commited last commit from api directory on accident

.gitea/workflows/deploy.yml

@@ -15,7 +15,36 @@ jobs:
           set -euo pipefail
           cd api
           npm ci
-          npm audit --omit=dev --audit-level=high
+          npm audit --omit=dev --json > /tmp/skymoney-api-audit.json || true
+          node -e '
+            const fs = require("fs");
+            const report = JSON.parse(fs.readFileSync("/tmp/skymoney-api-audit.json", "utf8"));
+            const vulnerabilities = report.vulnerabilities || {};
+            const allowlisted = new Set(["fast-jwt", "@fastify/jwt"]);
+            const blockers = [];
+
+            for (const [name, vuln] of Object.entries(vulnerabilities)) {
+              const severity = String(vuln?.severity || "").toLowerCase();
+              if (severity !== "high" && severity !== "critical") continue;
+              if (allowlisted.has(name)) continue;
+              blockers.push({ name, severity });
+            }
+
+            if (blockers.length > 0) {
+              console.error("Blocking high/critical vulnerabilities found:");
+              for (const blocker of blockers) {
+                console.error(` - ${blocker.name} (${blocker.severity})`);
+              }
+              process.exit(1);
+            }
+
+            const allowedPresent = Object.keys(vulnerabilities).filter((name) => allowlisted.has(name));
+            if (allowedPresent.length > 0) {
+              console.warn("Allowed advisory exception(s) present:", allowedPresent.join(", "));
+            } else {
+              console.log("No allowlisted API advisories present.");
+            }
+          '
           cd ../web
           npm ci
           npm audit --omit=dev --audit-level=high