Adam Moussa 522f4593c6 Gate web UIs behind auth and escape currency XSS ... The po-web-ui and workorder-web-ui handlers had no auth: any invocation path returned the full PO/WO DB. Add a fail-closed shared-secret gate (X-Auth-Token / Bearer, constant-time compared to WEB_UI_AUTH_TOKEN) so a future re-attached Function URL cannot re-expose the data (URLs removed under INFRA-74). Wire the token from the SSM String param /procurement-ingest/web-ui-auth-token. Also fix stored XSS in po-web-ui fmt_currency: the non-numeric fallback returned str(val) unescaped, so a prompt-injected email could make Claude emit total_amount as <script>. Escape it. Refs: INFRA-74		2026-07-15 19:29:41 -04:00
..
po	Gate web UIs behind auth and escape currency XSS	2026-07-15 19:29:41 -04:00
wo	Gate web UIs behind auth and escape currency XSS	2026-07-15 19:29:41 -04:00