Tribu

Security Hardening

Invitation Flow

• Admin invitations now require is_adult_preset=True — creating an admin invite for a non-adult is rejected with 400
• Registration via invite defensively demotes admin to member if the invitation has an inconsistent adult flag

PAT Scope Enforcement

• 22 endpoints across backup, notifications, nav, admin settings, and auth now enforce require_scope() for PAT least-privilege
• New admin:read and admin:write scopes for backup and admin settings (separated from families:*)
• Non-admin users cannot create PATs with admin:* scopes
• Admin settings GET endpoints now verify admin membership (previously only PUT endpoints did)

Avatar Upload Validation

• Profile image uploads now validate data URL format, MIME type whitelist (JPEG, PNG, WebP, GIF), and a 2 MB size limit
• Pre-decode size check prevents large allocation DoS before base64 decoding

Frontend

• PAT scope chooser labels are now i18n-aware (EN + DE) instead of hardcoded English
• Admin scope module only visible to admin users in the token creation UI

Other

• Dependency bump: Next.js (#143)