1826fc7976
Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md
- attendance: schemas accept the combined local datetimes the forms/service
use (new dateTimeString helpers in schemas/common.ts), breaks persist on
create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
enrollment QR generated locally via qrcode (CSP-blocked external service
also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
coercion in formatters.ts), billing_text persists on update, issued-order
status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
(shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
@hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
the Prisma 6 downgrade), drop deprecated @types stubs
Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
boha-app-ts
Internal business-management system for a Czech company (attendance, invoicing, leave/trips, projects, vehicles, warehouse, HR) — a TypeScript/Node.js rewrite of the legacy PHP app. User-facing text is Czech by design.
For full architecture, conventions, and gotchas, see CLAUDE.md.
Stack
- Backend: Fastify 5 · Prisma 6 → MySQL · Zod 4 · JWT (HS256) + TOTP 2FA
- Frontend: React 18 · Vite · Material UI v7 (Emotion) · TanStack Query — an
SPA in
src/admin/, served by the same Fastify process (Vite middleware in dev, static files in prod) - Other: Puppeteer (PDF) · nodemailer · node-cron ·
@anthropic-ai/sdk(the admins-only "Odin" assistant)
Prerequisites
- Node.js (LTS) and a MySQL database
- Copy
.env.example→.envand fill in the required vars (DATABASE_URL,JWT_SECRET,TOTP_ENCRYPTION_KEY— generate the keys withopenssl rand -hex 32)
Setup
npm install
npx prisma generate
npx prisma migrate dev # apply migrations to your dev DB
npx prisma db seed # optional: dev-only sample data (NEVER on prod)
Develop
npm run dev:server # API (tsx watch) on http://127.0.0.1:3050
npm run dev:client # Vite dev server (manage separately)
Build & run
npm run build # tsc server → dist/ + vite client → dist-client/
npm start # node dist/server.js
Test
npm test # vitest run — hits a real test DB (.env.test); no Prisma mocks
Quality gates
Before committing, all of these must pass:
npx tsc -b --noEmit # typecheck (NOT `tsc -p tsconfig.json`)
npm run build
npx vitest run
npm run lint # ESLint (incl. react-hooks) — see eslint.config.js
Database migrations
Every schema/data change is a tracked Prisma migration — never prisma db push
or raw SQL on production. Stop the dev server before running prisma migrate dev.
See CLAUDE.md → Database Migrations for the full workflow and the production
deploy/hotfix process.
License
ISC