- id: 1 title: 'Label #1' created_by_id: 1 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 - id: 2 title: 'Label #2' created_by_id: 1 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 - id: 3 title: 'Label #3 - other user' created_by_id: 2 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 - id: 4 title: 'Label #4 - visible via other task' created_by_id: 2 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 - id: 5 title: 'Label #5' created_by_id: 2 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 # Regression for GHSA-hj5c-mhh2-g7jq: only attached to task #34 # (project 20, user 13 only), must be unreachable for everyone else. - id: 6 title: 'Label #6 - private, attached only to private task' created_by_id: 13 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 # Covers the creator-can-read-own-unattached-label path. - id: 7 title: 'Label #7 - created by user 1, no task attachment' created_by_id: 1 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 # Covers the creator-branch maxPermission fallback: user 1's label whose # only label_tasks row points at task #34 (inaccessible to user 1). - id: 8 title: 'Label #8 - user 1 creator, only attached to inaccessible task' created_by_id: 1 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12 # Covers the bot-owner branch: created by bot 23, whose owner is user 21. # User 21 should be able to read/update/delete it; user 22 (who owns bot 24) # should not. - id: 9 title: 'Label #9 - created by bot 23 owned by user 21' created_by_id: 23 updated: 2018-12-02 15:13:12 created: 2018-12-01 15:13:12