Add a simple yes/no tick box on the far right of every table in the
SARS registrations tab, so SJ can tick off each client as the period's
return is filed and confirm nothing was missed at end of month.
- New PB collection sars_submission_flags (pbc_3539276419): company
relation, return_type select, period (YYYYMM), submitted bool,
submitted_at date. One row per (company, return_type, period).
- New route /api/sars-submission-flags with GET (list), POST (upsert,
server owns submitted_at) and DELETE (Clear all for a period).
Hard-allowlisted fields and a fixed collection id.
- Explorer gains a period banner, a submitted/total counter, a
Submitted column on desktop and a tick box on the mobile cards,
and a Clear all button guarded by a confirm.
The counter is scoped to the rows actually on screen. A flag can
outlive the filter that surfaced its company (a client can lose its
PAY/E number), and counting those made the banner read 4/18 while
only 3 boxes were ticked.
Period is the current month and rolls over on its own; Clear all is
what resets a type between periods. Per-month history is deliberately
out of scope for this first pass.
middleware.ts previously 404'd every external request, which meant the
app was unusable once hosted. There are no per-user accounts, so this
adds a single-password gate:
- /login page + POST /api/auth/login, POST /api/auth/logout
- lib/auth.ts: HMAC-SHA256 signed session cookie (lib/auth), Web Crypto
only so the same code runs in Edge middleware and Node handlers
- middleware now admits: the signing flow (unchanged, still public),
/login + /api/auth/*, local requests, and valid sessions. Everything
else redirects to /login (pages) or returns 401 JSON (API calls).
- password compared with a constant-time compare, wrong attempts
delayed 600ms to slow online guessing
- cookie is HttpOnly + SameSite=Lax, 12h, Secure when x-forwarded-proto
says https (Coolify serves the proxy on http today)
APP_PASSWORD / AUTH_SECRET added to .env.example, with a warning: an
unquoted # in an env value starts a comment, which silently truncated
the first generated password and made login fail.
Verified against a real built server: anon->307 /login, anon API->401,
wrong password->401, correct password->200+cookie, signed-in request
reaches PocketBase, /resign/ still 200 without a cookie, forged
cookie->401.
