1914fddb4d
file-type 16 -> 22 fixes GHSA-5v7r-6r5c-r473 (infinite loop in the ASF parser on
malformed input). v22 is ESM-only with a strict `exports` map, so the CommonJS
server can no longer `require()` it (and tsc would down-level a normal dynamic
import() back to require()). Converted the single call site in
nas-file-manager.ts to a cached runtime dynamic ESM import via the
Function('return import("file-type")') indirection (the same pattern server.ts
already uses for Vite), and updated the API to the v22 named export
`fileTypeFromBuffer` (was the v16 default `FileType.fromBuffer`).
Verified at runtime that the dynamic import loads v22 from CJS and detects
PNG/JPEG/PDF correctly. `npm audit` no longer lists file-type (6 -> 5 vulns; the
rest are quill [Phase 4] and Prisma 7's dev-tooling @hono/node-server).
Gates: tsc 0 | build 0 | vitest 247/247 | eslint 0 errors.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
boha-app-ts
Internal business-management system for a Czech company (attendance, invoicing, leave/trips, projects, vehicles, warehouse, HR) — a TypeScript/Node.js rewrite of the legacy PHP app. User-facing text is Czech by design.
For full architecture, conventions, and gotchas, see CLAUDE.md.
Stack
- Backend: Fastify 5 · Prisma 6 → MySQL · Zod 4 · JWT (HS256) + TOTP 2FA
- Frontend: React 18 · Vite · Material UI v7 (Emotion) · TanStack Query — an
SPA in
src/admin/, served by the same Fastify process (Vite middleware in dev, static files in prod) - Other: Puppeteer (PDF) · nodemailer · node-cron ·
@anthropic-ai/sdk(the admins-only "Odin" assistant)
Prerequisites
- Node.js (LTS) and a MySQL database
- Copy
.env.example→.envand fill in the required vars (DATABASE_URL,JWT_SECRET,TOTP_ENCRYPTION_KEY— generate the keys withopenssl rand -hex 32)
Setup
npm install
npx prisma generate
npx prisma migrate dev # apply migrations to your dev DB
npx prisma db seed # optional: dev-only sample data (NEVER on prod)
Develop
npm run dev:server # API (tsx watch) on http://127.0.0.1:3050
npm run dev:client # Vite dev server (manage separately)
Build & run
npm run build # tsc server → dist/ + vite client → dist-client/
npm start # node dist/server.js
Test
npm test # vitest run — hits a real test DB (.env.test); no Prisma mocks
Quality gates
Before committing, all of these must pass:
npx tsc -b --noEmit # typecheck (NOT `tsc -p tsconfig.json`)
npm run build
npx vitest run
npm run lint # ESLint (incl. react-hooks) — see eslint.config.js
Database migrations
Every schema/data change is a tracked Prisma migration — never prisma db push
or raw SQL on production. Stop the dev server before running prisma migrate dev.
See CLAUDE.md → Database Migrations for the full workflow and the production
deploy/hotfix process.
License
ISC