From b89a4a7fa3a6ce441f052d491f740cff8474c529 Mon Sep 17 00:00:00 2001
From: SJCoetz <s.coetzee6@my.milpark.ac.za>
Date: Mon, 3 Aug 2026 15:07:46 +0200
Subject: [PATCH] fix(stock-orders): preserve header nav + sanitize error
 message

- Header (title, description, Reorder, + New stock order) now
  renders unconditionally, so operators can navigate away even when
  the list query throws.
- Full error is logged server-side via console.error; the user
  sees a generic 'Failed to load stock orders. Please try again.'
  message that doesn't leak PB URLs, admin env var names, or
  filter syntax.

Co-authored-by: Orca <help@stably.ai>
---
 src/app/(app)/stock-orders/page.tsx | 43 ++++++++++++++++-------------
 1 file changed, 24 insertions(+), 19 deletions(-)

diff --git a/src/app/(app)/stock-orders/page.tsx b/src/app/(app)/stock-orders/page.tsx
index 317c182..95eec73 100644
--- a/src/app/(app)/stock-orders/page.tsx
+++ b/src/app/(app)/stock-orders/page.tsx
@@ -55,22 +55,18 @@ export default async function StockOrdersPage({
   const status = parseStatus(params.status);
   const page = parsePage(params.page);
 
-  let result: Awaited<ReturnType<typeof listStockPurchases>>;
+  let result: Awaited<ReturnType<typeof listStockPurchases>> | null = null;
+  let loadError: string | null = null;
   try {
     const pb = await getAdminPocketBase();
     result = await listStockPurchases(pb, { status, page, perPage: 50 });
   } catch (err) {
-    // Surface the failure inline rather than redirect to a global
-    // error boundary — operators need the URL context to retry.
-    return (
-      <div className="space-y-6">
-        <h1 className="text-2xl font-bold tracking-tight">Stock Orders</h1>
-        <p className="text-destructive text-sm">
-          Failed to load stock orders:{" "}
-          {err instanceof Error ? err.message : "unknown error"}
-        </p>
-      </div>
-    );
+    // Log full error server-side so operators have the diagnostic
+    // trail; show only a generic message to the user — internal
+    // detail (PB URLs, env-var names, filter syntax) is not safe
+    // to surface in the operator UI.
+    console.error("stock-orders list failed:", err);
+    loadError = "Failed to load stock orders. Please try again.";
   }
 
   return (
@@ -90,18 +86,27 @@ export default async function StockOrdersPage({
           >
             Reorder from low stock
           </Link>
-          <Link href="/stock-orders/new" className={cn(buttonVariants())}>
+          <Link
+            href="/stock-orders/new"
+            className={cn(buttonVariants())}
+          >
             + New stock order
           </Link>
         </div>
       </div>
 
-      <StockOrdersTable
-        rows={result.items as ListRow[]}
-        currentStatus={status}
-        page={result.page}
-        totalPages={result.totalPages}
-      />
+      {loadError ? (
+        <div className="rounded-md border border-destructive/30 bg-destructive/5 p-4 text-sm text-destructive">
+          {loadError}
+        </div>
+      ) : (
+        <StockOrdersTable
+          rows={result!.items as ListRow[]}
+          currentStatus={status}
+          page={result!.page}
+          totalPages={result!.totalPages}
+        />
+      )}
     </div>
   );
 }
\ No newline at end of file