boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix(nas): order PDF archive uses orders.view (parity w/ invoices) + document NAS_INVOICES/NAS_ORDERS

Browse Source 
Review follow-ups: the ?save=1 archive route required orders.export while the
save that triggers it only needs orders.edit, so an editor's fire-and-forget
archive 403'd silently. Use requireAnyPermission(orders.view, orders.export) to
match invoices-pdf (invoices.view). Also refresh .env.example for the split vars.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-06-09 20:59:06 +02:00
parent 841ab676ec
commit 3268cf2100
2 changed files with 9 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.env.example
View File

@@ -37,7 +37,8 @@ REFRESH_TOKEN_REMEMBER_EXPIRY=2592000
# ── File storage (NAS network shares) ───────────────────────────────────── # ── File storage (NAS network shares) ─────────────────────────────────────
NAS_PATH=Z:/02_PROJEKTY NAS_PATH=Z:/02_PROJEKTY
# NAS_FINANCIALS_PATH= # NAS_INVOICES= # invoice PDFs — {base}/Vydané|Přijaté/YYYY/MM/ (falls back to NAS_FINANCIALS_PATH if unset)
# NAS_ORDERS= # issued-order PDF archival — {base}/Vydané/YYYY/MM/ (off until set)
# NAS_OFFERS_PATH= # NAS_OFFERS_PATH=
MAX_UPLOAD_SIZE=52428800 # 50 MB MAX_UPLOAD_SIZE=52428800 # 50 MB

9
src/routes/admin/issued-orders-pdf.ts
View File

@@ -1,6 +1,6 @@
import { FastifyInstance } from "fastify"; import { FastifyInstance } from "fastify";
import prisma from "../../config/database"; import prisma from "../../config/database";
import { requirePermission } from "../../middleware/auth"; import { requireAnyPermission } from "../../middleware/auth";
import { parseId, success } from "../../utils/response"; import { parseId, success } from "../../utils/response";
import { localDateCzStr } from "../../utils/date"; import { localDateCzStr } from "../../utils/date";
import { htmlToPdf } from "../../utils/html-to-pdf"; import { htmlToPdf } from "../../utils/html-to-pdf";
@@ -821,7 +821,12 @@ ${indentCSS}
export default async function issuedOrdersPdfRoutes(fastify: FastifyInstance) { export default async function issuedOrdersPdfRoutes(fastify: FastifyInstance) {
fastify.get<{ Params: { id: string } }>( fastify.get<{ Params: { id: string } }>(
"/:id", "/:id",
{ preHandler: requirePermission("orders.export") }, // Mirror invoices-pdf (invoices.view): view-level access serves both the
// user-facing Export PDF and the ?save=1 NAS archive. Using requireAny so an
// order editor (who has orders.view) can trigger archival on save without
// also needing orders.export — otherwise the fire-and-forget archive 403s
// silently. orders.export holders keep access too.
{ preHandler: requireAnyPermission("orders.view", "orders.export") },
async (request, reply) => { async (request, reply) => {
const id = parseId(request.params.id, reply); const id = parseId(request.params.id, reply);
if (id === null) return; if (id === null) return;