fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

src/admin/pages/WarehouseReservations.tsx

@@ -1,6 +1,6 @@
 import { useState } from "react";
 import { useNavigate } from "react-router-dom";
-import { useQuery, useQueryClient } from "@tanstack/react-query";
+import { useQuery } from "@tanstack/react-query";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
 import Forbidden from "../components/Forbidden";
@@ -9,12 +9,12 @@ import IconButton from "@mui/material/IconButton";
 import { usePaginatedQuery } from "../hooks/usePaginatedQuery";
 import ItemPicker from "../components/warehouse/ItemPicker";
 
-import apiFetch from "../utils/api";
 import { formatDate, czechPlural } from "../utils/formatters";
 import {
   warehouseReservationListOptions,
   type WarehouseReservation,
 } from "../lib/queries/warehouse";
+import { useApiMutation } from "../lib/queries/mutations";
 import { projectListOptions } from "../lib/queries/projects";
 import {
   Button,
@@ -106,11 +106,17 @@ interface ReservationForm {
   notes: string;
 }
 
+interface CreateReservationPayload {
+  item_id: number;
+  project_id: number;
+  quantity: number;
+  notes: string | null;
+}
+
 export default function WarehouseReservations() {
   const navigate = useNavigate();
   const alert = useAlert();
   const { hasPermission } = useAuth();
-  const queryClient = useQueryClient();
 
   const [page, setPage] = useState(1);
   const [statusFilter, setStatusFilter] = useState<string>("");
@@ -148,6 +154,29 @@ export default function WarehouseReservations() {
       }),
     );
 
+  const createMutation = useApiMutation<CreateReservationPayload, void>({
+    url: () => "/api/admin/warehouse/reservations",
+    method: () => "POST",
+    invalidate: ["warehouse"],
+    onSuccess: () => {
+      setShowCreateModal(false);
+      setForm({ item_id: null, project_id: null, quantity: 0, notes: "" });
+      alert.success("Rezervace byla vytvořena");
+    },
+  });
+
+  const cancelMutation = useApiMutation<number, void>({
+    url: (reservationId) =>
+      `/api/admin/warehouse/reservations/${reservationId}/cancel`,
+    method: () => "POST",
+    invalidate: ["warehouse"],
+    onSuccess: () => {
+      setCancelTarget(null);
+      alert.success("Rezervace byla zrušena");
+    },
+  });
+
+  // All hooks above this line — permission gate is the last thing before render.
   if (!hasPermission("warehouse.view")) return <Forbidden />;
 
   const canOperate = hasPermission("warehouse.operate");
@@ -161,33 +190,25 @@ export default function WarehouseReservations() {
   const hasActiveFilters = statusFilter || projectId;
 
   const handleCreate = async () => {
-    if (!form.item_id || !form.project_id || form.quantity <= 0) {
+    if (
+      !form.item_id ||
+      !form.project_id ||
+      !Number.isFinite(form.quantity) ||
+      form.quantity <= 0
+    ) {
       alert.error("Vyplňte položku, projekt a množství");
       return;
     }
     setSaving(true);
     try {
-      const response = await apiFetch("/api/admin/warehouse/reservations", {
-        method: "POST",
-        headers: { "Content-Type": "application/json" },
-        body: JSON.stringify({
-          item_id: form.item_id,
-          project_id: form.project_id,
-          quantity: form.quantity,
-          notes: form.notes.trim() || null,
-        }),
+      await createMutation.mutateAsync({
+        item_id: form.item_id,
+        project_id: form.project_id,
+        quantity: form.quantity,
+        notes: form.notes.trim() || null,
       });
-      const result = await response.json();
-      if (result.success) {
-        queryClient.invalidateQueries({ queryKey: ["warehouse"] });
-        setShowCreateModal(false);
-        setForm({ item_id: null, project_id: null, quantity: 0, notes: "" });
-        alert.success("Rezervace byla vytvořena");
-      } else {
-        alert.error(result.error || "Nepodařilo se vytvořit rezervaci");
-      }
-    } catch {
-      alert.error("Chyba připojení");
+    } catch (e) {
+      alert.error(e instanceof Error ? e.message : "Chyba připojení");
     } finally {
       setSaving(false);
     }
@@ -197,20 +218,9 @@ export default function WarehouseReservations() {
     if (!cancelTarget) return;
     setCancelling(true);
     try {
-      const response = await apiFetch(
-        `/api/admin/warehouse/reservations/${cancelTarget.id}/cancel`,
-        { method: "POST" },
-      );
-      const result = await response.json();
-      if (result.success) {
-        queryClient.invalidateQueries({ queryKey: ["warehouse"] });
-        setCancelTarget(null);
-        alert.success("Rezervace byla zrušena");
-      } else {
-        alert.error(result.error || "Nepodařilo se zrušit rezervaci");
-      }
-    } catch {
-      alert.error("Chyba připojení");
+      await cancelMutation.mutateAsync(cancelTarget.id);
+    } catch (e) {
+      alert.error(e instanceof Error ? e.message : "Chyba připojení");
     } finally {
       setCancelling(false);
     }
@@ -451,12 +461,13 @@ export default function WarehouseReservations() {
           <TextField
             type="number"
             value={form.quantity || ""}
-            onChange={(e) =>
+            onChange={(e) => {
+              const n = Number(e.target.value);
               setForm((prev) => ({
                 ...prev,
-                quantity: Number(e.target.value),
-              }))
-            }
+                quantity: Number.isFinite(n) ? n : 0,
+              }));
+            }}
             inputProps={{ min: 0, step: 0.001 }}
           />
         </Field>