fix some other bugs of iam

This commit is contained in:
Montech
2026-10-11 16:01:15 +03:30
parent e4924a28f5
commit 025d223dac
227 changed files with 376 additions and 221 deletions
+3
View File
@@ -343,6 +343,9 @@ export const api = {
`/customer/auth/sso/logout-url?return_url=${encodeURIComponent(iamAppUrl(''))}`,
),
endSharedSession: () =>
request<{ ended: number }>('/customer/auth/logout', { method: 'POST', body: '{}' }),
// The three reads below identify the customer by TOKEN. They replaced
// /customers/:id, /:id/orders and /:id/ledger-entries, which took the id from
// the URL and let anyone read anyone (SEC-08).