249 Commits

Author	SHA1	Message	Date
Darko Gjorgjijoski	dbc6ca7ad6	fix(recurring-invoices): scale scheduled generation	2026-08-02 23:01:22 +02:00
Darko Gjorgjijoski	1e72d9d449	fix(invoices): require settlement before completion (#739)	2026-08-02 17:02:29 +02:00
Darko Gjorgjijoski	00c9c4268e	fix(pdf): give the reports their margin back, and one shared chrome (#738) ... * fix(pdf): put the page margin back on the report PDFs The report templates carry no inset of their own. They set `.sub-container { padding: 0px 20px }` and nothing else, and relied entirely on dompdf's built-in 1.2cm page margin. #727 made DompdfDriver always inject an `@page` rule from PdfPageSetup, and #735 defaulted those margins to zero so invoice2 and estimate2 could bleed their header band to the paper edge. The document templates were fine, they carry their own 30px/50px insets. The reports were not: every one of them now renders flush against the paper, with the company name's glyph box actually clipped 1.2pt above the top edge. The zero default has to stay for documents, so reports get a margin of their own: `pdf.page.report_margin`, PDF_REPORT_MARGIN, defaulting to the 1.2cm they were drawn against. It is a separate key on purpose, so an operator tuning the document margins for their invoice template does not silently reflow every report as a side effect. A page margin rather than padding on the templates because reports run to several pages and padding only insets the first one. Sales by customer already spans two on the demo data, and page two moves with the rest. Plumbed as an optional PdfPageSetup on the driver contract, defaulting to the configured page, so every existing call site renders exactly as before and only the five report controllers ask for anything different. Measured on the five reports, page 595.28 x 841.89pt, 1.2cm = 34.02pt: first page ink moves from xMin 15.0-15.8 / yMin -1.2 to xMin 49.0-49.8 / yMin 32.8, every axis shifting by exactly the margin. Also fixes three untranslated keys this exposed: the expenses report printed its column headings as the literal strings "expenses.date", "expenses.note" and "expenses.amount", which have never existed in lang/en.json. They are now pdf_expense_{date,note,amount}_label, and a test pins that every translation key a report template uses resolves in English. * fix(pdf): put the minus sign in front of the currency symbol format_money_pdf() formatted the signed value and then concatenated the symbol, so a negative amount came out as "$-24,738.00". Credit notes made that common: every line on a credit note PDF reads negative, and one credit note in a period is enough to make the customer sales report show a negative total. The magnitude is formatted first now and a single minus is prefixed to the whole assembled string, so the sign leads and the symbol stays glued to the digits. Only the symbol-first branch changes. number_format() already put the sign in front of the digits, so a trailing-symbol currency read "-24,738.00$" before and is byte-identical after. The sign is decided on the formatted digits rather than on the raw input, so an amount that rounds away at the currency's precision renders as zero rather than as "-0". A stray cent on a zero-precision currency is the case that needs it. * refactor(pdf): one shared chrome for the report PDFs The five report templates were five drifted copies of one 2018 stylesheet, and the insets had stopped agreeing with each other. profit-loss alone put its header and income row at +20px, its "Expenses" heading at +23px, its category rows at +30px, and its total rule and NET PROFIT band at +0, because that markup sat outside the container everything above it was in. Four left edges on one page. Every report also carried the same self-cancelling total rule, where `padding: 0px` follows the two longhands it silently overrides, and expenses carried six rule blocks nothing referenced at all, including the only horizontal rule in the file. There is now one layout partial and one stylesheet, and each report is content only: 236 lines down to 47 for profit-loss, and about 1200 lines deleted across the five. One content edge, measured: every band starts at 34.016pt and every amount ends at 561.260pt, on every page of every report. What changed on the page: - Real tables with a thead, so column headings repeat across page breaks. Only expenses had headings before and none of them used thead. sales-items emitted a separate table per item, which is why its rows never lined up. - The company logo in the header, the same fallback-to-name pattern the document templates use. - An empty period renders a "no records" row. profit-loss, sales-items and tax-summary rendered their total row and rule unconditionally, so a month with no data showed a heading, a gap, a rule and a lone $0.00. - Sections stay whole across a page break where they fit, and a section heading never sits at the foot of a page with its rows overleaf. - Credit notes stay in the sales totals, since a reversal netting the sale out is correct, but the line is tagged so a CN- number is not read as a sale. It reuses the document's own label, which is already in the shipped locales. - Labels stopped carrying their own presentation: "TOTAL EXPENSE" (also singular) is "Total expenses" and the stylesheet does the uppercasing. The five controllers drop the dead colour-settings block: nine *_color settings were queried and shared by every report, no template ever read them, and no migration, seeder or UI ever wrote them, so the query always returned an empty collection. Every other shared variable name is untouched, because a custom report template is a copy that references them by name. make:template had to learn the same lesson: it only ever copied partials/table.blade.php, so a cloned report would extend a layout that does not exist in its namespace and die on render. It now copies every partial a type ships and rewrites references by view name, including partial-to-partial ones, so each custom template still gets its own copies.	2026-08-02 14:34:02 +02:00
Darko Gjorgjijoski	885042f13a	feat(expenses): add tax tracking and reporting (#737)	2026-08-02 13:01:01 +02:00
lnx1-1	3455ceb594	feat(invoices): native credit notes (#689) ... * feat(invoices): add credit note (Stornorechnung) backend Implement native credit notes as invoices with type=CREDIT_NOTE that reference the original invoice they reverse. All monetary fields are negated as integer cents (no float arithmetic). - Migration: add invoices.type + related_invoice_id (unsignedInteger, matching invoices.id which is INT UNSIGNED via increments() rather than bigIncrements() -- required for the self-referencing foreign key to form correctly on MySQL/MariaDB) + widen invoice_items.price/base_price to signed (idempotent guards) - Invoice model: TYPE_* constants, relatedInvoice/creditNotes relations, isCreditNote() helper - InvoiceService::createCreditNote() copies + negates the source invoice, sets creator_id from the authenticated user - POST /invoices/{invoice}/credit-note endpoint (201) with CreditNotePolicy authorization; 422 when the source is already a credit note, 403 across companies - CreditNoteResource exposing type + related_invoice reference - Dedicated credit-note PDF template (Stornorechnung header + reference line) - SendCreditNoteRequest + SendCreditNoteMail + send endpoint/email template - en/de translations for the credit-note PDF labels - Feature tests: create, item negation, relation, 422, 403, PDF, email Fresh implementation addressing all review feedback from PR #536. Refs #317 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * feat(invoices): add credit note UI (button, badge, back-link) - 'Create Credit Note' action in the invoice dropdown (hidden on rows that are already credit notes) - Credit-note badge in the invoice list - Credit-note banner with a link back to the reversed invoice on the detail view; show() returns CreditNoteResource for credit notes so the original invoice reference is available - Expose type + related_invoice_id on InvoiceResource - invoiceService.createCreditNote + store action - Invoice domain type: InvoiceType, RelatedInvoice, type/related fields - en/de translations for the credit-note UI strings Refs #317 Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Settle balances on credit note creation and surface cancellation in UI Creating a credit note (full reversal) now settles both documents, the mechanism @gdarko praised in PR #536 ("Invoice due amount adjustment logic for create/update/delete is well thought out"), adapted to the invoice-row-with-type architecture: - The original invoice's due_amount/base_due_amount drop to 0 and its status/paid_status are recalculated through the existing changeInvoiceStatus() path (COMPLETED/PAID), so it falls out of every awaiting-payment view. The UI shows a distinct "Cancelled" badge and a "Cancelled via credit note: ST-XXXX" banner instead of the generic Paid badge, avoiding Xero's documented paid-vs-credited ambiguity. - The credit note itself is created settled (due 0, PAID): nothing is ever owed on it, so it never surfaces as an open negative balance. - Deleting a credit note restores the original invoice's balance, recomputed from recorded payments (integer cents), covering unpaid and partially-paid invoices; skipped when both documents are deleted in one batch. - One credit note per invoice: a second full reversal would double-negate the books (422 + hidden dropdown action). - InvoiceResource exposes minimal credit_notes refs, mirroring the existing related_invoice back-link, for the banner/badge in InvoiceDetailView and InvoiceIndexView. 8 new feature tests cover settlement, resource exposure, the one-per-invoice guard, and delete-side restoration. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Render credit notes through the invoice's own template, add cancellation banner to PDFs Fixes two bugs found via screenshot: the actual generated PDF (not just the Vue preview) is what customers download/print/email, and it was broken in both directions. 1. Credit notes always rendered through one hardcoded standalone layout (app/pdf/credit-note/credit-note.blade.php) regardless of which of the 3 invoice templates the company actually uses. A company on invoice2/3 branding got a credit note PDF that looked nothing like their real invoices. Fixed by making invoice1/2/3.blade.php credit-note-aware (swap number/date labels, add the red "CREDIT NOTE" banner + reference line, scaled to each template's own visual language) and removing the isCreditNote() special case in InvoiceService::getPdfData() so credit notes now go through the same PdfTemplateUtils resolution as regular invoices. The standalone template is deleted. 2. The original (now-cancelled) invoice's PDF showed zero indication it had been reversed by a credit note — only the Vue UI banner existed. Added an equivalent amber "Cancelled" banner + reference line to all three templates, conditional on $invoice->creditNotes->isNotEmpty(). getPdfData() now eager-loads both relatedInvoice and creditNotes unconditionally (cheap either way) so every template has what it needs. Covers all 3 templates x both document types (6 combinations), verified by generating real PDFs (not just Vue previews) for each. 4 new feature tests hit the actual /invoices/pdf/{hash}?preview=1 endpoint under non-default templates (invoice2, invoice3) and assert on template-specific structural markers plus the new banner text, so this class of bug (works on the default template, breaks on the others) cannot regress silently. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Create credit notes as COMPLETED and hide Record Payment on settled documents The credit note is born fully settled (due_amount 0, paid_status PAID), but its own status was hardcoded to SENT at creation and never advanced. It therefore showed a stale "Sent" badge forever and the detail view kept offering "Record Payment" on a document with nothing owed. - InvoiceService::createCreditNote() now creates the credit note with STATUS_COMPLETED, matching the end-state the original invoice reaches through the settlement path. - The "Record Payment" button (detail view) and dropdown item now also require due_amount > 0, so no already-settled document ever offers to record a payment, regardless of its status string. - CreditNoteTest: assert the credit note is created with STATUS_COMPLETED. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * Refresh invoice sidebar list after creating a credit note from detail view Creating a credit note from the split-pane invoice detail view (/admin/invoices/{id}/view) left the left-hand invoice list stale until a manual page reload: the new credit note never appeared, and the original invoice's row kept showing its pre-cancellation status. InvoiceDropdown's createCreditNote() now calls the loadData/table refresh callbacks after success, matching the pattern already used by removeInvoice(). InvoiceDetailView wires loadData to a new refreshInvoiceList() that resets invoiceList before refetching (loadInvoices() is append-only, built for infinite scroll, so calling it without a reset would duplicate every already-loaded row) — mirroring the existing onSearched() reset-and-refetch pattern. Also add the "Cancelled" badge to the sidebar's list-item template; it previously only existed in InvoiceIndexView.vue, so the split-pane sidebar never reflected an invoice's cancelled-by-credit-note state even after a full reload. * fix(migrations): drop the credit-note foreign key constraint related_invoice_id kept a DB-level foreign key with nullOnDelete(). That is against the codebase-wide convention established after the FK breakage in PRs #618 / #683: reference columns are plain unsignedInteger plus an index, with the relation declared on the model and cascades handled in app code. Replace the constraint with an index, and swap the dropForeign() in down() for a dropIndex() that runs before the column drop (MySQL and PostgreSQL would drop the index with the column, SQLite leaves it behind and then fails with "no such column"). Documents why the type default is load-bearing while here: it backfills existing rows with INVOICE, and the type-scoped serial-number queries would otherwise restart numbering on an existing install. * feat(invoices): give credit notes their own number sequence Credit notes were numbered out of the invoice sequence, so cancelling an invoice consumed an invoice number and the two document series interleaved (INV-000001, INV-000002 for a credit note, INV-000003 for the next invoice). Credit notes are Invoice rows with type = CREDIT_NOTE, and SerialNumberService derived both the format setting and the sequence lookup from the model class alone, which cannot distinguish them. SerialNumberService gains two optional, fluent hooks that leave the default behaviour untouched: - setSettingKey() overrides the company setting the format is read from, so a document type sharing a table can have its own format. - setSequenceScope() takes column => value constraints applied on top of the company (and customer) filters in both setNextSequenceNumber() and setNextCustomerSequenceNumber(), so each type counts on its own. createCreditNote() uses both: credit_note_number_format (default {{SERIES:CN}}{{DELIMITER:-}}{{SEQUENCE:6}}) and a CREDIT_NOTE scope. Every call site that numbers a real invoice is scoped to TYPE_INVOICE so the credit notes now sharing the table do not inflate the invoice sequence: create, update, clone, the recurring-invoice generator, estimate conversion, and the factory. The update() scope is not redundant: a customer change there triggers a customer-sequence recompute through setModelObject(), which would otherwise count credit notes. Estimate and payment numbering is unaffected. The format is configurable in Settings alongside invoice numbering (a second NumberCustomizer on the Invoices tab, no component changes needed) and is seeded for new companies by CompanyService. A data migration backfills it for existing companies: without a row, CompanySetting::getSetting() returns null and the generated serial is silently empty. The next-number endpoint answers key=credit_note with the CN format, so the settings preview and any future create form read the right sequence. * feat(pdf): show credit-note and cancellation banners on invoice PDFs The generated PDF is what the customer downloads, prints and receives by mail, and it was silent in both directions: a credit note rendered as an ordinary invoice, and the invoice it reversed carried no sign that it had been cancelled. Only the Vue UI said anything. The banner lives in one partial, resources/views/app/pdf/partials/ credit-note-banner.blade.php, rather than being copied into the three stock templates. It reads the shared $invoice, renders a red CREDIT NOTE box with a reference to the original when the document is a credit note, an amber CANCELLED box naming the credit note when the document has been reversed, and nothing at all otherwise -- pdf:compare reports byte-identical ink boxes for all seven stock templates, so regular documents are untouched. Every rule is inline on the elements. A partial included in the body cannot add anything to <head>, and inline styles are the one thing dompdf and Chromium honour identically; line-height is stated explicitly for the same reason. The box is a plain block with clear: both, so it cannot disturb the float layouts the templates are built on. Custom templates published into the pdf_templates namespace keep rendering exactly as they do today and opt in by including the partial. Alongside it, the cheap label swaps the same document type needs: the <title>, invoice1's and invoice3's number/date labels, invoice2's header heading, and the PDF's own Title/Subject metadata now say Credit Note, and the due-date row is dropped from a credit note, which has none. * feat(invoices): give credit notes the normal lifecycle and guard the unsafe paths A credit note had a parallel universe of its own: a dedicated send endpoint, its own request class, its own two gates and policy methods, all of which duplicated the invoice send path verbatim except for which mailable was constructed. It was also born COMPLETED, which is the one status that hides every Send affordance in the UI, so the endpoint that existed for it could not be reached from the app at all. Both halves are now the invoice's. InvoiceService::send() picks the mailable by document type and sendPreview() picks the matching template, so a credit note goes out through POST /invoices/{invoice}/send under the existing 'send invoice' authorization. The credit-note send route, controller action, service method, SendCreditNoteRequest, and the 'send credit note' / 'view credit note' gates are gone; CreditNotePolicy keeps only create(), which is the one ability that is genuinely different (it is gated on the *source* invoice's company). SendCreditNoteMail and its Blade template stay exactly as they were. The credit note is now created DRAFT with due_date null, still settled (paid_status PAID, both due amounts 0). DRAFT gives it the ordinary create-review-send lifecycle: the Send button appears on the detail page and send() promotes it to SENT. Nothing is owed on it in any status, so Record Payment stays hidden either way. The guards are the other half. A credit note is now immutable (InvoicePolicy ::update returns false: saving it back through the invoice form would recompute its totals positive), cannot be cloned or converted to an estimate (both copy the amounts unnegated), and can never be minted through the create endpoint -- getInvoicePayload() hard-sets type and related_invoice_id, which were previously forwarded straight from the request into Invoice::create. Reversing an invoice that already took a payment, or one that was never issued at all, is refused with a 422 alongside the two existing domain rules. CheckInvoiceStatus only considers real invoices, so a credit note can never be flagged overdue, and the invoice next-number preview is scoped by type like every invoice create path already is, so it can never count credit notes. Test changes follow the behaviour changes: invoices being credited are created SENT rather than relying on the factory's DRAFT default, the "created settled" test now expects DRAFT plus a null due date, the send test goes through the invoice endpoint and asserts the promotion to SENT, and the partially-paid delete-restore test mints its credit note through the service because the API now refuses that invoice. Nine tests cover the new guards. * fix(invoices): stop credit notes distorting counts, queries and deletes Three follow-ups to the credit-note feature, all of them cases where a reversal row was treated as if it were another invoice. Counts. A credit note is not an issued document, so "invoices: 12" must not become 13 the moment one is cancelled. The company dashboard, the customer portal dashboard and its invoice list, and both AI stat tools now count type = INVOICE only. Every sum is deliberately left alone: the negated total is exactly what nets a reversed sale back out of the figure, which is the whole point of storing it that way. The admin index meta count is also left alone, because that list shows credit notes and the count has to match it. Queries. InvoiceResource probed creditNotes twice per row -- an exists() then a fetch -- on a resource that is serialized for every row of a paginated list, and CreditNoteResource did the same for relatedInvoice. Both now read the loaded relation and emit nothing when it was not loaded, and the two places whose UI consumes the field (the index list badge, which also feeds the detail-page sidebar, and the detail page banner) eager-load it with the two columns they need. Deletes. related_invoice_id has no DB foreign key by convention, so both sides of the cascade have to be written out. Deleting an invoice whose credit note is not in the same batch is now a validation failure -- RelationNotExist cannot express "unless it is also going", so the rule takes the whole ids list. And InvoiceService::delete() nulls out any surviving pointer into the deleted batch, so even a caller that bypasses the request layer cannot leave a credit note referencing a row that is gone. Also: creating a credit note from the dropdown swallowed server errors, so a refused reversal (paid invoice, draft, already credited) looked like it had worked. It now surfaces the message the way the sibling actions in the app do. * fix(i18n): translate credit-note guard errors and complete locale coverage The create/clone/convert guards throw ValidationException with bare snake_case keys, and none of them were in ERROR_TRANSLATION_MAP, so the toast rendered the raw key instead of a sentence. - map the six guard keys to new errors.* translations - give clone and convert-to-estimate a catch so their guards surface at all, and factor the toast into showApiErrorNotification() - add every credit-note string to fr, it and mk (avoir / nota di credito / книжно одобрение) so the branch ships in all five maintained locales - proofread the German: "durch" instead of "via", reword errors.credit_note_attached * refactor(db): consolidate credit-note migrations into one Nothing in PR #689 has shipped, so the branch's two separate migrations are squashed into a single 2026_08_02_120000_add_credit_note_support. Installs upgrading to 3.0.0 apply one migration instead of three, and the columns the next phases need land in the same file rather than as follow-ups. Carried over unchanged from the deleted files: the INVOICE default on invoices.type (it backfills existing rows so they stay inside the type-scoped serial-number queries), the no-FK unsignedInteger convention for related_invoice_id per PRs #618 / #683, the SQLite requirement to dropIndex before dropColumn in down(), and the company_settings backfill of credit_note_number_format for installs predating independent credit-note numbering. New in this migration, for partial credit notes: - invoices.credit_reason (nullable text) - invoice_items.source_invoice_item_id (nullable unsignedInteger + index), recording which line of the original invoice a credit-note line credits - taxes.base_amount widened to a signed bigInteger The base_amount change fixes a pre-existing bug, not just a credit-note need. taxes.amount was made signed in 2024_02_08_181804_taxes_amount_as_signed but base_amount, added as unsignedBigInteger in 2021_07_16_075100, was left behind, so any negative tax row on a company with an exchange rate is rejected outright under strict-mode MySQL. CreditNoteSchemaTest covers the new columns and their nullability, the INVOICE default, a Tax row with a negative base_amount, a negative-price invoice item linked to its source line, and the seeded credit_note_number_format setting. Round-tripped up and down on both SQLite and MySQL 8.0. * feat(credit-notes): add the pure telescoping credit-note calculator CreditNoteAmounts computes partial and full credit notes from a plain-array snapshot of the original invoice, with no Eloquent involved. Every credit is the difference between two cumulative credits derived from the original's stored integers, so crediting a line in chunks sums back to the invoice to the cent and the order of the chunks does not matter. Quantities are carried as integer hundredths, money stays in integer minor units, and rounding is the same half-away-from-zero rule DocumentTotals uses. Fixed-amount tax rows are pro-rated like percentage ones (otherwise a flat tax is credited once per chunk and exceeds what was invoiced), and percentage rows are pro-rated from the stored amount rather than re-derived, so a full credit reproduces the invoice instead of re-making a rounding decision. * feat(credit-notes): credit an invoice line by line, not all at once A credit note is no longer a whole-invoice reversal. CreditNoteService takes the lines and quantities to credit (an empty list still means everything that is left) and drives CreditNoteAmounts, so an invoice can be credited in as many pieces as needed. The model is telescoping, not incremental: each credit note is the difference between the cumulative credit at the quantities credited after it and the one before it, both derived from the original invoice's stored integers and never from earlier credit notes. Chunks therefore sum back to the invoice to the cent in every field, in any order, and a fully credited invoice nets to zero. Because those integers are already exact, the line items are written with recompute disabled: re-deriving a total from price times quantity, or a base_* column through the exchange rate, would round a second time and break the identity by a cent. How much of each line is already credited is read off the surviving credit notes through source_invoice_item_id, so deleting one gives its quantities back with no separate bookkeeping. The invariants live in the service, under a row lock, because each is a read-then-write on the invoice: nothing may be credited twice, no line beyond what was invoiced, and no more in total than the invoice's unpaid balance. The one-credit-note-per-invoice and no-payments guards in the controller are gone, replaced by those. Paid status and balance are kept apart. A credit is not a payment: an invoice credited in part is still UNPAID, just for less, and only the payments decide whether it reads PARTIALLY_PAID. recalculateBalance() owns that rule and runs only when a credit note is created or deleted, which is why it does not live in getInvoiceStatusByAmount(): PaymentService::create() adjusts the invoice before the Payment row exists, so a payments-derived rule there would read a stale sum. PaymentService::delete() now derives the status from the payments that remain rather than from due == total, which is the same answer on an uncredited invoice and the correct one on a credited one. A credited invoice is frozen (its item ids anchor the credit-note lines), the reason for a credit is stored and cannot be written through the invoice form, and the invoice resource reports how much has been credited, whether that is partial or full, and how much of each line. * feat(credit-notes): choose the lines and quantities to credit in the UI Creating a credit note was a yes/no dialog that reversed the whole invoice, which is all the API could do. The API now credits any subset of the lines, so the front end has to ask which ones. The dropdown action opens a form instead of a confirmation: one row per invoice line showing what was invoiced, what is already credited and what is left, with the remaining quantity pre-filled and editable. Quantities are compared in integer hundredths so the last unit of a line is never blocked by float drift, and selecting every line at its full remaining quantity on an untouched invoice is sent as the no-items full reversal the server already implements. Only the line subtotals are shown: discounts and taxes are apportioned by the server's calculator, so re-deriving them here would disagree with the document that gets written. The note under the table says so. The "Cancelled" badge and banner now key on credited_status rather than on the presence of any credit note, so a partly credited invoice reads as partly credited and keeps its real paid status alongside. * feat(credit-notes): show partial credits on the document and in every locale The PDF said one of two things about a credited invoice: nothing, or "Cancelled". Partial credits made both wrong. An invoice credited by half now carries a Partially Credited banner naming the amount and the credit notes it came from, a fully credited one lists every credit note rather than the first, and the credit note itself prints the reason it was issued. The totals block was the more dangerous half. It was gated on paid_status, so an invoice settled by a credit note announced "Amount Paid" for money nobody sent. It now splits the two: Amount Credited comes off the credit notes, Amount Paid is whatever the balance dropped by beyond them. For a document with no credit notes the arithmetic collapses to the old expression and the rendering is unchanged word for word and position for position, checked against dompdf output and against pdf:compare across all seven stock templates. The reason is operator-written free text, so it is echoed escaped rather than through @lang, which does not escape. Locale-side, the phase-4 English-only strings are translated into the four maintained catalogues, and the two guards partial crediting retired (one credit note per invoice, and no crediting an invoice with payments) are deleted everywhere so no translated install can still show them. A test walks all five catalogues and fails on either a missing key or a surviving one. The dashboard's recent-due list eager-loads the credit notes so its rows can tell a credited invoice from a paid one. * fix(payments): stop an overpayment from silently vanishing A payment carried no maximum, so any amount larger than the invoice's outstanding balance was accepted. PaymentService then handed it to Invoice::subtractInvoicePayment(), which drove the balance negative, and Invoice::getInvoiceStatusByAmount() returns an empty array for a negative amount, so the status change was never applied. The money was recorded against an invoice whose balance and paid status no longer described it. The bug predates credit notes, but partial credit notes shrink an invoice's balance without shrinking its total, which makes it easy to walk into. PaymentRequest now caps the amount at the invoice's due amount. On an edit of a payment that already belongs to that same invoice its own amount returns to the pool, matching what PaymentService::update() does; a payment with no invoice stays uncapped. The message string is the translation key, as elsewhere in the app, and is mapped and localized in all five shipped locales. The 'update payment' fixture stacked two randomly sized payments on a randomly sized invoice, which the cap turns into an intermittent failure, so its amounts are pinned. * fix(payments): show the rejected-save message on the payment form The create-payment view swallowed every API failure in a bare catch, so a validation rejection, including the new remaining-balance cap, looked like a save that silently stalled. The catch now routes the error through the shared toast path the other forms use. * fix(dashboard): stop the recent-due list crashing on partial credits The recent-due invoices are serialized as raw models, so every loaded relation runs the full $appends set. The column-limited creditNotes eager load left its children without company_id, the company date-format lookup returned null, and formattedCreatedAt took the endpoint down with a 500. The relation is not needed there at all: credited_status is a resource field the raw payload never carried, and a fully credited invoice has no due amount so it never appears in this list. Drop the eager load and pin the scenario (a partially credited invoice among the recent due) with a test that fails 500 on the old code. --------- Co-authored-by: Linus <lkurz@posteo.de> Co-authored-by: Darko Gjorgjijoski <dg@darkog.com>	2026-08-01 22:15:00 +02:00
Darko Gjorgjijoski	773670c18f	feat(pdf): archival PDF/A output and document properties (#732) ... Generated files carried no document properties at all, so an archive of them showed a column of blank titles and no author. Title, Subject, Author and Creator are now written from the document number and company, on both drivers: dompdf via addInfo(), Gotenberg via metadata(). dompdf needed more than the API call. It reads Title from the <title> element during render(), which happens after addInfo(), so metadata set through the API alone was silently overwritten by whatever the template put there and the two drivers disagreed about what the file was called. The title is written into the markup as well, escaped. Also adds an archival format setting for Gotenberg: off, PDF/A-1b, -2b or -3b. PDF/A-3 is what the EU e-invoicing formats expect. Verified against a stock gotenberg:8 -- LibreOffice inside the image does the conversion and the output carries the right pdfaid:part in its XMP -- so no extra components are needed. A fixed list rather than free text, because the SDK forwards whatever it is given and an unsupported value would surface only as an HTTP error from the service at render time. Empty is a real choice meaning an ordinary PDF, so it overrides an env default rather than falling through it. Gotenberg only: dompdf cannot produce PDF/A. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF	2026-08-01 14:37:22 +02:00
Darko Gjorgjijoski	05e8acc3b1	feat(pdf): let payment receipts and reports be overridden too (#731) ... Only invoices and estimates could be customised. Payment receipts and all five reports were hardcoded to app.pdf.*, so changing them meant editing files inside the image -- and losing the edit on the next upgrade. Those documents have no template picker and no design to choose between, so overriding one is not a selection: it is a same-named file in storage/app/templates/pdf/{type}/ winning over the built-in. PdfTemplateUtils:: resolveView() is that rule, and it needs no setting, no column and no UI. resolveView asks View::exists rather than checking the storage disk. The disk and the view namespace are registered separately and could disagree about where custom templates live; asking the thing that will actually render removes that possibility. make:template covers the new types. Their names are not free, since an override replaces one specific document, so it validates against the real list -- 'payment' for payments, and the five report names -- and reports what is available when the name is wrong. Neither type gets a preview image written, having no picker to show one in. The payment preview route also went through the built-in view directly rather than the service, so ?preview ignored an override and rendered with none of the shared data. It goes through the service now, like invoices and estimates. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF	2026-08-01 13:01:15 +02:00
Darko Gjorgjijoski	713e0bc2e8	feat(pdf): repeating page headers and footers, and page numbers (#729) ... Takes over #690 by csoscd. The companion-view idea is theirs; this reworks it onto the shared page setup and fills in the gaps that stopped it landing. A `{template}_header` or `{template}_footer` view next to a template is rendered alongside it and repeated by Chromium on every page. The suffix resolves through the pdf_templates:: namespace too, so custom templates get it with no extra wiring. Two things had to change for that to be useful. Companion views are now hidden from the template picker. getFormattedTemplates() lists every .blade.php it finds, so an invoice1_footer would otherwise appear as a separately selectable template with no preview image -- the feature would have introduced that the moment anyone used it. And it does something out of the box. #690 shipped no companion views, so both of its margin settings were visible no-ops until someone hand-wrote a Blade file. Instead there is a pdf_page_numbers setting, off by default, that supplies a footer when a template has none. A template's own companion still wins, so turning page numbers on cannot overwrite a designed footer. The setting sits under Gotenberg because only Chromium can repeat a footer; dompdf has no equivalent. Its value is still carried by the dompdf form so saving from there cannot clear the choice -- the field is absent from that payload, and the controller only writes it when present. Margins come from the page setup rather than #690's separate header_margin and footer_margin. Chromium draws header and footer inside the page margin, so the existing margins are the space they occupy; two more settings for the same distance would have been a second way to say the same thing. Verified against a live gotenberg:8 on a two-page document: off produces no footer, on produces "1/2" and "2/2" on the respective pages, and a companion footer replaces both. #690's own test is not carried over. It asserted nothing: a bare View::shouldReceive('exists') is an allowance rather than an expectation, andReturn(false) never entered the companion branch, and the call sat inside try { } catch (Throwable) { }, so it passed with the feature deleted. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF	2026-08-01 12:52:47 +02:00
Darko Gjorgjijoski	a54a5ee007	feat(pdf): one page setup, honoured by both drivers (#728) ... Paper size was a Gotenberg-only setting stored as a single "210mm 297mm" string. dompdf had no page settings at all: size was pinned to config/dompdf.php's fixed 'a4', its top-level `orientation` key was read by nothing (the installed barryvdh v3 builds options only from `defines`), and margins were whatever dompdf's own stylesheet said. So the two drivers disagreed about margins by default -- dompdf 1.2cm, Gotenberg hardcoded to zero -- and selecting dompdf silently discarded the paper size. Replaces gotenberg_papersize with pdf_paper_width / pdf_paper_height / pdf_orientation / pdf_margin_{top,right,bottom,left}, saved and applied for either driver. Width and height are separate CSS lengths because that is the only lossless shared notation: Gotenberg has no named sizes, and dompdf's named table cannot express everything Gotenberg accepts. Named presets (A3/A4/A5/ Letter/Legal) are a convenience in the UI that resolve to a pair of lengths. PdfPageSetup resolves it once and translates: a points array plus an orientation argument for dompdf, CSS lengths plus landscape() for Gotenberg. Both are handed the portrait pair, since each swaps the axes itself. Gotenberg's margins() takes top, bottom, left, right, which is not the CSS order. dompdf exposes no margin API, so DompdfDriver injects an @page rule -- at the top of <head>, so a template declaring its own still wins. Doing it in the driver rather than a Blade partial means custom templates get it without including anything. Margins default to 1.2cm, dompdf's existing default, so Gotenberg starts matching it rather than rendering edge-to-edge. Verified against a live gotenberg:8: A4 portrait, A4 landscape and Letter at zero margins all come out with the same page box and the same ink offsets on both drivers. A malformed length now throws rather than being ignored. Blank still falls back, but a value that is set and wrong is an operator mistake, and the drivers would otherwise fail differently: dompdf throws converting to points, Gotenberg would forward the string and render at some other size. Also here: - Migration splits an existing gotenberg_papersize into the new pair. It earns its place because that key ships in 2.x, not just a 3.x alpha, so a stable install that chose Letter would otherwise come back up on A4. Drops gotenberg_margins, which 2.x also stores and neither driver ever read. - Removes EnvironmentManager::savePDFVariables/getPDFConfiguration, which had no caller anywhere, and the unused EnvironmentManager injection in the controller. - config/dompdf.php: drops the dead `orientation` key and defaults enable_remote to false, matching .env.example, which sets it explicitly and explains why. Installs predating that line were falling back to true. - Retires the settings.pdf.footer_text and pdf_layout strings, which no component referenced. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF	2026-08-01 12:48:51 +02:00
Darko Gjorgjijoski	6cb754da60	fix(pdf): give both drivers one contract, and fix what that was hiding (#727) ... PdfDriver and ResponseStream existed but nothing implemented them. The factory returned the vendor dompdf wrapper for one driver and a bespoke class for the other, so the two were never held to the same shape. Three things had slipped through that gap. Report PDFs answered 403 for everyone. The five report routes carry no company header, so ScopeBouncer is not in their middleware stack and the ability scope was never set; 'view-financial-reports' is stored scoped to a company, so the check could not pass. They now scope to the company named in the URL. The policy still checks membership, so this grants nothing new. Also firstOrFail() on the hash lookup, so an unknown company is a 404 rather than a 500 on a null. Report downloads were fatal on Gotenberg. GotenbergPdfResponse had no download(), and the report controllers are its only callers. Added, alongside stream() and output(), with the whole set now on the interface. Streamed documents carried an HTTP preamble. GeneratesPdfTrait wrapped $pdf->stream() -- already a Response -- in another response()->make(), which stringified it and prepended "HTTP/1.0 200 OK" plus headers to the file. Readers scan the first kilobyte for %PDF so nobody noticed, but the bytes were malformed. Passing ->output() fixes it, and the render test now asserts the position. Two driver-parity settings, both checked against a real gotenberg:8 rather than inferred: emulateScreenMediaType(), because Chromium defaults to print media while config/dompdf.php renders as screen, so a @media print rule applied on one driver and not the other; and printBackground(), which turns out to affect only the root background, since Chromium paints element backgrounds either way. No stock template sets a body background, so that one changes nothing today and is here to keep custom templates consistent across drivers. Claude-Session: https://claude.ai/code/session_01QmECndmNZwzN65Zz9P87dF	2026-08-01 12:43:31 +02:00
Darko Gjorgjijoski	fdd958c1e5	fix(setup): support mariadb in the installation wizard (#704) ... Fixes InvoiceShelf/docker#79 — a fresh install using the shipped docker-compose.mysql.yml cannot get past the database step, because that compose file sets DB_CONNECTION=mariadb. getDatabaseEnvironment() switched on sqlite, pgsql and mysql with no arm for mariadb and no default, so it answered {"config":[]}. The wizard chooses which form to render from database_connection in that response, so step 4 rendered blank with no way forward — and nothing reached the log, because the app never errored, it just replied with nothing. Adds the mariadb arm, and a default so an unrecognised driver can never again produce an unrenderable response: it is echoed back with the server defaults, leaving the fields editable rather than the step empty. MariaDB is now offered in the driver dropdown too. It was already a valid DB_CONNECTION with its own connection in config/database.php, and the form fields are identical to MySQL's. Tested against the original code, where three of the new cases fail with "Failed asserting that null is identical to 'mariadb'".	2026-07-29 12:29:01 +02:00
Darko Gjorgjijoski	9e496102d4	feat(updater): disable the in-app updater in containerized installs ... The Docker image already injects CONTAINERIZED=true; consume it via config('invoiceshelf.containerized'), expose it on /app/version, block the update endpoints + console command, and show a 'docker compose pull' panel instead of the updater. Adds missing i18n keys. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 23:42:11 +02:00
Darko Gjorgjijoski	d3202b8b2a	fix(members): scope member view & update to the acting company ... Member view/update bound the target user by global id and authorized only that the requester owns their active company, not that the target belonged to it. Bind the route model under the members param and require shared company membership in UserPolicy so an owner of one company can no longer read or modify users of another. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>	2026-06-14 23:42:11 +02:00
Darko Gjorgjijoski	e56b6b4fe5	fix(security): harden public EmailLog token endpoints (GHSA-73q7) (#669) ... v3 port. Customer PDF controllers resolved the target document by raw mailable_id ignoring mailable_type, and skipped expiry on the JSON endpoints. - Resolve via $emailLog->mailable + assert the expected type (404) to close cross-type disclosure. - Enforce isExpired() (403) on every public path incl. the JSON endpoints. - Harden EmailLog::isExpired() against a null/unresolvable mailable. Adds tests for cross-type 404, JSON-path expiry 403, and the valid path.	2026-06-12 11:02:11 +02:00
Darko Gjorgjijoski	c6a00df120	fix(security): enforce company scope on notes, doc-convert, and member bulk-delete (#668) ... v3 port of the v2 authorization fixes. - Notes IDOR (GHSA-85wc): NotePolicy checks the note's company_id and NotesController passes the bound model to authorize() on show/update/destroy. - Estimate<->Invoice convert IDOR (GHSA-j2vg): EstimatesController::convertToInvoice and InvoicesController::convertToEstimate authorize 'view' on the source document before creating the target. - Member bulk-delete (GHSA-wxrv): MembersController scopes ids via User::whereCompany() before MemberService::delete. Adds feature tests for cross-company 403s + same-company happy paths.	2026-06-12 11:02:08 +02:00
Darko Gjorgjijoski	ac2a8ca939	fix(security): gate AI tools by user ability and block admin-URL SSRF ... The AI chat assistant scoped tool queries by company but ignored the per-user Bouncer abilities the rest of the app enforces, so any `use ai` holder could read customers, invoices, payments, and company financials their role couldn't otherwise see. Each AiTool now declares a required ability (entity-aligned); the registry hides unauthorized tools from the model and refuses to execute them as a backstop. Separately, admin/owner-supplied URLs were fetched server-side with no guard against private/reserved targets (SSRF): the AI base URL, the CurrencyConverter "DEDICATED" exchange-rate URL, and S3/Spaces file-disk endpoints. A shared PrivateNetworkGuard now backs a PublicHttpUrl validation rule (save-time) and runtime guards in each driver. - AiTool::requiredAbility() + mapping across all 12 tools - AiToolRegistry filters schemas() by ability and re-checks in execute() - PrivateNetworkGuard / BlockedUrlException / PublicHttpUrl rule (new) - Rule wired into AI config (service + 3 controllers), exchange-rate, and file-disk endpoints; runtime guards in OpenRouterDriver, CurrencyConverterDriver, and FileDiskService - Tests for ability filtering, the guard, the rule, and 422 rejections	2026-06-05 00:01:09 +02:00
Darko Gjorgjijoski	b761ea9931	feat(ai): Phase 3 — text generation popup on WYSIWYG editors ... Third and final phase of the AI feature. A SparklesIcon button is added to every Tiptap WYSIWYG editor (invoice notes, email body compose, note templates — ~6 places where RichEditor is used) that opens a modal with a prompt input, optional 'use current content as context' toggle, preview area, and Insert / Replace / Regenerate actions. **Backend (thin)** — AiTextGenerationService is stateless: resolve config → check text_generation_enabled → instantiate driver → call textCompletion() with a system-prompt-wrapped user instruction. The system prompt is terse and opinionated: 'Return only the requested text. No preamble, no explanation, no markdown code fences.' When context is provided, it's included as a separate framed block ('Context (current content the user is working with):') so the model knows it's operating on existing copy. **GenerationController** — POST /api/v1/ai/generate with {prompt, context?}. Validates prompt required (max 4000 chars) and context optional (max 20000 chars). Rate-limited via the same 'ai' RateLimiter from Phase 2 (30/min per user/company). Gated by 'use ai' Bouncer ability + AiConfigurationService resolution. Returns {text} on success or {error, message} with 422 on any AiException. **Frontend modal (AiTextGenerationModal.vue)** — mounted globally in CompanyLayout when bootstrap reports ai.enabled && text_generation_enabled. Uses the existing modalStore pattern: self-registers on componentName='AiTextGenerationModal'. Modal state includes prompt, useContext toggle, generatedText preview. Callers (currently RichEditor) pass onInsert/onReplace callbacks via modalStore.data; the modal invokes them with the final text and closes — it knows nothing about tiptap or ProseMirror. **RichEditor integration** — the Sparkles toolbar button is pushed onto the existing editorButtons ref at setup time, gated on globalStore.ai.enabled && text_generation_enabled. The button opens the modal with the editor's current getHTML() as context and callbacks that use the tiptap chain API: insertContent for Insert, selectAll().deleteSelection().insertContent for Replace. No reactivity on the flag check — it's set once at bootstrap and doesn't change during a session. **Tests** (7 new) — AiGenerationTest with a dedicated TextGenDriver test double that tracks the exact prompt passed to textCompletion(). Covers: happy path, context inclusion/omission, AI globally disabled rejection, text_generation role disabled rejection, prompt/context length validation, response whitespace trimming. 395 tests pass (was 388, +7 new). Pint clean. npm run build clean. The AI feature is now complete end-to-end: provider configuration (Phase 1), chat assistant with DB tool-calling (Phase 2), and text generation popup (Phase 3).	2026-04-12 11:00:00 +02:00
Darko Gjorgjijoski	e861fc1fc1	feat(ai): Phase 2 — chat assistant with tool-calling ... Second phase of the AI feature. Users can now open a slide-in chat drawer from the SiteHeader and ask natural-language questions about their company's invoices, customers, payments, and expenses. The LLM invokes pre-defined read-only tool functions (scoped to the current company at execute time) to fetch data and synthesize answers. **Database** — new ai_conversations and ai_messages tables. Messages are stored in OpenAI's chat format so AiAssistantService serializes a conversation into an API request with zero translation. Columns: role, content, tool_call_id, tool_calls JSON, model, tokens_in, tokens_out. Conversations are scoped (company_id, user_id) — one user's chats are invisible to everyone else, even inside the same company. Foreign-key cascade deletes. **Tool infrastructure** — AiTool abstract base + AiToolRegistry singleton (registered in a new AiServiceProvider). The base class enforces the security rule: every tool's execute() receives companyId and userId as injected parameters; tools' JSON schemas NEVER include a company_id field. An LLM physically cannot pass a company_id and escape tenancy. Modules can register their own tools by resolving the registry from their own ServiceProvider::boot(). **Nine built-in tools**: search_invoices, get_invoice, search_customers, get_customer, list_recent_payments, list_overdue_invoices, get_company_stats (aggregates for named periods), search_items, list_expense_categories. All read-only; no mutations. Each returns JSON-encodable data the LLM can parse. **AiAssistantService orchestration loop** — the heart of Phase 2. Flow: persist user message → build payload from system prompt + recent history (40-message window) + new user message → call driver.chatCompletion with tools → if tool_calls, execute each one via the registry (with injected scope), persist tool result, loop → if plain text, persist and return. Hard cap at 5 iterations to prevent runaway LLMs. System prompt pins the assistant to this company's data and forbids mutation. **Controllers + policy + rate limit** — POST /api/v1/ai/chat runs the orchestration loop. GET/PATCH/DELETE /api/v1/ai/conversations for CRUD. AiConversationPolicy enforces user_id+company_id match on every action. A new 'ai' RateLimiter in RouteServiceProvider throttles to 30 req/min per (user, company). New 'use ai' Gate defined in AppServiceProvider returns true for any authenticated user — the per-company kill-switch still goes through AiConfigurationService::resolveForCompany. **Frontend** — new features/company/ai/ folder with a Pinia store (ai-chat.store.ts) holding drawer state, current conversation, messages, and loading flags. AiChatDrawer.vue is a slide-in panel teleported to <body>, mounted globally in CompanyLayout.vue when bootstrap reports ai.enabled && ai.chat_enabled. Sub-components: AiChatMessage (user bubbles vs assistant bubbles), AiChatMessageInput (Enter submits, Shift+Enter newline), AiChatConversationList (sidebar with 'new chat' button, rename, delete). A SparklesIcon button in SiteHeader toggles the drawer. **Driver test double** — tests use a ScriptedAiDriver registered via AiDriverFactory::register('scripted', ...) that returns pre-queued AiChatResponse objects. Feature tests cover: happy path (new conversation + message persistence), tool-call loop (multi-round-trip with search_invoices), runaway-loop cap, driver-throws path, ai_enabled=NO rejection, chat role disabled rejection, per-user conversation visibility, cross-user policy enforcement, cascade delete. 388 tests pass (was 372, +16 new). Pint clean. npm run build clean. Phase 3 (WYSIWYG text generation popup) is the remaining follow-up.	2026-04-12 08:00:00 +02:00
Darko Gjorgjijoski	c7fab5d52f	feat(ai): Phase 1 — provider configuration, installer step, admin + company settings ... Foundation for the AI chatbot + text generation feature. Phase 1 is infrastructure only: driver plumbing, configuration storage with encrypted API keys, global vs per-company resolution, admin + company UI pages, and an optional installer wizard step. The chat assistant and text-generation WYSIWYG integration come in later phases. **Driver plumbing (app/Support/Ai/)** — AiDriver abstract, AiDriverFactory, AiException, AiChatResponse DTO, OpenRouterDriver concrete implementation. OpenRouter is the OpenAI-compatible aggregator that unlocks hundreds of models behind one API key and one request shape — ideal as the default v1 driver. Drivers are extensible the same way exchange rate drivers are: the module Registry's generic registerDriver('ai', ...) machinery plus a typed Registry::registerAiDriver() convenience wrapper (shipped in the upstream invoiceshelf/modules package in a paired commit). **AiConfigurationService** — mirrors MailConfigurationService shape but with one deliberate deviation: API keys are encrypted at the service layer via Crypt::encryptString before persistence. OpenRouter bearer tokens have much bigger blast radius than SMTP passwords. Same settings / company_settings tables, same global-vs-per-company pattern, same use_custom_ai_config override toggle. Resolution order: global ai_enabled must be YES, then the company either overrides via use_custom_ai_config=YES (and can opt out with ai_enabled=NO inside the override) or inherits the global config. **Controllers** — Admin/Settings/AiConfigurationController (global CRUD + driver list + test connection), Company/Settings/CompanyAiConfigurationController (per-company override + test), Setup/AiConfigurationController (installer wizard step, skippable with explicit ai_enabled=NO). API key is always masked as '********' in GET responses — the frontend submits the placeholder back on save and the backend preserves the stored value. **Installer wizard** — new optional step 7 'AI' between Mail and Account. Default OFF with a Skip button. MailView.vue now routes to installation.ai instead of installation.account; installation.ai then routes to installation.account. Step order comment updated in routes.ts. **Admin + Company settings pages** — AdminAiConfigView (no toggle, always global) and AiConfigView (with use_custom_ai_config BaseSwitchSection that auto-saves OFF). Both share AiConfigurationForm which renders the driver selector, API key input with show/hide, driver-specific config_fields (base_url for OpenRouter), and per-role enable toggles with free-text model inputs backed by a datalist of suggested models from driver metadata. **Bootstrap endpoint** — adds an ai block to the response: { enabled, chat_enabled, text_generation_enabled }. All three are booleans resolved through AiConfigurationService::resolveForCompany(). Never leaks the API key. Frontend feature flags read from bootstrapData.ai to decide whether to show Phase 2/3 UI. **Bouncer ability** 'manage ai config' added to SettingsPolicy, gated on isSuperAdmin() (same pattern as manage email config, manage pdf config). **Tests** (22 new) — Unit: AiDriverFactory resolves built-in + Registry-contributed drivers, rejects unknown, merges availableDrivers. AiConfigurationService: encryption round-trip, resolution order (3 cases: global off, inherit global, override with company key, override with opt-out), makeDriver null/instance cases, listDrivers metadata. Feature: admin save + read with api key masking, preserve-on-placeholder behavior, company toggle ON/OFF semantics, bootstrap ai flags reflect resolution, company opt-out path. 372 tests pass (was 350, +22). Pint clean. npm run build clean. Phase 2 (chat assistant + tool calling) and Phase 3 (WYSIWYG text generation popup) are separate follow-up commits — this one is the foundation only.	2026-04-11 22:00:00 +02:00
Darko Gjorgjijoski	47907f9bf3	refactor(support): flatten Integrations umbrella and rename Formatters to Formatting ... Two plural outliers were the only directories in Services/ and Support/ that didn't follow the singular naming convention we normalized in commit 947d00a9 (Documents -> Document). **Integrations/ExchangeRate/ -> ExchangeRate/.** The Integrations/ umbrella was both plural AND introduced an extra layer of nesting no other Support subdir had (Pdf/, Hashids/, Module/, Update/ are all one level deep). Dropping the umbrella fixes both problems in one move and matches the existing shape. When AI providers eventually land, they follow the same pattern as Support/Pdf/: a sibling subdir at Support/Ai/, not buried under an umbrella. **Formatters/ -> Formatting/.** Formatter (singular noun) would have been awkward; Formatting (gerund describing the capability) reads naturally as a namespace segment. The subdir holds DateFormatter, TimeFormatter, TimeZones — classes whose common thread is 'things that do formatting', which the gerund captures better than either the singular or plural noun form. 10 files renamed, 4 consumers updated (DriverRegistryProvider, ExchangeRateProviderService, FormatsController, ExchangeRateDriverFactoryTest). 350 tests pass, Pint clean.	2026-04-11 18:00:00 +02:00
Darko Gjorgjijoski	f657b53215	refactor(services): split driver infrastructure out of Services into Support ... Services/Integrations/ExchangeRate/ and Services/Pdf/ were both mostly Support-shaped: interfaces, abstract classes, static factories, concrete adapter drivers, DTOs, and exceptions — infrastructure that doesn't carry business logic. They only each had one real DI-injected service mixed in. This commit applies the same Services=DI-business-logic / Support=stateless-plumbing rule we've been using throughout the reorg: **Moved to Support/Integrations/ExchangeRate/** (7 files): ExchangeRateDriver (abstract), ExchangeRateDriverFactory (static), ExchangeRateException, and the four concrete drivers (CurrencyConverter, CurrencyFreak, CurrencyLayer, OpenExchangeRate). These are HTTP adapters over third-party currency APIs — same shape as the Hashids library wrapper classes already in Support. **Moved to Support/Pdf/** (6 files, merging with existing Pdf utilities): PdfDriver (interface), PdfDriverFactory (static), PdfService (static facade), GotenbergPdfDriver, GotenbergPdfResponse (DTO), ResponseStream (interface). The Support/Pdf/ dir now contains the full PDF rendering subsystem — drivers + sanitizer + template/image utilities. **Promoted to Services/ root** (the real DI services): ExchangeRateProviderService (CRUD for ExchangeRateProvider model) and FontService (font package install/download orchestration). Both are proper DI services — instance methods, model writes, HTTP side effects. Services/Integrations/ and Services/Pdf/ are now empty and deleted. Services/ holds only DI-injected classes; Support/ holds all the plumbing. 17 files renamed (git detects 90-99% similarity), 4 consumer files updated (DriverRegistryProvider, PdfServiceProvider, ExchangeRateProviderController, FontController, GeneratesPdfTrait, test). 350 tests pass, Pint clean.	2026-04-11 16:30:00 +02:00
Darko Gjorgjijoski	4c3d809f89	refactor(support): group Bouncer, Media, Setup files into subdirs ... Finishes the Support/ consolidation pass: the three remaining root-level files get grouped into purpose-named subdirs, matching the shape the Pdf/, Hashids/, Update/, and Module/ subdirs took in the earlier sweep. - BouncerDefaultScope → Support/Bouncer/ (Bouncer-specific authorization scope) - CustomPathGenerator → Support/Media/ (Spatie MediaLibrary path generator — media config references it from config/media-library.php) - InstallWizardAuth → Support/Setup/ (folded into the existing Setup/ subdir alongside EnvironmentManager, FilePermissionChecker, InstallUtils, RequirementsChecker — it's install-wizard-flow state) 4 consumer files updated (AppServiceProvider, LoginController, UseInstallWizardTokenAuth middleware, config/media-library.php). app/Support/ root is now completely empty of standalone PHP files except helpers.php.	2026-04-11 15:00:00 +02:00
Darko Gjorgjijoski	8cc4a6fa98	refactor(services): move ModuleInstaller to app/Support/Module ... ModuleInstaller has the same shape as Updater (moved in 7cf72b9f): every method is public static, no constructor, no DI, no instance state. It orchestrates marketplace operations — fetch catalog, download zip, verify checksum, unzip, copy files, run module:migrate/module:enable, dispatch install/enable events — but the orchestration itself is stateless procedural plumbing. Emitting events and writing to the Module eloquent model doesn't make it a service; plenty of static helpers touch models. The distinguishing factor is stateless-procedural vs DI-injected-workflow, and this is clearly the former. 4 consumers updated: ModulesController, ModuleInstallationController, InstallModuleCommand, and a doc comment in config/invoiceshelf.php. 350 tests still pass. This leaves app/Services/ with no single-file driver-less subdirs except Mail/Module/Pdf/Storage which have multiple files each. The Module/ subdir in Services is now deleted entirely — the marketplace installer moved out and there were no other files in there.	2026-04-11 13:30:00 +02:00
Darko Gjorgjijoski	7cf72b9f1d	refactor(services): move Updater to app/Support/Update ... Updater is a pure static procedural class — all eight public methods (checkForUpdate, download, unzip, copyFiles, deleteFiles, cleanStaleFiles, migrateUpdate, finishUpdate) are static, there's no constructor, no DI, no instance state. It's stateless self-update plumbing, same character as the Setup/ helpers that moved to Support/ in commit 6d1816bd. Moving it out of Services/ leaves Services/ exclusively for DI-injected classes with real business logic, which is the contract the reorg was aiming for. Update/ now lives next to Setup/ in Support/ where the other install/upgrade-time utilities live. Only 3 consumers needed touching: UpdateController, UpdateCommand, and a reference in config/invoiceshelf.php's comment. 350 tests still pass.	2026-04-11 12:30:00 +02:00
Darko Gjorgjijoski	947d00a9f1	refactor(services): Documents→Document + ExchangeRate→Integrations/ExchangeRate ... Two follow-ups to the Services reorg that landed in 6d1816bd. **Documents → Document** (singular). Documents/ was the only plural subdir in app/Services/ — every other bucket (Company, Mail, Module, Pdf, Storage, Update, ExchangeRate) was singular. Renaming to Document/ normalizes the whole tree. **ExchangeRate → Integrations/ExchangeRate**. Introduces Integrations/ as an umbrella for external-service adapter subsystems. Exchange rate providers move in first; AI providers, payment gateways, and any other driver-pattern integrations land as sibling subdirs (Integrations/Ai/, Integrations/Payment/) without another reorg. Integrations/ was chosen over Providers/ to avoid conceptual collision with Laravel's app/Providers/ — 'check the providers' shouldn't be ambiguous. 17 files moved, 21 consumer files rewritten to point at the new namespaces via literal-string replacement (same approach as the previous reorg). 350 tests pass, Pint clean.	2026-04-11 11:30:00 +02:00
Darko Gjorgjijoski	6d1816bd1b	refactor: reorganize app/Services and app/Support by domain ... The app/Services/ directory had grown into 22 flat files at the root plus 7 uneven subdirectories — finding anything required scrolling through an alphabetical mix of small CRUD services, infrastructure drivers, and install-time utilities. This commit groups services by domain, folds Backup into a new Storage namespace, and moves framework-infrastructure and install-time helpers out of Services and into Support where they belong. New Services layout: Documents/ (Invoice, Estimate, RecurringInvoice, Payment, Expense, Transaction, DocumentItem, SerialNumber, Currency — matches the 'Documents' navigation group); Company/ (Company, Member, Invitation); Mail/ (MailConfiguration, CompanyMailConfig); Storage/ (FileDisk, plus Backup folded in). ExchangeRateProviderService moves next to its drivers in ExchangeRate/; FontService moves into Pdf/ where it belongs. CustomerService, ItemService, CustomFieldService stay at the Services root as standalone single-file domains. Moves to Support/: Hashids/ (library wrapper — not business logic); Setup/ (one-shot install-time utilities — stateless helpers); Pdf/ (ImageUtils, PdfTemplateUtils, plus the existing PdfHtmlSanitizer consolidated into the same subdir). These are all framework infrastructure and stateless utilities — the 'service' label never really fit them. Namespace declarations in 29 moved files updated to match new paths. 62 consumer files (controllers, other services, tests, database factories, seeders, routes, bootstrap/providers.php) have their use statements rewritten via a literal-string replacement script — no regex meant no risk of half-matching. Three Documents services needed an explicit 'use App\Services\Mail\CompanyMailConfigService' added because the same-namespace short reference they relied on no longer resolves after the split. Verified: composer dump-autoload, 350 tests pass (850 assertions), vendor/bin/pint clean, npm run build succeeds.	2026-04-11 10:00:00 +02:00
Darko Gjorgjijoski	5c11147e95	feat(settings): allow Danger Zone for any owner regardless of company count ... Removes three layered gates that kept the Danger Zone completely hidden unless the current user had more than one company: 1. SettingsLayoutView's showDangerZone computed no longer checks companies.length > 1 — just is_owner. 2. DangerZoneView drops the v-if that wrapped the delete button with the same check. 3. Admin\\CompaniesController::destroy() drops the companies_count <= 1 early-return that was enforcing the rule server-side (translation key You_cannot_delete_all_companies was inline in the controller, not in lang files or tests, so nothing else needs cleanup). The reasoning behind the old gate was that a user with zero companies would be stranded. That's a misread of how the app degrades: /admin/no-company already exists as a graceful fallback view, and the user can create a fresh company from there to recover. Hiding the entire delete flow just to avoid that fallback UX was overkill — the name-confirmation modal already prevents accidental deletion.	2026-04-11 08:00:00 +02:00
Darko Gjorgjijoski	e44657bf7e	feat(exchange-rate): make providers extendible via module Registry ... Exchange rate providers are now pluggable via the module Registry. The four built-in drivers (currency_converter, currency_freak, currency_layer, open_exchange_rate) move from a static config array into App\\Providers\\DriverRegistryProvider, which calls Registry::registerExchangeRateDriver() for each during app boot with metadata the frontend needs: label (i18n key), website (help-text URL), and config_fields (schema for driver-specific driver_config JSON). The Currency Converter's server-type selector and dedicated URL field — previously hardcoded in ExchangeRateProviderModal.vue — are now just another config_fields entry with a visible_when rule that shows the URL input only when type=DEDICATED. Any module that wants to ship a custom driver gets the same treatment for free: declare config_fields in the registration, and the host app's modal renders them automatically. ExchangeRateDriverFactory::make() falls back to Registry::driverMeta() when a name isn't in the local built-in map, and availableDrivers() merges both sources. ConfigController handles the exchange_rate_drivers key specially by mapping Registry::allDrivers('exchange_rate') to enriched option objects, so the config-file route still works for every other key. The static exchange_rate_drivers + currency_converter_servers arrays in config/invoiceshelf.php are deleted. Unit tests cover the new Registry::register/flushDrivers, the factory merging built-ins with Registry-contributed drivers, and the factory rejecting unknown names. A feature test exercises the end-to-end /api/v1/config?key=exchange_rate_drivers response shape. NOTE: this commit depends on invoiceshelf/modules package commit e44d951 which adds the Registry driver API. The package needs to be released and pinned in composer.json before a fresh composer install on this commit will work.	2026-04-11 04:00:00 +02:00
Darko Gjorgjijoski	7885bf9d11	feat(menu): priority-sorted menu groups, user-menu items, sidebar appearance toggle ... Every main_menu entry moves from numeric group (1/2/3) to string-based group + group_label + priority. Groups now carry their own i18n label and child entries are sorted by an explicit priority field instead of config-array order, so module-contributed menu items can slot into any existing group at any position. BootstrapController merges module-registered menu items into main_menu (previously they lived in a separate module_menu response key) and introduces a user_menu response key for items modules want to place in the avatar dropdown. The global store follows suit: moduleMenu becomes userMenu, menuGroups is a computed that sorts by priority, and hasActiveModules drops out. New admin Appearance setting page with a single toggle for whether sidebar group labels render — so instances that prefer a compact sidebar can hide the Documents/Administration/Modules headings without losing the grouping itself. CompanyLayout watches route meta and re-bootstraps when the admin-mode flag flips so the sidebar repaints with the right menu on navigation across the admin boundary. Test suites updated: module menu merging is asserted against main_menu (name: 'module-{slug}') rather than the old module_menu response; HelloWorldIntegrationTest verifies the schema translation path; CompanyModulesIndexTest covers the display_name attachment.	2026-04-11 00:30:00 +02:00
Darko Gjorgjijoski	345bfde306	feat(modules): translated display names and inline settings modal ... CompanyModulesController attaches a translated display_name to each module before returning the list. ModuleSettingsController gains a translateSchema() helper that resolves section titles and field labels against the host app's i18n store before sending the schema to the frontend, so module authors can keep their 'my_module::settings.field' keys and users still see localized strings. Per-module settings now open in an inline ModuleSettingsModal rather than routing to a standalone page. The modal reuses BaseSchemaForm for rendering, so the whole interaction takes place in-context next to the module card the user clicked — no navigation, no loss of place. CompanyModuleCard displays the translated display_name instead of the raw slug and emits open-settings with the module payload; the parent view hands that to the modal store.	2026-04-10 21:30:00 +02:00
Darko Gjorgjijoski	23d1476870	refactor(modules): marketplace install flow with checksum validation ... Rewires module installation to use slug + version + checksum_sha256 instead of the opaque module identifier. ModuleInstaller splits marketplace token handling out of install() into helpers, adopts structured error responses, and validates the downloaded archive's SHA-256 against the marketplace manifest before unpacking. ModuleResource is simplified to accept an already-loaded installed-module instance rather than fetching it from state, exposes access_tier and checksum fields, and drops the auto-disable-on-unpurchased side effect that was bleeding write logic into a read resource. UnzipUpdateRequest accepts a nullable module with a conditional module_name field so the same endpoint serves both app and module updates. ModulesPolicy::manageModules now short-circuits for super-admins so administration flows (token validation, store state) are not blocked on a company-scoped ability. Two new feature tests cover both the authorization bypass and ModuleResource serialization.	2026-04-10 17:30:00 +02:00
Darko Gjorgjijoski	42ce99eeba	Show common currencies first in dropdowns and default to USD in install wizard ... Currency dropdowns now display the most-traded currencies (USD, EUR, GBP, JPY, CAD, AUD, CHF, CNY, INR, BRL) at the top, followed by the rest alphabetically. The install wizard defaults to USD instead of EUR and formats currency names as "USD - US Dollar" for consistency with the rest of the app.	2026-04-10 15:55:46 +02:00
Darko Gjorgjijoski	9174254165	Refactor install wizard and mail configuration	2026-04-09 10:06:27 +02:00
Darko Gjorgjijoski	7743c2e126	feat(modules): dynamic sidebar group rendering active modules ... The sidebar gains a new section that lists each currently-activated module as a direct shortcut to its settings page. This is the always-visible companion to the company-context Active Modules index — both surface the same set of modules, but the index is the catalog landing page and the sidebar group is the per-module quick access. - BootstrapController returns module_menu populated from \InvoiceShelf\Modules\Registry::allMenu(), but only on the company-context branch — not on the super-admin branch (lines 53-69), since super admins don't see the dynamic group. Because nwidart only boots service providers for currently-activated modules, the registry naturally contains only active modules at request time, no extra filtering needed. - bootstrap.service.ts BootstrapResponse type extended with module_menu?: ModuleMenuItem[]; new ModuleMenuItem interface (title/link/icon) — shaped distinctly from MenuItem because module entries use namespaced i18n keys and don't carry group/ability metadata. - global.store.ts exposes a moduleMenu ref + a hasActiveModules computed. - SiteSidebar.vue appends a new "Modules" section after the existing menuGroups output, in both the mobile (Dialog) and desktop branches. The section is hidden when hasActiveModules is false. Uses the modules.sidebar.section_title i18n key added in the previous commit.	2026-04-09 00:29:56 +02:00
Darko Gjorgjijoski	e6eeacb6d4	feat(modules): company-context module surfaces and schema-driven settings ... Adds the read-only company "Active Modules" index page (lists every instance-activated module with a Settings shortcut) and the schema-driven settings framework (generic BaseSchemaForm.vue renderer + per-company persistence in CompanySetting). Bundled because they share the same routes/api.php edit and the index page's Settings button targets the settings page. Backend: - CompanyModulesController::index() returns every Module::enabled = true row with a kebab-case slug (via Str::kebab()) and a has_settings flag computed from \InvoiceShelf\Modules\Registry::settingsFor(). nwidart stores module names in PascalCase ("HelloWorld") but URLs and registry keys use kebab ("hello-world") — the controller normalizes so module authors can call Registry::registerSettings('hello-world') naturally without thinking about the storage format. - ModuleSettingsController::show(\$slug) returns the registered Schema + per-company values from CompanySetting (defaults flow through when nothing has been saved yet). update(\$slug) builds Laravel validator rules from the Schema's per-field rules arrays — with type-rule fallbacks for switch -> boolean, number -> numeric, multiselect -> array — silently drops unknown keys, and persists via CompanySetting::setSettings() under the module.{slug}.{key} prefix. Activation is instance-global, but settings are per-company: two companies on the same instance can configure the same activated module differently. - routes/api.php mounts GET /api/v1/company-modules at the root of the company API group and GET/PUT /api/v1/modules/{slug}/settings inside the existing modules prefix. Frontend: - BaseSchemaForm.vue is the central new component — a generic schema-driven form renderer that maps schema fields to BaseInput / BaseTextarea / BaseSwitch / BaseMultiselect by type, and builds Vuelidate rules dynamically from each field's rules array (supports required, email, url, numeric, min:N, max:N). New fields are added by extending the type -> component map. - CompanyModulesIndexView.vue fetches /company-modules and renders a card grid (with empty/loading states); CompanyModuleCard.vue is the per-row component with the Settings button. ModuleSettingsView.vue fetches /modules/{slug}/settings, hands {schema, values} to BaseSchemaForm, and posts back on submit. - Company-context routes.ts is rebuilt after the previous commit relocated the marketplace browser away. It now declares modules.index + modules.settings, both gated by manage-module ability. - New api/services/{companyModules,moduleSettings}.service.ts thin clients. - lang/en.json adds modules.index.{description,empty_title,empty_description}, modules.settings.{title,open,saved,not_found,none}, and modules.sidebar.section_title. The sidebar key is added here even though the dynamic sidebar rendering lands in the next commit — keeping all i18n additions in one file edit avoids hunk-splitting lang/en.json.	2026-04-09 00:29:36 +02:00
Darko Gjorgjijoski	b2b7a07e0c	refactor(modules): migrate asset registry from app/Services to invoiceshelf/modules package ... The vestigial App\Services\Module\Module static class — with its unused \$scripts / \$styles / \$settings registries — never had any of its helpers wired up. The new InvoiceShelf\Modules\Registry shipped from the invoiceshelf/modules package supersedes it cleanly: same static-array surface (\$menu, \$settings, \$scripts, \$styles), but lives outside the host app so third-party modules can depend on it without importing v3-app internals. Three consumers in the host app are migrated to the new namespace: - ScriptController and StyleController (the HTTP endpoints that serve module-registered JS/CSS assets at /modules/scripts/{name} and /modules/styles/{name}) now look up paths via Registry::scriptFor() and Registry::styleFor() instead of Arr::get(ModuleFacade::all*(), \$name). Also tightens type hints — Request import + Response return type. - resources/views/app.blade.php iterates Registry::allStyles() / Registry::allScripts() to inject module-supplied <link>/<script> tags into the main layout. Same Akaunting-style asset injection mechanism, just reading from the new namespace. Both Module and ModuleFacade are deleted — they had no remaining callers after this migration.	2026-04-09 00:27:44 +02:00
Darko Gjorgjijoski	119a1712b0	Port expense report grouped itemized view + i18n + return types from master ... Ports the net behaviour from three master commits into v3.0 as a single change, because v3.0 has already diverged structurally (controller moved from V1/Admin/Report to Company/Report, blade has its own CSS rework using the bundled fonts partial, and v3.0's App\Facades\Pdf replaces Barryvdh\DomPDF\Facade\Pdf). The three source commits are: 834b53ea (grouped itemized expenses), e22050bc (DomPDF facade + Pint — adapted to v3.0's App\Facades\Pdf), 0e9f18d4 (expenses.uncategorized + pdf_expense_group_total_label i18n keys + View|Response return type). Controller: replaces the expenseCategories aggregate fetch with an itemized Expense query ordered by date, groups by category name with expenses.uncategorized fallback, and shares an expenseGroups collection of {name, expenses, total} plus the overall totalExpense. Adds expense_category_id to applyFilters. Updates the docblock return type from JsonResponse to View|Response. Keeps v3.0's App\Facades\Pdf. Blade: replaces the single expenseCategories aggregate table with a per-group itemized table (date / note / amount columns + per-group total line using the new pdf_expense_group_total_label i18n key). Adds the item-table-* CSS classes and removes the old expense-total-table bottom block. lang/en.json: adds expenses.uncategorized = "Uncategorized" and pdf_expense_group_total_label = "Group total:".	2026-04-07 17:28:34 +02:00
Darko Gjorgjijoski	78ed332d06	Add per-user language preference with company default fallback ... Existing accounts inherited the company language at creation time and there was no way to change UI language per user. Add a 'Default (Company Language)' entry to the language selector in UserGeneralView, persist the choice through userStore.updateUserSettings and reload the i18n bundle via window.loadLanguage. The 'default' sentinel keeps the user opted in to the company-wide setting. Bootstrap (global.store) now syncs userForm from current_user data and resolves the active UI language as user > company > 'en'. RegisterController, InvitationRegistrationController and MemberService seed new users with language=default instead of copying the current company setting, so promoting/inviting members no longer leaks the inviter's frozen language.	2026-04-07 04:41:00 +02:00
Darko Gjorgjijoski	ba5c6c39ba	Add multilingual PDF font system with Noto Sans and on-demand CJK packages ... Bundle Noto Sans (Regular/Bold/Italic/BoldItalic) under resources/static/fonts/ as the default PDF face — it covers Latin, Cyrillic, Greek, Arabic, Thai and Hindi out of the box, replacing the limited DejaVu Sans fallback. Move all @font-face declarations into app.pdf.partials.fonts and include it from every invoice/estimate/payment/report template, dropping per-template font-family hardcodes and the conditional Thai locale include. Introduce FontService + FontController to download static Noto Sans CJK packages (zh, zh_CN, ja, ko) from life888888/cjk-fonts-ttf on demand. GeneratesPdfTrait::ensureFontsForLocale primes the family before rendering and the partial emits @font-face rules for installed packages so dompdf resolves them through standard CSS — no separate registerFont() instance required. Static TTFs are mandatory because dompdf's PHP-Font-Lib does not parse variable fonts (fvar/gvar tables), which is why Google Fonts' NotoSansTC[wght].ttf rendered empty boxes. Expose status/install via /api/v1/fonts/status and /api/v1/fonts/{package}/install with matching FONTS_STATUS / FONTS_INSTALL constants in scripts-v2/api/endpoints.ts. Flip DOMPDF_ENABLE_REMOTE default to true for remote asset loading.	2026-04-06 23:32:00 +02:00
Darko Gjorgjijoski	20085cab5d	Refactor FileDisk system with per-disk unique names and disk assignments UI ... Major changes to the file disk subsystem: - Each FileDisk now gets a unique Laravel disk name (disk_{id}) instead of temp_{driver}, fixing the bug where multiple local disks with different roots overwrote each other's config. - Move disk registration logic from FileDisk model to FileDiskService (registerDisk, getDiskName). Model keeps only getDecodedCredentials and a deprecated setConfig() wrapper. - Add Disk Assignments admin UI (File Disk tab) with three purpose dropdowns: Media Storage, PDF Storage, Backup Storage. Stored as settings (media_disk_id, pdf_disk_id, backup_disk_id). - Backup tab now uses the assigned backup disk instead of a per-backup dropdown. BackupsController refactored to use BackupService which centralizes disk resolution. Removed stale 4-second cache. - Add local_public disk to config/filesystems.php so system disks are properly defined. - Local disk roots stored relative to storage/app/ with hint text in the admin modal explaining the convention. - Fix BaseModal watchEffect -> watch to prevent infinite request loops on the File Disk page. - Fix string/number comparison for disk purpose IDs from settings. - Add safeguards: prevent deleting disks with files, warn on purpose change, prevent deleting system disks.	2026-04-07 02:04:57 +02:00
Darko Gjorgjijoski	67268ac2b7	Secure expense receipts by wiring Media Library to FileDisk ... Spatie Media Library now uses the default FileDisk (local_private) for new uploads instead of the public disk. Expense receipts are no longer directly web-accessible. - AppServiceProvider configures media-library disk from FileDisk on boot - Change media-library fallback from 'public' to 'local' - Expense receipt URL accessor returns authenticated route instead of direct file URL - Add registerMediaCollections() to Expense model - Prevent deleting FileDisk that contains files or is a system disk - Add media:secure command to migrate existing receipts to private disk Fixes #187	2026-04-07 01:01:59 +02:00
Darko Gjorgjijoski	9638e02eb8	Fix customer portal not reflecting company default currency ... The customer portal bootstrap now returns current_company_currency alongside the customer's own currency. The store falls back to the company currency when the customer has no currency assigned. Fixes #142	2026-04-06 23:37:56 +02:00
Darko Gjorgjijoski	25b61b73a0	Fix case-sensitive email login ... Email comparison on login now uses LOWER() for case-insensitive matching. Applied to both admin and customer portal login controllers. Fixes #424	2026-04-06 23:22:16 +02:00
Darko Gjorgjijoski	9ca998e64a	Add Convert to Estimate feature for invoices ... New backend endpoint POST /invoices/{id}/convert-to-estimate that creates a draft estimate from an invoice, copying items, taxes, custom fields, and financial data. Frontend wired with dropdown action, store method, and API service call.	2026-04-06 22:57:03 +02:00
Darko Gjorgjijoski	e64529468c	Replace deleted_files with manifest-based updater cleanup, add release workflow ... - Add manifest.json generation script (scripts/generate-manifest.php) - Add Updater::cleanStaleFiles() that removes files not in manifest - Add /api/v1/update/clean endpoint with backward compatibility - Add configurable update_protected_paths in config/invoiceshelf.php - Update frontend to use clean step instead of delete step - Add GitHub Actions release workflow triggered on version tags - Add .github/release.yml for auto-generated changelog categories - Update Makefile to include manifest generation and scripts directory	2026-04-06 19:27:33 +02:00
Darko Gjorgjijoski	74b4b2df4e	Finalize Typescript restructure	2026-04-06 17:59:15 +02:00
Darko Gjorgjijoski	eb0a588164	Refactor Administration entrypoint ... We moved the administration item to the company switcher in the header	2026-04-04 01:36:28 +02:00
Darko Gjorgjijoski	fae59221d3	Generate admin menus for super admins without a company ... Super admin users with no company associations now receive their administration menu items in the bootstrap response instead of empty arrays. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>	2026-04-04 00:24:00 +02:00
Darko Gjorgjijoski	c1994887ef	Support invitations for unregistered users ... When inviting an email without an InvoiceShelf account, the email now links to a registration page (/register?invitation={token}) instead of login. After registering, the invitation is auto-accepted. Backend: - InvitationRegistrationController: public details() and register() endpoints. Registration validates token + email match, creates account, auto-accepts invitation, returns Sanctum token. - AuthController: login now accepts optional invitation_token param to auto-accept invitation for existing users clicking the email link. - CompanyInvitationMail: conditional URL based on user existence. - Web route for /invitations/{token}/decline (email decline link). Frontend: - RegisterWithInvitation.vue: fetches invitation details, shows company name + role, registration form with pre-filled email. - Router: /register route added. Tests: 3 new tests (invitation details, register + accept, email mismatch).	2026-04-03 23:26:58 +02:00
Darko Gjorgjijoski	8a6c085288	Rename company-scoped Users to Members throughout ... Complete rename across backend and frontend: - Controller: Company/Users/UsersController -> Company/Members/MembersController - Service: UserService -> MemberService - Requests: UserRequest -> MemberRequest, DeleteUserRequest -> DeleteMemberRequest - API routes: /api/v1/users -> /api/v1/members (company-scoped only) - Sidebar menu: "Users" -> "Members" - Frontend: views/users -> views/members, stores/users -> stores/members - Router: users.index -> members.index, /admin/users -> /admin/members - i18n: new "members" section with invitation-related keys - Tests: UserTest -> MemberTest Admin/super-admin Users (system-wide user management) remains unchanged.	2026-04-03 23:12:30 +02:00