security: fix all Critical and High findings from FLAWS_REPORT audit

- Auth: pessimistic locking on login tokens and refresh token rotation, backup code attempt counter, rate limiting verification - Schema: unique constraints on business numbers, FK relations, unsigned/signed alignment, attendance duplicate prevention - Invoices/PDFs: DOMPurify sanitization, bounded queries in stats and alerts, VAT rounding, Puppeteer error handling - Orders/Offers: transactional parent+child creation, Zod NaN refinement, status enums, uniqueness checks - Projects/Files: path traversal protection, streamed uploads, permission guards, query param validation - Attendance/HR: duplicate checks, ownership validation, GPS restrictions, trip distance validation - Frontend: modal lock reference counting, XSS escaping in print HTML, ref mutation fixes, accessibility attributes Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-24 00:58:35 +02:00
parent 122eee175e
commit 528e55991b
57 changed files with 2355 additions and 1010 deletions
--- a/src/admin/components/AdminDatePicker.tsx
+++ b/src/admin/components/AdminDatePicker.tsx
@@ -91,7 +91,7 @@ function NativeInput({
 }

 interface AdminDatePickerProps {
-  mode?: "date" | "month" | "datetime" | "time";
+  mode?: "date" | "month" | "time";
  value: string;
  onChange: (value: string) => void;
  minDate?: string;
--- a/src/admin/components/BulkAttendanceModal.tsx
+++ b/src/admin/components/BulkAttendanceModal.tsx
@@ -57,13 +57,21 @@ export default function BulkAttendanceModal({
          />
          <motion.div
            className="admin-modal admin-modal-lg"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="bulk-attendance-modal-title"
            initial={{ opacity: 0, scale: 0.95, y: 20 }}
            animate={{ opacity: 1, scale: 1, y: 0 }}
            exit={{ opacity: 0, scale: 0.95, y: 20 }}
            transition={{ duration: 0.2 }}
          >
            <div className="admin-modal-header">
-              <h2 className="admin-modal-title">Vyplnit docházku za měsíc</h2>
+              <h2
+                id="bulk-attendance-modal-title"
+                className="admin-modal-title"
+              >
+                Vyplnit docházku za měsíc
+              </h2>
              <p
                style={{
                  color: "var(--text-secondary)",
--- a/src/admin/components/ConfirmModal.tsx
+++ b/src/admin/components/ConfirmModal.tsx
@@ -39,6 +39,9 @@ export default function ConfirmModal({
          <div className="admin-modal-backdrop" onClick={onClose} />
          <motion.div
            className="admin-modal admin-confirm-modal"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="confirm-modal-title"
            initial={{ opacity: 0, scale: 0.95, y: 20 }}
            animate={{ opacity: 1, scale: 1, y: 0 }}
            exit={{ opacity: 0, scale: 0.95, y: 20 }}
@@ -59,7 +62,9 @@ export default function ConfirmModal({
                  <line x1="12" y1="17" x2="12.01" y2="17" />
                </svg>
              </div>
-              <h2 className="admin-confirm-title">{title}</h2>
+              <h2 id="confirm-modal-title" className="admin-confirm-title">
+                {title}
+              </h2>
              <p className="admin-confirm-message">{message}</p>
            </div>
            <div className="admin-modal-footer">
--- a/src/admin/components/OrderConfirmationModal.tsx
+++ b/src/admin/components/OrderConfirmationModal.tsx
@@ -109,13 +109,19 @@ export default function OrderConfirmationModal({
            className={
              step === "edit" ? "admin-modal admin-modal-lg" : "admin-modal"
            }
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="order-confirmation-modal-title"
            initial={{ opacity: 0, scale: 0.95, y: 20 }}
            animate={{ opacity: 1, scale: 1, y: 0 }}
            exit={{ opacity: 0, scale: 0.95, y: 20 }}
            transition={{ duration: 0.2 }}
          >
            <div className="admin-modal-header">
-              <h2 className="admin-modal-title">
+              <h2
+                id="order-confirmation-modal-title"
+                className="admin-modal-title"
+              >
                Potvrzení objednávky {orderNumber}
              </h2>
            </div>
--- a/src/admin/components/ProjectFileManager.tsx
+++ b/src/admin/components/ProjectFileManager.tsx
@@ -197,6 +197,7 @@ export default function ProjectFileManager({
 }: ProjectFileManagerProps) {
  const alert = useAlert();
  const fileInputRef = useRef<HTMLInputElement>(null);
+  const isCancelling = useRef(false);

  const [items, setItems] = useState<FileItem[]>([]);
  const [loading, setLoading] = useState(true);
@@ -768,10 +769,26 @@ export default function ProjectFileManager({
                            }}
                            autoFocus
                            onKeyDown={(e) => {
-                              if (e.key === "Enter") handleRename(item);
-                              if (e.key === "Escape") setRenamingItem(null);
+                              if (e.key === "Enter") {
+                                e.preventDefault();
+                                handleRename(item);
+                              }
+                              if (e.key === "Escape") {
+                                e.preventDefault();
+                                isCancelling.current = true;
+                                setRenamingItem(null);
+                                setRenameValue(item.name);
+                                setTimeout(() => {
+                                  isCancelling.current = false;
+                                }, 0);
+                              }
+                            }}
+                            onBlur={() => {
+                              if (isCancelling.current) {
+                                return;
+                              }
+                              handleRename(item);
                            }}
-                            onBlur={() => handleRename(item)}
                          />
                        ) : (
                          <FileNameCell
--- a/src/admin/components/ShiftFormModal.tsx
+++ b/src/admin/components/ShiftFormModal.tsx
@@ -251,13 +251,16 @@ export default function ShiftFormModal({
          <div className="admin-modal-backdrop" onClick={onClose} />
          <motion.div
            className="admin-modal admin-modal-lg"
+            role="dialog"
+            aria-modal="true"
+            aria-labelledby="shift-form-modal-title"
            initial={{ opacity: 0, scale: 0.95, y: 20 }}
            animate={{ opacity: 1, scale: 1, y: 0 }}
            exit={{ opacity: 0, scale: 0.95, y: 20 }}
            transition={{ duration: 0.2 }}
          >
            <div className="admin-modal-header">
-              <h2 className="admin-modal-title">
+              <h2 id="shift-form-modal-title" className="admin-modal-title">
                {isCreate ? "Přidat záznam docházky" : "Upravit docházku"}
              </h2>
              {!isCreate && editingRecord && (
--- a/src/admin/context/AlertContext.tsx
+++ b/src/admin/context/AlertContext.tsx
@@ -5,6 +5,7 @@ import {
  useCallback,
  useMemo,
  useRef,
+  useEffect,
  type ReactNode,
 } from "react";

@@ -39,6 +40,15 @@ export function AlertProvider({ children }: { children: ReactNode }) {
  }, []);

  const counterRef = useRef(0);
+  const timeoutsRef = useRef<Set<ReturnType<typeof setTimeout>>>(new Set());
+
+  useEffect(() => {
+    return () => {
+      timeoutsRef.current.forEach(clearTimeout);
+      timeoutsRef.current.clear();
+    };
+  }, []);
+
  const addAlert = useCallback(
    (message: string, type = "success", duration = 4000) => {
      const id = `${Date.now()}-${counterRef.current++}`;
@@ -47,7 +57,8 @@ export function AlertProvider({ children }: { children: ReactNode }) {
        { id, message, type: type as Alert["type"] },
      ]);
      if (duration > 0) {
-        setTimeout(() => removeAlert(id), duration);
+        const timeoutId = setTimeout(() => removeAlert(id), duration);
+        timeoutsRef.current.add(timeoutId);
      }
      return id;
    },
--- a/src/admin/context/AuthContext.tsx
+++ b/src/admin/context/AuthContext.tsx
@@ -84,32 +84,35 @@ function mapUser(u: Record<string, unknown> | null): User | null {
  } as User;
 }

-let accessToken: string | null = null;
-let tokenExpiresAt: number | null = null;
-let cachedUser: User | null = null;
-let sessionFetched = false;
-let silentRefreshInFlight: Promise<boolean> | null = null;
-
 export function AuthProvider({ children }: { children: ReactNode }) {
-  const [user, setUser] = useState<User | null>(cachedUser);
-  const [loading, setLoading] = useState(!sessionFetched);
+  const accessTokenRef = useRef<string | null>(null);
+  const tokenExpiresAtRef = useRef<number | null>(null);
+  const cachedUserRef = useRef<User | null>(null);
+  const sessionFetchedRef = useRef(false);
+  const silentRefreshInFlightRef = useRef<Promise<boolean> | null>(null);
+  const [user, setUser] = useState<User | null>(cachedUserRef.current);
+  const [loading, setLoading] = useState(!sessionFetchedRef.current);
  const [error, setError] = useState<string | null>(null);
  const refreshTimeoutRef = useRef<ReturnType<typeof setTimeout> | null>(null);

  useEffect(() => {
-    cachedUser = user;
+    cachedUserRef.current = user;
  }, [user]);

  const getAccessTokenFn = useCallback((): string | null => {
-    if (!tokenExpiresAt || Date.now() > tokenExpiresAt - 30000) return null;
-    return accessToken;
+    if (
+      !tokenExpiresAtRef.current ||
+      Date.now() > tokenExpiresAtRef.current - 30000
+    )
+      return null;
+    return accessTokenRef.current;
  }, []);

  const setAccessTokenFn = useCallback(
    (token: string | null, expiresIn?: number) => {
      const ttl = expiresIn ?? 900; // default 15 min matching backend config
-      accessToken = token;
-      tokenExpiresAt = token ? Date.now() + ttl * 1000 : null;
+      accessTokenRef.current = token;
+      tokenExpiresAtRef.current = token ? Date.now() + ttl * 1000 : null;
      if (refreshTimeoutRef.current) {
        clearTimeout(refreshTimeoutRef.current);
        refreshTimeoutRef.current = null;
@@ -126,7 +129,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {

  const silentRefresh = useCallback(async (): Promise<boolean> => {
    // Deduplicate concurrent refresh calls — token rotation means only one call can succeed
-    if (silentRefreshInFlight) return silentRefreshInFlight;
+    if (silentRefreshInFlightRef.current)
+      return silentRefreshInFlightRef.current;

    const promise = (async (): Promise<boolean> => {
      try {
@@ -140,21 +144,21 @@ export function AuthProvider({ children }: { children: ReactNode }) {
          setUser(mapUser(data.data.user));
          return true;
        }
-        accessToken = null;
-        tokenExpiresAt = null;
+        accessTokenRef.current = null;
+        tokenExpiresAtRef.current = null;
        setUser(null);
-        cachedUser = null;
+        cachedUserRef.current = null;
        setSessionExpired();
        return false;
      } catch {
        // Network error — don't kick the user out, just return false
        return false;
      } finally {
-        silentRefreshInFlight = null;
+        silentRefreshInFlightRef.current = null;
      }
    })();

-    silentRefreshInFlight = promise;
+    silentRefreshInFlightRef.current = promise;
    return promise;
  }, [setAccessTokenFn]);

@@ -172,12 +176,12 @@ export function AuthProvider({ children }: { children: ReactNode }) {
          headers,
        });
        if (response.status === 429 || response.status >= 500)
-          return !!cachedUser;
+          return !!cachedUserRef.current;
        const data = await response.json();
        if (data.success && data.data?.user) {
          if (data.data.access_token) setAccessTokenFn(data.data.access_token);
          setUser(mapUser(data.data.user));
-          cachedUser = mapUser(data.data.user);
+          cachedUserRef.current = mapUser(data.data.user);
          return true;
        }
      }
@@ -185,15 +189,15 @@ export function AuthProvider({ children }: { children: ReactNode }) {
      const refreshed = await silentRefresh();
      if (refreshed) return true;
      setUser(null);
-      cachedUser = null;
-      accessToken = null;
-      tokenExpiresAt = null;
+      cachedUserRef.current = null;
+      accessTokenRef.current = null;
+      tokenExpiresAtRef.current = null;
      return false;
    } catch {
-      return !!cachedUser;
+      return !!cachedUserRef.current;
    } finally {
      setLoading(false);
-      sessionFetched = true;
+      sessionFetchedRef.current = true;
    }
  }, [getAccessTokenFn, setAccessTokenFn, silentRefresh]);

@@ -231,8 +235,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
          }
          setAccessTokenFn(data.data.access_token, data.data.expires_in);
          setUser(mapUser(data.data.user));
-          cachedUser = mapUser(data.data.user);
-          sessionFetched = true;
+          cachedUserRef.current = mapUser(data.data.user);
+          sessionFetchedRef.current = true;
          return { success: true };
        }
        setError(data.error);
@@ -270,8 +274,8 @@ export function AuthProvider({ children }: { children: ReactNode }) {
        if (data.success) {
          setAccessTokenFn(data.data.access_token, data.data.expires_in);
          setUser(mapUser(data.data.user));
-          cachedUser = mapUser(data.data.user);
-          sessionFetched = true;
+          cachedUserRef.current = mapUser(data.data.user);
+          sessionFetchedRef.current = true;
          return { success: true };
        }
        setError(data.error);
@@ -296,11 +300,11 @@ export function AuthProvider({ children }: { children: ReactNode }) {
    } catch {
      /* ignore */
    } finally {
-      accessToken = null;
-      tokenExpiresAt = null;
+      accessTokenRef.current = null;
+      tokenExpiresAtRef.current = null;
      setUser(null);
-      cachedUser = null;
-      sessionFetched = false;
+      cachedUserRef.current = null;
+      sessionFetchedRef.current = false;
      if (refreshTimeoutRef.current) {
        clearTimeout(refreshTimeoutRef.current);
        refreshTimeoutRef.current = null;
--- a/src/admin/hooks/useApiCall.ts
+++ b/src/admin/hooks/useApiCall.ts
@@ -23,8 +23,9 @@ export default function useApiCall() {
      abortRef.current = controller;

      try {
+        const { signal: _, ...restOptions } = options;
        const response = await apiFetch(url, {
-          ...options,
+          ...restOptions,
          signal: controller.signal,
        });
        const data = await response.json();
--- a/src/admin/hooks/useAttendanceAdmin.ts
+++ b/src/admin/hooks/useAttendanceAdmin.ts
@@ -224,11 +224,20 @@ function computeUserTotals(
 // Print helpers
 // ---------------------------------------------------------------------------

+function escapeHtml(str: string): string {
+  return str
+    .replace(/&/g, "&amp;")
+    .replace(/</g, "&lt;")
+    .replace(/>/g, "&gt;")
+    .replace(/"/g, "&quot;")
+    .replace(/'/g, "&#039;");
+}
+
 function renderFundStatus(userData: Record<string, any>): string {
  if (userData.overtime > 0)
-    return `<span class="leave-badge badge-overtime">+${userData.overtime}h přesčas</span>`;
+    return `<span class="leave-badge badge-overtime">+${escapeHtml(String(userData.overtime))}h přesčas</span>`;
  if (userData.missing > 0)
-    return `<span style="color:#dc2626">−${userData.missing}h</span>`;
+    return `<span style="color:#dc2626">−${escapeHtml(String(userData.missing))}h</span>`;
  return '<span style="color:#16a34a">splněno</span>';
 }

@@ -255,11 +264,11 @@ function buildProjectLogsHtml(record: Record<string, any>): string {
          h = 0;
          m = 0;
        }
-        return `<div>${log.project_name || `#${log.project_id}`} (${h}:${String(m).padStart(2, "0")}h)</div>`;
+        return `<div>${escapeHtml(log.project_name || `#${log.project_id}`)} (${h}:${String(m).padStart(2, "0")}h)</div>`;
      })
      .join("");
  }
-  return record.project_name || "—";
+  return escapeHtml(record.project_name || "—");
 }

 function buildLeaveSummaryHtml(
@@ -268,15 +277,15 @@ function buildLeaveSummaryHtml(
  printData: Record<string, any>,
 ): string {
  const bal = printData.leave_balances[userId];
-  let parts = `<strong>Dovolená ${printData.year}:</strong> Zbývá ${bal.vacation_remaining.toFixed(1)}h z ${bal.vacation_total}h`;
+  let parts = `<strong>Dovolená ${escapeHtml(String(printData.year))}:</strong> Zbývá ${bal.vacation_remaining.toFixed(1)}h z ${bal.vacation_total}h`;
  if (userData.vacation_hours > 0)
-    parts += ` | <span class="leave-badge badge-vacation">Tento měsíc: ${userData.vacation_hours}h</span>`;
+    parts += ` | <span class="leave-badge badge-vacation">Tento měsíc: ${escapeHtml(String(userData.vacation_hours))}h</span>`;
  if (userData.sick_hours > 0)
-    parts += ` | <span class="leave-badge badge-sick">Nemoc: ${userData.sick_hours}h</span>`;
+    parts += ` | <span class="leave-badge badge-sick">Nemoc: ${escapeHtml(String(userData.sick_hours))}h</span>`;
  if (userData.holiday_hours > 0)
-    parts += ` | <span class="leave-badge badge-holiday">Svátek: ${userData.holiday_hours}h</span>`;
+    parts += ` | <span class="leave-badge badge-holiday">Svátek: ${escapeHtml(String(userData.holiday_hours))}h</span>`;
  if (userData.overtime > 0)
-    parts += ` | <span class="leave-badge badge-overtime">Přesčas: +${userData.overtime}h</span>`;
+    parts += ` | <span class="leave-badge badge-overtime">Přesčas: +${escapeHtml(String(userData.overtime))}h</span>`;
  return `<div class="leave-summary">${parts}</div>`;
 }

@@ -299,17 +308,17 @@ function buildUserSectionHtml(
      const breakCell =
        isLeave || !record.break_start || !record.break_end
          ? "—"
-          : `${formatTimeOrDatetimePrint(record.break_start, record.shift_date)} - ${formatTimeOrDatetimePrint(record.break_end, record.shift_date)}`;
+          : `${escapeHtml(formatTimeOrDatetimePrint(record.break_start, record.shift_date))} - ${escapeHtml(formatTimeOrDatetimePrint(record.break_end, record.shift_date))}`;

      return `<tr>
-      <td>${formatDate(record.shift_date)}</td>
-      <td><span class="leave-badge ${getLeaveTypeBadgeClass(leaveType)}">${getLeaveTypeName(leaveType)}</span></td>
-      <td class="text-center">${isLeave ? "—" : formatTimeOrDatetimePrint(record.arrival_time, record.shift_date)}</td>
+      <td>${escapeHtml(formatDate(record.shift_date))}</td>
+      <td><span class="leave-badge ${escapeHtml(getLeaveTypeBadgeClass(leaveType))}">${escapeHtml(getLeaveTypeName(leaveType))}</span></td>
+      <td class="text-center">${isLeave ? "—" : escapeHtml(formatTimeOrDatetimePrint(record.arrival_time, record.shift_date))}</td>
      <td class="text-center">${breakCell}</td>
-      <td class="text-center">${isLeave ? "—" : formatTimeOrDatetimePrint(record.departure_time, record.shift_date)}</td>
+      <td class="text-center">${isLeave ? "—" : escapeHtml(formatTimeOrDatetimePrint(record.departure_time, record.shift_date))}</td>
      <td class="text-center">${workMinutes > 0 ? `${hours}:${String(mins).padStart(2, "0")}` : "—"}</td>
      <td style="font-size:8px">${buildProjectLogsHtml(record)}</td>
-      <td>${record.notes || ""}</td>
+      <td>${escapeHtml(record.notes || "")}</td>
    </tr>`;
    })
    .join("");
@@ -318,15 +327,15 @@ function buildUserSectionHtml(
    userData.fund !== null
      ? `<tr>
        <td colspan="6" class="text-right">Fond měsíce:</td>
-        <td class="text-center">${userData.covered}h / ${userData.fund}h</td>
+        <td class="text-center">${escapeHtml(String(userData.covered))}h / ${escapeHtml(String(userData.fund))}h</td>
        <td colspan="2">${renderFundStatus(userData)}</td>
      </tr>`
      : "";

  return `<div class="user-section">
    <div class="user-header">
-      <h3>${userData.name}</h3>
-      <span class="total">Odpracováno: ${formatMinutes(userData.minutes)} h</span>
+      <h3>${escapeHtml(userData.name)}</h3>
+      <span class="total">Odpracováno: ${escapeHtml(formatMinutes(userData.minutes))} h</span>
    </div>
    ${leaveHtml}
    <table>
@@ -344,7 +353,7 @@ function buildUserSectionHtml(
      <tfoot>
        <tr>
          <td colspan="6" class="text-right">Odpracováno:</td>
-          <td class="text-center">${formatMinutes(userData.minutes)} h</td>
+          <td class="text-center">${escapeHtml(formatMinutes(userData.minutes))} h</td>
          <td colspan="2"></td>
        </tr>
        ${fundRow}
@@ -365,7 +374,7 @@ function buildPrintHtml(
 <head>
  <meta charset="UTF-8">
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
-  <title>Docházka - ${pData.month_name}</title>
+  <title>Docházka - ${escapeHtml(pData.month_name)}</title>
  <style>
    * { margin: 0; padding: 0; box-sizing: border-box; }
    body {
@@ -428,11 +437,11 @@ function buildPrintHtml(
          <img src="/api/admin/company-settings/logo?variant=light" alt="" class="print-logo" />
          <div class="print-header-text">
            <h1>EVIDENCE DOCHÁZKY</h1>
-            <div class="company">${companyName}</div>
+            <div class="company">${escapeHtml(companyName)}</div>
          </div>
        </div>
        <div class="print-header-right">
-          <div class="period">${pData.month_name}</div>
+          <div class="period">${escapeHtml(pData.month_name)}</div>
          ${filterNote}
          <div class="generated">Vygenerováno: ${new Date().toLocaleString("cs-CZ")}</div>
        </div>
@@ -1037,7 +1046,7 @@ export default function useAttendanceAdmin({ alert }: AlertContext) {
            ? '<p style="text-align:center;padding:20px">Za vybrané období nejsou žádné záznamy.</p>'
            : "";
        const filterNote = pData.selected_user_name
-          ? `<div class="filters">Zaměstnanec: ${pData.selected_user_name}</div>`
+          ? `<div class="filters">Zaměstnanec: ${escapeHtml(pData.selected_user_name)}</div>`
          : "";
        const bodyContent = buildPrintHtml(
          pData,
--- a/src/admin/hooks/useModalLock.ts
+++ b/src/admin/hooks/useModalLock.ts
@@ -1,14 +1,16 @@
 import { useEffect } from "react";

+let activeLocks = 0;
+
 export default function useModalLock(isOpen: boolean): void {
  useEffect(() => {
    if (isOpen) {
-      document.body.style.overflow = "hidden";
-    } else {
-      document.body.style.overflow = "";
+      if (activeLocks === 0) document.body.style.overflow = "hidden";
+      activeLocks++;
+      return () => {
+        activeLocks = Math.max(0, activeLocks - 1);
+        if (activeLocks === 0) document.body.style.overflow = "";
+      };
    }
-    return () => {
-      document.body.style.overflow = "";
-    };
  }, [isOpen]);
 }
--- a/src/admin/pages/InvoiceDetail.tsx
+++ b/src/admin/pages/InvoiceDetail.tsx
@@ -313,7 +313,7 @@ export default function InvoiceDetail() {
  const { id } = useParams<{ id: string }>();
  const isEdit = Boolean(id);

-  const keyCounterRef = useRef(0);
+  const keyCounterRef = useRef(1);
  const emptyItem = useCallback(
    (): InvoiceItem => ({
      _key: `inv-${++keyCounterRef.current}`,
@@ -369,7 +369,16 @@ export default function InvoiceDetail() {

  const [bankAccounts, setBankAccounts] = useState<BankAccount[]>([]);
  const [dueDays, setDueDays] = useState(14);
-  const [items, setItems] = useState<InvoiceItem[]>([emptyItem()]);
+  const [items, setItems] = useState<InvoiceItem[]>([
+    {
+      _key: "inv-1",
+      description: "",
+      quantity: 1,
+      unit: "ks",
+      unit_price: 0,
+      vat_rate: 21,
+    },
+  ]);
  const [errors, setErrors] = useState<Record<string, string>>({});
  const [saving, setSaving] = useState(false);
  const [loading, setLoading] = useState(true);
--- a/src/admin/pages/Invoices.tsx
+++ b/src/admin/pages/Invoices.tsx
@@ -138,8 +138,18 @@ export default function Invoices() {
  const [statsLoading, setStatsLoading] = useState(true);
  const hasLoadedOnce = useRef(false);
  const slideDirection = useRef(0);
+  const blobUrlRef = useRef<string | null>(null);
  const [slideKey, setSlideKey] = useState(0);

+  useEffect(() => {
+    return () => {
+      if (blobUrlRef.current) {
+        URL.revokeObjectURL(blobUrlRef.current);
+        blobUrlRef.current = null;
+      }
+    };
+  }, []);
+
  const isCurrentMonth =
    statsMonth === now.getMonth() + 1 && statsYear === now.getFullYear();
  const monthLabel = `${MONTH_NAMES[statsMonth - 1]} ${statsYear}`;
@@ -299,9 +309,11 @@ export default function Invoices() {
        return;
      }
      const blob = await response.blob();
-      const url = URL.createObjectURL(blob);
-      if (newWindow) newWindow.location.href = url;
-      setTimeout(() => URL.revokeObjectURL(url), 60000);
+      if (blobUrlRef.current) {
+        URL.revokeObjectURL(blobUrlRef.current);
+      }
+      blobUrlRef.current = URL.createObjectURL(blob);
+      if (newWindow) newWindow.location.href = blobUrlRef.current;
    } catch {
      alert.error("Chyba při generování PDF");
    } finally {
--- a/src/admin/pages/OfferDetail.tsx
+++ b/src/admin/pages/OfferDetail.tsx
@@ -55,9 +55,6 @@ interface OfferItem {
  is_included_in_total: boolean;
 }

-let _itemKeyCounter = 0;
-const nextItemKey = () => `item-${++_itemKeyCounter}`;
-
 interface ScopeSection {
  title: string;
  title_cz: string;
@@ -113,16 +110,6 @@ const emptyScopeSection = (): ScopeSection => ({
  content: "",
 });

-const emptyItem = (): OfferItem => ({
-  _key: nextItemKey(),
-  description: "",
-  item_description: "",
-  quantity: 1,
-  unit: "ks",
-  unit_price: 0,
-  is_included_in_total: true,
-});
-
 function SortableItemRow({
  item,
  index,
@@ -288,11 +275,25 @@ export default function OfferDetail() {
    useSensor(KeyboardSensor),
  );

+  const itemKeyCounter = useRef(0);
+  const emptyItem = useCallback(
+    (): OfferItem => ({
+      _key: `item-${++itemKeyCounter.current}`,
+      description: "",
+      item_description: "",
+      quantity: 1,
+      unit: "ks",
+      unit_price: 0,
+      is_included_in_total: true,
+    }),
+    [],
+  );
+
  const [loading, setLoading] = useState(isEdit);
  const [saving, setSaving] = useState(false);
  const [errors, setErrors] = useState<Record<string, string | undefined>>({});
  const [form, setForm] = useState<OfferForm>(emptyForm);
-  const [items, setItems] = useState<OfferItem[]>([emptyItem()]);
+  const [items, setItems] = useState<OfferItem[]>(() => [emptyItem()]);
  const [sections, setSections] = useState<ScopeSection[]>([]);
  const [scopeTemplates, setScopeTemplates] = useState<
    Array<{
@@ -397,7 +398,10 @@ export default function OfferDetail() {
        });
        setItems(
          d.items?.length
-            ? d.items.map((it: any) => ({ ...it, _key: nextItemKey() }))
+            ? d.items.map((it: any) => ({
+                ...it,
+                _key: `item-${++itemKeyCounter.current}`,
+              }))
            : [emptyItem()],
        );
        setSections(
--- a/src/admin/pages/Offers.tsx
+++ b/src/admin/pages/Offers.tsx
@@ -1,4 +1,4 @@
-import { useState } from "react";
+import { useState, useEffect, useRef } from "react";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
 import { Link, useNavigate } from "react-router-dom";
@@ -63,6 +63,16 @@ export default function Offers() {
    quotation: Quotation | null;
  }>({ show: false, quotation: null });
  const [invalidating, setInvalidating] = useState(false);
+  const blobUrlRef = useRef<string | null>(null);
+
+  useEffect(() => {
+    return () => {
+      if (blobUrlRef.current) {
+        URL.revokeObjectURL(blobUrlRef.current);
+        blobUrlRef.current = null;
+      }
+    };
+  }, []);
  const [duplicating, setDuplicating] = useState<number | null>(null);
  const [pdfLoading, setPdfLoading] = useState<number | null>(null);
  const [creatingOrder, setCreatingOrder] = useState<number | null>(null);
@@ -237,9 +247,11 @@ export default function Offers() {
        return;
      }
      const blob = await response.blob();
-      const url = URL.createObjectURL(blob);
-      if (newWindow) newWindow.location.href = url;
-      setTimeout(() => URL.revokeObjectURL(url), 60000);
+      if (blobUrlRef.current) {
+        URL.revokeObjectURL(blobUrlRef.current);
+      }
+      blobUrlRef.current = URL.createObjectURL(blob);
+      if (newWindow) newWindow.location.href = blobUrlRef.current;
    } catch {
      newWindow?.close();
      alert.error("Chyba připojení");
--- a/src/admin/pages/Settings.tsx
+++ b/src/admin/pages/Settings.tsx
@@ -76,6 +76,7 @@ export default function Settings() {
  const navigate = useNavigate();
  const [loading, setLoading] = useState(true);
  const [roles, setRoles] = useState<Role[]>([]);
+  const [users, setUsers] = useState<{ role_id: number }[]>([]);
  const [, setAllPermissions] = useState<Permission[]>([]);
  const [permissionGroups, setPermissionGroups] = useState<
    Record<string, Permission[]>
@@ -161,12 +162,14 @@ export default function Settings() {
      return;
    }
    try {
-      const [rolesRes, permsRes] = await Promise.all([
+      const [rolesRes, permsRes, usersRes] = await Promise.all([
        apiFetch(`${API_BASE}/roles`),
        apiFetch(`${API_BASE}/roles/permissions`),
+        apiFetch(`${API_BASE}/users`),
      ]);
      const rolesResult = await rolesRes.json();
      const permsResult = await permsRes.json();
+      const usersResult = await usersRes.json();

      if (rolesResult.success) {
        setRoles(Array.isArray(rolesResult.data) ? rolesResult.data : []);
@@ -188,6 +191,10 @@ export default function Settings() {
        }
        setPermissionGroups(groups);
      }
+
+      if (usersResult.success) {
+        setUsers(Array.isArray(usersResult.data) ? usersResult.data : []);
+      }
    } catch {
      alert.error("Chyba připojení");
    } finally {
@@ -808,7 +815,7 @@ export default function Settings() {
                      </td>
                      <td>
                        <span className="admin-badge admin-badge-secondary">
-                          {0}
+                          {users.filter((u) => u.role_id === role.id).length}
                        </span>
                      </td>
                      <td>
@@ -838,16 +845,21 @@ export default function Settings() {
                              }
                              className="admin-btn-icon danger"
                              title={
-                                0 > 0
+                                users.filter((u) => u.role_id === role.id)
+                                  .length > 0
                                  ? "Nelze smazat roli s přiřazenými uživateli"
                                  : "Smazat"
                              }
                              aria-label={
-                                0 > 0
+                                users.filter((u) => u.role_id === role.id)
+                                  .length > 0
                                  ? "Nelze smazat roli s přiřazenými uživateli"
                                  : "Smazat"
                              }
-                              disabled={0 > 0}
+                              disabled={
+                                users.filter((u) => u.role_id === role.id)
+                                  .length > 0
+                              }
                            >
                              <svg
                                width="16"
--- a/src/admin/utils/api.ts
+++ b/src/admin/utils/api.ts
@@ -1,39 +1,55 @@
-let showSessionExpiredAlert = false;
-let showLogoutAlert = false;
-let getTokenFn: (() => string | null) | null = null;
-let refreshFn: (() => Promise<boolean>) | null = null;
-let refreshPromise: Promise<boolean> | null = null;
+class ApiState {
+  showSessionExpiredAlert = false;
+  showLogoutAlert = false;
+  getTokenFn: (() => string | null) | null = null;
+  refreshFn: (() => Promise<boolean>) | null = null;
+  refreshPromise: Promise<boolean> | null = null;
+
+  reset() {
+    this.showSessionExpiredAlert = false;
+    this.showLogoutAlert = false;
+    this.getTokenFn = null;
+    this.refreshFn = null;
+    this.refreshPromise = null;
+  }
+}
+
+const state = new ApiState();
+
+export const resetApiState = (): void => {
+  state.reset();
+};

 export const shouldShowSessionExpiredAlert = (): boolean => {
-  if (showSessionExpiredAlert) {
-    showSessionExpiredAlert = false;
+  if (state.showSessionExpiredAlert) {
+    state.showSessionExpiredAlert = false;
    return true;
  }
  return false;
 };

 export const setSessionExpired = (): void => {
-  showSessionExpiredAlert = true;
+  state.showSessionExpiredAlert = true;
 };

 export const shouldShowLogoutAlert = (): boolean => {
-  if (showLogoutAlert) {
-    showLogoutAlert = false;
+  if (state.showLogoutAlert) {
+    state.showLogoutAlert = false;
    return true;
  }
  return false;
 };

 export const setLogoutAlert = (): void => {
-  showLogoutAlert = true;
+  state.showLogoutAlert = true;
 };

 export const setTokenGetter = (fn: () => string | null): void => {
-  getTokenFn = fn;
+  state.getTokenFn = fn;
 };

 export const setRefreshFn = (fn: () => Promise<boolean>): void => {
-  refreshFn = fn;
+  state.refreshFn = fn;
 };

 export const apiFetch = async (
@@ -42,7 +58,7 @@ export const apiFetch = async (
 ): Promise<Response> => {
  let token: string | null = null;
  try {
-    token = getTokenFn ? getTokenFn() : null;
+    token = state.getTokenFn ? state.getTokenFn() : null;
  } catch {
    // token retrieval failed
  }
@@ -69,21 +85,22 @@ export const apiFetch = async (
    credentials: "include",
  });

-  if (response.status === 401 && refreshFn) {
+  if (response.status === 401 && state.refreshFn) {
    try {
-      if (!refreshPromise) {
-        refreshPromise = refreshFn().finally(() => {
-          refreshPromise = null;
+      if (!state.refreshPromise) {
+        state.refreshPromise = state.refreshFn().finally(() => {
+          state.refreshPromise = null;
        });
      }
-      const refreshed = await refreshPromise;
+      const refreshed = await state.refreshPromise;
      if (refreshed) {
-        token = getTokenFn ? getTokenFn() : null;
+        token = state.getTokenFn ? state.getTokenFn() : null;
        if (token) {
          headers["Authorization"] = `Bearer ${token}`;
        }
+        const { signal, ...retryOptions } = options;
        response = await fetch(url, {
-          ...options,
+          ...retryOptions,
          headers,
          credentials: "include",
        });
@@ -100,7 +117,7 @@ export const apiFetch = async (

 export const getAccessToken = (): string | null => {
  try {
-    return getTokenFn ? getTokenFn() : null;
+    return state.getTokenFn ? state.getTokenFn() : null;
  } catch {
    return null;
  }