Thanakorn
8705be0d1b
Enforce roles on admin endpoints and return real status codes
...
- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
database errors no longer leak to the client
2026-09-24 14:53:40 +07:00
Thanakorn
e579dd596c
Start every session through session.php; idle timeout, app access and auth status codes
2026-09-24 14:30:35 +07:00
Thanakorn S
0815ae3292
document number sequence
2026-05-26 08:19:40 +07:00
Thanakorn S
5c0166ae73
Seal live dashboard event gaps
2026-05-25 17:02:52 +07:00
Thanakorn S
5ca6b49fd0
code audit fixes: require_once, issue flow, role guards
2026-05-23 17:06:08 +07:00
Thanakorn S
cf25732da0
use roles guards
2026-05-22 08:45:35 +07:00
Thanakorn S
7396db6ffc
accounting workflows
2026-05-20 10:17:02 +07:00
Thanakorn