You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.

Thomas Joise 5865aafe06 fix(employees): purge sessions on password reset; reject empty patches and duplicate emails cleanly ... Review findings on the Phase 1-2 employee slice: - setEmployeePassword now deletes the employee's sessions in the same transaction — resetting a suspected-compromised password must not leave the attacker's existing 14-day bearer token valid (deactivateEmployee already did this; the reset path is the natural lockout action). - updateEmployee throws 'Nothing to update' when the patch resolves to zero recognized fields, instead of returning 200 and writing a no-op before==after audit row; PATCH /employees/:id with {} or wrongly-typed fields now 400s. - createEmployee pre-checks UNIQUE(email) inside the transaction and throws 'Email already in use' instead of surfacing the raw engine-specific 'UNIQUE constraint failed: staff_user.email' text (would differ on Postgres, the locked production engine — D15). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>		5 days ago
..
hq	fix(employees): purge sessions on password reset; reject empty patches and duplicate emails cleanly	5 days ago
hq-web	feat(clients): account-owner plumbing — client.owner_id, audited owner route, role gate	5 days ago