ROLAC

T

Chris Chen 95fa37ebdf fix(expense): open category read to all authed users; statement lookups via FirstOrDefaultAsync

Final-review findings:
- ExpenseCategoriesController was finance-only at the class level, but the member
  self-service reimbursement form reads the category list to populate its dropdown,
  so members got 403 and could not submit. Open GET to any authenticated user;
  keep group/subcategory writes finance-only (mirrors MinistriesController).
  Verified live with a member-role account: reads 200, writes 403, self-submit 200.
- MonthlyStatementService Update/Finalize now use FirstOrDefaultAsync for
  convention consistency with the rest of the service layer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

2026-05-29 19:14:18 -07:00

API

fix(expense): open category read to all authed users; statement lookups via FirstOrDefaultAsync

2026-05-29 19:14:18 -07:00

APP

feat(expense): wire routes + sidebar nav for expense pages

2026-05-29 18:59:25 -07:00

docs

docs(expense): correct subcategory seed count to 39 (matches DB_SCHEMA §8)

2026-05-29 18:10:42 -07:00

.gitignore

feat(storage): add IFileStorage + local-disk implementation