Add Recebimento/Conferência MVP: frontend, Supabase schema and TeraBox backend - #4
Add Recebimento/Conferência MVP: frontend, Supabase schema and TeraBox backend#4hhhthiti wants to merge 6 commits into
Conversation
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 4f2e4a6086
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| app.post('/exportar-txt-terabox', async (req, res) => { | ||
| try { | ||
| ensureConfig(); | ||
| ensureToken(); | ||
|
|
There was a problem hiding this comment.
The /exportar-txt-terabox handler only checks that a process-wide teraboxToken exists, so once any admin completes OAuth, any caller can POST arbitrary content to this endpoint and write files into the same TeraBox account. Because CORS is globally enabled and there is no per-request identity check, this becomes an unauthorized write path when the backend is publicly deployed.
Useful? React with 👍 / 👎.
| try { | ||
| await dbUpdate('usuarios', { matricula }, { senha: novaSenha }); | ||
| if (state.mode === 'supabase') { | ||
| const { error } = await supabase.functions.invoke('send-email', { body: { to: 'leseliv487@fengnu.com', subject: 'Nova senha', text: `Nova senha: ${novaSenha}` } }); |
There was a problem hiding this comment.
The email recovery flow always sends the new password to a fixed mailbox instead of the target user's registered email, so resetting any matrícula leaks credentials to an unrelated address and the intended user never receives the recovery message. This breaks account recovery and exposes sensitive credentials.
Useful? React with 👍 / 👎.
| await dbUpdate('usuarios', { matricula, telefone }, { senha: novaSenha }); | ||
| if (state.mode === 'supabase') { | ||
| const { error } = await supabase.functions.invoke('send-sms', { body: { to: telefone, message: `Nova senha: ${novaSenha}` } }); | ||
| if (error) throw error; |
There was a problem hiding this comment.
The SMS recovery path writes the new password before attempting to send the SMS. If the edge function is missing/misconfigured or SMS delivery fails, the catch path reports failure but the password has already changed, leaving the user locked out without receiving the new credential.
Useful? React with 👍 / 👎.
| (nota.itens_json || []).forEach((item) => { | ||
| const code = normalizeProductCode(item.codigo); | ||
| const fardosPorPalete = getFardosPorPalete(code); | ||
| conferenciaForm.insertAdjacentHTML('beforeend', `<div class="item"><p><strong>${code}</strong> - ${item.descricao}</p><p class="hint">${fardosPorPalete} fardos por palete</p><label>Quantidade conferida<input type="number" step="0.01" min="0" required name="${code}" /></label><label class="fracao-fardo hidden" data-fracao="${code}">Fardos fracionados (quando conferir em paletes)<input type="number" step="0.01" min="0" name="${code}__fracao" value="0" /></label></div>`); |
There was a problem hiding this comment.
Each item input is keyed only by normalized SKU code, so when an XML has multiple det rows with the same product code, the form ends up with duplicated field names and FormData.get(code) later reads only the first value. That causes incorrect per-line conferência totals, false divergences, and corrupted NQ output for those invoices.
Useful? React with 👍 / 👎.
Removed the Recebimento Excel tab and its content.
1 participant
Motivation
Description
index.html,styles.cssandmain.jsimplementing authentication (matrícula/senha), ADM/Operação UIs, XML parsing, PDF generation, barcode, NQ/recebimento export lines, chat and logs.localmode usinglocalStoragewhen schema/tables are missing, via helper DB functionsdbSelect,dbInsert,dbUpdate, anddbDeleteAll.server.jspluspackage.jsonand.env.exampleto perform OAuth (/auth/terabox), receive callback and export TXT files to TeraBox (/exportar-txt-terabox) using preupload/upload/create calls.supabase-schema.sqlto create required tables (usuarios,notas,conferencias,logs,chats,nq_reports) and kept README with setup and run instructions.Testing
Codex Task