Revisión de OpenCode: 20 ramas de arreglo, traducción de errores y acceso por rol

backend/config/db-config.ts

@@ -26,7 +26,7 @@ interface DBConfig {
   user: string
   password: string | undefined
   database: string
-  ssl?: any
+  ssl?: object
 }
 
 // ========================================

backend/config/error-codes.ts

@@ -54,6 +54,9 @@ export const ERROR_CODES = {
   BACKOFFICE_SUPPLIER_NOT_FOUND: 'BACKOFFICE_SUPPLIER_NOT_FOUND',
   BACKOFFICE_REJECTION_REASON_REQUIRED: 'BACKOFFICE_REJECTION_REASON_REQUIRED',
   BACKOFFICE_PAYMENT_DATE_REQUIRED: 'BACKOFFICE_PAYMENT_DATE_REQUIRED',
+  BACKOFFICE_INVALID_PAYMENT_DATE: 'BACKOFFICE_INVALID_PAYMENT_DATE',
+  BACKOFFICE_INVALID_AMOUNT: 'BACKOFFICE_INVALID_AMOUNT',
+  BACKOFFICE_INVOICE_DUPLICATE: 'BACKOFFICE_INVOICE_DUPLICATE',
   BACKOFFICE_NO_FILE_SENT: 'BACKOFFICE_NO_FILE_SENT',
   BACKOFFICE_PDF_ONLY: 'BACKOFFICE_PDF_ONLY',
   BACKOFFICE_FILE_TOO_LARGE: 'BACKOFFICE_FILE_TOO_LARGE',
@@ -253,6 +256,8 @@ export const ERROR_CODES = {
   // Group Payment
   GROUP_PAYMENT_MISSING_FIELDS: 'GROUP_PAYMENT_MISSING_FIELDS',
   GROUP_PAYMENT_INVALID_AMOUNT: 'GROUP_PAYMENT_INVALID_AMOUNT',
+  GROUP_PAYMENT_OVERPAID: 'GROUP_PAYMENT_OVERPAID',
+  GROUP_PAYMENT_PERCENTAGE_OVER_100: 'GROUP_PAYMENT_PERCENTAGE_OVER_100',
   GROUP_PAYMENT_NOT_FOUND: 'GROUP_PAYMENT_NOT_FOUND',
   GROUP_PAYMENT_NOT_IN_GROUP: 'GROUP_PAYMENT_NOT_IN_GROUP',
   GROUP_PAYMENT_FETCH_ERROR: 'GROUP_PAYMENT_FETCH_ERROR',
@@ -387,6 +392,7 @@ export const ERROR_CODES = {
   NOTIFICATIONS_MISSING_REQUIRED_FIELDS: 'NOTIFICATIONS_MISSING_REQUIRED_FIELDS',
   NOTIFICATIONS_INVALID_SCHEDULED_DATE: 'NOTIFICATIONS_INVALID_SCHEDULED_DATE',
   NOTIFICATIONS_INVALID_MODULE: 'NOTIFICATIONS_INVALID_MODULE',
+  NOTIFICATIONS_INVALID_RECIPIENTS: 'NOTIFICATIONS_INVALID_RECIPIENTS',
   NOTIFICATIONS_NOT_FOUND: 'NOTIFICATIONS_NOT_FOUND',
   NOTIFICATIONS_FETCH_ERROR: 'NOTIFICATIONS_FETCH_ERROR',
   NOTIFICATIONS_FETCH_UNREAD_ERROR: 'NOTIFICATIONS_FETCH_UNREAD_ERROR',
@@ -417,6 +423,8 @@ export const ERROR_CODES = {
   PARKING_FETCH_BOOKING_ERROR: 'PARKING_FETCH_BOOKING_ERROR',
   PARKING_CREATE_BOOKING_ERROR: 'PARKING_CREATE_BOOKING_ERROR',
   PARKING_CHECKIN_ERROR: 'PARKING_CHECKIN_ERROR',
+  PARKING_CHECKIN_INVALID_STATUS: 'PARKING_CHECKIN_INVALID_STATUS',
+  PARKING_SPOT_OCCUPIED: 'PARKING_SPOT_OCCUPIED',
   PARKING_CHECKOUT_ERROR: 'PARKING_CHECKOUT_ERROR',
   PARKING_CANCEL_ERROR: 'PARKING_CANCEL_ERROR',
   PARKING_NOSHOW_ERROR: 'PARKING_NOSHOW_ERROR',

backend/config/logger.ts

@@ -17,6 +17,22 @@ import pino from 'pino'
 const isDev = process.env.NODE_ENV !== 'production'
 const level = process.env.LOG_LEVEL ?? (isDev ? 'debug' : 'info')
 
+const SECRET_KEYS = ['password', 'currentPassword', 'newPassword', 'token', 'refreshToken']
+
+// Redactar campos sensibles si aparecen accidentalmente. pino has no
+// recursive wildcard: secrets are hidden at the first three levels. The SQL
+// of a failed db.query carries its values interpolated (texts, plates,
+// hashes); err.code and err.message stay
+export const redact = {
+  paths: [
+    ...SECRET_KEYS.flatMap((key) => [key, `*.${key}`, `*.*.${key}`]),
+    'req.headers.authorization',
+    'req.headers.cookie',
+    '*.sql',
+  ],
+  censor: '[REDACTED]',
+}
+
 export const logger = pino({
   level,
   ...(isDev
@@ -31,15 +47,5 @@ export const logger = pino({
         },
       }
     : {}),
-  // Redactar campos sensibles si aparecen accidentalmente
-  redact: {
-    paths: [
-      '*.password',
-      '*.token',
-      '*.refreshToken',
-      'req.headers.authorization',
-      'req.headers.cookie',
-    ],
-    censor: '[REDACTED]',
-  },
+  redact,
 })

backend/controllers/auth/user-controllers.ts

@@ -143,10 +143,10 @@ export const resetUserPassword = async (req: Request, res: Response): Promise<vo
     }
 
     res.status(200).json({ message: 'Contraseña actualizada correctamente' })
-  } catch (error: any) {
+  } catch (error) {
     logger.error({ err: error }, 'Error resetUserPassword')
-    if (error.message === 'Usuario no encontrado') {
-      res.status(404).json({ error: error.message })
+    if ((error as Error).message === 'Usuario no encontrado') {
+      res.status(404).json({ error: (error as Error).message })
       return
     }
     res.status(500).json({ error: 'Error al resetear contraseña' })

backend/controllers/backoffice/backoffice-controller.ts

@@ -18,6 +18,12 @@ import {
   executeBatchPaymentSchema,
   revertBatchPaymentSchema,
 } from '../../validations/backoffice/batch-payment.js'
+import {
+  hasValidAmounts,
+  isDuplicateEntry,
+  isValidPaidDate,
+} from '../../validations/backoffice/invoice.js'
+import { formatDateMadrid, getTodayMadrid } from '../../config/date-utils.js'
 import {
   isOwnCloudinaryUrl,
   isPublicIdInFolder,
@@ -26,6 +32,23 @@ import {
 import { fetchStoredFile, sendPrivateFile } from '../../services/uploads/private-files.js'
 import { presentAsset, presentInvoice, presentInvoiceOrNull } from './backoffice-files.js'
 
+function respondInvalidAmount(res: Response): void {
+  res.status(400).json({
+    success: false,
+    error: ERROR_CODES.BACKOFFICE_INVALID_AMOUNT,
+    code: ERROR_CODES.BACKOFFICE_INVALID_AMOUNT,
+  })
+}
+
+// uk_invoice_supplier_number: the supplier already has an invoice with that number
+function respondDuplicateInvoice(res: Response): void {
+  res.status(409).json({
+    success: false,
+    error: ERROR_CODES.BACKOFFICE_INVOICE_DUPLICATE,
+    code: ERROR_CODES.BACKOFFICE_INVOICE_DUPLICATE,
+  })
+}
+
 // An invoice action changed no row: the invoice does not exist (404) or its
 // status does not allow the action (409)
 async function respondActionNotApplied(res: Response, id: number): Promise<void> {
@@ -570,6 +593,11 @@ export class BackofficeController {
         return
       }
 
+      if (!hasValidAmounts(req.body)) {
+        respondInvalidAmount(res)
+        return
+      }
+
       // The PDF must be one we uploaded: the server later downloads this URL
       if (
         (req.body.original_pdf_url && !isOwnCloudinaryUrl(req.body.original_pdf_url)) ||
@@ -611,6 +639,10 @@ export class BackofficeController {
         invoice: presentInvoiceOrNull(invoice),
       })
     } catch (error) {
+      if (isDuplicateEntry(error)) {
+        respondDuplicateInvoice(res)
+        return
+      }
       logger.error({ err: error }, '[BackofficeController.createInvoice] Error')
       res.status(500).json({
         success: false,
@@ -637,6 +669,11 @@ export class BackofficeController {
 
       const { id } = req.params
 
+      if (!hasValidAmounts(req.body)) {
+        respondInvalidAmount(res)
+        return
+      }
+
       const updated = await BackofficeRepository.updateInvoice(Number(id), req.body, req.user.id)
 
       if (!updated) {
@@ -653,6 +690,10 @@ export class BackofficeController {
         invoice: presentInvoiceOrNull(invoice),
       })
     } catch (error) {
+      if (isDuplicateEntry(error)) {
+        respondDuplicateInvoice(res)
+        return
+      }
       logger.error({ err: error }, '[BackofficeController.updateInvoice] Error')
       res.status(500).json({
         success: false,
@@ -872,6 +913,26 @@ export class BackofficeController {
         return
       }
 
+      const current = await BackofficeRepository.getInvoiceById(Number(id))
+      if (!current) {
+        res.status(404).json({
+          success: false,
+          error: ERROR_CODES.BACKOFFICE_INVOICE_NOT_FOUND,
+          code: ERROR_CODES.BACKOFFICE_INVOICE_NOT_FOUND,
+        })
+        return
+      }
+
+      // A real day, not before the invoice nor in the future
+      if (!isValidPaidDate(paid_date, formatDateMadrid(current.invoice_date), getTodayMadrid())) {
+        res.status(400).json({
+          success: false,
+          error: ERROR_CODES.BACKOFFICE_INVALID_PAYMENT_DATE,
+          code: ERROR_CODES.BACKOFFICE_INVALID_PAYMENT_DATE,
+        })
+        return
+      }
+
       const paid = await BackofficeRepository.markAsPaid(Number(id), paid_date, req.user.id)
 
       if (!paid) {
@@ -1097,6 +1158,7 @@ export class BackofficeController {
       const previousPublicId =
         type === 'original' ? pdfInfo?.original_pdf_public_id : pdfInfo?.validated_pdf_public_id
 
+      // Type, bytes and size were checked by singleInvoicePdf (backofficeUpload.ts)
       if (!req.file) {
         res.status(400).json({
           success: false,
@@ -1106,27 +1168,6 @@ export class BackofficeController {
         return
       }
 
-      // Validar tipo de archivo
-      if (req.file.mimetype !== 'application/pdf') {
-        res.status(400).json({
-          success: false,
-          error: ERROR_CODES.BACKOFFICE_PDF_ONLY,
-          code: ERROR_CODES.BACKOFFICE_PDF_ONLY,
-        })
-        return
-      }
-
-      // Validar tamaño (máx 10MB)
-      const maxSize = 10 * 1024 * 1024
-      if (req.file.size > maxSize) {
-        res.status(400).json({
-          success: false,
-          error: ERROR_CODES.BACKOFFICE_FILE_TOO_LARGE,
-          code: ERROR_CODES.BACKOFFICE_FILE_TOO_LARGE,
-        })
-        return
-      }
-
       logger.debug('[BackofficeController.uploadInvoicePdf] Uploading to Cloudinary...')
 
       // Subir a Cloudinary (usar uploadPdf para archivos PDF)
@@ -1282,6 +1323,7 @@ export class BackofficeController {
         return
       }
 
+      // Type, bytes and size were checked by singleAssetImage (backofficeUpload.ts)
       if (!req.file) {
         res.status(400).json({
           success: false,
@@ -1291,17 +1333,6 @@ export class BackofficeController {
         return
       }
 
-      // Validar tipo de archivo
-      const allowedTypes = ['image/png', 'image/webp']
-      if (!allowedTypes.includes(req.file.mimetype)) {
-        res.status(400).json({
-          success: false,
-          error: ERROR_CODES.BACKOFFICE_INVALID_IMAGE_TYPE,
-          code: ERROR_CODES.BACKOFFICE_INVALID_IMAGE_TYPE,
-        })
-        return
-      }
-
       // Subir a Cloudinary
       const cloudinaryResult = await CloudinaryService.uploadImage(
         req.file.buffer,

backend/controllers/blacklist/blacklist-controller.ts

@@ -420,7 +420,9 @@ export class BlacklistController {
   static async getImage(req: Request, res: Response): Promise<void> {
     const file = String(req.params.file)
     if (!isBlacklistImageFile(file)) {
-      res.status(404).json({ success: false, error: ERROR_CODES.NOT_FOUND })
+      res
+        .status(404)
+        .json({ success: false, error: ERROR_CODES.NOT_FOUND, code: ERROR_CODES.NOT_FOUND })
       return
     }
     const { publicId, format } = parseBlacklistImageFile(file)
@@ -435,7 +437,9 @@ export class BlacklistController {
       sendPrivateFile(res, fetched)
     } catch (error) {
       logger.warn({ err: error, file }, '[BlacklistController.getImage] Not available')
-      res.status(404).json({ success: false, error: ERROR_CODES.NOT_FOUND })
+      res
+        .status(404)
+        .json({ success: false, error: ERROR_CODES.NOT_FOUND, code: ERROR_CODES.NOT_FOUND })
     }
   }
 

backend/controllers/cashier/cashier-errors.ts

@@ -17,6 +17,10 @@ export const CASHIER_DOMAIN_ERRORS: Record<string, number> = {
   'El vale ya está justificado': 409,
   'El vale ya está cancelado': 409,
   'Solo se pueden eliminar vales pendientes': 409,
+  'Solo se pueden modificar vales pendientes': 409,
+  'Solo se pueden justificar vales pendientes': 409,
+  'Solo se pueden cancelar vales pendientes': 409,
+  'El turno ya tiene el máximo de 5 vales': 400,
 }
 
 /** Known domain errors keep their message; anything else is a generic 500 (no SQL details). */

backend/controllers/cashier/cashier-voucher-controller.ts

@@ -133,18 +133,8 @@ export class CashierVoucherController {
       }
       const voucherData = { ...parsed.data, created_by: userId }
 
-      // Verificar límite de 5 vales por turno
-      const canAdd = await CashierVoucherRepository.canAddVoucherToShift(parseInt(shiftId))
-      if (!canAdd) {
-        res.status(400).json({ error: 'El turno ya tiene el máximo de 5 vales' })
-        return
-      }
-
-      // Crear vale
-      const voucher = await CashierVoucherRepository.create(voucherData)
-
-      // Asociar con turno
-      await CashierVoucherRepository.associateWithShift(voucher.id, parseInt(shiftId))
+      // Crear el vale y asociarlo al turno (límite de 5, en una transacción)
+      const voucher = await CashierVoucherRepository.createForShift(voucherData, parseInt(shiftId))
 
       // Registrar en historial
       await CashierHistoryRepository.create({
@@ -158,8 +148,7 @@ export class CashierVoucherController {
 
       res.status(201).json(voucher)
     } catch (error) {
-      logger.error({ err: error }, 'Error al crear vale')
-      res.status(500).json({ error: 'Error al crear vale' })
+      sendCashierError(res, error, 'Error al crear vale')
     }
   }
 

backend/controllers/checklist/checklist-comments-controllers.ts

@@ -6,6 +6,20 @@ import { createCommentSchema } from '../../validations/checklist/checklist-schem
 import { logger } from '../../config/logger.js'
 import { fetchStoredFile, sendPrivateFile } from '../../services/uploads/private-files.js'
 
+// Answers a refused delete; returns true when it did
+function refuseRemove(
+  res: Response,
+  result: commentsService.RemoveResult,
+  what: 'comentario' | 'adjunto'
+): boolean {
+  if (result === 'deleted') return false
+  if (result === 'not_found') res.status(404).json({ error: `No existe ese ${what}` })
+  else if (result === 'closed')
+    res.status(409).json({ error: 'El día está cerrado: solo un administrador puede borrar' })
+  else res.status(403).json({ error: `No tienes permiso para eliminar este ${what}` })
+  return true
+}
+
 function isAdmin(req: Request): boolean {
   return req.user?.role?.toLowerCase() === 'admin'
 }
@@ -45,17 +59,13 @@ export async function addCommentController(req: Request, res: Response): Promise
 // DELETE /api/checklists/:id/steps/:stepId/comments/:commentId
 export async function deleteCommentController(req: Request, res: Response): Promise<void> {
   try {
-    const { id, commentId } = req.params
-    const deleted = await commentsService.removeComment(
-      id,
+    const { commentId } = req.params
+    const result = await commentsService.removeComment(
       Number(commentId),
       req.user!.id,
       isAdmin(req)
     )
-    if (!deleted) {
-      res.status(403).json({ error: 'No tienes permiso para eliminar este comentario' })
-      return
-    }
+    if (refuseRemove(res, result, 'comentario')) return
     res.json({ success: true })
   } catch (err) {
     logger.error({ err }, '[checklist] deleteComment')
@@ -113,17 +123,13 @@ export async function addAttachmentController(req: Request, res: Response): Prom
 // DELETE /api/checklists/:id/steps/:stepId/attachments/:attachmentId
 export async function deleteAttachmentController(req: Request, res: Response): Promise<void> {
   try {
-    const { id, attachmentId } = req.params
-    const deleted = await commentsService.removeAttachment(
-      id,
+    const { attachmentId } = req.params
+    const result = await commentsService.removeAttachment(
       Number(attachmentId),
       req.user!.id,
       isAdmin(req)
     )
-    if (!deleted) {
-      res.status(403).json({ error: 'No tienes permiso para eliminar este adjunto' })
-      return
-    }
+    if (refuseRemove(res, result, 'adjunto')) return
     res.json({ success: true })
   } catch (err) {
     logger.error({ err }, '[checklist] deleteAttachment')