From ac7c220bb19a303216db110370ece20382d4d431 Mon Sep 17 00:00:00 2001
From: BOHA <boha@boha.cz>
Date: Mon, 8 Jun 2026 19:46:49 +0200
Subject: [PATCH] =?UTF-8?q?fix(odin):=20gate=20Ulo=C5=BEit=20on=20invoices?=
 =?UTF-8?q?.create=20+=20correct=20invoice=20invalidation=20key?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Final review caught two minor issues:
- saveInvoice invalidated ["received-invoices"], which matches no query (the
  received list/stats are keyed ["invoices","received",…]); use ["invoices"]
  so the list/stats actually refresh after an import.
- The Save button hit /received-invoices (requires invoices.create) while Odin
  is gated only on ai.use; disable Uložit (with a hint) when the user lacks
  invoices.create so the UI never offers a 403 action. Dormant today (ai.use is
  admin-only and admin bypasses checks) but correct going forward.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/admin/components/odin/InvoiceReviewCard.tsx | 10 +++++++++-
 src/admin/components/odin/OdinChat.tsx          |  8 +++++++-
 2 files changed, 16 insertions(+), 2 deletions(-)

diff --git a/src/admin/components/odin/InvoiceReviewCard.tsx b/src/admin/components/odin/InvoiceReviewCard.tsx
index 9f53f5e..3a9137a 100644
--- a/src/admin/components/odin/InvoiceReviewCard.tsx
+++ b/src/admin/components/odin/InvoiceReviewCard.tsx
@@ -7,6 +7,7 @@ import type { ReviewInvoice, EditableField } from "./types";
 interface InvoiceReviewCardProps {
   inv: ReviewInvoice;
   busy: boolean;
+  canSave: boolean;
   onChange: (uid: string, field: EditableField, value: string) => void;
   onSave: (inv: ReviewInvoice) => void;
   onDiscard: (uid: string) => void;
@@ -17,6 +18,7 @@ const fieldCols = { xs: "1fr", sm: "1fr 1fr" };
 export default function InvoiceReviewCard({
   inv,
   busy,
+  canSave,
   onChange,
   onSave,
   onDiscard,
@@ -96,7 +98,13 @@ export default function InvoiceReviewCard({
 
       {/* Actions */}
       <Box sx={{ display: "flex", gap: 1, mt: 1.5 }}>
-        <Button onClick={() => onSave(inv)} disabled={busy}>
+        <Button
+          onClick={() => onSave(inv)}
+          disabled={busy || !canSave}
+          title={
+            !canSave ? "Nemáte oprávnění k uložení přijatých faktur" : undefined
+          }
+        >
           Uložit
         </Button>
         <Button
diff --git a/src/admin/components/odin/OdinChat.tsx b/src/admin/components/odin/OdinChat.tsx
index e773683..09d9551 100644
--- a/src/admin/components/odin/OdinChat.tsx
+++ b/src/admin/components/odin/OdinChat.tsx
@@ -4,6 +4,7 @@ import Box from "@mui/material/Box";
 import Typography from "@mui/material/Typography";
 import apiFetch from "../../utils/api";
 import { useAlert } from "../../context/AlertContext";
+import { useAuth } from "../../context/AuthContext";
 import {
   aiUsageOptions,
   aiConversationsOptions,
@@ -61,6 +62,10 @@ function summaryNote(reviews: ReviewInvoice[]): string {
 export default function OdinChat() {
   const alert = useAlert();
   const qc = useQueryClient();
+  const { hasPermission } = useAuth();
+  // Saving an extracted invoice hits /received-invoices (needs invoices.create);
+  // Odin itself only needs ai.use, so the Save affordance is gated separately.
+  const canSave = hasPermission("invoices.create");
   const { data: usage } = useQuery(aiUsageOptions());
   const { data: convData, isPending: convPending } = useQuery(
     aiConversationsOptions(),
@@ -304,7 +309,7 @@ export default function OdinChat() {
       if (!res.ok) throw new Error(body?.error || "Uložení selhalo");
       alert.success("Faktura uložena");
       setReview((r) => r.filter((x) => x.uid !== inv.uid));
-      qc.invalidateQueries({ queryKey: ["received-invoices"] });
+      qc.invalidateQueries({ queryKey: ["invoices"] });
     } catch (e) {
       alert.error(e instanceof Error ? e.message : "Uložení selhalo");
     } finally {
@@ -445,6 +450,7 @@ export default function OdinChat() {
               key={inv.uid}
               inv={inv}
               busy={busy}
+              canSave={canSave}
               onChange={patch}
               onSave={saveInvoice}
               onDiscard={(uid) =>