert-url)]
+            (let [cf   (CertificateFactory/getInstance "X.509")
+                  cert (.generateCertificate cf cert-stream)
+                  sig  (Signature/getInstance algorithm)]
+              (.initVerify sig (.getPublicKey cert))
+              (.update sig (.getBytes string-sign java.nio.charset.StandardCharsets/UTF_8))
+              (.verify sig (.decode (Base64/getDecoder) signature)))))
+        (catch clojure.lang.ExceptionInfo e
+          (let [data (ex-data e)]
+            (if (= :validation (:type data))
+              (throw e)
+              (do
+                (l/wrn :hint "SNS signature verification exception"
+                       :action "sns-signature-verification-exception"
+                       :cause e)
+                false))))
+        (catch Exception e
+          (l/wrn :hint "SNS signature verification exception"
+                 :action "sns-signature-verification-exception"
+                 :cause e)
+          false)))))
+
+(defn- verify-sns-message!
+  "Verifies the AWS SNS message signature and URL validity.
+   Throws if verification fails.
+   See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html"
+  [cfg body]
+  (let [cert-url    (get body "SigningCertURL")
+        subscribe-url (get body "SubscribeURL")
+        mtype       (get body "Type")]
+
+    (when-not (valid-sns-url? cert-url)
+      (l/wrn :hint "SNS certificate URL not from amazonaws.com"
+             :action "sns-invalid-cert-url"
+             :message-type mtype
+             :signing-cert-url cert-url)
+      (ex/raise :type :validation
+                :code :invalid-signing-cert-url
+                :hint "SigningCertURL must be from amazonaws.com"))
+
+    (when (and (= mtype "SubscriptionConfirmation")
+               (not (valid-sns-url? subscribe-url)))
+      (l/wrn :hint "SNS subscribe URL not from amazonaws.com"
+             :action "sns-invalid-subscribe-url"
+             :message-type mtype
+             :subscribe-url subscribe-url)
+      (ex/raise :type :validation
+                :code :invalid-subscribe-url
+                :hint "SubscribeURL must be from amazonaws.com"))
+
+    (when-not (verify-signature cfg body)
+      (l/wrn :hint "SNS signature verification failed"
+             :action "sns-signature-verification-failed"
+             :message-type mtype
+             :topic-arn (get body "TopicArn")
+             :signing-cert-url cert-url)
+      (ex/raise :type :authentication
+                :code :invalid-signature
+                :hint "SNS signature verification failed"))))
+
 (defmethod ig/assert-key ::routes
   [_ params]
   (assert (http/client? (::http/client params)) "expect a valid http client")
@@ -37,9 +182,9 @@
 (defmethod ig/init-key ::routes
   [_ cfg]
   (letfn [(handler [request]
-            (let [data (-> request yreq/body slurp)]
-              (handle-request cfg data)
-              {::yres/status 200}))]
+            (let [data (-> request yreq/body slurp)
+                  result (handle-request cfg data)]
+              {::yres/status (or (:status result) 200)}))]
     ["/sns" {:handler handler
              :allowed-methods #{:post}}]))
 
@@ -48,25 +193,52 @@
   (try
     (let [body  (parse-json data)
           mtype (get body "Type")]
+
+      (when body
+        (verify-sns-message! cfg body))
+
       (cond
         (= mtype "SubscriptionConfirmation")
         (let [surl   (get body "SubscribeURL")
               stopic (get body "TopicArn")]
           (l/info :action "subscription received" :topic stopic :url surl)
-          (http/req cfg {:uri surl :method :post :timeout 10000} {:sync? true}))
+          (http/req cfg {:uri surl :method :post :timeout 10000} {:sync? true})
+          {:status 200})
 
         (= mtype "Notification")
-        (when-let [message (parse-json (get body "Message"))]
-          (let [notification (parse-notification cfg message)]
-            (process-report cfg notification)))
+        (if-let [message (parse-json (get body "Message"))]
+          (do
+            (let [notification (parse-notification cfg message)]
+              (process-report cfg notification))
+            {:status 200})
+          (do
+            (l/wrn :hint "notification with missing or unparseable Message field"
+                   :action "sns-missing-message")
+            {:status 400}))
 
         :else
-        (l/warn :hint "unexpected data received"
-                :report (pr-str body))))
+        (do
+          (l/warn :hint "unexpected data received"
+                  :report (pr-str body))
+          {:status 400})))
+
+    (catch clojure.lang.ExceptionInfo e
+      (let [data (ex-data e)]
+        (if (#{:validation :authentication} (:type data))
+          (do
+            (l/wrn :hint "SNS message validation failed"
+                   :action "sns-validation-failed"
+                   :code (:code data))
+            {:status 400})
+          (do
+            (l/error :hint "unexpected exception on awsns"
+                     :cause e)
+            {:status 500}))))
 
     (catch Throwable cause
       (l/error :hint "unexpected exception on awsns"
-               :cause cause))))
+               :cause cause)
+      {:status 500})))
 
 (defn- parse-bounce
   [data]

backend/src/app/media/local.clj

@@ -7,22 +7,30 @@
 (ns app.media.local
   "Local media processing via ImageMagick and FontForge shell commands."
   (:require
+   [app.common.data :as d]
+   [app.common.data.macros :as dm]
    [app.common.exceptions :as ex]
    [app.common.logging :as l]
    [app.common.media :as cm]
    [app.common.schema :as sm]
    [app.common.time :as ct]
    [app.config :as cf]
-   [app.media.svg :as svg]
    [app.media.validation :as validation]
    [app.storage.tmp :as tmp]
    [app.util.shell :as shell]
    [buddy.core.bytes :as bb]
    [buddy.core.codecs :as bc]
    [clojure.string]
+   [clojure.xml :as xml]
    [cuerdas.core :as str]
    [datoteka.fs :as fs]
-   [datoteka.io :as io]))
+   [datoteka.io :as io])
+  (:import
+   clojure.lang.XMLHandler
+   java.io.InputStream
+   javax.xml.parsers.SAXParserFactory
+   javax.xml.XMLConstants
+   org.apache.commons.io.IOUtils))
 
 (defmulti process (fn [_system params] (:cmd params)))
 
@@ -32,6 +40,30 @@
             :code :not-implemented
             :hint (str/fmt "No impl found for local process cmd: %s" cmd)))
 
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+;; SVG PARSING
+;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
+
+(defn- secure-parser-factory
+  [^InputStream input ^XMLHandler handler]
+  (.. (doto (SAXParserFactory/newInstance)
+        (.setFeature XMLConstants/FEATURE_SECURE_PROCESSING true)
+        (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" true))
+      (newSAXParser)
+      (parse input handler)))
+
+(defn- strip-doctype
+  [data]
+  (cond-> data
+    (str/includes? data "<!DOCTYPE")
+    (str/replace #"<\!DOCTYPE[^>]*>" "")))
+
+(defn parse-svg
+  [text]
+  (let [text (strip-doctype text)]
+    (dm/with-open [istream (IOUtils/toInputStream ^String text "UTF-8")]
+      (xml/parse istream secure-parser-factory))))
+
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; IMAGE THUMBNAILS
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
@@ -135,6 +167,34 @@
                                            "-extent" (str width "x" height)
                                            "-quality" (str quality)]))))
 
+(defn get-basic-info-from-svg
+  [{:keys [tag attrs] :as data}]
+  (when (not= tag :svg)
+    (ex/raise :type :validation
+              :code :unable-to-parse-svg
+              :hint "uploaded svg has invalid content"))
+  (reduce (fn [default f]
+            (if-let [res (f attrs)]
+              (reduced res)
+              default))
+          {:width 100 :height 100}
+          [(fn parse-width-and-height
+             [{:keys [width height]}]
+             (when (and (string? width)
+                        (string? height))
+               (let [width  (d/parse-double width)
+                     height (d/parse-double height)]
+                 (when (and width height)
+                   {:width (int width)
+                    :height (int height)}))))
+           (fn parse-viewbox
+             [{:keys [viewBox]}]
+             (let [[x y width height] (->> (str/split viewBox #"\s+" 4)
+                                           (map d/parse-double))]
+               (when (and x y width height)
+                 {:width (int width)
+                  :height (int height)})))]))
+
 (defn- get-dimensions-with-orientation [system ^String path]
   ;; Image magick doesn't give info about exif rotation so we use the identify command
   ;; If we are processing an animated gif we use the first frame with -scene 0
@@ -157,7 +217,7 @@
   [system {:keys [input] :as params}]
   (let [{:keys [path mtype] :as input} (validation/check-input input)]
     (if (= mtype "image/svg+xml")
-      (let [info (some-> path slurp svg/parse-svg svg/get-basic-info-from-svg)]
+      (let [info (some-> path slurp parse-svg get-basic-info-from-svg)]
         (when-not info
           (ex/raise :type :validation
                     :code :invalid-svg-file

backend/src/app/media/remote.clj

@@ -13,7 +13,7 @@
    [app.common.uri :as uri]
    [app.config :as cf]
    [app.http.client :as http]
-   [app.media.svg :as svg]
+   [app.media.local :as local]
    [app.media.validation :as validation]
    [app.setup :as-alias setup]
    [app.storage.tmp :as tmp]
@@ -182,7 +182,7 @@
   (let [{:keys [path mtype]} (validation/check-input input)]
     (if (= mtype "image/svg+xml")
       ;; SVG: parse locally (Sharp doesn't support SVG)
-      (let [info (some-> path slurp svg/parse-svg svg/get-basic-info-from-svg)]
+      (let [info (some-> path slurp local/parse-svg local/get-basic-info-from-svg)]
         (when-not info
           (ex/raise :type :validation
                     :code :invalid-svg-file

backend/src/app/media/svg.clj

@@ -1,130 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
-
-(ns app.media.svg
-  "SVG parsing, sanitization, and info extraction.
-   Centralizes all SVG-related security concerns."
-  (:require
-   [app.common.data :as d]
-   [app.common.data.macros :as dm]
-   [app.common.exceptions :as ex]
-   [app.common.logging :as l]
-   [clojure.xml :as xml]
-   [cuerdas.core :as str])
-  (:import
-   clojure.lang.XMLHandler
-   java.io.InputStream
-   javax.xml.parsers.SAXParserFactory
-   javax.xml.XMLConstants
-   org.apache.commons.io.IOUtils))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; SVG PARSING
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defn- secure-parser-factory
-  [^InputStream input ^XMLHandler handler]
-  (.. (doto (SAXParserFactory/newInstance)
-        (.setFeature XMLConstants/FEATURE_SECURE_PROCESSING true)
-        (.setFeature "http://apache.org/xml/features/disallow-doctype-decl" true))
-      (newSAXParser)
-      (parse input handler)))
-
-(defn- strip-doctype
-  [data]
-  (cond-> data
-    (str/includes? data "<!DOCTYPE")
-    (str/replace #"<\!DOCTYPE[^>]*>" "")))
-
-(defn parse-svg
-  [text]
-  (let [text (strip-doctype text)]
-    (dm/with-open [istream (IOUtils/toInputStream ^String text "UTF-8")]
-      (xml/parse istream secure-parser-factory))))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; SVG SANITIZATION
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(def ^:private dangerous-attrs-pattern #"(?i)^on\w+$")
-(def ^:private javascript-href-pattern #"(?i)^javascript:")
-
-(defn- sanitize-svg-element
-  "Recursively sanitize an SVG element by removing dangerous tags and attributes."
-  [{:keys [tag attrs content] :as element}]
-  (when (and (map? element) tag)
-    (let [dangerous-tags #{:script :foreignObject :set :animate :animateTransform :animateColor :animateMotion}]
-      (when-not (contains? dangerous-tags tag)
-        (let [clean-attrs (->> attrs
-                               (remove (fn [[k v]]
-                                         (or (re-matches dangerous-attrs-pattern (name k))
-                                             (and (#{:href :xlink:href} k)
-                                                  (string? v)
-                                                  (re-find javascript-href-pattern (str/trim v))))))
-                               (into {}))
-              clean-content (when content
-                              (->> content
-                                   (filter #(or (string? %) (map? %)))
-                                   (map (fn [child]
-                                          (if (map? child)
-                                            (sanitize-svg-element child)
-                                            child)))
-                                   (filter some?)
-                                   vec))]
-          (cond-> {:tag tag :attrs clean-attrs}
-            (seq clean-content) (assoc :content clean-content)))))))
-
-(defn sanitize-svg
-  "Sanitize SVG content by removing dangerous elements and attributes.
-   Removes <script> tags, <foreignObject> elements, event handlers (on*),
-   and javascript: URLs from href attributes."
-  [svg-text]
-  (try
-    (let [parsed (parse-svg svg-text)
-          sanitized (sanitize-svg-element parsed)]
-      (if sanitized
-        (with-out-str (xml/emit sanitized))
-        (ex/raise :type :validation
-                  :code :invalid-svg-file
-                  :hint "SVG sanitization produced no output")))
-    (catch Exception e
-      (l/warn :hint "SVG sanitization failed, rejecting upload" :cause e)
-      (ex/raise :type :validation
-                :code :invalid-svg-file
-                :hint "SVG parsing failed during sanitization"
-                :cause e))))
-
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-;; SVG INFO EXTRACTION
-;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
-
-(defn get-basic-info-from-svg
-  [{:keys [tag attrs] :as data}]
-  (when (not= tag :svg)
-    (ex/raise :type :validation
-              :code :unable-to-parse-svg
-              :hint "uploaded svg has invalid content"))
-  (reduce (fn [default f]
-            (if-let [res (f attrs)]
-              (reduced res)
-              default))
-          {:width 100 :height 100}
-          [(fn parse-width-and-height
-             [{:keys [width height]}]
-             (when (and (string? width)
-                        (string? height))
-               (let [width  (d/parse-double width)
-                     height (d/parse-double height)]
-                 (when (and width height)
-                   {:width (int width)
-                    :height (int height)}))))
-           (fn parse-viewbox
-             [{:keys [viewBox]}]
-             (let [[x y width height] (->> (str/split viewBox #"\s+" 4)
-                                           (map d/parse-double))]
-               (when (and x y width height)
-                 {:width (int width)
-                  :height (int height)})))]))

backend/src/app/rpc/commands/auth.clj

@@ -8,7 +8,6 @@
   (:require
    [app.auth :as auth]
    [app.auth.oidc :as oidc]
-   [app.auth.passwords :as passwords]
    [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.features :as cfeat]
@@ -183,7 +182,6 @@
               (db/update! conn :profile {:password pwd :is-active true} {:id profile-id})
               nil))]
 
-    (passwords/validate-password password)
     (->> (validate-token token)
          (update-password conn))
 
@@ -242,9 +240,6 @@
               :code :email-as-password
               :hint "you can't use your email as password"))
 
-  ;; Validate password strength against common password dictionary
-  (passwords/validate-password (:password params))
-
   (when (eml/has-bounce-reports? cfg (:email params))
     (ex/raise :type :restriction
               :code :email-has-permanent-bounces
@@ -263,8 +258,7 @@
   (validate-register-attempt! cfg params)
 
   (let [email   (profile/clean-email email)
-        profile (profile/get-profile-by-email pool email)
-        fullname (d/normalize-string fullname)]
+        profile (profile/get-profile-by-email pool email)]
 
     ;; SECURITY: refuse to issue a prepared-register token when an active
     ;; profile already exists for this email.
@@ -365,9 +359,6 @@
         is-active (:is-active params false)
         theme     (:theme params nil)
         email     (str/lower email)
-        fullname  (d/normalize-string (:fullname params))
-        locale    (d/normalize-string locale)
-        theme     (d/normalize-string theme)
 
         photo-id  (some->> (or (:oidc/picture props)
                                (:google/picture props)
@@ -376,7 +367,7 @@
                            (import-profile-picture cfg))
 
         params    {:id id
-                   :fullname fullname
+                   :fullname (:fullname params)
                    :email email
                    :auth-backend backend
                    :lang locale

backend/src/app/rpc/commands/binfile.clj

@@ -118,10 +118,11 @@
 
 (def ^:private schema:import-binfile
   [:and
-   [:map {:title "import-binfile" :closed true}
+   [:map {:title "import-binfile"}
     [:name [:or [:string {:max 250}]
             [:map-of ::sm/uuid [:string {:max 250}]]]]
     [:project-id ::sm/uuid]
+    [:file-id {:optional true} ::sm/uuid]
     [:version {:optional true} ::sm/int]
     [:file {:optional true} media.v/schema:upload]
     [:upload-id {:optional true} ::sm/uuid]]
@@ -130,26 +131,35 @@
       (or (some? file) (some? upload-id)))]])
 
 (sv/defmethod ::import-binfile
-  "Import a penpot file in a binary format.
+  "Import a penpot file in a binary format. If `file-id` is provided,
+  an in-place import will be performed instead of creating a new file.
+
+  The in-place imports are only supported for binfile-v3 and when a
+  .penpot file only contains one penpot file.
 
   The file content may be provided either as a multipart `file` upload
   or as an `upload-id` referencing a completed chunked-upload session,
   which allows importing files larger than the multipart size limit.
   "
   {::doc/added "1.15"
-   ::doc/changes [["1.20" "Set default version to 3"]
-                  ["2.15" "Add upload-id param for chunked upload support"]]
+   ::doc/changes ["1.20" "Add file-id param for in-place import"
+                  "1.20" "Set default version to 3"
+                  "2.15" "Add upload-id param for chunked upload support"]
 
    ::webhooks/event? true
    ::sse/stream? true
    ::sm/params schema:import-binfile}
-  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id project-id version upload-id] :as params}]
+  [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id project-id version file-id upload-id] :as params}]
   (projects/check-edition-permissions! pool profile-id project-id)
   (let [version (or version 3)
         params  (-> params
                     (assoc :profile-id profile-id)
                     (assoc :version version))
 
+        cfg     (cond-> cfg
+                  (uuid? file-id)
+                  (assoc ::bfc/file-id file-id))
+
         params
         (if (some? upload-id)
           (let [file (db/tx-run! cfg media-cmd/assemble-chunks upload-id)]
@@ -164,5 +174,6 @@
     (with-meta
       (sse/response (partial import-binfile cfg params))
       {::audit/props {:file nil
+                      :file-id file-id
                       :generated-by (:generated-by manifest)
                       :referer (:referer manifest)}})))

backend/src/app/rpc/commands/feedback.clj

@@ -14,25 +14,22 @@
    [app.db :as db]
    [app.email :as eml]
    [app.rpc :as-alias rpc]
-   [app.rpc.climit :as-alias climit]
    [app.rpc.commands.profile :as profile]
    [app.rpc.doc :as-alias doc]
    [app.util.services :as sv]))
 
 (declare ^:private send-user-feedback!)
 
-(def schema:send-user-feedback
+(def ^:private schema:send-user-feedback
   [:map {:title "send-user-feedback"}
    [:subject [:string {:max 500}]]
    [:content [:string {:max 2500}]]
    [:type {:optional true} :string]
    [:error-href {:optional true} [:string {:max 2500}]]
-   [:error-report {:optional true} [:string {:max 1048576}]]])
+   [:error-report {:optional true} :string]])
 
 (sv/defmethod ::send-user-feedback
-  {::climit/id [[:send-user-feedback/by-profile ::rpc/profile-id]
-                [:send-user-feedback/global]]
-   ::doc/added "1.18"
+  {::doc/added "1.18"
    ::sm/params schema:send-user-feedback}
   [{:keys [::db/pool]} {:keys [::rpc/profile-id] :as params}]
   (when-not (contains? cf/flags :user-feedback)

backend/src/app/rpc/commands/files.clj

@@ -1069,25 +1069,6 @@
   [cfg {:keys [::rpc/profile-id] :as params}]
   (db/tx-run! cfg delete-file (assoc params :profile-id profile-id)))
 
-;; --- Library relation helpers
-
-(defn- check-library-team-ownership!
-  "Verify that file and library belong to the same team.
-  Prevents cross-team library relation injection."
-  [conn file-id library-id]
-  (let [sql "SELECT EXISTS (
-               SELECT 1 FROM file AS f
-               JOIN project AS fp ON (fp.id = f.project_id)
-               JOIN file AS l ON (l.id = ?)
-               JOIN project AS lp ON (lp.id = l.project_id)
-               WHERE f.id = ? AND fp.team_id = lp.team_id
-             ) AS ok"
-        row (db/exec-one! conn [sql library-id file-id])]
-    (when-not (:ok row)
-      (ex/raise :type :not-found
-                :code :object-not-found
-                :hint "file and library must belong to the same team"))))
-
 ;; --- MUTATION COMMAND: link-file-to-library
 
 (def sql:link-file-to-library
@@ -1123,7 +1104,6 @@
 
   (check-edition-permissions! conn profile-id file-id)
   (check-edition-permissions! conn profile-id library-id)
-  (check-library-team-ownership! conn file-id library-id)
 
   (let [transitive-deps (bfc/get-libraries cfg [library-id])]
     (when (contains? transitive-deps file-id)
@@ -1155,7 +1135,6 @@
   [{:keys [::db/conn] :as cfg} {:keys [::rpc/profile-id file-id library-id] :as params}]
   (check-edition-permissions! conn profile-id file-id)
   (check-edition-permissions! conn profile-id library-id)
-  (check-library-team-ownership! conn file-id library-id)
   (unlink-file-from-library conn params)
   nil)
 
@@ -1180,7 +1159,6 @@
   [{:keys [::db/conn]} {:keys [::rpc/profile-id file-id library-id] :as params}]
   (check-edition-permissions! conn profile-id file-id)
   (check-edition-permissions! conn profile-id library-id)
-  (check-library-team-ownership! conn file-id library-id)
   (update-sync conn params))
 
 ;; --- MUTATION COMMAND: ignore-sync

backend/src/app/rpc/commands/media.clj

@@ -16,7 +16,6 @@
    [app.db :as db]
    [app.loggers.audit :as-alias audit]
    [app.media :as media]
-   [app.media.svg :as svg]
    [app.media.validation :as media.v]
    [app.rpc :as-alias rpc]
    [app.rpc.climit :as climit]
@@ -115,22 +114,13 @@
 
 (defn- process-main-image
   [info]
-  (let [path  (:path info)
-        mtype (:mtype info)
-        path  (if (= mtype "image/svg+xml")
-                (let [content   (slurp path)
-                      sanitized (svg/sanitize-svg content)
-                      temp-path (tmp/tempfile :prefix "penpot-svg-" :suffix ".svg" :min-age "5m")]
-                  (spit (str temp-path) sanitized)
-                  temp-path)
-                path)
-        hash  (sto/calculate-hash path)
-        data  (-> (sto/content path)
-                  (sto/wrap-with-hash hash))]
+  (let [hash (sto/calculate-hash (:path info))
+        data (-> (sto/content (:path info))
+                 (sto/wrap-with-hash hash))]
     {::sto/content data
      ::sto/deduplicate? true
      ::sto/touched-at (:ts info)
-     :content-type mtype
+     :content-type (:mtype info)
      :bucket "file-media-object"}))
 
 (defn- process-thumb-image

backend/src/app/rpc/commands/profile.clj

@@ -7,7 +7,6 @@
 (ns app.rpc.commands.profile
   (:require
    [app.auth :as auth]
-   [app.auth.passwords :as passwords]
    [app.common.data :as d]
    [app.common.exceptions :as ex]
    [app.common.schema :as sm]
@@ -165,9 +164,6 @@
   ;; it or not for explicit locking and avoid concurrent updates of
   ;; the same row/object.
   (let [profile (get-profile conn profile-id ::db/for-update true)
-        fullname (d/normalize-string fullname)
-        lang     (d/normalize-string lang)
-        theme    (d/normalize-string theme)
         ;; Update the profile map with direct params
         profile (-> profile
                     (assoc :fullname fullname)
@@ -213,9 +209,6 @@
                 :code :email-as-password
                 :hint "you can't use your email as password"))
 
-    ;; Validate password strength against common password dictionary
-    (passwords/validate-password (:password params))
-
     (update-profile-password! cfg (assoc profile :password password))
 
     (->> (rph/get-request params)

backend/src/app/rpc/commands/projects.clj

@@ -6,7 +6,6 @@
 
 (ns app.rpc.commands.projects
   (:require
-   [app.common.data :as d]
    [app.common.data.macros :as dm]
    [app.common.exceptions :as ex]
    [app.common.schema :as sm]
@@ -260,8 +259,7 @@
    ::db/transaction true}
   [{:keys [::db/conn]} {:keys [::rpc/profile-id id name] :as params}]
   (check-edition-permissions! conn profile-id id)
-  (let [project (db/get-by-id conn :project id ::sql/for-update true)
-        name    (d/normalize-string name)]
+  (let [project (db/get-by-id conn :project id ::sql/for-update true)]
     (db/update! conn :project
                 {:name name}
                 {:id id})

backend/src/app/rpc/commands/teams.clj

@@ -652,7 +652,6 @@
   (let [id         (or id (uuid/next))
         is-default (if (boolean? is-default) is-default false)
         features   (db/create-array conn "text" features)
-        name       (d/normalize-string name)
         team       (db/insert! conn :team
                                {:id id
                                 :name name
@@ -689,7 +688,6 @@
   [conn {:keys [id team-id name is-default created-at modified-at]}]
   (let [id         (or id (uuid/next))
         is-default (if (boolean? is-default) is-default false)
-        name       (d/normalize-string name)
         params     {:id id
                     :name name
                     :team-id team-id
@@ -720,10 +718,9 @@
    ::db/transaction true}
   [{:keys [::db/conn] :as cfg} {:keys [::rpc/profile-id id name]}]
   (check-edition-permissions! conn profile-id id)
-  (let [name (d/normalize-string name)]
-    (db/update! conn :team
-                {:name name}
-                {:id id}))
+  (db/update! conn :team
+              {:name name}
+              {:id id})
   nil)
 
 

backend/src/app/rpc/commands/teams_invitations.clj

@@ -46,29 +46,10 @@
 
 (def sql:upsert-organization-invitation
   "insert into team_invitation(id, team_id, org_id, email_to, created_by, role, valid_until)
-    values (?, null, ?, ?, ?, ?, ?)
-        on conflict(org_id, email_to) where team_id is null do
-           update set role = ?, valid_until = ?, updated_at = now()
-    returning *")
-
-(def ^:private sql:check-recent-invitation
-  "SELECT 1 FROM team_invitation
-   WHERE team_id = ? AND email_to = ?
-     AND updated_at > now() - interval '5 minutes'
-   LIMIT 1")
-
-(def ^:private sql:check-recent-org-invitation
-  "SELECT 1 FROM team_invitation
-   WHERE org_id = ? AND email_to = ?
-     AND updated_at > now() - interval '5 minutes'
-   LIMIT 1")
-
-(defn- recently-invited?
-  [{:keys [::db/conn]} team-id org-id email]
-  (let [query (if org-id
-                [sql:check-recent-org-invitation org-id email]
-                [sql:check-recent-invitation team-id email])]
-    (some? (db/exec-one! conn query))))
+   values (?, null, ?, ?, ?, ?, ?)
+       on conflict(org_id, email_to) where team_id is null do
+          update set role = ?, valid_until = ?, updated_at = now()
+   returning *")
 
 (defn- create-invitation-token
   [cfg {:keys [profile-id valid-until organization-id organization-name team-id member-id member-email role]}]
@@ -204,36 +185,35 @@
         (teams/check-email-bounce conn email true)
         (teams/check-email-spam conn email true)
 
-        (let [id              (uuid/next)
-              expire          (if organization
-                                (ct/in-future "876000h")  ;; Organization invitations doesn't expire
-                                (ct/in-future "168h")) ;; 7 days
-              recent?         (recently-invited? cfg (:id team) (:id organization) email)
-              invitation      (db/exec-one! conn (if organization
-                                                   [sql:upsert-organization-invitation id
-                                                    (:id organization)
-                                                    (str/lower email)
-                                                    (:id profile)
-                                                    (name role) expire
-                                                    (name role) expire]
-                                                   [sql:upsert-team-invitation id
-                                                    (:id team)
-                                                    (str/lower email)
-                                                    (:id profile)
-                                                    (name role) expire
-                                                    (name role) expire]))
-              updated?        (not= id (:id invitation))
-              profile-id      (:id profile)
+        (let [id         (uuid/next)
+              expire     (if organization
+                           (ct/in-future "876000h")  ;; Organization invitations doesn't expire
+                           (ct/in-future "168h")) ;; 7 days
+              invitation (db/exec-one! conn (if organization
+                                              [sql:upsert-organization-invitation id
+                                               (:id organization)
+                                               (str/lower email)
+                                               (:id profile)
+                                               (name role) expire
+                                               (name role) expire]
+                                              [sql:upsert-team-invitation id
+                                               (:id team)
+                                               (str/lower email)
+                                               (:id profile)
+                                               (name role) expire
+                                               (name role) expire]))
+              updated?   (not= id (:id invitation))
+              profile-id (:id profile)
               team-organization-id (get-in team [:organization :id])
-              tprops          {:profile-id profile-id
-                               :invitation-id (:id invitation)
-                               :valid-until expire
-                               :team-id (:id team)
-                               :organization-id (:id organization)
-                               :organization-name (:name organization)
-                               :member-email (:email-to invitation)
-                               :member-id (:id member)
-                               :role role}
+              tprops     {:profile-id profile-id
+                          :invitation-id (:id invitation)
+                          :valid-until expire
+                          :team-id (:id team)
+                          :organization-id (:id organization)
+                          :organization-name (:name organization)
+                          :member-email (:email-to invitation)
+                          :member-id (:id member)
+                          :role role}
               audit-props
               (cond-> {:invitation-id (:id invitation)
                        :valid-until expire
@@ -254,8 +234,8 @@
                         (and team-organization-id
                              member
                              (contains? all-organization-member-ids (:id member))))))
-              itoken          (create-invitation-token cfg tprops)
-              ptoken          (create-profile-identity-token cfg profile-id)]
+              itoken     (create-invitation-token cfg tprops)
+              ptoken     (create-profile-identity-token cfg profile-id)]
 
           (when (contains? cf/flags :log-invitation-tokens)
             (l/info :hint "invitation token" :token itoken))
@@ -271,8 +251,7 @@
                           (assoc :props props))]
             (audit/submit cfg event))
 
-          (when (and (allow-invitation-emails? member)
-                     (not recent?))
+          (when (allow-invitation-emails? member)
             (if organization
               (when (contains? cf/flags :admin-console)
                 (eml/send! {::eml/conn conn

backend/src/app/rpc/commands/webhooks.clj

@@ -23,9 +23,11 @@
    [cuerdas.core :as str]))
 
 (defn get-webhooks-permissions
-  [conn profile-id team-id]
+  [conn profile-id team-id creator-id]
   (let [permissions (t/get-permissions conn profile-id team-id)
-        can-edit (boolean (:can-edit permissions))]
+
+        can-edit (boolean (or (:can-edit permissions)
+                              (= profile-id creator-id)))]
     (assoc permissions :can-edit can-edit)))
 
 (def has-webhook-edit-permissions?
@@ -118,7 +120,7 @@
   {::doc/added "1.17"
    ::sm/params schema:create-webhook}
   [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id team-id] :as params}]
-  (t/check-edition-permissions! pool profile-id team-id)
+  (check-webhook-edition-permissions! pool profile-id team-id profile-id)
   (validate-quotes! cfg params)
   (validate-webhook! cfg nil params)
   (insert-webhook! cfg params))
@@ -135,7 +137,7 @@
    ::sm/params schema:update-webhook}
   [{:keys [::db/pool] :as cfg} {:keys [::rpc/profile-id id] :as params}]
   (let [whook (-> (db/get pool :webhook {:id id}) (decode-row))]
-    (check-webhook-edition-permissions! pool profile-id (:team-id whook))
+    (check-webhook-edition-permissions! pool profile-id (:team-id whook) (:profile-id whook))
     (validate-webhook! cfg whook params)
     (update-webhook! cfg whook params)))
 
@@ -149,7 +151,7 @@
    ::db/transaction true}
   [{:keys [::db/conn]} {:keys [::rpc/profile-id id]}]
   (let [whook (-> (db/get conn :webhook {:id id}) decode-row)]
-    (check-webhook-edition-permissions! conn profile-id (:team-id whook))
+    (check-webhook-edition-permissions! conn profile-id (:team-id whook) (:profile-id whook))
     (db/delete! conn :webhook {:id id})
     nil))
 

backend/test/backend_tests/auth_oidc_test.clj

@@ -518,16 +518,3 @@
               loc    (redirect-location result)]
           (t/is (= 302 (::yres/status result)))
           (t/is (.contains loc "error=unable-to-auth")))))))
-
-(t/deftest prepare-organization-sso-provider-does-not-skip-ssrf-check
-  (t/testing "organization SSO provider must use SSRF protection"
-    (let [captured-params (atom nil)]
-      (with-redefs [oidc/prepare-oidc-provider (fn [_cfg params]
-                                                 (reset! captured-params params)
-                                                 {:type "oidc" :id "test"})]
-        (#'oidc/prepare-organization-sso-provider {}
-                                                  {:client-id "test-client"
-                                                   :client-secret "test-secret"
-                                                   :issuer "https://idp.example.com"})
-        (t/is (not (true? (:skip-ssrf-check? @captured-params)))
-              "SSRF protection must be disabled for organization SSO")))))

backend/test/backend_tests/binfile_test.clj

@@ -8,7 +8,6 @@
   "Internal binfile test, no RPC involved"
   (:require
    [app.binfile.common :as bfc]
-   [app.binfile.v1 :as v1]
    [app.binfile.v3 :as v3]
    [app.common.features :as cfeat]
    [app.common.files.validate :as cfv]
@@ -26,10 +25,7 @@
    [clojure.test :as t]
    [cuerdas.core :as str]
    [datoteka.fs :as fs]
-   [datoteka.io :as io])
-  (:import
-   java.io.ByteArrayInputStream
-   java.io.DataInputStream))
+   [datoteka.io :as io]))
 
 (t/use-fixtures :once th/state-init)
 (t/use-fixtures :each th/database-reset)
@@ -206,26 +202,3 @@
                      (v3/import-files!))]
       (t/is (= (count result) 1))
       (t/is (every? uuid? result)))))
-
-(t/deftest read-obj-rejects-oversized-buffer
-  ;; N1-07: read-obj! must reject objects exceeding max-object-size
-  ;; before attempting to allocate the buffer
-  (let [size (+ bfc/max-object-size 1)
-        baos (java.io.ByteArrayOutputStream. 17)
-        dos  (java.io.DataOutputStream. baos)]
-    (.writeByte dos 5)
-    (.writeLong dos (long size))
-    (.flush dos)
-    (let [input (java.io.DataInputStream.
-                 (ByteArrayInputStream. (.toByteArray baos)))]
-      (binding [v1/*position* (atom 0)]
-        (let [out (try
-                    (v1/read-obj! input)
-                    nil
-                    (catch clojure.lang.ExceptionInfo e
-                      (ex-data e)))]
-          ;; Without the guard, read-obj! will either OOM or proceed
-          ;; to read-bytes! on a truncated stream (no :max-file-size-reached).
-          ;; With the guard, it raises :validation :max-file-size-reached.
-          (t/is (= :validation (:type out)))
-          (t/is (= :max-file-size-reached (:code out))))))))

backend/test/backend_tests/bounce_handling_test.clj

@@ -12,6 +12,7 @@
    [app.http.awsns :as awsns]
    [app.tokens :as tokens]
    [backend-tests.helpers :as th]
+   [clojure.data.json :as j]
    [clojure.pprint :refer [pprint]]
    [clojure.test :as t]
    [mockery.core :refer [with-mocks]]))
@@ -290,3 +291,289 @@
 
     (th/create-global-complaint-for pool {:type :bounce :email (:email profile)})
     (t/is (true? (email/has-bounce-reports? pool (:email profile))))))
+
+(t/deftest test-validate-sns-url-rejects-s3-and-other-services
+  ;; S3 buckets are attacker-controlled
+  (t/is (false? (#'awsns/valid-sns-url? "https://my-bucket.s3.amazonaws.com/cert.pem")))
+  (t/is (false? (#'awsns/valid-sns-url? "https://my-bucket.s3.eu-central-1.amazonaws.com/cert.pem")))
+  ;; Other AWS services
+  (t/is (false? (#'awsns/valid-sns-url? "https://lambda.amazonaws.com/cert.pem")))
+  (t/is (false? (#'awsns/valid-sns-url? "https://ec2.amazonaws.com/cert.pem")))
+  ;; Plain amazonaws.com without sns prefix
+  (t/is (false? (#'awsns/valid-sns-url? "https://amazonaws.com/cert.pem"))))
+
+(t/deftest test-validate-sns-url-accepts-only-sns-hosts
+  ;; Valid SNS URLs with region
+  (t/is (true? (#'awsns/valid-sns-url? "https://sns.eu-central-1.amazonaws.com/cert.pem")))
+  (t/is (true? (#'awsns/valid-sns-url? "https://sns.us-east-1.amazonaws.com/cert.pem")))
+  (t/is (true? (#'awsns/valid-sns-url? "https://sns.ap-southeast-1.amazonaws.com/cert.pem"))))
+
+;; Helper to load test certificate and private key from resources
+;; See: https://docs.aws.amazon.com/sns/latest/dg/sns-verify-signature-of-message.html
+(defn- load-test-cert-and-key
+  "Loads the test certificate and private key from test resources."
+  []
+  (let [cert-pem (slurp (clojure.java.io/resource "sns-test-cert.pem"))
+        key-pem  (slurp (clojure.java.io/resource "sns-test-key.pem"))
+        ;; Parse certificate
+        cert-bytes (.getBytes (-> cert-pem
+                                  (clojure.string/replace "-----BEGIN CERTIFICATE-----" "")
+                                  (clojure.string/replace "-----END CERTIFICATE-----" "")
+                                  (clojure.string/replace #"\s+" ""))
+                              java.nio.charset.StandardCharsets/UTF_8)
+        cert-input (java.io.ByteArrayInputStream. (.decode (java.util.Base64/getDecoder) cert-bytes))
+        cf (java.security.cert.CertificateFactory/getInstance "X.509")
+        cert (.generateCertificate cf cert-input)
+        ;; Parse private key
+        key-bytes (.getBytes (-> key-pem
+                                 (clojure.string/replace "-----BEGIN PRIVATE KEY-----" "")
+                                 (clojure.string/replace "-----END PRIVATE KEY-----" "")
+                                 (clojure.string/replace #"\s+" ""))
+                             java.nio.charset.StandardCharsets/UTF_8)
+        key-spec (java.security.spec.PKCS8EncodedKeySpec. (.decode (java.util.Base64/getDecoder) key-bytes))
+        kf (java.security.KeyFactory/getInstance "RSA")
+        private-key (.generatePrivate kf key-spec)]
+    {:cert cert
+     :cert-bytes (.getEncoded cert)
+     :private-key private-key
+     :public-key (.getPublicKey cert)}))
+
+(t/deftest test-verify-signature-end-to-end-v1
+  (let [{:keys [cert-bytes private-key]} (load-test-cert-and-key)
+
+        msg         {"Type"             "Notification"
+                     "MessageId"        "test-msg-1"
+                     "TopicArn"         "arn:aws:sns:us-east-1:123:topic"
+                     "Message"          "test message"
+                     "Timestamp"        "2021-02-04T14:41:37.020Z"
+                     "SigningCertURL"   "https://sns.us-east-1.amazonaws.com/cert.pem"
+                     "SignatureVersion" "1"}
+
+        string-to-sign (#'awsns/build-string-to-sign msg)
+        sig          (java.security.Signature/getInstance "SHA1withRSA")
+        _            (.initSign sig private-key)
+        _            (.update sig (.getBytes string-to-sign java.nio.charset.StandardCharsets/UTF_8))
+        signature    (.encodeToString (java.util.Base64/getEncoder) (.sign sig))
+        msg-with-sig (assoc msg "Signature" signature)]
+
+    (with-redefs [awsns/fetch-certificate (fn [_ _]
+                                            (java.io.ByteArrayInputStream. cert-bytes))]
+      (t/is (true? (#'awsns/verify-signature {} msg-with-sig))))))
+
+(t/deftest test-verify-signature-end-to-end-v2
+  (let [{:keys [cert-bytes private-key]} (load-test-cert-and-key)
+
+        msg         {"Type"             "Notification"
+                     "MessageId"        "test-msg-2"
+                     "TopicArn"         "arn:aws:sns:us-east-1:123:topic"
+                     "Message"          "test message"
+                     "Timestamp"        "2021-02-04T14:41:37.020Z"
+                     "SigningCertURL"   "https://sns.us-east-1.amazonaws.com/cert.pem"
+                     "SignatureVersion" "2"}
+
+        string-to-sign (#'awsns/build-string-to-sign msg)
+        sig          (java.security.Signature/getInstance "SHA256withRSA")
+        _            (.initSign sig private-key)
+        _            (.update sig (.getBytes string-to-sign java.nio.charset.StandardCharsets/UTF_8))
+        signature    (.encodeToString (java.util.Base64/getEncoder) (.sign sig))
+        msg-with-sig (assoc msg "Signature" signature)]
+
+    (with-redefs [awsns/fetch-certificate (fn [_ _]
+                                            (java.io.ByteArrayInputStream. cert-bytes))]
+      (t/is (true? (#'awsns/verify-signature {} msg-with-sig))))))
+
+(t/deftest test-verify-signature-end-to-end-subscription-confirmation
+  (let [{:keys [cert-bytes private-key]} (load-test-cert-and-key)
+
+        msg         {"Type"             "SubscriptionConfirmation"
+                     "MessageId"        "test-msg-3"
+                     "TopicArn"         "arn:aws:sns:us-east-1:123:topic"
+                     "Message"          "You have chosen to subscribe"
+                     "Timestamp"        "2021-02-04T14:41:37.020Z"
+                     "Token"            "test-token-123"
+                     "SubscribeURL"     "https://sns.us-east-1.amazonaws.com/confirm"
+                     "SigningCertURL"   "https://sns.us-east-1.amazonaws.com/cert.pem"
+                     "SignatureVersion" "1"}
+
+        string-to-sign (#'awsns/build-string-to-sign msg)
+        sig          (java.security.Signature/getInstance "SHA1withRSA")
+        _            (.initSign sig private-key)
+        _            (.update sig (.getBytes string-to-sign java.nio.charset.StandardCharsets/UTF_8))
+        signature    (.encodeToString (java.util.Base64/getEncoder) (.sign sig))
+        msg-with-sig (assoc msg "Signature" signature)]
+
+    (with-redefs [awsns/fetch-certificate (fn [_ _]
+                                            (java.io.ByteArrayInputStream. cert-bytes))]
+      (t/is (true? (#'awsns/verify-signature {} msg-with-sig))))))
+
+(t/deftest test-verify-signature-rejects-wrong-key
+  (let [{:keys [cert-bytes]} (load-test-cert-and-key)
+        ;; Generate a different keypair for signing
+        keypair-gen (java.security.KeyPairGenerator/getInstance "RSA")
+        _           (.initialize keypair-gen 2048)
+        kp          (.generateKeyPair keypair-gen)
+        wrong-private-key (.getPrivate kp)
+
+        msg         {"Type"             "Notification"
+                     "MessageId"        "test-msg-4"
+                     "TopicArn"         "arn:aws:sns:us-east-1:123:topic"
+                     "Message"          "test message"
+                     "Timestamp"        "2021-02-04T14:41:37.020Z"
+                     "SigningCertURL"   "https://sns.us-east-1.amazonaws.com/cert.pem"
+                     "SignatureVersion" "1"}
+
+        string-to-sign (#'awsns/build-string-to-sign msg)
+        sig          (java.security.Signature/getInstance "SHA1withRSA")
+        _            (.initSign sig wrong-private-key)
+        _            (.update sig (.getBytes string-to-sign java.nio.charset.StandardCharsets/UTF_8))
+        signature    (.encodeToString (java.util.Base64/getEncoder) (.sign sig))
+        msg-with-sig (assoc msg "Signature" signature)]
+
+    (with-redefs [awsns/fetch-certificate (fn [_ _]
+                                            (java.io.ByteArrayInputStream. cert-bytes))]
+      (t/is (false? (#'awsns/verify-signature {} msg-with-sig))))))
+
+(t/deftest test-verify-signature-rejects-unsupported-version
+  (let [msg {"Type" "Notification"
+             "MessageId" "test-msg-3"
+             "TopicArn" "arn:aws:sns:us-east-1:123:topic"
+             "Message" "test message"
+             "Timestamp" "2021-02-04T14:41:37.020Z"
+             "SigningCertURL" "https://sns.us-east-1.amazonaws.com/cert.pem"
+             "SignatureVersion" "3"
+             "Signature" "fake=="}]
+
+    (t/is (thrown? clojure.lang.ExceptionInfo
+                   (#'awsns/verify-signature {} msg)))))
+
+(t/deftest test-build-string-to-sign-v1-notification
+  (let [msg {"Type"             "Notification"
+             "MessageId"        "msg-123"
+             "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+             "Message"          "{\"notificationType\":\"Bounce\"}"
+             "Timestamp"        "2021-02-04T14:41:37.020Z"
+             "SigningCertURL"   "https://sns.eu-central-1.amazonaws.com/cert.pem"
+             "SignatureVersion" "1"
+             "Signature"        "abc123=="}
+        result (#'awsns/build-string-to-sign msg)]
+    (t/is (string? result))
+    (t/is (.contains result "MessageId"))
+    (t/is (.contains result "msg-123"))
+    (t/is (.contains result "TopicArn"))
+    (t/is (.contains result "Message"))
+    (t/is (.contains result "Timestamp"))
+    ;; V1 does NOT include SigningCertURL, SignatureVersion, or Signature
+    (t/is (not (.contains result "SigningCertURL")))
+    (t/is (not (.contains result "SignatureVersion")))
+    (t/is (not (.contains result "Signature")))))
+
+(t/deftest test-build-string-to-sign-v2-notification
+  (let [msg {"Type"             "Notification"
+             "MessageId"        "msg-123"
+             "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+             "Message"          "{\"notificationType\":\"Bounce\"}"
+             "Timestamp"        "2021-02-04T14:41:37.020Z"
+             "SigningCertURL"   "https://sns.eu-central-1.amazonaws.com/cert.pem"
+             "SignatureVersion" "2"
+             "Signature"        "abc123=="}
+        result (#'awsns/build-string-to-sign msg)]
+    (t/is (string? result))
+    (t/is (.contains result "MessageId"))
+    (t/is (.contains result "TopicArn"))
+    ;; V2 uses the same fields as V1 (only hash algorithm differs: SHA1 vs SHA256)
+    ;; SigningCertURL and SignatureVersion are metadata, not part of the signed content
+    (t/is (not (.contains result "SigningCertURL")))
+    (t/is (not (.contains result "SignatureVersion")))
+    ;; Signature is never part of the string-to-sign
+    (t/is (not (.contains result "Signature\n")))))
+
+(t/deftest test-build-string-to-sign-subscription-confirmation
+  (let [msg {"Type"             "SubscriptionConfirmation"
+             "MessageId"        "msg-456"
+             "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+             "Message"          "You have chosen to subscribe"
+             "Timestamp"        "2021-02-04T14:41:37.020Z"
+             "Token"            "test-token-123"
+             "SigningCertURL"   "https://sns.eu-central-1.amazonaws.com/cert.pem"
+             "SignatureVersion" "1"
+             "Signature"        "xyz789=="
+             "SubscribeURL"     "https://sns.eu-central-1.amazonaws.com/confirm"}
+        result (#'awsns/build-string-to-sign msg)]
+    (t/is (string? result))
+    (t/is (.contains result "SubscribeURL"))
+    (t/is (.contains result "https://sns.eu-central-1.amazonaws.com/confirm"))
+    ;; Token must be included for SubscriptionConfirmation
+    (t/is (.contains result "Token"))
+    (t/is (.contains result "test-token-123"))))
+
+(t/deftest test-handle-request-returns-4xx-for-invalid-signature
+  (let [{:keys [cert-bytes]} (load-test-cert-and-key)
+        body (j/write-str
+              {"Type"             "Notification"
+               "MessageId"        "msg-123"
+               "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+               "Message"          "{\"test\":\"data\"}"
+               "Timestamp"        "2021-02-04T14:41:37.020Z"
+               "SigningCertURL"   "https://sns.eu-central-1.amazonaws.com/cert.pem"
+               "SignatureVersion" "1"
+               "Signature"        "invalid-signature=="})
+        result (with-redefs [awsns/fetch-certificate (fn [_ _]
+                                                       (java.io.ByteArrayInputStream. cert-bytes))]
+                 (#'awsns/handle-request th/*system* body))]
+    (t/is (= 400 (:status result)))))
+
+(t/deftest test-handle-request-returns-4xx-for-invalid-url
+  (let [body (j/write-str
+              {"Type"             "Notification"
+               "MessageId"        "msg-123"
+               "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+               "Message"          "{\"test\":\"data\"}"
+               "Timestamp"        "2021-02-04T14:41:37.020Z"
+               "SigningCertURL"   "https://evil.com/cert.pem"
+               "SignatureVersion" "1"
+               "Signature"        "fake-signature=="})
+        result (#'awsns/handle-request th/*system* body)]
+    (t/is (= 400 (:status result)))))
+
+(t/deftest test-handle-request-rejects-invalid-signing-cert-url
+  (let [pool (:app.db/pool th/*system*)
+        profile (th/create-profile* 1)
+        token (tokens/generate th/*system*
+                               {:iss :profile-identity
+                                :profile-id (:id profile)})
+        body (j/write-str
+              {"Type"             "Notification"
+               "MessageId"        "msg-123"
+               "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+               "Message"          (j/write-str {"notificationType" "Bounce"
+                                                "bounce" {"bounceType" "Permanent"
+                                                          "bounceSubType" "General"
+                                                          "bouncedRecipients" [{"emailAddress" "victim@example.com"}]
+                                                          "timestamp" "2021-02-04T14:41:38.000Z"}
+                                                "mail" {"source" "no-reply@penpot.app"
+                                                        "destination" ["victim@example.com"]
+                                                        "timestamp" "2021-02-04T14:41:37.020Z"
+                                                        "headers" [{"name" "X-Penpot-Data" "value" token}]}})
+               "Timestamp"        "2021-02-04T14:41:37.020Z"
+               "SigningCertURL"   "https://evil.com/cert.pem"
+               "SignatureVersion" "1"
+               "Signature"        "fake-signature=="})]
+    (#'awsns/handle-request th/*system* body)
+    (let [reports (db/query pool :global-complaint-report :all)]
+      (t/is (empty? reports)))))
+
+(t/deftest test-handle-request-rejects-invalid-subscribe-url
+  (let [pool (:app.db/pool th/*system*)
+        body (j/write-str
+              {"Type"             "SubscriptionConfirmation"
+               "MessageId"        "msg-456"
+               "TopicArn"         "arn:aws:sns:eu-central-1:123:topic"
+               "Message"          "You have chosen to subscribe"
+               "Timestamp"        "2021-02-04T14:41:37.020Z"
+               "SigningCertURL"   "https://sns.eu-central-1.amazonaws.com/cert.pem"
+               "SignatureVersion" "1"
+               "Signature"        "fake-signature=="
+               "SubscribeURL"     "http://attacker.com/confirm"})]
+    (#'awsns/handle-request th/*system* body)
+    (let [reports (db/query pool :global-complaint-report :all)]
+      (t/is (empty? reports)))))

backend/test/backend_tests/helpers.clj

@@ -189,7 +189,7 @@
    (let [params (merge {:id (mk-uuid "profile" i)
                         :fullname (str "Profile " i)
                         :email (str "profile" i ".test@nodomain.com")
-                        :password "Test123!"
+                        :password "123123"
                         :is-demo false}
                        params)]
      (db/run! system

backend/test/backend_tests/http_assets_test.clj

@@ -459,135 +459,6 @@
 ;; Tests: objects-handler — expired objects
 ;; ----------------------------------------------------------------
 
-;; ----------------------------------------------------------------
-;; Tests: file-objects-handler — authz required (T2-N1-01)
-;; ----------------------------------------------------------------
-
-(t/deftest file-objects-handler-unauthenticated-returns-404
-  ;; Unauthenticated requests to file-media assets must return 404
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        profile  (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id profile)})
-        project  (th/create-project* 1 {:profile-id (:id profile)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id profile)
-                                     :project-id (:id project)})
-        media-storage (create-storage-object! storage "file-media-object" "image data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id media-storage)})
-        request  {:path-params {:id (str (:id media-obj))}}
-        response (assets/file-objects-handler cfg request)]
-    (t/is (= 404 (::yres/status response)))))
-
-(t/deftest file-objects-handler-no-file-perms-returns-404
-  ;; Authenticated user without file read permissions must get 404
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        owner    (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id owner)})
-        project  (th/create-project* 1 {:profile-id (:id owner)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id owner)
-                                     :project-id (:id project)})
-        media-storage (create-storage-object! storage "file-media-object" "image data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id media-storage)})
-        stranger (th/create-profile* 2)
-        request  {:path-params {:id (str (:id media-obj))}
-                  ::session/profile-id (:id stranger)}
-        response (assets/file-objects-handler cfg request)]
-    (t/is (= 404 (::yres/status response)))))
-
-(t/deftest file-objects-handler-with-file-perms-succeeds
-  ;; Authenticated user with file read permissions must get the object
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        owner    (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id owner)})
-        project  (th/create-project* 1 {:profile-id (:id owner)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id owner)
-                                     :project-id (:id project)})
-        media-storage (create-storage-object! storage "file-media-object" "image data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id media-storage)})
-        request  {:path-params {:id (str (:id media-obj))}
-                  ::session/profile-id (:id owner)}
-        response (assets/file-objects-handler cfg request)]
-    (t/is (= 204 (::yres/status response)))))
-
-(t/deftest file-thumbnails-handler-unauthenticated-returns-404
-  ;; Unauthenticated requests to file-thumbnail assets must return 404
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        profile  (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id profile)})
-        project  (th/create-project* 1 {:profile-id (:id profile)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id profile)
-                                     :project-id (:id project)})
-        media-storage (create-storage-object! storage "file-media-object" "image data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id media-storage)})
-        request  {:path-params {:id (str (:id media-obj))}}
-        response (assets/file-thumbnails-handler cfg request)]
-    (t/is (= 404 (::yres/status response)))))
-
-(t/deftest file-thumbnails-handler-with-file-perms-succeeds
-  ;; Authenticated user with file read permissions must get the thumbnail
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        owner    (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id owner)})
-        project  (th/create-project* 1 {:profile-id (:id owner)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id owner)
-                                     :project-id (:id project)})
-        thumb-storage (create-storage-object! storage "file-object-thumbnail" "thumb data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id thumb-storage)})
-        request  {:path-params {:id (str (:id media-obj))}
-                  ::session/profile-id (:id owner)}
-        response (assets/file-thumbnails-handler cfg request)]
-    ;; Falls back to media-id since no thumbnail-id, but still serves
-    (t/is (= 204 (::yres/status response)))))
-
-(t/deftest file-objects-handler-non-existent-media-returns-404
-  ;; Request for non-existent file-media-object returns 404
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        profile  (th/create-profile* 1)
-        request  {:path-params {:id (str (uuid/next))}
-                  ::session/profile-id (:id profile)}
-        response (assets/file-objects-handler cfg request)]
-    (t/is (= 404 (::yres/status response)))))
-
-(t/deftest file-objects-handler-nil-profile-id-returns-404
-  ;; When profile-id is nil (invalid session), must return 404
-  (let [storage  (-> (:app.storage/storage th/*system*)
-                     (configure-storage-backend))
-        cfg      (make-handler-cfg storage)
-        profile  (th/create-profile* 1)
-        team     (th/create-team* 1 {:profile-id (:id profile)})
-        project  (th/create-project* 1 {:profile-id (:id profile)
-                                        :team-id (:id team)})
-        file     (th/create-file* 1 {:profile-id (:id profile)
-                                     :project-id (:id project)})
-        media-storage (create-storage-object! storage "file-media-object" "image data")
-        media-obj (th/create-file-media-object* {:file-id (:id file)
-                                                 :media-id (:id media-storage)})
-        request  {:path-params {:id (str (:id media-obj))}
-                  ::session/profile-id nil}
-        response (assets/file-objects-handler cfg request)]
-    (t/is (= 404 (::yres/status response)))))
-
 (t/deftest objects-handler-expired-object
   ;; Expired objects should return 404 (get-object filters them out).
   (let [storage  (-> (:app.storage/storage th/*system*)

backend/test/backend_tests/media_test.clj

@@ -8,7 +8,6 @@
   (:require
    [app.common.exceptions :as ex]
    [app.media :as media]
-   [app.media.svg :as svg]
    [backend-tests.helpers :as th]
    [clojure.test :as t]
    [datoteka.fs :as fs]))
@@ -56,87 +55,6 @@
       (t/is (pos? (:width info)))
       (t/is (pos? (:height info))))))
 
-(t/deftest sanitize-svg-script-tag
-  (t/testing "sanitize-svg removes script tags"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><script>alert('xss')</script><rect width=\"50\" height=\"50\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "<script>")))
-      (t/is (not (clojure.string/includes? result "alert")))
-      (t/is (clojure.string/includes? result "<rect")))))
-
-(t/deftest sanitize-svg-event-handlers
-  (t/testing "sanitize-svg removes event handler attributes"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\" onload=\"alert('xss')\"><rect width=\"50\" height=\"50\" onmouseover=\"alert('xss')\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "onload")))
-      (t/is (not (clojure.string/includes? result "onmouseover")))
-      (t/is (not (clojure.string/includes? result "alert")))
-      (t/is (clojure.string/includes? result "<rect")))))
-
-(t/deftest sanitize-svg-javascript-href
-  (t/testing "sanitize-svg removes javascript: URLs from href attributes"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"><a xlink:href=\"javascript:alert('xss')\"><rect width=\"50\" height=\"50\"/></a></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "javascript:")))
-      (t/is (not (clojure.string/includes? result "alert")))
-      (t/is (clojure.string/includes? result "<a")))))
-
-(t/deftest sanitize-svg-foreign-object
-  (t/testing "sanitize-svg removes foreignObject elements"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><foreignObject width=\"100\" height=\"100\"><body xmlns=\"http://www.w3.org/1999/xhtml\"><script>alert('xss')</script></body></foreignObject><rect width=\"50\" height=\"50\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "foreignObject")))
-      (t/is (not (clojure.string/includes? result "<script>")))
-      (t/is (clojure.string/includes? result "<rect")))))
-
-(t/deftest sanitize-svg-clean-content
-  (t/testing "sanitize-svg preserves clean SVG content"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"50\" height=\"50\" fill=\"red\"/><circle cx=\"75\" cy=\"75\" r=\"20\" fill=\"blue\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (clojure.string/includes? result "<rect"))
-      (t/is (clojure.string/includes? result "<circle"))
-      (t/is (or (clojure.string/includes? result "fill=\"red\"")
-                (clojure.string/includes? result "fill='red'")))
-      (t/is (or (clojure.string/includes? result "fill=\"blue\"")
-                (clojure.string/includes? result "fill='blue'"))))))
-
-(t/deftest sanitize-svg-invalid-svg-rejected
-  (t/testing "sanitize-svg rejects malformed SVG input"
-    (let [svg "<svg><not-closed>"]
-      (t/is (thrown-with-msg? Exception #"SVG parsing failed during sanitization"
-                              (svg/sanitize-svg svg))))))
-
-(t/deftest sanitize-svg-preserves-xlink
-  (t/testing "sanitize-svg preserves legitimate xlink:href attributes"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" xmlns:xlink=\"http://www.w3.org/1999/xlink\" width=\"100\" height=\"100\"><use xlink:href=\"#icon\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (clojure.string/includes? result "xlink:href"))
-      (t/is (clojure.string/includes? result "#icon")))))
-
-(t/deftest sanitize-svg-javascript-href-whitespace
-  (t/testing "sanitize-svg catches javascript: URLs with leading whitespace"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><a href=\" javascript:alert('xss')\"><rect width=\"50\" height=\"50\"/></a></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "javascript:")))
-      (t/is (not (clojure.string/includes? result "alert")))
-      (t/is (clojure.string/includes? result "<a")))))
-
-(t/deftest sanitize-svg-nested-script
-  (t/testing "sanitize-svg removes script tags from nested elements"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><g><script>alert('xss')</script></g></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "<script")))
-      (t/is (not (clojure.string/includes? result "alert")))
-      (t/is (clojure.string/includes? result "<g")))))
-
-(t/deftest sanitize-svg-smil-bypass
-  (t/testing "sanitize-svg removes SMIL animation elements that can set on* attrs"
-    (let [svg "<svg xmlns=\"http://www.w3.org/2000/svg\" width=\"100\" height=\"100\"><rect width=\"100\" height=\"100\" id=\"r\"/><set attributeName=\"onmouseover\" to=\"alert('xss')\" xlink:href=\"#r\" begin=\"0s\"/></svg>"
-          result (svg/sanitize-svg svg)]
-      (t/is (not (clojure.string/includes? result "<set")))
-      (t/is (not (clojure.string/includes? result "onmouseover")))
-      (t/is (clojure.string/includes? result "<rect")))))
-
 (t/deftest info-invalid-image
   (t/testing "info on invalid image raises error"
     (let [path (fs/create-tempfile :prefix "penpot-test-" :suffix ".jpg")]

backend/test/backend_tests/rpc_binfile_test.clj

@@ -1,42 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
-
-(ns backend-tests.rpc-binfile-test
-  (:require
-   [app.common.schema :as sm]
-   [app.common.uuid :as uuid]
-   [app.rpc :as-alias rpc]
-   [app.rpc.commands.binfile :as binfile]
-   [backend-tests.helpers :as th]
-   [clojure.test :as t]
-   [datoteka.fs :as fs]))
-
-(t/use-fixtures :once th/state-init)
-(t/use-fixtures :each th/database-reset)
-
-(t/deftest import-binfile-schema-rejects-file-id
-  ;; N1-06: file-id parameter must be removed from schema for security
-  ;; The schema should not accept file-id as a valid parameter
-  (let [schema @#'binfile/schema:import-binfile
-        validator (sm/lazy-validator schema)
-
-        ;; Valid params without file-id
-        valid-params {:name "test"
-                      :project-id (uuid/random)
-                      :version 3
-                      :upload-id (uuid/random)}
-
-        ;; Params with file-id (should be rejected after fix)
-        params-with-file-id (assoc valid-params :file-id (uuid/random))]
-
-    ;; Valid params without file-id should pass
-    (t/is (true? (validator valid-params))
-          "params without file-id should be valid")
-
-    ;; Params with file-id should fail validation after fix
-    ;; (Currently this will fail because file-id is still in schema)
-    (t/is (false? (validator params-with-file-id))
-          "params with file-id should be rejected")))

backend/test/backend_tests/rpc_feedback_test.clj

@@ -1,39 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
-
-(ns backend-tests.rpc-feedback-test
-  (:require
-   [app.common.schema :as sm]
-   [app.rpc.commands.feedback :as feedback]
-   [clojure.test :as t]))
-
-(t/deftest send-user-feedback-schema-validation
-  (let [schema feedback/schema:send-user-feedback]
-
-    (t/testing "accepts valid feedback with all fields"
-      (let [params {:subject "Test subject"
-                    :content "Test content"
-                    :type "bug"
-                    :error-href "https://example.com/error"
-                    :error-report "Error details here"}]
-        (t/is (sm/valid? schema params))))
-
-    (t/testing "accepts feedback without optional fields"
-      (let [params {:subject "Test subject"
-                    :content "Test content"}]
-        (t/is (sm/valid? schema params))))
-
-    (t/testing "accepts error-report up to 1MiB"
-      (let [params {:subject "Test subject"
-                    :content "Test content"
-                    :error-report (apply str (repeat 1048576 "x"))}]
-        (t/is (sm/valid? schema params))))
-
-    (t/testing "rejects error-report exceeding 1MiB"
-      (let [params {:subject "Test subject"
-                    :content "Test content"
-                    :error-report (apply str (repeat 1048577 "x"))}]
-        (t/is (not (sm/valid? schema params)))))))

backend/test/backend_tests/rpc_file_test.clj

@@ -141,31 +141,6 @@
         (let [result (:result out)]
           (t/is (= 0 (count result))))))))
 
-(t/deftest create-file-with-duplicate-id
-  (let [prof    (th/create-profile* 1 {:is-active true})
-        proj-id (:default-project-id prof)
-        file-id (uuid/next)]
-
-    (t/testing "create file with specific id"
-      (let [data {::th/type :create-file
-                  ::rpc/profile-id (:id prof)
-                  :project-id proj-id
-                  :id file-id
-                  :name "first-file"}
-            out  (th/command! data)]
-        (t/is (nil? (:error out)))))
-
-    (t/testing "create file with duplicate id returns normalized error"
-      (let [data {::th/type :create-file
-                  ::rpc/profile-id (:id prof)
-                  :project-id proj-id
-                  :id file-id
-                  :name "duplicate-file"}
-            out  (th/command! data)
-            err  (:error out)]
-        (t/is (th/ex-info? err))
-        (t/is (th/ex-of-type? err :not-found))))))
-
 (t/deftest file-gc-with-fragments
   (let [profile (th/create-profile* 1)
         file    (th/create-file* 1 {:profile-id (:id profile)
@@ -1008,38 +983,6 @@
     (t/is (some? sync))
     (t/is (some? (:synced-at sync)))))
 
-(t/deftest link-file-to-library-rejects-cross-team
-  ;; N1-08: A file in team2 must not be linked to a library in team1,
-  ;; even when the user has edit permissions on both (BOLA / CWE-639).
-  (let [prof1  (th/create-profile* 1)
-        prof2  (th/create-profile* 2)
-        team1  (th/create-team* 1 {:profile-id (:id prof1)})
-        team2  (th/create-team* 2 {:profile-id (:id prof2)})
-        proj1  (th/create-project* 1 {:profile-id (:id prof1)
-                                      :team-id (:id team1)})
-        proj2  (th/create-project* 2 {:profile-id (:id prof2)
-                                      :team-id (:id team2)})
-        lib    (th/create-file* 1 {:project-id (:id proj1)
-                                   :profile-id (:id prof1)
-                                   :is-shared true})
-        file2  (th/create-file* 2 {:project-id (:id proj2)
-                                   :profile-id (:id prof2)})]
-
-    ;; Add prof2 as editor to team1 so they have edit access to the library
-    (th/db-insert! :team-profile-rel {:team-id (:id team1)
-                                      :profile-id (:id prof2)
-                                      :is-owner false
-                                      :is-admin false
-                                      :can-edit true})
-
-    ;; prof2 tries to link file2 (team2) to lib (team1) — must fail
-    (let [data {::th/type :link-file-to-library
-                ::rpc/profile-id (:id prof2)
-                :file-id (:id file2)
-                :library-id (:id lib)}
-          out  (th/command! data)]
-      (t/is (some? (:error out))))))
-
 (t/deftest update-file-library-sync-status-updates-sync-row
   (let [profile  (th/create-profile* 1)
         file1    (th/create-file* 1 {:project-id (:default-project-id profile)

backend/test/backend_tests/rpc_profile_test.clj

@@ -42,7 +42,7 @@
   (let [profile (th/create-profile* 1)
         data    {::th/type :login-with-password
                  :email "profile1.test@nodomain.com"
-                 :password "Foobar12!"}
+                 :password "foobar"}
         out     (th/command! data)]
 
     #_(th/print-result! out)
@@ -56,7 +56,7 @@
   (let [profile (th/create-profile* 1)
         data    {::th/type :login-with-password
                  :email "profile1.test@nodomain.com"
-                 :password "Test123!"}
+                 :password "123123"}
         out     (th/command! data)]
     ;; (th/print-result! out)
     (let [error (:error out)]
@@ -69,7 +69,7 @@
   (let [profile (th/create-profile* 1 {:is-active true})
         data    {::th/type :login-with-password
                  :email "profile1.test@nodomain.com"
-                 :password "Test123!"}
+                 :password "123123"}
         out     (th/command! data)]
     ;; (th/print-result! out)
     (t/is (nil? (:error out)))
@@ -403,7 +403,7 @@
   (let [data  {::th/type :prepare-register-profile
                :email "user@example.com"
                :fullname "foobar"
-               :password "Foobar12!"
+               :password "foobar"
                :utm_campaign "utma"
                :mtm_campaign "mtma"}
         out   (th/command! data)
@@ -444,7 +444,7 @@
       (let [data  {::th/type :prepare-register-profile
                    :email "hello@example.com"
                    :fullname "foobar"
-                   :password "Foobar12!"}
+                   :password "foobar"}
             out   (th/command! data)
             token (get-in out [:result :token])]
         (t/is (th/success? out))
@@ -463,7 +463,7 @@
       (let [data  {::th/type :prepare-register-profile
                    :email "hello@example.com"
                    :fullname "foobar"
-                   :password "Foobar12!"}
+                   :password "foobar"}
             out   (th/command! data)
             token (get-in out [:result :token])]
         (t/is (th/success? out))
@@ -498,7 +498,7 @@
       (let [data  {::th/type :prepare-register-profile
                    :email "hello@example.com"
                    :fullname "foobar"
-                   :password "Foobar12!"}
+                   :password "foobar"}
             out   (th/command! data)
             token (get-in out [:result :token])]
         (t/is (th/success? out))
@@ -521,7 +521,7 @@
       (let [data  {::th/type :prepare-register-profile
                    :email "hello@example.com"
                    :fullname "foobar"
-                   :password "Foobar12!"}
+                   :password "foobar"}
             out   (th/command! data)
             token (get-in out [:result :token])]
         (t/is (th/success? out))
@@ -547,7 +547,7 @@
         (let [data  {::th/type :prepare-register-profile
                      :email "hello@example.com"
                      :fullname "foobar"
-                     :password "Foobar12!"}
+                     :password "foobar"}
               out   (th/command! data)
               token (get-in out [:result :token])]
           (t/is (th/success? out))
@@ -576,7 +576,7 @@
         (let [data  {::th/type :prepare-register-profile
                      :email "hello@example.com"
                      :fullname "foobar"
-                     :password "Foobar12!"}
+                     :password "foobar"}
               out   (th/command! data)
               token (get-in out [:result :token])]
           (t/is (th/success? out))
@@ -614,7 +614,7 @@
                      :invitation-token itoken
                      :fullname "foobar"
                      :email "user@example.com"
-                     :password "Foobar12!"}
+                     :password "foobar"}
 
           {prep-result :result prep-error :error} (th/command! prep-data)]
       (t/is (nil? prep-error))
@@ -659,7 +659,7 @@
                      :invitation-token itoken
                      :fullname "foobar"
                      :email "user@example.com"
-                     :password "Foobar12!"}
+                     :password "foobar"}
 
           {prep-result :result prep-error :error} (th/command! prep-data)]
       (t/is (nil? prep-error))
@@ -692,7 +692,7 @@
                :invitation-token itoken
                :email "user@example.com"
                :fullname "foobar"
-               :password "Foobar12!"}
+               :password "foobar"}
         out   (th/command! data)]
 
     (t/is (not (th/success? out)))
@@ -712,7 +712,7 @@
                  :invitation-token itoken
                  :fullname "foobar"
                  :email "user@example.com"
-                 :password "Foobar12!"}
+                 :password "foobar"}
           out (th/command! data)]
 
       (t/is (not (th/success? out)))
@@ -733,7 +733,7 @@
                  :invitation-token itoken
                  :email "user@example.com"
                  :fullname "foobar"
-                 :password "Foobar12!"}
+                 :password "foobar"}
           out   (th/command! data)]
 
       (t/is (not (th/success? out)))
@@ -754,7 +754,7 @@
                  :invitation-token itoken
                  :fullname "foobar"
                  :email "user@example.com"
-                 :password "Foobar12!"}
+                 :password "foobar"}
           out   (th/command! data)]
 
       (t/is (not (th/success? out)))
@@ -767,7 +767,7 @@
     (let [data  {::th/type :prepare-register-profile
                  :fullname "foobar"
                  :email "user@example.com"
-                 :password "Foobar12!"}
+                 :password "foobar"}
           out  (th/command! data)]
 
       (t/is (not (th/success? out)))
@@ -780,7 +780,7 @@
         data    {::th/type :prepare-register-profile
                  :fullname "foobar"
                  :email (:email profile)
-                 :password "Foobar12!"}
+                 :password "foobar"}
         out     (th/command! data)]
     ;; (th/print-result! out)
     (t/is (th/success? out))
@@ -793,7 +793,7 @@
         data  {::th/type :prepare-register-profile
                :fullname "foobar"
                :email "user@example.com"
-               :password "Foobar12!"}]
+               :password "foobar"}]
 
     (th/create-global-complaint-for pool {:type :bounce :email "user@example.com"})
 
@@ -808,7 +808,7 @@
         data  {::th/type :prepare-register-profile
                :fullname "foobar"
                :email "user@example.com"
-               :password "Foobar12!"}]
+               :password "foobar"}]
 
     (th/create-global-complaint-for pool {:type :complaint :email "user@example.com"})
 
@@ -1131,8 +1131,8 @@
   (let [profile (th/create-profile* 1)
         data  {::th/type :update-profile-password
                ::rpc/profile-id (:id profile)
-               :old-password "Test123!"
-               :password "Foobar12!"}
+               :old-password "123123"
+               :password "foobarfoobar"}
         out   (th/command! data)]
     (t/is (nil? (:error out)))
     (t/is (nil? (:result out)))))
@@ -1143,7 +1143,7 @@
         data  {::th/type :update-profile-password
                ::rpc/profile-id (:id profile)
                :old-password "badpassword"
-               :password "Foobar12!"}
+               :password "foobarfoobar"}
         {:keys [result error] :as out} (th/command! data)]
     (t/is (th/ex-info? error))
     (t/is (th/ex-of-type? error :validation))
@@ -1154,7 +1154,7 @@
   (let [profile (th/create-profile* 1)
         data  {::th/type :update-profile-password
                ::rpc/profile-id (:id profile)
-               :old-password "Test123!"
+               :old-password "123123"
                :password "profile1.test@nodomain.com"}
         {:keys [result error] :as out} (th/command! data)]
     (t/is (th/ex-info? error))
@@ -1271,49 +1271,3 @@
     (t/is (th/ex-info? (:error out)))
     (t/is (th/ex-of-type? (:error out) :validation))
     (t/is (th/ex-of-code? (:error out) :params-validation))))
-
-
-(t/deftest prepare-register-profile-password-too-short
-  (let [data {::th/type :prepare-register-profile
-              :email "user@example.com"
-              :fullname "foobar"
-              :password "123"}
-        out  (th/command! data)]
-    (t/is (th/ex-info? (:error out)))
-    (t/is (th/ex-of-type? (:error out) :validation))
-    (t/is (th/ex-of-code? (:error out) :weak-password))))
-
-
-(t/deftest prepare-register-profile-weak-password
-  (let [data {::th/type :prepare-register-profile
-              :email "user@example.com"
-              :fullname "foobar"
-              :password "password123"}
-        out  (th/command! data)]
-    (t/is (th/ex-info? (:error out)))
-    (t/is (th/ex-of-type? (:error out) :validation))
-    (t/is (th/ex-of-code? (:error out) :weak-password))))
-
-
-(t/deftest update-profile-password-too-short
-  (let [profile (th/create-profile* 1)
-        data    {::th/type :update-profile-password
-                 ::rpc/profile-id (:id profile)
-                 :old-password "Test123!"
-                 :password "123"}
-        out     (th/command! data)]
-    (t/is (th/ex-info? (:error out)))
-    (t/is (th/ex-of-type? (:error out) :validation))
-    (t/is (th/ex-of-code? (:error out) :weak-password))))
-
-
-(t/deftest update-profile-password-weak-password
-  (let [profile (th/create-profile* 1)
-        data    {::th/type :update-profile-password
-                 ::rpc/profile-id (:id profile)
-                 :old-password "Test123!"
-                 :password "qwerty"}
-        out     (th/command! data)]
-    (t/is (th/ex-info? (:error out)))
-    (t/is (th/ex-of-type? (:error out) :validation))
-    (t/is (th/ex-of-code? (:error out) :weak-password))))

backend/test/backend_tests/rpc_team_test.clj

@@ -1015,46 +1015,6 @@
           out  (th/command! data)]
       (t/is (th/success? out)))))
 
-(t/deftest create-team-invitations-email-cooldown
-  (with-mocks [mock {:target 'app.email/send! :return nil}]
-    (let [profile1 (th/create-profile* 1 {:is-active true})
-          team     (th/create-team* 1 {:profile-id (:id profile1)})
-
-          data     {::th/type :create-team-invitations
-                    ::rpc/profile-id (:id profile1)
-                    :team-id (:id team)
-                    :role :editor
-                    :emails ["cooldown-test@example.com"]}]
-
-      ;; First invitation sends email
-      (let [out (th/command! data)]
-        (t/is (th/success? out))
-        (t/is (= 1 (:call-count @mock))))
-
-      ;; Resending immediately should NOT send email (cooldown active)
-      (th/reset-mock! mock)
-      (let [out (th/command! data)]
-        (t/is (th/success? out))
-        (t/is (= 0 (:call-count @mock))))
-
-      ;; Resending to a different email should send email
-      (th/reset-mock! mock)
-      (let [data (assoc data :emails ["different@example.com"])
-            out  (th/command! data)]
-        (t/is (th/success? out))
-        (t/is (= 1 (:call-count @mock))))
-
-      ;; After cooldown expires, resending should send email
-      (th/reset-mock! mock)
-      (th/db-update! :team-invitation
-                     {:updated-at (ct/in-past "10m")}
-                     {:team-id (:id team)
-                      :email-to "cooldown-test@example.com"})
-      (let [data (assoc data :emails ["cooldown-test@example.com"])
-            out  (th/command! data)]
-        (t/is (th/success? out))
-        (t/is (= 1 (:call-count @mock)))))))
-
 (t/deftest update-team-with-invalid-name
   (let [profile (th/create-profile* 1 {:is-active true})
         team    (th/create-team* 1 {:profile-id (:id profile)})]

backend/test/backend_tests/rpc_webhooks_test.clj

@@ -155,7 +155,8 @@
                           :return {:status 200}}]
     (let [owner       (th/create-profile* 1 {:is-active true})
           viewer      (th/create-profile* 2 {:is-active true})
-          team        (th/create-team* 1 {:profile-id (:id owner)})]
+          team        (th/create-team* 1 {:profile-id (:id owner)})
+          whook       (volatile! nil)]
       (th/create-team-role* {:team-id (:id team)
                              :profile-id (:id viewer)
                              :role :viewer})
@@ -163,15 +164,52 @@
       (let [roles (th/db-query :team-profile-rel {:team-id (:id team)})]
         (t/is (= 2 (count roles))))
 
-      (t/testing "viewer cannot create a webhook (requires editor role)"
+      (t/testing "viewer creates a webhook"
         (let [viewers-webhook (create-webhook-params (:id viewer) (:id team))
               out             (th/command! viewers-webhook)]
+          (t/is (nil? (:error out)))
+          (t/is (= 1 (:call-count @http-mock)))
+
+          (let [result (:result out)]
+            (check-webhook-format result)
+            (t/is (= (:uri viewers-webhook) (:uri result)))
+            (t/is (= (:team-id viewers-webhook) (:team-id result)))
+            (t/is (= (::rpc/profile-id viewers-webhook) (:profile-id result)))
+            (t/is (= (:mtype viewers-webhook) (:mtype result)))
+            (vreset! whook result))))
+
+      (th/reset-mock! http-mock)
+
+      (t/testing "viewer updates it's own webhook (success)"
+        (let [params {::th/type :update-webhook
+                      ::rpc/profile-id (:id viewer)
+                      :id (:id @whook)
+                      :uri (:uri @whook)
+                      :mtype "application/transit+json"
+                      :is-active false}
+              out    (th/command! params)
+              result (:result out)]
+
+          (t/is (nil? (:error out)))
           (t/is (= 0 (:call-count @http-mock)))
-          (let [error      (:error out)
-                error-data (ex-data error)]
-            (t/is (th/ex-info? error))
-            (t/is (= (:type error-data) :not-found))
-            (t/is (= (:code error-data) :object-not-found)))))
+          (check-webhook-format result)
+          (t/is (= (:is-active params) (:is-active result)))
+          (t/is (= (:team-id @whook) (:team-id result)))
+          (t/is (= (:mtype params) (:mtype result)))
+          (vreset! whook result)))
+
+      (th/reset-mock! http-mock)
+
+      (t/testing "viewer deletes it's own webhook (success)"
+        (let [params {::th/type :delete-webhook
+                      ::rpc/profile-id (:id viewer)
+                      :id (:id @whook)}
+              out    (th/command! params)]
+          (t/is (= 0 (:call-count @http-mock)))
+          (t/is (nil? (:error out)))
+          (t/is (nil? (:result out)))
+          (let [rows (th/db-exec! ["select * from webhook"])]
+            (t/is (= 0 (count rows))))))
 
       (th/reset-mock! http-mock))))
 
@@ -230,26 +268,6 @@
           (t/is (= (:type error-data) :not-found))
           (t/is (= (:code error-data) :object-not-found)))))))
 
-(t/deftest webhooks-viewer-cannot-create
-  (with-mocks [http-mock {:target 'app.http.client/req
-                          :return {:status 200}}]
-    (let [owner  (th/create-profile* 1 {:is-active true})
-          viewer (th/create-profile* 2 {:is-active true})
-          team   (th/create-team* 1 {:profile-id (:id owner)})]
-      (th/create-team-role* {:team-id (:id team)
-                             :profile-id (:id viewer)
-                             :role :viewer})
-
-      (t/testing "viewer cannot create a webhook on the team"
-        (let [params (create-webhook-params (:id viewer) (:id team))
-              out    (th/command! params)]
-          (t/is (= 0 (:call-count @http-mock)))
-          (let [error      (:error out)
-                error-data (ex-data error)]
-            (t/is (th/ex-info? error))
-            (t/is (= (:type error-data) :not-found))
-            (t/is (= (:code error-data) :object-not-found))))))))
-
 (t/deftest webhooks-quotes
   (with-mocks [http-mock {:target 'app.http.client/req
                           :return {:status 200}}]
@@ -286,91 +304,3 @@
         (t/is (th/ex-info? error))
         (t/is (= (:type error-data) :restriction))
         (t/is (= (:code error-data) :webhooks-quote-reached))))))
-
-(t/deftest removed-user-cannot-edit-webhook
-  (with-mocks [http-mock {:target 'app.http.client/req
-                          :return {:status 200}}]
-
-    (let [owner  (th/create-profile* 1 {:is-active true})
-          editor (th/create-profile* 2 {:is-active true})
-          team   (th/create-team* 1 {:profile-id (:id owner)})]
-
-      (th/create-team-role* {:team-id (:id team)
-                             :profile-id (:id editor)
-                             :role :editor})
-
-      (let [params {::th/type :create-webhook
-                    ::rpc/profile-id (:id editor)
-                    :team-id (:id team)
-                    :uri (u/uri "http://example.com")
-                    :mtype "application/json"}
-            out    (th/command! params)]
-
-        (t/is (nil? (:error out)))
-        (let [whook (:result out)]
-
-          (th/reset-mock! http-mock)
-
-          (t/testing "owner can edit editor's webhook (team owns it)"
-            (let [params {::th/type :update-webhook
-                          ::rpc/profile-id (:id owner)
-                          :id (:id whook)
-                          :uri (u/uri "http://example.com/updated")
-                          :mtype "application/transit+json"
-                          :is-active true}
-                  out    (th/command! params)]
-              (t/is (nil? (:error out)))
-              (t/is (= 1 (:call-count @http-mock)))))
-
-          (th/reset-mock! http-mock)
-
-          (t/testing "remove editor from team"
-            (let [params {::th/type :delete-team-member
-                          ::rpc/profile-id (:id owner)
-                          :team-id (:id team)
-                          :member-id (:id editor)}
-                  out    (th/command! params)]
-              (t/is (nil? (:error out)))))
-
-          (th/reset-mock! http-mock)
-
-          (t/testing "removed editor cannot update webhook"
-            (let [params {::th/type :update-webhook
-                          ::rpc/profile-id (:id editor)
-                          :id (:id whook)
-                          :uri (u/uri "http://example.com/evil")
-                          :mtype "application/transit+json"
-                          :is-active true}
-                  out    (th/command! params)]
-              (t/is (= 0 (:call-count @http-mock)))
-              (let [error      (:error out)
-                    error-data (ex-data error)]
-                (t/is (th/ex-info? error))
-                (t/is (= (:type error-data) :not-found))
-                (t/is (= (:code error-data) :object-not-found)))))
-
-          (th/reset-mock! http-mock)
-
-          (t/testing "removed editor cannot delete webhook"
-            (let [params {::th/type :delete-webhook
-                          ::rpc/profile-id (:id editor)
-                          :id (:id whook)}
-                  out    (th/command! params)]
-              (t/is (= 0 (:call-count @http-mock)))
-              (let [error      (:error out)
-                    error-data (ex-data error)]
-                (t/is (th/ex-info? error))
-                (t/is (= (:type error-data) :not-found))
-                (t/is (= (:code error-data) :object-not-found)))))
-
-          (th/reset-mock! http-mock)
-
-          (t/testing "owner can still delete editor's webhook"
-            (let [params {::th/type :delete-webhook
-                          ::rpc/profile-id (:id owner)
-                          :id (:id whook)}
-                  out    (th/command! params)]
-              (t/is (nil? (:error out)))
-              (t/is (nil? (:result out)))
-              (let [rows (th/db-exec! ["select * from webhook"])]
-                (t/is (= 0 (count rows)))))))))))

backend/test/resources/sns-test-cert.pem

@@ -0,0 +1,19 @@
+-----BEGIN CERTIFICATE-----
+MIIDGDCCAgCgAwIBAgIJAMp8qfcfOi+AMA0GCSqGSIb3DQEBDAUAMDoxCzAJBgNV
+BAYTAlVTMQ0wCwYDVQQHEwRUZXN0MQ0wCwYDVQQKEwRUZXN0MQ0wCwYDVQQDEwRU
+ZXN0MB4XDTI2MDgwNTE1NTQxN1oXDTI3MDgwNTE1NTQxN1owOjELMAkGA1UEBhMC
+VVMxDTALBgNVBAcTBFRlc3QxDTALBgNVBAoTBFRlc3QxDTALBgNVBAMTBFRlc3Qw
+ggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDj18ep0Pm5Y8VdXOSH9kXv
+7RWzmxfNvN/zD1Fp2scADGBXnuVUhHYoR09Pe8U26X2gmDRg+JS7h6XXcGaWGUyh
+28HISH3J0XrnKQmDKO77kxWFOAeu5apP2NVv1Nndbv+VqQczZqNZ6Kq9juflHjfK
+hnnYiQqKZZ118IMCnu0uX26ShTwZJe7rAtO4MB4UNnfmAeRdrBOdI+1fp7QItYRc
+2ppK3pXo2MAh8WhFeUy2UrlW6w1FpRjG/8nMmr14mD/dP9aWW85vcht5sA19bU3I
+sf8ZOxOO9SGAk8Tg5Ey8aCdL5BU05OF8PNClOuqhHdGKShul3n2Pgojb2yGBHTYB
+AgMBAAGjITAfMB0GA1UdDgQWBBTQbRwLjgbx/S7j1S/QFNB5HakDEjANBgkqhkiG
+9w0BAQwFAAOCAQEAklxu68LkEdTFthA/ASyzm7KNxiWw+k+9IaEcViuwVa3XR2Ly
+cO3L00NznsctwtcbevIT6ZlaK454snnpc5qZWHZSTYjQP34svT+XUZkgT29JdiYe
+r5so+cUdorJyngMAen/tzpAHXV2l9SbRsi5+fRkR8DjPv9Ctz+kmh/Oy5fF3x/nu
+AVZiwO8Oq4M3r+ElEfFed+9MkIQ6OZ3+ezgRhJYlXzVzii1OYQYpndocGNB+Jgwy
+1FqzP1/02dzT6Oz95Md3B9fxj0OSCpCCBMo3ihkOKuNixaqyQ2+n/06Y+qpvnfuM
+YrXnhbdpH7hsJM0/xNjWJMQlP04+zr1CQ9V9tg==
+-----END CERTIFICATE-----

backend/test/resources/sns-test-key.pem

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvwIBADANBgkqhkiG9w0BAQEFAASCBKkwggSlAgEAAoIBAQDj18ep0Pm5Y8Vd
+XOSH9kXv7RWzmxfNvN/zD1Fp2scADGBXnuVUhHYoR09Pe8U26X2gmDRg+JS7h6XX
+cGaWGUyh28HISH3J0XrnKQmDKO77kxWFOAeu5apP2NVv1Nndbv+VqQczZqNZ6Kq9
+juflHjfKhnnYiQqKZZ118IMCnu0uX26ShTwZJe7rAtO4MB4UNnfmAeRdrBOdI+1f
+p7QItYRc2ppK3pXo2MAh8WhFeUy2UrlW6w1FpRjG/8nMmr14mD/dP9aWW85vcht5
+sA19bU3Isf8ZOxOO9SGAk8Tg5Ey8aCdL5BU05OF8PNClOuqhHdGKShul3n2Pgojb
+2yGBHTYBAgMBAAECggEAIPku65wTL+nI+9iAOE8DUxQoIlyNJtixPl9WpG+lghPI
+c5XK0Z7z7KNZToL2iRpkdHPijLAc8kDQ1uts5UcXCIuhsUcQcT8wPrj5J/KqF11z
+bVqs/fo92h1i0jLnLr0sHvAd2yn89PuPjixa0hU79MLeamB21o2bKqDajOwMHjwq
+bAFUED3rmQe0nLv1pJbCIUUqd4ZElx+/XV+Y0c329zfA0WzjJI2EkHCnsS4tQn50
+KX77Mzcbm9ujVQf2xsr5pnRscsCk2LrzXmAW4nOw5jpeWxxudvVTzARhpv46mj0j
+MN0EN00YSw9FAHXBwDrjzS6cvvkchmBTJCUpKcoEWQKBgQDmO23YlsHrtnpWZRKf
+BTu/uIObLHXgNt1yXby0mFk2BSe6L6yJDxalJQ1jxdyay73+LLBUdJwfg2K/jRdw
+PFDdOvSRpb42LxTJ0TQxNaXsr91FDmbkjj0rFk1ygZKd/79HZq7xKWsfHsyTfUI7
+wgYz9QaapYYM1t1+diXlWxupJQKBgQD9V+T0EsuOTof8goKcBNw6C8zPnif8mKwy
+qtFWVySWpcreq74Q9+qyhMzNKDQ2flb1Akc6J3CSSvZBR21IKuqk9Cgu3qMH5CrX
+pe8smw8LpPaO5adnHvRgPTih7tJ0u7jUErWhmavkqroEq6DmvngmQ/6w9nhwTaC4
+tWfJzPvIrQKBgQDA19qEZpJ7y1bhcruMMyf+yKCDo1QAwDPwjY94fXuMAflqvG/6
+RYckQMrcXWkQx8OWWPxBYYM76iMWaynMutjI1Y7xSDDw1bLF8NOUvGkEvbHLG+sX
+WgTmSEIKvXl/mi4vslSqb5TodjXI/Ew0HapwbrZfZnHH41mXiYLof83FeQKBgQDK
+91T1ee1c6GuoEINFLdumIXgHyeStST+EJDgsXQpyKwd6F8vhWk3MkfpmTtRt6BAQ
+oK+h1qEogygBKpFR5Rgx6W4cBsBEfTcZp9YTPXLzWEk0OKdCRZlxVPr/OQ+g+Bhe
+x1J+0lfVjjYTsdDprCUkOwtciUn6ZybhdGxfT3tUzQKBgQC2BxPNlzPJvRkLvfMJ
+fJXfM9g96Uy7to7a7+LcLB2+OEAt/5kQAMg6ishwwoNvxVMtdy5uLEYNpq74lnQ2
+bCVc7qc834edVMykhjlK5CLu0GiK2NM4aQavBNRGBoLF7I1Ih+tcToZFUC6W8YEU
+djPrILOfRncjBj+epHXo92Z0iA==
+-----END PRIVATE KEY-----

common/src/app/common/data.cljc

@@ -1173,15 +1173,6 @@
   [key coll]
   (sort-by key natural-compare coll))
 
-(defn normalize-string
-  "Normalizes a string by trimming leading/trailing whitespace.
-   Returns empty string for nil input. Non-string input is returned unchanged."
-  [s]
-  (cond
-    (nil? s) ""
-    (string? s) (str/trim s)
-    :else s))
-
 (defn sanitize-string [s]
   (if s
     (-> s

common/src/app/common/fressian.clj

@@ -31,11 +31,6 @@
   ([^String s, ^String encoding]
    (.getBytes s encoding)))
 
-;; --- DEPTH TRACKING
-
-(def ^:dynamic *read-depth* 0)
-(def ^:const max-read-depth 128)
-
 ;; --- LOW LEVEL FRESSIAN API
 
 (defn write-object!
@@ -46,13 +41,7 @@
 
 (defn read-object!
   [^Reader r]
-  (when (>= *read-depth* max-read-depth)
-    (throw (ex-info "maximum Fressian read depth exceeded"
-                    {:type :validation
-                     :code :max-read-depth-reached
-                     :hint "maximum Fressian read depth exceeded"})))
-  (binding [*read-depth* (inc *read-depth*)]
-    (.readObject r)))
+  (.readObject r))
 
 (defn write-tag!
   ([^Writer w ^String n]

common/test/common_tests/data_test.cljc

@@ -36,24 +36,6 @@
   (t/is (= "" (d/get-initials nil)))
   (t/is (= "" (d/get-initials "!!! ???"))))
 
-(t/deftest normalize-string-test
-  ;; nil input returns empty string
-  (t/is (= "" (d/normalize-string nil)))
-  ;; empty string returns empty string
-  (t/is (= "" (d/normalize-string "")))
-  ;; leading whitespace is trimmed
-  (t/is (= "hello" (d/normalize-string "  hello")))
-  ;; trailing whitespace is trimmed
-  (t/is (= "hello" (d/normalize-string "hello  ")))
-  ;; both leading and trailing whitespace are trimmed
-  (t/is (= "hello" (d/normalize-string "  hello  ")))
-  ;; internal whitespace is preserved
-  (t/is (= "hello world" (d/normalize-string "  hello world  ")))
-  ;; non-string input is returned unchanged
-  (t/is (= 42 (d/normalize-string 42)))
-  (t/is (= :keyword (d/normalize-string :keyword)))
-  (t/is (= true (d/normalize-string true))))
-
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;
 ;; Ordered Data Structures
 ;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;

common/test/common_tests/fressian_test.clj

@@ -21,8 +21,7 @@
   (:import
    java.time.Instant
    java.time.OffsetDateTime
-   java.time.ZoneOffset
-   java.util.UUID))
+   java.time.ZoneOffset))
 
 ;; ---------------------------------------------------------------------------
 ;; Helpers
@@ -525,18 +524,3 @@
     (t/is (d/ordered-map? rt))
     (t/is (= om rt))
     (t/is (= (keys om) (keys rt)))))
-
-(t/deftest decode-rejects-excessive-recursion-depth
-  ;; N2-01: deeply nested structures must be rejected before stack overflow
-  (let [depth  (+ fres/max-read-depth 50)
-        data   (reduce (fn [acc _i] [acc])
-                       :leaf
-                       (range depth))
-        encoded (fres/encode data)]
-    (try
-      (fres/decode encoded)
-      (t/is false "expected exception for excessive recursion depth")
-      (catch clojure.lang.ExceptionInfo e
-        (let [d (ex-data e)]
-          (t/is (= :validation (:type d)))
-          (t/is (= :max-read-depth-reached (:code d))))))))

frontend/packages/draft-js/index.js

@@ -22,8 +22,7 @@ export const {
 } = pkg;
 
 import DraftPasteProcessor from 'draft-js/lib/DraftPasteProcessor.js';
-import Immutable from "immutable";
-const {Map, OrderedSet} = Immutable;
+import {Map, OrderedSet} from "immutable";
 
 function isDefined(v) {
   return v !== undefined && v !== null;

frontend/packages/draft-js/package.json

@@ -8,7 +8,8 @@
   "author": "Andrey Antukh",
   "license": "MPL-2.0",
   "dependencies": {
-    "draft-js": "penpot/draft-js.git#c58ebd9429a6359d72a88cff87e078aaf6fe285d"
+    "draft-js": "penpot/draft-js.git#c58ebd9429a6359d72a88cff87e078aaf6fe285d",
+    "immutable": "^5.1.9"
   },
   "peerDependencies": {
     "react": ">=0.17.0",

frontend/pnpm-lock.yaml

@@ -18,6 +18,7 @@ overrides:
   postcss@<8.5.10: ^8.5.10
   yaml@>=2.0.0 <2.8.3: ^2.8.3
   playwright@>=1.61.1 <2.0.0-0: 1.62.1
+  immutable@<4.3.9: ^4.3.9
 
 patchedDependencies:
   '@zip.js/zip.js@2.8.34': 7b556bbd426f152eb086f0126a53900e369a95cf64357c380b7c8d8e940c3d95
@@ -270,6 +271,9 @@ importers:
       draft-js:
         specifier: penpot/draft-js.git#c58ebd9429a6359d72a88cff87e078aaf6fe285d
         version: https://codeload.github.com/penpot/draft-js/tar.gz/c58ebd9429a6359d72a88cff87e078aaf6fe285d(encoding@0.1.13)(react-dom@19.2.8(react@19.2.8))(react@19.2.8)
+      immutable:
+        specifier: ^5.1.9
+        version: 5.1.9
       react:
         specifier: '>=0.17.0'
         version: 19.2.8
@@ -2189,11 +2193,6 @@ packages:
 
   '@volar/typescript@2.4.28':
     resolution: {integrity: sha512-Ja6yvWrbis2QtN4ClAKreeUZPVYMARDYZl9LMEv1iQ1QdepB6wn0jTRxA9MftYmYa4DQ4k/DaSZpFPUfxl8giw==}
-    peerDependencies:
-      typescript: '*'
-    peerDependenciesMeta:
-      typescript:
-        optional: true
 
   '@webcontainer/env@1.1.1':
     resolution: {integrity: sha512-6aN99yL695Hi9SuIk1oC88l9o0gmxL1nGWWQ/kNy81HigJ0FoaoTXpytCj6ItzgyCEwA9kF1wixsTuv5cjsgng==}
@@ -3511,9 +3510,8 @@ packages:
     resolution: {integrity: sha512-BAg6QkE8W+TuQLrrw0Ugr7HegXduRuuj8/ti2kSOc+jz1dmx8/WNcjr6XGnq5YpDWxFwwaavqD0+jIUOKelTsw==}
     engines: {node: '>= 4'}
 
-  immutable@3.8.3:
-    resolution: {integrity: sha512-AUY/VyX0E5XlibOmWt10uabJzam1zlYjwiEgQSDc5+UIkFNaF9WM0JxXKaNMGf+F/ffUF+7kRKXM9A7C0xXqMg==}
-    engines: {node: '>=0.10.0'}
+  immutable@4.3.9:
+    resolution: {integrity: sha512-ObHy4YN7ycwZOUCLI1/6svfyAFu7vL8RhAvVu/bh/RZW9EPlOyDaQ9jDQWCtdqzaXUjgXZCW1migtHE7YI7UGQ==}
 
   immutable@5.1.9:
     resolution: {integrity: sha512-m8nVez3rwrgmWxtLMt1ZYXB2Lv7OKYn/disyxAlSDYAlKSlFoPPfIAmAM/M5xqL4m4C/wAPw7S2/CNaUii1Hxg==}
@@ -7561,13 +7559,11 @@ snapshots:
 
   '@volar/source-map@2.4.28': {}
 
-  '@volar/typescript@2.4.28(typescript@6.0.3)':
+  '@volar/typescript@2.4.28':
     dependencies:
       '@volar/language-core': 2.4.28
       path-browserify: 1.0.1
       vscode-uri: 3.1.0
-    optionalDependencies:
-      typescript: 6.0.3
 
   '@webcontainer/env@1.1.1': {}
 
@@ -8336,7 +8332,7 @@ snapshots:
   draft-js@https://codeload.github.com/penpot/draft-js/tar.gz/c58ebd9429a6359d72a88cff87e078aaf6fe285d(encoding@0.1.13)(react-dom@19.2.8(react@19.2.8))(react@19.2.8):
     dependencies:
       fbjs: 3.0.5(encoding@0.1.13)
-      immutable: 3.8.3
+      immutable: 4.3.9
       object-assign: 4.1.1
       react: 19.2.8
       react-dom: 19.2.8(react@19.2.8)
@@ -9085,7 +9081,7 @@ snapshots:
 
   ignore@7.0.6: {}
 
-  immutable@3.8.3: {}
+  immutable@4.3.9: {}
 
   immutable@5.1.9: {}
 
@@ -11201,7 +11197,7 @@ snapshots:
   unplugin-dts@1.0.3(@microsoft/api-extractor@7.56.2(@types/node@26.1.2))(esbuild@0.28.1)(rolldown@1.2.1)(rollup@4.61.1)(supports-color@10.2.2)(typescript@6.0.3)(vite@8.2.0(@types/node@26.1.2)(esbuild@0.28.1)(sass-embedded@1.100.0)(sass@1.102.0)):
     dependencies:
       '@rollup/pluginutils': 5.4.0(rollup@4.61.1)
-      '@volar/typescript': 2.4.28(typescript@6.0.3)
+      '@volar/typescript': 2.4.28
       compare-versions: 6.1.1
       debug: 4.4.3(supports-color@10.2.2)
       kolorist: 1.8.0

frontend/pnpm-workspace.yaml

@@ -32,3 +32,4 @@ overrides:
   postcss@<8.5.10: ^8.5.10
   yaml@>=2.0.0 <2.8.3: ^2.8.3
   playwright@>=1.61.1 <2.0.0-0: "1.62.1"
+  immutable@<4.3.9: ^4.3.9

frontend/src/app/main/data/profile.cljs

@@ -462,14 +462,11 @@
       ptk/WatchEvent
       (watch [_ _ _]
         (let [{:keys [on-error on-success]
-               :or {on-error identity
+               :or {on-error rx/throw
                     on-success identity}} (meta data)]
           (->> (rp/cmd! :recover-profile data)
                (rx/tap on-success)
-               (rx/catch (fn [err]
-                           (on-error err)
-                           (rx/empty)))
-               (rx/ignore)))))))
+               (rx/catch on-error)))))))
 
 ;; --- EVENT: fetch-team-webhooks
 

frontend/src/app/main/data/shortcuts.cljs

@@ -204,27 +204,20 @@
 
 (defn- bind!
   [shortcuts]
-  (let [entries (remove #(:disabled (second %)) shortcuts)
-        bind-fn (fn [[key {:keys [command fn type overwrite]}]]
-                  (let [callback  (wrap-cb key fn)
-                        commands  (if (vector? command)
-                                    (into-array command)
-                                    #js [command])]
-                    (if (vector? type)
-                      (do (mousetrap/bind commands callback (nth type 0) overwrite)
-                          (mousetrap/bind commands callback (nth type 1) overwrite))
-                      (let [undefined (js* "(void 0)")]
-                        (if type
-                          (mousetrap/bind commands callback type overwrite)
-                          (mousetrap/bind commands callback undefined overwrite))))))]
-    ;; Bind non-overwrite entries first so that entries flagged with
-    ;; `:overwrite` are bound last and can reliably splice out the
-    ;; colliding callbacks bound earlier (mousetrap's overwrite only
-    ;; removes callbacks that were already registered for the same
-    ;; combo). Map iteration order is hash-based, so we must force the
-    ;; order explicitly.
-    (run! bind-fn (remove (comp :overwrite second) entries))
-    (run! bind-fn (filter (comp :overwrite second) entries))))
+  (->> shortcuts
+       (remove #(:disabled (second %)))
+       (run! (fn [[key {:keys [command fn type overwrite]}]]
+               (let [callback  (wrap-cb key fn)
+                     commands  (if (vector? command)
+                                 (into-array command)
+                                 #js [command])]
+                 (if (vector? type)
+                   (do (mousetrap/bind commands callback (nth type 0) overwrite)
+                       (mousetrap/bind commands callback (nth type 1) overwrite))
+                   (let [undefined (js* "(void 0)")]
+                     (if type
+                       (mousetrap/bind commands callback type overwrite)
+                       (mousetrap/bind commands callback undefined overwrite)))))))))
 
 (defn- reset!
   ([]

frontend/src/app/main/data/workspace/clipboard.cljs

@@ -1217,7 +1217,7 @@
               (rx/mapcat (fn [blob]
                            ;; Resolve the deferred with the fetched blob; the browser
                            ;; will now complete the clipboard write it started earlier.
-                           (p/resolve deferred blob)
+                           (p/resolve! deferred blob)
                            (rx/from write-promise)))
               (rx/map (fn [_]
                         (ntf/success (tr "workspace.clipboard.image-copied"))))
@@ -1225,5 +1225,5 @@
                           (js/console.error "clipboard error:" e)
                           ;; Reject the deferred in case the error occurred before the
                           ;; blob was fetched, so the pending clipboard write is cancelled.
-                          (p/reject deferred e)
+                          (p/reject! deferred e)
                           (rx/of (ntf/error (tr "workspace.clipboard.image-copy-failed")))))))))))

frontend/src/app/main/data/workspace/path/shortcuts.cljs

@@ -37,7 +37,6 @@
                      :command "p"
                      :subsections [:path-editor]
                      :section [:workspace]
-                     :overwrite true
                      :fn #(st/emit! (drp/change-edit-mode :draw))}
 
    :add-node        {:tooltip (ds/shift "+")
@@ -50,9 +49,7 @@
                      :command ["del" "backspace"]
                      :subsections [:path-editor]
                      :section [:workspace]
-                     :overwrite true
-                     :fn #(st/emit!
-                           (drp/remove-node))}
+                     :fn #(st/emit! (drp/remove-node))}
 
    :merge-nodes     {:tooltip (ds/meta "J")
                      :command (ds/c-mod "j")
@@ -70,7 +67,6 @@
                      :command "k"
                      :subsections [:path-editor]
                      :section [:workspace]
-                     :overwrite true
                      :fn #(st/emit! (drp/separate-nodes))}
 
    :make-corner     {:tooltip "X"
@@ -83,7 +79,6 @@
                      :command "c"
                      :subsections [:path-editor]
                      :section [:workspace]
-                     :overwrite true
                      :fn #(st/emit! (drp/make-curve))}
 
    :snap-nodes      {:tooltip (ds/meta "'")
@@ -96,7 +91,6 @@
    :escape          {:tooltip (ds/esc)
                      :command ["escape" "enter" "v"]
                      :section [:workspace]
-                     :overwrite true
                      :fn #(st/emit! (esc-pressed))}
 
    :undo            {:tooltip (ds/meta "Z")

frontend/src/app/main/render.cljs

@@ -15,7 +15,6 @@
    ["react-dom/server" :as rds]
    [app.common.data :as d]
    [app.common.data.macros :as dm]
-   [app.common.exceptions :as ex]
    [app.common.files.helpers :as cfh]
    [app.common.geom.point :as gpt]
    [app.common.geom.rect :as grc]
@@ -60,7 +59,6 @@
    [rumext.v2 :as mf]))
 
 (def ^:const viewbox-decimal-precision 3)
-(def ^:const max-export-dimension 100000)
 (def ^:private default-color clr/canvas)
 
 (mf/defc background
@@ -84,20 +82,12 @@
       (let [bounds
             (->> root-objects
                  (map (partial gsb/get-object-bounds objects))
-                 (grc/join-rects))
-            bounds (-> bounds
-                       (update :x mth/finite 0)
-                       (update :y mth/finite 0)
-                       (update :width mth/finite 100000)
-                       (update :height mth/finite 100000))]
-        (when (or (> (:width bounds) max-export-dimension)
-                  (> (:height bounds) max-export-dimension)
-                  (> (+ (:x bounds) (:width bounds)) max-export-dimension)
-                  (> (+ (:y bounds) (:height bounds)) max-export-dimension))
-          (ex/raise :type :validation
-                    :code :export-area-too-large
-                    :hint "export area exceeds maximum allowed dimensions"))
+                 (grc/join-rects))]
         (-> bounds
+            (update :x mth/finite 0)
+            (update :y mth/finite 0)
+            (update :width mth/finite 100000)
+            (update :height mth/finite 100000)
             (grc/update-rect :position)
             (grc/fix-aspect-ratio aspect-ratio))))))
 

frontend/src/app/main/ui/auth/recovery.cljs

@@ -28,18 +28,8 @@
       (= password-1 password-2))]])
 
 (defn- on-error
-  [form error]
-  (let [{:keys [type code] :as edata} (ex-data error)]
-    (if (= [:validation :weak-password] [type code])
-      (let [details (:details edata)
-            options (when (seq details)
-                      (mapv tr details))]
-        (swap! form assoc-in [:extra-errors :password-1]
-               {:message (tr "errors.weak-password")
-                :options options}))
-
-      (let [msg (tr "errors.invalid-recovery-token")]
-        (st/emit! (ntf/error msg))))))
+  [_form _error]
+  (st/emit! (ntf/error (tr "errors.invalid-recovery-token"))))
 
 (defn- on-success
   [_]
@@ -48,7 +38,7 @@
 
 (defn- on-submit
   [form _event]
-  (let [mdata  {:on-error (partial on-error form)
+  (let [mdata  {:on-error on-error
                 :on-success on-success}
         params {:token (get-in @form [:clean-data :token])
                 :password (get-in @form [:clean-data :password-2])}]

frontend/src/app/main/ui/auth/register.cljs

@@ -21,7 +21,6 @@
    [app.util.i18n :as i18n :refer [tr]]
    [app.util.storage :as storage]
    [beicon.v2.core :as rx]
-   [cuerdas.core :as str]
    [rumext.v2 :as mf]))
 
 ;; --- PAGE: Register
@@ -104,20 +103,8 @@
                (st/emit! (ntf/error (tr "errors.email-already-exists")))
 
                [:validation :email-as-password]
-               (st/emit! (ntf/error (tr "errors.email-as-password")))
-
-               [:validation :weak-password]
-               (let [details  (:details edata)
-                     items    (when (seq details)
-                                (->> details
-                                     (map #(str "<li>" (tr %) "</li>"))
-                                     (str/join "")))
-                     detail   (when items
-                                (str "<ul>" items "</ul>"))]
-                 (st/emit! (ntf/show {:content (tr "errors.weak-password")
-                                      :detail detail
-                                      :type :toast
-                                      :level :error})))
+               (swap! form assoc-in [:errors :password]
+                      {:message (tr "errors.email-as-password")})
 
                (do
                  (when-let [explain (get edata :explain)]

frontend/src/app/main/ui/components/forms.cljs

@@ -180,17 +180,11 @@
 
       (cond
         (and touched? (:message error) show-error)
-        (let [message (:message error)
-              options (:options error)]
+        (let [message (:message error)]
           [:div {:id (dm/str "error-" input-name)
                  :class (stl/css :error)
                  :data-testid (dm/str data-testid "-error")}
-           message
-           (when (seq options)
-             [:ul {:class (stl/css :error-options)}
-              (for [opt options]
-                [:li {:key opt
-                      :class (stl/css :error-option)} opt])])])
+           message])
 
         ;; FIXME: DEPRECATED
         (and touched? (:code error) show-error)

frontend/src/app/main/ui/components/forms.scss

@@ -168,16 +168,6 @@
   font-size: deprecated.$fs-14;
 }
 
-.error-options {
-  margin-block: var(--sp-xxs);
-  padding-inline-start: var(--sp-l);
-  list-style-type: disc;
-}
-
-.error-option {
-  margin-block: var(--sp-xxs);
-}
-
 .hint {
   @include t.use-typography("body-small");
 

frontend/src/app/main/ui/dashboard/sidebar.scss

@@ -734,8 +734,8 @@
   display: flex;
   justify-content: center;
   align-items: center;
-  width: $sz-48;
-  height: $sz-48;
+  width: $sz-32;
+  height: $sz-32;
 
   &:hover {
     --icon-stroke: var(--color-accent-primary);

frontend/src/app/main/ui/settings/password.cljs

@@ -28,14 +28,6 @@
       (swap! form assoc-in [:extra-errors :password-1]
              {:message (tr "errors.email-as-password")})
 
-      :weak-password
-      (let [details (:details data)
-            options (when (seq details)
-                      (mapv tr details))]
-        (swap! form assoc-in [:extra-errors :password-1]
-               {:message (tr "errors.weak-password")
-                :options options}))
-
       (let [msg (tr "generic.error")]
         (st/emit! (ntf/error msg))))))
 

frontend/src/app/main/ui/shortcuts.scss

@@ -21,7 +21,7 @@
 
 .section-title,
 .subsection-title {
-  @include t.use-typography("headline-small");
+  @include t.use-typography("title-small");
 
   display: flex;
   align-items: center;
@@ -43,7 +43,6 @@
 }
 
 .subsection-title {
-  block-size: $sz-32;
   text-transform: none;
   padding-inline-start: var(--sp-m);
 }

frontend/src/app/plugins/register.cljs

@@ -35,7 +35,7 @@
   "Signals that plugins runtime has been initialized. Called by app.plugins/init-plugins-runtime."
   []
   (when (p/pending? runtime-ready-promise)
-    (p/resolve runtime-ready-promise true)))
+    (p/resolve! runtime-ready-promise true)))
 
 ;; Stores the installed plugins information
 (defonce ^:private registry (atom {}))

frontend/test/frontend_tests/plugins/tokens_test.cljs

@@ -385,18 +385,18 @@
         theme-id  (uuid/next)
         theme     (ctob/make-token-theme :id theme-id :group "mode" :name "Light")
         emitted   (atom [])
-        errors    (atom [])]
-    (with-redefs [u/locate-token-set         (constantly nil)
-                  u/locate-token-theme       (fn [_ id] (when (= id theme-id) theme))
-                  u/throw-validation-errors? (constantly true)
-                  dwtl/update-token-theme    (fn [id theme] {:id id :theme theme})
-                  st/emit!                   (fn ([event] (swap! emitted conj event) nil)
-                                               ([event & _] (swap! emitted conj event) nil))]
+        invalid   (atom [])]
+    (with-redefs [u/locate-token-set   (constantly nil)
+                  u/locate-token-theme (fn [_ id] (when (= id theme-id) theme))
+                  u/not-valid          (fn [_ code value] (swap! invalid conj [code value]))
+                  dwtl/update-token-theme (fn [id theme] {:id id :theme theme})
+                  st/emit!             (fn ([event] (swap! emitted conj event) nil)
+                                         ([event & _] (swap! emitted conj event) nil))]
       (let [theme-proxy (ptok/token-theme-proxy plugin-id file-id theme-id)]
         ;; Non-id, non-proxy arguments are rejected by the schema coercer.
-        (try (.addSet theme-proxy 42) (catch :default e (swap! errors conj e)))
-        (try (.removeSet theme-proxy nil) (catch :default e (swap! errors conj e)))
+        (.addSet theme-proxy 42)
+        (.removeSet theme-proxy nil)
         (t/is (empty? @emitted))
-        (t/is (= 2 (count @errors)))
-        (t/is (every? #(instance? js/Error %) @errors))))))
+        (t/is (= 2 (count @invalid)))
+        (t/is (every? #(= :error (first %)) @invalid))))))
 

frontend/test/frontend_tests/render_dimensions_test.cljs

@@ -1,78 +0,0 @@
-;; This Source Code Form is subject to the terms of the Mozilla Public
-;; License, v. 2.0. If a copy of the MPL was not distributed with this
-;; file, You can obtain one at http://mozilla.org/MPL/2.0/.
-;;
-;; Copyright (c) KALEIDOS INC Sucursal en España SL
-
-(ns frontend-tests.render-dimensions-test
-  (:require
-   [app.common.geom.rect :as grc]
-   [app.common.geom.shapes.bounds :as gsb]
-   [app.common.test-helpers.files :as cthf]
-   [app.common.test-helpers.ids-map :as cthi]
-   [app.common.test-helpers.shapes :as cths]
-   [app.common.types.shape :as cts]
-   [app.common.uuid :as uuid]
-   [app.main.render :as render]
-   [cljs.test :as t :include-macros true]))
-
-(defn- make-objects
-  "Create a proper objects map with a root frame and the given shapes."
-  [& shapes]
-  (let [root-frame (cts/setup-shape {:id uuid/zero
-                                     :type :frame
-                                     :parent-id uuid/zero
-                                     :frame-id uuid/zero
-                                     :name "Root Frame"
-                                     :shapes (mapv :id shapes)})
-        objects {uuid/zero root-frame}]
-    (reduce (fn [objs shape]
-              (assoc objs (:id shape) (assoc shape :frame-id uuid/zero)))
-            objects
-            shapes)))
-
-(t/deftest calculate-dimensions-normal-bounds
-  (t/testing "Normal bounding box should pass"
-    (let [shape1 (cts/setup-shape {:type :rect :x 100 :y 100 :width 200 :height 150})
-          shape2 (cts/setup-shape {:type :rect :x 400 :y 300 :width 100 :height 100})
-          objects (make-objects shape1 shape2)
-          result (render/calculate-dimensions objects nil)]
-      (t/is (some? result))
-      (t/is (<= (:width result) render/max-export-dimension))
-      (t/is (<= (:height result) render/max-export-dimension)))))
-
-(t/deftest calculate-dimensions-extreme-width
-  (t/testing "Extreme width should throw export-area-too-large"
-    (let [shape (cts/setup-shape {:type :rect :x 0 :y 0 :width 200000 :height 100})
-          objects (make-objects shape)]
-      (t/is (thrown-with-msg?
-             js/Error
-             #"export area exceeds maximum allowed dimensions"
-             (render/calculate-dimensions objects nil))))))
-
-(t/deftest calculate-dimensions-extreme-height
-  (t/testing "Extreme height should throw export-area-too-large"
-    (let [shape (cts/setup-shape {:type :rect :x 0 :y 0 :width 100 :height 200000})
-          objects (make-objects shape)]
-      (t/is (thrown-with-msg?
-             js/Error
-             #"export area exceeds maximum allowed dimensions"
-             (render/calculate-dimensions objects nil))))))
-
-(t/deftest calculate-dimensions-extreme-position
-  (t/testing "Shape at extreme position should throw export-area-too-large"
-    (let [shape (cts/setup-shape {:type :rect :x 500000 :y 500000 :width 100 :height 100})
-          objects (make-objects shape)]
-      (t/is (thrown-with-msg?
-             js/Error
-             #"export area exceeds maximum allowed dimensions"
-             (render/calculate-dimensions objects nil))))))
-
-(t/deftest calculate-dimensions-exactly-at-limit
-  (t/testing "Bounding box exactly at limit should pass"
-    (let [shape (cts/setup-shape {:type :rect :x 0 :y 0 :width render/max-export-dimension :height render/max-export-dimension})
-          objects (make-objects shape)
-          result (render/calculate-dimensions objects nil)]
-      (t/is (some? result))
-      (t/is (<= (:width result) render/max-export-dimension))
-      (t/is (<= (:height result) render/max-export-dimension)))))

frontend/test/frontend_tests/runner.cljs

@@ -51,7 +51,6 @@
    [frontend-tests.plugins.tokens-test]
    [frontend-tests.plugins.utils-test]
    [frontend-tests.plugins.value-objects-test]
-   [frontend-tests.render-dimensions-test]
    [frontend-tests.render-wasm.process-objects-test]
    [frontend-tests.render-wasm.text-editor-caret-color-test]
    [frontend-tests.svg-fills-test]
@@ -161,7 +160,6 @@
    'frontend-tests.ui.gradient-handlers-test
    'frontend-tests.ui.layout-container-multiple-test
    'frontend-tests.ui.measures-menu-props-test
-   'frontend-tests.render-dimensions-test
    'frontend-tests.text-editor-paste-guard-test
    'frontend-tests.ui.settings-password-schema-test
    'frontend-tests.ui.settings-shortcuts-test

frontend/translations/en.po

@@ -1748,34 +1748,6 @@ msgstr "Confirmation password must match"
 msgid "errors.password-too-short"
 msgstr "Password should at least be 8 characters"
 
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password"
-msgstr "Password does not meet the requirements"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.too-short"
-msgstr "At least 8 characters"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-lowercase"
-msgstr "At least 1 lowercase letter"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-uppercase"
-msgstr "At least 1 uppercase letter"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-digits"
-msgstr "At least 1 digit"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-special"
-msgstr "At least 1 special character"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.in-dictionary"
-msgstr "Password is too common"
-
 #: src/app/main/errors.cljs:267
 msgid "errors.paste-data-validation"
 msgstr "Invalid data in clipboard"

frontend/translations/es.po

@@ -1717,34 +1717,6 @@ msgstr "La contraseña de confirmación debe coincidir"
 msgid "errors.password-too-short"
 msgstr "La contraseña debe tener 8 caracteres como mínimo"
 
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password"
-msgstr "La contraseña no cumple los requisitos"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.too-short"
-msgstr "Al menos 8 caracteres"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-lowercase"
-msgstr "Al menos 1 letra minúscula"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-uppercase"
-msgstr "Al menos 1 letra mayúscula"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-digits"
-msgstr "Al menos 1 dígito"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.insufficient-special"
-msgstr "Al menos 1 carácter especial"
-
-#: src/app/main/ui/settings/password.cljs, src/app/main/ui/auth/register.cljs
-msgid "errors.weak-password.in-dictionary"
-msgstr "La contraseña es demasiado común"
-
 #: src/app/main/errors.cljs:267
 msgid "errors.paste-data-validation"
 msgstr "Datos inválidos en el portapapeles"

scripts/ci

@@ -23,7 +23,7 @@ ALL_MODULES=("frontend" "backend" "common" "render-wasm" "exporter" "mcp" "plugi
 # Module commands
 declare -A LINT_CMD=(
   [frontend]="pnpm run lint:clj && pnpm run lint:js && pnpm run lint:scss"
-  [backend]="pnpm run lint:clj"
+  [backend]="pnpm run lint"
   [common]="pnpm run lint:clj"
   [render-wasm]="./lint"
   [exporter]="pnpm run lint"