190 Commits

Author SHA1 Message Date
BOHA
0baa604ade fix: remove duplicate canSecurity declaration in Settings 2026-03-23 11:43:27 +01:00
BOHA
1a62b31cd2 fix: support PHP encryption format for TOTP secrets
PHP uses base64(nonce+ciphertext+tag), TS was using hex:hex:hex.
decrypt() now auto-detects the format. encrypt() now outputs
PHP-compatible base64 format for cross-compatibility.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:42:32 +01:00
BOHA
f40f9d2a4b feat: wire up mandatory 2FA toggle in global settings
Connects the existing UI button to GET/POST /api/admin/totp/required
endpoints. Fetches current state on load, toggles on click.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:40:50 +01:00
BOHA
2b42e636ae chore: create Prisma migration baseline 2026-03-23 11:09:12 +01:00
BOHA
e0fbae1530 fix: received invoices — show skeleton only on initial load, not on sort/filter
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:03:22 +01:00
BOHA
0ad88aa5ce fix: invoice item schema accepts string numbers from form inputs
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 11:01:34 +01:00
BOHA
d3a72c51a2 fix: table sort toggle — use single state object to prevent lost updates
Two separate useState calls (sort + order) caused React to skip
re-renders when clicking the same column — setSort returned the same
value so React bailed out, and the nested setOrder was lost.

Single state object guarantees a new reference on every click,
so React always re-renders and useListData always refetches.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:58:56 +01:00
BOHA
635c6fd0ff fix: table sorting blocked by pointerEvents:none during loading
Root cause: useListData set loading=true on every refetch, and all 4
admin list pages (offers, orders, invoices, projects) applied
pointerEvents:'none' while loading — blocking all clicks including
sort column headers.

Fix: removed setLoading(true) from refetch (matching PHP behavior)
and removed pointerEvents from all list page cards. Opacity fade
kept as visual feedback.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:57:17 +01:00
BOHA
56065c381b fix: align useTableSort with PHP version — userClicked ref, nullable activeSort
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:53:26 +01:00
BOHA
1a175e805b fix: use vehicle initial_km as start_km for first trip record
When no trips exist for a vehicle, the last-km endpoint now returns
the vehicle's initial_km instead of 0, matching the PHP behavior:
COALESCE(MAX(end_km), vehicle.initial_km, 0)

Also fixed ordering from id DESC to end_km DESC for correctness.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:49:42 +01:00
BOHA
7ef25a077b feat: add SPAYD QR payment code to invoice PDF
Generates QR code in SVG format using the SPAYD payment standard,
matching the PHP implementation. Contains: IBAN, amount, currency,
variable symbol, constant symbol, and invoice reference.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:37:43 +01:00
BOHA
47fb4dc8ac feat: integrate ProjectFileManager into project detail page
Replace the file management placeholder with the actual ProjectFileManager
component, providing projectId, projectNumber, hasPermission, and hasNasFolder
props from the existing page state.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:22:10 +01:00
BOHA
3c1a35ae9c feat: add ProjectFileManager component with file browser UI
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:20:49 +01:00
BOHA
b87081dd2c feat: integrate NAS file operations with project CRUD
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:19:15 +01:00
BOHA
49e668ee2a feat: add project files REST endpoints with auth and audit logging
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:19:11 +01:00
BOHA
ff26dc497d feat: add NasFileManager service with security-hardened file operations
TypeScript port of PHP NasFileManager with symlink rejection,
path traversal protection, MIME validation via file-type, and
blocked extension checking.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 10:16:36 +01:00
BOHA
373ea82279 fix: rewrite attendance print to match PHP design 1:1
- Dark table headers (#333), proper column widths, uppercase labels
- User header bar with gray background and total hours
- Records from userData.records (not filtered from global records)
- Fund row with covered/total and status badge
- Leave summary with vacation remaining
- Print wrapper table for repeating header
- Matching CSS: borders, fonts, spacing, badges

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:39:31 +01:00
BOHA
23ae832eeb fix: attendance print - return proper data structure with records, leave balances, and fund stats
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:36:52 +01:00
BOHA
8c1fd07293 feat: implement attendance admin print functionality
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:33:43 +01:00
BOHA
ab71de78ce fix: rewrite invoices PDF to match PHP POHODA-style design
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:22:55 +01:00
BOHA
7a71d63f7f chore: add TOTP encryption key rotation script
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:13:16 +01:00
BOHA
bf9d54d9c0 test: add numbering tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:13:09 +01:00
BOHA
071c36916b test: add auth flow integration tests
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:13:05 +01:00
BOHA
6618ef1abd feat: add graceful shutdown handling (SIGTERM/SIGINT)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:13:04 +01:00
BOHA
5b56fc4dff chore: add vitest testing infrastructure
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:13:01 +01:00
BOHA
c0b8a94210 fix: resolve TypeScript compilation errors from service extraction
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:11:04 +01:00
BOHA
28eb58946f refactor: extract attendance business logic into attendance.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:06:40 +01:00
BOHA
0e9d30f5a8 refactor: extract orders business logic into orders.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:04:03 +01:00
BOHA
ba0e9617ad refactor: extract invoices business logic into invoices.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:04:02 +01:00
BOHA
89fa3128cf refactor: extract projects business logic into projects.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:03:32 +01:00
BOHA
dbf8749b37 refactor: extract users business logic into users.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:03:31 +01:00
BOHA
d26bbd8e7c refactor: extract offers business logic into offers.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:01:56 +01:00
BOHA
2146696bc6 refactor: extract numbering logic into numbering.service.ts
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 09:00:07 +01:00
BOHA
d2b22e9399 feat: add Zod validation schemas for all domain routes
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:57:38 +01:00
BOHA
a4303b0188 feat: add Zod validation for auth endpoints
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:49:54 +01:00
BOHA
7689b28d6d security: timing-safe auth to prevent username enumeration
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:48:13 +01:00
BOHA
333d1f7697 security: add request body size limits (1MB global, 10KB auth)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:47:59 +01:00
BOHA
8aa1d40ba1 security: add CSP (prod) and Permissions-Policy headers
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:47:16 +01:00
BOHA
9b2da944b1 security: add stricter rate limit on login endpoint (20/min)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:47:03 +01:00
BOHA
4608494a3f initial commit
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-23 08:46:51 +01:00