Alex Dunmow
3967fa955a
Context does not cross the wasm ABI, so requireAdmin's auth.GetUserFromContext only sees claims if the guest rebuilds them from the host-stamped X-Bn-Verified-* headers. 2.0.3 never mounted auth.TrustedHeaderMiddleware, so every admin endpoint (settings save, event-types, test, rotate) returned 401 for real admins — the settings panel could not store the Cal.com API key. Mount the middleware on the router and pin the contract with a header-driven test (viewer headers must reach requireAdmin and 403, never 401): the existing admin tests injected claims straight into context, which is exactly the path wasm does not have. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
10 lines
400 B
Modula-2
10 lines
400 B
Modula-2
[plugin]
|
|
name = "calcomblock"
|
|
display_name = "Cal.com Booking"
|
|
scope = "@ninja"
|
|
version = "2.0.4"
|
|
description = "Embeddable Cal.com booking calendar block with custom styling, timezone-aware slot windowing, honeypot + captcha + rate-limited public booking endpoints, and webhook receiver."
|
|
kind = "plugin"
|
|
categories = ["forms"]
|
|
tags = ["calcom", "booking", "calendar", "scheduling", "appointments"]
|