hotel-manage-stack/kitchen
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions
28 commits 1 branch 0 tags 50 MiB
Commit graph

4 commits

Author SHA1 Message Date
jtricerolph
bcc94024e3 Pre-deploy security/correctness fixes (port log E17) 
- Remove dead kitchen->KDS internal API (api/internal.py, verify_internal_secret)
  — KDS reads kitchen_db directly (E16), nothing ever called this endpoint
- Add expires_at to dispute_attachments; public attachment links now expire
  after 30 days instead of staying valid forever (A4)
- Add services/upload_validation.py: sniff real file content via python-magic
  instead of trusting the client-supplied Content-Type header, plus a 20MB
  cap. Applied across invoices/logbook/food_flags/credit_notes/disputes
  upload endpoints (A5) — disputes previously had no file-type check at all
- Fix nginx client_max_body_size drift (800m -> the plan's intended 20m)

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
 2026-08-06 14:44:58 +00:00
jtricerolph
742bc91b3b Fix PDF viewing: cookie auth fallback + .mjs MIME type 
- /file and /pdf endpoints: make token optional, fall back to hnf_session
  cookie auth when no valid JWT token provided. Kitchen frontend passes the
  literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
  passes browser strict MIME check for ES module scripts.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-12 21:34:51 +00:00
jtricerolph
e7e1fda9f6 Fix 413 upload limit + add /api/kds/settings to kitchen backend 
- nginx client_max_body_size raised to 800m (was 20m) to allow 577MB backup
  upload; proxy_read_timeout raised to 600s for long restore operations
- Add api/kds_settings.py: GET+PATCH /api/kds/settings served by kitchen
  backend (kitchen Settings page configures KDS timers/GraphQL/course order;
  all config lives in kitchen_settings so kitchen owns these endpoints)

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-12 17:47:28 +00:00
jtricerolph
8d688b459d Initial kitchen scaffold — Phase 1 kitchen port (build-verified 2026-07-11) 
FastAPI backend (Python 3.11, MSSQL ODBC for SambaPOS, Azure DI OCR),
kitchen_db on central PG. React/TS/Vite frontend with navy sidebar layout.

Backend: auth.py (APP_SLUG=kitchen, SimpleNamespace — archive routes use
.kitchen_id/.is_admin without modification), main.py (51 migrations, scheduler,
internal router for KDS bookings feed), api/internal.py, full archive API
(31 routers: invoices, recipes, menus, sambapos, resos, newbook, disputes,
purchase_orders, etc.), models, migrations, OCR pipeline.
kitchen_id pinned to 1 (B1 — single hotel).

Frontend: AuthGate (app=kitchen, token shim for archive compat — B5b pending),
Layout (navy sidebar, 6 sections, Lucide icons, teal --app-primary),
App.tsx (Outlet pattern, UploadApp outside Layout), index.css (full :root block).
strict: false — archive components have type issues; build clean.

Note: 45 archive components call fetch('/api/...') without /kitchen/ prefix
(B5b). Runtime 404s; deferred until after initial testing.

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
 2026-07-12 12:15:39 +00:00