Traqify
Get started

Changelog

All notable changes to Traqify are documented in this file. Format follows Keep a Changelog.

v1.23.0 - 2026-05-20

Documentation

  • backend/README.md full rewrite with Mermaid diagrams, middleware pipeline, full API reference, and ER diagram
  • frontend/README.md full rewrite with component architecture, route map, sequence diagrams, and state management reference
  • SECURITY.md rewritten to reflect all active security controls including tokenVersion, OTP hashing, OAuth code exchange, Paystack verification, and cron protection

v1.22.0 - 2026-05-20

Security — 17 vulnerabilities fixed

  • OAuth tokens no longer placed in redirect URL; stored in OAuthSession, exchanged via one-time code
  • tokenVersion added to all JWTs; incremented on logout and password change
  • OTPs hashed with SHA-256 before storage; only hash persisted
  • OTP invalidated after 5 failed attempts
  • Paystack verified amount compared to server-calculated order total
  • Newsletter subscribers scoped to organization
  • forgotPassword returns same response whether account exists or not
  • SSRF guard on downloadable product file URLs
  • changePassword enforces full complexity rules
  • acceptInvite password requires special character
  • upload-file endpoint has explicit MIME allowlist
  • notFound middleware registered before error handler
  • Startup validation for 5 required env vars
  • Removed withCredentials: true from Axios
  • Morgan uses short format in production
  • GET /api/staff restricted to AUDITOR+
  • Deleted unauthenticated POST /api/auth/google endpoint

v1.21.0 - 2026-05-19

Added

  • Daily Vercel Cron job to prevent Supabase database pausing (GET /api/cron/ping at 06:00 UTC)
  • CRON_SECRET environment variable with Bearer header validation

Fixed

  • White navbar now applied immediately on page load for /system, /changelog, /security, /license, /contributing, /privacy, /terms (previously required scroll)
  • Footer 5-column desktop layout: all five sections now appear in a single row

v1.20.0 - 2026-05-17

Added

  • Delete confirmation modal on Reviews page
  • Category pill on store product cards
  • Total review count on store product cards
  • Downloadable product email attachments
  • Invited user registration block

Changed

  • Google OAuth and email/password login are no longer mutually exclusive
  • Mobile padding on all landing page sections
  • Mobile padding on all dashboard pages
  • Mobile padding on store pages
  • Hero image column mobile padding
  • FAQ answers rewritten
  • Footer mobile layout
  • Email footer formatting

Fixed

  • 5.0 default rating bug

v1.19.0 - 2026-05-12

Added

  • Approval/rejection confirmation modals on Reviews page
  • Mark-delivered confirmation modal on Logistics page
  • Quick Links card after charts on Overview page

Changed

  • New manual order initial status is now APPROVED
  • Traqify brand logo in all platform email templates

Fixed

  • Report routes audit

v1.18.0 - 2026-05-12

Added

  • Per-chart independent period filters on Overview page
  • Quick Links card on Overview page

Fixed

  • Downloadable file upload 500 error

v1.17.0 - 2026-05-12

Added

  • Publish confirmation modal on Add Product page
  • Save confirmation modal on Edit Product page
  • Dedicated downloadable file upload endpoint
  • Unified product edit page
  • Product category immutability

Changed

  • Products list page
  • Downloadable file upload
  • Mobile-first responsive layout across all dashboard pages
  • Mobile sidebar

Fixed

  • Upload 400 on downloadable file

v1.16.0 - 2026-05-12

Added

  • 60-day chart period
  • Revenue growth "New this month" indicator

Changed

  • getRevenueChart migrated from $queryRaw to findMany
  • getCustomerChart baseline seeding
  • createOrder payment is inside the transaction
  • Overview period change re-fetches KPI cards

Fixed

  • Customer source on store checkout
  • Revenue chart missing store-checkout revenue
  • getCustomerChart Y-axis starting at 0

v1.15.0 - 2025-05-27

Added

  • Manual order: inline customer creation (Walk-in, Existing, New customer picker)
  • Manual order: customer confirmation email when new customer provides email
  • Shared storeOrderConfirmationEmailTemplate for dashboard and store checkout
  • Product average rating computed from approved reviews on list and store endpoints
  • Rating displayed as "4.8/5.0" on dashboard, store cards, and product detail page

Changed

  • All email templates standardised to white mode; emojis removed
  • Store-facing emails moved to wrapStoreEmail wrapper
  • Overview charts converted to ComposedChart (Bar + Area gradient)
  • updateOrderStatus passes org contact to email templates

Fixed

  • Product star rating showing count instead of average
  • Store product detail review list format

v1.14.0 - 2025-05-11

Added

  • Payment auto-backfill: GET /api/payments auto-creates Payment records for COMPLETED/APPROVED orders with no record on first load
  • Dashboard order creation now immediately creates a COMPLETED Payment record

Changed

  • Overview revenue aggregates Payment.amount (status=COMPLETED) instead of Order.totalAmount
  • Revenue and customer charts fill full date range with zeros for missing days
  • All chart Y-axes start at 0; period change refreshes KPI cards
  • Window focus refresh re-fetches all overview data

Fixed

  • Payments page empty for existing orders before Payment model introduction
  • Revenue chart missing store-checkout revenue
  • Customer chart starting above 0

v1.13.0 - 2025-05-13

Added

  • Payments auto-creation on store checkout (PENDING for transfer, COMPLETED for Paystack)
  • Staff removal notification email
  • Customer view modal with contact info and up to 5 recent orders
  • Reviews stats cards: total, average, pending, approved
  • Review order context displays linked order number
  • Newsletter CSV export now includes Status column
  • Audit Logs report card with PDF download on Reports page
  • Audit Logs PDF report type with date-range filter

Changed

  • Reports 400 guard removed; empty PDFs render "No data available" instead
  • Audit log detail page: full-width, responsive padding, wider meta grid
  • Footer newsletter form migrated to react-hook-form + zod

Fixed

  • Payments page empty (no Payment record created at checkout)
  • Reports 400 on empty date range
  • order.controller.ts type error on newOrderEmailTemplate

v1.11.0 - 2025-05-10

Added

  • Staff page: pending invite badges and Cancel invite action
  • Lazy expiry detection in getInvites with audit log entry
  • Payments and Customers pages: modal overlay for add actions
  • First-time welcome modal with role-specific message for invited members
  • Invite accept page redesigned: header inside card, left-aligned, eye icon on confirm field
  • Settings Company tab now visible to all roles (read-only for non-OWNER)
  • Password change rejects passwords containing name or email

Changed

  • Staff invite expiry extended from 48 hours to 3 days
  • Email template invite copy updated to "3 days"

Fixed

  • Review controller: added error logging for Vercel function logs

v1.10.0 - 2026-05-10

Added

  • Profile: phone and role fields in Settings (2x2 grid; role is immutable)
  • Payments report PDF with reference, method, amount, status, order, date columns
  • Payment Tracking feature card on landing page
  • Audit log row click navigates to detail page
  • Audit log mark-read success modal

Changed

  • Report PDF tagline: "Enterprise Store Management System"
  • Notification bell limited to 3 recent notifications; compact single-line format
  • Overview header: Open Storefront button and live clock inline on all screen sizes
  • Em dashes removed from all source files and documentation

Fixed

  • Prisma client regenerated after Payment model confirmation

v1.9.0 - 2026-05-10

Added

  • Payments module: Payment model, backend CRUD, frontend page with summary cards, filter, paginated table, inline status update modal
  • Payments report card on Reports page
  • Audit log detail page: /dashboard/[slug]/audit-logs/[id]
  • Notification bell in topbar with dropdown (6 recent logs, unread count, mark all read)
  • Inventory filters: category and stock-status dropdowns
  • Store publish validation checks logo, description, email, published products, and categories
  • Customer source badge: PURCHASE (Auto) vs MANUAL

Changed

  • Registration flow calls login() from auth context after org creation; no re-login required
  • Overview welcome modal guarded by user?.organizationId
  • Sidebar nav order: enterprise-logical ordering
  • Sidebar Audit Logs: MANAGER added to allowed roles

Fixed

  • Store togglePublish syntax: missing closing brace
  • Products page missing Link import

v1.7.0 - 2026-05-10

Added

  • OTP-first registration: Step 1 sends a verification code before personal or org details are collected
  • Google auth indicator in Settings: Security tab shows "Signed in with Google"; password change hidden for Google accounts
  • Low-stock email alerts to org OWNER when inventory falls at or below threshold
  • Comprehensive audit logging: report email export, store publish/unpublish toggle

Changed

  • Register step 2/3 flow: JWT stored in React state, re-login after org creation; no manual sign-in required
  • verifyEmail handles pre-existing OTP-first flow
  • Product images on dashboard and store changed to object-cover
  • Org logo uploads go to Supabase avatars bucket; local uploads folder removed

Fixed

  • sendOTP 404 when email had no existing account
  • Register skipping org creation (was writing tokens and redirecting immediately)
  • JWT missing organizationId after org creation

v1.6.0 - 2026-05-08

Added

  • Product reviews: Review model, moderation dashboard, post-checkout submission, public review grid
  • Reviews dashboard page: tabbed PENDING/APPROVED/REJECTED, search, approve/reject/delete
  • Review count badge on dashboard product cards and public store grid
  • Staff page role and status filters
  • Newsletter refresh modal with subscriber stats summary

Changed

  • RBAC hierarchy corrected: AUDITOR (2) above CASHIER (1)
  • Sidebar Customers visible to AUDITOR
  • Overview API uses safe Prisma findMany for low-stock query
  • Store logo links to org website when set
  • Settings layout: Name/Email and Website/Description as 50/50 desktop grids

Fixed

  • Overview undefined% / undefined total orders
  • CASHIER incorrectly accessing financial reports
  • Newsletter modal JSX syntax

v1.4.0 - 2026-05-08

Added

  • Newsletter dashboard: subscriber stats, searchable table, CSV export (OWNER/MANAGER)
  • Admin new-order notification email to org OWNER
  • Overview: Open Storefront button (shows error modal if store is unpublished)
  • Overview: 7/30/90-day chart period filter
  • Products: type filter and type pill badge
  • Store description field on Organization; rendered in public store info banner
  • Store sort bar: Newest, Oldest, Price, Name A-Z
  • RBAC hardening: removeStaff and resetStaffPassword return 403 for OWNER targets

Changed

  • Orders page: table rows fully clickable; action buttons stop propagation
  • Settings: description field included in org form defaults and schema
  • Sidebar: "Store" renamed to "Storefront"; Newsletter nav item added

Fixed

  • Invite accept redirect using wrong slug field
  • initialStock / lowStockAlert validation (missing valueAsNumber)
  • updateOrgSchema missing industry and size fields
  • Logistics order count not filtering by APPROVED status
  • Admin order email orgOwner.email missing from select

v1.3.0 - 2026-05-08

Added

  • Audit log: LOGIN, CREATE/Order (store checkout), EXPORT/Report events
  • Audit log frontend: entity map extended with ProductCategory and StaffInvite
  • Order status emails: orderApprovedEmailTemplate and orderCompletedEmailTemplate
  • Low-stock email alert to org OWNER on inventory update
  • Customer chart API: GET /api/reports/customer-chart
  • Variable product attributes UI on /products/new
  • Downloadable product toggle: URL tab or file upload tab
  • Store checkout audit log via org owner ID

Changed

  • Google Fonts migrated to next/font/google (self-hosted at build time)
  • Overview order bar chart replaced with AreaChart; customer chart uses real API data
  • Product card images: object-cover (no whitespace)
  • backend/.env.example fully rewritten with section headers and dashboard links

Fixed

  • CORS broken in production (FRONTEND_URL not set on Vercel)
  • All API calls failing in production (NEXT_PUBLIC_API_URL not set)
  • Google OAuth redirect_uri_mismatch
  • Express rate-limit ERR_ERL_UNEXPECTED_X_FORWARDED_FOR
  • SMTP cold-start noise from transporter.verify()

v1.2.0 - 2026-05-08

Added

  • Supabase Storage: product images, org logos, user avatars
  • Wishlist system: localStorage + backend sync, email capture, reminder emails (30min, 2hr, 1 day, 3 days)
  • Logistics page: APPROVED orders as cards with Mark delivered button
  • APPROVED order status with quick-approve button
  • Product type field: SIMPLE, DOWNLOADABLE, VARIABLE with downloadUrl
  • Store info section: org details below products, linkable via #store-info
  • Store off-canvas mobile menu with category nav and cart/wishlist counts
  • Product detail drawer: image gallery, thumbnail strip, wishlist toggle
  • User avatar upload via POST /api/auth/upload-avatar
  • Open Graph image and updated favicon (Traqify grid mark)

Changed

  • Public store layout: 2-column (filter sidebar + products) replacing 3-column
  • updateOrderStatus now accepts APPROVED status
  • getStoreProducts filters published status and returns org contact fields

Fixed

  • Old favicon replaced with correct grid logo mark
  • Footer links overflow on mobile
  • imageUrl shown twice on hover cycle (deduped with Array.from(new Set(...)))

v1.1.0 - 2026-05-08

Added

  • Product categories: backend CRUD, admin page /dashboard/[slug]/categories, sidebar nav
  • Multi-image products: up to 4 images, first is cover, stored in imageUrls[]
  • Auto-SKU generation from product name
  • Product status: published / draft + isActive toggle
  • Store management page: /dashboard/[slug]/store with publish toggle and URL copy
  • Reports redesign: 6 report type cards, PDF download and email modal
  • Backend PDF generation with PDFKit for all report types
  • Pagination on Products (20/page) and Customers (25/page) pages

Changed

  • getProducts returns paginated results with total count
  • getCustomers returns paginated results with server-side search
  • sendEmail updated to support optional attachments array
  • Store routes filter published products and return category data

Fixed

  • Sidebar Staff nav item had wrong icon
  • Report controller items include renamed to orderItems

v1.0.0 - 2025-05-07

Initial release

  • Multi-tenant organization system with OWNER, MANAGER, CASHIER, AUDITOR roles
  • JWT authentication with refresh tokens and OTP email verification
  • Google OAuth 2.0 redirect-based sign-in
  • Product management: create, edit, deactivate, image upload
  • Inventory management: stock tracking, low-stock alerts, adjustments
  • Order management: POS-style creation, detail modal, status tracking
  • Customer management with full purchase history and profile
  • Staff management: email invitations, role assignment, account restriction
  • Public store page per org with product catalog, cart, and guest checkout
  • Real-time revenue and order analytics dashboard (role-based, Recharts)
  • Audit log system: every action logged with user, timestamp, and details
  • Settings page: profile update, password change, org management
  • Reports page: date-range sales report with totals
  • Branded HTML email templates: OTP, password reset, welcome, invite, order confirmation
  • Newsletter subscription with confirmation email
  • Full landing page: Hero, Features, Stats, HowItWorks, Testimonials, FAQ, CTA
  • Shared Navbar with mobile menu and Google login button
  • Footer with newsletter subscription form, social links, payment methods
  • Privacy Policy and Terms of Service pages
  • Custom 404 Not Found page