Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension

Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
11 changes: 2 additions & 9 deletions .tsc-baseline.json
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"generatedAt": "2026-05-10T00:32:16.986Z",
"totalErrors": 924,
"generatedAt": "2026-05-10T01:02:08.855Z",
"totalErrors": 892,
"counts": {
"src/components/admin/DiscountApprovalQueue.tsx": {
"TS18048": 1
Expand Down Expand Up @@ -627,13 +627,6 @@
"src/hooks/useReplenishmentsSelectionMode.ts": {
"TS2352": 1
},
"src/hooks/useSalesGoals.ts": {
"TS2769": 6,
"TS2345": 5,
"TS2322": 10,
"TS2339": 10,
"TS2353": 1
},
"src/hooks/useScheduledReports.ts": {
"TS2322": 1
},
Expand Down
19 changes: 7 additions & 12 deletions src/hooks/useSalesGoals.ts
Original file line number Diff line number Diff line change
@@ -1,5 +1,5 @@
import { useQuery, useMutation, useQueryClient } from "@tanstack/react-query";
import { supabase } from "@/integrations/supabase/client";
import { untypedFrom } from "@/lib/supabase-untyped";
import { useAuth } from "@/contexts/AuthContext";
import { toast } from "sonner";
import { startOfMonth, endOfMonth, startOfWeek, endOfWeek, startOfQuarter, endOfQuarter, format } from "date-fns";
Expand Down Expand Up @@ -55,8 +55,7 @@ export function useSalesGoals() {
queryFn: async () => {
if (!user?.id) return [];

const { data, error } = await supabase
.from("sales_goals")
const { data, error } = await untypedFrom<SalesGoal>("sales_goals")
.select("*")
.eq("user_id", user.id)
.order("created_at", { ascending: false });
Expand All @@ -75,8 +74,7 @@ export function useSalesGoals() {

const now = new Date().toISOString().split("T")[0];

const { data, error } = await supabase
.from("sales_goals")
const { data, error } = await untypedFrom<SalesGoal>("sales_goals")
.select("*")
.eq("user_id", user.id)
.lte("start_date", now)
Expand All @@ -97,8 +95,7 @@ export function useSalesGoals() {

const { start, end } = getDateRange(input.goal_type);

const { data, error } = await supabase
.from("sales_goals")
const { data, error } = await untypedFrom<SalesGoal>("sales_goals")
.insert({
user_id: user.id,
goal_type: input.goal_type,
Expand Down Expand Up @@ -143,8 +140,7 @@ export function useSalesGoals() {
if (!user?.id) throw new Error("Not authenticated");

// Get current goal
const { data: currentGoal, error: fetchError } = await supabase
.from("sales_goals")
const { data: currentGoal, error: fetchError } = await untypedFrom<SalesGoal>("sales_goals")
.select("*")
.eq("id", goalId)
.single();
Comment on lines +143 to 146
Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

⚠️ Potential issue | 🟠 Major | ⚡ Quick win

🧩 Analysis chain

🏁 Script executed:

cat -n src/hooks/useSalesGoals.ts

Repository: adm01-debug/Promo_Gifts

Length of output: 9028


Adicionar filtro user_id em update/delete de metas para evitar alteração fora da conta.

Em updateProgressMutation (linhas 143-146 e 162-171) e deleteGoalMutation (linha 196), o filtro está restrito apenas a id. Se houver falha de RLS no banco, isso abre brecha para atuar em metas de outro usuário.

Adicione .eq("user_id", user.id) nas queries de leitura e atualização, e valide autenticação no delete (padrão já usado em createGoalMutation nas linhas 94 e 98).

🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@src/hooks/useSalesGoals.ts` around lines 143 - 146, Na função useSalesGoals,
ajuste as mutações que lêem/alteram/removem metas para garantir que só afetem
metas do usuário autenticado: em updateProgressMutation (onde você usa
untypedFrom<SalesGoal>("sales_goals").select(...).eq("id", goalId) e na seção de
update que faz .update(...).eq("id", goalId)) adicione .eq("user_id", user.id)
aos mesmos queries; em deleteGoalMutation, adicione .eq("user_id", user.id) ao
delete query e garanta que o usuário esteja autenticado (mesma validação usada
em createGoalMutation que verifica user/id antes de prosseguir). Isso evita
alterações/leitura de metas de outros usuários caso RLS falhe.

Expand All @@ -163,8 +159,7 @@ export function useSalesGoals() {

const wasNotAchieved = !currentGoal.is_achieved;

const { data, error } = await supabase
.from("sales_goals")
const { data, error } = await untypedFrom<SalesGoal>("sales_goals")
.update({
current_value: newValue,
current_quotes: newQuotes,
Expand Down Expand Up @@ -198,7 +193,7 @@ export function useSalesGoals() {
// Delete goal mutation
const deleteGoalMutation = useMutation({
mutationFn: async (goalId: string) => {
const { error } = await supabase.from("sales_goals").delete().eq("id", goalId);
const { error } = await untypedFrom<SalesGoal>("sales_goals").delete().eq("id", goalId);
if (error) throw error;
},
onSuccess: () => {
Expand Down
Loading