Expense VAT (F4), fiscal calendar (F3), 303/130 drafts (F5), and other#39
Merged
Conversation
…voice lifecycle (F2) Expenses (F4): add net/vat_rate/vat_amount/deductible/deductible_pct to the expense model (core + module mirror) with guarded migration; VAT auto-calc form, category defaults + settings panel, list/report/API/tax-panel surfacing. Fiscal calendar (F3): new module with local AEAT deadline dataset, dashboard panel, year page, form-selection settings, idempotent reminder scheduler job riding the notify capability seam. Tax ES forms (F5): new module rendering per-quarter Modelo 303/130 box drafts from invoices + expenses (estimate only, versioned box mapping), tax-obligations panel + REST API; consumes the F2 fiscal snapshot and F4 expense VAT. Invoice lifecycle (F2): draft->issued->paid states with issued/paid lock across routes and InvoiceService, per-series sequential numbering + frozen fiscal snapshot at issue, rectificative + annul flows, and issue-blocking on_invoice_issued/rectified/annulled module hooks. Also fixes the empty Contractor column on the expenses list and consolidates module-loading test setup into one shared conftest fixture. Tests: 63 passing (expense VAT, fiscal calendar, invoice lifecycle, 303/130 engine, expenses list). No live AEAT verification — box numbers/rates/dates are standard values, versioned and framed as "estimate, not tax advice". Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
- Sanitize exception text in the three invoice-lifecycle error logs (issue/annul/rectify) to prevent log injection from user-derived data. - Drop unused imports: datetime in fiscal_calendar, date in tax_es_forms. - Stop importing module 'app' both ways (import + from-import) in tests/conftest.py and tests/test_invoice_lifecycle.py; use sys.modules['app']. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CodeQL taint tracking does not recognize the custom _log_safe helper as a sanitizer, so the three lifecycle error logs stayed flagged. Drop the exception text from the log line entirely and use exc_info=True instead — no user-derived string reaches the formatter, full diagnostics stay in the traceback. Remove the now-unused _log_safe helper. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
CodeQL models Flask route parameters as tainted regardless of the <int:> converter, so the lifecycle error logs stayed flagged even without the exception text. Log the ORM object's id (DB-derived, untainted) instead, matching how the rest of the codebase logs invoice identifiers. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
…voice lifecycle (F2)
Expenses (F4): add net/vat_rate/vat_amount/deductible/deductible_pct to the expense model (core + module mirror) with guarded migration; VAT auto-calc form, category defaults + settings panel, list/report/API/tax-panel surfacing.
Fiscal calendar (F3): new module with local AEAT deadline dataset, dashboard panel, year page, form-selection settings, idempotent reminder scheduler job riding the notify capability seam.
Tax ES forms (F5): new module rendering per-quarter Modelo 303/130 box drafts from invoices + expenses (estimate only, versioned box mapping), tax-obligations panel + REST API; consumes the F2 fiscal snapshot and F4 expense VAT.
Invoice lifecycle (F2): draft->issued->paid states with issued/paid lock across routes and InvoiceService, per-series sequential numbering + frozen fiscal snapshot at issue, rectificative + annul flows, and issue-blocking on_invoice_issued/rectified/annulled module hooks.
Also fixes the empty Contractor column on the expenses list and consolidates module-loading test setup into one shared conftest fixture.
Tests: 63 passing (expense VAT, fiscal calendar, invoice lifecycle, 303/130 engine, expenses list). No live AEAT verification — box numbers/rates/dates are standard values, versioned and framed as "estimate, not tax advice".