1826fc7976
Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md
- attendance: schemas accept the combined local datetimes the forms/service
use (new dateTimeString helpers in schemas/common.ts), breaks persist on
create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
enrollment QR generated locally via qrcode (CSP-blocked external service
also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
coercion in formatters.ts), billing_text persists on update, issued-order
status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
(shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
@hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
the Prisma 6 downgrade), drop deprecated @types stubs
Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
103 lines
2.9 KiB
JSON
103 lines
2.9 KiB
JSON
{
|
|
"name": "app-ts",
|
|
"version": "2.2.0",
|
|
"description": "",
|
|
"main": "dist/server.js",
|
|
"scripts": {
|
|
"dev:server": "tsx watch src/server.ts",
|
|
"dev:client": "vite",
|
|
"dev": "tsx watch src/server.ts",
|
|
"build:server": "tsc -p tsconfig.server.json",
|
|
"build:client": "vite build",
|
|
"build": "npm run build:server && npm run build:client",
|
|
"start": "node dist/server.js",
|
|
"preview": "vite preview",
|
|
"db:generate": "prisma generate",
|
|
"db:pull": "prisma db pull",
|
|
"db:push": "prisma db push",
|
|
"db:studio": "prisma studio",
|
|
"test": "vitest run",
|
|
"test:watch": "vitest",
|
|
"seed": "tsx prisma/seed.ts",
|
|
"typecheck": "tsc -b --noEmit",
|
|
"lint": "eslint .",
|
|
"lint:fix": "eslint . --fix",
|
|
"format": "prettier --write .",
|
|
"format:check": "prettier --check ."
|
|
},
|
|
"keywords": [],
|
|
"author": "",
|
|
"license": "ISC",
|
|
"type": "commonjs",
|
|
"dependencies": {
|
|
"@anthropic-ai/sdk": "^0.102.0",
|
|
"@dnd-kit/core": "^6.3.1",
|
|
"@dnd-kit/modifiers": "^9.0.0",
|
|
"@dnd-kit/sortable": "^10.0.0",
|
|
"@dnd-kit/utilities": "^3.2.2",
|
|
"@emotion/react": "^11.14.0",
|
|
"@emotion/styled": "^11.14.1",
|
|
"@fastify/cookie": "^11.0.2",
|
|
"@fastify/cors": "^11.2.0",
|
|
"@fastify/multipart": "^9.4.0",
|
|
"@fastify/rate-limit": "^10.3.0",
|
|
"@fastify/static": "^9.0.0",
|
|
"@mui/material": "^7.3.11",
|
|
"@mui/x-date-pickers": "^8.29.0",
|
|
"@prisma/adapter-mariadb": "^7.8.0",
|
|
"@prisma/client": "^7.8.0",
|
|
"@tanstack/react-query": "^5.100.5",
|
|
"bcryptjs": "^3.0.3",
|
|
"date-fns": "^4.1.0",
|
|
"dompurify": "^3.3.3",
|
|
"dotenv": "^17.3.1",
|
|
"fastify": "^5.8.2",
|
|
"file-type": "^22.0.1",
|
|
"framer-motion": "^12.38.0",
|
|
"jsdom": "^29.0.2",
|
|
"jsonwebtoken": "^9.0.3",
|
|
"leaflet": "^1.9.4",
|
|
"mariadb": "^3.5.2",
|
|
"node-cron": "^4.2.1",
|
|
"nodemailer": "^8.0.2",
|
|
"otpauth": "^9.5.0",
|
|
"prisma": "^7.8.0",
|
|
"puppeteer": "^24.40.0",
|
|
"qrcode": "^1.5.4",
|
|
"react": "^19.2.7",
|
|
"react-dom": "^19.2.7",
|
|
"react-quill-new": "^3.8.3",
|
|
"react-router-dom": "^6.30.3",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@eslint/js": "^10.0.1",
|
|
"@types/jsdom": "^28.0.1",
|
|
"@types/jsonwebtoken": "^9.0.10",
|
|
"@types/leaflet": "^1.9.21",
|
|
"@types/node": "^25.5.0",
|
|
"@types/node-cron": "^3.0.11",
|
|
"@types/nodemailer": "^7.0.11",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@types/react": "^19.2.17",
|
|
"@types/react-dom": "^19.2.3",
|
|
"@types/supertest": "^7.2.0",
|
|
"@vitejs/plugin-react": "^6.0.1",
|
|
"eslint": "^10.4.1",
|
|
"eslint-config-prettier": "^10.1.8",
|
|
"eslint-plugin-react-hooks": "^7.1.1",
|
|
"eslint-plugin-react-refresh": "^0.5.2",
|
|
"globals": "^17.6.0",
|
|
"prettier": "^3.8.3",
|
|
"supertest": "^7.2.2",
|
|
"tsx": "^4.21.0",
|
|
"typescript": "^5.9.3",
|
|
"typescript-eslint": "^8.61.0",
|
|
"vite": "^8.0.0",
|
|
"vitest": "^4.1.0"
|
|
},
|
|
"overrides": {
|
|
"@hono/node-server": "^1.19.13"
|
|
}
|
|
}
|