5 Commits

Author	SHA1	Message	Date
johnnyq	36ea4a9a80	API: allow reads to filter by client_id on top of RBAC client scoping ... The RBAC rework dropped the client_id read filter along with per-key client scope, so an all-clients key could no longer narrow to one client. apiClientScopeSql() now appends the filter after the scope fragment, so it can only narrow, never widen. Reads only - writes take client_id as their target client.	2026-08-31 18:30:09 -04:00
johnnyq	e6daf00528	Fix some broken API calls after RBAC update	2026-07-25 16:59:03 -04:00
johnnyq	c509b7f693	Add user-based RBAC for API keys ... API keys now run as a user and inherit that user's module, operation, and client permissions. Drops per-key client scoping and removes existing keys (must be recreated). Adds an edit modal to change a key's user.	2026-07-25 16:50:58 -04:00
johnnyq	1e02322382	API: Invoice_items only return if item_id or invoice_id is specified and do not return all invoice items	2026-04-11 17:57:22 -04:00
johnnyq	830f40edee	API: Add Invoice Items read endpoint	2026-04-11 13:32:50 -04:00