production had diverged from main with 20 unreviewed direct-push
commits never merged back (account center feature, owner-only employee
roles, and a login-screen redesign - the exact "cream login" work that
replaced the old dark table-photo screen). Neither QA nor the
audit fixes on main had ever seen this code.
Conflict resolution:
- service-worker.js: kept production's newer cache-refresh mechanism
(CRITICAL_FRESH, forceFresh, withAccountCenter, v81 cache name) and
combined both sides' CORE asset lists (account-center-v1780.js +
login-signature-v1776.js from production, auth-security-v1774.js +
order-enhancements-v1775.js from main).
- deploy-timeweb.yml: kept main's version, which already independently
verifies service-worker.js's sha256 alongside the login/logo files -
strictly more thorough than production's version of the same check.
Also fixes fallout from production's commits never having been
QA-tested before landing: package.json was bumped to 17.8.0 with
nothing else in the codebase updated to match (reverted to 17.7.3,
matching package-lock.json/release-manifest.json/app-runtime.js, since
no other release artifact actually changed), and three tests
(static-security.mjs, edge-security-v1774.mjs, release-check.mjs) had
hardcoded strings (old PWA cache name, old employee role list) that no
longer matched the code they were checking.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
This Edge Function grants platform-admin power (list every user across
every workspace, ban/unban accounts, trigger password resets for any
user_id) but answered with Access-Control-Allow-Origin: '*', unlike the
sibling caterium-create-employee function which already uses an origin
allowlist. Authorization itself was never bypassable this way (the
function still requires the caller's own Bearer token and re-checks
sun_is_platform_admin() server-side), but a wildcard CORS response
removes a real layer of defense-in-depth if a platform-admin token were
ever exposed to another origin.
Applies the same allowedOrigin()/corsHeaders() pattern already proven in
caterium-create-employee, and extends edge-security-v1774.mjs (which
already asserted the wildcard was gone from create-employee, but never
checked this function) to cover both.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Add per-line comments, day/hour order reminders, catalog search by number/name, and delivery-inclusive financial summary. Includes static regression checks.
* chore: add one-time index html repair script
* chore: run one-time html repair on fix branch
* fix: close mobile style block [html-repair]
* chore: remove one-time html repair workflow
* chore: remove one-time html repair script
* test: add html style integrity checks
* test: enforce html integrity in deploy checks
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Introduce the first data layer, move order auto-completion to server cron with legacy/cloud compatibility, clean error telemetry, update PWA/versioning, and add regression coverage.
Fix Developer Console memory refresh freeze, auto-complete and fully pay orders one minute after scheduled time, persist offer template per client proposal, and add styled Menu SVG icon. Includes PWA cache update and regression coverage.
Fix platform developer gate during workspace loading and prevent SaaS click events from reaching Developer Console as DOM buttons. Add v17.6.3 regression tests and PWA cache bump.
