Alexandre Brandizzi c841e130be fix(auth): harden password reset codes against guessing and email enumeration ... Forgot Password answers every address the same way and emails a code only to an active account. Codes are stored as salted SHA-256 hashes, expire 15 minutes after issue, are replaced by a newer request, and are checked only against the email they were issued to. Five failed checks delete the code; attempts are reserved with one conditional UPDATE so concurrent guesses cannot exceed the budget. VerificationCode requires the email, and email and code are accepted in the JSON body so they stay out of URLs. The three anonymous endpoints are rate limited to 10 requests per 15 minutes per client IP. Forwarded headers are trusted only through loopback and private hops, since the API sits behind the EB load balancer and nginx. The migration adds hash, salt, expiry and attempt columns and deletes the old plaintext rows.		2026-09-25 12:21:29 -03:00
..
DashboardBusinessTime.cs	feat(dashboard): add core dashboard metrics (SH-343)	2026-09-16 17:28:21 -03:00
DashboardMetrics.cs	feat(dashboard): add scoped metrics contract (SH-347)	2026-09-16 21:37:17 -03:00
DashboardRegions.cs	Merge remote-tracking branch 'origin/dev' into feat/ab/sh-348-region-filter	2026-09-17 02:20:44 -03:00
LifecycleStatusMapper.cs	fix(work-orders): align phase 2 status/type contract to SHOC frontend	2026-07-07 13:11:22 -03:00
LifecycleStatusSets.cs	fix(work-orders): lock ScheduledStart/End when patching apptTime	2026-07-21 09:31:27 -03:00
NotificationActivityItems.cs	feat(notifications): feed assignments, comments, mentions and uplift decisions to the user they concern	2026-09-18 13:15:33 -03:00
NotificationAudience.cs	feat(notifications): SEV response-window alerts and breach acknowledgement	2026-09-25 11:16:21 -03:00
NotificationFeedOrdering.cs	feat(notifications): serve the Notification Center feed grouped by reason	2026-09-18 12:40:37 -03:00
PasswordResetCodeSecrets.cs	fix(auth): harden password reset codes against guessing and email enumeration	2026-09-25 12:21:29 -03:00
SeaHavenClaimTypes.cs	!fix(work-orders): fail-closed media account scope with org_scope claim [SH-221]	2026-08-06 10:26:04 -03:00
SlaResponseWindows.cs	feat(notifications): SEV response-window alerts and breach acknowledgement	2026-09-25 11:16:21 -03:00
UserMutationErrors.cs	!fix(users): restrict AccountId assignment to Admin [SH-221]	2026-08-11 09:28:08 -03:00
UsStateCodes.cs	fix(dashboard): resolve region zones from full state names (SH-348)	2026-09-16 20:15:20 -03:00
VendorConflictPairs.cs	feat(notifications): serve the Notification Center feed grouped by reason	2026-09-18 12:40:37 -03:00
VendorPhoneNormalizer.cs	feat(vendors): complete core vendor workflows	2026-07-23 17:02:40 -03:00
VideoDurationProbe.cs	fix(media): name HEIC in the unsupported-type message and keep ticket keys out of comments	2026-09-25 02:58:15 -03:00
WorkOrderAdditionalContactsMapper.cs	fix(work-orders): map additionalContacts on detail GET (SH-218)	2026-08-18 10:03:12 -03:00
WorkOrderAddonCutoff.cs	feat(work-orders): persist IsAddOn frozen at create (SH-126)	2026-08-13 13:30:09 -03:00
WorkOrderAuditProjection.cs	fix(work-orders): make stacked tip build for CI quality gates	2026-07-17 13:18:46 -03:00
WorkOrderBoardApptTimeParser.cs	fix(work-orders): persist empty apptTime as null scheduled instants	2026-08-31 10:49:54 -03:00
WorkOrderBoardCreateLifecycleRules.cs	feat(work-orders): re-derive lifecycle when board status is patched	2026-09-09 10:23:22 -03:00
WorkOrderBoardFieldMutations.cs	feat(work-orders): run schedule status side-effects on board field mutations	2026-09-08 16:22:11 -03:00
WorkOrderBoardFieldNames.cs	feat(work-orders): link service selections to registry	2026-09-16 18:02:57 -03:00
WorkOrderBoardMutationRules.cs	feat(work-orders): derive Scheduled from date without assignee	2026-09-08 16:19:50 -03:00
WorkOrderBoardPatchLifecycleRules.cs	fix(work-orders): reject forged automatic lifecycle statuses on board patch (SH-357, SH-358) (#120)	2026-09-16 14:41:23 -03:00
WorkOrderBoardSortFields.cs	feat(work-orders): enrich board search overdue filters and 0-based paging (#23)	2026-07-24 21:12:03 +00:00
WorkOrderCommentProjection.cs	fix(work-orders): make stacked tip build for CI quality gates	2026-07-17 13:18:46 -03:00
WorkOrderCompletionDocFileRules.cs	fix(work-orders): enforce a file allowlist on completion-doc upload (SH-337)	2026-09-08 21:24:10 -03:00
WorkOrderCompletionSnapshotMapper.cs	fix(workorders): persist manual POC override with audit and site-follow (SH-379)	2026-09-18 14:30:54 -03:00
WorkOrderDerivedFields.cs	feat(work-orders): apply schedule lifecycle promote and demote	2026-09-08 16:21:14 -03:00
WorkOrderExternalVersion.cs	fix(work-orders): address procurement review findings	2026-07-27 14:40:17 -03:00
WorkOrderFlagColors.cs	fix(work-orders): keep FlagColor out of structured-notes slice	2026-07-21 09:38:34 -03:00
WorkOrderIdSet.cs	feat(workorders): filter board search to an exact work-order id set	2026-09-25 10:56:47 -03:00
WorkOrderIngestFieldMapper.cs	feat(work-orders): add work order ingest API with X-Ingest-Key	2026-07-13 13:22:11 -03:00
WorkOrderMediaAuthorization.cs	!fix(work-orders): fail-closed media account scope with org_scope claim [SH-221]	2026-08-06 10:26:04 -03:00
WorkOrderMediaContract.cs	fix(media): name HEIC in the unsupported-type message and keep ticket keys out of comments	2026-09-25 02:58:15 -03:00
WorkOrderMediaFileRules.cs	fix(media): name HEIC in the unsupported-type message and keep ticket keys out of comments	2026-09-25 02:58:15 -03:00
WorkOrderMediaProjection.cs	feat(work-orders): add Phase 6 slide-over detail comments audit and media API	2026-07-13 13:13:00 -03:00
WorkOrderNumberNormalizer.cs	fix(work-orders): keep SH placeholder WO numbers and block downgrades (#123)	2026-09-16 15:01:10 -03:00
WorkOrderNumberRules.cs	fix(work-orders): enforce provisional WO numbers (SH-252)	2026-08-20 14:34:08 -03:00
WorkOrderOperationalWeek.cs	fix(work-orders): address PR #13 review feedback	2026-07-09 10:06:36 -03:00
WorkOrderPocSiteContact.cs	fix(workorders): compare manual POC against the followed contact, not any site contact	2026-09-18 18:56:29 -03:00
WorkOrderSearchDateRangeResolver.cs	fix(board-search): keep undated rows for clients that omit includeDateless (SH-391)	2026-09-25 01:41:49 -03:00
WorkOrderSeverityRules.cs	feat(work-orders): persist board severity on create, patch, and search	2026-09-07 11:46:13 -03:00
WorkOrderTypeMapper.cs	fix(work-orders): align phase 2 status/type contract to SHOC frontend	2026-07-07 13:11:22 -03:00
WorkOrderUpliftAllowance.cs	fix(work-orders): enforce SH-196 cumulative allowance and one pending per WO	2026-08-14 10:36:35 -03:00
WorkOrderUpliftContractMapper.cs	fix(uplifts): one per-path uplift amount for queue, approval and exposure	2026-09-25 02:32:58 -03:00