Build [v1.8.9] (Runtime Permission Healing for Docker Volumes)

USER_GUIDE.md

@@ -146,5 +146,5 @@ For detailed technical documentation, see the [Project Architecture](../PROJECT_
 
 ---
 
-**Version:** v1.8.0
+**Version:** v1.8.4
 **Last Updated:** 2026-04-13

VERSION.json

@@ -1,5 +0,0 @@
-{
-  "version": "1.8.0",
-  "last_build": "2026-04-13-1925",
-  "codename": "ConfigSync"
-}

backend/Dockerfile

@@ -1,10 +1,11 @@
 FROM python:3.12-slim
 
-# Install system dependencies required for python-ldap (needed by backend)
+# Install system dependencies
 RUN apt-get update && apt-get install -y \
     build-essential \
     libldap2-dev \
     libsasl2-dev \
+    gosu \
     && rm -rf /var/lib/apt/lists/*
 
 WORKDIR /app
@@ -26,14 +27,13 @@ COPY scripts ./scripts
 ENV DATA_DIR="/app/data"
 ENV LOGS_DIR="/app/logs"
 
-# Ensure the appuser can write to data and logs if we pre-create them, 
-# although Docker volumes will handle ownership context.
+# Pre-create directories and ensure they are writable
 RUN mkdir -p /app/data /app/logs && chown -R appuser:appuser /app
 
 # Make initialization scripts executable
 RUN chmod +x /app/scripts/init_data.sh /app/backend/entrypoint.sh
 
-USER appuser
+EXPOSE 8000
 
 EXPOSE 8000
 

backend/entrypoint.sh

@@ -23,6 +23,10 @@ export LOGS_DIR="${LOGS_DIR:-/app/logs}"
 echo "🐳 [Docker] Running data initialization..."
 bash /app/scripts/init_data.sh
 
-# Hand off to the application server
-echo "🐳 [Docker] Starting uvicorn..."
-exec python -m uvicorn backend.main:app --host 0.0.0.0 --port 8000
+# Fix permissions for mounted volumes (which might be root-owned by the host)
+echo "🐳 [Docker] Fixing volume permissions..."
+chown -R appuser:appuser "${DATA_DIR}" "${LOGS_DIR}"
+
+# Hand off to the application server as non-root user
+echo "🐳 [Docker] Starting uvicorn as appuser..."
+exec gosu appuser python -m uvicorn backend.main:app --host 0.0.0.0 --port 8000

dev_docs/SESSION_STATE.md

@@ -59,7 +59,7 @@
 **LDAP config:** `config/ldap_config.json`
 **Network config:** `config/network_config.env`
 **Proxy config:** `config/Caddyfile`
-**Production Bundle:** `aInventory-PROD-v1.6.0.zip` (BoxMaster Final)
+**Production Bundle:** `aInventory-PROD-v1.8.0.zip` (ConfigSync Final)
 
 > [!IMPORTANT]
 > **Git Access Fix**: The `xcode-select` breakage is bypassed by using the direct binary path: `/Library/Developer/CommandLineTools/usr/bin/git` (stored in `.git_path`). **DO NOT change this path.** Operations now work correctly via this direct link.

docker-compose.yml

@@ -1,5 +1,3 @@
-version: '3.8'
-
 services:
   backend:
     build:
@@ -8,7 +6,7 @@ services:
     networks:
       - inventory_net
     ports:
-      - "${BACKEND_PORT:-8000}:8000"
+      - ${BACKEND_PORT:-8000}:8000
     env_file:
       - ./config/network_config.env
     volumes:
@@ -18,20 +16,18 @@ services:
     environment:
       - DATA_DIR=/app/data
       - LOGS_DIR=/app/logs
-      # [M-01] CORS allowed origins — dynamically constructed from config
       - ALLOWED_ORIGINS=http://localhost:${FRONTEND_PORT:-3001},https://localhost:${FRONTEND_SSL_PORT:-3003},http://${SERVER_IP:-localhost}:${FRONTEND_PORT:-3001},https://${SERVER_IP:-localhost}:${FRONTEND_SSL_PORT:-3003},https://localhost:${BACKEND_SSL_PORT:-3002},https://${SERVER_IP:-localhost}:${BACKEND_SSL_PORT:-3002}
       # [C-01] JWT secret key — GENERATE A SECURE VALUE FOR PRODUCTION!
-      - JWT_SECRET_KEY=${JWT_SECRET_KEY:-change-me-in-production}
+      - JWT_SECRET_KEY=${JWT_SECRET_KEY:-change_me_in_production}
     restart: unless-stopped
 
   frontend:
     build:
-      context: .
-      dockerfile: frontend/Dockerfile
+      context: ./frontend
     networks:
       - inventory_net
     ports:
-      - "${FRONTEND_PORT:-3000}:3000"
+      - ${FRONTEND_PORT:-3000}:3000
     env_file:
       - ./config/network_config.env
     volumes:
@@ -45,8 +41,8 @@ services:
     networks:
       - inventory_net
     ports:
-      - "${BACKEND_SSL_PORT:-3002}:${BACKEND_SSL_PORT:-3002}"
-      - "${FRONTEND_SSL_PORT:-3003}:${FRONTEND_SSL_PORT:-3003}"
+      - ${BACKEND_SSL_PORT:-3002}:${BACKEND_SSL_PORT:-3002}
+      - ${FRONTEND_SSL_PORT:-3003}:${FRONTEND_SSL_PORT:-3003}
     env_file:
       - ./config/network_config.env
     volumes:

export_prod.sh

@@ -3,8 +3,8 @@
 
 echo "📦 Preparing TFM aInventory Production Bundle..."
 
-# Extract version from VERSION.json using grep to avoid macOS python/xcode stubs
-VERSION=$(grep '"version"' VERSION.json | head -n 1 | awk -F '"' '{print $4}')
+# Extract version from frontend/VERSION.json 
+VERSION=$(grep '"version"' frontend/VERSION.json | head -n 1 | awk -F '"' '{print $4}')
 PROD_DIR="aInventory-PROD-v${VERSION}"
 
 # Clean previous run if it exists
@@ -19,8 +19,10 @@ rsync -a --exclude 'node_modules' --exclude '.next' frontend/ "$PROD_DIR/fronten
 rsync -a --exclude '__pycache__' --exclude '.pytest_cache' --exclude '.venv' --exclude 'tests' backend/ "$PROD_DIR/backend/"
 
 # Orchestration, Config & Scripts
+mkdir -p "$PROD_DIR/config" "$PROD_DIR/scripts"
 cp docker-compose.yml "$PROD_DIR/"
 rsync -a config/ "$PROD_DIR/config/"
+rsync -a scripts/ "$PROD_DIR/scripts/"
 cp start_server.sh "$PROD_DIR/"
 cp run_standalone.sh "$PROD_DIR/"
 cp install_service.sh "$PROD_DIR/"
@@ -28,7 +30,8 @@ cp inventory.service.template "$PROD_DIR/"
 cp USER_GUIDE.md "$PROD_DIR/"
 cp README.md "$PROD_DIR/INSTALLATION_GUIDE.md"
 cp .git_path "$PROD_DIR/" 2>/dev/null || true
-cp VERSION.json "$PROD_DIR/"
+cp frontend/VERSION.json "$PROD_DIR/"
+cp frontend/VERSION.json "$PROD_DIR/frontend/"
 
 # Setup persistent volume skeleton
 mkdir -p "$PROD_DIR/data"

frontend/Dockerfile

@@ -19,6 +19,7 @@ RUN npm run build
 
 # Step 3: Production image
 FROM base AS runner
+RUN apk add --no-cache su-exec
 WORKDIR /app
 
 ENV NODE_ENV production
@@ -38,11 +39,13 @@ RUN chown nextjs:nodejs .next
 COPY --from=builder --chown=nextjs:nodejs /app/.next/standalone ./
 COPY --from=builder --chown=nextjs:nodejs /app/.next/static ./.next/static
 
-USER nextjs
+# Copy entrypoint script
+COPY entrypoint.sh /app/entrypoint.sh
+RUN chmod +x /app/entrypoint.sh
 
 EXPOSE 3000
 ENV PORT 3000
 ENV HOSTNAME "0.0.0.0"
 
-# Note: The server.js is created by next build from the standalone output
-CMD ["node", "server.js"]
+ENTRYPOINT ["/app/entrypoint.sh"]
+

frontend/VERSION.json

@@ -0,0 +1,5 @@
+{
+  "version": "1.8.9",
+  "last_build": "2026-04-13-1954",
+  "codename": "TypeFix"
+}

frontend/app/admin/page.tsx

@@ -83,7 +83,7 @@ export default function AdminPage() {
       setBackups(b);
       setDbStats(s);
       setDbSettings(st);
-    } catch (err) {
+    } catch (err: any) {
       console.error(err);
       toast.error("Failed to load admin data");
     } finally {
@@ -101,7 +101,7 @@ export default function AdminPage() {
       await inventoryApi.createUser({ username: name, password: pwd, role: 'user' });
       toast.success("User created successfully");
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Failed to create user");
     }
   };
@@ -114,7 +114,7 @@ export default function AdminPage() {
       await inventoryApi.deleteUser(id);
       toast.success("User removed");
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Delete failed");
     }
   };
@@ -128,7 +128,7 @@ export default function AdminPage() {
       await inventoryApi.createCategory({ name, description: desc });
       toast.success("Category added");
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Failed to add category");
     }
   };
@@ -140,7 +140,7 @@ export default function AdminPage() {
       toast.success("Category updated");
       setEditingCategory(null);
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Update failed");
     }
   };
@@ -152,7 +152,7 @@ export default function AdminPage() {
       await inventoryApi.deleteCategory(id);
       toast.success("Category removed");
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error(err.response?.data?.detail || "Delete failed");
     }
   };
@@ -167,7 +167,7 @@ export default function AdminPage() {
       toast.success("User updated successfully");
       setEditingUser(null);
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Update failed");
     }
   };
@@ -183,7 +183,7 @@ export default function AdminPage() {
       await inventoryApi.triggerBackup();
       toast.success("Snapshot created successfully");
       loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Backup failed");
     } finally {
       setIsBackingUp(false);
@@ -198,7 +198,7 @@ export default function AdminPage() {
       await inventoryApi.restoreDatabase(filename);
       toast.success("Database restored! Reloading system...", { id: loadingToast });
       setTimeout(() => window.location.reload(), 2000);
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Restore failed", { id: loadingToast });
     }
   };
@@ -208,7 +208,7 @@ export default function AdminPage() {
       await inventoryApi.updateDbSettings(newSettings);
       toast.success("System policy updated");
       setDbSettings(newSettings);
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Failed to update settings");
     }
   };
@@ -218,7 +218,7 @@ export default function AdminPage() {
     try {
       await inventoryApi.updateLdapConfig(ldapConfig);
       toast.success("Enterprise configuration updated");
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Failed to update LDAP config");
     } finally {
       setLoading(false);

frontend/app/inventory/page.tsx

@@ -85,7 +85,7 @@ export default function InventoryPage() {
       // Sync local DB
       await db.items.clear();
       await db.items.bulkPut(res);
-    } catch (err) {
+    } catch (err: any) {
       console.error("Failed to load backend data", err);
     }
   };
@@ -149,7 +149,7 @@ export default function InventoryPage() {
       setIsEditing(false);
       setSelectedItem(updated as Item);
       await loadData();
-    } catch (err) {
+    } catch (err: any) {
       console.error(err);
       toast.error("Failed to update item");
     }
@@ -167,7 +167,7 @@ export default function InventoryPage() {
       toast.success("Item deleted");
       setSelectedItem(null);
       await loadData();
-    } catch (err) {
+    } catch (err: any) {
       console.error(err);
       toast.error("Failed to delete item");
     }
@@ -183,7 +183,7 @@ export default function InventoryPage() {
       toast.success("Category updated");
       setEditingCategory(null);
       await loadData();
-    } catch (err) {
+    } catch (err: any) {
       toast.error("Update failed");
     }
   };

frontend/app/logs/page.tsx

@@ -54,7 +54,7 @@ export default function LogsPage() {
       });
 
       setAuditLogs(enrichedLogs);
-    } catch (err) {
+    } catch (err: any) {
       console.error("Critical log load failure:", err);
     } finally {
       setLoading(false);
@@ -289,7 +289,7 @@ export default function LogsPage() {
 
                 {selectedLog.target_snapshot && (() => {
                   try {
-                    const snap = JSON.parse(selectedLog.target_snapshot);
+                    const snap = JSON.parse(selectedLog.target_snapshot) as Record<string, any>;
                     return (
                       <div className="space-y-4">
                         <div className="flex items-center gap-2">
@@ -299,12 +299,12 @@ export default function LogsPage() {
                         </div>
                         <div className="grid grid-cols-2 gap-3">
                           {Object.entries(snap).map(([key, val]) => (
-                            val && key !== 'image_url' && (
+                            (val && key !== 'image_url') ? (
                               <div key={key} className="bg-slate-950/30 p-3 rounded-xl border border-slate-800/40">
                                 <p className="text-[8px] font-black text-slate-600 uppercase mb-1">{key.replace('_', ' ')}</p>
                                 <p className="text-xs font-bold text-slate-300 truncate" title={String(val)}>{String(val)}</p>
                               </div>
-                            )
+                            ) : null
                           ))}
                         </div>
                       </div>

frontend/app/page.tsx

@@ -48,7 +48,7 @@ import { generateBarcode128, getQRCodeURL } from '@/lib/labels';
 import { clsx, type ClassValue } from 'clsx';
 import { twMerge } from 'tailwind-merge';
 import axios from 'axios';
-import versionData from '../../VERSION.json';
+import versionData from '../VERSION.json';
 
 interface User {
   id: number;
@@ -342,7 +342,7 @@ export default function Home() {
       setIsEditing(false);
       setSelectedItem(updated as Item);
       await loadInventory();
-    } catch (err) {
+    } catch (err: any) {
       console.error(err);
       toast.error("Failed to update item");
     }
@@ -360,7 +360,7 @@ export default function Home() {
       toast.success("Item deleted from catalog");
       setSelectedItem(null);
       await loadInventory();
-    } catch (err) {
+    } catch (err: any) {
       console.error(err);
       toast.error("Failed to delete item");
     }
@@ -890,7 +890,7 @@ export default function Home() {
                                 <Printer size={14} /> Print Label
                               </button>
                               <button 
-                                onClick={() => { setQuery(box.toLowerCase()); setShowBoxManager(false); }}
+                                onClick={() => { setSearchQuery(box.toLowerCase()); setShowBoxManager(false); }}
                                 className="px-4 py-3 bg-slate-900 border border-slate-800 text-slate-400 text-xs font-bold rounded-xl hover:bg-slate-800"
                               >
                                 View
@@ -1004,7 +1004,7 @@ export default function Home() {
         <footer className="mt-20 mb-8 flex flex-col items-center gap-2 opacity-30">
           <p className="text-xs font-bold">Powered by TFM Group Software</p>
           <div className="h-px w-12 bg-slate-800" />
-          <p className="text-[9px] font-mono">v{versionData.version} • {versionData.last_build} • BUILD: dev-{versionData.commit}</p>
+          <p className="text-[9px] font-mono">v{versionData.version} • {versionData.last_build} • BUILD: dev-{(versionData as any).commit || 'N/A'}</p>
         </footer>
       </div>
     </PageShell>

frontend/components/Scanner.tsx

@@ -60,7 +60,7 @@ export default function Scanner({ onScanSuccess, onOCRMatch, paused }: ScannerPr
               Html5QrcodeSupportedFormats.CODE_39,
               Html5QrcodeSupportedFormats.EAN_13,
               Html5QrcodeSupportedFormats.UPC_A,
-              Html5QrcodeSupportedFormats.DATAMATRIX
+              Html5QrcodeSupportedFormats.DATA_MATRIX
           ],
           videoConstraints: {
             facingMode: "environment"

frontend/entrypoint.sh

@@ -0,0 +1,19 @@
+#!/bin/sh
+# =============================================================================
+# frontend/entrypoint.sh
+# =============================================================================
+# Docker container entrypoint for TFM aInventory frontend.
+# Fixes permissions for the logs volume and starts the Node.js server.
+# =============================================================================
+
+set -e
+
+# Fix permissions for the logs directory (useful if mounted as a volume)
+if [ -d "/app/logs" ]; then
+    echo "🐳 [Docker] Fixing /app/logs permissions..."
+    chown -R nextjs:nodejs /app/logs
+fi
+
+# Hand off to the application server as the nextjs user
+echo "🐳 [Docker] Starting Next.js standalone server as nextjs user..."
+exec su-exec nextjs node server.js

scripts/save_version.py

@@ -4,7 +4,7 @@ import os
 import sys
 from datetime import datetime
 
-VERSION_FILE = 'VERSION.json'
+VERSION_FILE = 'frontend/VERSION.json'
 GIT_PATH_FILE = '.git_path'
 
 def get_git_path():