Fixes every CRITICAL/HIGH finding from the 2026-06-09 full-codebase audit
(REVIEW_FINDINGS.md); each fix went through independent spec + code-quality
review. Plan and per-task log: docs/superpowers/plans/2026-06-10-audit-high-fix-pass.md
- attendance: schemas accept the combined local datetimes the forms/service
use (new dateTimeString helpers in schemas/common.ts), breaks persist on
create, AttendanceCreate submit rebuilt — every submit 400'd since 519edce
- 2fa: backup codes wired to /totp/backup-verify (+ remember-me parity),
enrollment QR generated locally via qrcode (CSP-blocked external service
also leaked the secret), dashboard shows per-user enrollment, not policy
- invoices/orders: per-line VAT survives re-saves (numberOr 0-respecting
coercion in formatters.ts), billing_text persists on update, issued-order
status transitions update UI gates
- trips: real pagination on all 3 pages, GET /trips/stats server aggregate
(shared buildTripsWhere + legacy distance coalesce), vehicle_id applies on
PUT with both-vehicle odometer recompute, print rebuilt (sync window.open,
escaped template, server totals)
- orders api: attachment_data PDF blob excluded from all non-binary reads
- warehouse: unit field is a Select over UnitEnum, receipt attachments
downloadable via new authenticated GET route
- downloads: shared RFC 5987 contentDisposition helper — Czech filenames no
longer 500 (warehouse, received-invoices, orders endpoints)
- misc: block-env hook actually blocks (exit 2 + stderr), project create
works with empty dates, NaN filter guards on trips endpoints
- deps: remove unused concurrently (clears both critical advisories), pin
@hono/node-server >=1.19.13 via overrides (clears the 3 moderates without
the Prisma 6 downgrade), drop deprecated @types stubs
Gates: tsc -b clean - vitest 30 files / 342 tests (31 new) - eslint 0 errors
- build OK
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
157 lines
4.3 KiB
TypeScript
157 lines
4.3 KiB
TypeScript
import { queryOptions } from "@tanstack/react-query";
|
|
import { jsonQuery, paginatedJsonQuery } from "../apiAdapter";
|
|
|
|
export interface TripVehicle {
|
|
id: number;
|
|
spz: string;
|
|
name: string;
|
|
}
|
|
|
|
export interface TripUser {
|
|
id: number;
|
|
name: string;
|
|
}
|
|
|
|
export interface BackendTrip {
|
|
id: number;
|
|
vehicle_id: number;
|
|
user_id: number;
|
|
trip_date: string;
|
|
start_km: number;
|
|
end_km: number;
|
|
distance: number | null;
|
|
route_from: string;
|
|
route_to: string;
|
|
is_business: boolean;
|
|
notes: string | null;
|
|
users: { id: number; first_name: string; last_name: string };
|
|
vehicles: { id: number; name: string; spz: string };
|
|
}
|
|
|
|
export const tripListOptions = (filters: {
|
|
month?: number;
|
|
year?: number;
|
|
vehicleId?: number;
|
|
userId?: number;
|
|
page?: number;
|
|
perPage?: number;
|
|
}) =>
|
|
queryOptions({
|
|
queryKey: [
|
|
"trips",
|
|
"list",
|
|
{
|
|
month: filters.month,
|
|
year: filters.year,
|
|
vehicleId: filters.vehicleId,
|
|
userId: filters.userId,
|
|
page: filters.page,
|
|
perPage: filters.perPage,
|
|
},
|
|
],
|
|
queryFn: () => {
|
|
const params = new URLSearchParams();
|
|
if (filters.month) params.set("month", String(filters.month));
|
|
if (filters.year) params.set("year", String(filters.year));
|
|
if (filters.vehicleId)
|
|
params.set("vehicle_id", String(filters.vehicleId));
|
|
if (filters.userId) params.set("user_id", String(filters.userId));
|
|
if (filters.page) params.set("page", String(filters.page));
|
|
if (filters.perPage) params.set("per_page", String(filters.perPage));
|
|
const qs = params.toString();
|
|
return paginatedJsonQuery<BackendTrip>(
|
|
`/api/admin/trips${qs ? `?${qs}` : ""}`,
|
|
);
|
|
},
|
|
});
|
|
|
|
export const tripVehiclesOptions = () =>
|
|
queryOptions({
|
|
queryKey: ["trips", "vehicles"],
|
|
queryFn: () => jsonQuery<TripVehicle[]>("/api/admin/vehicles"),
|
|
staleTime: 2 * 60_000,
|
|
});
|
|
|
|
export const tripUsersOptions = () =>
|
|
queryOptions({
|
|
queryKey: ["trips", "users"],
|
|
queryFn: () => jsonQuery<TripUser[]>("/api/admin/trips/users"),
|
|
staleTime: 2 * 60_000,
|
|
});
|
|
|
|
export const tripHistoryOptions = (filters: {
|
|
month?: string;
|
|
vehicleId?: number;
|
|
userId?: number;
|
|
page?: number;
|
|
perPage?: number;
|
|
}) =>
|
|
queryOptions({
|
|
queryKey: [
|
|
"trips",
|
|
"history",
|
|
{
|
|
month: filters.month,
|
|
vehicleId: filters.vehicleId,
|
|
userId: filters.userId,
|
|
page: filters.page,
|
|
perPage: filters.perPage,
|
|
},
|
|
],
|
|
queryFn: () => {
|
|
const params = new URLSearchParams();
|
|
if (filters.month) params.set("month", filters.month);
|
|
if (filters.vehicleId)
|
|
params.set("vehicle_id", String(filters.vehicleId));
|
|
if (filters.userId) params.set("user_id", String(filters.userId));
|
|
if (filters.page) params.set("page", String(filters.page));
|
|
if (filters.perPage) params.set("per_page", String(filters.perPage));
|
|
const qs = params.toString();
|
|
return paginatedJsonQuery<BackendTrip>(
|
|
`/api/admin/trips${qs ? `?${qs}` : ""}`,
|
|
);
|
|
},
|
|
});
|
|
|
|
export interface TripStats {
|
|
count: number;
|
|
total_km: number;
|
|
business_km: number;
|
|
private_km: number;
|
|
}
|
|
|
|
// Count/km totals over the WHOLE filtered set (not one page) — hits
|
|
// /trips/stats with the same filters the lists use. `month` accepts either a
|
|
// numeric month (paired with `year`, TripsAdmin style) or a combined
|
|
// "YYYY-MM" string (TripsHistory style); the server supports both.
|
|
export const tripStatsOptions = (filters: {
|
|
month?: number | string;
|
|
year?: number;
|
|
vehicleId?: number;
|
|
userId?: number;
|
|
}) =>
|
|
queryOptions({
|
|
queryKey: [
|
|
"trips",
|
|
"stats",
|
|
{
|
|
month: filters.month,
|
|
year: filters.year,
|
|
vehicleId: filters.vehicleId,
|
|
userId: filters.userId,
|
|
},
|
|
],
|
|
queryFn: () => {
|
|
const params = new URLSearchParams();
|
|
if (filters.month) params.set("month", String(filters.month));
|
|
if (filters.year) params.set("year", String(filters.year));
|
|
if (filters.vehicleId)
|
|
params.set("vehicle_id", String(filters.vehicleId));
|
|
if (filters.userId) params.set("user_id", String(filters.userId));
|
|
const qs = params.toString();
|
|
return jsonQuery<TripStats>(
|
|
`/api/admin/trips/stats${qs ? `?${qs}` : ""}`,
|
|
);
|
|
},
|
|
});
|