2b1adaa496
case 4712 - customer contacts limited to the routes the customer screens use
...
Customer contacts had the Customer role's Select and read rights on most record
types and could call any route whose staff role check they passed, including
several with no role check (security review F13 to F17). Step 1 of 4712: the
token middleware now answers 403 (same body as other 403s) to Customer and
HeadOffice users for any route not in CustomerContactRoutes, the routes the
customer screens use (read from raven-client). Anonymous routes are always
allowed. New routes stay closed to contacts unless added on purpose.
Ownership of the records these routes return follows in the next steps.
Checked: full integration suite 103 passed, 5 skipped, the same 2 known
failures as the baseline.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com >
2026-10-24 13:44:02 -07:00
b7b2a3009c
2023-02-22 23:51:00 +00:00
80242d598f
2023-02-22 23:50:01 +00:00
102c145386
Cleanup and better comments to clarify licensing code
2022-10-25 20:30:57 +00:00
940ea816ba
2022-02-01 19:24:46 +00:00
b1880ecf04
2021-07-13 17:55:36 +00:00
56d8cc27cb
Renamed roles and trans keys "Limited"->"Restricted" "Full" -> ""
2021-07-12 17:19:09 +00:00
92067c1be2
2021-04-16 21:54:57 +00:00
dde1b8bb8c
rename all variants of naming that hold an AyaType value to "aType" (parameter) / "AType" (not parameter) everywhere front and back; "ayType", "objectType", "oType" all are used in various areas
2021-03-23 17:06:05 +00:00
040e12c978
2021-03-17 00:11:42 +00:00
89c411bc28
2021-03-16 17:14:35 +00:00
7927fce640
2021-03-03 17:33:14 +00:00
eec26f92de
2021-03-03 00:50:15 +00:00
1b07953f59
2021-03-02 23:03:11 +00:00
0b631228b9
2021-01-28 18:24:27 +00:00
3c5585b2ec
2020-12-22 20:33:48 +00:00
fca43b0f61
2020-12-09 20:11:12 +00:00
f264f012ed
2020-11-27 19:55:33 +00:00
945de40c16
2020-11-27 16:14:14 +00:00
b18a87bdf5
2020-10-26 20:42:16 +00:00
03352e2799
UPDATED TO .net5 Tests ok so far, had to edit a package file just click on it and add a ) if necessary
2020-09-24 16:14:07 +00:00
739db128cd
2020-08-12 19:29:25 +00:00
6d1d753433
2020-08-06 17:07:21 +00:00
b67dba6363
2020-08-05 19:03:20 +00:00
3c650ba980
2020-07-21 22:01:54 +00:00
3a987f3477
2020-06-26 20:06:58 +00:00
4412b3ca48
2020-06-25 17:24:10 +00:00
59f4c6a9d2
auto license fetching now and generator more solid
2020-06-15 19:26:29 +00:00
746f60af15
2020-06-10 23:51:25 +00:00
7ffee42684
2020-06-10 13:53:59 +00:00
bbcbdd86d0
clean up and various little improvements after search for static wasted memory objects (not found) At this point it appears I don't have any leaks and it's all pretty efficient.
2020-06-05 23:36:44 +00:00
c2f6fd94c1
Ditched app.metrics
2020-05-24 21:51:03 +00:00
fd8c489914
changed all lambda experssion variables to z from various where appropriate
2020-05-18 19:42:42 +00:00
07390b6a31
Removed unused readOnly property on return response
2020-05-18 16:25:08 +00:00
8f3118d309
ayType aytype all now AyaType or ayaType
2020-05-15 21:08:37 +00:00
bb10dc726d
Removed v7 import shit
2020-05-01 01:00:39 +00:00
3e1323ee1d
2020-04-05 23:33:10 +00:00
8443c7c5bf
server state cleanup
2020-04-05 21:35:42 +00:00
e367b4b132
2020-04-05 20:38:08 +00:00
442c794681
2020-04-03 18:50:11 +00:00
2cf681d7d7
2020-03-12 19:25:20 +00:00
a234b3531d
Locale -> Translation
2020-03-06 19:36:36 +00:00
684f7be73d
2020-02-13 20:50:53 +00:00
8d2c57e702
2020-02-13 16:13:56 +00:00
ddbc8d5471
2020-02-11 23:46:28 +00:00
9ae5156105
2020-02-11 23:03:41 +00:00
9625baa8da
2020-02-11 22:55:58 +00:00
4f0a2d08da
2020-01-28 00:28:52 +00:00
20728c0224
2020-01-27 18:34:38 +00:00
452dc30484
2020-01-23 20:47:22 +00:00
