boha_admin/app
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 26 Wiki Activity

fix: resolve all 28 findings from the 2026-06-12 full audit (TDD-pinned)

Browse Source 
Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
  failed deficit line rolls back the surplus corrective receipt — retries
  no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
  of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
  (in-transaction, clamped at 0)

High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
  the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
  when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
  (Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
  hours against its own balance (mirrors createLeave)

Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
  500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
  Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
  (recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
  @db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
  /items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
  finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
  settings.company|settings.system; Settings System tab no longer clobbers
  Firma numbering patterns; draft invoices hide the dead PDF button;
  dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
  audit-log + invoice month buckets day-shift fixes

Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.

~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
BOHA
2026-06-12 23:00:19 +02:00
parent 8f74efba97
commit e11765bf0e
56 changed files with 3968 additions and 265 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
src/schemas/auth.schema.ts
View File

@@ -27,7 +27,10 @@ export const TotpBackupSchema = z.object({
});
export const TotpEnableSchema = z.object({
secret: z.string().min(1).max(255),
// The secret is stored AES-256-GCM encrypted (base64 of IV+ciphertext+tag)
// in a VarChar(255) column — plaintext over ~164 chars overflows AFTER
// encryption. Real TOTP secrets are 16-32 chars; 64 is generous.
secret: z.string().min(1).max(64),
code: z.string().min(1).max(64),
password: z.string().max(200).optional(),
current_code: z.string().max(64).optional(),

20
src/schemas/common.ts
View File

@@ -110,6 +110,26 @@ export const isoDateString = z.preprocess(
.regex(/^\d{4}-\d{2}-\d{2}$/, "Datum musí být ve formátu YYYY-MM-DD"),
);
/**
* Nullable/optional variant of isoDateString for edit-form date fields:
* "" and null normalize to null (the forms clear date inputs with empty
* strings), undefined stays undefined (update semantics: field untouched).
* Same lenient trailing-time stripping — a local-midnight datetime written
* to a @db.Date column would land a day early (Prisma truncates to the UTC
* date part).
*/
export const nullableIsoDateString = z.preprocess(
(v) => {
if (v === undefined) return undefined;
if (v === null || v === "") return null;
return typeof v === "string" ? v.slice(0, 10) : v;
},
z
.string()
.regex(/^\d{4}-\d{2}-\d{2}$/, "Datum musí být ve formátu YYYY-MM-DD")
.nullish(),
);
/** HH:MM (24h) time string. Tolerant of a trailing ":ss" seconds component. */
export const timeString = z.preprocess(
(v) =>

16
src/schemas/customers.schema.ts
View File

@@ -4,10 +4,10 @@ export const CreateCustomerSchema = z.object({
name: z.string().min(1, "Název zákazníka je povinný").max(255),
street: z.string().max(255).nullish(),
city: z.string().max(255).nullish(),
postal_code: z.string().max(255).nullish(),
country: z.string().max(255).nullish(),
company_id: z.string().max(255).nullish(),
vat_id: z.string().max(255).nullish(),
postal_code: z.string().max(20).nullish(),
country: z.string().max(100).nullish(),
company_id: z.string().max(50).nullish(),
vat_id: z.string().max(50).nullish(),
custom_fields: z.array(z.unknown()).max(100).optional(),
customer_field_order: z.array(z.string()).optional(),
});
@@ -16,10 +16,10 @@ export const UpdateCustomerSchema = z.object({
name: z.string().min(1, "Název zákazníka je povinný").max(255).optional(),
street: z.string().max(255).nullish(),
city: z.string().max(255).nullish(),
postal_code: z.string().max(255).nullish(),
country: z.string().max(255).nullish(),
company_id: z.string().max(255).nullish(),
vat_id: z.string().max(255).nullish(),
postal_code: z.string().max(20).nullish(),
country: z.string().max(100).nullish(),
company_id: z.string().max(50).nullish(),
vat_id: z.string().max(50).nullish(),
custom_fields: z.array(z.unknown()).max(100).optional(),
customer_field_order: z.array(z.string()).optional(),
});

53
src/schemas/invoices.schema.ts
View File

@@ -6,39 +6,40 @@ import {
positiveNumberFromForm,
nullableIntIdFromForm,
booleanFromForm,
nullableIsoDateString,
DocumentSectionSchema,
} from "./common";
const InvoiceItemSchema = z.object({
description: z.string().max(8000).nullish(),
description: z.string().max(500).nullish(),
item_description: z.string().max(8000).nullish(),
quantity: positiveNumberFromForm.default(1),
unit: z.string().max(255).nullish(),
unit: z.string().max(20).nullish(),
unit_price: numberFromForm.default(0),
vat_rate: numberInRange(0, 100).optional().default(21.0),
position: nonNegativeNumberFromForm.optional(),
});
export const CreateInvoiceSchema = z.object({
invoice_number: z.string().max(255).nullish(),
invoice_number: z.string().max(50).nullish(),
order_id: nullableIntIdFromForm.nullish(),
customer_id: nullableIntIdFromForm.nullish(),
status: z.string().max(20).optional().default("draft"),
currency: z.string().max(20).optional().default("CZK"),
currency: z.string().max(10).optional().default("CZK"),
vat_rate: numberInRange(0, 100).optional().default(21.0),
apply_vat: booleanFromForm.optional().default(true),
payment_method: z.string().max(255).nullish(),
constant_symbol: z.string().max(255).nullish(),
payment_method: z.string().max(50).nullish(),
constant_symbol: z.string().max(20).nullish(),
bank_name: z.string().max(255).nullish(),
bank_swift: z.string().max(255).nullish(),
bank_iban: z.string().max(255).nullish(),
bank_account: z.string().max(255).nullish(),
issue_date: z.string().max(255).nullish(),
due_date: z.string().max(255).nullish(),
tax_date: z.string().max(255).nullish(),
bank_swift: z.string().max(20).nullish(),
bank_iban: z.string().max(50).nullish(),
bank_account: z.string().max(50).nullish(),
issue_date: nullableIsoDateString,
due_date: nullableIsoDateString,
tax_date: nullableIsoDateString,
issued_by: z.string().max(255).nullish(),
billing_text: z.string().max(8000).nullish(),
language: z.string().max(20).optional().default("cs"),
billing_text: z.string().max(500).nullish(),
language: z.string().max(5).optional().default("cs"),
// `notes` was dropped (printed-notes block removed — free-form PDF content
// lives in the sections); legacy clients still sending it are silently
// stripped by z.object. internal_notes is never printed.
@@ -51,24 +52,24 @@ export const CreateInvoiceSchema = z.object({
export const UpdateInvoiceSchema = z.object({
status: z.string().max(20).optional(),
currency: z.string().max(20).optional(),
language: z.string().max(20).optional(),
payment_method: z.string().max(255).nullish(),
constant_symbol: z.string().max(255).nullish(),
currency: z.string().max(10).optional(),
language: z.string().max(5).optional(),
payment_method: z.string().max(50).nullish(),
constant_symbol: z.string().max(20).nullish(),
bank_name: z.string().max(255).nullish(),
bank_swift: z.string().max(255).nullish(),
bank_iban: z.string().max(255).nullish(),
bank_account: z.string().max(255).nullish(),
bank_swift: z.string().max(20).nullish(),
bank_iban: z.string().max(50).nullish(),
bank_account: z.string().max(50).nullish(),
issued_by: z.string().max(255).nullish(),
billing_text: z.string().max(8000).nullish(),
billing_text: z.string().max(500).nullish(),
customer_id: nullableIntIdFromForm.optional(),
vat_rate: numberInRange(0, 100).optional(),
apply_vat: booleanFromForm.optional(),
issue_date: z.union([z.string().max(255), z.null()]).optional(),
due_date: z.union([z.string().max(255), z.null()]).optional(),
tax_date: z.union([z.string().max(255), z.null()]).optional(),
issue_date: nullableIsoDateString,
due_date: nullableIsoDateString,
tax_date: nullableIsoDateString,
internal_notes: z.string().max(8000).nullish(),
paid_date: z.union([z.string().max(255), z.null()]).optional(),
paid_date: nullableIsoDateString,
items: z.array(InvoiceItemSchema).optional(),
sections: z.array(DocumentSectionSchema).optional(),
});

20
src/schemas/orders.schema.ts
View File

@@ -9,10 +9,10 @@ import {
} from "./common";
const OrderItemSchema = z.object({
description: z.string().max(8000).nullish(),
description: z.string().max(500).nullish(),
item_description: z.string().max(8000).nullish(),
quantity: positiveNumberFromForm.default(1),
unit: z.string().max(255).nullish(),
unit: z.string().max(20).nullish(),
unit_price: numberFromForm.default(0),
is_included_in_total: booleanFromForm.optional().default(true),
position: nonNegativeNumberFromForm.optional(),
@@ -27,20 +27,20 @@ const OrderSectionSchema = z.object({
export const CreateOrderFromQuotationSchema = z.object({
quotationId: intIdFromForm,
customerOrderNumber: z.string().max(255).optional().default(""),
customerOrderNumber: z.string().max(100).optional().default(""),
});
export const CreateOrderSchema = z.object({
order_number: z.string().max(255).nullish(),
customer_order_number: z.string().max(255).nullish(),
order_number: z.string().max(50).nullish(),
customer_order_number: z.string().max(100).nullish(),
quotation_id: nullableIntIdFromForm.nullish(),
customer_id: nullableIntIdFromForm.nullish(),
status: z
.enum(["prijata", "v_realizaci", "dokoncena", "zrusena"])
.optional()
.default("prijata"),
currency: z.string().max(20).optional().default("CZK"),
language: z.string().max(20).optional().default("cs"),
currency: z.string().max(10).optional().default("CZK"),
language: z.string().max(5).optional().default("cs"),
exchange_rate: positiveNumberFromForm.optional().default(1.0),
scope_title: z.string().max(255).nullish(),
scope_description: z.string().max(8000).nullish(),
@@ -51,10 +51,10 @@ export const CreateOrderSchema = z.object({
});
export const UpdateOrderSchema = z.object({
customer_order_number: z.string().max(255).nullish(),
customer_order_number: z.string().max(100).nullish(),
status: z.enum(["prijata", "v_realizaci", "dokoncena", "zrusena"]).optional(),
currency: z.string().max(20).optional(),
language: z.string().max(20).optional(),
currency: z.string().max(10).optional(),
language: z.string().max(5).optional(),
scope_title: z.string().max(255).nullish(),
scope_description: z.string().max(8000).nullish(),
notes: z.string().max(8000).nullish(),

28
src/schemas/received-invoices.schema.ts
View File

@@ -1,33 +1,37 @@
import { z } from "zod";
import { numberInRange, nonNegativeNumberFromForm } from "./common";
import {
numberInRange,
nonNegativeNumberFromForm,
nullableIsoDateString,
} from "./common";
export const CreateReceivedInvoiceSchema = z.object({
supplier_name: z.string().min(1, "Název dodavatele je povinný").max(255),
month: numberInRange(1, 12),
year: numberInRange(2000, 2100),
invoice_number: z.string().max(255).nullish(),
description: z.string().max(8000).nullish(),
invoice_number: z.string().max(100).nullish(),
description: z.string().max(500).nullish(),
amount: nonNegativeNumberFromForm.optional().default(0),
currency: z.string().max(20).optional().default("CZK"),
currency: z.string().max(3).optional().default("CZK"),
vat_rate: numberInRange(0, 100).optional().default(21),
vat_amount: nonNegativeNumberFromForm.optional().default(0),
issue_date: z.string().max(255).nullish(),
due_date: z.string().max(255).nullish(),
issue_date: nullableIsoDateString,
due_date: nullableIsoDateString,
status: z.enum(["unpaid", "paid"]).optional().default("unpaid"),
notes: z.string().max(8000).nullish(),
});
export const UpdateReceivedInvoiceSchema = z.object({
supplier_name: z.string().max(255).optional(),
invoice_number: z.string().max(255).nullish(),
description: z.string().max(8000).nullish(),
invoice_number: z.string().max(100).nullish(),
description: z.string().max(500).nullish(),
amount: nonNegativeNumberFromForm.optional(),
currency: z.string().max(20).optional(),
currency: z.string().max(3).optional(),
vat_rate: numberInRange(0, 100).optional(),
vat_amount: nonNegativeNumberFromForm.optional(),
issue_date: z.union([z.string().max(255), z.null()]).optional(),
due_date: z.union([z.string().max(255), z.null()]).optional(),
paid_date: z.union([z.string().max(255), z.null()]).optional(),
issue_date: nullableIsoDateString,
due_date: nullableIsoDateString,
paid_date: nullableIsoDateString,
status: z.enum(["unpaid", "paid"]).optional(),
notes: z.string().max(8000).nullish(),
month: numberInRange(1, 12).optional(),

20
src/schemas/trips.schema.ts
View File

@@ -1,7 +1,7 @@
import { z } from "zod";
import {
intIdFromForm,
nonNegativeNumberFromForm,
nonNegativeIntFromForm,
booleanFromForm,
isoDateString,
} from "./common";
@@ -12,10 +12,12 @@ export const CreateTripSchema = z.object({
// when the client doesn't provide it (see POST /trips handler)
user_id: intIdFromForm.optional(),
trip_date: isoDateString,
start_km: nonNegativeNumberFromForm,
end_km: nonNegativeNumberFromForm,
route_from: z.string().min(1, "Vyplňte odkud").max(255),
route_to: z.string().min(1, "Vyplňte kam").max(255),
// Int columns — a decimal odometer reading would 500 at Prisma (or
// truncate, corrupting the derived distance and vehicles.actual_km).
start_km: nonNegativeIntFromForm,
end_km: nonNegativeIntFromForm,
route_from: z.string().min(1, "Vyplňte odkud").max(100),
route_to: z.string().min(1, "Vyplňte kam").max(100),
is_business: booleanFromForm.optional().default(false),
notes: z.string().max(2000).nullish(),
});
@@ -24,10 +26,10 @@ export const UpdateTripSchema = z.object({
// trips.vehicle_id is a non-nullable FK — when present it must be a valid id
vehicle_id: intIdFromForm.optional(),
trip_date: isoDateString.optional(),
start_km: nonNegativeNumberFromForm.optional(),
end_km: nonNegativeNumberFromForm.optional(),
route_from: z.string().min(1, "Vyplňte odkud").max(255).optional(),
route_to: z.string().min(1, "Vyplňte kam").max(255).optional(),
start_km: nonNegativeIntFromForm.optional(),
end_km: nonNegativeIntFromForm.optional(),
route_from: z.string().min(1, "Vyplňte odkud").max(100).optional(),
route_to: z.string().min(1, "Vyplňte kam").max(100).optional(),
is_business: booleanFromForm.optional(),
notes: z.string().max(2000).nullish(),
});

11
src/schemas/vehicles.schema.ts
View File

@@ -1,13 +1,14 @@
import { z } from "zod";
import { nonNegativeNumberFromForm } from "./common";
import { nonNegativeIntFromForm } from "./common";
export const CreateVehicleSchema = z.object({
spz: z.string().min(1, "SPZ je povinná").max(50),
name: z.string().min(1, "Název je povinný").max(255),
brand: z.string().nullish(),
model: z.string().nullish(),
initial_km: nonNegativeNumberFromForm.optional().default(0),
actual_km: nonNegativeNumberFromForm.optional().default(0),
// Int columns — decimals would 500 at Prisma or silently truncate.
initial_km: nonNegativeIntFromForm.optional().default(0),
actual_km: nonNegativeIntFromForm.optional().default(0),
is_active: z
.preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
.optional()
@@ -19,8 +20,8 @@ export const UpdateVehicleSchema = z.object({
name: z.string().max(255).optional(),
brand: z.string().nullish(),
model: z.string().nullish(),
initial_km: nonNegativeNumberFromForm.optional(),
actual_km: nonNegativeNumberFromForm.optional(),
initial_km: nonNegativeIntFromForm.optional(),
actual_km: nonNegativeIntFromForm.optional(),
is_active: z
.preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
.optional(),

8
src/schemas/warehouse.schema.ts
View File

@@ -31,8 +31,8 @@ export type UpdateCategoryInput = z.infer<typeof UpdateCategorySchema>;
// stripped by z.object). Limits are DB-aligned.
export const CreateSupplierSchema = z.object({
name: z.string().min(1, "Název je povinný").max(255),
ico: z.string().max(255).nullish(),
dic: z.string().max(255).nullish(),
ico: z.string().max(20).nullish(),
dic: z.string().max(20).nullish(),
street: z.string().max(255).nullish(),
city: z.string().max(255).nullish(),
postal_code: z.string().max(20).nullish(),
@@ -42,8 +42,8 @@ export const CreateSupplierSchema = z.object({
});
export const UpdateSupplierSchema = z.object({
name: z.string().min(1, "Název je povinný").max(255).optional(),
ico: z.string().max(255).nullish(),
dic: z.string().max(255).nullish(),
ico: z.string().max(20).nullish(),
dic: z.string().max(20).nullish(),
street: z.string().max(255).nullish(),
city: z.string().max(255).nullish(),
postal_code: z.string().max(20).nullish(),