fix(security): close cross-tenant IDOR gaps in OAuth credential and execution auth#4549

Open

waleedlatif1 wants to merge 7 commits intostagingfrom

fix/security-idor-auth

Commits on May 10, 2026

fix(security): close IDOR gaps in OAuth credential and execution authorization
waleedlatif1
committed

Commits on May 11, 2026

fix(security): close verifyFileAccess bypass, thread workflowId to processQueuedResumes, fix log level
waleedlatif1
committed
fix(security): thread workflowId through all processQueuedResumes call sites
waleedlatif1
committed
fix(security): remove any types, drop extraneous comments, normalize caught errors
waleedlatif1
committed
fix: use logger.warn for credential access denial in outlook folders route
waleedlatif1
committed
fix(security): make workflowId required in all HITL pause/resume methods
waleedlatif1
committed
fix(security): thread workflowId through internal HITL cancellation calls and remove dead branches in credential-access
waleedlatif1
committed