2 Commits

Author	SHA1	Message	Date
johnnyq	497ea3b669	Centralize client portal access checks through contactCan() ... Replaces the duplicated primary/billing/technical checks across portal pages, post.php handlers, nav, and dashboard with contactCan()/enforceContactCan(). Same behavior, but the rules now live in one place instead of being copy-pasted, which is what let them drift before. file.php keeps its 404 response; ticket-visibility and approval-routing checks are intentionally left as-is.	2026-07-25 17:55:30 -04:00
johnnyq	3838d052f0	Add secure file handler for client ticket attachment and file view along with client and contact permission isolation, add the handler links in asset and contact	2026-07-15 18:35:32 -04:00