Commit graph

6 commits

Author SHA1 Message Date
John Mizerek
3f15b0c8b6 Fix SQL injection, wrong PK, and hardcoded production URLs
Security:
- orders/submit.cfm: parameterize IN clause (was string-interpolated)
- auth/completeProfile.cfm: fix UserID → ID on Users table PK

Environment-aware URLs:
- Add application.baseUrl to config/environment.cfm
- Replace all hardcoded https://biz.payfrit.com with application.baseUrl in:
  orders/getDetail, tasks/getDetails, auth/completeProfile, auth/avatar,
  stripe/onboard, users/search, workers/onboardingLink, workers/earlyUnlock

Also fix submit.cfm qMeta.ItemID → qMeta.ID (column not in SELECT)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 21:14:19 -08:00
John Mizerek
a7b7717ccd Fix prefixed column names in uploadHeader, stripe/onboard, stripe/createPaymentIntent
- uploadHeader.cfm: WHERE BusinessID → WHERE ID (Businesses table PK)
- onboard.cfm: WHERE BusinessID → WHERE ID, BusinessStripeOnboardingStarted → StripeOnboardingStarted
- createPaymentIntent.cfm: WHERE BusinessID → WHERE ID, OrderDeliveryFee → DeliveryFee, WHERE OrderID → WHERE ID

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 20:56:35 -08:00
John Mizerek
8acf2f3249 Complete DB column normalization: strip redundant table-name prefixes from all SQL queries
Updated 70 files to match the payfrit_dev schema where columns like
BusinessName→Name, UserFirstName→FirstName, AddressCity→City, etc.
PKs renamed to ID, FKs keep referenced table name (e.g. BusinessID).
SQL aliases preserve original JSON response keys for API compatibility.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 20:03:40 -08:00
John Mizerek
6b66d2cef8 Fix normalized DB column names across all API files
Sweep of 26 API files to use prefixed column names matching the
database schema (e.g. BusinessID not ID, BusinessName not Name,
BusinessDeliveryFlatFee not DeliveryFlatFee, ServicePointName not Name).

Files fixed: auth, beacons, businesses, menu, orders, setup, stripe,
tasks, and workers endpoints.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-31 16:56:41 -08:00
John Mizerek
1210249f54 Normalize database column and table names across entire codebase
Update all SQL queries, query result references, and ColdFusion code to match
the renamed database schema. Tables use plural CamelCase, PKs are all `ID`,
column prefixes stripped (e.g. BusinessName→Name, UserFirstName→FirstName).

Key changes:
- Strip table-name prefixes from all column references (Businesses, Users,
  Addresses, Hours, Menus, Categories, Items, Stations, Orders,
  OrderLineItems, Tasks, TaskCategories, TaskRatings, QuickTaskTemplates,
  ScheduledTaskDefinitions, ChatMessages, Beacons, ServicePoints, Employees,
  VisitorTrackings, ApiPerfLogs, tt_States, tt_Days, tt_AddressTypes,
  tt_OrderTypes, tt_TaskTypes)
- Rename PK references from {TableName}ID to ID in all queries
- Rewrite 7 admin beacon files to use ServicePoints.BeaconID instead of
  dropped lt_Beacon_Businesses_ServicePoints link table
- Rewrite beacon assignment files (list, save, delete) for new schema
- Fix FK references incorrectly changed to ID (OrderLineItems.OrderID,
  Categories.MenuID, Tasks.CategoryID, ServicePoints.BeaconID)
- Update Addresses: AddressLat→Latitude, AddressLng→Longitude
- Update Users: UserPassword→Password, UserIsEmailVerified→IsEmailVerified,
  UserIsActive→IsActive, UserBalance→Balance, etc.

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-30 15:39:12 -08:00
John Mizerek
0765dc1e27 Add business portal, Stripe Connect, beacon APIs, and task system
Portal:
- New business portal UI (portal/index.html, portal.css, portal.js)
- Dashboard with real-time stats (orders today, revenue, pending, menu items)
- Business info endpoint (api/businesses/get.cfm)
- Portal stats endpoint (api/portal/stats.cfm)
- Menu page links to existing full-featured menu editor

Stripe Connect:
- Onboarding endpoint (api/stripe/onboard.cfm)
- Status check endpoint (api/stripe/status.cfm)
- Payment intent creation (api/stripe/createPaymentIntent.cfm)
- Webhook handler (api/stripe/webhook.cfm)

Beacon APIs:
- List all beacons (api/beacons/list_all.cfm)
- Get business from beacon (api/beacons/getBusinessFromBeacon.cfm)

Task System:
- List pending tasks (api/tasks/listPending.cfm)
- Accept task (api/tasks/accept.cfm)

Other:
- HUD interface for quick order status display
- KDS debug/test pages
- Updated Application.cfm with public endpoint allowlist
- Order status check improvements

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude Opus 4.5 <noreply@anthropic.com>
2026-01-01 23:38:26 -08:00