adamp 7068ea354e Fix bugs, harden validation, and improve robustness
P0 fixes:
- Fix OrderDetail product change overwriting product_id due to React
  state batching (single setItems call now updates both fields)
- Validate all :id route params via parseId helper; return 400 for
  invalid IDs instead of passing raw strings to SQLite
- Product/customer delete now checks for references first, returns
  409 Conflict instead of letting FK constraint produce 500

P1 fixes:
- Disallow quantity_on_hand in product PUT so all stock changes go
  through PATCH /stock (preserves audit trail)
- Add global Express error handler and unhandledRejection listener

P2 fixes:
- Validate report date params (YYYY-MM-DD format) and stock-history
  limit (positive integer, capped at 1000)
- Add jsonSafe() helper to api.js for safe 204 handling
- OrderNew setSubmitting now runs in finally block
- Login shows specific message for 429 rate limit, generic message
  for other auth failures

P3 fixes:
- Replace brittle try/catch ALTER TABLE with schema_version migration
  table and versioned migrations
- Fix OrderDetail useEffect missing dependency (useCallback + [load])

Also: expanded README with full production deployment instructions
(PM2, nginx, backups)

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-09 21:35:53 -06:00

100 lines
3.7 KiB
JavaScript

const express = require('express');
const router = express.Router();
const { getDb } = require('../db');
const { isValidDate } = require('../utils');
router.get('/', (req, res) => {
try {
const db = getDb();
const { start, end } = req.query;
if (start && !isValidDate(start)) return res.status(400).json({ error: 'Invalid start date. Use YYYY-MM-DD format.' });
if (end && !isValidDate(end)) return res.status(400).json({ error: 'Invalid end date. Use YYYY-MM-DD format.' });
const endWithTime = end ? end + ' 23:59:59' : null;
// Build date filter fragments and positional params for order-based queries
let dateFilter = '';
const orderParams = [];
if (start) { dateFilter += ' AND o.created_at >= ?'; orderParams.push(start); }
if (end) { dateFilter += ' AND o.created_at <= ?'; orderParams.push(endWithTime); }
// For stock adjustments
let dateFilterSA = '';
const saParams = [];
if (start) { dateFilterSA += ' AND sa.created_at >= ?'; saParams.push(start); }
if (end) { dateFilterSA += ' AND sa.created_at <= ?'; saParams.push(endWithTime); }
// For inventory summary, the SA params repeat 3 times (3 subqueries)
const invParams = [...saParams, ...saParams, ...saParams];
const salesByProduct = db.prepare(`
SELECT p.name as product_name,
COALESCE(SUM(oi.quantity), 0) as units_sold,
COALESCE(SUM(oi.quantity * oi.price_at_sale), 0) as revenue
FROM products p
LEFT JOIN (
SELECT oi.product_id, oi.quantity, oi.price_at_sale
FROM order_items oi
JOIN orders o ON o.id = oi.order_id
WHERE 1=1 ${dateFilter}
) oi ON oi.product_id = p.id
GROUP BY p.id, p.name
ORDER BY revenue DESC
`).all(...orderParams);
const topCustomers = db.prepare(`
SELECT c.name as customer_name,
COUNT(DISTINCT o.id) as order_count,
COALESCE(SUM(oi.quantity * oi.price_at_sale), 0) as total_spent
FROM customers c
JOIN orders o ON o.customer_id = c.id ${dateFilter ? 'AND 1=1' + dateFilter : ''}
JOIN order_items oi ON oi.order_id = o.id
GROUP BY c.id, c.name
ORDER BY total_spent DESC
`).all(...orderParams);
const revenueOverTime = db.prepare(`
SELECT date(o.created_at) as date,
COALESCE(SUM(oi.quantity * oi.price_at_sale), 0) as revenue,
COUNT(DISTINCT o.id) as order_count
FROM orders o
JOIN order_items oi ON oi.order_id = o.id
WHERE 1=1 ${dateFilter}
GROUP BY date(o.created_at)
ORDER BY date
`).all(...orderParams);
const orderStatusBreakdown = db.prepare(`
SELECT o.status, COUNT(*) as count
FROM orders o
WHERE 1=1 ${dateFilter}
GROUP BY o.status
ORDER BY count DESC
`).all(...orderParams);
const inventorySummary = db.prepare(`
SELECT p.name as product_name,
p.quantity_on_hand as current_stock,
p.low_stock_threshold,
COALESCE((SELECT SUM(sa.adjustment) FROM stock_adjustments sa WHERE sa.product_id = p.id AND sa.reason = 'restock' ${dateFilterSA}), 0) as total_restocked,
COALESCE((SELECT ABS(SUM(sa.adjustment)) FROM stock_adjustments sa WHERE sa.product_id = p.id AND sa.adjustment < 0 ${dateFilterSA}), 0) as total_sold,
COALESCE((SELECT COUNT(*) FROM stock_adjustments sa WHERE sa.product_id = p.id AND sa.reason = 'restock' ${dateFilterSA}), 0) as restock_count
FROM products p
ORDER BY p.name
`).all(...invParams);
res.json({
salesByProduct,
topCustomers,
revenueOverTime,
orderStatusBreakdown,
inventorySummary,
});
} catch (err) {
res.status(500).json({ error: err.message });
}
});
module.exports = router;