2 Commits

Author	SHA1	Message	Date
Damir Radulić	f5c6570d47	CC2 R4 #2+#5: remove legacy unauth /api/admin/users — close 401 gap ... The bare @app.get/post('/api/admin/users') decorators in pgz_sport_api.py were registered before app.include_router(admin_users_router) and shadowed the JWT-protected M2 routes, leaking user list to anyone. Removed all three: GET /api/admin/users, POST /api/admin/users, POST /api/admin/users/{uid}/toggle. The auth.admin_users router now owns this prefix exclusively and gates every method with require_user. Verified: no-auth → 401, invalid token → 401, valid Bearer → 200.	2026-05-05 00:44:50 +02:00
CC4-PGZ-Sport	834b7bf89f	M5.1 OCR upload + parse + invoices CRUD (ERP) ... - erp/ocr.py: FastAPI router under /api/erp/* - POST /ocr/upload: file → pgz_sport.invoice_uploads (sha256, mime, klub_id, tenant_id) - POST /ocr/parse: Tesseract+pdftotext OCR + DeepSeek V3 LLM extraction - GET/POST/PUT /invoices, /invoices/{id}/pay, uploads list - Wired into pgz_sport_api.py - HR invoice regex (OIB, IBAN, datum DD.MM.YYYY i ISO, ukupno/PDV) - DeepSeek V3 returns JSON object {izdavatelj_*, kupac_*, iznos_neto/pdv/brutto, stavke[], vrsta_troska...} Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-05-04 23:53:22 +02:00