No description

jtricerolph be670f724d Enforce granular capabilities across cashup ... Backend (server-side enforcement, not just UI): - auth.js: read caps from JWT; hasCap() + requireCap() helpers; legacy-token fallback (full access minus settings) so existing sessions keep working until re-login - finalise: submit final, delete draft, bulk-finalise, attachments - reports: multiday report, cash summary, debtors - floats: float management + safe count - settings: settings mutations (was is_admin) - count: draft save, newbook fetch Frontend: - can(user, cap) helper; User.caps from /verify - Nav items, routes and actions (Submit Final, delete, bulk-finalise) gated on capabilities; non-finalisers see a draft-only hint Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>		2026-07-02 14:19:30 +00:00
backend	Enforce granular capabilities across cashup	2026-07-02 14:19:30 +00:00
frontend	Enforce granular capabilities across cashup	2026-07-02 14:19:30 +00:00
docker-compose.yml	Pass SETTINGS_URL and SETTINGS_SECRET to backend container	2026-07-01 21:22:37 +00:00