denis_ireri
f865837b27
The initial test report (run before the pilot-readiness changes) raised seven findings and a retest plan. This closes the ones still open. - F-01: a business on its free trial may run 2 active branches whatever its tier, so an owner can try transfers and per-branch stock. Only active branches count towards any limit. - F-06: owners can rename branches and deactivate/reactivate them from the Branches page. A branch can only be deactivated once it holds no stock and no active staff; its history stays in every report, and it leaves every picker. - F-04: the Products page lists deactivated products under a toggle with Reactivate. Deactivating warns about stock still on hand, which stays on the Stock page so it can be transferred or counted out. - F-05: products carry a unit (L, ml, kg, g, pcs, tray, pack) instead of everything being litres. - CAT-12: product prices must be above zero and names are unique per business, ignoring case. - F-03: a reversed report period is refused by the page and the API, and the page labels which period the cards show. Report dates are Nairobi business days. - F-07: cost of goods sold is units sold x average buying price. Stock bought in the period is reported separately, with a cash surplus line, so unsold stock no longer shows as a loss. - STA-04: staff and new branch managers can be invited with a one-time, 7-day link; the person sets their own password. Managers can issue a new link for their own cashiers. - OFF-02 / POS-02: the till shows each product's stock and deducts every sale immediately, online or offline; it warns before selling more than the recorded stock, and has a Clear sale button. - npm run backfill:stock turns purchases recorded before the stock ledger into stock, so existing tenants (and the report's ZERRO fixtures) start from what they bought. tests/retest-plan.test.ts runs the report's completion and retest plan and checks every balance and total it predicts. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
28 lines
1.0 KiB
TypeScript
28 lines
1.0 KiB
TypeScript
import crypto from "crypto";
|
|
import bcrypt from "bcryptjs";
|
|
import type { NextRequest } from "next/server";
|
|
import type { IUser } from "@/lib/server/models/User";
|
|
|
|
export const INVITE_TTL_MS = 7 * 24 * 60 * 60 * 1000;
|
|
|
|
export function hashInviteToken(token: string): string {
|
|
return crypto.createHash("sha256").update(token).digest("hex");
|
|
}
|
|
|
|
/** A password nobody knows, for an account whose owner has not accepted their invite yet. */
|
|
export async function unusablePasswordHash(): Promise<string> {
|
|
return bcrypt.hash(crypto.randomBytes(32).toString("hex"), 12);
|
|
}
|
|
|
|
/**
|
|
* Give the user a fresh invite (any earlier link stops working) and return
|
|
* the link to send them. The caller saves the user.
|
|
*/
|
|
export function issueInvite(user: IUser, req: NextRequest): string {
|
|
const token = crypto.randomBytes(32).toString("base64url");
|
|
user.inviteTokenHash = hashInviteToken(token);
|
|
user.inviteExpiresAt = new Date(Date.now() + INVITE_TTL_MS);
|
|
const origin = process.env.APP_URL?.replace(/\/$/, "") || req.nextUrl.origin;
|
|
return `${origin}/invite/${token}`;
|
|
}
|