4 commits

Author	SHA1	Message	Date
jtricerolph	2e9b4a2ca3	Let admins unfinalise a cash up from history ... Adds POST /api/cashup/:id/unfinalise (admin-only) to revert a finalised cash up back to draft so it can be corrected, plus an Unfinalise button in the history table for admin users.	2026-08-03 08:53:00 +00:00
jtricerolph	be670f724d	Enforce granular capabilities across cashup ... Backend (server-side enforcement, not just UI): - auth.js: read caps from JWT; hasCap() + requireCap() helpers; legacy-token fallback (full access minus settings) so existing sessions keep working until re-login - finalise: submit final, delete draft, bulk-finalise, attachments - reports: multiday report, cash summary, debtors - floats: float management + safe count - settings: settings mutations (was is_admin) - count: draft save, newbook fetch Frontend: - can(user, cap) helper; User.caps from /verify - Nav items, routes and actions (Submit Final, delete, bulk-finalise) gated on capabilities; non-finalisers see a draft-only hint Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-07-02 14:19:30 +00:00
jtricerolph	e4ab137025	Fix invalid date in history; expand weekly report ... - History: slice session_date to YYYY-MM-DD before Date parse (postgres returns date columns as ISO timestamps in JSON) - History: fix Edit/View navigate link passing full ISO string as date param - Weekly report: add daily status row, reconciliation variance (banked vs Newbook reported), sales with gross+net, debtors/creditors lazy-loaded Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>	2026-07-01 22:29:50 +00:00
jtricerolph	63a5a72fa3	Wire Newbook credentials to settings service	2026-07-01 19:33:16 +00:00