boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

feat: P4 backend kvalita - SELECT * fix, overdue konsolidace, Validator

Browse Source 
- SELECT * nahrazen explicitnimi sloupci ve 22 PHP souborech (69+ vyskytu)
- users-handlers.php: password_hash explicitne vyloucen z dotazu
- Overdue detekce presunuta do invoices.php routeru (1x pred dispatch misto 3x v handlerech)
- Validator.php: validacni helper s pravidly required, string, int, email, in, numeric
- PaginationHelper: PHPStan typy opraveny

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
This commit is contained in:
Simon
2026-03-12 18:42:42 +01:00
parent df506dfea4
commit 758be819c3
25 changed files with 513 additions and 102 deletions
Download Patch File Download Diff File Expand all files Collapse all files

40
api/admin/handlers/attendance-handlers.php
View File

@@ -7,7 +7,11 @@ function handleGetCurrent(PDO $pdo, int $userId): void
$today = date('Y-m-d');
$stmt = $pdo->prepare("
SELECT * FROM attendance
SELECT id, user_id, shift_date, arrival_time, arrival_lat, arrival_lng,
arrival_accuracy, arrival_address, break_start, break_end,
departure_time, departure_lat, departure_lng, departure_accuracy,
departure_address, notes, project_id, leave_type, leave_hours, created_at
FROM attendance
WHERE user_id = ? AND departure_time IS NULL AND (leave_type IS NULL OR leave_type = 'work')
ORDER BY created_at DESC LIMIT 1
");
@@ -17,7 +21,10 @@ function handleGetCurrent(PDO $pdo, int $userId): void
$projectLogs = [];
$activeProjectId = null;
if ($ongoingShift) {
$stmt = $pdo->prepare('SELECT * FROM attendance_project_logs WHERE attendance_id = ? ORDER BY started_at ASC');
$stmt = $pdo->prepare(
'SELECT id, attendance_id, project_id, started_at, ended_at, hours, minutes
FROM attendance_project_logs WHERE attendance_id = ? ORDER BY started_at ASC'
);
$stmt->execute([$ongoingShift['id']]);
$projectLogs = $stmt->fetchAll();
foreach ($projectLogs as $log) {
@@ -29,7 +36,11 @@ function handleGetCurrent(PDO $pdo, int $userId): void
}
$stmt = $pdo->prepare("
SELECT * FROM attendance
SELECT id, user_id, shift_date, arrival_time, arrival_lat, arrival_lng,
arrival_accuracy, arrival_address, break_start, break_end,
departure_time, departure_lat, departure_lng, departure_accuracy,
departure_address, notes, project_id, leave_type, leave_hours, created_at
FROM attendance
WHERE user_id = ? AND shift_date = ?
AND departure_time IS NOT NULL
AND (leave_type IS NULL OR leave_type = 'work')
@@ -43,7 +54,8 @@ function handleGetCurrent(PDO $pdo, int $userId): void
if (!empty($completedShiftIds)) {
$placeholders = implode(',', array_fill(0, count($completedShiftIds), '?'));
$stmt = $pdo->prepare(
"SELECT * FROM attendance_project_logs
"SELECT id, attendance_id, project_id, started_at, ended_at, hours, minutes
FROM attendance_project_logs
WHERE attendance_id IN ($placeholders)
ORDER BY started_at ASC"
);
@@ -65,7 +77,9 @@ function handleGetCurrent(PDO $pdo, int $userId): void
$endDate = date('Y-m-t');
$stmt = $pdo->prepare('
SELECT * FROM attendance
SELECT id, user_id, shift_date, arrival_time, break_start, break_end,
departure_time, notes, project_id, leave_type, leave_hours
FROM attendance
WHERE user_id = ? AND shift_date BETWEEN ? AND ?
');
$stmt->execute([$userId, $startDate, $endDate]);
@@ -167,7 +181,10 @@ function handleGetHistory(PDO $pdo, int $userId): void
$endDate = date('Y-m-t', strtotime($startDate));
$stmt = $pdo->prepare('
SELECT * FROM attendance
SELECT id, user_id, shift_date, arrival_time, arrival_address,
break_start, break_end, departure_time, departure_address,
notes, project_id, leave_type, leave_hours, created_at
FROM attendance
WHERE user_id = ? AND shift_date BETWEEN ? AND ?
ORDER BY shift_date DESC
');
@@ -245,7 +262,9 @@ function handlePunch(PDO $pdo, int $userId): void
$address = !empty($input['address']) ? $input['address'] : null;
$stmt = $pdo->prepare("
SELECT * FROM attendance
SELECT id, user_id, shift_date, arrival_time, break_start, break_end,
departure_time, notes, project_id, leave_type, created_at
FROM attendance
WHERE user_id = ? AND departure_time IS NULL AND (leave_type IS NULL OR leave_type = 'work')
ORDER BY created_at DESC LIMIT 1
");
@@ -529,7 +548,10 @@ function handleGetProjectLogs(PDO $pdo, int $currentUserId, array $authData): vo
}
}
$stmt = $pdo->prepare('SELECT * FROM attendance_project_logs WHERE attendance_id = ? ORDER BY started_at ASC');
$stmt = $pdo->prepare(
'SELECT id, attendance_id, project_id, started_at, ended_at, hours, minutes
FROM attendance_project_logs WHERE attendance_id = ? ORDER BY started_at ASC'
);
$stmt->execute([$attendanceId]);
$logs = $stmt->fetchAll();
@@ -556,7 +578,7 @@ function handleSaveProjectLogs(PDO $pdo): void
errorResponse('attendance_id je povinné');
}
$stmt = $pdo->prepare('SELECT * FROM attendance WHERE id = ?');
$stmt = $pdo->prepare('SELECT id FROM attendance WHERE id = ?');
$stmt->execute([$attendanceId]);
$record = $stmt->fetch();
if (!$record) {

14
api/admin/handlers/bank-accounts-handlers.php
View File

@@ -4,7 +4,11 @@ declare(strict_types=1);
function handleGetBankAccountList(PDO $pdo): void
{
$stmt = $pdo->query('SELECT * FROM bank_accounts ORDER BY position, id');
$stmt = $pdo->query(
'SELECT id, account_name, bank_name, account_number, iban, bic,
currency, is_default, position, created_at, modified_at
FROM bank_accounts ORDER BY position, id'
);
successResponse($stmt->fetchAll());
}
@@ -78,7 +82,11 @@ function handleCreateBankAccount(PDO $pdo): void
function handleUpdateBankAccount(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM bank_accounts WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, account_name, bank_name, account_number, iban, bic,
currency, is_default, position
FROM bank_accounts WHERE id = ?'
);
$stmt->execute([$id]);
$account = $stmt->fetch();
@@ -145,7 +153,7 @@ function handleUpdateBankAccount(PDO $pdo, int $id): void
function handleDeleteBankAccount(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM bank_accounts WHERE id = ?');
$stmt = $pdo->prepare('SELECT id, account_name FROM bank_accounts WHERE id = ?');
$stmt->execute([$id]);
$account = $stmt->fetch();

8
api/admin/handlers/company-settings-handlers.php
View File

@@ -9,7 +9,13 @@ declare(strict_types=1);
function getOrCreateSettings(PDO $pdo, bool $includeLogo = false): array
{
if ($includeLogo) {
$stmt = $pdo->query('SELECT * FROM company_settings LIMIT 1');
$stmt = $pdo->query('
SELECT id, company_name, company_id, vat_id, street, city, postal_code,
country, quotation_prefix, default_currency, default_vat_rate,
custom_fields, logo_data, uuid, modified_at, sync_version,
order_type_code, invoice_type_code, is_deleted, require_2fa
FROM company_settings LIMIT 1
');
} else {
$stmt = $pdo->query('
SELECT id, company_name, company_id, vat_id, street, city, postal_code, country,

22
api/admin/handlers/customers-handlers.php
View File

@@ -54,7 +54,9 @@ function encodeCustomerCustomFields(array $input, ?string $existingJson): ?strin
function handleGetAll(PDO $pdo): void
{
$stmt = $pdo->query('
SELECT c.*, COUNT(q.id) as quotation_count
SELECT c.id, c.name, c.street, c.city, c.postal_code, c.country,
c.company_id, c.vat_id, c.custom_fields, c.created_at,
COUNT(q.id) as quotation_count
FROM customers c
LEFT JOIN quotations q ON q.customer_id = c.id
GROUP BY c.id
@@ -72,7 +74,11 @@ function handleGetAll(PDO $pdo): void
function handleGetOne(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM customers WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, name, street, city, postal_code, country,
company_id, vat_id, custom_fields, created_at
FROM customers WHERE id = ?'
);
$stmt->execute([$id]);
$customer = $stmt->fetch();
@@ -93,7 +99,9 @@ function handleSearch(PDO $pdo): void
}
$stmt = $pdo->prepare('
SELECT * FROM customers
SELECT id, name, street, city, postal_code, country,
company_id, vat_id, custom_fields
FROM customers
WHERE name LIKE ? OR company_id LIKE ? OR city LIKE ?
ORDER BY name ASC
LIMIT 20
@@ -177,7 +185,11 @@ function handleCreateCustomer(PDO $pdo): void
function handleUpdateCustomer(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM customers WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, name, street, city, postal_code, country,
company_id, vat_id, custom_fields
FROM customers WHERE id = ?'
);
$stmt->execute([$id]);
$existing = $stmt->fetch();
@@ -248,7 +260,7 @@ function handleUpdateCustomer(PDO $pdo, int $id): void
function handleDeleteCustomer(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM customers WHERE id = ?');
$stmt = $pdo->prepare('SELECT id, name FROM customers WHERE id = ?');
$stmt->execute([$id]);
$customer = $stmt->fetch();

43
api/admin/handlers/invoices-handlers.php
View File

@@ -99,9 +99,6 @@ function handleGetStats(PDO $pdo): void
$month = max(1, min(12, (int) ($_GET['month'] ?? (int) date('n'))));
$year = max(2020, min(2099, (int) ($_GET['year'] ?? (int) date('Y'))));
// Lazy overdue detekce
$pdo->exec("UPDATE invoices SET status = 'overdue' WHERE status = 'issued' AND due_date < CURDATE()");
$monthStart = sprintf('%04d-%02d-01', $year, $month);
$monthEnd = date('Y-m-t', strtotime($monthStart));
@@ -186,9 +183,6 @@ function handleGetList(PDO $pdo): void
$p = PaginationHelper::parseParams($sortMap);
// Lazy overdue detekce
$pdo->exec("UPDATE invoices SET status = 'overdue' WHERE status = 'issued' AND due_date < CURDATE()");
$where = 'WHERE 1=1';
$params = [];
@@ -253,13 +247,14 @@ function handleGetList(PDO $pdo): void
function handleGetDetail(PDO $pdo, int $id): void
{
// Lazy overdue
$pdo->prepare(
"UPDATE invoices SET status = 'overdue' WHERE id = ? AND status = 'issued' AND due_date < CURDATE()"
)->execute([$id]);
$stmt = $pdo->prepare('
SELECT i.*, c.name as customer_name, o.order_number
SELECT i.id, i.invoice_number, i.order_id, i.customer_id, i.status,
i.currency, i.vat_rate, i.apply_vat, i.payment_method,
i.constant_symbol, i.bank_name, i.bank_swift, i.bank_iban,
i.bank_account, i.issue_date, i.due_date, i.tax_date,
i.paid_date, i.issued_by, i.notes, i.internal_notes,
i.created_at, i.modified_at,
c.name as customer_name, o.order_number
FROM invoices i
LEFT JOIN customers c ON i.customer_id = c.id
LEFT JOIN orders o ON i.order_id = o.id
@@ -273,7 +268,10 @@ function handleGetDetail(PDO $pdo, int $id): void
}
// Polozky
$stmt = $pdo->prepare('SELECT * FROM invoice_items WHERE invoice_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT id, invoice_id, description, quantity, unit, unit_price, vat_rate, position
FROM invoice_items WHERE invoice_id = ? ORDER BY position'
);
$stmt->execute([$id]);
$invoice['items'] = $stmt->fetchAll();
@@ -317,7 +315,11 @@ function handleGetOrderData(PDO $pdo, int $id): void
}
// Polozky objednavky
$stmt = $pdo->prepare('SELECT * FROM order_items WHERE order_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT id, order_id, description, item_description, quantity, unit,
unit_price, is_included_in_total, position
FROM order_items WHERE order_id = ? ORDER BY position'
);
$stmt->execute([$id]);
$order['items'] = $stmt->fetchAll();
@@ -506,7 +508,14 @@ function handleCreateInvoice(PDO $pdo, array $authData): void
function handleUpdateInvoice(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM invoices WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, invoice_number, order_id, customer_id, status, currency,
vat_rate, apply_vat, payment_method, constant_symbol,
bank_name, bank_swift, bank_iban, bank_account,
issue_date, due_date, tax_date, paid_date,
issued_by, notes, internal_notes
FROM invoices WHERE id = ?'
);
$stmt->execute([$id]);
$invoice = $stmt->fetch();
@@ -657,7 +666,9 @@ function handleUpdateInvoice(PDO $pdo, int $id): void
function handleDeleteInvoice(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM invoices WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, invoice_number, customer_id FROM invoices WHERE id = ?'
);
$stmt->execute([$id]);
$invoice = $stmt->fetch();

33
api/admin/handlers/leave-requests-handlers.php
View File

@@ -31,7 +31,10 @@ function getLeaveBalanceForRequest(PDO $pdo, int $userId, ?int $year = null): ar
{
$year = $year ?: (int)date('Y');
$stmt = $pdo->prepare('SELECT * FROM leave_balances WHERE user_id = ? AND year = ?');
$stmt = $pdo->prepare(
'SELECT id, user_id, year, vacation_total, vacation_used, sick_used
FROM leave_balances WHERE user_id = ? AND year = ?'
);
$stmt->execute([$userId, $year]);
$balance = $stmt->fetch();
@@ -77,7 +80,9 @@ function getPendingVacationHours(PDO $pdo, int $userId, int $year): float
function handleGetMyRequests(PDO $pdo, int $userId): void
{
$stmt = $pdo->prepare("
SELECT lr.*,
SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
lr.total_hours, lr.total_days, lr.notes, lr.status,
lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
CONCAT(u.first_name, ' ', u.last_name) as reviewer_name
FROM leave_requests lr
LEFT JOIN users u ON lr.reviewer_id = u.id
@@ -96,7 +101,9 @@ function handleGetMyRequests(PDO $pdo, int $userId): void
function handleGetPending(PDO $pdo): void
{
$stmt = $pdo->prepare("
SELECT lr.*,
SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
lr.total_hours, lr.total_days, lr.notes, lr.status,
lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
CONCAT(u.first_name, ' ', u.last_name) as employee_name,
CONCAT(rv.first_name, ' ', rv.last_name) as reviewer_name
FROM leave_requests lr
@@ -138,7 +145,9 @@ function handleGetAll(PDO $pdo): void
$whereClause = $where ? 'WHERE ' . implode(' AND ', $where) : '';
$stmt = $pdo->prepare("
SELECT lr.*,
SELECT lr.id, lr.user_id, lr.leave_type, lr.date_from, lr.date_to,
lr.total_hours, lr.total_days, lr.notes, lr.status,
lr.reviewer_id, lr.reviewer_note, lr.reviewed_at, lr.created_at,
CONCAT(u.first_name, ' ', u.last_name) as employee_name,
CONCAT(rv.first_name, ' ', rv.last_name) as reviewer_name
FROM leave_requests lr
@@ -270,7 +279,11 @@ function handleCancelRequest(PDO $pdo, int $userId): void
errorResponse('ID žádosti je povinné');
}
$stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ? AND user_id = ?');
$stmt = $pdo->prepare(
'SELECT id, user_id, leave_type, date_from, date_to, total_hours,
total_days, notes, status
FROM leave_requests WHERE id = ? AND user_id = ?'
);
$stmt->execute([$requestId, $userId]);
$request = $stmt->fetch();
@@ -310,7 +323,11 @@ function handleApproveRequest(PDO $pdo, int $reviewerId, array $authData): void
errorResponse('ID žádosti je povinné');
}
$stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, user_id, leave_type, date_from, date_to, total_hours,
total_days, status
FROM leave_requests WHERE id = ?'
);
$stmt->execute([$requestId]);
$request = $stmt->fetch();
@@ -427,7 +444,9 @@ function handleRejectRequest(PDO $pdo, int $reviewerId, array $authData): void
errorResponse('Důvod zamítnutí je povinný');
}
$stmt = $pdo->prepare('SELECT * FROM leave_requests WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, user_id, status FROM leave_requests WHERE id = ?'
);
$stmt->execute([$requestId]);
$request = $stmt->fetch();

38
api/admin/handlers/offers-handlers.php
View File

@@ -54,7 +54,11 @@ function handleGetList(PDO $pdo): void
function handleGetDetail(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('
SELECT q.*, c.name as customer_name
SELECT q.id, q.quotation_number, q.project_code, q.customer_id,
q.created_at, q.valid_until, q.currency, q.language,
q.vat_rate, q.apply_vat, q.exchange_rate, q.order_id,
q.status, q.scope_title, q.scope_description,
c.name as customer_name
FROM quotations q
LEFT JOIN customers c ON q.customer_id = c.id
WHERE q.id = ?
@@ -68,7 +72,9 @@ function handleGetDetail(PDO $pdo, int $id): void
// Get items
$stmt = $pdo->prepare('
SELECT * FROM quotation_items
SELECT id, quotation_id, position, description, item_description,
quantity, unit, unit_price, is_included_in_total
FROM quotation_items
WHERE quotation_id = ?
ORDER BY position
');
@@ -77,7 +83,8 @@ function handleGetDetail(PDO $pdo, int $id): void
// Get scope sections
$stmt = $pdo->prepare('
SELECT * FROM scope_sections
SELECT id, quotation_id, position, title, title_cz, content
FROM scope_sections
WHERE quotation_id = ?
ORDER BY position
');
@@ -264,7 +271,12 @@ function handleCreateOffer(PDO $pdo): void
function handleUpdateOffer(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM quotations WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, quotation_number, project_code, customer_id, created_at,
valid_until, currency, language, vat_rate, apply_vat,
exchange_rate, order_id, status, scope_title, scope_description
FROM quotations WHERE id = ?'
);
$stmt->execute([$id]);
$existing = $stmt->fetch();
@@ -349,7 +361,12 @@ function handleUpdateOffer(PDO $pdo, int $id): void
function handleDuplicate(PDO $pdo, int $sourceId): void
{
$stmt = $pdo->prepare('SELECT * FROM quotations WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, quotation_number, project_code, customer_id, currency,
language, vat_rate, apply_vat, exchange_rate,
scope_title, scope_description
FROM quotations WHERE id = ?'
);
$stmt->execute([$sourceId]);
$source = $stmt->fetch();
@@ -357,11 +374,18 @@ function handleDuplicate(PDO $pdo, int $sourceId): void
errorResponse('Zdrojová nabídka nebyla nalezena', 404);
}
$stmt = $pdo->prepare('SELECT * FROM quotation_items WHERE quotation_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT description, item_description, quantity, unit, unit_price,
is_included_in_total, position
FROM quotation_items WHERE quotation_id = ? ORDER BY position'
);
$stmt->execute([$sourceId]);
$sourceItems = $stmt->fetchAll();
$stmt = $pdo->prepare('SELECT * FROM scope_sections WHERE quotation_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT title, title_cz, content, position
FROM scope_sections WHERE quotation_id = ? ORDER BY position'
);
$stmt->execute([$sourceId]);
$sourceSections = $stmt->fetchAll();

18
api/admin/handlers/offers-templates-handlers.php
View File

@@ -4,7 +4,10 @@ declare(strict_types=1);
function handleGetItemTemplates(PDO $pdo): void
{
$stmt = $pdo->query('SELECT * FROM item_templates ORDER BY category, name');
$stmt = $pdo->query(
'SELECT id, name, description, default_price, category
FROM item_templates ORDER BY category, name'
);
successResponse(['templates' => $stmt->fetchAll()]);
}
@@ -100,13 +103,17 @@ function handleDeleteItemTemplate(PDO $pdo, int $id): void
function handleGetScopeTemplates(PDO $pdo): void
{
$stmt = $pdo->query('SELECT * FROM scope_templates ORDER BY name');
$stmt = $pdo->query(
'SELECT id, name, title, description FROM scope_templates ORDER BY name'
);
successResponse(['templates' => $stmt->fetchAll()]);
}
function handleGetScopeDetail(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM scope_templates WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, name, title, description FROM scope_templates WHERE id = ?'
);
$stmt->execute([$id]);
$template = $stmt->fetch();
@@ -114,7 +121,10 @@ function handleGetScopeDetail(PDO $pdo, int $id): void
errorResponse('Šablona nebyla nalezena', 404);
}
$stmt = $pdo->prepare('SELECT * FROM scope_template_sections WHERE scope_template_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT id, scope_template_id, position, title, title_cz, content
FROM scope_template_sections WHERE scope_template_id = ? ORDER BY position'
);
$stmt->execute([$id]);
$template['sections'] = $stmt->fetchAll();

37
api/admin/handlers/orders-handlers.php
View File

@@ -96,12 +96,19 @@ function handleGetDetail(PDO $pdo, int $id): void
}
// Get items
$stmt = $pdo->prepare('SELECT * FROM order_items WHERE order_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT id, order_id, description, item_description, quantity, unit,
unit_price, is_included_in_total, position
FROM order_items WHERE order_id = ? ORDER BY position'
);
$stmt->execute([$id]);
$order['items'] = $stmt->fetchAll();
// Get sections
$stmt = $pdo->prepare('SELECT * FROM order_sections WHERE order_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT id, order_id, title, title_cz, content, position
FROM order_sections WHERE order_id = ? ORDER BY position'
);
$stmt->execute([$id]);
$order['sections'] = $stmt->fetchAll();
@@ -202,7 +209,12 @@ function handleCreateOrder(PDO $pdo): void
}
// Verify quotation exists and has no order yet
$stmt = $pdo->prepare('SELECT * FROM quotations WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, quotation_number, project_code, customer_id, currency,
language, vat_rate, apply_vat, exchange_rate, order_id,
scope_title, scope_description
FROM quotations WHERE id = ?'
);
$stmt->execute([$quotationId]);
$quotation = $stmt->fetch();
@@ -215,11 +227,18 @@ function handleCreateOrder(PDO $pdo): void
}
// Get quotation items and sections
$stmt = $pdo->prepare('SELECT * FROM quotation_items WHERE quotation_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT description, item_description, quantity, unit,
unit_price, is_included_in_total, position
FROM quotation_items WHERE quotation_id = ? ORDER BY position'
);
$stmt->execute([$quotationId]);
$quotationItems = $stmt->fetchAll();
$stmt = $pdo->prepare('SELECT * FROM scope_sections WHERE quotation_id = ? ORDER BY position');
$stmt = $pdo->prepare(
'SELECT title, title_cz, content, position
FROM scope_sections WHERE quotation_id = ? ORDER BY position'
);
$stmt->execute([$quotationId]);
$quotationSections = $stmt->fetchAll();
@@ -354,7 +373,9 @@ function handleCreateOrder(PDO $pdo): void
function handleUpdateOrder(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM orders WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, order_number, status, notes FROM orders WHERE id = ?'
);
$stmt->execute([$id]);
$order = $stmt->fetch();
@@ -461,7 +482,9 @@ function handleUpdateOrder(PDO $pdo, int $id): void
function handleDeleteOrder(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM orders WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, order_number, quotation_id FROM orders WHERE id = ?'
);
$stmt->execute([$id]);
$order = $stmt->fetch();

14
api/admin/handlers/projects-handlers.php
View File

@@ -114,7 +114,9 @@ function handleCreateProject(PDO $pdo): void
function handleDeleteProject(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM projects WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, project_number, name, order_id, status FROM projects WHERE id = ?'
);
$stmt->execute([$id]);
$project = $stmt->fetch();
@@ -207,7 +209,10 @@ function handleGetList(PDO $pdo): void
function handleGetDetail(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('
SELECT p.*,
SELECT p.id, p.project_number, p.name, p.customer_id,
p.quotation_id, p.order_id, p.status,
p.start_date, p.end_date, p.notes,
p.created_at, p.modified_at,
c.name as customer_name,
o.order_number, o.status as order_status,
q.quotation_number
@@ -229,7 +234,10 @@ function handleGetDetail(PDO $pdo, int $id): void
function handleUpdateProject(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM projects WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, project_number, name, status, start_date, end_date, notes
FROM projects WHERE id = ?'
);
$stmt->execute([$id]);
$project = $stmt->fetch();

7
api/admin/handlers/received-invoices-handlers.php
View File

@@ -358,7 +358,12 @@ function handleBulkUpload(PDO $pdo, array $authData): void
function handleUpdateReceivedInvoice(PDO $pdo, int $id): void
{
$stmt = $pdo->prepare('SELECT * FROM received_invoices WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, supplier_name, invoice_number, description,
amount, currency, vat_rate, vat_amount,
issue_date, due_date, paid_date, status, notes
FROM received_invoices WHERE id = ?'
);
$stmt->execute([$id]);
$invoice = $stmt->fetch();

11
api/admin/handlers/roles-handlers.php
View File

@@ -9,7 +9,8 @@ function handleGetRole(PDO $pdo): void
{
// Get all roles with user count (LEFT JOIN instead of correlated subquery)
$stmt = $pdo->query('
SELECT r.*, COUNT(u.id) as user_count
SELECT r.id, r.name, r.display_name, r.description, r.created_at,
COUNT(u.id) as user_count
FROM roles r
LEFT JOIN users u ON u.role_id = r.id
GROUP BY r.id
@@ -133,7 +134,9 @@ function handleCreateRole(PDO $pdo): void
function handleUpdateRole(PDO $pdo, int $roleId): void
{
// Get existing role
$stmt = $pdo->prepare('SELECT * FROM roles WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, name, display_name, description FROM roles WHERE id = ?'
);
$stmt->execute([$roleId]);
$role = $stmt->fetch();
@@ -205,7 +208,9 @@ function handleUpdateRole(PDO $pdo, int $roleId): void
*/
function handleDeleteRole(PDO $pdo, int $roleId): void
{
$stmt = $pdo->prepare('SELECT * FROM roles WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, name, display_name, description FROM roles WHERE id = ?'
);
$stmt->execute([$roleId]);
$role = $stmt->fetch();

11
api/admin/handlers/totp-handlers.php
View File

@@ -181,7 +181,9 @@ function handleVerify(PDO $pdo, TwoFactorAuth $tfa): void
$userId = $tokenData['user_id'];
$stmt = $pdo->prepare('
SELECT u.*, r.name as role_name, r.display_name as role_display_name
SELECT u.id, u.username, u.email, u.first_name, u.last_name,
u.role_id, u.is_active, u.totp_secret, u.totp_enabled,
r.name as role_name, r.display_name as role_display_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
WHERE u.id = ? AND u.totp_enabled = 1
@@ -230,7 +232,9 @@ function handleBackupVerify(PDO $pdo): void
$userId = $tokenData['user_id'];
$stmt = $pdo->prepare('
SELECT u.*, r.name as role_name, r.display_name as role_display_name
SELECT u.id, u.username, u.email, u.first_name, u.last_name,
u.role_id, u.is_active, u.totp_enabled, u.totp_backup_codes,
r.name as role_name, r.display_name as role_display_name
FROM users u
LEFT JOIN roles r ON u.role_id = r.id
WHERE u.id = ? AND u.totp_enabled = 1
@@ -355,7 +359,8 @@ function verifyLoginToken(PDO $pdo, string $token): ?array
$hashedToken = hash('sha256', $token);
$stmt = $pdo->prepare('
SELECT * FROM totp_login_tokens
SELECT id, user_id, token_hash, expires_at, created_at
FROM totp_login_tokens
WHERE token_hash = ? AND expires_at > NOW()
');
$stmt->execute([$hashedToken]);

41
api/admin/handlers/trips-handlers.php
View File

@@ -37,7 +37,10 @@ function handleGetCurrent(PDO $pdo, int $userId): void
$endDate = date('Y-m-t', strtotime($startDate));
$sql = "
SELECT t.*, v.spz, v.name as vehicle_name, v.brand, v.model,
SELECT t.id, t.vehicle_id, t.user_id, t.trip_date, t.start_km,
t.end_km, t.distance, t.route_from, t.route_to,
t.is_business, t.notes, t.created_at,
v.spz, v.name as vehicle_name, v.brand, v.model,
CONCAT(u.first_name, ' ', u.last_name) as driver_name
FROM trips t
JOIN vehicles v ON t.vehicle_id = v.id
@@ -101,7 +104,10 @@ function handleGetHistory(PDO $pdo, int $userId): void
$endDate = date('Y-m-t', strtotime($startDate));
$sql = "
SELECT t.*, v.spz, v.name as vehicle_name, v.brand, v.model,
SELECT t.id, t.vehicle_id, t.user_id, t.trip_date, t.start_km,
t.end_km, t.distance, t.route_from, t.route_to,
t.is_business, t.notes, t.created_at,
v.spz, v.name as vehicle_name, v.brand, v.model,
CONCAT(u.first_name, ' ', u.last_name) as driver_name
FROM trips t
JOIN vehicles v ON t.vehicle_id = v.id
@@ -173,7 +179,10 @@ function handleGetAdmin(PDO $pdo): void
}
$sql = "
SELECT t.*, v.spz, v.name as vehicle_name,
SELECT t.id, t.vehicle_id, t.user_id, t.trip_date, t.start_km,
t.end_km, t.distance, t.route_from, t.route_to,
t.is_business, t.notes, t.created_at,
v.spz, v.name as vehicle_name,
CONCAT(u.first_name, ' ', u.last_name) as driver_name
FROM trips t
JOIN vehicles v ON t.vehicle_id = v.id
@@ -239,7 +248,10 @@ function handleGetAdmin(PDO $pdo): void
function handleGetVehicles(PDO $pdo): void
{
$stmt = $pdo->query('
SELECT v.*, COUNT(t.id) as trip_count,
SELECT v.id, v.spz, v.name, v.brand, v.model,
v.initial_km, v.actual_km, v.is_active,
v.created_at, v.updated_at,
COUNT(t.id) as trip_count,
COALESCE(MAX(t.end_km), v.initial_km) as current_km
FROM vehicles v
LEFT JOIN trips t ON t.vehicle_id = v.id
@@ -415,7 +427,11 @@ function handleVehicle(PDO $pdo): void
*/
function handleUpdateTrip(PDO $pdo, int $id, int $userId, array $authData): void
{
$stmt = $pdo->prepare('SELECT * FROM trips WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, vehicle_id, user_id, trip_date, start_km, end_km,
route_from, route_to, is_business, notes
FROM trips WHERE id = ?'
);
$stmt->execute([$id]);
$trip = $stmt->fetch();
@@ -467,7 +483,11 @@ function handleUpdateTrip(PDO $pdo, int $id, int $userId, array $authData): void
*/
function handleDeleteTrip(PDO $pdo, int $id, int $userId, array $authData): void
{
$stmt = $pdo->prepare('SELECT * FROM trips WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, vehicle_id, user_id, trip_date, start_km, end_km,
route_from, route_to, is_business, notes
FROM trips WHERE id = ?'
);
$stmt->execute([$id]);
$trip = $stmt->fetch();
@@ -497,7 +517,9 @@ function handleDeleteVehicle(PDO $pdo, int $id): void
errorResponse('ID je povinné');
}
$stmt = $pdo->prepare('SELECT * FROM vehicles WHERE id = ?');
$stmt = $pdo->prepare(
'SELECT id, spz, name, brand, model, is_active FROM vehicles WHERE id = ?'
);
$stmt->execute([$id]);
$vehicle = $stmt->fetch();
@@ -573,7 +595,10 @@ function handleGetPrint(PDO $pdo): void
}
$sql = "
SELECT t.*, v.spz, v.name as vehicle_name, v.brand, v.model,
SELECT t.id, t.vehicle_id, t.user_id, t.trip_date, t.start_km,
t.end_km, t.distance, t.route_from, t.route_to,
t.is_business, t.notes, t.created_at,
v.spz, v.name as vehicle_name, v.brand, v.model,
CONCAT(u.first_name, ' ', u.last_name) as driver_name
FROM trips t
JOIN vehicles v ON t.vehicle_id = v.id

6
api/admin/handlers/users-handlers.php
View File

@@ -142,7 +142,11 @@ function handleCreateUser(PDO $pdo, array $authData): void
function handleUpdateUser(PDO $pdo, int $userId, int $currentUserId, array $authData): void
{
// Get existing user
$stmt = $pdo->prepare('SELECT * FROM users WHERE id = ?');
$stmt = $pdo->prepare('
SELECT id, username, email, first_name, last_name, role_id, is_active,
last_login, created_at
FROM users WHERE id = ?
');
$stmt->execute([$userId]);
$existingUser = $stmt->fetch();