2 commits

Author	SHA1	Message	Date
Arthur Bassi	4f16b6a76f	fix(work-orders): trust only JWT org_scope for account list ... Ignore stored AuthUser.orgScope so a scoped token cannot open the unscoped account picker via localStorage.	2026-08-25 21:31:18 -03:00
Arthur Bassi	b240cc8c79	fix(work-orders): gate account picker to org-wide scope ... Hide GetAccountList and skip client customer on create unless org_scope is all, so scoped users cannot read another tenant name.	2026-08-25 21:10:12 -03:00