You cannot select more than 25 topics
Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
5865aafe06
Review findings on the Phase 1-2 employee slice:
- setEmployeePassword now deletes the employee's sessions in the same
transaction — resetting a suspected-compromised password must not leave
the attacker's existing 14-day bearer token valid (deactivateEmployee
already did this; the reset path is the natural lockout action).
- updateEmployee throws 'Nothing to update' when the patch resolves to
zero recognized fields, instead of returning 200 and writing a no-op
before==after audit row; PATCH /employees/:id with {} or wrongly-typed
fields now 400s.
- createEmployee pre-checks UNIQUE(email) inside the transaction and
throws 'Email already in use' instead of surfacing the raw
engine-specific 'UNIQUE constraint failed: staff_user.email' text
(would differ on Postgres, the locked production engine — D15).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
5 days ago | |
|---|---|---|
| .. | ||
| scripts | 1 week ago | |
| src | 5 days ago | |
| test | 5 days ago | |
| .env.example | 1 week ago | |
| build-server.mjs | 2 weeks ago | |
| package.json | 2 weeks ago | |
| schema.sql | 2 weeks ago | |
| tsconfig.json | 2 weeks ago | |