fix: address safe CodeRabbit findings from the #240 promotion review (#249)

* fix: address safe CodeRabbit findings from the promotion (#240) review

Six low-risk, verified fixes:
- Webhooks/dispatcher.js: guard against an undefined pending entry in the debounce callback (entry.doc could throw).
- gitlabOAuth/controller.js: add a 15s timeout to the token-exchange axios call (was unbounded).
- Admin/common/controller.js: drop an erroneous JSON.parse in the missing-file branch (makeDefaultBrandSettings resolves an object) - fixes a first-run 404 on getBrandSettingsData.
- Stickies/helpers/stickyRules.js: strict boolean for isPinned (the string 'false' no longer coerces to true).
- StickiesPanel.vue: clear the pending debounced save in remove() so it cannot fire a stale PUT after delete.
- README.md: 'Priority support & SLAs' -> 'response-time targets' to match SUPPORT.md.

Verified: node --check (backend), sticky-rules jest 16/16, StickiesPanel SFC compile.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix: scope updateMember role-promotion guard to PAT requests

Companion to #248: the owner-only role-promotion check in updateMember now runs only for PAT/MCP requests (req.apiToken), so the web app's role management behaves exactly as before. Same 2026-06-15 MCP-isolation hardening as permissionGuard.js.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: parth0025

Modules/Admin/common/controller.js

@@ -106,7 +106,9 @@ exports.getBrandSettingsData = (req, res) => {
         if (!fs.existsSync(filePath)) {
             exports.makeDefaultBrandSettings()
             .then((data) => {
-                res.status(200).json(withDemo(JSON.parse(data)));
+                // makeDefaultBrandSettings resolves an OBJECT (not a JSON string),
+                // so it must not be JSON.parse'd — that threw on first run.
+                res.status(200).json(withDemo(data));
             })
             .catch((error) => {
                 res.status(404).send(error);

Modules/Stickies/helpers/stickyRules.js

@@ -43,7 +43,8 @@ const validateStickyPayload = (payload = {}, { partial = false } = {}) => {
     }
 
     if (payload.isPinned !== undefined) {
-        out.isPinned = Boolean(payload.isPinned);
+        // Strict boolean — the string "false" must not coerce to true.
+        out.isPinned = payload.isPinned === true || payload.isPinned === 'true' || payload.isPinned === 1 || payload.isPinned === '1';
     }
 
     if (payload.sortIndex !== undefined) {

Modules/Webhooks/dispatcher.js

@@ -144,6 +144,7 @@ function onTaskEvent(type) {
                 timer: setTimeout(() => {
                     const entry = pending.get(key);
                     pending.delete(key);
+                    if (!entry) return; // key already replaced/cleaned up — nothing to flush
                     flush(companyId, event, entry.doc).catch((error) => {
                         logger.error(`${LOG_PREFIX} flush failed: ${error.message}`);
                     });

Modules/gitlabOAuth/controller.js

@@ -28,7 +28,7 @@ exports.getAccessToken = async (req, res) => {
             code,
             grant_type: "authorization_code",
             redirect_uri: redirectUri,
-        }, { headers: { Accept: "application/json" } });
+        }, { headers: { Accept: "application/json" }, timeout: 15000 });
 
         const accessToken = tokenResponse.data.access_token;
 

Modules/settings/Members/controller.js

@@ -219,10 +219,11 @@ exports.updateMember = async (req, res) => {
             });
         }
 
-        // Defense in depth (route is already owner/admin-gated): granting
-        // owner/admin (roleType 1/2) is OWNER-only — prevents an admin from
-        // promoting anyone (incl. self) to owner. Members never reach here.
-        if (data && data.roleType !== undefined) {
+        // Defense in depth: granting owner/admin (roleType 1/2) is OWNER-only.
+        // SCOPED TO PAT/MCP REQUESTS ONLY (req.apiToken) so the web app's role
+        // management behaves exactly as before — MCP changes must never affect
+        // existing frontend/backend behavior (2026-06-15).
+        if (req.apiToken && data && data.roleType !== undefined) {
             const { getRoleType, ROLE_OWNER, ROLE_ADMIN } = require('../../../Config/permissionGuard');
             const callerRole = await getRoleType(req.headers['companyid'] || '', req.uid);
             const targetRole = Number(data.roleType);

README.md

@@ -413,7 +413,7 @@ AlianHub is built and maintained by [Aliansoftware](https://aliansoftware.net).
 
 - 🚀 **Managed hosting & deployment** — on your infrastructure or ours
 - 🛠️ **Custom features & integrations** — tailored to your workflow
-- 🤝 **Priority support & SLAs** — [support@aliansoftware.net](mailto:support@aliansoftware.net)
+- 🤝 **Priority support & response-time targets** — [support@aliansoftware.net](mailto:support@aliansoftware.net)
 
 ---
 

frontend/src/components/molecules/Stickies/StickiesPanel.vue

@@ -259,6 +259,11 @@ function onReorder() {
 
 function remove(note) {
     openMenuId.value = null;
+    // Cancel any pending debounced save so it can't fire a stale PUT after delete.
+    if (saveTimers[note._id]) {
+        clearTimeout(saveTimers[note._id]);
+        delete saveTimers[note._id];
+    }
     apiRequest('delete', `/api/v2/stickies/${note._id}?uid=${encodeURIComponent(userId.value)}`)
     .then((response) => {
         if (response.data?.status) {