feat: system settings, dynamic logos, template numbering, permission consolidation

- System settings page with tabs: Security, System, Firma - Configurable attendance rules (break thresholds, rounding) from DB - Configurable document numbering with template patterns ({YYYY}/{PREFIX}/{NNN}) - Dynamic logo upload (light/dark variants) served from DB instead of static files - Email settings (SMTP from/name, alert/leave emails) configurable in UI - Currency and VAT rate lists configurable, used across all modules - Permissions simplified: offers.settings + settings.roles + settings.security → settings.manage - Leaflet bundled locally, removed unpkg.com from CSP - Silent catch blocks fixed with proper logging - console.log replaced with app.log.info in server.ts - Schema renamed: company-settings.schema → settings.schema - App info section: version, Node.js, uptime, memory, DB status, NAS status Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 10:15:47 +01:00
parent f49015a627
commit 6b31b2f74b
43 changed files with 2094 additions and 525 deletions
--- a/src/admin/pages/AttendanceHistory.tsx
+++ b/src/admin/pages/AttendanceHistory.tsx
@@ -126,6 +126,7 @@ export default function AttendanceHistory() {
  const alert = useAlert();
  const { user, hasPermission } = useAuth();
  const [loading, setLoading] = useState(true);
+  const [companyName, setCompanyName] = useState("");
  const printRef = useRef<HTMLDivElement>(null);
  const [month, setMonth] = useState(() => {
    const now = new Date();
@@ -156,6 +157,15 @@ export default function AttendanceHistory() {
    fetchData();
  }, [fetchData]);

+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanyName(d.data.company_name || "");
+      })
+      .catch(() => {});
+  }, []);
+
  const computed = useMemo(() => {
    const [yearStr, monthStr] = month.split("-");
    const monthIndex = parseInt(monthStr, 10) - 1;
@@ -637,13 +647,13 @@ export default function AttendanceHistory() {
                  <div className="print-header">
                    <div className="print-header-left">
                      <img
-                        src="/images/logo-light.png"
-                        alt="BOHA"
+                        src="/api/admin/company-settings/logo?variant=light"
+                        alt=""
                        className="print-logo"
                      />
                      <div className="print-header-text">
                        <h1>EVIDENCE DOCHÁZKY</h1>
-                        <div className="company">BOHA Automation s.r.o.</div>
+                        <div className="company">{companyName}</div>
                      </div>
                    </div>
                    <div className="print-header-right">
--- a/src/admin/pages/AttendanceLocation.tsx
+++ b/src/admin/pages/AttendanceLocation.tsx
@@ -5,12 +5,13 @@ import Forbidden from "../components/Forbidden";
 import { useNavigate, useParams, Link } from "react-router-dom";
 import { motion } from "framer-motion";

+import L from "leaflet";
+import "leaflet/dist/leaflet.css";
+
 import { formatDate, formatTime } from "../utils/attendanceHelpers";
 import apiFetch from "../utils/api";
 const API_BASE = "/api/admin";

-declare const L: any;
-
 interface LocationRecord {
  user_name: string;
  shift_date: string;
@@ -74,23 +75,6 @@ export default function AttendanceLocation() {

    if (!hasAnyLocation || !mapRef.current) return;

-    const loadLeaflet = async () => {
-      if ((window as unknown as Record<string, unknown>).L) {
-        initMap();
-        return;
-      }
-
-      const link = document.createElement("link");
-      link.rel = "stylesheet";
-      link.href = "https://unpkg.com/leaflet@1.9.4/dist/leaflet.css";
-      document.head.appendChild(link);
-
-      const script = document.createElement("script");
-      script.src = "https://unpkg.com/leaflet@1.9.4/dist/leaflet.js";
-      script.onload = initMap;
-      document.body.appendChild(script);
-    };
-
    const initMap = () => {
      if (mapInstanceRef.current) {
        (mapInstanceRef.current as { remove: () => void }).remove();
@@ -175,7 +159,7 @@ export default function AttendanceLocation() {
      }
    };

-    loadLeaflet();
+    initMap();

    return () => {
      if (mapInstanceRef.current) {
--- a/src/admin/pages/CompanySettings.tsx
+++ b/src/admin/pages/CompanySettings.tsx
@@ -24,8 +24,6 @@ const FIELD_LABELS: Record<string, string> = {
  vat_id: "DIČ",
 };

-const currentYear = new Date().getFullYear().toString().slice(-2);
-
 interface CustomField {
  name: string;
  value: string;
@@ -41,11 +39,6 @@ interface CompanyForm {
  country: string;
  company_id: string;
  vat_id: string;
-  quotation_prefix: string;
-  default_currency: string;
-  default_vat_rate: number;
-  order_type_code: string;
-  invoice_type_code: string;
 }

 interface BankAccount {
@@ -69,14 +62,19 @@ interface BankForm {
  is_default: boolean;
 }

-export default function CompanySettings() {
+export default function CompanySettings({
+  embedded,
+}: { embedded?: boolean } = {}) {
  const alert = useAlert();
  const { hasPermission } = useAuth();
  const [loading, setLoading] = useState(true);
  const [saving, setSaving] = useState(false);
  const [uploadingLogo, setUploadingLogo] = useState(false);
+  const [uploadingLogoDark, setUploadingLogoDark] = useState(false);
  const [logoUrl, setLogoUrl] = useState<string | null>(null);
+  const [logoUrlDark, setLogoUrlDark] = useState<string | null>(null);
  const logoUrlRef = useRef<string | null>(null);
+  const logoUrlDarkRef = useRef<string | null>(null);
  const [form, setForm] = useState<CompanyForm>({
    company_name: "",
    street: "",
@@ -85,11 +83,6 @@ export default function CompanySettings() {
    country: "",
    company_id: "",
    vat_id: "",
-    quotation_prefix: "N",
-    default_currency: "EUR",
-    default_vat_rate: 21,
-    order_type_code: "71",
-    invoice_type_code: "81",
  });
  const [customFields, setCustomFields] = useState<CustomField[]>([]);
  const customFieldKeyCounter = useRef(0);
@@ -97,6 +90,12 @@ export default function CompanySettings() {
    ...DEFAULT_FIELD_ORDER,
  ]);
  const [bankAccounts, setBankAccounts] = useState<BankAccount[]>([]);
+  const [availableCurrencies, setAvailableCurrencies] = useState<string[]>([
+    "CZK",
+    "EUR",
+    "USD",
+    "GBP",
+  ]);
  const [bankLoading, setBankLoading] = useState(true);
  const [bankSaving, setBankSaving] = useState(false);
  const [editingBank, setEditingBank] = useState<number | null>(null);
@@ -151,17 +150,28 @@ export default function CompanySettings() {
    return key;
  };

-  const fetchLogo = useCallback(async () => {
+  const fetchLogo = useCallback(async (variant: "light" | "dark" = "light") => {
    try {
-      const resp = await apiFetch(`${API_BASE}/company-settings/logo`);
+      const resp = await apiFetch(
+        `${API_BASE}/company-settings/logo?variant=${variant}`,
+      );
      if (resp.ok) {
        const blob = await resp.blob();
-        setLogoUrl((prev) => {
-          if (prev) URL.revokeObjectURL(prev);
-          const url = URL.createObjectURL(blob);
-          logoUrlRef.current = url;
-          return url;
-        });
+        if (variant === "dark") {
+          setLogoUrlDark((prev) => {
+            if (prev) URL.revokeObjectURL(prev);
+            const url = URL.createObjectURL(blob);
+            logoUrlDarkRef.current = url;
+            return url;
+          });
+        } else {
+          setLogoUrl((prev) => {
+            if (prev) URL.revokeObjectURL(prev);
+            const url = URL.createObjectURL(blob);
+            logoUrlRef.current = url;
+            return url;
+          });
+        }
      }
    } catch {
      // ignore - no logo
@@ -183,11 +193,6 @@ export default function CompanySettings() {
          country: d.country || "",
          company_id: d.company_id || "",
          vat_id: d.vat_id || "",
-          quotation_prefix: d.quotation_prefix || "N",
-          default_currency: d.default_currency || "EUR",
-          default_vat_rate: d.default_vat_rate || 21,
-          order_type_code: d.order_type_code || "71",
-          invoice_type_code: d.invoice_type_code || "81",
        });
        const cf =
          Array.isArray(d.custom_fields) && d.custom_fields.length > 0
@@ -207,8 +212,17 @@ export default function CompanySettings() {
        } else {
          setFieldOrder([...DEFAULT_FIELD_ORDER]);
        }
+        if (
+          Array.isArray(d.available_currencies) &&
+          d.available_currencies.length > 0
+        ) {
+          setAvailableCurrencies(d.available_currencies);
+        }
        if (d.has_logo) {
-          fetchLogo();
+          fetchLogo("light");
+        }
+        if (d.has_logo_dark) {
+          fetchLogo("dark");
        }
      } else {
        alert.error(result.error || "Nepodařilo se načíst nastavení");
@@ -316,10 +330,11 @@ export default function CompanySettings() {
    fetchBankAccounts();
  }, [fetchData, fetchBankAccounts]);

-  // Cleanup blob URL on unmount
+  // Cleanup blob URLs on unmount
  useEffect(() => {
    return () => {
      if (logoUrlRef.current) URL.revokeObjectURL(logoUrlRef.current);
+      if (logoUrlDarkRef.current) URL.revokeObjectURL(logoUrlDarkRef.current);
    };
  }, []);

@@ -351,30 +366,38 @@ export default function CompanySettings() {
    }
  };

-  const handleLogoUpload = async (e: React.ChangeEvent<HTMLInputElement>) => {
+  const handleLogoUpload = async (
+    e: React.ChangeEvent<HTMLInputElement>,
+    variant: "light" | "dark" = "light",
+  ) => {
    const file = e.target.files?.[0];
    if (!file) return;

-    setUploadingLogo(true);
+    const setUploading =
+      variant === "dark" ? setUploadingLogoDark : setUploadingLogo;
+    setUploading(true);
    try {
      const formData = new FormData();
      formData.append("logo", file);

-      const response = await apiFetch(`${API_BASE}/company-settings/logo`, {
-        method: "POST",
-        body: formData,
-      });
+      const response = await apiFetch(
+        `${API_BASE}/company-settings/logo?variant=${variant}`,
+        {
+          method: "POST",
+          body: formData,
+        },
+      );
      const result = await response.json();
      if (result.success) {
        alert.success(result.message || "Logo bylo nahráno");
-        fetchLogo();
+        fetchLogo(variant);
      } else {
        alert.error(result.error || "Nepodařilo se nahrát logo");
      }
    } catch {
      alert.error("Chyba připojení");
    } finally {
-      setUploadingLogo(false);
+      setUploading(false);
      e.target.value = "";
    }
  };
@@ -383,7 +406,7 @@ export default function CompanySettings() {
    setForm((prev) => ({ ...prev, [field]: value }));
  };

-  if (!hasPermission("offers.settings")) return <Forbidden />;
+  if (!embedded && !hasPermission("settings.manage")) return <Forbidden />;

  if (loading) {
    return (
@@ -464,33 +487,33 @@ export default function CompanySettings() {

  return (
    <div>
-      <motion.div
-        className="admin-page-header"
-        initial={{ opacity: 0, y: 12 }}
-        animate={{ opacity: 1, y: 0 }}
-        transition={{ duration: 0.25 }}
-      >
-        <div>
-          <h1 className="admin-page-title">Nastavení firmy</h1>
-          <p className="admin-page-subtitle">
-            Firemní údaje, číslování dokladů a výchozí hodnoty
-          </p>
-        </div>
-        <button
-          onClick={handleSave}
-          className="admin-btn admin-btn-primary"
-          disabled={saving}
+      {!embedded && (
+        <motion.div
+          className="admin-page-header"
+          initial={{ opacity: 0, y: 12 }}
+          animate={{ opacity: 1, y: 0 }}
+          transition={{ duration: 0.25 }}
        >
-          {saving ? (
-            <>
-              <div className="admin-spinner admin-spinner-sm" />
-              Ukládání...
-            </>
-          ) : (
-            "Uložit nastavení"
-          )}
-        </button>
-      </motion.div>
+          <div>
+            <h1 className="admin-page-title">Nastavení firmy</h1>
+            <p className="admin-page-subtitle">Firemní údaje a bankovní účty</p>
+          </div>
+          <button
+            onClick={handleSave}
+            className="admin-btn admin-btn-primary"
+            disabled={saving}
+          >
+            {saving ? (
+              <>
+                <div className="admin-spinner admin-spinner-sm" />
+                Ukládání...
+              </>
+            ) : (
+              "Uložit nastavení"
+            )}
+          </button>
+        </motion.div>
+      )}

      <div className="offers-settings-grid">
        {/* Company Info */}
@@ -898,10 +921,11 @@ export default function CompanySettings() {
                          }
                          className="admin-form-select"
                        >
-                          <option value="CZK">CZK</option>
-                          <option value="EUR">EUR</option>
-                          <option value="USD">USD</option>
-                          <option value="GBP">GBP</option>
+                          {availableCurrencies.map((c) => (
+                            <option key={c} value={c}>
+                              {c}
+                            </option>
+                          ))}
                        </select>
                      </FormField>
                    </div>
@@ -1055,177 +1079,135 @@ export default function CompanySettings() {
            <h3 className="admin-card-title">Logo</h3>
          </div>
          <div className="admin-card-body">
-            <div className="offers-logo-section">
-              {logoUrl && (
-                <div className="offers-logo-preview">
-                  <img src={logoUrl} alt="Logo" />
-                </div>
-              )}
-              <label
-                className="admin-btn admin-btn-secondary"
-                style={{ cursor: "pointer" }}
-              >
-                {uploadingLogo ? (
-                  <>
-                    <div className="admin-spinner admin-spinner-sm" />
-                    Nahrávání...
-                  </>
-                ) : (
-                  <>
-                    <svg
-                      width="16"
-                      height="16"
-                      viewBox="0 0 24 24"
-                      fill="none"
-                      stroke="currentColor"
-                      strokeWidth="2"
-                    >
-                      <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
-                      <polyline points="17 8 12 3 7 8" />
-                      <line x1="12" y1="3" x2="12" y2="15" />
-                    </svg>
-                    Nahrát logo
-                  </>
+            <div className="admin-form-row">
+              <div className="offers-logo-section">
+                <label
+                  className="admin-form-label"
+                  style={{ display: "block", marginBottom: 4 }}
+                >
+                  Logo (světlý režim)
+                </label>
+                {logoUrl && (
+                  <div className="offers-logo-preview">
+                    <img src={logoUrl} alt="Logo (světlý režim)" />
+                  </div>
                )}
-                <input
-                  type="file"
-                  accept="image/*"
-                  onChange={handleLogoUpload}
-                  style={{ display: "none" }}
-                  disabled={uploadingLogo}
-                />
-              </label>
-              <small className="admin-form-hint">
-                PNG, JPEG, GIF nebo WebP, max 5 MB
-              </small>
-            </div>
-          </div>
-        </motion.div>
-
-        {/* Cislovani dokladu */}
-        <motion.div
-          className="admin-card"
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.25, delay: 0.15 }}
-        >
-          <div className="admin-card-header">
-            <h3 className="admin-card-title">Číslování dokladů</h3>
-          </div>
-          <div className="admin-card-body">
-            <div className="admin-form">
-              <FormField label="Nabídky — prefix">
-                <input
-                  type="text"
-                  value={form.quotation_prefix}
-                  onChange={(e) =>
-                    updateField("quotation_prefix", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="N"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: ROK/PREFIX/ČÍSLO — ukázka: {new Date().getFullYear()}/
-                  {form.quotation_prefix || "N"}/001
-                </small>
-              </FormField>
-              <hr
-                style={{
-                  border: "none",
-                  borderTop: "1px solid var(--border-color)",
-                  margin: "0.75rem 0",
-                }}
-              />
-              <FormField label="Objednávky a projekty — typový kód">
-                <input
-                  type="text"
-                  value={form.order_type_code}
-                  onChange={(e) =>
-                    updateField("order_type_code", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="71"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: RRKÓD#### — ukázka: {currentYear}
-                  {form.order_type_code || "71"}0001
-                </small>
-              </FormField>
-              <hr
-                style={{
-                  border: "none",
-                  borderTop: "1px solid var(--border-color)",
-                  margin: "0.75rem 0",
-                }}
-              />
-              <FormField label="Faktury — typový kód">
-                <input
-                  type="text"
-                  value={form.invoice_type_code}
-                  onChange={(e) =>
-                    updateField("invoice_type_code", e.target.value)
-                  }
-                  className="admin-form-input"
-                  placeholder="81"
-                  style={{ maxWidth: 120 }}
-                />
-                <small className="admin-form-hint">
-                  Formát: RRKÓD#### — ukázka: {currentYear}
-                  {form.invoice_type_code || "81"}0001
-                </small>
-              </FormField>
-            </div>
-          </div>
-        </motion.div>
-
-        {/* Default values */}
-        <motion.div
-          className="admin-card"
-          initial={{ opacity: 0, y: 12 }}
-          animate={{ opacity: 1, y: 0 }}
-          transition={{ duration: 0.25, delay: 0.15 }}
-        >
-          <div className="admin-card-header">
-            <h3 className="admin-card-title">Výchozí hodnoty</h3>
-          </div>
-          <div className="admin-card-body">
-            <div className="admin-form">
-              <div className="admin-form-row">
-                <FormField label="Výchozí měna">
-                  <select
-                    value={form.default_currency}
-                    onChange={(e) =>
-                      updateField("default_currency", e.target.value)
-                    }
-                    className="admin-form-select"
-                  >
-                    <option value="EUR">EUR</option>
-                    <option value="USD">USD</option>
-                    <option value="CZK">CZK</option>
-                    <option value="GBP">GBP</option>
-                  </select>
-                </FormField>
-                <FormField label="Výchozí sazba DPH (%)">
+                <label
+                  className="admin-btn admin-btn-secondary"
+                  style={{ cursor: "pointer" }}
+                >
+                  {uploadingLogo ? (
+                    <>
+                      <div className="admin-spinner admin-spinner-sm" />
+                      Nahrávání...
+                    </>
+                  ) : (
+                    <>
+                      <svg
+                        width="16"
+                        height="16"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        strokeWidth="2"
+                      >
+                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+                        <polyline points="17 8 12 3 7 8" />
+                        <line x1="12" y1="3" x2="12" y2="15" />
+                      </svg>
+                      Nahrát logo
+                    </>
+                  )}
                  <input
-                    type="number"
-                    value={form.default_vat_rate}
-                    onChange={(e) =>
-                      updateField(
-                        "default_vat_rate",
-                        parseFloat(e.target.value) || 0,
-                      )
-                    }
-                    className="admin-form-input"
-                    step="0.1"
+                    type="file"
+                    accept="image/*"
+                    onChange={(e) => handleLogoUpload(e, "light")}
+                    style={{ display: "none" }}
+                    disabled={uploadingLogo}
                  />
-                </FormField>
+                </label>
+                <small className="admin-form-hint">
+                  PNG, JPEG, GIF nebo WebP, max 5 MB
+                </small>
+              </div>
+              <div className="offers-logo-section">
+                <label
+                  className="admin-form-label"
+                  style={{ display: "block", marginBottom: 4 }}
+                >
+                  Logo (tmavý režim)
+                </label>
+                {logoUrlDark && (
+                  <div className="offers-logo-preview">
+                    <img src={logoUrlDark} alt="Logo (tmavý režim)" />
+                  </div>
+                )}
+                <label
+                  className="admin-btn admin-btn-secondary"
+                  style={{ cursor: "pointer" }}
+                >
+                  {uploadingLogoDark ? (
+                    <>
+                      <div className="admin-spinner admin-spinner-sm" />
+                      Nahrávání...
+                    </>
+                  ) : (
+                    <>
+                      <svg
+                        width="16"
+                        height="16"
+                        viewBox="0 0 24 24"
+                        fill="none"
+                        stroke="currentColor"
+                        strokeWidth="2"
+                      >
+                        <path d="M21 15v4a2 2 0 0 1-2 2H5a2 2 0 0 1-2-2v-4" />
+                        <polyline points="17 8 12 3 7 8" />
+                        <line x1="12" y1="3" x2="12" y2="15" />
+                      </svg>
+                      Nahrát logo
+                    </>
+                  )}
+                  <input
+                    type="file"
+                    accept="image/*"
+                    onChange={(e) => handleLogoUpload(e, "dark")}
+                    style={{ display: "none" }}
+                    disabled={uploadingLogoDark}
+                  />
+                </label>
+                <small className="admin-form-hint">
+                  PNG, JPEG, GIF nebo WebP, max 5 MB
+                </small>
              </div>
            </div>
          </div>
        </motion.div>
      </div>
+
+      {embedded && (
+        <motion.div
+          initial={{ opacity: 0, y: 12 }}
+          animate={{ opacity: 1, y: 0 }}
+          transition={{ duration: 0.25, delay: 0.2 }}
+        >
+          <button
+            onClick={handleSave}
+            className="admin-btn admin-btn-primary"
+            style={{ width: "100%", marginTop: "1rem" }}
+            disabled={saving}
+          >
+            {saving ? (
+              <>
+                <div className="admin-spinner admin-spinner-sm" />
+                Ukládání...
+              </>
+            ) : (
+              "Uložit nastavení firmy"
+            )}
+          </button>
+        </motion.div>
+      )}
    </div>
  );
 }
--- a/src/admin/pages/InvoiceDetail.tsx
+++ b/src/admin/pages/InvoiceDetail.tsx
@@ -56,12 +56,6 @@ const TRANSITION_CLASSES: Record<string, string> = {
  paid: "admin-btn admin-btn-primary",
 };

-const VAT_OPTIONS = [
-  { value: 21, label: "21%" },
-  { value: 12, label: "12%" },
-  { value: 0, label: "0%" },
-];
-
 interface InvoiceItem {
  id?: number;
  _key: string;
@@ -145,6 +139,7 @@ function SortableInvoiceRow({
  index,
  currency,
  apply_vat,
+  vatOptions,
  onUpdate,
  onRemove,
  canDelete,
@@ -153,6 +148,7 @@ function SortableInvoiceRow({
  index: number;
  currency: string;
  apply_vat: boolean;
+  vatOptions: { value: number; label: string }[];
  onUpdate: (
    index: number,
    field: keyof InvoiceItem,
@@ -266,7 +262,7 @@ function SortableInvoiceRow({
              minWidth: "4.5rem",
            }}
          >
-            {VAT_OPTIONS.map((o) => (
+            {vatOptions.map((o) => (
              <option key={o.value} value={o.value}>
                {o.label}
              </option>
@@ -309,6 +305,7 @@ function SortableInvoiceEditRow({
  item,
  index,
  apply_vat,
+  vatOptions,
  onUpdate,
  onRemove,
  canDelete,
@@ -316,6 +313,7 @@ function SortableInvoiceEditRow({
  item: InvoiceItem;
  index: number;
  apply_vat: boolean;
+  vatOptions: { value: number; label: string }[];
  onUpdate: (index: number, field: string, value: string | number) => void;
  onRemove: (index: number) => void;
  canDelete: boolean;
@@ -427,7 +425,7 @@ function SortableInvoiceEditRow({
              minWidth: "4.5rem",
            }}
          >
-            {VAT_OPTIONS.map((o) => (
+            {vatOptions.map((o) => (
              <option key={o.value} value={o.value}>
                {o.label}
              </option>
@@ -543,6 +541,45 @@ export default function InvoiceDetail() {
  const [customerSearch, setCustomerSearch] = useState("");
  const [showCustomerDropdown, setShowCustomerDropdown] = useState(false);

+  const [companySettings, setCompanySettings] = useState<{
+    default_currency: string;
+    default_vat_rate: number;
+    available_currencies: string[];
+    available_vat_rates: number[];
+  } | null>(null);
+
+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanySettings(d.data);
+      })
+      .catch(() => {});
+  }, []);
+
+  const vatOptions = (
+    companySettings?.available_vat_rates || [0, 10, 12, 15, 21]
+  ).map((v) => ({
+    value: v,
+    label: `${v}%`,
+  }));
+
+  useEffect(() => {
+    if (companySettings && !isEdit) {
+      setForm((prev) => ({
+        ...prev,
+        currency:
+          prev.currency === "CZK"
+            ? companySettings.default_currency || "CZK"
+            : prev.currency,
+        vat_rate:
+          prev.vat_rate === 21
+            ? (companySettings.default_vat_rate ?? 21)
+            : prev.vat_rate,
+      }));
+    }
+  }, [companySettings, isEdit]);
+
  const DRAFT_KEY = "boha_invoice_draft";

  const clearDraft = useCallback(() => {
@@ -634,13 +671,16 @@ export default function InvoiceDetail() {
          const orderData = await results[3].json();
          if (orderData.success) {
            const order = orderData.data;
-            const vatRate = Number(order.vat_rate) || 21;
+            const vatRate =
+              Number(order.vat_rate) ||
+              (companySettings?.default_vat_rate ?? 21);
            setForm((prev) => ({
              ...prev,
              customer_id: order.customer_id,
              customer_name: order.customer_name || "",
              order_id: order.id,
-              currency: order.currency || "CZK",
+              currency:
+                order.currency || companySettings?.default_currency || "CZK",
              apply_vat: Number(order.apply_vat) || 0,
              vat_rate: vatRate,
            }));
@@ -963,7 +1003,8 @@ export default function InvoiceDetail() {
        quantity: Number(item.quantity) || 1,
        unit: item.unit || "",
        unit_price: Number(item.unit_price) || 0,
-        vat_rate: Number(item.vat_rate) || 21,
+        vat_rate:
+          Number(item.vat_rate) || (companySettings?.default_vat_rate ?? 21),
      })),
    );
    setEditingItems(true);
@@ -988,7 +1029,7 @@ export default function InvoiceDetail() {
        quantity: 1,
        unit: "ks",
        unit_price: 0,
-        vat_rate: 21,
+        vat_rate: companySettings?.default_vat_rate ?? 21,
      },
    ]);
  };
@@ -1373,9 +1414,18 @@ export default function InvoiceDetail() {
                    }
                    className="admin-form-select"
                  >
-                    <option value="CZK">CZK (Kč)</option>
-                    <option value="EUR">EUR</option>
-                    <option value="USD">USD ($)</option>
+                    {(
+                      companySettings?.available_currencies || [
+                        "CZK",
+                        "EUR",
+                        "USD",
+                        "GBP",
+                      ]
+                    ).map((c) => (
+                      <option key={c} value={c}>
+                        {c}
+                      </option>
+                    ))}
                  </select>
                </FormField>
                <FormField label="Jazyk faktury">
@@ -1514,6 +1564,7 @@ export default function InvoiceDetail() {
                            index={index}
                            currency={form.currency}
                            apply_vat={!!form.apply_vat}
+                            vatOptions={vatOptions}
                            onUpdate={updateItem}
                            onRemove={removeItem}
                            canDelete={items.length > 1}
@@ -1851,6 +1902,7 @@ export default function InvoiceDetail() {
                          item={item}
                          index={index}
                          apply_vat={!!Number(invoice.apply_vat)}
+                          vatOptions={vatOptions}
                          onUpdate={updateEditItem}
                          onRemove={removeEditItem}
                          canDelete={editItems.length > 1}
--- a/src/admin/pages/Invoices.tsx
+++ b/src/admin/pages/Invoices.tsx
@@ -8,7 +8,7 @@ import {
 } from "react";
 import { useAlert } from "../context/AlertContext";
 import { useAuth } from "../context/AuthContext";
-import { Link } from "react-router-dom";
+import { Link, useSearchParams } from "react-router-dom";
 import { motion, AnimatePresence } from "framer-motion";
 import ConfirmModal from "../components/ConfirmModal";
 import Forbidden from "../components/Forbidden";
@@ -119,7 +119,11 @@ export default function Invoices() {
  const alert = useAlert();
  const { hasPermission } = useAuth();

-  const [activeTab, setActiveTab] = useState("issued");
+  const [searchParams, setSearchParams] = useSearchParams();
+  const activeTab =
+    searchParams.get("tab") === "received" ? "received" : "issued";
+  const setActiveTab = (tab: string) =>
+    setSearchParams({ tab }, { replace: true });
  const [receivedUploadOpen, setReceivedUploadOpen] = useState(false);
  const { sort, order, handleSort, activeSort } =
    useTableSort("invoice_number");
--- a/src/admin/pages/Login.tsx
+++ b/src/admin/pages/Login.tsx
@@ -190,11 +190,17 @@ export default function Login() {
              <img
                src={
                  theme === "dark"
-                    ? "/images/logo-dark.png"
-                    : "/images/logo-light.png"
+                    ? "/api/admin/company-settings/logo?variant=dark"
+                    : "/api/admin/company-settings/logo?variant=light"
                }
                alt="Logo"
                className="admin-login-logo"
+                onError={(e) => {
+                  (e.target as HTMLImageElement).src =
+                    theme === "dark"
+                      ? "/images/logo-dark.png"
+                      : "/images/logo-light.png";
+                }}
              />
              <h1 className="admin-login-title">Interní systém</h1>
              <p className="admin-login-subtitle">Přihlaste se ke svému účtu</p>
--- a/src/admin/pages/OfferDetail.tsx
+++ b/src/admin/pages/OfferDetail.tsx
@@ -98,7 +98,7 @@ const emptyForm: OfferForm = {
  customer_name: "",
  created_at: new Date().toISOString().split("T")[0],
  valid_until: "",
-  currency: "EUR",
+  currency: "CZK",
  language: "EN",
  vat_rate: 21,
  apply_vat: false,
@@ -327,6 +327,12 @@ export default function OfferDetail() {
  const [customerOrderNumber, setCustomerOrderNumber] = useState("");
  const [orderAttachment, setOrderAttachment] = useState<File | null>(null);
  const [pdfLoading, setPdfLoading] = useState(false);
+  const [companySettings, setCompanySettings] = useState<{
+    default_currency: string;
+    default_vat_rate: number;
+    available_currencies: string[];
+    available_vat_rates: number[];
+  } | null>(null);
  const [lockedBy, setLockedBy] = useState<{
    user_id: number;
    username: string;
@@ -336,6 +342,31 @@ export default function OfferDetail() {

  useModalLock(showOrderModal);

+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanySettings(d.data);
+      })
+      .catch(() => {});
+  }, []);
+
+  useEffect(() => {
+    if (companySettings && !isEdit) {
+      setForm((prev) => ({
+        ...prev,
+        currency:
+          prev.currency === "EUR"
+            ? companySettings.default_currency || "CZK"
+            : prev.currency,
+        vat_rate:
+          prev.vat_rate === 21
+            ? (companySettings.default_vat_rate ?? 21)
+            : prev.vat_rate,
+      }));
+    }
+  }, [companySettings, isEdit]);
+
  const isInvalidated = offerStatus === "invalidated";
  const isLockedByOther = !!lockedBy;
  const isExpiredNotInvalidated =
@@ -362,9 +393,9 @@ export default function OfferDetail() {
          valid_until: d.valid_until
            ? String(d.valid_until).substring(0, 10)
            : "",
-          currency: d.currency || "EUR",
+          currency: d.currency || companySettings?.default_currency || "CZK",
          language: d.language || "EN",
-          vat_rate: d.vat_rate ?? 21,
+          vat_rate: d.vat_rate ?? companySettings?.default_vat_rate ?? 21,
          apply_vat: !!d.apply_vat,
          exchange_rate: d.exchange_rate || "",
          scope_title: d.scope_title || "",
@@ -408,7 +439,7 @@ export default function OfferDetail() {
    } finally {
      setLoading(false);
    }
-  }, [id, alert, navigate, hasPermission]);
+  }, [id, alert, navigate, hasPermission, companySettings]);

  // Heartbeat to keep lock alive + cleanup on unmount
  useEffect(() => {
@@ -1125,10 +1156,18 @@ export default function OfferDetail() {
                className="admin-form-select"
                disabled={isInvalidated || isLockedByOther}
              >
-                <option value="EUR">EUR</option>
-                <option value="USD">USD</option>
-                <option value="CZK">CZK</option>
-                <option value="GBP">GBP</option>
+                {(
+                  companySettings?.available_currencies || [
+                    "CZK",
+                    "EUR",
+                    "USD",
+                    "GBP",
+                  ]
+                ).map((c) => (
+                  <option key={c} value={c}>
+                    {c}
+                  </option>
+                ))}
              </select>
            </FormField>
            <FormField label="Jazyk nabídky">
@@ -1147,16 +1186,22 @@ export default function OfferDetail() {
          <div className="offers-form-row-3">
            <FormField label="Sazba DPH (%)">
              <div className="flex-row-gap">
-                <input
-                  type="number"
+                <select
                  value={form.vat_rate}
                  onChange={(e) =>
                    updateForm("vat_rate", parseFloat(e.target.value) || 0)
                  }
-                  className="admin-form-input flex-1"
-                  step="0.1"
-                  readOnly={isInvalidated || isLockedByOther}
-                />
+                  className="admin-form-select flex-1"
+                  disabled={isInvalidated || isLockedByOther}
+                >
+                  {(
+                    companySettings?.available_vat_rates || [0, 10, 12, 15, 21]
+                  ).map((r) => (
+                    <option key={r} value={r}>
+                      {r}%
+                    </option>
+                  ))}
+                </select>
                <label
                  className="admin-form-checkbox"
                  style={{ whiteSpace: "nowrap" }}
--- a/src/admin/pages/Offers.tsx
+++ b/src/admin/pages/Offers.tsx
@@ -324,7 +324,7 @@ export default function Offers() {
          </p>
        </div>
        <div className="admin-page-actions">
-          {hasPermission("offers.settings") && (
+          {hasPermission("settings.manage") && (
            <Link
              to="/offers/templates"
              className="admin-btn admin-btn-secondary"
--- a/src/admin/pages/OffersTemplates.tsx
+++ b/src/admin/pages/OffersTemplates.tsx
@@ -55,7 +55,7 @@ export default function OffersTemplates() {
  const { hasPermission } = useAuth();
  const [activeTab, setActiveTab] = useState<"items" | "scopes">("items");

-  if (!hasPermission("offers.settings")) return <Forbidden />;
+  if (!hasPermission("settings.manage")) return <Forbidden />;

  return (
    <div>
--- a/src/admin/pages/ReceivedInvoices.tsx
+++ b/src/admin/pages/ReceivedInvoices.tsx
@@ -21,8 +21,8 @@ const STATUS_CLASSES: Record<string, string> = {
  unpaid: "admin-badge-invoice-overdue",
  paid: "admin-badge-invoice-paid",
 };
-const CURRENCY_OPTIONS = ["CZK", "EUR", "USD", "GBP"];
-const VAT_RATE_OPTIONS = [0, 10, 12, 15, 21];
+const DEFAULT_CURRENCIES = ["CZK", "EUR", "USD", "GBP"];
+const DEFAULT_VAT_RATES = [0, 10, 12, 15, 21];

 const MONTH_NAMES = [
  "leden",
@@ -124,13 +124,20 @@ function formatCzkWithDetail(
  return { value: formatMultiCurrency(amounts), detail: null };
 }

-function emptyMeta(): UploadMeta {
+interface CompanySettings {
+  default_currency: string;
+  default_vat_rate: number;
+  available_currencies: string[];
+  available_vat_rates: number[];
+}
+
+function emptyMeta(settings: CompanySettings | null): UploadMeta {
  return {
    supplier_name: "",
    invoice_number: "",
    amount: "",
-    currency: "CZK",
-    vat_rate: "21",
+    currency: settings?.default_currency || "CZK",
+    vat_rate: String(settings?.default_vat_rate ?? 21),
    issue_date: "",
    due_date: "",
    notes: "",
@@ -168,6 +175,8 @@ export default function ReceivedInvoices({
  const [saving, setSaving] = useState(false);

  const [supplierNames, setSupplierNames] = useState<string[]>([]);
+  const [companySettings, setCompanySettings] =
+    useState<CompanySettings | null>(null);

  const [uploadFiles, setUploadFiles] = useState<File[]>([]);
  const [uploadMeta, setUploadMeta] = useState<UploadMeta[]>([]);
@@ -231,6 +240,22 @@ export default function ReceivedInvoices({
      .catch(() => {});
  }, []);

+  useEffect(() => {
+    apiFetch(`${API_BASE}/company-settings`)
+      .then((r) => r.json())
+      .then((d) => {
+        if (d.success) setCompanySettings(d.data);
+      })
+      .catch(() => {});
+  }, []);
+
+  const currencyOptions =
+    companySettings?.available_currencies || DEFAULT_CURRENCIES;
+  const vatRateOptions =
+    companySettings?.available_vat_rates || DEFAULT_VAT_RATES;
+  const defaultCurrency = companySettings?.default_currency || "CZK";
+  const defaultVatRate = String(companySettings?.default_vat_rate ?? 21);
+
  // Fetch stats (silent refresh without animation)
  const refreshStats = useCallback(async () => {
    try {
@@ -292,7 +317,10 @@ export default function ReceivedInvoices({
      return true;
    });
    setUploadFiles((prev) => [...prev, ...valid]);
-    setUploadMeta((prev) => [...prev, ...valid.map(() => emptyMeta())]);
+    setUploadMeta((prev) => [
+      ...prev,
+      ...valid.map(() => emptyMeta(companySettings)),
+    ]);
    e.target.value = "";
  };

@@ -1041,12 +1069,14 @@ export default function ReceivedInvoices({
                          <FormField label="Měna" style={{ width: "90px" }}>
                            <select
                              className="admin-form-select"
-                              value={uploadMeta[idx]?.currency || "CZK"}
+                              value={
+                                uploadMeta[idx]?.currency || defaultCurrency
+                              }
                              onChange={(e) =>
                                updateMeta(idx, "currency", e.target.value)
                              }
                            >
-                              {CURRENCY_OPTIONS.map((c) => (
+                              {currencyOptions.map((c) => (
                                <option key={c} value={c}>
                                  {c}
                                </option>
@@ -1056,12 +1086,14 @@ export default function ReceivedInvoices({
                          <FormField label="DPH %" style={{ width: "90px" }}>
                            <select
                              className="admin-form-select"
-                              value={uploadMeta[idx]?.vat_rate || "21"}
+                              value={
+                                uploadMeta[idx]?.vat_rate || defaultVatRate
+                              }
                              onChange={(e) =>
                                updateMeta(idx, "vat_rate", e.target.value)
                              }
                            >
-                              {VAT_RATE_OPTIONS.map((r) => (
+                              {vatRateOptions.map((r) => (
                                <option key={r} value={String(r)}>
                                  {r}%
                                </option>
@@ -1085,14 +1117,14 @@ export default function ReceivedInvoices({
                                  uploadMeta[idx].amount || "0",
                                );
                                const r = parseFloat(
-                                  uploadMeta[idx].vat_rate || "21",
+                                  uploadMeta[idx].vat_rate || defaultVatRate,
                                );
                                return r > 0
                                  ? Math.round((a - a / (1 + r / 100)) * 100) /
                                      100
                                  : 0;
                              })(),
-                              uploadMeta[idx].currency || "CZK",
+                              uploadMeta[idx].currency || defaultCurrency,
                            )}
                          </div>
                        )}
@@ -1255,7 +1287,7 @@ export default function ReceivedInvoices({
                              }
                              disabled={ro}
                            >
-                              {CURRENCY_OPTIONS.map((c) => (
+                              {currencyOptions.map((c) => (
                                <option key={c} value={c}>
                                  {c}
                                </option>
@@ -1275,7 +1307,7 @@ export default function ReceivedInvoices({
                              }
                              disabled={ro}
                            >
-                              {VAT_RATE_OPTIONS.map((r) => (
+                              {vatRateOptions.map((r) => (
                                <option key={r} value={String(r)}>
                                  {r}%
                                </option>
@@ -1296,14 +1328,14 @@ export default function ReceivedInvoices({
                              (() => {
                                const a = parseFloat(editInvoice.amount || "0");
                                const r = parseFloat(
-                                  editInvoice.vat_rate || "21",
+                                  editInvoice.vat_rate || defaultVatRate,
                                );
                                return r > 0
                                  ? Math.round((a - a / (1 + r / 100)) * 100) /
                                      100
                                  : 0;
                              })(),
-                              editInvoice.currency || "CZK",
+                              editInvoice.currency || defaultCurrency,
                            )}
                          </div>
                        )}
--- a/src/admin/pages/Settings.tsx
+++ b/src/admin/pages/Settings.tsx
--- a/src/admin/pages/TripsAdmin.tsx
+++ b/src/admin/pages/TripsAdmin.tsx
@@ -89,6 +89,7 @@ export default function TripsAdmin() {
  const alert = useAlert();
  const { hasPermission } = useAuth();
  const [loading, setLoading] = useState(true);
+  const [companyName, setCompanyName] = useState("");
  const [filterMonth, setFilterMonth] = useState(() =>
    String(new Date().getMonth() + 1),
  );
@@ -124,13 +125,16 @@ export default function TripsAdmin() {
  useEffect(() => {
    const fetchLookups = async () => {
      try {
-        const [vRes, uRes] = await Promise.all([
+        const [vRes, uRes, csRes] = await Promise.all([
          apiFetch(`${API_BASE}/vehicles`),
          apiFetch(`${API_BASE}/users?limit=1000`),
+          apiFetch(`${API_BASE}/company-settings`),
        ]);
        const vJson = await vRes.json();
        const uJson = await uRes.json();
+        const csJson = await csRes.json();
        if (vJson.success) setVehicles(vJson.data);
+        if (csJson.success) setCompanyName(csJson.data.company_name || "");
        if (uJson.success) {
          setUsers(
            uJson.data.map(
@@ -886,13 +890,13 @@ export default function TripsAdmin() {
          <div className="print-header">
            <div className="print-header-left">
              <img
-                src="/images/logo-light.png"
-                alt="BOHA"
+                src="/api/admin/company-settings/logo?variant=light"
+                alt=""
                className="print-logo"
              />
              <div className="print-header-text">
                <h1>KNIHA JÍZD</h1>
-                <div className="company">BOHA Automation s.r.o.</div>
+                <div className="company">{companyName}</div>
              </div>
            </div>
            <div className="print-header-right">