- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
— KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
instead of trusting the client-supplied Content-Type header, plus a 20MB
cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
Query was used at lines 2121 and 2242 (token query-param auth on image preview
endpoints) but never imported, causing the backend to crash on startup.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Migrated all 435 frontend fetch calls from Authorization Bearer header to credentials: 'include' (cookie auth)
- Removed ?token= from all file/image URLs (browser history exposure)
- Added ProtectedRoute wrapper to all capability-gated routes in App.tsx
- OCR background task: added transaction boundary, improved error handling and status rollback
- DuplicateDetector: wrapped in non-fatal try/except so crashes don't abort invoice processing
- File upload: commit DB row before writing to disk to prevent orphaned files
- GP% clamped to 100% in GPReport (credit notes can inflate above 100%)
- Added CSV export to GPReport (suppliers, daily data, allowances breakdown)
- Backend file-serving endpoints: cookie auth with ?token= fallback for backward compatibility
- DATA_DIR: moved from hardcoded /app/data to os.getenv in invoices.py and recipes.py
- N+1 fix in list_recipes: batch-loads latest cost snapshot in 1 query (was N)
- Zero-yield sub-recipe: logs warning instead of silently zeroing cost contribution
- Budget spend rate input: rejects negative values
- GPReport allowances toggle: persisted to localStorage across page loads
- DB pool_size/max_overflow: configurable via DB_POOL_SIZE/DB_MAX_OVERFLOW env vars
- Fixed SyntaxWarning from \\d in invoices.py docstring
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- /file and /pdf endpoints: make token optional, fall back to hnf_session
cookie auth when no valid JWT token provided. Kitchen frontend passes the
literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
passes browser strict MIME check for ES module scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove stale import of non-existent require_cap_from_token from
get_invoice_file endpoint — caused ImportError → 500 on every PDF load
- Fix pdf.js worker path from '/pdf.worker.min.mjs' to '/kitchen/pdf.worker.min.mjs'
in Review.tsx and SearchDefinitions.tsx — worker was being fetched from domain
root instead of under the /kitchen/ base, causing MIME type rejection
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Frontend sends lowercase status (e.g. 'confirmed'), but the DB enum values
are uppercase (CONFIRMED). Uppercase the parameter before comparison.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
