fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

scripts/migrate-received-invoices-to-nas.ts

@@ -5,6 +5,7 @@
  */
 
 import "../src/config/env";
+import fs from "fs";
 import { PrismaClient } from "@prisma/client";
 import { nasFinancialsManager } from "../src/services/nas-financials-manager";
 
@@ -51,6 +52,39 @@ async function main() {
       continue;
     }
 
+    // Read-back verification before we null out the ONLY DB copy of the bytes.
+    // The manager uses writeFileSync (synchronous) and returns a relative path;
+    // resolve it back to disk and confirm the file exists and its size matches
+    // the source buffer. A 0-byte/truncated/corrupt write would otherwise lose
+    // the invoice permanently once file_data is set to null. If verification
+    // fails we KEEP file_data and report the row as failed.
+    const expectedSize = rec.file_data.length;
+    const readBack = nasFinancialsManager.readReceivedInvoice(result.filePath);
+    let writtenSize = -1;
+    if (readBack) {
+      writtenSize = readBack.data.length;
+    } else {
+      // Fall back to a direct stat in case readReceivedInvoice's path guard
+      // rejects an otherwise-valid path; either way we need a confirmed size.
+      try {
+        writtenSize = fs.statSync(
+          (nasFinancialsManager as unknown as { basePath: string }).basePath +
+            "/" +
+            result.filePath,
+        ).size;
+      } catch {
+        writtenSize = -1;
+      }
+    }
+
+    if (writtenSize !== expectedSize) {
+      console.error(
+        `  FAIL id=${rec.id}: read-back mismatch (expected ${expectedSize} bytes, got ${writtenSize}); keeping DB copy`,
+      );
+      failed++;
+      continue;
+    }
+
     await prisma.received_invoices.update({
       where: { id: rec.id },
       data: { file_path: result.filePath, file_data: null },

scripts/rotate-totp-key.ts

@@ -1,35 +1,29 @@
-import crypto from 'crypto';
-import { PrismaClient } from '@prisma/client';
+import { PrismaClient } from "@prisma/client";
+import { decryptWithKey, encryptWithKey } from "../src/utils/encryption";
 
 const prisma = new PrismaClient();
 
-function decrypt(ciphertext: string, keyHex: string): string {
-  const key = Buffer.from(keyHex, 'hex');
-  const [ivHex, encHex, tagHex] = ciphertext.split(':');
-  const iv = Buffer.from(ivHex, 'hex');
-  const encrypted = Buffer.from(encHex, 'hex');
-  const tag = Buffer.from(tagHex, 'hex');
-  const decipher = crypto.createDecipheriv('aes-256-gcm', key, iv);
-  decipher.setAuthTag(tag);
-  return decipher.update(encrypted, undefined, 'utf8') + decipher.final('utf8');
-}
-
-function encrypt(plaintext: string, keyHex: string): string {
-  const key = Buffer.from(keyHex, 'hex');
-  const iv = crypto.randomBytes(12);
-  const cipher = crypto.createCipheriv('aes-256-gcm', key, iv);
-  const encrypted = Buffer.concat([cipher.update(plaintext, 'utf8'), cipher.final()]);
-  const tag = cipher.getAuthTag();
-  return `${iv.toString('hex')}:${encrypted.toString('hex')}:${tag.toString('hex')}`;
-}
+// Reuse the dual-format decrypt/encrypt from src/utils/encryption.ts so this
+// script handles BOTH wire formats: the TS `hex:hex:hex` form and the
+// PHP-legacy single-base64 blob. The previous hand-rolled `decrypt` only parsed
+// the TS form and threw `Buffer.from(undefined, 'hex')` on any legacy secret —
+// inside the $transaction that aborted/rolled back the ENTIRE batch on the first
+// legacy user. These key-parameterized helpers accept the old/new keys passed on
+// the command line (the config-bound `decrypt`/`encrypt` use the env key only).
+const decrypt = (ciphertext: string, keyHex: string): string =>
+  decryptWithKey(ciphertext, keyHex);
+const encrypt = (plaintext: string, keyHex: string): string =>
+  encryptWithKey(plaintext, keyHex);
 
 async function main() {
   const oldKey = process.argv[2];
   const newKey = process.argv[3];
-  const dryRun = process.argv.includes('--dry-run');
+  const dryRun = process.argv.includes("--dry-run");
 
   if (!oldKey || !newKey) {
-    console.error('Usage: tsx scripts/rotate-totp-key.ts <old-key-hex> <new-key-hex> [--dry-run]');
+    console.error(
+      "Usage: tsx scripts/rotate-totp-key.ts <old-key-hex> <new-key-hex> [--dry-run]",
+    );
     process.exit(1);
   }
 
@@ -46,12 +40,14 @@ async function main() {
         const decrypted = decrypt(user.totp_secret!, oldKey);
         const reEncrypted = encrypt(decrypted, newKey);
         decrypt(reEncrypted, newKey); // verify round-trip
-        console.log(`  [OK] ${user.username} (id=${user.id}) — decryption and re-encryption verified`);
+        console.log(
+          `  [OK] ${user.username} (id=${user.id}) — decryption and re-encryption verified`,
+        );
       } catch (e) {
         console.error(`  [FAIL] ${user.username} (id=${user.id}) — ${e}`);
       }
     }
-    console.log('\nDry run complete. No changes made.');
+    console.log("\nDry run complete. No changes made.");
     return;
   }
 
@@ -59,13 +55,19 @@ async function main() {
     for (const user of users) {
       const decrypted = decrypt(user.totp_secret!, oldKey);
       const reEncrypted = encrypt(decrypted, newKey);
-      await tx.users.update({ where: { id: user.id }, data: { totp_secret: reEncrypted } });
+      await tx.users.update({
+        where: { id: user.id },
+        data: { totp_secret: reEncrypted },
+      });
       console.log(`  Re-encrypted TOTP for ${user.username} (id=${user.id})`);
     }
   });
 
-  console.log('\nAll TOTP secrets re-encrypted successfully.');
+  console.log("\nAll TOTP secrets re-encrypted successfully.");
   await prisma.$disconnect();
 }
 
-main().catch((e) => { console.error(e); process.exit(1); });
+main().catch((e) => {
+  console.error(e);
+  process.exit(1);
+});