Fix #109 implement override of edit and deletion protections

Author: kittendevv

backend/src/controllers/invoices.ts

@@ -4,6 +4,7 @@ import {
   getDatabase,
   getNextInvoiceNumber,
 } from "../database/init.ts";
+import { getSetting } from "./settings.ts";
 import {
   CreateInvoiceRequest,
   Invoice,
@@ -51,6 +52,18 @@ type PerLineCalc = {
   summary: Array<{ percent: number; taxable: number; amount: number }>;
 };
 
+function isInvoiceProtectionOverrideEnabled(): boolean {
+  const raw = getSetting("allowProtectedInvoiceChanges");
+  if (raw === null || raw === undefined) return false;
+  const normalized = String(raw).trim().toLowerCase();
+  return (
+    normalized === "true" ||
+    normalized === "1" ||
+    normalized === "yes" ||
+    normalized === "on"
+  );
+}
+
 function calculatePerLineTotals(
   items: ItemInput[],
   discountPercentage = 0,
@@ -772,7 +785,8 @@ export const updateInvoice = async (
   }
 
   const isIssued = existing.status !== "draft";
-  if (isIssued) {
+  const allowProtectedChanges = isInvoiceProtectionOverrideEnabled();
+  if (isIssued && !allowProtectedChanges) {
     const forbidden = [
       "items",
       "discountAmount",
@@ -1091,8 +1105,13 @@ export const deleteInvoice = async (id: string): Promise<boolean> => {
   const existing = await getInvoiceById(id);
   if (!existing) throw new Error("Invoice not found");
 
+  const allowProtectedChanges = isInvoiceProtectionOverrideEnabled();
   // Only draft invoices can be deleted; issued invoices must be voided for audit trail
-  if (existing.status !== "draft" && existing.status !== "voided") {
+  if (
+    !allowProtectedChanges &&
+    existing.status !== "draft" &&
+    existing.status !== "voided"
+  ) {
     throw new Error(
       "Only draft or voided invoices can be deleted. Void the invoice first.",
     );

backend/src/database/migrations.sql

@@ -22,6 +22,7 @@ INSERT OR IGNORE INTO settings (key, value) VALUES
   -- Optional default invoice number pattern (tokens: {YYYY} {YY} {MM} {DD} {DATE} {RAND4})
   ('invoiceNumberPattern', ''),
   ('invoiceNumberingEnabled', 'true'),
+  ('allowProtectedInvoiceChanges', 'false'),
   ('embedXmlInHtml', 'false'),
   -- Optional PEPPOL endpoint configuration (leave empty if not applicable)
   ('peppolSellerEndpointId', ''),

backend/src/database/migrations_clean.sql

@@ -94,7 +94,8 @@ INSERT OR IGNORE INTO settings (key, value) VALUES
   ('paymentMethods', 'Bank Transfer, PayPal, Credit Card'),
   ('bankAccount', 'Account: 1234567890, Routing: 987654321'),
   ('paymentTerms', 'Due in 30 days'),
-  ('defaultNotes', 'Thank you for your business!');
+  ('defaultNotes', 'Thank you for your business!'),
+  ('allowProtectedInvoiceChanges', 'false');
 
 -- Insert a simple default template
 INSERT OR IGNORE INTO templates (id, name, html, is_default) VALUES 

backend/src/routes/admin.ts

@@ -271,6 +271,23 @@ function normalizeLocaleSettingPayload(data: Record<string, unknown>) {
   }
 }
 
+function normalizeInvoiceProtectionSettingsPayload(data: Record<string, unknown>) {
+  if (
+    !Object.prototype.hasOwnProperty.call(data, "allowProtectedInvoiceChanges")
+  ) {
+    return;
+  }
+  const raw = String(data.allowProtectedInvoiceChanges ?? "")
+    .toLowerCase()
+    .trim();
+  const truthy = new Set(["1", "true", "yes", "y", "on"]);
+  (data as Record<string, unknown>).allowProtectedInvoiceChanges = truthy.has(
+    raw,
+  )
+    ? "true"
+    : "false";
+}
+
 // Demo mode flag (mutations allowed; periodic resets handle reverting state)
 const DEMO_MODE = isDemoMode();
 
@@ -885,6 +902,9 @@ adminRoutes.get("/settings", async (c) => {
   if (!map.dateFormat) map.dateFormat = "YYYY-MM-DD";
   if (!map.numberFormat) map.numberFormat = "comma";
   if (!map.postalCityFormat) map.postalCityFormat = "auto";
+  if (!map.allowProtectedInvoiceChanges) {
+    map.allowProtectedInvoiceChanges = "false";
+  }
   // Expose demo mode to frontend UI
   (map as Record<string, unknown>).demoMode = DEMO_MODE ? "true" : "false";
   return c.json(map);
@@ -906,6 +926,7 @@ adminRoutes.put(
     // Normalize tax-related settings
     normalizeTaxSettingsPayload(data);
     normalizeLocaleSettingPayload(data);
+    normalizeInvoiceProtectionSettingsPayload(data);
     const settings = await updateSettings(data);
     try {
       if ("logoUrl" in data) deleteSetting("logoUrl");
@@ -946,6 +967,7 @@ adminRoutes.patch(
     // Normalize tax-related settings
     normalizeTaxSettingsPayload(data);
     normalizeLocaleSettingPayload(data);
+    normalizeInvoiceProtectionSettingsPayload(data);
     const settings = await updateSettings(data);
     if (typeof data.templateId === "string" && data.templateId) {
       try {
@@ -1013,6 +1035,9 @@ adminRoutes.get("/admin/settings", async (c) => {
   if (!map.dateFormat) map.dateFormat = "YYYY-MM-DD";
   if (!map.numberFormat) map.numberFormat = "comma";
   if (!map.postalCityFormat) map.postalCityFormat = "auto";
+  if (!map.allowProtectedInvoiceChanges) {
+    map.allowProtectedInvoiceChanges = "false";
+  }
   // Expose demo mode to frontend UI for admin-prefixed route as well
   (map as Record<string, unknown>).demoMode = DEMO_MODE ? "true" : "false";
   return c.json(map);
@@ -1030,6 +1055,7 @@ adminRoutes.put(
     // Normalize tax-related settings
     normalizeTaxSettingsPayload(data);
     normalizeLocaleSettingPayload(data);
+    normalizeInvoiceProtectionSettingsPayload(data);
     const settings = await updateSettings(data);
     try {
       if ("logoUrl" in data) deleteSetting("logoUrl");
@@ -1052,6 +1078,7 @@ adminRoutes.patch(
     // Normalize tax-related settings
     normalizeTaxSettingsPayload(data);
     normalizeLocaleSettingPayload(data);
+    normalizeInvoiceProtectionSettingsPayload(data);
     const settings = await updateSettings(data);
     try {
       if ("logoUrl" in data) deleteSetting("logoUrl");

frontend/src/lib/i18n/locales/de.json

@@ -18,6 +18,8 @@
   "Appearance heading": "Darstellung",
   "Applies to invoice headings and status labels": "Gilt für Rechnungstitel und Statusbezeichnungen",
   "Apply": "Anwenden",
+  "Allow editing and deleting sent/paid invoices": "Bearbeiten und Löschen von gesendeten/bezahlten Rechnungen erlauben",
+  "Allowing edits/deletes for sent or paid invoices can violate invoice retention laws. Only enable this if you understand the legal impact.": "Das Bearbeiten/Löschen von gesendeten oder bezahlten Rechnungen kann gegen Aufbewahrungspflichten verstoßen. Aktivieren Sie dies nur, wenn Sie die rechtlichen Folgen kennen.",
   "Are you sure?": "Sind Sie sicher?",
   "Back to Customer": "Zurück zum Kunden",
   "Bank Account": "Bankkonto",
@@ -336,6 +338,7 @@
   "View all": "Alle anzeigen",
   "View public link": "Öffentlichen Link anzeigen",
   "Void Invoice": "Rechnung stornieren",
+  "Warning: you are editing a sent/paid invoice. Ensure this is legally allowed in your jurisdiction.": "Warnung: Sie bearbeiten eine gesendete/bezahlte Rechnung. Stellen Sie sicher, dass dies in Ihrer Rechtsordnung zulässig ist.",
   "Void this invoice? The invoice will be preserved but marked as voided.": "Diese Rechnung stornieren? Die Rechnung wird aufbewahrt, aber als storniert markiert.",
   "Voided": "Storniert",
   "What you need to do:": "Was Sie tun müssen:",
@@ -344,6 +347,8 @@
   "XML profiles helper": "Profile sind momentan nur eingebaut. UBL 2.1 ist der Standard und bevorzugt für E-Rechnungs Netzwerke (PEPPOL). Das stub Profile ist für interne Testzwecke.",
   "YYYY-MM-DD (2025-01-15)": "JJJJ-MM-TT (2025-01-15)",
   "Yes": "Ja",
+  "You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?": "Sie sind dabei, eine gesendete/bezahlte Rechnung zu löschen. Dies kann gegen Aufbewahrungspflichten verstoßen und kann nicht rückgängig gemacht werden. Fortfahren?",
+  "You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?": "Sie sind dabei, eine gesendete/bezahlte Rechnung zu bearbeiten. Stellen Sie sicher, dass dies in Ihrer Rechtsordnung zulässig ist. Fortfahren?",
   "password": "Passwort",
   "username": "Benutzername",
   "{{count}} item(s)": "{{count}} Position(en)"

frontend/src/lib/i18n/locales/en.json

@@ -10,6 +10,8 @@
   "2FA code": "2FA code",
   "2FA QR code": "2FA QR code",
   "Adjust the look and feel of the application.": "Adjust the look and feel of the application.",
+  "Allow editing and deleting sent/paid invoices": "Allow editing and deleting sent/paid invoices",
+  "Allowing edits/deletes for sent or paid invoices can violate invoice retention laws. Only enable this if you understand the legal impact.": "Allowing edits/deletes for sent or paid invoices can violate invoice retention laws. Only enable this if you understand the legal impact.",
   "Admin": "Admin",
   "Administrator": "Administrator",
   "Administrators have full access to all features.": "Administrators have full access to all features.",
@@ -271,6 +273,7 @@
   "View HTML": "View HTML",
   "View public link": "View public link",
   "Void Invoice": "Void Invoice",
+  "Warning: you are editing a sent/paid invoice. Ensure this is legally allowed in your jurisdiction.": "Warning: you are editing a sent/paid invoice. Ensure this is legally allowed in your jurisdiction.",
   "Void this invoice?": "Void this invoice?",
   "Voided": "Voided",
   "Welcome to Invio": "Welcome to Invio",
@@ -280,6 +283,8 @@
   "XML Profile ID": "XML Profile ID",
   "Yes": "Yes",
   "Yes, disable": "Yes, disable",
+  "You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?": "You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?",
+  "You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?": "You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?",
   "You do not have permission to modify settings.": "You do not have permission to modify settings.",
   "You do not have permission to view customers. Contact an administrator to request access.": "You do not have permission to view customers. Contact an administrator to request access.",
   "You do not have permission to view invoices. Contact an administrator to request access.": "You do not have permission to view invoices. Contact an administrator to request access.",

frontend/src/lib/i18n/locales/nl.json

@@ -18,6 +18,8 @@
   "Appearance heading": "Weergave",
   "Applies to invoice headings and status labels": "Van toepassing op factuurtitels en statuslabels",
   "Apply": "Toepassen",
+  "Allow editing and deleting sent/paid invoices": "Bewerken en verwijderen van verzonden/betaalde facturen toestaan",
+  "Allowing edits/deletes for sent or paid invoices can violate invoice retention laws. Only enable this if you understand the legal impact.": "Het bewerken/verwijderen van verzonden of betaalde facturen kan in strijd zijn met de bewaarplicht. Schakel dit alleen in als je de juridische gevolgen begrijpt.",
   "Are you sure?": "Weet je het zeker?",
   "Back to Customer": "Terug naar klant",
   "Bank Account": "Bankrekening",
@@ -336,6 +338,7 @@
   "View all": "Alles bekijken",
   "View public link": "Openbare link bekijken",
   "Void Invoice": "Factuur nietig verklaren",
+  "Warning: you are editing a sent/paid invoice. Ensure this is legally allowed in your jurisdiction.": "Waarschuwing: je bewerkt een verzonden/betaalde factuur. Controleer of dit juridisch is toegestaan in jouw rechtsgebied.",
   "Void this invoice? The invoice will be preserved but marked as voided.": "Deze factuur nietig verklaren? De factuur wordt bewaard maar gemarkeerd als nietig.",
   "Voided": "Nietig",
   "What you need to do:": "Wat je moet doen:",
@@ -344,6 +347,8 @@
   "XML profiles helper": "Profielen zijn momenteel alleen ingebouwd. UBL 2.1 is de standaard en heeft de voorkeur voor e-factuurnetwerken (PEPPOL). Het stub-profiel is voor interne tests.",
   "YYYY-MM-DD (2025-01-15)": "JJJJ-MM-DD (2025-01-15)",
   "Yes": "Ja",
+  "You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?": "Je staat op het punt een verzonden/betaalde factuur te verwijderen. Dit kan in strijd zijn met de bewaarplicht en kan niet ongedaan worden gemaakt. Doorgaan?",
+  "You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?": "Je staat op het punt een verzonden/betaalde factuur te bewerken. Controleer of dit juridisch is toegestaan in jouw rechtsgebied. Doorgaan?",
   "password": "wachtwoord",
   "username": "gebruikersnaam",
   "{{count}} item(s)": "{{count}} artikel(en)"

frontend/src/lib/i18n/locales/pt-br.json

@@ -18,6 +18,8 @@
   "Appearance heading": "Aparência",
   "Applies to invoice headings and status labels": "Aplica-se aos cabeçalhos da fatura e etiquetas de status",
   "Apply": "Aplicar",
+  "Allow editing and deleting sent/paid invoices": "Permitir edição e exclusão de faturas enviadas/pagas",
+  "Allowing edits/deletes for sent or paid invoices can violate invoice retention laws. Only enable this if you understand the legal impact.": "Permitir edições/exclusões em faturas enviadas ou pagas pode violar leis de retenção de faturas. Ative apenas se você entender o impacto legal.",
   "Are you sure?": "Tem certeza?",
   "Back to Customer": "Voltar ao Cliente",
   "Bank Account": "Conta Bancária",
@@ -336,6 +338,7 @@
   "View all": "Ver tudo",
   "View public link": "Ver link público",
   "Void Invoice": "Anular fatura",
+  "Warning: you are editing a sent/paid invoice. Ensure this is legally allowed in your jurisdiction.": "Aviso: você está editando uma fatura enviada/paga. Garanta que isso seja legalmente permitido na sua jurisdição.",
   "Void this invoice? The invoice will be preserved but marked as voided.": "Anular esta fatura? A fatura será preservada, mas marcada como anulada.",
   "Voided": "Anulada",
   "What you need to do:": "O que você precisa fazer:",
@@ -344,6 +347,8 @@
   "XML profiles helper": "Os perfis atualmente são apenas integrados. O UBL 2.1 é o padrão e preferido para redes de faturamento eletrônico (PEPPOL). O perfil 'stub' é para testes internos.",
   "YYYY-MM-DD (2025-01-15)": "AAAA-MM-DD (2025-01-15)",
   "Yes": "Sim",
+  "You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?": "Você está prestes a excluir uma fatura enviada/paga. Isso pode violar leis de retenção de faturas e não pode ser desfeito. Continuar?",
+  "You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?": "Você está prestes a editar uma fatura enviada/paga. Garanta que isso seja legalmente permitido na sua jurisdição. Continuar?",
   "password": "senha",
   "username": "usuário",
   "{{count}} item(s)": "{{count}} item(ns)"

frontend/src/routes/invoices/[id]/+page.server.ts

@@ -13,12 +13,26 @@ export const load: PageServerLoad = async ({ params, locals, url }) => {
   }
 
   try {
-    const invoice = await backendGet(
-      `/api/v1/invoices/` + params.id,
-      locals.authHeader,
-    );
+    const [invoiceRes, settingsRes] = await Promise.allSettled([
+      backendGet(`/api/v1/invoices/` + params.id, locals.authHeader),
+      backendGet("/api/v1/settings", locals.authHeader),
+    ]);
+    if (invoiceRes.status !== "fulfilled") {
+      throw error(404, "Invoice not found");
+    }
+    const settings =
+      settingsRes.status === "fulfilled"
+        ? (settingsRes.value as Record<string, unknown>)
+        : {};
+    const allowProtectedInvoiceChanges =
+      String(settings.allowProtectedInvoiceChanges || "false").toLowerCase() ===
+      "true";
     const showPublishedBanner = url.searchParams.get("published") === "1";
-    return { invoice, showPublishedBanner };
+    return {
+      invoice: invoiceRes.value,
+      showPublishedBanner,
+      allowProtectedInvoiceChanges,
+    };
   } catch (err: any) {
     throw error(404, "Invoice not found");
   }

frontend/src/routes/invoices/[id]/+page.svelte

@@ -31,6 +31,10 @@
   let canDelete = $derived(hasPermission(user, "invoices", "delete"));
   let canPublish = $derived(hasPermission(user, "invoices", "publish"));
   let canVoid = $derived(hasPermission(user, "invoices", "void"));
+  let allowProtectedInvoiceChanges = $derived(Boolean(data.allowProtectedInvoiceChanges));
+  let isRetentionProtectedInvoice = $derived(invoice?.status === "sent" || invoice?.status === "paid" || invoice?.status === "complete" || invoice?.status === "overdue");
+  let canEditInvoice = $derived(canUpdate && Boolean(invoice && (invoice.status === "draft" || (allowProtectedInvoiceChanges && invoice.status !== "voided"))));
+  let canDeleteInvoice = $derived(canDelete && Boolean(invoice && (invoice.status === "draft" || invoice.status === "voided" || (allowProtectedInvoiceChanges && invoice.status !== "voided"))));
 
   let paidPaymentMethod = $state("");
 
@@ -64,11 +68,19 @@
     alert(t("Link copied!"));
   }
 
-  function confirmAction(message: string): SubmitFunction {
+  function confirmAction(message: string | (() => string)): SubmitFunction {
     return ({ cancel }) => {
-      if (!confirm(message)) cancel();
+      const text = typeof message === "function" ? message() : message;
+      if (!confirm(text)) cancel();
     };
   }
+
+  function confirmEditNavigation(event: MouseEvent) {
+    if (!allowProtectedInvoiceChanges || !isRetentionProtectedInvoice) return;
+    if (!confirm(t("You are about to edit a sent/paid invoice. Ensure this is legally allowed in your jurisdiction. Continue?"))) {
+      event.preventDefault();
+    }
+  }
 </script>
 
 <div class="mb-6">
@@ -156,14 +168,23 @@
     <form id="inv-void" method="post" class="hidden" use:enhance={confirmAction(t("Void this invoice?"))}>
       <input type="hidden" name="intent" value="void" />
     </form>
-    <form id="inv-delete" method="post" class="hidden" use:enhance={confirmAction(t("Delete this invoice? This cannot be undone."))}>
+    <form
+      id="inv-delete"
+      method="post"
+      class="hidden"
+      use:enhance={confirmAction(() =>
+        isRetentionProtectedInvoice
+          ? t("You are about to delete a sent/paid invoice. This may violate invoice retention laws and cannot be undone. Continue?")
+          : t("Delete this invoice? This cannot be undone."),
+      )}
+    >
       <input type="hidden" name="intent" value="delete" />
     </form>
 
     {#if invoice}
       <div class="flex flex-wrap items-center gap-2">
-        {#if invoice.status === "draft" && !isOverdue && canUpdate}
-          <a href="/invoices/{invoice.id}/edit" class="btn btn-sm">
+        {#if canEditInvoice}
+          <a href="/invoices/{invoice.id}/edit" class="btn btn-sm" onclick={confirmEditNavigation}>
             <Pencil size={16} />
             <span class="hidden sm:inline">{t("Edit")}</span>
           </a>
@@ -279,7 +300,7 @@
                 </button>
               </li>
             {/if}
-            {#if (invoice.status === "draft" || invoice.status === "voided") && canDelete}
+            {#if canDeleteInvoice}
               <li>
                 <button type="submit" form="inv-delete" class="text-error flex items-center gap-2 py-2">
                   <Trash2 size={16} />