You cannot select more than 25 topics Topics must start with a letter or number, can include dashes ('-') and can be up to 35 characters long.
sims-hq/apps/hq
Thomas Joise f812555528 fix(sec/d24): money-integrity guards — CN cap, atomic doc-no, qty, TDS, markStatus
Red-team money findings:
- createCreditNote caps the CN to the invoice's remaining creditable value
  (invoice payable − already-credited by non-cancelled CNs), read+insert in
  one txn. Blocks a CN exceeding its invoice / unlimited CNs flipping it 'paid'.
- nextDocNo allocates via one atomic UPDATE ... RETURNING (row lock) instead of
  read-then-bump — no duplicate/burned numbers under concurrent issue (Postgres).
- markStatus rejects accepted/lost on non-QUOTATION docs — an issued invoice can
  no longer be hidden from overdue chasing via a quote-only transition.
- computeBill bounds qty magnitude (keeps fractional for weighed Store goods);
  HQ buildLines additionally requires whole-unit integer qty (SMS/module seats).
- recordPayment rejects TDS greater than the cash received — no fabricated-TDS
  'settlement' with no money.
money-guards test locks all four. Suite money paths green.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
4 days ago
..
scripts feat(d20): importer v2 rework from the 46-agent real-data audit 4 days ago
src fix(sec/d24): money-integrity guards — CN cap, atomic doc-no, qty, TDS, markStatus 4 days ago
test fix(sec/d24): money-integrity guards — CN cap, atomic doc-no, qty, TDS, markStatus 4 days ago
.env.example chore: commit pending working-tree improvements (env doc + headless-Chromium container flags) 4 days ago
build-server.mjs feat(hq): server assembly, build script and e2e smoke (HQ-1 task 14) 2 weeks ago
package.json feat(d20): P4 — full-APEX importer v2 (9 files, stage/commit, CLI) 4 days ago
schema.sql docs+chore: HQ DDL snapshot, gitignored import-drop, Postgres locked pre-go-live (D15) 2 weeks ago
tsconfig.json feat(hq): app skeleton with health endpoint (HQ-1 task 1) 2 weeks ago