No description
Six PUT /api/config/* routes were missing per-route capability checks — any authenticated hk-planner user could modify staff, time requirements, pickup data, tasks, adjustments, and last-reviewed regardless of their cap. Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com> |
||
|---|---|---|
| backend | ||
| frontend | ||
| .env.example | ||
| docker-compose.yml | ||
| seed-app.js | ||