3 Commits

Author	SHA1	Message	Date
Matt	eb1e8a7870	fix: case-insensitive email matching in auth and password reset ... Email lookups used findUnique (case-sensitive on PostgreSQL) but user input was lowercased, causing login failures for users with mixed-case emails stored in the DB (e.g. Laurent_Faure@dietsmann.com). Also normalized 7 affected emails to lowercase on the production DB. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-14 11:04:31 -04:00
Matt	b85a9b9a7b	fix: security hardening + performance refactoring (code review batch 1) ... - IDOR fix: deliberation vote now verifies juryMemberId === ctx.user.id - Rate limiting: tRPC middleware (100/min), AI endpoints (5/hr), auth IP-based (10/15min) - 6 compound indexes added to Prisma schema - N+1 eliminated in processRoundClose (batch updateMany/createMany) - N+1 eliminated in batchCheckRequirementsAndTransition (3 batch queries) - Service extraction: juror-reassignment.ts (578 lines) - Dead code removed: award.ts, cohort.ts, decision.ts (680 lines) - 35 bare catch blocks replaced across 16 files - Fire-and-forget async calls fixed - Notification false positive bug fixed Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-07 16:18:24 +01:00
Matt	6b6f5e33f5	fix: admin role change, logo access, magic link validation, login help ... - Add updateTeamMemberRole mutation for admins to change team member roles - Allow any team member (not just lead) to change project logo - Add visible "Add logo"/"Change" label under logo for discoverability - Pre-check email existence before sending magic link (show error) - Add "forgot which email" contact link on login page Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-03-05 16:37:45 +01:00