David Montero 1aae505aa7 fix(P2.2-sec): visibility-gate cross-tenant custom-library resolution ... The compile scope resolved a project OWNER's per-user custom libraries for ANY project_id a requester supplied, with no visibility check — so a requester who knew a victim's PRIVATE project_id + custom-lib name could compile a binary against the victim's private uploaded library. Replace the ungated get_project_owner hook with resolve_compile_owner(project_id, requester_id), which returns the owner ONLY when the requester IS the owner OR the project is shareable (public/unlisted); otherwise None -> the caller falls back to the requester's OWN store. Fails closed on any error. Also gate the server-side manifest fallback by the same rule (symmetry): a private project's declared library NAMES are no longer read into a non-owner's compile scope. The owner's own compile and shared/embed compiles of public/ unlisted projects keep their backend-authoritative scope unchanged.		2026-06-08 00:36:29 +02:00
..
routes	fix(P2.2-sec): visibility-gate cross-tenant custom-library resolution	2026-06-08 00:36:29 +02:00
__init__.py	feat: Implement Arduino Simulator with component management and simulation features	2026-03-03 00:20:49 -03:00