Skip to content

fix(cashier): vales en estado final, alta de vales atómica y totales con permiso - #20

Merged
bpstack merged 1 commit into
claude/compassionate-planck-gh6aoffrom
opencode/fix-cashier
Oct 12, 2026
Merged

bpstack merged 1 commit into
claude/compassionate-planck-gh6aoffrom
opencode/fix-cashier

Conversation

@bpstack

@bpstack bpstack commented Oct 12, 2026

Copy link
Copy Markdown
Owner

Cambios

  • Un vale justificado o cancelado ya no se puede modificar.
  • El límite de vales por turno se comprueba en la misma transacción que el alta.
  • Recepción no accede a /daily, /shifts/:id/history ni /vouchers/stats (canViewReports).

Por qué

Se podían editar vales cerrados, pasar del límite con altas simultáneas y ver totales sin permiso.

…totals

- cashier-voucher-repository.ts: only a pending voucher can change its
  amount, reason or notes, be justified or be cancelled; the write itself
  checks the status. createForShift locks the shift, counts its vouchers
  and creates and links the new one in one transaction; create,
  canAddVoucherToShift and associateWithShift go.
- cashier-voucher-controller.ts: create uses createForShift and answers
  domain errors with their status.
- cashier-errors.ts: the new voucher errors.
- cashier-routes.ts: GET /daily, /shifts/:id/history and /vouchers/stats
  require canViewReports, like the other history and report routes.
- voucher-lifecycle.test.ts: transitions, the locked creation, the limit
  and the three guarded routes.

Why: a cancelled voucher could be justified, a justified one cancelled and
the amount of either changed; the 5-voucher limit could be passed in
parallel and going over it left a voucher without a shift; reception saw
history and totals meant for admin. Decided on 2026-10-11: justified and
cancelled are final. Checked with curl against the local database:
reception gets 403 on the three routes and admin 200; a justified voucher
refuses a new amount, cancel and justify; a voucher on a missing shift
answers 404 and creates nothing.
@bpstack
bpstack merged commit fab4cf3 into claude/compassionate-planck-gh6aof Oct 12, 2026
4 checks passed
@vercel

vercel Bot commented Oct 12, 2026

Copy link
Copy Markdown

The latest updates on your projects. Learn more about Vercel for GitHub.

Project Deployment Actions Updated
four-points Ready Ready Preview Oct 12, 2026 6:53pm UTC

This branch was successfully deployed

1 active deployment
Preview — 355b844e Deployed Oct 12, 2026 by vercel[bot]
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant