2fda27a329
fix(login): request-otp must insert otp_code (NOT NULL) for send_pin email
...
Full edge-fn sync clobbered a live hotfix: repo request-otp only wrote
otp_code_hash, but login_otps.otp_code is NOT NULL, so every request
failed with 'Failed to generate OTP' and no PIN email was sent. Restore
writing otp_code (n8n send_pin trigger emails it; verify still uses hash).
2026-08-21 16:35:04 +02:00
d04901d296
security: fix 9 vulnerabilities + OrdersTable 14px font + colored status badges
...
Security fixes:
- Remove VITE_SUPABASE_SERVICE_ROLE_KEY from Docker build args
- Add missing security.ts functions (verifyInternalRequest, requireSameOrigin, etc)
- Store only OTP hash, remove plaintext otp_code
- Fix CORS origin check: startsWith → exact match
- Use atomic SQL check_rate_limit RPC instead of JS rate limiter
- Mask PII in get_delivery_invitation_by_token single-order path
- Add RequireAuth wrapper for protected routes
- Revoke anon execute on confirm_delivery_choice_by_token
- Add HSTS header to Caddyfile
UI:
- OrdersTable desktop: all cells text-sm (14px)
- Status column: use colored Badge with tone from getOrderGroupStatusTone
- Header row: text-sm (14px)
2026-06-19 12:14:19 +00:00
e05613ac1d
feat: add pickup (самовывоз) delivery type
...
- New status pickup in delivery workflow
- DB: delivery_type, pickup_date, pickup_time_slot columns
- Client page: tabs Доставка/Самовывоз with PickupSlotsPicker
- PickupSlotsPicker: today/tomorrow/day-after with half-day slots
- Storage notice: free 2 workdays, then 300₽/day
- OrderDetailPanel: delivery type tabs, pickup date/time, status button
- Edge function: delivery_type/pickup fields in confirm-delivery-choice
- RPC: confirm_delivery_choice_by_token updated for pickup
- orderGroupRepository: full pickup field mapping
2026-06-10 12:02:46 +00:00
b9c6bb2810
fix: RLS recursion, driver UI, auth errors, status counts
...
- Fix infinite RLS recursion in users policies via current_role_name()
- Add is_admin() helper and simplify users select policies
- Fix order_groups insert for service_role (n8n integration)
- Fix status option counts in dropdown (LogisticsReadinessBoard)
- Add driver delivery status buttons (loaded, on_route, delivered, problem, cancelled)
- Replace driver date range filters with single date picker + date pills
- Hide SMS/internal data from driver view in OrderDetailPanel
- Fix Edge Function error messages in OTP flow (read error.context body)
- Add update_delivery_status RPC for driver workflow
- Remove customer column from order_groups fetch (DB schema mismatch)
- UI: swap filter/search positions, limit modal width, status label cleanup
2026-05-20 16:25:05 +03:00
e29a51e7ea
Harden auth and delivery endpoints
2026-05-13 18:59:30 +03:00
Hermes
root
root
Codex