ROLAC

Files

T

Chris Chen 95fa37ebdf fix(expense): open category read to all authed users; statement lookups via FirstOrDefaultAsync

Final-review findings:
- ExpenseCategoriesController was finance-only at the class level, but the member
  self-service reimbursement form reads the category list to populate its dropdown,
  so members got 403 and could not submit. Open GET to any authenticated user;
  keep group/subcategory writes finance-only (mirrors MinistriesController).
  Verified live with a member-role account: reads 200, writes 403, self-submit 200.
- MonthlyStatementService Update/Finalize now use FirstOrDefaultAsync for
  convention consistency with the rest of the service layer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-29 19:14:18 -07:00

Controllers

fix(expense): open category read to all authed users; statement lookups via FirstOrDefaultAsync

2026-05-29 19:14:18 -07:00

Data

feat(expense): add Expense + MonthlyStatement entities and EF config

2026-05-29 18:11:56 -07:00

DTOs

feat(expense): add expense, category, and monthly-statement DTOs

2026-05-29 18:21:52 -07:00

Entities

feat(expense): add Expense + MonthlyStatement entities and EF config