denis_ireri
d4808b3e46
The admin pages redirected cashiers away, but the API itself let them read profit, expenses and purchases and record expenses and purchases. Branch managers could also change product prices for every branch. Every gated route now goes through authorize(), which answers 401 when signed out and 403 for the wrong role. - Owners and managers only: profit report, expenses, purchases, users, morning dispatch and evening count. Owner only: create and edit products, rename branches. - PATCH /api/users/:id deactivates or reactivates staff (managers: their own cashiers only) and revokes the user's device sessions. PATCH /api/branches/:id renames a branch. - Login and token refresh refuse inactive or SUSPENDED businesses. - Public signup refuses PLATFORM_ADMIN_EMAILS addresses, so an unregistered operator email can no longer be claimed. - M-Pesa sits behind FEATURE_MPESA (off by default, out of scope for the pilot): its routes return 404 and the Daraja variables are optional. Turning it on in production requires the callback IP allowlist. - "Today" and the default month now follow Africa/Nairobi instead of the server's UTC clock, so the business day no longer starts at 03:00 EAT. - Malformed ids in query strings and bodies return 400 instead of a 500, the inventory routes check the product belongs to the tenant, and the reconciliation lookups are tenant-scoped. - Branch-scoped staff see their branch's override price from GET /api/products. - Adds a vitest suite against an in-memory MongoDB (npm test). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
41 lines
1.7 KiB
TypeScript
41 lines
1.7 KiB
TypeScript
// The business day for every tenant is the Kenyan calendar day
|
|
// (Africa/Nairobi, EAT). EAT is a fixed UTC+3 with no daylight saving, so a
|
|
// constant offset is exact — no timezone database needed.
|
|
//
|
|
// Never use `new Date().setHours(0)` or `toISOString().slice(0, 10)` for
|
|
// "today" on the server: on Vercel the server clock is UTC, which would
|
|
// start the business day at 03:00 EAT and push early-morning sales onto
|
|
// the previous day.
|
|
|
|
const EAT_OFFSET_MS = 3 * 60 * 60 * 1000;
|
|
const DAY_MS = 24 * 60 * 60 * 1000;
|
|
const DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
|
|
|
|
/** Today's business day as YYYY-MM-DD. */
|
|
export function todayNairobi(now: Date = new Date()): string {
|
|
return new Date(now.getTime() + EAT_OFFSET_MS).toISOString().slice(0, 10);
|
|
}
|
|
|
|
export function isBusinessDate(value: string): boolean {
|
|
if (!DATE_RE.test(value)) return false;
|
|
const d = new Date(value + "T00:00:00.000Z");
|
|
return !Number.isNaN(d.getTime()) && d.toISOString().slice(0, 10) === value;
|
|
}
|
|
|
|
/** The UTC instants [start, end) covering one business day. */
|
|
export function dayRangeNairobi(date: string): { start: Date; end: Date } {
|
|
if (!isBusinessDate(date)) throw new Error(`Invalid business date: ${date}`);
|
|
const start = new Date(new Date(date + "T00:00:00.000Z").getTime() - EAT_OFFSET_MS);
|
|
return { start, end: new Date(start.getTime() + DAY_MS) };
|
|
}
|
|
|
|
/** Start of the business day containing `now`. */
|
|
export function startOfTodayNairobi(now: Date = new Date()): Date {
|
|
return dayRangeNairobi(todayNairobi(now)).start;
|
|
}
|
|
|
|
/** Start of the current business month (1st, 00:00 EAT). */
|
|
export function startOfMonthNairobi(now: Date = new Date()): Date {
|
|
return dayRangeNairobi(todayNairobi(now).slice(0, 8) + "01").start;
|
|
}
|