Commit graph

10 commits

Author SHA1 Message Date
Alexandre Brandizzi
e53415de39 Merge remote-tracking branch 'origin/feat/ab/sh-386-password-policy' into feat/ab/sh-385-invite-registration 2026-09-25 13:04:18 -03:00
Alexandre Brandizzi
9091335ff2 fix(auth): reject an unconfirmed new password and report only policy failures as weak 2026-09-25 13:02:58 -03:00
Alexandre Brandizzi
c0ae8479ce feat(team-members): invite registration with emailed code confirmation (SH-385) 2026-09-25 11:49:10 -03:00
Alexandre Brandizzi
66a49ab957 feat(auth): enforce one password policy on every password-setting path (SH-386)
Both hosts now apply the same Identity password rule: at least 6 characters
with one uppercase letter, one number and one special character. Change
password requires an authenticated caller, verifies the current password
before evaluating the new one, and reports a policy rejection separately
from a wrong current password.
2026-09-25 11:06:42 -03:00
Alexandre Brandizzi
7d245eb717
refactor: enforce backend boundaries and optimize dispatch (#30)
* refactor(api): enforce service and data-service boundaries

* refactor(api): complete feature service boundaries

* refactor(identity): enforce service and data boundaries

* refactor(vendors): enforce service and data boundaries

* refactor(workorders): enforce service and data boundaries

* refactor(backend): enforce architecture and optimize dispatch

* style(backend): format changed architecture files

* fix(architecture): address backend review follow-ups

* fix(backend): sanitize exception disclosure in changed API endpoints

Replace raw exception-message disclosure (ex.Message) returned to API
callers with a stable sanitized public message plus correlated structured
internal logging, across the endpoints changed in this PR.

- Add SanitizedErrors helper: logs the original exception at Error with a
  generated correlation id and returns a stable public message referencing
  it so support can trace without exposing internals.
- Inject ILogger<T> into the 14 changed controllers and route every
  ex.Message/dbex.Message disclosure through the helper, preserving status
  codes, response shapes, and business data (e.g. OpenWorkOrders).
- Leave FluentValidation (vex.Errors) and existing fixed-message catches
  untouched; out-of-scope controllers (Account/Contact/Employee/Asset/
  PMSchedule) are unchanged.
- Add focused tests proving internal exception text is not returned and
  that Error logging carrying the original exception is invoked.

* fix(architecture): abstract job run state access

* style: format board update service

* test: use collection assertion idiom
2026-07-24 17:35:34 -03:00
npalOmega
64adcae4ed fixes for Dev changes 2026-04-24 12:12:16 -05:00
Adam Moussa
128ae44a0d Fix login null check order and strengthen password reset code
- Reorder null check: check user != null before accessing user.IsDeleted
- Increase password reset code from 4 digits to 6 digits (10K to 1M combinations)
2026-04-16 16:33:09 -04:00
Adam Moussa
486233076c Replace hardcoded SMTP credentials with SendGrid service
- Remove inline SMTP method with codevoir.com credentials
- Inject existing SendMessage helper that uses SendGrid via config
- Clean up unused using directives
2026-04-16 16:25:11 -04:00
npalOmega
9a23c41b21 initial commit for api changes 2025-02-18 13:13:33 -06:00
69b9e69f00 Initial commit 2024-09-28 14:58:36 -04:00