Evergreen farms (pos)

Bug or feature: Cross-Tenant Path Traversal Vulnerability via x-tenant-slug Header
Fix: Updated tenantPermissions.js to ensure admin routes cannot masquerade as storefront requests, and enforced strict tenant database matching (409 Conflict) if an authenticated user passes a mismatched or non-existent company slug header.

Bug or feature: Missing In-App Feedback Reason for Negative FAQ Votes
Fix: Added optional comment field (max 300 characters) to FaqVote-model.js and faqValidation.js. Updated faq.service.js and storefront FaqHelpfulVote.tsx to record why an FAQ was unhelpful with real-time button loading states.

Bug or feature: Lack of Unique Collision-Safe Reference Number on FAQ Inquiries
Fix: Added reference index field (sparse: true) to FaqEnquiry-model.js. Implemented generateEnquiryReference() in faq.service.js which automatically generates and attaches collision-proof ticket identifiers in the format FAQ-XXXX (e.g., FAQ-1006).

Bug or feature: Missing Customer Auto-Confirmation Email and Staff Subject Ticket Tagging
Fix: Integrated base.mail.js into faqNotification.js to dispatch a confirmation email to the customer containing their inquiry reference code (FAQ-XXXX) and an alert to store administrators with the customer's email set as replyTo.

Bug or feature: Storefront Leaking Mock/Static FAQs When Tenant Has No Configured FAQs
Fix: Updated mergeLiveAndStaticFaqs in faqDataMapper.ts to return an empty array rather than hardcoded demo questions when live categories are empty, respecting strict tenant database isolation.

Bug or feature: Admin Inquiries Table Missing Ticket Reference and Dynamic Staff Assignment
Fix: Updated FaqEnquiriesPage.tsx to display the REF # column, link email replies directly with the ticket reference in the subject, fetch live nursery users from /nus-user/getAll for the "Assign to" dropdown, and provide an interactive Reply Dialog with Gmail Web and copy fallbacks.

Bug or feature: Redis Cache Eviction Freezing Single-Threaded Event Loop
Fix: Replaced blocking redisClient.keys() in faqCache.js with non-blocking scanIterator and cursor-based scan pattern matching.