app/docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md

2026-06-10 — Audit fix pass #1: all verified CRITICAL/HIGH findings

Source: REVIEW_FINDINGS.md (2026-06-09 full audit, 304 files). Scope of this pass: the 19 verified per-file HIGH findings + the project-level CRITICAL dependency finding. The two project-level HIGH structural refactors (service-layer extraction for 6 route files; PDF template dedup) are explicitly out of scope — they are multi-thousand-line refactors that deserve their own pass.

Execution: subagent-driven development — one implementer per task (sequential, shared test DB forbids parallel test runs), spec-compliance review then code-quality review after each. No commits until the user asks. Final full gates: npx tsc -b --noEmit · npx vitest run · npm run lint · npm run build.

---

Task H — Dependencies (project-level CRITICAL) — done inline by controller

• Remove concurrently from devDependencies (unused; carries both critical advisories GHSA-w7jw-789q-3m8p / shell-quote CVSS 8.1).
• Add "overrides": { "@hono/node-server": "^1.19.13" } (clears the 3 moderate advisories from the prisma → @prisma/dev chain; do NOT take npm's Prisma 6 downgrade).
• Remove deprecated stub types @types/dompurify, @types/bcryptjs; move @types/jsdom to devDependencies.
• Add qrcode + @types/qrcode (needed by Task B to replace the CSP-blocked external QR service).
• npm install, verify npm audit (criticals+moderates gone), typecheck.

Task A — Attendance create/edit broken since 519edce (top-5 #1)

Findings (both verified HIGH):

• src/admin/pages/AttendanceCreate.tsx:80-99 — handleSubmit posts the raw form whose shape the API does not accept: arrival_date/break_start_date/break_start_time/ break_end_*/departure_date are not in CreateAttendanceSchema (silently stripped — breaks and overnight dates never save); times are never combined with dates (unlike useAttendanceAdmin's combineDatetime), so a validated "HH:MM" would reach createAttendance which does new Date('08:00') → Invalid Date → 500; and since commit 519edce the always-sent empty-string time fields (arrival_time: "") fail timeString validation, so EVERY submit from this page — including leave records — returns 400.
• src/admin/pages/AttendanceAdmin.tsx:407-442 (logic in useAttendanceAdmin.ts) — create/edit modal submits send combined YYYY-MM-DDTHH:MM:00 datetimes for arrival/departure/break, but since 519edce CreateAttendanceSchema/UpdateAttendanceSchema validate them with timeString (HH:MM only) — every create/edit containing a time is rejected 400 "Čas musí být ve formátu HH:MM" (and the service itself expects full datetimes via new Date(...)); additionally break_start/break_end are absent from CreateAttendanceSchema, so breaks are silently stripped on create.

Direction: first git show 519edce to understand the intent; the schema contradicts both client and service, so the fix is to make the schemas validate the combined local-datetime wire format the client sends and the service consumes (lenient helper in src/schemas/common.ts per repo convention), add break_start/break_end to the create schema, and rewrite AttendanceCreate.tsx's submit to combine date+time and omit empty optionals. TDD: route-level regression tests (work record with times+breaks, overnight, leave record without times, update) in src/__tests__/.

Task B — 2FA: backup-code login, enrollment QR, dashboard status (top-5 #2)

Findings (all verified HIGH):

• src/admin/context/AuthContext.tsx:263-272 — backup-code login broken: verify2FA always POSTs to /login/totp with the code as totp_code plus an isBackup flag the server ignores; TotpVerifySchema requires exactly 6 digits so 8-char backup codes always 400. The real endpoint POST /api/admin/totp/backup-verify (expects backup_code) is never called anywhere in the frontend — lockout for any user who lost their authenticator.
• src/admin/components/dashboard/DashProfile.tsx:556 — QR <img> from api.qrserver.com is blocked by the production CSP (img-src 'self' data: blob: + osm tiles), so prod 2FA enrollment shows a broken image. (Also a privacy bug: the TOTP secret is sent to a third-party URL.) Fix: generate the QR locally with the qrcode package (QRCode.toDataURL(otpauthUrl)) — data: is already CSP-allowed.
• src/admin/pages/Dashboard.tsx:89-91 — totpEnabled derived from require2FAOptions() which returns the COMPANY-WIDE require_2fa policy flag, not the user's enrollment; the per-user endpoint (totp.ts:190-197) is never queried. Wrong "2FA Aktivní/Neaktivní" and wrong button shown.

Direction: read src/routes/admin/totp.ts first; wire Login/AuthContext so a backup code goes to backup-verify and completes the login-token flow. If the server endpoint doesn't fit the loginToken flow, extend it minimally (single-use code consumption + logAudit preserved). Server test for backup-verify login path if server is touched.

Task C — Invoice/issued-order edit integrity (top-5 #3)

Findings (all verified HIGH):

• src/admin/pages/InvoiceDetail.tsx:728 — edit hydration overwrites each item's persisted per-line VAT with the invoice-level rate (vat_rate: Number(inv.vat_rate) || 21) though invoice_items.vat_rate is a real per-item column — re-saving a mixed-rate invoice silently corrupts per-line VAT in the DB; || 21 also turns legitimate 0% into 21% (same falsy-zero at line 689).
• src/admin/pages/InvoiceDetail.tsx:1891-1902 — editing "Text fakturace (na PDF)" is silently lost: payload includes billing_text but UpdateInvoiceSchema (src/schemas/invoices.schema.ts:46-67) has no billing_text field, so Zod strips it (updateInvoice supports it via strFields). Add the field to the schema + server test.
• src/admin/pages/IssuedOrderDetail.tsx:606-611 — hydration falsy-fallbacks: quantity: Number(it.quantity) || 1 turns saved 0 into 1; vat_rate: Number(it.vat_rate) || Number(d.vat_rate) || 21 turns a saved 0% line into 21% — displayed wrong and silently persisted on next save.
• src/admin/pages/IssuedOrderDetail.tsx:826-839 — handleStatusChange never mirrors the new status into form.status, so StatusChip, the editable flag and the delete-button gate use the stale status after every transition.

Use Number.isFinite-style coercion that respects 0 (e.g. const n = Number(x); Number.isFinite(n) ? n : fallback).

Task D — Trips: truncated lists/totals + dropped vehicle edit (top-5 #4a)

Findings (all verified HIGH):

• src/admin/lib/queries/trips.ts:52-63 — tripListOptions consumes the paginated endpoint via plain jsonQuery, discarding pagination meta; Trips.tsx uses default limit 25 and TripsAdmin perPage:100 (server hard cap) — both silently truncate with no pagination controls.
• src/admin/lib/queries/trips.ts:95-103 — tripHistoryOptions sends no page/per_page → 25 rows; TripsHistory.tsx computes monthly km/business totals from the truncated rows.
• src/admin/pages/Trips.tsx:324-336 — stat cards computed from the 25-row page; header labels stats "current month" though the query has no month filter.
• src/admin/pages/TripsAdmin.tsx:295,665-676 — edit modal sends vehicle_id but UpdateTripSchema (src/schemas/trips.schema.ts:23-31) has no vehicle_id and the PUT handler never applies it — vehicle change silently dropped. Add to schema (nullableIntIdFromForm) + apply in route + audit + server test.
• src/admin/pages/TripsHistory.tsx:98-104,121-128 — same 25-row truncation for the month view and its stat cards.

Direction for totals: prefer a server-side aggregate (the repo already has per-currency totals endpoints for invoices/orders as the pattern) over fetching all pages client-side; lists get real pagination using the existing usePaginatedQuery/Pagination kit pieces used elsewhere. Keep the month-filter semantics of TripsHistory correct (totals must cover the WHOLE month, not one page).

Task E — orders.service.ts: PDF blob in every response (top-5 #4b)

Finding (verified HIGH): src/services/orders.service.ts:154-176,196-216,228-263,570,683 — attachment_data (full PDF blob, Bytes) is fetched on every query with no select/omit and spread into API responses by enrichOrder/getOrder; getOrderTotals loads every blob for the whole filtered set just to sum totals; updateOrder/deleteOrder pre-reads pull the blob to check status/number. A dedicated /:id/attachment endpoint already exists. Exclude the blob from list/detail/totals/pre-reads (keep has_attachment-style boolean if the FE needs it — check FE usage), keep the attachment endpoint working, extend src/__tests__/orders-list.test.ts to assert attachment_data is absent.

Task F — Warehouse: unit enum 400s + dead attachment download

Findings (both verified HIGH):

• src/admin/pages/WarehouseItemDetail.tsx:451-462 — "Jednotka" is free-text but the server requires UnitEnum ("ks","m","kg","bal","sada","m2","m3","l") — any other value 400s create/update. Make it a Select over the enum values (single source: mirror the server enum list).
• src/admin/pages/WarehouseReceiptDetail.tsx:251-259 — attachment link targets GET /warehouse/receipts/:id/attachments/:attachmentId which does not exist (only POST upload + DELETE are registered in warehouse.ts), and a plain sends no Authorization header anyway. Add the GET download route (requirePermission, correct content-type/disposition) + authenticated blob download in the UI (fetch via apiFetch → object URL, like other binary downloads in the repo). Server test for the new route.

Task G — Small fixes

• .claude/hooks/block-env.js:10-11 (verified HIGH) — block decision never takes effect: prints {decision:'block'} JSON to stdout then exits 1; Claude Code only parses stdout JSON on exit 0 and only blocks on exit 2 (reason on stderr). Fix: exit 2 with the reason on stderr.
• src/admin/pages/Projects.tsx:153-154 (verified HIGH) — create modal submits start_date/end_date initialized to "" which isoDateString.nullish() rejects → creating a project without filling BOTH dates always 400s. Send null/omit when empty.

---

Status

• H — dependencies (controller, inline) — criticals+moderates cleared; only the 2 known-mitigated quill lows remain
• A — attendance create/edit — dateTimeString helpers, break fields, rewritten AttendanceCreate payload; 6 regression tests
• B — 2FA — backup-verify wired (+ remember-me parity server-side), local QR via qrcode lib, per-user totp status; 6 tests
• C — invoice/issued-order edit integrity — numberOr (shared in formatters.ts), billing_text in UpdateInvoiceSchema, status mirror; 2 tests
• D — trips — paginated queries + Pagination UI on 3 pages, GET /trips/stats (buildTripsWhere shared), vehicle_id on PUT + both-vehicle odometer recompute, print rebuilt (sync window.open, escaped string template); 7 tests
• E — orders attachment_data excluded from all non-binary reads (incl. numbering/invoices/orders-pdf callers); 4 tests
• F — warehouse unit Select + GET receipt attachment route + authenticated blob download; RFC 5987 content-disposition helper (also fixes received-invoices + orders Czech-filename 500); 6 tests
• G — block-env hook exit 2/stderr (verified empirically), Projects empty dates → null
• Final gates: tsc -b clean · vitest 30 files / 342 tests green · lint 0 errors · build OK. Whole-diff 3-lens review: see final report.