Files
app/src/services/nas-offers-manager.ts
BOHA d7c7fbad88 fix: security, validation, and data integrity fixes across 53 files
- Auth: HS256 algorithm restriction on JWT verify, timing-safe bcrypt
  for inactive/locked users, locked_until check in loadAuthData, TOTP
  fixes (async bcrypt, BigInt conversion, future-code counter fix)
- Validation: Zod enums for leave_type/status, numeric transforms on
  foreign keys, VAT 0% coercion fix (Number(v)||21 → v!=null checks)
- Permissions: requirePermission on attendance PUT, attendance_users
  and project_logs access checks, trips users filtered by trips.record
- Prisma queries: fixed roles.is:{OR} pattern (doesn't work on to-one
  relations), attendance_users now filters by attendance.record only
- Transactions: wrapped deleteOrder, createOrder, updateUser, deleteUser,
  duplicateOffer, bulkCreateAttendance, createLeave, scope-templates,
  leave-requests, company-settings, profile updates
- Frontend: mountedRef reset in useListData, blob URL cleanup on unmount,
  null checks on date fields, AdminDatePicker min/max for HH:mm
- Security headers: COOP, CORP, CSP frame-ancestors/form-action/base-uri
- Other: exchange-rate cache TTL, invoice-alert midnight comparison fix,
  numbering.service releaseSequence no-op, nas-offers filename sanitize,
  Content-Disposition header injection fix, mojibake Czech strings

Co-Authored-By: Claude Opus 4.7 <noreply@anthropic.com>
2026-04-28 08:40:38 +02:00

149 lines
4.3 KiB
TypeScript

import fs from "fs";
import path from "path";
import { config } from "../config/env";
/**
* NAS storage for offers/quotations.
* Structure: {basePath}/{YYYY}/{prefix_seq}/{year_prefix_seq}.pdf
* The env path (NAS_OFFERS_PATH) should point directly to the Nabídky folder.
*/
class NasOffersManager {
private readonly basePath: string;
constructor() {
const raw = config.nas.offersPath;
this.basePath = raw ? path.resolve(raw).replace(/\\/g, "/") : "";
}
isConfigured(): boolean {
if (!this.basePath) return false;
try {
fs.mkdirSync(this.basePath, { recursive: true });
return fs.statSync(this.basePath).isDirectory();
} catch {
return false;
}
}
saveOfferPdf(
quotationNumber: string,
year: number,
pdfBuffer: Buffer,
): string | null {
const { prefix, seq } = this.parseParts(quotationNumber);
const folderName = this.sanitizeFilename(`${prefix}_${seq}`);
const fileName = this.sanitizeFilename(`${year}_${prefix}_${seq}`) + ".pdf";
const dir = this.ensureDir(year, folderName);
if (!dir) return null;
const fullPath = path.join(dir, fileName);
try {
fs.writeFileSync(fullPath, pdfBuffer);
return `${year}/${folderName}/${fileName}`;
} catch {
return null;
}
}
readOfferPdf(
relativePath: string,
): { data: Buffer; fileName: string } | null {
const fullPath = this.resolveSafePath(relativePath);
if (!fullPath) return null;
try {
const data = fs.readFileSync(fullPath);
return { data, fileName: path.basename(fullPath) };
} catch {
return null;
}
}
deleteOfferPdf(relativePath: string): boolean {
const fullPath = this.resolveSafePath(relativePath);
if (!fullPath) return false;
try {
fs.unlinkSync(fullPath);
// Remove parent folder if empty
const dir = path.dirname(fullPath);
const remaining = fs.readdirSync(dir);
if (remaining.length === 0) {
fs.rmdirSync(dir);
}
return true;
} catch {
return false;
}
}
/** Build the relative NAS path for a given quotation number + year */
buildRelativePath(quotationNumber: string, year: number): string {
const { prefix, seq } = this.parseParts(quotationNumber);
const folderName = this.sanitizeFilename(`${prefix}_${seq}`);
const fileName = this.sanitizeFilename(`${year}_${prefix}_${seq}`) + ".pdf";
return `${year}/${folderName}/${fileName}`;
}
private parseParts(quotationNumber: string): {
prefix: string;
seq: string;
} {
const parts = quotationNumber.split("/");
return {
prefix: this.sanitizeFilename(
parts.length >= 2 ? parts[parts.length - 2] : "NA",
),
seq: this.sanitizeFilename(parts[parts.length - 1]),
};
}
// ── Private helpers ──────────────────────────────────────────────
private ensureDir(year: number, quotationNumber?: string): string | null {
const parts = [this.basePath, String(year)];
if (quotationNumber) parts.push(quotationNumber);
const dirPath = path.join(...parts);
try {
fs.mkdirSync(dirPath, { recursive: true });
return dirPath;
} catch {
return null;
}
}
private sanitizeFilename(name: string): string {
let safe = path.basename(name);
safe = safe.replace(/[\x00-\x1f\x7f<>:"/\\|?*]/g, "");
safe = safe.replace(/^[. ]+|[. ]+$/g, "");
if ([...safe].length > 255) {
const ext = path.extname(safe).slice(1);
const base = path.basename(safe, ext ? "." + ext : "");
const maxBase = 250 - [...ext].length;
safe = ext
? [...base].slice(0, maxBase).join("") + "." + ext
: [...base].slice(0, maxBase).join("");
}
return safe;
}
private resolveSafePath(relativePath: string): string | null {
if (!this.basePath) return null;
if (relativePath.includes("\0") || relativePath.includes("..")) {
return null;
}
const normalized = relativePath.replace(/\\/g, "/").replace(/^\/+/, "");
const candidate = path
.resolve(this.basePath, normalized)
.replace(/\\/g, "/");
const normalBase = this.basePath.replace(/\\/g, "/");
if (!candidate.startsWith(normalBase + "/")) {
return null;
}
return candidate;
}
}
export const nasOffersManager = new NasOffersManager();