From 9c4584d428f34b999a53d61c44998cf8fc0cc9c0 Mon Sep 17 00:00:00 2001 From: lorentz Date: Wed, 15 Jul 2026 08:17:07 -0400 Subject: [PATCH] fix(15): exclude soft-deleted notes/time entries from phishing evidence ticket_notes and time_entries both carry an is_deleted soft-delete flag (per CLAUDE.md audit-column convention); gatherTicketEvidence was reading both without filtering it, so retracted notes and reversed time entries showed up as evidence for every phishing report. Found during code-review re-verification of the Phase 15 CR-01/WR-01/WR-02 fixes. Co-Authored-By: Claude Sonnet 5 Claude-Session: https://claude.ai/code/session_012wWroM6FXkQJiH3JgYcony --- lib/services/phishing-detector.ts | 2 ++ 1 file changed, 2 insertions(+) diff --git a/lib/services/phishing-detector.ts b/lib/services/phishing-detector.ts index 54349b5..a2e6ef4 100644 --- a/lib/services/phishing-detector.ts +++ b/lib/services/phishing-detector.ts @@ -127,6 +127,7 @@ export async function gatherTicketEvidence( `SELECT id, title, description, note_type, creator_resource_id, created_at FROM ticket_notes WHERE ticket_id = $1 + AND is_deleted = false ORDER BY created_at`, [ticket.id] ); @@ -135,6 +136,7 @@ export async function gatherTicketEvidence( `SELECT id, resource_id, entry_date, hours_worked, start_date_time, end_date_time FROM time_entries WHERE ticket_id = $1 + AND is_deleted = false ORDER BY entry_date`, [ticket.id] );