Expenses now have invoiceFileUrl, invoiceFileName, paperlessUrl,
paperlessDocumentId for supplier invoice attachment.
New expense_packages junction links expenses to multiple packages.
New sales + sale_line_items + sale_packages tables for income tracking
with per-line tax rate and per-sale withholding rate.
Added saleStatusEnum and 4 audit events: expense_invoice_uploaded,
sale_created, sale_confirmed, sale_voided.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Scheduler checks every 15min; if 24h since last FX refresh, fetches
rates for all foreign-currency accounts and updates fxRateToBase.
Uses CDN primary + Cloudflare fallback with 10s timeout.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Accounts now have fxRateToBase (default 1.0). The budget total query
multiplies each transaction by the account's rate, so a USD account
with rate 34.5 contributes correctly to the THB-denominated budget.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Total budget is now sum(account transaction amounts) across all
non-deleted accounts. Removed the manual 'Add Budget' action and form.
Budget page is now read-only for the total; allocations still work.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
C3: Budget allocation now verifies project belongs to company
M4: Expense approve/reject scoped by company via project join
H2: OIDC cookies get secure flag on HTTPS
H3: OIDC auto-link only when email_verified by provider
H4: Content-Security-Policy + X-Content-Type-Options in hooks
M7: SSRF favicon redirect depth capped at 3
M2: File downloads use attachment disposition (not inline)
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Mirrors the buildfor_life_repair workflow: SSH into LXC, reset working
tree, pull, npm ci, build, db:push, restart the buildfor-life-budget
systemd service, health-check.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Stretched-link pattern: absolute-positioned overlay anchor covers the
card; action controls (edit/archive/delete + inline forms) get
`relative z-10` so they float above and stay clickable.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
The correlated subquery in the SELECT was returning 0 for every row.
Replaced with a separate grouped-sum query joined in JS — same data, more
reliable SQL generation.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three new CSVs in the export bundle, with matching README entries:
- company_bank_accounts.csv
- company_cards.csv (last4 only, joined with linked bank account name)
- company_addresses.csv
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Visible to admin, manager, and accountant. Placed between
Integrations and Export so the broader-audience tab appears first.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
New /companies/[id]/profile route. Single page, three sections:
Bank Accounts:
- Table view with masked account numbers (••••1234)
- Add form (always-on inline) with bank, account holder, number,
type, branch, SWIFT/BIC, IBAN, currency, primary toggle, notes
- Inline edit row (admin only) and Set Primary / Remove actions
- Audit log: bank_account_added/updated/removed
Cards:
- Add form gates input to last 4 digits (maxlength=4 + regex)
- Amber warning: "Last 4 digits only — never enter full PAN"
- Optional link to a bank account
- Brand select (Visa/Mastercard/Amex/JCB/UnionPay/Discover/Other)
- Audit log: card_added/removed (no edit — remove + re-add)
Addresses:
- Type enum (Legal/Shipping/Billing/Other) with type-coloured badges
- Grouped by type, default flag scoped per type
- Full Thai address fields plus contact person/phone
- Inline edit per row, Set Default per type, Remove
- Audit log: address_added/updated/removed
Read access: admin/manager/accountant. Edit: admin only.
All forms use enhance with reset:false to preserve state on error.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three new per-company tables backing the upcoming Profile page:
- company_bank_accounts: bank/account name, account number, type,
branch, SWIFT/BIC, IBAN, currency (default THB), isPrimary,
isActive, notes
- company_cards: brand (visa/mastercard/amex/jcb/unionpay/discover/
other), last4 (varchar(4)), cardholder, expiry month/year,
nickname, optional FK to a bank account. Stores ONLY last 4
digits — never the full PAN, to avoid PCI-DSS scope.
- company_addresses: type enum (legal/shipping/billing/other),
label, recipient, full Thai address fields (subdistrict/district/
province/postal code), country defaulting to Thailand, contact
person + phone, isDefault, notes
Eight new audit events in companyLogEventEnum cover add/update/
remove operations on each. Page UI and export integration follow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Extends the employees.csv builder to include all 14 new fields
(DOB, gender, nationality, marital status, full Thai address,
emergency contact). Order matches the on-screen detail page so
auditors and accountants get the complete record.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Detail page now has three new cards beneath the main employee block:
- Personal: DOB (with computed age), gender, nationality, marital status
- Address: combined one-line address plus a labelled grid for the
Thai-specific subdistrict/district/province/postal code parts
- Emergency Contact: name, phone, relationship
Edit modal extends with matching sections so HR/admin can update
all 14 new fields. updateEmployee server action passes the new
fields through to the employees table.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
Three new form blocks slot in between Tax & Bank and Salary:
- Personal: date of birth, gender (select), nationality (defaults
to Thai), marital status (select)
- Address: line 1/2, subdistrict (Tambon), district (Amphoe),
province (Changwat), postal code, country (defaults to Thailand)
- Emergency Contact: name, phone, relationship
Server action pulls each new field from formData (all optional)
and includes them in the employees insert.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
14 new nullable columns on the employees table:
Personal:
- dateOfBirth, gender, nationality, maritalStatus
Address (Thai-specific):
- addressLine1, addressLine2, subdistrict (Tambon),
district (Amphoe), province (Changwat), postalCode, country
Emergency contact:
- emergencyContactName, emergencyContactPhone,
emergencyContactRelationship
All nullable to leave existing rows intact. Constrained sets
(gender, marital status) live in the UI selects rather than
pgEnums for flexibility. Form/UI/export updates follow.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
grabowski