d7c7fbad88
- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
for inactive/locked users, locked_until check in loadAuthData, TOTP
fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
numbering.service releaseSequence no-op, nas-offers filename sanitize,
Content-Disposition header injection fix, mojibake Czech strings
Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
106 lines
3.2 KiB
TypeScript
106 lines
3.2 KiB
TypeScript
import { z } from "zod";
|
|
|
|
const InvoiceItemSchema = z.object({
|
|
description: z.string().nullish(),
|
|
quantity: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => {
|
|
const n = Number(v);
|
|
if (isNaN(n) || n <= 0) throw new Error("Invalid quantity");
|
|
return n;
|
|
})
|
|
.optional()
|
|
.default(1),
|
|
unit: z.string().nullish(),
|
|
unit_price: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => {
|
|
const n = Number(v);
|
|
if (isNaN(n)) throw new Error("Invalid unit_price");
|
|
return n;
|
|
})
|
|
.optional()
|
|
.default(0),
|
|
vat_rate: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.optional()
|
|
.default(21.0),
|
|
position: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.optional(),
|
|
});
|
|
|
|
export const CreateInvoiceSchema = z.object({
|
|
invoice_number: z.string().nullish(),
|
|
order_id: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.nullish(),
|
|
customer_id: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.nullish(),
|
|
status: z.string().optional().default("issued"),
|
|
currency: z.string().optional().default("CZK"),
|
|
vat_rate: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.optional()
|
|
.default(21.0),
|
|
apply_vat: z
|
|
.preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
|
|
.optional()
|
|
.default(true),
|
|
payment_method: z.string().nullish(),
|
|
constant_symbol: z.string().nullish(),
|
|
bank_name: z.string().nullish(),
|
|
bank_swift: z.string().nullish(),
|
|
bank_iban: z.string().nullish(),
|
|
bank_account: z.string().nullish(),
|
|
issue_date: z.string().nullish(),
|
|
due_date: z.string().nullish(),
|
|
tax_date: z.string().nullish(),
|
|
issued_by: z.string().nullish(),
|
|
billing_text: z.string().nullish(),
|
|
language: z.string().optional().default("cs"),
|
|
notes: z.string().nullish(),
|
|
internal_notes: z.string().nullish(),
|
|
items: z.array(InvoiceItemSchema).optional(),
|
|
});
|
|
|
|
export const UpdateInvoiceSchema = z.object({
|
|
status: z.string().optional(),
|
|
currency: z.string().optional(),
|
|
language: z.string().optional(),
|
|
payment_method: z.string().nullish(),
|
|
constant_symbol: z.string().nullish(),
|
|
bank_name: z.string().nullish(),
|
|
bank_swift: z.string().nullish(),
|
|
bank_iban: z.string().nullish(),
|
|
bank_account: z.string().nullish(),
|
|
issued_by: z.string().nullish(),
|
|
customer_id: z
|
|
.union([z.number(), z.string(), z.null()])
|
|
.transform((v) => (v === null ? null : Number(v)))
|
|
.optional(),
|
|
vat_rate: z
|
|
.union([z.number(), z.string()])
|
|
.transform((v) => Number(v))
|
|
.optional(),
|
|
apply_vat: z
|
|
.preprocess((v) => v === true || v === 1 || v === "1", z.boolean())
|
|
.optional(),
|
|
issue_date: z.union([z.string(), z.null()]).optional(),
|
|
due_date: z.union([z.string(), z.null()]).optional(),
|
|
tax_date: z.union([z.string(), z.null()]).optional(),
|
|
notes: z.string().nullish(),
|
|
internal_notes: z.string().nullish(),
|
|
paid_date: z.union([z.string(), z.null()]).optional(),
|
|
items: z.array(InvoiceItemSchema).optional(),
|
|
});
|
|
|
|
export type CreateInvoiceInput = z.infer<typeof CreateInvoiceSchema>;
|
|
export type UpdateInvoiceInput = z.infer<typeof UpdateInvoiceSchema>;
|