shoc-backend/docs/adr
Arthur Bassi de0f6da8fb fix(work-orders): scope legacy GET GetComments by account [SH-221]
Pass ClaimsPrincipal into GetCommentsAsync and filter via
GetAllForAccountAsync so account-scoped callers cannot enumerate
cross-tenant comments. ADR + cross-account tests updated.
2026-08-11 15:18:29 -03:00
..
0001-work-order-single-org-scope.md fix(work-orders): scope legacy GET GetComments by account [SH-221] 2026-08-11 15:18:29 -03:00