Alexandre Brandizzi
3a4af64a64
fix(observability): preserve backend release identity ( #114 )
2026-09-15 16:08:14 -03:00
Alexandre Brandizzi
6ceb274bfb
feat: add API Sentry tracing (SH-298) ( #105 )
...
Validate and deploy / Validate deployable source bundle (push) Has been cancelled
Validate and deploy / Deploy shoc-backend-dev through Terraform (push) Has been cancelled
Validate and deploy / Deploy shoc-backend-staging to Elastic Beanstalk (push) Has been cancelled
* feat: add API Sentry tracing
* feat: activate Sentry deployment environments
* fix: allow Sentry-free design-time tooling
* fix: trace background jobs in Sentry
* feat(observability): identify and scrub Sentry transactions
* fix(observability): finish abandoned transactions
2026-09-04 14:11:32 -03:00
Arthur Bassi
61923b2a7d
feat(work-orders): stamp board create account from location
...
Org-wide create no longer depends on customer name. POST /workorders/board requires locationId and stamps WorkOrder.AccountId from Location.AccountId.
2026-08-26 09:12:48 -03:00
Arthur Bassi
de0f6da8fb
fix(work-orders): scope legacy GET GetComments by account [SH-221]
...
Pass ClaimsPrincipal into GetCommentsAsync and filter via
GetAllForAccountAsync so account-scoped callers cannot enumerate
cross-tenant comments. ADR + cross-account tests updated.
2026-08-11 15:18:29 -03:00
Arthur Bassi
3c090e2757
fix(work-orders): scope comments and completion-doc by account [SH-221]
...
Close the remaining SH-221 bypass: board/legacy comments and completion-doc now enforce server-derived account scope, authorize before blob storage, and cover cross-account regressions.
2026-08-11 14:52:02 -03:00
Arthur Bassi
1edcf479ae
fix(work-orders): apply account scope across create and reads [SH-221]
...
Stamp WorkOrder.AccountId on all create paths and filter board/list/search/detail by server-derived account claims so scoped callers cannot cross accounts.
Co-authored-by: Cursor <cursoragent@cursor.com>
2026-08-11 10:45:37 -03:00
Arthur Bassi
ea2dedf579
!fix(work-orders): fail-closed media account scope with org_scope claim [SH-221]
2026-08-06 10:26:04 -03:00
Arthur Bassi
fdc315d8fe
!feat(work-orders): enforce media account scope and AddMedia freshness [SH-221]
2026-08-06 09:47:34 -03:00
Arthur Bassi
e572786b1c
~docs(work-orders): demote ADR 0001 to Proposed pending CODEOWNERS [SH-116]
2026-08-05 09:57:14 -03:00
Arthur Bassi
8ff4ab1742
fix(work-orders): document single-org media scope (ADR 0001)
...
Clarify SH-116 tenant scope as board-aligned ApplyBaseScope + claims, and add out-of-org-scope GET/mutation tests for deleted/template/missing WOs.
2026-08-04 16:07:26 -03:00
