Tighter Locks Between Businesses
ImprovementA security review tightened how record deletions are scoped across the whole application, bringing them in line with the checks that edits already applied.
🔒 Applied Everywhere at Once: • Both shared model foundations now verify business and branch ownership before a delete or an undo takes effect • That covers 44 delete endpoints across 32 screens in a single change, with no per-screen work • Branch-limited records get branch-scoped deletes, matching how their edits already behaved • Global lookup tables that have no business column are untouched and behave exactly as before.
🍳 Kitchen Screens: • Food Category and Food Timing save and delete now confirm ownership before acting, so an out-of-scope request returns an honest error instead of a silent no-op that reported success.
Result: Every screen now applies the same ownership rule to deletions that it already applied to edits.