Alexandre Brandizzi c841e130be fix(auth): harden password reset codes against guessing and email enumeration ... Forgot Password answers every address the same way and emails a code only to an active account. Codes are stored as salted SHA-256 hashes, expire 15 minutes after issue, are replaced by a newer request, and are checked only against the email they were issued to. Five failed checks delete the code; attempts are reserved with one conditional UPDATE so concurrent guesses cannot exceed the budget. VerificationCode requires the email, and email and code are accepted in the JSON body so they stay out of URLs. The three anonymous endpoints are rate limited to 10 requests per 15 minutes per client IP. Forwarded headers are trusted only through loopback and private hops, since the API sits behind the EB load balancer and nginx. The migration adds hash, salt, expiry and attempt columns and deletes the old plaintext rows.		2026-09-25 12:21:29 -03:00
..
Accounts.cs	added new controllers	2026-01-21 15:41:19 -06:00
Addresses.cs	added new controllers	2026-01-21 15:41:19 -06:00
Area.cs	feat(vendors): add admin-assigned vendor company Area	2026-09-16 11:34:45 -03:00
Assets.cs	added new controllers	2026-01-21 15:41:19 -06:00
Category.cs	Initial commit	2024-09-28 14:58:36 -04:00
Comments.cs	feat: complete SH-133 procurement reconciliation	2026-07-24 22:13:25 -03:00
CompletionDocTemplate.cs	feat(completion-templates): author templates with safety note and ordered procedures	2026-09-25 11:00:22 -03:00
ContactDetails.cs	added new controllers	2026-01-21 15:41:19 -06:00
Contacts.cs	feat(locations): manage ordered site contacts	2026-09-15 19:03:54 -03:00
Dispatch.cs	merge: integrate origin/dev into PR #22 flag-color base	2026-07-24 14:20:16 -03:00
DispatchChecklistItem.cs	Add dispatch checklist items with template support	2026-04-17 15:28:52 -04:00
DispatchSignoff.cs	Add dispatch sign-offs with signature capture	2026-04-17 15:51:20 -04:00
DispatchUpliftRequest.cs	feat(uplifts): complete SH-101 approval lifecycle	2026-08-11 08:58:19 -03:00
DispatchWorkOrder.cs	Add multi-WO dispatch support with junction table	2026-04-17 15:16:28 -04:00
DropdownOption.cs	Add configurable dropdowns, new WO fields, and seed data	2026-04-17 10:40:38 -04:00
Employee.cs	backend architectural template	2026-05-06 10:49:33 -05:00
Events.cs	Add calendar/events backend API (#8)	2026-06-22 18:46:46 -04:00
FollowUps.cs	added new controllers	2026-01-21 15:41:19 -06:00
ForgetPasswordCode.cs	fix(auth): harden password reset codes against guessing and email enumeration	2026-09-25 12:21:29 -03:00
LinkedWorkOrderInfo.cs	feat(vendors): complete core vendor workflows	2026-07-23 17:02:40 -03:00
Locations.cs	feat(locations): manage ordered site contacts	2026-09-15 19:03:54 -03:00
PMSchedules.cs	added new controllers	2026-01-21 15:41:19 -06:00
Quotes.cs	Initial commit	2024-09-28 14:58:36 -04:00
Service.cs	feat(services): add global services registry	2026-09-16 17:07:59 -03:00
SitePreferredVendor.cs	feat(vendors): complete operations roadmap backend	2026-07-23 19:18:06 -03:00
TaskListTemplate.cs	Add Task List Templates with CRUD controller	2026-04-17 14:57:18 -04:00
TaskListTemplateItem.cs	Add Task List Templates with CRUD controller	2026-04-17 14:57:18 -04:00
Template.cs	Initial commit	2024-09-28 14:58:36 -04:00
Trade.cs	feat(vendors): server-owned canonical trades vocabulary for SH-249	2026-08-18 12:11:13 -03:00
TradeCatalog.cs	fix: align vendor trades with confirmed taxonomy	2026-08-20 11:44:07 -03:00
Vendor.cs	feat(vendors): complete operations roadmap backend	2026-07-23 19:18:06 -03:00
VendorAccessToken.cs	Add vendor portal with token-based authentication	2026-04-20 12:01:53 -04:00
VendorAuditLog.cs	feat(vendors): complete core vendor workflows	2026-07-23 17:02:40 -03:00
VendorCompany.cs	feat(vendors): add admin-assigned vendor company Area	2026-09-16 11:34:45 -03:00
VendorCompletionDocument.cs	feat(uplifts): complete SH-101 approval lifecycle	2026-08-11 08:58:19 -03:00
VendorPortalReadModels.cs	Keep work-order uplift requests read-only in the Vendor Portal	2026-09-25 02:52:03 -03:00
WorkerOrder.cs	feat(work-orders): link service selections to registry	2026-09-16 18:02:57 -03:00
WorkOrderAttachments.cs	feat(work-orders): add Phase 6 completion templates schema and media category	2026-07-13 13:12:07 -03:00
WorkOrderAuditLog.cs	feat(work-orders): add domain enums and aggregate root fields	2026-07-02 09:17:59 -03:00
WorkOrderCategories.cs	Initial commit	2024-09-28 14:58:36 -04:00
WorkOrderCompletionSnapshot.cs	feat(work-orders): capture Site/Vendor/POC snapshot on Completed	2026-09-10 15:46:25 -03:00
WorkOrderContacts.cs	feat(work-orders): add domain enums and aggregate root fields	2026-07-02 09:17:59 -03:00
WorkOrderExternalReceipt.cs	feat: complete SH-133 procurement reconciliation	2026-07-24 22:13:25 -03:00
WorkOrderFieldLock.cs	feat(work-orders): add domain enums and aggregate root fields	2026-07-02 09:17:59 -03:00
WorkOrderReconciliationJob.cs	feat: complete SH-133 procurement reconciliation	2026-07-24 22:13:25 -03:00
WorkOrderWebhookDelivery.cs	feat: ingest signed procurement work-order webhooks	2026-07-24 21:03:50 -03:00
WorkOrderWeekRolledLedger.cs	feat(work-orders): add Phase 5 scheduled domain events (WeekRolled)	2026-07-24 10:13:17 -03:00