Each of Newbook, Resos, SambaPOS, SMTP, and Nextcloud now has a checkbox at the
top of its credentials block. When enabled, the app reads auth credentials from
the central stack settings service (SETTINGS_URL + STACK_INTERNAL_SECRET) and
the local auth fields are grayed out. App-specific fields (base path, GL codes,
keywords, sync intervals, etc.) remain editable regardless.
Backend: new use_global_* columns on kitchen_settings, migration, global_settings_service
with apply_global_overrides() for in-memory credential injection, GET /api/settings/global-status
endpoint, and apply_global_overrides() called in test-connection endpoints and FileArchivalService.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- /file and /pdf endpoints: make token optional, fall back to hnf_session
cookie auth when no valid JWT token provided. Kitchen frontend passes the
literal '__session__' compat shim so token-only auth always 401'd.
- Add Request injection so cookie-based fallback path can read hnf_session.
- nginx: add types block mapping .mjs → text/javascript so pdf.worker.min.mjs
passes browser strict MIME check for ES module scripts.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Remove stale import of non-existent require_cap_from_token from
get_invoice_file endpoint — caused ImportError → 500 on every PDF load
- Fix pdf.js worker path from '/pdf.worker.min.mjs' to '/kitchen/pdf.worker.min.mjs'
in Review.tsx and SearchDefinitions.tsx — worker was being fetched from domain
root instead of under the /kitchen/ base, causing MIME type rejection
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Frontend sends lowercase status (e.g. 'confirmed'), but the DB enum values
are uppercase (CONFIRMED). Uppercase the parameter before comparison.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Migrations used try/except around ADD COLUMN inside a single engine.begin()
block. When a 'column already exists' error was caught, asyncpg left the
transaction in aborted state, causing all subsequent DDL in the block to fail
with InFailedSQLTransactionError. Replace with IF NOT EXISTS to prevent the
error entirely.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- nginx client_max_body_size raised to 800m (was 20m) to allow 577MB backup
upload; proxy_read_timeout raised to 600s for long restore operations
- Add api/kds_settings.py: GET+PATCH /api/kds/settings served by kitchen
backend (kitchen Settings page configures KDS timers/GraphQL/course order;
all config lives in kitchen_settings so kitchen owns these endpoints)
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
kitchen_settings has a FK to kitchens.id — on a fresh kitchen_db the
kitchens table is empty, so any restore attempt fails with a FK violation.
Idempotent INSERT ON CONFLICT DO NOTHING runs after create_all on every boot.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
?token= query-param endpoints (PO/invoice print previews, recipe image exports,
backup download) call get_current_user_from_token which was not ported from the
original archive auth module. Added the function and fixed the missing import in
backup.py, ingredients.py, and invoices.py.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
