From fb480d886dd94338fce8514ddf6d7344b61e484c Mon Sep 17 00:00:00 2001
From: BOHA <boha@boha.cz>
Date: Tue, 16 Jun 2026 20:31:58 +0200
Subject: [PATCH] fix(documents): gate selected_custom_fields behind editable
 guard; bound index cap to column width

Addresses review: add selected_custom_fields to offers/issued-orders
NON_STATUS_UPDATE_FIELDS so a non-editable document rejects selection
edits (status-only transitions still pass); tighten Zod cap 200->50 to
stay within VARCHAR(255).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---
 src/schemas/invoices.schema.ts        | 4 ++--
 src/schemas/issued-orders.schema.ts   | 2 +-
 src/schemas/offers.schema.ts          | 2 +-
 src/services/issued-orders.service.ts | 1 +
 src/services/offers.service.ts        | 1 +
 5 files changed, 6 insertions(+), 4 deletions(-)

diff --git a/src/schemas/invoices.schema.ts b/src/schemas/invoices.schema.ts
index b6ae94f..dccfebc 100644
--- a/src/schemas/invoices.schema.ts
+++ b/src/schemas/invoices.schema.ts
@@ -53,7 +53,7 @@ export const CreateInvoiceSchema = z.object({
   // Positional indices of company custom fields to print on this document's PDF.
   selected_custom_fields: z
     .array(z.number().int().nonnegative())
-    .max(200)
+    .max(50)
     .optional(),
 });
 
@@ -81,7 +81,7 @@ export const UpdateInvoiceSchema = z.object({
   sections: z.array(DocumentSectionSchema).optional(),
   selected_custom_fields: z
     .array(z.number().int().nonnegative())
-    .max(200)
+    .max(50)
     .optional(),
 });
 
diff --git a/src/schemas/issued-orders.schema.ts b/src/schemas/issued-orders.schema.ts
index f570c47..e137f5f 100644
--- a/src/schemas/issued-orders.schema.ts
+++ b/src/schemas/issued-orders.schema.ts
@@ -45,7 +45,7 @@ export const CreateIssuedOrderSchema = z.object({
   // PDF. Omitted/empty ⇒ none. Update schema derives via .partial().
   selected_custom_fields: z
     .array(z.number().int().nonnegative())
-    .max(200)
+    .max(50)
     .optional(),
 });
 
diff --git a/src/schemas/offers.schema.ts b/src/schemas/offers.schema.ts
index 5a52677..427b94f 100644
--- a/src/schemas/offers.schema.ts
+++ b/src/schemas/offers.schema.ts
@@ -52,7 +52,7 @@ export const CreateQuotationSchema = z.object({
   // PDF. Omitted/empty ⇒ none. Update schema derives via .partial().
   selected_custom_fields: z
     .array(z.number().int().nonnegative())
-    .max(200)
+    .max(50)
     .optional(),
 });
 
diff --git a/src/services/issued-orders.service.ts b/src/services/issued-orders.service.ts
index 4265942..7925e2c 100644
--- a/src/services/issued-orders.service.ts
+++ b/src/services/issued-orders.service.ts
@@ -129,6 +129,7 @@ const NON_STATUS_UPDATE_FIELDS = [
   "language",
   "order_text",
   "internal_notes",
+  "selected_custom_fields",
   "items",
   "sections",
 ] as const;
diff --git a/src/services/offers.service.ts b/src/services/offers.service.ts
index 3842a3e..a244c3f 100644
--- a/src/services/offers.service.ts
+++ b/src/services/offers.service.ts
@@ -68,6 +68,7 @@ const NON_STATUS_UPDATE_FIELDS = [
   "language",
   "scope_title",
   "scope_description",
+  "selected_custom_fields",
   "items",
   "sections",
 ] as const;