Platform Updates

Repository: Partners API. Status: Validation and documentation update; no change to live access rules.

What’s Changed: The release check now recognizes the exact partner-permission guard used by Social Publishing, and its membership-read check runs with the current Node toolchain.

Impact: Maintainers can run the full partner-permission certification again. Partner roles and dashboard access remain unchanged.

Upgrade Notes: No action is needed. The check passed all 20 permission-contract assertions and its membership concurrency test after the update.

Repositories: Partners, Partners API. Status: Linked production builds passed; signed-in hosted email journeys remain to verify.

New partner sign-in emails put their one-time code after the # in the confirmation link, so opening the link does not send the code with the page request. Links already sent with a query string still work. Sign-in, password-reset, invitation and email-action pages clear one-time details from the browser address bar as soon as they open, while keeping the details in memory long enough to complete the usual action. A failed or expired link still offers a way back to sign in. The dashboard also stops sending page addresses as referrers and asks browsers not to cache these four entry pages. Request a fresh email if a link has expired.

Local browser checks reproduced the address-bar issue before the change, then passed after it. They covered old and new sign-in links, invitation and reset screens, email-action Continue buttons, and password recovery with and without MFA. API link checks preserved the existing format for other sites. Dashboard and API typechecks, production builds and a production dependency audit passed. Both linked production builds passed; all four live entry pages returned no-referrer and no-store, and a hosted browser check cleared a sample query and fragment without sending the query in asset referrers. Signed-in email delivery remains to verify.

Repository: Partners. Status: Linked dashboard build and database migration passed; signed-in hosted verification remains pending.

Partner asset actions now use the same effective permissions at the database boundary as the dashboard API, including active role templates, individual changes and asset-specific grants. Policy approval and rejection also require a recent security verification even when the database function is called directly. Authorized operators can continue using the normal asset workflows.

The asset register, operations and settings browser fixtures passed before and after the change. The updated SQL parsed, dashboard typecheck and build passed, and the migration dry run selected only this change. The published database migration passed rollback-only permission and recent-verification checks. Signed-in hosted asset actions still need verification.

Repositories: Partners, Partners API. Status: Git-linked dashboard and API production builds passed; signed-in hosted campaign editing remains to verify.

Event finance managers can continue using relative campaign landing paths and attribution links. A path that would send an attendee to another site is now rejected when saving a campaign. The dashboard also withholds the share link for any older campaign with an unsafe stored path. Correct the landing path and save the campaign to restore its share link.

The local affiliate browser fixture passed before and after the change, including an ordinary campaign link. Focused API path checks, finance security contracts, typechecks and production builds passed. Linked production deployments passed; a signed-in hosted campaign save and copy remains to verify.

Repository: Partners. Status: Git-linked dashboard production build passed; signed-in hosted download remains to verify.

Event operators can still download a planning folder as a ZIP. When its combined files exceed the browser-safe 512 MiB limit, the dashboard now explains the limit and offers the existing individual file downloads. ZIP checksums are calculated as files stream through the browser, so ordinary archives no longer require an extra full-file memory copy.

A local test reproduced the oversized ZIP before the change and confirmed the limit afterward. Existing ZIP contents and checksums, download retry and individual downloads passed browser and contract checks. Dashboard typecheck and production build passed. The linked production deployment passed; authenticated hosted downloads remain to verify.

Repositories: Partners, Partners API. Status: Git-linked dashboard and API production builds passed; signed-in hosted journeys remain to verify.

When a partner signs into a different account in another browser tab, the first tab now refreshes its dashboard session and shows the new account’s workspace. The previous account’s details remain hidden throughout the switch. Changing the active partner in another tab also refreshes the selected scope.

Facilitator-private meeting notes and draft minutes follow the meeting’s department boundary. A lead for a different department cannot read those private details or add notes without an invitation. Invited participants outside the department can record a shared note without changing minutes or seeing private controls. The organizer, note author, authorized department lead and project-wide editor retain their expected access. Minutes approval records now use the signed-in operator and server time; ordinary minutes without approval fields still work. A live read-only count found no active facilitator-private or confidential meeting notes requiring historical cleanup.

Local two-tab browser and direct API route tests reproduced the gaps before the fixes and checked authorized and denied paths afterward. Typechecks and builds passed. The linked dashboard and API production builds passed; the public dashboard responded and a protected planning route rejected unauthenticated access. Signed-in hosted behavior remains to verify.

Repositories: Partners, Partners API. Status: Git-linked dashboard and API releases, database permission migration, and one-hour hosted Auth setting verified. Signed-in hosted journeys remain to verify.

Email confirmation and recovery buttons accept only their intended destinations. Dashboard and survey CSV exports protect spreadsheet cells containing formulas. Notices, profile details and authenticator setup stay with the correct account even when a previous account’s request finishes late. Private planning notes stay in the note record instead of being copied into shared minutes, and meeting members cannot read another author’s facilitator-private note unless they organize or coordinate the meeting. Planning meeting responses, notes, comments, watchers, linked resources and record updates follow the same resource visibility rules as reads. Server-only event, check-in and poll operations reject direct public database calls while continuing through the authorized API. The dashboard Markdown sanitizer dependency is updated.

Partners and event operators can continue normal confirmation, recovery, downloads and meeting work. Confirmation and invitation links expire after one hour; request a fresh message if a link expires. The email-template publisher uses the same configured expiry so future template updates keep that limit. Private notes use a note-only action; shared notes can still create minutes. Members excluded from a planning resource cannot change, archive or inspect its state or receive its comments and links. Assigned delivery updates remain available across departments.

Local browser and API fixtures reproduced the issues before the fixes and verified legitimate paths afterward. Typechecks, builds and a production dependency audit passed. The linked dashboard and API production builds passed; the public dashboard responded, protected planning routes rejected unauthenticated requests, and live database grants deny direct public calls to seven server-only operations while preserving server access. Hosted Auth now reports a one-hour lifetime and the invitation and confirmation messages match it. Signed-in hosted workflows remain to verify.

Repositories: Partners API, Partners, CMS. Status: Eight database migrations published; Git-linked API, dashboard and CMS releases verified.

A repository-wide security review closed 48 validated findings across partner and event isolation, authorization failure handling, registration and commerce ownership, transfers, private social media delivery, Google Wallet, CMS access and password recovery. Authorized partner and event workflows keep their existing behavior. Stale capabilities, cross-tenant records and requests whose permissions cannot be verified now fail earlier.

The release adds atomic ownership checks for event-shop inventory and Wallet classes, tighter guards around event-owned records and registration catalog data, subject-level transfer privacy, encrypted private-image delivery, independent appeal review and patched production dependencies. CMS partner sessions now use short-lived, owner-bound API capabilities through the proxy. Thirteen remaining legacy CMS provider tokens were revoked after a dry run, and the follow-up inventory returned zero. Development tools were also upgraded, and Apps Script ignore patterns now reject oversized or deeply nested input before the upstream CLI processes them.

Validation covered the immutable full-repository scan, focused before-and-after route and database regressions, API and dashboard typechecks, production builds, a Worker dry build, CMS handoff and proxy checks, zero production dependency vulnerabilities, exact migration-history reconciliation and live fail-closed access checks. The full dependency audit was reduced from 18 records to three records for one development-only upstream pattern parser advisory that has no patched release; its reachable repository input is now bounded and regression-tested. Cloudflare reports the pushed commits as the active production deployments, and all eight reviewed migrations are present remotely. Authenticated end-to-end CMS editing and provider-delivery journeys were not repeated during this release.

Repositories: Partners, Partners API. Status: Migration published; Git-linked API and dashboard releases verified.

Selecting a partner keeps an FPH administrator’s platform access and also grants the selected partner’s administrator access. A separate partner-admin membership is not required or created. EPS member position/title editing and plan notification settings now follow this rule, alongside staff-directory management.

Event Page verification also follows the scoped administration rule, including the continuing validation of an approval’s issuer. The exact FPH administrator role must belong to the enabled canonical platform partner, and the selected partner must be enabled. Department leads and other FPH roles do not inherit these administrator permissions. Existing ordinary partner permission checks, staff-directory privacy and expiry controls remain in force.

Checks passed 79 title HTTP, 45 title database, 45 notification HTTP, 49 Event Page fixtures, 7 title browser and 12 directory browser scenarios, plus typechecking and production builds. The live title migration and protected database grants were verified. Authenticated production actions remain untested.

Repositories: Partners, Partners API. Status: Migration published; Git-linked API and dashboard deployments and live expiry assets verified.

FPH administrators and an event plan’s owning partner administrators can choose 30, 90 or 180 days, or 1, 2 or 3 years for a new staff-directory credential. Open the plan’s Departments page and select Credential expiry before enabling or rotating the integration. The default remains 90 days. Existing credentials keep their current expiry until rotated; rotation immediately replaces the previous credential.

The API and database enforce the supported durations, capped at 1,095 days. Sharing remains plan-scoped, limited to the six approved staff profile fields, and protected by recent multifactor authentication and hash-only persistence. Member title editing remains restricted to the owning partner’s administrators.

Validation passed 63 HTTP, 63 isolated database, 22 authority and 12 browser scenarios, plus API/frontend typechecking and production builds. The hosted migration and denied browser database privileges were verified. Browser screenshots use sample responses; authenticated production credential issuance remains untested.