AssetController and ContactController had [Authorize] commented out with
"Removed for testing", leaving every asset and contact endpoint reachable
without a token. Restore the attribute. Also drop AssetController's unused
UserManager dependency.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Starting point for the ARCHITECTURE_AND_CODE_QUALITY.md cleanup pass: a
verified (not grep-only) list of layering violations, validation coverage
gaps against the existing FluentValidation pattern, and N+1/query-shape
issues found so far, plus what was checked and ruled out.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Past Due must track the deadline (Due Date), not Schedule On. Keep dueDate and scheduledDate PATCH mutations independent so rescheduling alone does not clear Past Due.
Pass ClaimsPrincipal into GetCommentsAsync and filter via
GetAllForAccountAsync so account-scoped callers cannot enumerate
cross-tenant comments. ADR + cross-account tests updated.
Close the remaining SH-221 bypass: board/legacy comments and completion-doc now enforce server-derived account scope, authorize before blob storage, and cover cross-account regressions.
Stamp WorkOrder.AccountId on all create paths and filter board/list/search/detail by server-derived account claims so scoped callers cannot cross accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
