Thanakorn
8705be0d1b
Enforce roles on admin endpoints and return real status codes
...
- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
database errors no longer leak to the client
2026-09-24 14:53:40 +07:00
Thanakorn
e579dd596c
Start every session through session.php; idle timeout, app access and auth status codes
2026-09-24 14:30:35 +07:00
Thanakorn S
5ca6b49fd0
code audit fixes: require_once, issue flow, role guards
2026-05-23 17:06:08 +07:00
Thanakorn S
7396db6ffc
accounting workflows
2026-05-20 10:17:02 +07:00
Thanakorn S
a24930f684
centralize roles guards
2026-05-07 09:26:39 +07:00
Thanakorn S
7cb78d013b
Complete security audit fixes
2026-03-09 14:31:39 +07:00
Thanakorn S
9a50080ae5
init wms
2026-02-19 14:48:40 +07:00
Thanakorn