adam/shoc-backend
1
0
Fork 0
mirror of https://github.com/Sea-Haven-Industries/shoc-backend.git synced 2026-10-02 05:03:21 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions 1
shoc-backend/Api.SeaHavenIndustries/Controllers
History
Alexandre Brandizzi c841e130be fix(auth): harden password reset codes against guessing and email enumeration 
Forgot Password answers every address the same way and emails a code only
to an active account. Codes are stored as salted SHA-256 hashes, expire 15
minutes after issue, are replaced by a newer request, and are checked only
against the email they were issued to. Five failed checks delete the code;
attempts are reserved with one conditional UPDATE so concurrent guesses
cannot exceed the budget. VerificationCode requires the email, and email and
code are accepted in the JSON body so they stay out of URLs.

The three anonymous endpoints are rate limited to 10 requests per 15
minutes per client IP. Forwarded headers are trusted only through loopback
and private hops, since the API sits behind the EB load balancer and nginx.
The migration adds hash, salt, expiry and attempt columns and deletes the
old plaintext rows.
2026-09-25 12:21:29 -03:00
..
AccountController.cs backend changes 2026-05-14 11:00:12 -05:00
AssetController.cs backend changes 2026-05-14 11:00:12 -05:00
AuthenticationController.cs fix(auth): harden password reset codes against guessing and email enumeration 2026-09-25 12:21:29 -03:00
CalendarController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
CommonController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
ContactController.cs backend changes 2026-05-14 11:00:12 -05:00
DashboardController.cs feat(dashboard): count open unassigned work orders for the period (SH-392) 2026-09-24 21:11:31 -03:00
DispatchController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
DispatchPublicController.cs Add vendor portal with token-based authentication 2026-04-20 12:01:53 -04:00
DropdownOptionsController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
EmployeeController.cs backend changes 2026-05-14 11:00:12 -05:00
FollowUpController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
LocationController.cs feat(locations): support site registry queries (SH-330) 2026-09-16 20:45:15 -03:00
NotificationsController.cs feat(notifications): SEV response-window alerts and breach acknowledgement 2026-09-25 11:16:21 -03:00
PMScheduleController.cs backend changes 2026-05-14 11:00:12 -05:00
QuotesController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
ServicesRegistryController.cs feat(services): add global services registry 2026-09-16 17:07:59 -03:00
SettingsController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
SyncController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
TaskListTemplateController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
TeamMemberController.cs feat(team-members): add member detail editing (SH-326) 2026-09-16 21:41:55 -03:00
TeamPermissionController.cs feat(permissions): expose team member permission overrides (SH-328) 2026-09-16 18:02:02 -03:00
UpliftController.cs feat(uplifts): add approval decision actions (SH-210) 2026-09-16 20:11:26 -03:00
UserController.cs !fix(users): restrict DeleteUser to Admin [SH-221] 2026-08-11 09:44:52 -03:00
VendorCompanyRosterController.cs feat(vendors): add admin-assigned vendor company Area 2026-09-16 11:34:45 -03:00
VendorController.cs feat(vendors): add admin-assigned vendor company Area 2026-09-16 11:34:45 -03:00
VendorOperationsController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
VendorPortalController.cs Merge remote-tracking branch 'origin/main' into HEAD 2026-09-24 23:05:17 -03:00
WorkOrderBoardController.cs fix(workorders): persist manual POC override with audit and site-follow (SH-379) 2026-09-18 14:30:54 -03:00
WorkOrderCompletionController.cs feat(completion-templates): author templates with safety note and ordered procedures 2026-09-25 11:00:22 -03:00
WorkOrderController.cs fix(work-orders): bind GetWorkorderById id from the query string (SH-374) 2026-09-16 20:15:30 -03:00
WorkOrderDetailController.cs Merge remote-tracking branch 'origin/main' into lane/sh-327 2026-09-24 23:00:18 -03:00
WorkOrderDispatchController.cs refactor: enforce backend boundaries and optimize dispatch (#30) 2026-07-24 17:35:34 -03:00
WorkOrderIngestController.cs feat(work-orders): add work order ingest API with X-Ingest-Key 2026-07-13 13:22:11 -03:00
WorkOrderJobsController.cs feat(work-orders): add Phase 5 scheduled domain events (WeekRolled) 2026-07-24 10:13:17 -03:00
WorkOrderMediaController.cs fix(media): name HEIC in the unsupported-type message and keep ticket keys out of comments 2026-09-25 02:58:15 -03:00
WorkOrderOpsController.cs feat(work-orders): add Sync kill-switch and ops health coexistence endpoints 2026-07-13 13:22:12 -03:00
WorkOrderReconciliationController.cs test: prove SH-133 webhook and admin boundaries 2026-07-25 15:45:52 -03:00
WorkOrderWebhookController.cs feat: ingest signed procurement work-order webhooks 2026-07-24 21:03:50 -03:00