SIMS
/
sims-hq
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
main
feat/client-detail-redesign
Branches Tags
${ item.name }
Create tag ${ searchTerm }
Create branch ${ searchTerm }
from '54cde7961b'
${ noResults }
sims-hq/apps/hq/test
History
Thomas Joise 54cde7961b fix(sec/d24): gate destructive/sensitive ops to managerial 
Red-team authorization findings:
- New requireManagerial middleware. Applied to POST /documents/:id/cancel,
  /credit-note (financially destructive — reverse money / consume a number)
  and /documents/:id/share (mints an UNAUTHENTICATED public PDF link — the
  IDOR exfiltration high). Any signed-in staff could previously do all three.
- PATCH /interactions/:id now 403s unless the viewer is the interaction's
  author or managerial — staff can no longer overwrite another employee's
  logged call/visit.
New authz-gates test locks both. Note (deliberate): general client read/edit
stays open to staff — a shared support-team book is the intended model; the
genuinely sensitive credential reveals are already managerial + rate-limited.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
 		4 days ago
..
fixtures feat(hq): seed + apex csv importer with verification and series seeding (HQ-1 task 13) 2 weeks ago
amc.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
auth.test.ts fix(sec/d24): auth hardening — login lockout, rate limits, constant-time, trust proxy 4 days ago
authz-gates.test.ts fix(sec/d24): gate destructive/sensitive ops to managerial 4 days ago
aws-costs.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
aws-pull-route.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
aws-repo.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
bounces.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
client-modules.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
client-owner.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
client-support.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
clients.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
convert-and-send.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
dashboard.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
db.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
documents-page.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
documents.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
due-dates.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
e2e.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
employees-routes.test.ts fix(sec/d24): auth hardening — login lockout, rate limits, constant-time, trust proxy 4 days ago
employees.test.ts fix(sec/d24): auth hardening — login lockout, rate limits, constant-time, trust proxy 4 days ago
gmail-connect.test.ts feat(hq): one-time gmail oauth connect script (HQ-1 task 12) 2 weeks ago
gmail.test.ts feat(hq): gmail send with token-death handling and email log (HQ-1 task 11) 2 weeks ago
health.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
hq2-schema.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
hq3-schema.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
import-apex-full.test.ts feat(d21): P4 — importer seeds module field_spec + writes field_values 4 days ago
import-routes.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
import.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
interactions.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
isolation.test.ts feat(hq): HQ-1.5 — module quote content, pack pick-lists, bundle isolation check 2 weeks ago
milestones.test.ts feat(d22): P1 — onboarding milestone tracker (backend) + monotonic uuidv7 4 days ago
module-fields.test.ts feat(d21): P1+P2 — module-defined field schema (backend) 4 days ago
module-roster.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
modules.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
payments.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
pdf-download.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
pg-engine.test.ts feat(db): D19 P4 — DATABASE_URL engine selection + Postgres integration suite 4 days ago
pipeline.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
prepare-draft.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
preview-fidelity.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
preview-route.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
preview-sample.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
profile-me.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
public-share.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
quote-followup.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
receipt.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
recurring.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
reminder-preview.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
reminder-schedule.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
reminders-page.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
reminders.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
reports.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
scheduler-recurring.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
scheduler-scan.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
send-reminder.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
series.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
settings-company.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
settings-reminders.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
settings-sharing.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
settings-template.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
shares.test.ts feat(db): D19 P1-P3 — async DB interface, dual engines, Postgres adapter 4 days ago
sms-rate-card.test.ts feat(d23): SMS volume-band billing (dated rate card, money locked) 4 days ago
template-accent.test.ts feat(hq): beautify document template — "Slate Ledger" visual system + template.accent 1 week ago
template-render.test.ts feat(hq): render editable template.* letterhead fields with default fallback 1 week ago
templates.test.ts feat(templates): section-per-module quotation PDF (Phase 9, D18 WS-H) 5 days ago
tickets.test.ts feat(d20): P2 — ticket/branch/service-data routes, gated + audited 4 days ago