2 Commits (4e2b71cf9f8bd1d69477f13921b952fdf681735a)

Author	SHA1	Message	Date
Thomas Joise	5865aafe06	fix(employees): purge sessions on password reset; reject empty patches and duplicate emails cleanly ... Review findings on the Phase 1-2 employee slice: - setEmployeePassword now deletes the employee's sessions in the same transaction — resetting a suspected-compromised password must not leave the attacker's existing 14-day bearer token valid (deactivateEmployee already did this; the reset path is the natural lockout action). - updateEmployee throws 'Nothing to update' when the patch resolves to zero recognized fields, instead of returning 200 and writing a no-op before==after audit row; PATCH /employees/:id with {} or wrongly-typed fields now 400s. - createEmployee pre-checks UNIQUE(email) inside the transaction and throws 'Email already in use' instead of surfacing the raw engine-specific 'UNIQUE constraint failed: staff_user.email' text (would differ on Postgres, the locked production engine — D15). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	5 days ago
Thomas Joise	1af7b87aab	feat(hq): employee foundation — manager role, employee repo, session hardening (phase 1) ... - rebuildTable helper: guarded, txn-wrapped CHECK-constraint rebuild (SQLite-only path) - staff_user.role CHECK widened to owner|manager|staff (SCHEMA + migrate for old DBs) - repos-employees.ts: list/get/create/update/setPassword/deactivate/reactivate, audited in-txn, password columns never selected, last-active-owner + self guards - verifySession requires active=1; deactivation purges sessions in the same txn - 9 tests (apps/hq/test/employees.test.ts); suite now 186 green Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	5 days ago