meshkee-app/backend
1
0
Fork 0
mirror of https://git.meshkee.com/Meshkee/backend.git synced 2026-08-11 22:30:59 +04:30
Code Issues Packages Projects Releases Wiki Activity

Add opaque 12-digit publicId for unguessable invoice links.

Browse Source 
Public viewer and URLs use publicId instead of sequential primary keys.

Co-authored-by: Cursor <cursoragent@cursor.com>
This commit is contained in:
Alireza Hassani
2026-07-26 12:00:10 +03:30
co-authored by Cursor
parent 3faeb9bc0d
commit 723948cd5e
5 changed files with 64 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/PROJECT_CONTEXT.md
+6 -5
View File
@@ -156,6 +156,7 @@ Example super admin: `+989121111111` / `password`
| `037_invoice_name.sql` | Optional `invoices.name` |
| `038_invoice_templates.sql` | Full invoice templates + key points/accounts on invoices |
| `039_invoice_account_holder.sql` | `account_holder_name` on invoice / template accounts |
| `040_invoice_public_id.sql` | Opaque `public_id` for unguessable public invoice links |
Docker mounts `./database/migrations` into Postgres init — migrations run automatically only on **first** volume creation. Use `migrate.sh` for subsequent migrations.
@@ -588,17 +589,17 @@ Super admins issue invoices **to** a business. Schema is ready for future busine
| GET/PATCH/DELETE | `/invoice-templates/:templateId` |
| GET/POST | `/businesses/:businessId/invoices` |
| GET/PATCH/DELETE | `/businesses/:businessId/invoices/:invoiceId` |
| GET | `/public/invoices/:invoiceId` (no auth; issued/paid only) |
| GET | `/public/invoices/:publicId` (no auth; issued/paid only; opaque 12-digit id) |
Auth (admin routes): `JwtAuthGuard` + service `assertSuperAdmin`.
Serialized platform invoices include `publicUrl`: `https://{INVOICE_PUBLIC_DOMAIN}/invoices/{id}` (default `meshkee.com`), or `{INVOICE_PUBLIC_BASE_URL}/invoices/{id}` when set. Accounts include optional `accountHolderName`.
Serialized platform invoices include `publicId` + `publicUrl`: `https://{INVOICE_PUBLIC_DOMAIN}/invoices/{publicId}` (default `meshkee.com`), or `{INVOICE_PUBLIC_BASE_URL}/invoices/{publicId}` when set. Accounts include optional `accountHolderName`.
Public HTML viewer lives in the dashboards super-admin SPA (`/invoices/:id`); API serves JSON via `/public/invoices/:id`.
Public HTML viewer lives in the dashboards super-admin SPA (`/invoices/:publicId`); API serves JSON via `/public/invoices/:publicId` (sequential PK is not accepted).
Permissions seeded for future business dashboard: `invoices.*`, `invoice_templates.*`.
Module: `src/invoices/` · Migrations: `036`, `037`, `038`, `039`
Module: `src/invoices/` · Migrations: `036` … `040`
---
@@ -646,7 +647,7 @@ Follow the pattern in `CategoryVariationsService` / `CategoryTechnicalFormServic
| Prisma schema | `prisma/schema.prisma` |
| Env template | `.env.example` (`INVOICE_PUBLIC_DOMAIN` / optional `INVOICE_PUBLIC_BASE_URL`) |
| Invoices module | `src/invoices/` |
| Invoice migrations | `database/migrations/036_invoices.sql` … `039_invoice_account_holder.sql` |
| Invoice migrations | `database/migrations/036_invoices.sql` … `040_invoice_public_id.sql` |
| Docker services | `docker-compose.yml` |
| Dev seed data | `database/seeds/001_sample_data.sql` |
| Postman | `postman/Meshkee-CMS-Auth.postman_collection.json` |