Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
failed deficit line rolls back the surplus corrective receipt — retries
no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
(in-transaction, clamped at 0)
High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
(Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
hours against its own balance (mirrors createLeave)
Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
(recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
@db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
/items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
settings.company|settings.system; Settings System tab no longer clobbers
Firma numbering patterns; draft invoices hide the dead PDF button;
dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
audit-log + invoice month buckets day-shift fixes
Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.
~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
125 lines
4.1 KiB
TypeScript
125 lines
4.1 KiB
TypeScript
import { describe, it, expect, beforeAll, afterAll } from "vitest";
|
|
import prisma from "../config/database";
|
|
import { confirmInventorySession } from "../services/warehouse.service";
|
|
|
|
/**
|
|
* Pinning tests for audit finding C3: confirmInventorySession must be atomic.
|
|
* A session whose item list contains a valid surplus line BEFORE a deficit
|
|
* line that cannot be satisfied (no batches) must fail WITHOUT committing the
|
|
* surplus item's corrective receipt/batch — and retries must not accumulate
|
|
* phantom stock.
|
|
*/
|
|
|
|
const N = "wh_invconf_";
|
|
|
|
let itemAId: number; // surplus line (processed first — lower line id)
|
|
let itemBId: number; // deficit line with no batches -> selectFifoBatches throws
|
|
let sessionId: number;
|
|
|
|
/** Corrective receipts carry generated notes without our prefix — collect
|
|
* them via their lines' items before deleting. */
|
|
async function cleanup() {
|
|
const lines = await prisma.sklad_receipt_lines.findMany({
|
|
where: { item: { name: { contains: N } } },
|
|
select: { receipt_id: true },
|
|
});
|
|
const receiptIds = [...new Set(lines.map((l) => l.receipt_id))];
|
|
await prisma.sklad_batches.deleteMany({
|
|
where: { item: { name: { contains: N } } },
|
|
});
|
|
await prisma.sklad_receipt_lines.deleteMany({
|
|
where: { item: { name: { contains: N } } },
|
|
});
|
|
if (receiptIds.length > 0) {
|
|
await prisma.sklad_receipts.deleteMany({
|
|
where: { id: { in: receiptIds } },
|
|
});
|
|
}
|
|
await prisma.sklad_inventory_lines.deleteMany({
|
|
where: { session: { notes: { contains: N } } },
|
|
});
|
|
await prisma.sklad_inventory_sessions.deleteMany({
|
|
where: { notes: { contains: N } },
|
|
});
|
|
await prisma.sklad_items.deleteMany({ where: { name: { contains: N } } });
|
|
}
|
|
|
|
beforeAll(async () => {
|
|
await cleanup();
|
|
|
|
const itemA = await prisma.sklad_items.create({
|
|
data: { name: `${N}surplus_item`, unit: "ks" },
|
|
});
|
|
itemAId = itemA.id;
|
|
const itemB = await prisma.sklad_items.create({
|
|
data: { name: `${N}deficit_item`, unit: "ks" },
|
|
});
|
|
itemBId = itemB.id;
|
|
|
|
// Surplus line created first => lower id => processed first by the confirm
|
|
// loop. Deficit line for an item with NO batches forces the FIFO throw.
|
|
const session = await prisma.sklad_inventory_sessions.create({
|
|
data: {
|
|
notes: `${N}session`,
|
|
items: {
|
|
create: [
|
|
{ item_id: itemAId, system_qty: 0, actual_qty: 5, difference: 5 },
|
|
{ item_id: itemBId, system_qty: 3, actual_qty: 0, difference: -3 },
|
|
],
|
|
},
|
|
},
|
|
});
|
|
sessionId = session.id;
|
|
});
|
|
|
|
afterAll(async () => {
|
|
await cleanup();
|
|
await prisma.$disconnect();
|
|
});
|
|
|
|
describe("confirmInventorySession atomicity (audit C3)", () => {
|
|
it("rolls back the surplus corrective receipt when a later deficit line fails", async () => {
|
|
const result = await confirmInventorySession(sessionId);
|
|
|
|
// The confirm must fail — item B has nothing to consume.
|
|
expect("error" in result).toBe(true);
|
|
if ("error" in result) {
|
|
expect(result.status).toBe(400);
|
|
expect(result.error).toContain(`ID ${itemBId}`);
|
|
}
|
|
|
|
// ...and item A's surplus writes must NOT have been committed.
|
|
const receiptLines = await prisma.sklad_receipt_lines.findMany({
|
|
where: { item_id: itemAId },
|
|
});
|
|
expect(receiptLines).toHaveLength(0);
|
|
|
|
const batches = await prisma.sklad_batches.findMany({
|
|
where: { item_id: itemAId },
|
|
});
|
|
expect(batches).toHaveLength(0);
|
|
|
|
// The session itself stays DRAFT and unnumbered either way.
|
|
const session = await prisma.sklad_inventory_sessions.findUnique({
|
|
where: { id: sessionId },
|
|
});
|
|
expect(session?.status).toBe("DRAFT");
|
|
expect(session?.session_number).toBeNull();
|
|
});
|
|
|
|
it("does not accumulate phantom stock when the failed confirm is retried", async () => {
|
|
await confirmInventorySession(sessionId);
|
|
await confirmInventorySession(sessionId);
|
|
|
|
const batches = await prisma.sklad_batches.findMany({
|
|
where: { item_id: itemAId },
|
|
});
|
|
expect(batches).toHaveLength(0);
|
|
|
|
const receipts = await prisma.sklad_receipts.findMany({
|
|
where: { notes: { contains: `inventarizace #${sessionId}` } },
|
|
});
|
|
expect(receipts).toHaveLength(0);
|
|
});
|
|
});
|