Commit Graph

10 Commits

Author SHA1 Message Date
Gerhard Scheikl 01b4734477 security hardening 2026-05-31 09:35:31 +02:00
Gerhard Scheikl 2a4a7fd983 fix(invoice): unify customer-facing remittance reference with the printed invoice number
Two related fixes around the order/invoice number:

1) The thank-you page and the customer-account order page were showing
   the bare Shopify order name (e.g. '#1034') as the payment reference,
   while the PDF (and its GiroCode QR) used the canonical invoice
   number (e.g. 'RE-1034'). Banks treat each unique reference as a
   separate payment, and several reject the '#' character outright \u2014
   so customers who pasted the thank-you reference into their banking
   app ended up with a payment the shop couldn't reconcile.

   New shared helper resolveOrderRemittance() (services/invoice/
   remittance.server.ts) returns the single source of truth for the
   reference: latest non-cancelled Invoice row for the order, falling
   back to '${prefix}${orderNumber}' when no PDF has been generated yet.
   Both /api/public/payment-info and /api/public/girocode.png now route
   through it, so the thank-you page, the customer-account page and the
   GiroCode QR are guaranteed to match the PDF byte-for-byte.

2) Drop the redundant '\u00b7 Bestellnummer: #1004' suffix from the PDF
   title when the invoice number's trailing digits already match the
   Shopify order name (default 'order_number' numbering mode). In that
   mode the two strings carry identical numeric content and the suffix
   only adds noise; sequential mode (RE-7 vs #1004) keeps the suffix.

- New smoke assertion verifies the suppression triggers on
  invoiceNumber='RE-1004' + orderName='#1004' and that the invoice
  number itself is still shown.
- Both endpoints now also query 'Order.number' (already covered by
  read_orders) so the fallback path can build the prefix+order-number
  string without requiring the Invoice row.
2026-05-15 15:51:10 +02:00
Gerhard Scheikl 3a77bed716 fix security issues 2026-05-09 22:19:25 +02:00
Gerhard Scheikl ca769c49a4 feat(customer-account): payment extension for order page (shares /api/public/payment-info; dual auth) 2026-05-09 21:45:27 +02:00
Gerhard Scheikl 5ac2e09f8c cleanup(thank-you): remove debug, render nothing when no payment data 2026-05-09 21:38:16 +02:00
Gerhard Scheikl f6c5d108ad fix(thank-you): force https for QR PNG URL behind TLS-terminating proxy 2026-05-09 21:19:01 +02:00
Gerhard Scheikl 3fb8600402 fix(thank-you): serve GiroCode as signed PNG URL instead of data URL 2026-05-09 21:14:47 +02:00
Gerhard Scheikl cc7cedfedb fix(payment-info): rewrite OrderIdentity GID to Order GID; surface error detail; brief retry 2026-05-09 21:07:39 +02:00
Gerhard Scheikl 8bc86ef985 payment info updates 2026-05-09 21:05:09 +02:00
Gerhard Scheikl 884070cddc feat(thank-you): payment instructions extension (GiroCode + bank details) for manual payment orders 2026-05-09 20:48:08 +02:00