1.5.2

- feat: order confirmation PDF generation with VAT support
- feat: order confirmation modal with custom item editing
- fix: attendance negative duration clamping and switchProject timing
- fix: Quill editor locked to Tahoma 14px, PDF heading sizes
- fix: invoice/offer PDF font consistency (Tahoma enforcement)
- fix: invoice alert cron improvements
- fix: NAS financials manager edge cases
- refactor: numbering service with unique sequence constraints

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

src/routes/admin/received-invoices.ts

@@ -15,6 +15,11 @@ import { nasFinancialsManager } from "../../services/nas-financials-manager";
 import { toCzk } from "../../services/exchange-rates";
 
 const VALID_STATUSES = ["unpaid", "paid"] as const;
+
+/** Round a monetary value to 2 decimal places to avoid floating-point drift. */
+function roundMoney(n: number): number {
+  return Math.round(n * 100) / 100;
+}
 const ALLOWED_SORT_FIELDS = [
   "id",
   "supplier_name",
@@ -411,6 +416,15 @@ export default async function receivedInvoicesRoutes(
         }
       }
 
+      if (String(existing.status) === "paid") {
+        const attempted = Object.keys(body).filter(
+          (k) => !["status", "paid_date", "notes"].includes(k),
+        );
+        if (attempted.length > 0) {
+          return error(reply, "Nelze upravit uhrazenou fakturu", 400);
+        }
+      }
+
       // Recalculate vat_amount when amount or vat_rate changes (matching PHP)
       const finalAmount =
         body.amount !== undefined
@@ -423,9 +437,9 @@ export default async function receivedInvoicesRoutes(
       // Amount includes VAT — extract VAT portion: amount - amount/(1 + rate/100)
       const computedVat =
         finalVatRate > 0
-          ? Math.round(
-              (finalAmount - finalAmount / (1 + finalVatRate / 100)) * 100,
-            ) / 100
+          ? roundMoney(
+              finalAmount - roundMoney(finalAmount / (1 + finalVatRate / 100)),
+            )
           : 0;
 
       // Auto-set paid_date when status transitions to paid (matching PHP)