What's new in
UseLodger

Fixed a privilege-escalation hole where any delegated worker (even one with only 'maintenance' access) could self-promote to full access via PropertyWorkerController::update() and InvitationController::store(), which were gated only by tenant membership, never the caller's own permission

Fixed userCanOnTenant()'s same-tenant fast path returning true for any staff member whose tenant_id matched, with no role/permission check at all — every regular staff account (receptionist, housekeeping, anyone) could pass any hr.permission check

Fixed hotel-side RBAC gaps mirroring the landlord-side holes: PaymentController::refund() had zero role check (any tenant member could refund), plus cross-tenant order-status access and a separate role-escalation path

Closed a cross-tenant leak in ReportController::bookings() — zero tenant scoping on all three sub-queries meant any caller with the analytics module could see every tenant's booking data; reports routes now also require a staff role, not just the module

Fixed cross-tenant housekeeping assignment on rooms, and gated Restaurant management behind role checks (three fully-unguarded endpoints)

Gated notices/meetings writes behind their permission, and fixed a raw tenant_id being trusted directly in chat

Removed duplicate vendors/invitations/property-roles routes that were silently overriding the permission gates added in an earlier commit

CheckModule resolved a delegated worker's tenant via the raw tenant_id relation (null for anyone whose access comes from a PropertyRoleAssignment instead), locking every delegated worker out of landlord_management — found while live-testing the permission-gate work above

Closed a payment-webhook race: the pending→successful transition wasn't locked, so a retried webhook could re-run commission recording on an already-settled payment

Closed a wallet-debit race that could drive a balance negative — the funds check read a possibly-stale wallet_balance, and wasn't atomic with the decrement

Prevented double-refunding the same payment — refund eligibility only checked payment status, not whether a refund was already queued, leaving a window between 'refund row created' and 'job completes'

Closed the subscription/module renewal double-charge race — two overlapping scheduler runs could both see auto_renew=true and both call chargeAuthorization() against the tenant's saved card

Fixed a real overbooking bug in Booking::scopeBlocking(), found while adding row-locking to BookingService::createSingle() to close a separate double-booking race

Added defense-in-depth locking to ad-renewal processing, file-type allowlists to three upload endpoints, and a dedicated rate limit on refunds

Added multi-provider SMS routing (Kudi + Termii) — first piece of Africa expansion beyond Nigeria's primary carrier

Wired notifications through to the places that were silently missing them: payment_failed, ad auto-renewal, recruitment applicant/interviewer updates, an anonymity-safe whistleblower channel, maintenance requests, visitor passes, and payslip payment receipts

Added a manual-review fallback for identity verification for non-Nigerian users, and escalating panic-alert re-notification every 3 minutes until acknowledged (was push+in-app only)

Landlord dashboard: AI meeting-agenda drafting, a dedicated meeting link separate from the overloaded location field, a hard-to-miss panic-alert banner, poll voting info, richer job-opening/expense/vendor/maintenance forms with proper dropdowns, and Support promoted to a standalone nav item for every role

Fixed operational summary defaulting to $ instead of ₦, a gap where paid bookings could skip commission recording entirely, and staff menus that were under-permissive for several roles