Thanakorn 8705be0d1b Enforce roles on admin endpoints and return real status codes ...

- users, SMTP and batch-lock endpoints are owner/admin only
- engines answer 400/403/404/409/500 instead of 200 with an error body;
  database errors no longer leak to the client

2026-09-24 14:53:40 +07:00

..

api/engine

Enforce roles on admin endpoints and return real status codes

2026-09-24 14:53:40 +07:00

manage_purchase_invoice.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_purchase_order.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_purchase_request.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

manage_supplier_credit_note.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

payment.php

accounting workflows

2026-05-20 10:17:02 +07:00

purchase_invoice.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

purchase_order.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00

purchase_request.php

Start every session through session.php; idle timeout, app access and auth status codes

2026-09-24 14:30:35 +07:00