e11765bf0e
Critical (data integrity):
- warehouse inventory confirm: throw (not return) inside $transaction so a
failed deficit line rolls back the surplus corrective receipt — retries
no longer accumulate phantom stock
- warehouse issue confirm: validate batches against the COMBINED quantity
of all lines (duplicate FIFO-resolved lines drove batches negative)
- attendance delete: restore vacation_used/sick_used for the deleted day
(in-transaction, clamped at 0)
High:
- auth refresh: terminated sessions (replaced_at only) get a plain 401 —
the theft branch (family revocation) now fires only on replaced_by_hash
- POST /users strips role_id for non-admin callers (mirrors PUT guard)
- issued-order transition flushes unsaved edits via the full save payload
when dirty; server contract (items+status in one PUT) pinned
- received-invoices list: usePaginatedQuery + pager (rows 26+ unreachable)
- received-invoice dates: nullableIsoDateString + NaN guard before NAS save
(Czech-format dates corrupted month/year, orphaned NAS files)
- leave approval skips Czech public holidays and books each calendar year's
hours against its own balance (mirrors createLeave)
Medium/Low (classes):
- 52 Zod caps aligned to DB column widths across 7 schemas (over-cap input
500ed at Prisma instead of a Czech 400)
- FK pre-validation: projects update + warehouse receipts/issues return
Czech 400s instead of P2003 500s
- invoice PDF degrades gracefully when the CNB rate is unavailable
(recap omitted instead of 500 + lost NAS archival)
- date boundaries: local-day filters (warehouse lists/reports, audit-log),
@db.Date coercion on invoice dates
- plan updateEntry re-checks the per-cell cap (self-excluding)
- {id} tiebreaks on customers/received-invoices/warehouse-items sorts;
/items honors the client sort param
- htmlToPdf relaunches once when the shared browser died mid-render
- offer number release parses the year from the document number (cross-year
finalize+delete left permanent sequence gaps)
- trips/vehicles km fields integer-coerced; AI budget regated to
settings.company|settings.system; Settings System tab no longer clobbers
Firma numbering patterns; draft invoices hide the dead PDF button;
dashboard quick-trip invalidates ["vehicles"]; TOTP secret cap 64;
audit-log + invoice month buckets day-shift fixes
Docs: corrected the stale "Chromium has no CSS margin-box footers" claim
(html-to-pdf.ts + CLAUDE.md — margin boxes render since Chrome 131); audit
report M3 withdrawn accordingly.
~65 new pinning tests; every finding reproduced RED against the real test
DB before its fix. Suite: 58 files / 634 tests green.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
boha-app-ts
Internal business-management system for a Czech company (attendance, invoicing, leave/trips, projects, vehicles, warehouse, HR) — a TypeScript/Node.js rewrite of the legacy PHP app. User-facing text is Czech by design.
For full architecture, conventions, and gotchas, see CLAUDE.md.
Stack
- Backend: Fastify 5 · Prisma 6 → MySQL · Zod 4 · JWT (HS256) + TOTP 2FA
- Frontend: React 18 · Vite · Material UI v7 (Emotion) · TanStack Query — an
SPA in
src/admin/, served by the same Fastify process (Vite middleware in dev, static files in prod) - Other: Puppeteer (PDF) · nodemailer · node-cron ·
@anthropic-ai/sdk(the admins-only "Odin" assistant)
Prerequisites
- Node.js (LTS) and a MySQL database
- Copy
.env.example→.envand fill in the required vars (DATABASE_URL,JWT_SECRET,TOTP_ENCRYPTION_KEY— generate the keys withopenssl rand -hex 32)
Setup
npm install
npx prisma generate
npx prisma migrate dev # apply migrations to your dev DB
npx prisma db seed # optional: dev-only sample data (NEVER on prod)
Develop
npm run dev:server # API (tsx watch) on http://127.0.0.1:3050
npm run dev:client # Vite dev server (manage separately)
Build & run
npm run build # tsc server → dist/ + vite client → dist-client/
npm start # node dist/server.js
Test
npm test # vitest run — hits a real test DB (.env.test); no Prisma mocks
Quality gates
Before committing, all of these must pass:
npx tsc -b --noEmit # typecheck (NOT `tsc -p tsconfig.json`)
npm run build
npx vitest run
npm run lint # ESLint (incl. react-hooks) — see eslint.config.js
Database migrations
Every schema/data change is a tracked Prisma migration — never prisma db push
or raw SQL on production. Stop the dev server before running prisma migrate dev.
See CLAUDE.md → Database Migrations for the full workflow and the production
deploy/hotfix process.
License
ISC