Six PUT /api/config/* routes were missing per-route capability checks — any authenticated hk-planner user could modify staff, time requirements, pickup data, tasks, adjustments, and last-reviewed regardless of their cap. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| .. | ||
| src | ||
| Dockerfile | ||
| package.json | ||