boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: resolve all 28 findings from the 2026-06-12 full audit (TDD-pinned)

Browse Source 
Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
  failed deficit line rolls back the surplus corrective receipt — retries
  no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
  of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
  (in-transaction, clamped at 0)

High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
  the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
  when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
  (Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
  hours against its own balance (mirrors createLeave)

Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
  500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
  Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
  (recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
  @db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
  /items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
  finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
  settings.company|settings.system; Settings System tab no longer clobbers
  Firma numbering patterns; draft invoices hide the dead PDF button;
  dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
  audit-log + invoice month buckets day-shift fixes

Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.

~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-06-12 23:00:19 +02:00
parent 8f74efba97
commit e11765bf0e
56 changed files with 3968 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files

39
src/admin/pages/InvoiceDetail.tsx
View File

@@ -1802,23 +1802,28 @@ export default function InvoiceDetail() {
</Box>
</Box>
<Box sx={headerActionsSx}>
{isEdit && invoice && hasPermission("invoices.view") && (
<Button
onClick={() => handleViewPdf(invoice.language || "cs")}
variant="outlined"
color="inherit"
disabled={pdfLoading}
startIcon={
pdfLoading ? (
<CircularProgress size={16} color="inherit" />
) : (
FileIcon
)
}
>
Zobrazit fakturu
</Button>
)}
{/* Drafts have no number → /file 404s; hide the button like
OfferDetail/IssuedOrderDetail do. */}
{isEdit &&
invoice &&
invoice.invoice_number &&
hasPermission("invoices.view") && (
<Button
onClick={() => handleViewPdf(invoice.language || "cs")}
variant="outlined"
color="inherit"
disabled={pdfLoading}
startIcon={
pdfLoading ? (
<CircularProgress size={16} color="inherit" />
) : (
FileIcon
)
}
>
Zobrazit fakturu
</Button>
)}
{/* ── Create mode: two-button save ── */}
{!isEdit && (
<>

4
src/admin/pages/Invoices.tsx
View File

@@ -248,6 +248,9 @@ export default function Invoices() {
} else {
setStatsMonth((m) => m - 1);
}
// Back to page 1 — the server never clamps, so keeping e.g. page 3 in a
// sparser month shows an empty table (same reset as the filter handlers).
setPage(1);
};
const nextMonth = () => {
@@ -258,6 +261,7 @@ export default function Invoices() {
} else {
setStatsMonth((m) => m + 1);
}
setPage(1);
};
const [deleteConfirm, setDeleteConfirm] = useState<{

18
src/admin/pages/IssuedOrderDetail.tsx
View File

@@ -254,7 +254,7 @@ export default function IssuedOrderDetail() {
const editable = !readOnly;
const canExport = hasPermission("orders.view");
const { markClean } = useUnsavedChangesGuard(
const { isDirty, markClean } = useUnsavedChangesGuard(
{ form, items, sections },
!isEdit || dataReady,
);
@@ -506,11 +506,23 @@ export default function IssuedOrderDetail() {
else void handleSubmit();
};
// ─── Status transition (status-ONLY payload — a full-form resubmit on a
// non-editable order now 400s server-side) ───
// ─── Status transition. With unsaved edits on an editable (sent) order
// the transition routes through handleSubmit so the edits are PERSISTED
// with the status — a status-only payload would silently drop them, and
// the markClean below would re-baseline the guard so even the beforeunload
// warning disappears (the order is then read-only: edits unrecoverable).
// Clean (or non-editable) orders keep the status-only payload — a
// full-form resubmit on a non-editable order 400s server-side. ───
const handleStatusChange = async () => {
if (!statusConfirm.status || statusChanging) return;
const newStatus = statusConfirm.status;
if (editable && isDirty) {
setStatusConfirm({ show: false, status: null });
// handleSubmit validates, sends the full payload + status, archives
// the PDF and re-baselines the guard with what was actually persisted.
await handleSubmit(newStatus);
return;
}
setStatusChanging(newStatus);
try {
const result = await statusMutation.mutateAsync({ status: newStatus });

9
src/admin/pages/IssuedOrders.tsx
View File

@@ -133,6 +133,15 @@ export default function IssuedOrders({ month, year }: IssuedOrdersProps) {
const [status, setStatus] = useState("");
const [supplierFilter, setSupplierFilter] = useState<number | "">("");
const [page, setPage] = useState(1);
// Reset to page 1 when the parent moves to another month — the kept page
// index would otherwise request e.g. page 2 of a sparser month and render
// an empty list. Adjusted during render (adjust-state-on-prop-change
// pattern); a remount via `key` would also clear search/filters.
const [prevMonthYear, setPrevMonthYear] = useState(`${month}-${year}`);
if (`${month}-${year}` !== prevMonthYear) {
setPrevMonthYear(`${month}-${year}`);
setPage(1);
}
// Track first successful load so later refetches (filter/status/page change)
// keep the table visible instead of flashing the full-page skeleton.
const hasLoadedOnce = useRef(false);

42
src/admin/pages/ReceivedInvoices.tsx
View File

@@ -16,6 +16,7 @@ import {
} from "../utils/formatters";
import { normalizeDateStr } from "../utils/attendanceHelpers";
import useTableSort from "../hooks/useTableSort";
import { usePaginatedQuery } from "../hooks/usePaginatedQuery";
import {
companySettingsOptions,
type CompanySettingsData,
@@ -44,6 +45,7 @@ import {
StatCard,
EmptyState,
LoadingState,
Pagination,
type DataColumn,
type StatCardColor,
} from "../ui";
@@ -261,14 +263,33 @@ export default function ReceivedInvoices({
const { data: supplierNames = [] } = useQuery(supplierListOptions());
const companySettings = useQuery(companySettingsOptions()).data;
// List query — auto-refetches when filters change
const listQuery = useQuery(
const [page, setPage] = useState(1);
// Reset to page 1 when the parent moves to another month — the kept page
// index would otherwise request e.g. page 2 of a sparser month and render
// an empty list. Adjusted during render (adjust-state-on-prop-change
// pattern); a remount via `key` would also clear the search field.
const [prevMonthYear, setPrevMonthYear] = useState(
`${statsMonth}-${statsYear}`,
);
if (`${statsMonth}-${statsYear}` !== prevMonthYear) {
setPrevMonthYear(`${statsMonth}-${statsYear}`);
setPage(1);
}
// List query — auto-refetches when filters change. Paginated: the server
// caps at 25/page, so without the page param rows 26+ were unreachable.
const {
items: invoices,
pagination,
isPending: listPending,
} = usePaginatedQuery<ReceivedInvoice>(
receivedInvoiceListOptions({
month: statsMonth,
year: statsYear,
search,
sort,
order,
page,
}),
);
@@ -289,13 +310,10 @@ export default function ReceivedInvoices({
}),
);
// Derive list data from query (paginatedJsonQuery returns { data, pagination })
const invoices = listQuery.data?.data ?? [];
// Track first successful load (used to suppress the skeleton on later
// refetches). Set in an effect rather than during render to avoid a
// render-phase ref mutation.
const hasData = !!(listQuery.data || statsQuery.data);
const hasData = !!(pagination || statsQuery.data);
useEffect(() => {
if (hasData) hasLoadedOnce.current = true;
}, [hasData]);
@@ -336,7 +354,7 @@ export default function ReceivedInvoices({
},
});
const showListSkeleton = listQuery.isPending && !hasLoadedOnce.current;
const showListSkeleton = listPending && !hasLoadedOnce.current;
const [uploadFiles, setUploadFiles] = useState<File[]>([]);
const [uploadMeta, setUploadMeta] = useState<UploadMeta[]>([]);
@@ -814,7 +832,10 @@ export default function ReceivedInvoices({
<Box sx={{ flex: "1 1 320px" }}>
<TextField
value={search}
onChange={(e) => setSearch(e.target.value)}
onChange={(e) => {
setSearch(e.target.value);
setPage(1);
}}
placeholder="Hledat podle dodavatele nebo čísla faktury..."
fullWidth
/>
@@ -869,6 +890,11 @@ export default function ReceivedInvoices({
</Box>
</Box>
)}
<Pagination
page={page}
pageCount={pagination?.total_pages ?? 1}
onChange={setPage}
/>
</Card>
{/* Upload Modal */}

21
src/admin/pages/Settings.tsx
View File

@@ -334,7 +334,7 @@ export default function Settings() {
}, [sysSettingsData, sysFormInitialized]);
const saveSystemSettingsMutation = useApiMutation<
typeof sysForm,
Partial<typeof sysForm>,
{ message?: string; error?: string }
>({
url: () => `${API_BASE}/company-settings`,
@@ -424,7 +424,24 @@ export default function Settings() {
const handleSaveSystemSettings = async () => {
try {
await saveSystemSettingsMutation.mutateAsync(sysForm);
// Send ONLY the fields this tab edits. sysForm also carries
// numbering/currency fields captured once at init (sysFormInitialized
// never resets), and the backend applies every defined field — sending
// the whole form would silently revert a Firma-tab numbering edit made
// in the meantime with stale values.
await saveSystemSettingsMutation.mutateAsync({
break_threshold_hours: sysForm.break_threshold_hours,
break_duration_short: sysForm.break_duration_short,
break_duration_long: sysForm.break_duration_long,
clock_rounding_minutes: sysForm.clock_rounding_minutes,
invoice_alert_email: sysForm.invoice_alert_email,
leave_notify_email: sysForm.leave_notify_email,
smtp_from: sysForm.smtp_from,
smtp_from_name: sysForm.smtp_from_name,
max_login_attempts: sysForm.max_login_attempts,
lockout_minutes: sysForm.lockout_minutes,
max_requests_per_minute: sysForm.max_requests_per_minute,
});
} catch (e) {
alert.error(e instanceof Error ? e.message : "Chyba připojení");
}