Hey guys, how have you been doing lately? I’m alright. I’m still getting my driver license, so I don’t have much time to code.

Last devlog was all about the PDF engine on the backend, and I closed it saying that the UI was next. Here it is:

• Print button: I added a print button Print PDF on quotes, orders, delivery notes and invoices. The file is downloaded with the document number as its name, so you get for example 2025-47.pdf and not just document.pdf

• Template editor: I also added to settings a new tab called “Print”. On the left there’s the list of templates, on the right the HTML, the page size and the margin. The preview renders the last real document of that module instead of a fake one, so what you can see is exactly what your customer receives. The default templates can’t be edited you duplicate them: the seeder rewrites them at every boot, so any change would silently disapper on the next restart. I preferred to say it in the interface rather than let someoune lose an afternoon of work.

• Company data: The company settings now hold also the legal name, VAT number, tax code, address and contact line. That’s what the PDF header prints, and without them the header comes out empty.

• VAT that adds up to the cent The header discount is spread across the VAT rates and every share gets rounded, so the sum of the shares could end up one or two cents away from the total. On a quote nobody would ever notice. On an electronic invoice it’s rejection 00423. Now the rounding leftover goes on the last rate, so taxable + VAT = total, always.

• Tests on a real db: The report engine builds SQL at runtime, and mocking a database proves nothing, so its tests now start a throwaway Postgres in Docker and run against it: filters, grouping, ordering and counting.

• Two bugs closed: Merging two records didn’t look at the bin, so a deleted record could be merged into a live one. And editing a saved report answered 405, because the frontend was sending PUT to an endpoint that only has POST.

Right now I’m working on the 2FA (for those who don’t know, the 2 factor auth). I’m writing the TOTP myself instead of pulling in a library: it’s an HMAC-SHA1 of the 30 second counter, and the six digits come out of the dynamic truncation described in the RFC. The secret is encrypted in the database with AES-GCM, because someone who can read the db must not be able to generate the codes, otherwise a second factor is just a second password. There are ten recovery codes, stored hashed and usable
once each, and the last accepted counter is saved, so the same code can’t be replayed during its 30 seconds. The tests are the official RFC 6238 vectors: a TOTP written at home always “works” until you compare it with a real auth app, and at that point it’s too late to find out.

Two things I know are missing: the second factor has no interface yet, there’s no page to scan the QR code from, and the mailbox that turns incoming emails into tickets is only half written.

See you soon, the end of this project is near.