boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: code review — XSS, type safety, validation improvements

Browse Source 
Critical:
- InvoiceDetail: sanitize notes HTML with DOMPurify
- OrderDetail: use proper DOMPurify import instead of window fallback

Important:
- AttendanceBalances: add fund_to_date to interface, remove as-any casts
- All schemas: replace z.any() with z.preprocess for boolean fields
- Routes: simplify boolean coercion (Zod handles it now)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-03-24 20:13:20 +01:00
parent 3c167cf5c4
commit 106606f3fa
17 changed files with 63 additions and 46 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
src/schemas/bank-accounts.schema.ts
View File

@@ -7,7 +7,7 @@ export const CreateBankAccountSchema = z.object({
iban: z.string().nullish(),
bic: z.string().nullish(),
currency: z.string().optional().default("CZK"),
is_default: z.any().optional().default(false),
is_default: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(false),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -22,7 +22,7 @@ export const UpdateBankAccountSchema = z.object({
iban: z.string().nullish(),
bic: z.string().nullish(),
currency: z.string().optional(),
is_default: z.any().optional(),
is_default: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))

2
src/schemas/company-settings.schema.ts
View File

@@ -16,7 +16,7 @@ export const UpdateCompanySettingsSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
require_2fa: z.any().optional(),
require_2fa: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
custom_fields: z.array(z.any()).optional(),
supplier_field_order: z.array(z.any()).optional(),
});

4
src/schemas/invoices.schema.ts
View File

@@ -41,7 +41,7 @@ export const CreateInvoiceSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
payment_method: z.string().nullish(),
constant_symbol: z.string().nullish(),
bank_name: z.string().nullish(),
@@ -73,7 +73,7 @@ export const UpdateInvoiceSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
issue_date: z.union([z.string(), z.null()]).optional(),
due_date: z.union([z.string(), z.null()]).optional(),
tax_date: z.union([z.string(), z.null()]).optional(),

6
src/schemas/offers.schema.ts
View File

@@ -14,7 +14,7 @@ const QuotationItemSchema = z.object({
.transform((v) => Number(v) || 0)
.optional()
.default(0),
is_included_in_total: z.any().optional().default(true),
is_included_in_total: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -46,7 +46,7 @@ export const CreateQuotationSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -73,7 +73,7 @@ export const UpdateQuotationSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))

6
src/schemas/orders.schema.ts
View File

@@ -14,7 +14,7 @@ const OrderItemSchema = z.object({
.transform((v) => Number(v) || 0)
.optional()
.default(0),
is_included_in_total: z.any().optional().default(true),
is_included_in_total: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
position: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -55,7 +55,7 @@ export const CreateOrderSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(21.0),
apply_vat: z.any().optional().default(true),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
exchange_rate: z
.union([z.number(), z.string()])
.transform((v) => Number(v))
@@ -82,7 +82,7 @@ export const UpdateOrderSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
apply_vat: z.any().optional(),
apply_vat: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
items: z.array(OrderItemSchema).optional(),
sections: z.array(OrderSectionSchema).optional(),
});

4
src/schemas/trips.schema.ts
View File

@@ -11,7 +11,7 @@ export const CreateTripSchema = z.object({
end_km: z.union([z.number(), z.string()]).transform((v) => Number(v)),
route_from: z.string(),
route_to: z.string(),
is_business: z.any().optional().default(false),
is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(false),
notes: z.string().nullish(),
});
@@ -27,7 +27,7 @@ export const UpdateTripSchema = z.object({
.optional(),
route_from: z.string().optional(),
route_to: z.string().optional(),
is_business: z.any().optional(),
is_business: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
notes: z.string().nullish(),
});

4
src/schemas/users.schema.ts
View File

@@ -7,7 +7,7 @@ export const CreateUserSchema = z.object({
first_name: z.string().min(1, "Jméno je povinné"),
last_name: z.string().min(1, "Příjmení je povinné"),
role_id: z.union([z.number(), z.string()]).transform((v) => Number(v)),
is_active: z.any().optional().default(true),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
});
export const UpdateUserSchema = z.object({
@@ -17,7 +17,7 @@ export const UpdateUserSchema = z.object({
first_name: z.string().optional(),
last_name: z.string().optional(),
role_id: z.union([z.number(), z.string(), z.null()]).optional(),
is_active: z.any().optional(),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
});
export type CreateUserInput = z.infer<typeof CreateUserSchema>;

4
src/schemas/vehicles.schema.ts
View File

@@ -15,7 +15,7 @@ export const CreateVehicleSchema = z.object({
.transform((v) => Number(v))
.optional()
.default(0),
is_active: z.any().optional().default(true),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional().default(true),
});
export const UpdateVehicleSchema = z.object({
@@ -31,7 +31,7 @@ export const UpdateVehicleSchema = z.object({
.union([z.number(), z.string()])
.transform((v) => Number(v))
.optional(),
is_active: z.any().optional(),
is_active: z.preprocess(v => v === true || v === 1 || v === "1", z.boolean()).optional(),
});
export type CreateVehicleInput = z.infer<typeof CreateVehicleSchema>;