2 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	c6a00df120	fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668) ... v3 port of the v2 authorization fixes. - Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and NotesController passes the bound model to authorize() on show/update/destroy. - Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice and InvoicesController::convertToEstimate authorize 'view' on the source document before creating the target. - Member bulk-delete (GHSA-wxrv): MembersController scopes ids via User::whereCompany() before MemberService::delete. Adds feature tests for cross-company 403s + same-company happy paths.	2026-06-12 11:02:08 +02:00
Darko Gjorgjijoski	8a6c085288	Rename company-scoped Users to Members throughout ... Complete rename across backend and frontend: - Controller: Company/Users/UsersController -> Company/Members/MembersController - Service: UserService -> MemberService - Requests: UserRequest -> MemberRequest, DeleteUserRequest -> DeleteMemberRequest - API routes: /api/v1/users -> /api/v1/members (company-scoped only) - Sidebar menu: "Users" -> "Members" - Frontend: views/users -> views/members, stores/users -> stores/members - Router: users.index -> members.index, /admin/users -> /admin/members - i18n: new "members" section with invitation-related keys - Tests: UserTest -> MemberTest Admin/super-admin Users (system-wide user management) remains unchanged.	2026-04-03 23:12:30 +02:00