Thanakorn
8705be0d1b
Enforce roles on admin endpoints and return real status codes
...
- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
database errors no longer leak to the client
2026-09-24 14:53:40 +07:00
Thanakorn
e579dd596c
Start every session through session.php; idle timeout, app access and auth status codes
2026-09-24 14:30:35 +07:00
Thanakorn
c915379e2e
Fix item counts, PR/QT conversions, validation and department loss
2026-09-15 16:11:47 +07:00
Thanakorn S
5ca6b49fd0
code audit fixes: require_once, issue flow, role guards
2026-05-23 17:06:08 +07:00
Thanakorn S
cf25732da0
use roles guards
2026-05-22 08:45:35 +07:00
Thanakorn S
91f8bb854f
review code pattern consistency
2026-05-20 13:07:57 +07:00
Thanakorn S
7396db6ffc
accounting workflows
2026-05-20 10:17:02 +07:00
Thanakorn S
04a683bd02
accounting modules
2026-05-13 15:11:24 +07:00
Thanakorn