6d9232f3b7
The first scoping pass covered tables carrying a tenantid column. These five have no such column and were still returning every client's data to a client login, which is what made creating info@dailygrubs.com unsafe: - GET /admin/customers — scoped through the bookings placed for them, since a customer carries no tenant of their own (the same person can order from two clients). - GET /admin/exceptions — scoped through the consignment the exception was raised against. - GET /admin/tenantcustomers — the legacy customers table predates tenant attribution entirely, so no row can be proven to belong to a client. Returns empty for client logins rather than handing over the whole list. - GET /admin/tripsheets — a vehicle run routinely carries several clients' parcels on one manifest, so there is no honest per-client view. Doormile staff only. - GET /admin/milers — scoped through appusers.tenantid, so a client sees their own riders rather than the whole roster. Also guards PUT /admin/consignments/:id/status, which took the id straight from the path and would have let a client move another client's parcel through the network. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>