BOHA
519edce373
fix: 2026-06-09 full-codebase audit hardening
...
Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.
Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.
Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).
Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.
Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.
Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-09 06:45:26 +02:00
BOHA
2610301258
harden(plan): 92-day range cap + dedup user_ids on bulk create
2026-06-08 12:17:51 +02:00
BOHA
95ca258718
feat(plan): bulk entry creation endpoint + service
2026-06-08 12:03:47 +02:00
BOHA
23ac924472
fix(plan): edit/add the clicked record + layer-aware add in exception mode
...
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-08 11:29:52 +02:00
BOHA
72888bf9cd
feat(plan): resolveCell/resolveGrid return arrays; dashboard shows up to 3
...
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com >
2026-06-08 10:53:26 +02:00
BOHA
80dc8a5c69
feat(plan): per-cell record cap (3) + additive overrides
...
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com >
2026-06-08 10:46:40 +02:00
BOHA
f31797fb5b
fix(plan): allow empty notes, use local time for past-date gate
...
Three related fixes from manual smoke testing:
- Zod schema: drop min(1) on note field across all four schemas — note is
optional in real usage, and the modal initialized it to empty.
- assertNotPastDate: replace toISOString() (UTC) with local-time getters
to match the rest of the codebase. Fixes off-by-one near day boundaries.
- createEntry / updateEntry: also check the date_to endpoint for past
dates, so a range can't extend backwards into the past even when its
start is today or future. Defense in depth.
Modal: drop `required` attribute and asterisk from the note field. Tests:
add 5 new cases covering empty note, past date HTTP rejection, and the
new to-endpoint check in updateEntry.
2026-06-05 13:42:21 +02:00
BOHA
9c10ff9f22
test(plan): HTTP route tests with auth, scoping, and force flag
2026-06-05 12:51:20 +02:00
BOHA
ef404e4362
feat(plan): listEntries/listOverrides with employee scoping
2026-06-05 12:33:20 +02:00
BOHA
fb022802ae
feat(plan): override CRUD with replace-existing behavior
2026-06-05 12:30:27 +02:00
BOHA
795d4d5af9
feat(plan): entry CRUD with past-date lock and audit-data return
2026-06-05 12:19:21 +02:00
BOHA
74113035ae
feat(plan): assertNotPastDate guard for write paths
2026-06-05 12:15:39 +02:00
BOHA
42f9561337
feat(plan): listPlanUsers with role/permission filter
2026-06-05 12:13:16 +02:00
BOHA
f79967d433
feat(plan): resolveGrid for batch cell resolution
2026-06-05 12:10:30 +02:00
BOHA
0711bafac0
feat(plan): resolveCell with override-precedence semantics
2026-06-05 11:55:30 +02:00
