The in-app page-restriction system (admin-only toggles in Settings) was
nav-hiding only and duplicated functionality already covered by JWT caps
in the main stack auth service. All 9 pages in the restriction list were
already gated in Layout.tsx by existing caps.
Backend: add router-level requireCap() to enforce caps at the API layer:
- reports.py: Depends(require_cap("view"))
- logbook.py: Depends(require_cap("logbook"))
- search.py: Depends(require_cap("invoices"))
Frontend: remove the Access Control settings section entirely:
- Drop pageRestrictions query, restrictedPages/accessSaveMessage state,
savePageRestrictionsMutation, isSectionAccessible helper
- Remove 'access' from SettingsSection type and sidebarItems
- Strip restrictPath from all sidebar items (no longer needed)
Access management is now fully centralised in the main stack auth service.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- settings/src/integrations/schema.js: rename azure from 'Azure AD' to
'Azure Document Intelligence', swap fields to endpoint + api_key
- Add use_global_azure column (migration + model)
- global_settings_service: add azure to check_global_status and apply_global_overrides
- api/settings.py: expose use_global_azure in response/update; apply overrides
in test_azure_connection before credential check
- Settings.tsx: add 'Use credentials from main stack settings' toggle for
Azure OCR section (endpoint/key disabled when on, test button enabled when
global is configured); remove Users section (managed centrally via auth
service), clean up UserData interface, users query and mutations
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the
top of its credentials block. When enabled, the app reads auth credentials from
the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and
the local auth fields are grayed out. App-specific fields (base path, GL codes,
keywords, sync intervals, etc.) remain editable regardless.
Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service
with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status
endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
npm upgraded pdfjs-dist from 5.4.530 to 5.7.284 (^semver range) but the
manually copied worker file in public/ was left at 5.4.530, causing an
API/Worker version mismatch error at runtime. Copy matching worker from
node_modules/pdfjs-dist/build/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- /file and /pdf endpoints: make token optional, fall back to hnf_session
cookie auth when no valid JWT token provided. Kitchen frontend passes the
literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
passes browser strict MIME check for ES module scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove stale import of non-existent require_cap_from_token from
get_invoice_file endpoint — caused ImportError → 500 on every PDF load
- Fix pdf.js worker path from '/pdf.worker.min.mjs' to '/kitchen/pdf.worker.min.mjs'
in Review.tsx and SearchDefinitions.tsx — worker was being fetched from domain
root instead of under the /kitchen/ base, causing MIME type rejection
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The full Purchases.tsx page at /purchases (multi-week tables, date range picker,
disputes/allowances rows, 24-week comparison chart) was already ported but had
no sidebar nav entry. Adds it under Invoices → Purchases Chart and removes the
simplified single-week PurchasesCalendar placeholder that replaced it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend endpoint /api/reports/purchases/weekly existed but had no frontend.
Adds PurchasesCalendar page under Invoices > Purchases Chart: 7-day columns,
one row per supplier, each cell lists invoice chips (number + total) linking
to the invoice detail. Daily totals row in footer, prev/next week navigation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bare <a href="/invoice/..."> tags bypass React Router basename, causing
hard navigations to absolute paths with no NPM route. Added /kitchen/
prefix to all internal href values across 12 components.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Frontend sends lowercase status (e.g. 'confirmed'), but the DB enum values
are uppercase (CONFIRMED). Uppercase the parameter before comparison.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrations used try/except around ADD COLUMN inside a single engine.begin()
block. When a 'column already exists' error was caught, asyncpg left the
transaction in aborted state, causing all subsequent DDL in the block to fail
with InFailedSQLTransactionError. Replace with IF NOT EXISTS to prevent the
error entirely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx client_max_body_size raised to 800m (was 20m) to allow 577MB backup
upload; proxy_read_timeout raised to 600s for long restore operations
- Add api/kds_settings.py: GET+PATCH /api/kds/settings served by kitchen
backend (kitchen Settings page configures KDS timers/GraphQL/course order;
all config lives in kitchen_settings so kitchen owns these endpoints)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kitchen_settings has a FK to kitchens.id — on a fresh kitchen_db the
kitchens table is empty, so any restore attempt fails with a FK violation.
Idempotent INSERT ON CONFLICT DO NOTHING runs after create_all on every boot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All archive components were calling fetch('/api/...') directly. Replaced
all occurrences of /api/ URLs (string literals, template literals,
window.open, src attributes) with /kitchen/api/ across 37 source files.
The central axios instance in api.ts was already correct.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
