Molecule AI Backend Engineer 993d39a74e fix(wsauth): restore ValidateAnyToken removed-workspace JOIN (#682 defense-in-depth), restore ADR-001 blast-radius docs ... - ValidateAnyToken: add JOIN on workspaces with AND w.status != 'removed' so tokens belonging to deleted workspaces cannot be replayed against admin endpoints even before the token row is explicitly revoked. - tokens_test.go: update ValidateAnyToken regexp patterns to match new JOIN query; add TestValidateAnyToken_RemovedWorkspaceRejected. - wsauth_middleware_test.go: update validateAnyTokenSelectQuery constant to match JOIN query; add TestAdminAuth_RemovedWorkspaceToken_Returns401 to pin the AdminAuth removed-workspace rejection at the middleware layer. - ADR-001: restore full blast-radius endpoint table (15 affected admin routes), explicit risk statement ("full platform takeover"), current mitigations, and Phase-H remediation plan (schema, middleware, bootstrap flow, migration path). Tracking issue: #710.		2026-04-17 12:25:44 +00:00
..
ADR-001-admin-token-scope.md	fix(wsauth): restore ValidateAnyToken removed-workspace JOIN (#682 defense-in-depth), restore ADR-001 blast-radius docs	2026-04-17 12:25:44 +00:00