- New stock_adjustments table logs every stock change (restock, order
create/update/delete) with reason and reference
- Orders now track payment_method and amount_paid with validation
- New /api/reports endpoint with 5 aggregation queries and date filtering
- Reports page with date range presets and sales, customer, revenue,
status, and inventory sections
- Payment fields added to OrderNew and OrderDetail pages with balance due
- Girl Scouts trefoil logo added to header
- Vite dev server exposed on network for mobile access
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Use timing-safe comparisons for HMAC verification and password checks
- Add login rate limiting (5 attempts/minute per IP)
- Lock down CORS to Vite dev origin only (not needed in production)
- Derive signing key from APP_PASSWORD instead of using it directly
- Replace hand-rolled cookie parsing with cookie-parser middleware
- Wrap all order mutations in SQLite transactions
- Fix TOCTOU race on stock with atomic UPDATE...WHERE quantity >= ?
- Fix APP_SECERT typo in .env (gitignored, local fix only)
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
