jared 9c4dd5df51 fix: admin-only suppression enforcement, links.html broken date parsing ...

Security: add require_admin decorator; apply to POST/DELETE /api/suppressions
and /suppressions page. Previously any user in allowed_groups could create or
delete suppressions even though the nav restricts the UI to admins.

Bug: links.html "Updated:" timestamp and stale-warning both produced
Invalid Date because the raw "YYYY-MM-DD HH:MM:SS UTC" string was appended
with 'Z' instead of being normalised through _toIso(). Fix both call sites to
use _toIso(), and remove the now-redundant local _toIso redefinition.

Style: use `with open(sentinel, 'w'): pass` consistently (was open().close()
at avatar JPEG validation path).

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>

2026-05-11 13:03:37 -04:00

..

base.html

fix: aria-required sync, aria-label pills, deduplicate setDuration logic

2026-05-11 12:58:32 -04:00

index.html

fix: diagnostic toggle hint, link_stats schema, pagination UX, rate-limit feedback

2026-05-11 12:01:56 -04:00

inspector.html

fix: inspector stale data warning, remove dead supported_modes code

2026-05-11 12:05:08 -04:00

links.html

fix: admin-only suppression enforcement, links.html broken date parsing

2026-05-11 13:03:37 -04:00

suppressions.html

fix: aria-required sync, aria-label pills, deduplicate setDuration logic

2026-05-11 12:58:32 -04:00