ToolNaka — Hardening & Delivery Handoff
Industrial B2B procurement platform · https://toolsnaka.store
Live
Auth hardened
Delivery format removed
DB tuned
Report generated 2026-09-12 · Next.js 16 · Prisma 6 · SQLite
1. What was completed this run
Delivery format
Removed 100%
ToolNaka-side fleet, rider, GPS-tracking and vehicle/settlement UI stripped from the vendor dashboard; landing-page claims rewritten to vendor-hand delivery.
API security
25 routes secured
Every previously-open /api/* handler now requires a valid Bearer token (verifyToken).
Database
13 new indexes
WAL journal + 5s busy-timeout enabled; daily automated backups scheduled.
Plant Head Oversight
Verified end-to-end
Vendor→parts visibility, department ordering, flag/clear with reason.
2. Delivery-format removal (frontend + backend)
| Area | Action | Evidence |
|---|
| Vendor dashboard | Removed Delivery tab, NAV entry, MOCK_DELIVERIES, DELIVERY_STEPS, VEHICLE_OPTIONS, VehicleOption/DeliveryStatus types, deliveries state & fetch | File rebuilt from source package; tsc 0 |
| Landing page | “Live Delivery Tracking” → “Vendor-Managed Delivery”; GPS/partner copy rewritten | Live HTML check: old string absent, new string present |
| Legacy APIs | /api/delivery, /api/riders, /api/rider, /api/nearby, /api/zones, /api/zone-vendors, /api/driver-profile | All 404 live |
3. API authentication hardening
25 routes that previously accepted unauthenticated requests now enforce a signed JWT. A global client-side fetch interceptor (AuthFetchPatch) auto-attaches the current user’s Bearer token to every /api/ call, so existing UI flows keep working.
| Test | Result |
|---|
| 15 protected GET routes without a token | 401 Unauthorized (all 15) |
POST /api/challan-invoices without a token | 401 |
| Authenticated factory token → orders / invoices / challans / monthly-bills | 200 (all 4) |
| Client interceptor present in deployed bundle | Found in static/chunks |
4. Database reliability & scale
| Item | Detail | Verification |
|---|
| WAL journal mode | PRAGMA journal_mode=WAL | journal_mode = wal (Prisma query) |
| busy timeout | PRAGMA busy_timeout=5000; pool connection_limit=1 | Applied at startup in src/lib/db.ts |
| Indexes added | Product(name), Product(vendorId,isActive), Product(category,isActive), Order(factoryId,status), Order(vendorId,status), Order(createdAt), OrderItem(orderId/productId), Invoice(factoryId/paymentStatus,status,createdAt), Challan(factoryId/vendorId,status,createdAt,monthlyBillId), ChallanItem(challanId) | 39 total custom indexes confirmed via sqlite_master |
| Pagination | /api/products?limit=&page= (legacy full list capped at 500) | limit=3 → 3 of 35, 12 pages; no-param → 35 |
| Daily backup | scripts/backup-db.cjs (VACUUM INTO / file-copy fallback, keeps 14) | Snapshot created (~2.6 MB); Windows task ToolNakaDbBackup @ 02:30 |
5. Plant Head Oversight (verified live)
GET /api/oversight -> 200
vendors: 1 departments: 1 recentOrders: 4
totals: { orderCount: 4, value: 17464, vendorCount: 1, flaggedCount: 0 }
POST /api/oversight { orderId, action: "flag"|"clear", reason } -> 200
Test account planthead@test.com seeded against the demo factory; oversight tab renders vendor→parts, department table and per-order Flag/Stop + Clear&Proceed controls.
6. Live endpoint verification
| Check | Status |
|---|
| Health | 200 {"status":"ok","db":"ok"} |
| Landing page | 200 |
| Removed delivery routes | 404 ×7 |
| Unauthenticated protected routes | 401 ×16 |
| Authenticated factory/vendor/plant-head flows | 200 |
6b. Fresh-start reset (2026-09-13)
The site is brand new, so all registered accounts and their data were cleared so real registrations can begin on a clean slate.
| Item | Before → After |
|---|
| Accounts (factory / vendor / dept_manager / plant_head / delivery) | 19 → 0 (only admin@toolnaka.com kept) |
| Products | 38 → 0 |
| Orders / Order items | 4 / 4 → 0 |
| Challans / items, Invoices, Monthly bills | 34 / 17 / 2 → 0 |
| RFQs / quotations, Part requests / responses, Payments | 4 / 5 / 5 / 4 / 6 → 0 |
| Vendors / vendor profiles / factory profiles | 3 / 5 / 7 → 0 |
| Kept | PincodeCoverage reference data (19 rows) |
| Safety | Full DB snapshot taken before the wipe (kept in backups/) |
| UI | Admin dashboard mock-seeded lists emptied and obsolete delivery/fleet tabs (Deliveries, Zones & Coverage, Settlements) removed |
Verified live: /api/products returns 0; all dashboards start from empty state.
7. How to operate
- Site:
https://toolsnaka.store (Cloudflare named tunnel toolsnaka; laptop is origin).
- Watchdog: Windows task
ToolNakaPreviewWatchdog (v4) restarts the server + named tunnel on drift/logon, and now performs a health-based tunnel check every 20s — if toolsnaka.store/api/health fails 3 cycles in a row it force-restarts cloudflared. This recovers the silent-530 failure mode seen on 2026-09-13.
- Monthly bills: task
ToolNakaMonthlyBills (daily 00:05) runs scripts/auto-generate-bills.cjs.
- Backups: task
ToolNakaDbBackup (daily 02:30) → backups/, keeps 14 snapshots.
- Build/deploy ritual: stop watchdog + standalone →
npm run build → copy DELIVERY/*.html to .next/standalone/public/ → start watchdog → health check.
- DB push: stop watchdog + standalone first (Windows DLL lock), then
npx prisma db push.
8. Remaining / next
Known open items (not blockers):
- Payments remain SCAFFOLD-only (no live gateway).
- 2Factor.in SMS needs manual account registration to move off demo OTP.
- 24/7 uptime depends on the laptop; migrate to a VPS when SSH access is provided.
- Vendor Billing tab and richer Challan creation form remain optional UI polish.
- Demo credentials:
factory@toolnaka.com / factory123, vendor@toolnaka.com / vendor123, planthead@test.com / plant123.