boha_admin/app - app - BOHA Automation Git

Author SHA1 Message Date

Author	SHA1	Message	Date
BOHA	1826fc7976	fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit (REVIEW_FINDINGS.md); each fix went through independent spec + code-quality review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md - attendance: schemas accept the combined local datetimes the forms/service use (new dateTimeString helpers in schemas/common.ts), breaks persist on create, AttendanceCreate submit rebuilt — every submit 400'd since `519edce` - 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity), enrollment QR generated locally via qrcode (CSP-blocked external service also leaked the secret), dashboard shows per-user enrollment, not policy - invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting coercion in formatters.ts), billing_text persists on update, issued-order status transitions update UI gates - trips: real pagination on all 3 pages, GET /trips/stats server aggregate (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on PUT with both-vehicle odometer recompute, print rebuilt (sync window.open, escaped template, server totals) - orders api: attachment_data PDF blob excluded from all non-binary reads - warehouse: unit field is a Select over UnitEnum, receipt attachments downloadable via new authenticated GET route - downloads: shared RFC 5987 contentDisposition helper — Czech filenames no longer 500 (warehouse, received-invoices, orders endpoints) - misc: block-env hook actually blocks (exit 2 + stderr), project create works with empty dates, NaN filter guards on trips endpoints - deps: remove unused concurrently (clears both critical advisories), pin @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without the Prisma 6 downgrade), drop deprecated @types stubs Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors - build OK Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>	2026-06-10 09:59:47 +02:00
BOHA	519edce373	fix: 2026-06-09 full-codebase audit hardening Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace the raw number\|string transform idiom across every schema (the root-cause NaN bug class); emailOrEmpty + lenient isoDateString/timeString. Security: roles privilege-escalation closed; refresh-token family revocation on reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices gross VAT on all paths; orders-pdf custom-items authz. Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse confirm/cancel, attendance lockUserRow); uniqueness checks moved into create transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO). Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted fields; dashboard invalidation gaps; stale-closure confirm bugs. Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier; tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes), isolated on app_test via .env.test with a hard-throw setup guard. Gates: tsc 0 \| build 0 \| vitest 247/247 \| eslint 0 errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-09 06:45:26 +02:00
BOHA	8c278be941	test: add regression tests for Critical+High FLAWS_REPORT fixes - Tests caught 2 real bugs: - Zod NaN bypass in orders/offers schemas (Number(v) \|\| fallback) - invoiceTotalWithVat using Number() on { toNumber() } objects - 7 new test files covering auth, env, exchange rates, NAS paths, schema NaN rejection, invoice VAT calculation, customer validation - 45 tests passing, build clean Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>	2026-04-24 11:04:20 +02:00

BOHA

1826fc7976

fix: audit fix pass #1 — all 19 verified HIGH findings + critical dep cleanup

Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

- attendance: schemas accept the combined local datetimes the forms/service
  use (new dateTimeString helpers in schemas/common.ts), breaks persist on
  create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
  enrollment QR generated locally via qrcode (CSP-blocked external service
  also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
  coercion in formatters.ts), billing_text persists on update, issued-order
  status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
  (shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
  PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
  escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
  downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
  longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
  works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
  @hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
  the Prisma 6 downgrade), drop deprecated @types stubs

Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

2026-06-10 09:59:47 +02:00

BOHA

519edce373

fix: 2026-06-09 full-codebase audit hardening

Validation: shared NaN-guarded Zod coercion helpers in schemas/common.ts replace
the raw number|string transform idiom across every schema (the root-cause NaN bug
class); emailOrEmpty + lenient isoDateString/timeString.

Security: roles privilege-escalation closed; refresh-token family revocation on
reuse; TOTP uses config params; read endpoints permission-guarded; received-invoices
gross VAT on all paths; orders-pdf custom-items authz.

Concurrency: $queryRaw SELECT...FOR UPDATE locks in ascending-id order (warehouse
confirm/cancel, attendance lockUserRow); uniqueness checks moved into create
transactions (TOCTOU -> 409); deterministic id tiebreak on second-precision
timestamp ordering (plan resolveCell/resolveGrid, warehouse FIFO).

Frontend: Rules-of-Hooks fixed across ~14 pages + PlanCellModal; UTC-date persisted
fields; dashboard invalidation gaps; stale-closure confirm bugs.

Tooling/tests: ESLint flat config (react-hooks/rules-of-hooks = error) + Prettier;
tsconfig.test.json so tsc -b type-checks the tests; removed 3 dead deps; npm audit
fix (8 -> 3). Suite 195 -> 247 (happy-path auth, FIFO oldest-first, flakiness fixes),
isolated on app_test via .env.test with a hard-throw setup guard.

Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

2026-06-09 06:45:26 +02:00

BOHA

8c278be941

test: add regression tests for Critical+High FLAWS_REPORT fixes

- Tests caught 2 real bugs:
  - Zod NaN bypass in orders/offers schemas (Number(v) || fallback)
  - invoiceTotalWithVat using Number() on { toNumber() } objects
- 7 new test files covering auth, env, exchange rates, NAS paths,
  schema NaN rejection, invoice VAT calculation, customer validation
- 45 tests passing, build clean

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>

2026-04-24 11:04:20 +02:00

3 Commits