OpenConstructionERP Files

Fixed

• IDOR closures across legacy modules (surfaced by the v4.2.0 20-wave QA sweep). Added owner / project-access checks to:
• BOQ: get_boq_structured, get_boq_activity, create_revision
• Equipment: GET / PATCH / DELETE /equipment/{id}
• Punchlist: /items/{id}/transition/, /items/{id}/pin-to-sheet/
• Meetings: /{meeting_id}/complete/

• Costs: /v1/costs/{item_id}/record-usage/

• Coordination Hub serial fetch → asyncio.gather — six KPI sub-counters in coordination_hub.service.build_dashboard() now run concurrently. Dashboard load time matches the slowest single counter instead of their sum.

• MeasureTool snap-to-vertex X axis — removed dead (raw.x - raw.x) term that always evaluated to 0; snap now reads the correct X coordinate.

• Hardcoded currency fallbacks removed — 'USD' in CwicrMatchPanel/VariantPicker/MultiVariantPicker and 'EUR' in CostsPage assembly / cost-item modals + totals badge now resolve from useProjectContextStore + projects query. Empty fallback when no project context.

• Change Orders monetary fields — cost_impact, cost_delta, quantities, rates, summary totals now serialise as Decimal-validated str (mirrors finance module). Eliminates the float-in-money pattern.

• Punchlist photo upload — magic-byte signature validation replaces spoofable content-type-only check. SVG / PDF / scripts rejected with 415.

Testing

21 backend unit + 37 coordination_hub + 47 changeorders/punchlist + 24 costs frontend + 9 MeasureTool — all green.

Compatibility

No DB migrations. AGPL-3.0 compliance unchanged. Drop-in upgrade from 4.2.0.