This repository has been archived on 2026-05-24. You can view files and clone it. You cannot open issues or pull requests or push a commit.

Scrubs McBarkley 6893cad13a fix: add authorization + expiry checks to impersonation endpoints, add tests ...

Security: Add ownership verification (resolveStaff + staffId check) to
GET /sessions/:id, POST /sessions/:id/log, and GET /sessions/:id/audit-log
endpoints that were previously unprotected.

Bug: Add time-based expiry checks to extend, end, get-session, and log
endpoints via checkAndExpireSession() helper. Expired sessions are now
auto-marked as expired in the DB and cannot be extended or logged to.

Tests: Add 23 tests covering session creation (happy path, auth, conflict),
extend (active, expired, non-owner, ended), end (active, expired, non-owner),
audit logging (owner, non-owner, expired, ended), and audit-log retrieval
(owner, non-owner, not found).

Addresses QA review on PR #75 (GRO-66).

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

2026-03-20 02:35:30 +00:00

..

api

fix: add authorization + expiry checks to impersonation endpoints, add tests

2026-03-20 02:35:30 +00:00

e2e

feat: client disable/deletion with soft-delete (#69)

2026-03-19 20:03:18 +00:00

web

chore: remove unused useNavigate import from Clients.tsx

2026-03-20 02:17:50 +00:00