Refactor: centralize Zod schemas and fully integrate into API routes
Improvements #1-3 deepening:
1. Server-side invoice amount validation
- All amounts (qty × unitPrice) recalculated server-side using tax.ts
- Prevents client-side manipulation attacks
- Supports kleinunternehmer auto-inheritance
2. Comprehensive audit logging
- LogAction type extended with 11 new actions
- All CRUD operations now logged with metadata
- Metadata includes: amounts, counts, status transitions, oldStatus/newStatus
3. Advanced Zod validation (centralized)
- New file: app/lib/schemas.ts (220 lines, 18+ validators)
- Custom validators: currencySchema, taxRateSchema, ibanSchema, taxIdSchema, vatIdSchema
- All API routes (invoices, companies, customers) now use centralized schemas
- Consistent German error messages
- Single source of truth for validation logic
Additional improvements:
- DB indices applied: invoices(status, dueDate, deletedAt, customerId), customers(companyId)
- Migration 20260415192953_add_indices applied successfully
- Build succeeds without critical errors
- TypeScript compilation validates all schemas
Files modified:
- app/lib/schemas.ts (NEW)
- app/routes/api.invoices.ts (uses centralized schemas)
- app/routes/api.invoices.$id.ts (status transition validation)
- app/routes/api.companies.ts, api.companies.$id.ts
- app/routes/api.customers.ts, api.customers.$id.ts
- app/lib/logger.server.ts (metadata support)
- prisma/schema.prisma (indices)
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
hwinkel
f10a79471e