12 Commits

Author SHA1 Message Date
BOHA
09a9e8c2f0 1.4.3 2026-04-02 11:13:30 +02:00
BOHA
b26a6f40b9 fix: invoice PDF shows unit next to quantity (e.g. 193,50 / ks)
Adjusted column widths to prevent header overlap.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-02 11:13:29 +02:00
BOHA
40cb5a4d76 1.4.2 2026-04-02 11:05:42 +02:00
BOHA
ecd97ae5a3 fix: bulk attendance fill creates holiday records instead of skipping
Holidays now get leave_type: "holiday" with 8h so they count in fund calculation.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-02 11:05:42 +02:00
BOHA
d14e97d7bd 1.4.1 2026-04-02 10:56:26 +02:00
BOHA
ef891f8e01 fix: bulk attendance fill — accept string user_ids, skip holidays
- Schema now accepts both string and number user_ids (frontend sends strings)
- Bulk fill now skips Czech public holidays in addition to weekends

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-04-02 10:56:25 +02:00
BOHA
96ba5d034f 1.4.0 2026-03-28 09:03:06 +01:00
BOHA
2402b7cbc8 fix: "Moje žádosti" page shows only current user's requests
Admins were seeing all requests on their own requests page.
Added mine=1 param to force user_id filter regardless of role.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 09:03:05 +01:00
BOHA
79b2fa5570 1.3.9 2026-03-28 08:56:14 +01:00
BOHA
35fa172d36 fix: trips admin shows only users with trips.record permission
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-28 08:56:14 +01:00
BOHA
000a77ccf4 1.3.8 2026-03-27 21:27:16 +01:00
BOHA
ecd9f6a181 chore: fix npm audit vulnerabilities (brace-expansion, fastify, nodemailer, picomatch)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-27 21:27:14 +01:00
9 changed files with 80 additions and 32 deletions

28
package-lock.json generated
View File

@@ -1,12 +1,12 @@
{ {
"name": "app-ts", "name": "app-ts",
"version": "1.3.7", "version": "1.4.3",
"lockfileVersion": 3, "lockfileVersion": 3,
"requires": true, "requires": true,
"packages": { "packages": {
"": { "": {
"name": "app-ts", "name": "app-ts",
"version": "1.3.7", "version": "1.4.3",
"license": "ISC", "license": "ISC",
"dependencies": { "dependencies": {
"@dnd-kit/core": "^6.3.1", "@dnd-kit/core": "^6.3.1",
@@ -2089,9 +2089,9 @@
} }
}, },
"node_modules/brace-expansion": { "node_modules/brace-expansion": {
"version": "5.0.4", "version": "5.0.5",
"resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.4.tgz", "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.5.tgz",
"integrity": "sha512-h+DEnpVvxmfVefa4jFbCf5HdH5YMDXRsmKflpf1pILZWRFlTbJpxeU55nJl4Smt5HQaGzg1o6RHFPJaOqnmBDg==", "integrity": "sha512-VZznLgtwhn+Mact9tfiwx64fA9erHH/MCXEUfB/0bX/6Fz6ny5EGTXYltMocqg4xFAQZtnO3DHWWXi8RiuN7cQ==",
"license": "MIT", "license": "MIT",
"dependencies": { "dependencies": {
"balanced-match": "^4.0.2" "balanced-match": "^4.0.2"
@@ -3086,9 +3086,9 @@
"license": "BSD-3-Clause" "license": "BSD-3-Clause"
}, },
"node_modules/fastify": { "node_modules/fastify": {
"version": "5.8.2", "version": "5.8.4",
"resolved": "https://registry.npmjs.org/fastify/-/fastify-5.8.2.tgz", "resolved": "https://registry.npmjs.org/fastify/-/fastify-5.8.4.tgz",
"integrity": "sha512-lZmt3navvZG915IE+f7/TIVamxIwmBd+OMB+O9WBzcpIwOo6F0LTh0sluoMFk5VkrKTvvrwIaoJPkir4Z+jtAg==", "integrity": "sha512-sa42J1xylbBAYUWALSBoyXKPDUvM3OoNOibIefA+Oha57FryXKKCZarA1iDntOCWp3O35voZLuDg2mdODXtPzQ==",
"funding": [ "funding": [
{ {
"type": "github", "type": "github",
@@ -4282,9 +4282,9 @@
"license": "MIT" "license": "MIT"
}, },
"node_modules/nodemailer": { "node_modules/nodemailer": {
"version": "8.0.2", "version": "8.0.4",
"resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.2.tgz", "resolved": "https://registry.npmjs.org/nodemailer/-/nodemailer-8.0.4.tgz",
"integrity": "sha512-zbj002pZAIkWQFxyAaqoxvn+zoIwRnS40hgjqTXudKOOJkiFFgBeNqjgD3/YCR12sZnrghWYBY+yP1ZucdDRpw==", "integrity": "sha512-k+jf6N8PfQJ0Fe8ZhJlgqU5qJU44Lpvp2yvidH3vp1lPnVQMgi4yEEMPXg5eJS1gFIJTVq1NHBk7Ia9ARdSBdQ==",
"license": "MIT-0", "license": "MIT-0",
"engines": { "engines": {
"node": ">=6.0.0" "node": ">=6.0.0"
@@ -4540,9 +4540,9 @@
"license": "ISC" "license": "ISC"
}, },
"node_modules/picomatch": { "node_modules/picomatch": {
"version": "4.0.3", "version": "4.0.4",
"resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.3.tgz", "resolved": "https://registry.npmjs.org/picomatch/-/picomatch-4.0.4.tgz",
"integrity": "sha512-5gTmgEY/sqK6gFXLIsQNH19lWb4ebPDLA4SdLP7dsWkIXHWlG66oPuVvXSGFPppYZz8ZDZq0dYYrbHfBCVUb1Q==", "integrity": "sha512-QP88BAKvMam/3NxH6vj2o21R6MjxZUAd6nlwAS/pnGvN9IVLocLHxGYIzFhg6fUQ+5th6P4dv4eW9jX3DSIj7A==",
"dev": true, "dev": true,
"license": "MIT", "license": "MIT",
"engines": { "engines": {

View File

@@ -1,6 +1,6 @@
{ {
"name": "app-ts", "name": "app-ts",
"version": "1.3.7", "version": "1.4.3",
"description": "", "description": "",
"main": "dist/server.js", "main": "dist/server.js",
"scripts": { "scripts": {

View File

@@ -61,7 +61,7 @@ export default function LeaveRequests() {
const fetchRequests = useCallback(async () => { const fetchRequests = useCallback(async () => {
try { try {
const response = await apiFetch(`${API_BASE}/leave-requests`); const response = await apiFetch(`${API_BASE}/leave-requests?mine=1`);
if (response.status === 401) return; if (response.status === 401) return;
const result = await response.json(); const result = await response.json();
if (result.success) { if (result.success) {

View File

@@ -127,7 +127,7 @@ export default function TripsAdmin() {
try { try {
const [vRes, uRes, csRes] = await Promise.all([ const [vRes, uRes, csRes] = await Promise.all([
apiFetch(`${API_BASE}/vehicles`), apiFetch(`${API_BASE}/vehicles`),
apiFetch(`${API_BASE}/users?limit=1000`), apiFetch(`${API_BASE}/trips/users`),
apiFetch(`${API_BASE}/company-settings`), apiFetch(`${API_BASE}/company-settings`),
]); ]);
const vJson = await vRes.json(); const vJson = await vRes.json();
@@ -136,14 +136,7 @@ export default function TripsAdmin() {
if (vJson.success) setVehicles(vJson.data); if (vJson.success) setVehicles(vJson.data);
if (csJson.success) setCompanyName(csJson.data.company_name || ""); if (csJson.success) setCompanyName(csJson.data.company_name || "");
if (uJson.success) { if (uJson.success) {
setUsers( setUsers(uJson.data);
uJson.data.map(
(u: { id: number; first_name: string; last_name: string }) => ({
id: u.id,
name: `${u.first_name} ${u.last_name}`,
}),
),
);
} }
} catch { } catch {
// silently fail, filters will just be empty // silently fail, filters will just be empty

View File

@@ -427,7 +427,7 @@ export default async function invoicesPdfRoutes(
return `<tr> return `<tr>
<td class="row-num">${i + 1}</td> <td class="row-num">${i + 1}</td>
<td class="desc">${escapeHtml(item.description)}</td> <td class="desc">${escapeHtml(item.description)}</td>
<td class="center">${formatNum(qty, qtyDecimals)}</td> <td class="center">${formatNum(qty, qtyDecimals)}${item.unit ? ` / ${escapeHtml(item.unit)}` : ""}</td>
<td class="right">${formatNum(unitPrice)}</td> <td class="right">${formatNum(unitPrice)}</td>
<td class="right">${formatNum(lineSubtotal)}</td> <td class="right">${formatNum(lineSubtotal)}</td>
<td class="center">${applyVat ? Math.floor(vatRate) : 0}%</td> <td class="center">${applyVat ? Math.floor(vatRate) : 0}%</td>
@@ -944,9 +944,9 @@ ${indentCSS}
<table class="items"> <table class="items">
<thead> <thead>
<tr> <tr>
<th class="center" style="width:5%">${escapeHtml(t.col_no)}</th> <th class="center" style="width:4%">${escapeHtml(t.col_no)}</th>
<th style="width:30%">${escapeHtml(t.col_desc)}</th> <th style="width:28%">${escapeHtml(t.col_desc)}</th>
<th class="center" style="width:9%">${escapeHtml(t.col_qty)}</th> <th class="center" style="width:12%">${escapeHtml(t.col_qty)}</th>
<th class="right" style="width:11%">${escapeHtml(t.col_unit_price)}</th> <th class="right" style="width:11%">${escapeHtml(t.col_unit_price)}</th>
<th class="right" style="width:11%">${escapeHtml(t.col_price)}</th> <th class="right" style="width:11%">${escapeHtml(t.col_price)}</th>
<th class="center" style="width:7%">${escapeHtml(t.col_vat_pct)}</th> <th class="center" style="width:7%">${escapeHtml(t.col_vat_pct)}</th>

View File

@@ -29,7 +29,7 @@ export default async function leaveRequestsRoutes(
const isAdmin = authData.permissions.includes("attendance.approve"); const isAdmin = authData.permissions.includes("attendance.approve");
const where: Record<string, unknown> = {}; const where: Record<string, unknown> = {};
if (!isAdmin) where.user_id = authData.userId; if (!isAdmin || query.mine === "1") where.user_id = authData.userId;
else if (query.user_id) where.user_id = Number(query.user_id); else if (query.user_id) where.user_id = Number(query.user_id);
if (query.status) where.status = String(query.status); if (query.status) where.status = String(query.status);

View File

@@ -66,6 +66,45 @@ export default async function tripsRoutes(
}); });
}); });
// GET /api/admin/trips/users — users with trips.record permission
fastify.get(
"/users",
{ preHandler: requireAuth },
async (_request, reply) => {
const users = await prisma.users.findMany({
where: {
is_active: true,
roles: {
is: {
OR: [
{ name: "admin" },
{
role_permissions: {
some: { permissions: { name: "trips.record" } },
},
},
],
},
},
},
select: {
id: true,
first_name: true,
last_name: true,
username: true,
},
orderBy: { last_name: "asc" },
});
return success(
reply,
users.map((u) => ({
id: u.id,
name: `${u.first_name} ${u.last_name}`.trim() || u.username,
})),
);
},
);
// GET /api/admin/trips/print — print data for trip report // GET /api/admin/trips/print — print data for trip report
fastify.get( fastify.get(
"/print", "/print",

View File

@@ -39,7 +39,9 @@ export const AttendanceBalancesSchema = z.object({
export const AttendanceBulkSchema = z.object({ export const AttendanceBulkSchema = z.object({
month: z.string().regex(/^\d{4}-\d{2}$/, "Měsíc je povinný (formát YYYY-MM)"), month: z.string().regex(/^\d{4}-\d{2}$/, "Měsíc je povinný (formát YYYY-MM)"),
user_ids: z.array(z.number()).min(1, "Vyberte alespoň jednoho zaměstnance"), user_ids: z
.array(z.union([z.number(), z.string()]).transform((v) => Number(v)))
.min(1, "Vyberte alespoň jednoho zaměstnance"),
arrival_time: z.string().optional().default("08:00"), arrival_time: z.string().optional().default("08:00"),
departure_time: z.string().optional().default("16:30"), departure_time: z.string().optional().default("16:30"),
break_start_time: z.string().optional().default("12:00"), break_start_time: z.string().optional().default("12:00"),

View File

@@ -1,6 +1,6 @@
import { attendance_leave_type, Prisma } from "@prisma/client"; import { attendance_leave_type, Prisma } from "@prisma/client";
import prisma from "../config/database"; import prisma from "../config/database";
import { getBusinessDaysInMonth } from "../utils/czech-holidays"; import { getBusinessDaysInMonth, isHoliday } from "../utils/czech-holidays";
import { localDateStr } from "../utils/date"; import { localDateStr } from "../utils/date";
import { getSystemSettings } from "./system-settings"; import { getSystemSettings } from "./system-settings";
@@ -1094,6 +1094,20 @@ export async function bulkCreateAttendance(data: BulkAttendanceData) {
} }
const shiftDate = new Date(Date.UTC(yr, mo - 1, day, 12, 0, 0)); const shiftDate = new Date(Date.UTC(yr, mo - 1, day, 12, 0, 0));
if (isHoliday(dateStr)) {
await prisma.attendance.create({
data: {
user_id: userId,
shift_date: shiftDate,
leave_type: "holiday",
leave_hours: 8,
},
});
inserted++;
continue;
}
await prisma.attendance.create({ await prisma.attendance.create({
data: { data: {
user_id: userId, user_id: userId,