AuthGate unconditionally hard-navigated window.top to the central
/login on session expiry, even when not embedded in the portal
iframe — dropping an installed/directly-opened kitchen session into
the portal's framed browser view instead of staying in its own
window.
Now only bounces to central login when actually embedded (passing
?from= so it returns here afterwards); standalone or directly-opened
tabs get an in-app login form and never navigate away. Also wired up
the previously-dead inactivity auto-logout timer (disabled for
installed PWAs, configurable per device otherwise). The legacy
token/restrictedPages/login/logout compat shim is unchanged.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
- Migrated all 435 frontend fetch calls from Authorization Bearer header to credentials: 'include' (cookie auth)
- Removed ?token= from all file/image URLs (browser history exposure)
- Added ProtectedRoute wrapper to all capability-gated routes in App.tsx
- OCR background task: added transaction boundary, improved error handling and status rollback
- DuplicateDetector: wrapped in non-fatal try/except so crashes don't abort invoice processing
- File upload: commit DB row before writing to disk to prevent orphaned files
- GP% clamped to 100% in GPReport (credit notes can inflate above 100%)
- Added CSV export to GPReport (suppliers, daily data, allowances breakdown)
- Backend file-serving endpoints: cookie auth with ?token= fallback for backward compatibility
- DATA_DIR: moved from hardcoded /app/data to os.getenv in invoices.py and recipes.py
- N+1 fix in list_recipes: batch-loads latest cost snapshot in 1 query (was N)
- Zero-yield sub-recipe: logs warning instead of silently zeroing cost contribution
- Budget spend rate input: rejects negative values
- GPReport allowances toggle: persisted to localStorage across page loads
- DB pool_size/max_overflow: configurable via DB_POOL_SIZE/DB_MAX_OVERFLOW env vars
- Fixed SyntaxWarning from \\d in invoices.py docstring
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The in-app page-restriction system (admin-only toggles in Settings) was
nav-hiding only and duplicated functionality already covered by JWT caps
in the main stack auth service. All 9 pages in the restriction list were
already gated in Layout.tsx by existing caps.
Backend: add router-level requireCap() to enforce caps at the API layer:
- reports.py: Depends(require_cap("view"))
- logbook.py: Depends(require_cap("logbook"))
- search.py: Depends(require_cap("invoices"))
Frontend: remove the Access Control settings section entirely:
- Drop pageRestrictions query, restrictedPages/accessSaveMessage state,
savePageRestrictionsMutation, isSectionAccessible helper
- Remove 'access' from SettingsSection type and sidebarItems
- Strip restrictPath from all sidebar items (no longer needed)
Access management is now fully centralised in the main stack auth service.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- settings/src/integrations/schema.js: rename azure from 'Azure AD' to
'Azure Document Intelligence', swap fields to endpoint + api_key
- Add use_global_azure column (migration + model)
- global_settings_service: add azure to check_global_status and apply_global_overrides
- api/settings.py: expose use_global_azure in response/update; apply overrides
in test_azure_connection before credential check
- Settings.tsx: add 'Use credentials from main stack settings' toggle for
Azure OCR section (endpoint/key disabled when on, test button enabled when
global is configured); remove Users section (managed centrally via auth
service), clean up UserData interface, users query and mutations
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the
top of its credentials block. When enabled, the app reads auth credentials from
the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and
the local auth fields are grayed out. App-specific fields (base path, GL codes,
keywords, sync intervals, etc.) remain editable regardless.
Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service
with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status
endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
npm upgraded pdfjs-dist from 5.4.530 to 5.7.284 (^semver range) but the
manually copied worker file in public/ was left at 5.4.530, causing an
API/Worker version mismatch error at runtime. Copy matching worker from
node_modules/pdfjs-dist/build/.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- /file and /pdf endpoints: make token optional, fall back to hnf_session
cookie auth when no valid JWT token provided. Kitchen frontend passes the
literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
passes browser strict MIME check for ES module scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove stale import of non-existent require_cap_from_token from
get_invoice_file endpoint — caused ImportError → 500 on every PDF load
- Fix pdf.js worker path from '/pdf.worker.min.mjs' to '/kitchen/pdf.worker.min.mjs'
in Review.tsx and SearchDefinitions.tsx — worker was being fetched from domain
root instead of under the /kitchen/ base, causing MIME type rejection
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The full Purchases.tsx page at /purchases (multi-week tables, date range picker,
disputes/allowances rows, 24-week comparison chart) was already ported but had
no sidebar nav entry. Adds it under Invoices → Purchases Chart and removes the
simplified single-week PurchasesCalendar placeholder that replaced it.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Backend endpoint /api/reports/purchases/weekly existed but had no frontend.
Adds PurchasesCalendar page under Invoices > Purchases Chart: 7-day columns,
one row per supplier, each cell lists invoice chips (number + total) linking
to the invoice detail. Daily totals row in footer, prev/next week navigation.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Bare <a href="/invoice/..."> tags bypass React Router basename, causing
hard navigations to absolute paths with no NPM route. Added /kitchen/
prefix to all internal href values across 12 components.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx client_max_body_size raised to 800m (was 20m) to allow 577MB backup
upload; proxy_read_timeout raised to 600s for long restore operations
- Add api/kds_settings.py: GET+PATCH /api/kds/settings served by kitchen
backend (kitchen Settings page configures KDS timers/GraphQL/course order;
all config lives in kitchen_settings so kitchen owns these endpoints)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
All archive components were calling fetch('/api/...') directly. Replaced
all occurrences of /api/ URLs (string literals, template literals,
window.open, src attributes) with /kitchen/api/ across 37 source files.
The central axios instance in api.ts was already correct.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
