Admin bulk deactivate/reactivate accepts decimal path segments matching GET /rbac/roles IDs, resolving RoleRecord.name to the platform key. Document 404 when id is unknown. Add Cursor rule: on push, commit dirty tree first without secrets.
Co-authored-by: Cursor <cursoragent@cursor.com>
Platform ADMIN callers no longer hit 403 on these endpoints; bulk changes to platform users.role ADMIN remain restricted to SUPER_ADMIN, while team_members.team_role ADMIN is still eligible under path ADMIN.
Co-authored-by: Cursor <cursoragent@cursor.com>
Expose POST /admin/roles/:role/bulk-deactivate and bulk-reactivate for platform users and team_members, mirroring deactivate/reactivate semantics and optional team member exclusions.
Co-authored-by: Cursor <cursoragent@cursor.com>
- Updated league handling to ensure valid page size checks and improved error handling for sport ID parsing.
- Introduced new endpoint to update global league settings with comprehensive validation and error logging.
- Refactored odds settings management, including saving, removing, and updating odds settings with enhanced validation.
- Added tenant slug retrieval by token, ensuring proper user and company validation.
- Improved middleware to check for active company status and adjusted route permissions for various endpoints.
- Added SQL script to fix auto-increment desynchronization across multiple tables.
