Darko Gjorgjijoski d3202b8b2a fix(members): scope member view & update to the acting company ...

Member view/update bound the target user by global id and authorized only that the requester owns their active company, not that the target belonged to it. Bind the route model under the members param and require shared company membership in UserPolicy so an owner of one company can no longer read or modify users of another.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-14 23:42:11 +02:00

..

Controllers

fix(members): scope member view & update to the acting company

2026-06-14 23:42:11 +02:00

Middleware

refactor(support): group Bouncer, Media, Setup files into subdirs

2026-04-11 15:00:00 +02:00

Requests

fix(members): scope member view & update to the acting company

2026-06-14 23:42:11 +02:00

Resources

refactor(modules): marketplace install flow with checksum validation

2026-04-10 17:30:00 +02:00