[claude]

Requested by Richard Hartmann · Slack thread

Before: invoice PDFs (Rechnung, Rechnungsberichtigung, Stornorechnung) land in the public file library and can be downloaded by anyone with the link (/assets/<file-id>).

After: new invoices land in a dedicated folder that the Public role cannot read.

How

• New env var INVOICE_FILES_FOLDER (id of a directus_files folder), read from the extension context env like STORAGE_LOCATIONS.
• renderAndUploadInvoice / issueOriginalInvoice take an optional folder and pass it to FilesService.uploadOne. All upload paths set it: the paid hook (ticket-order-processing) and all four invoice-lifecycle routes (regenerate invoice/correction, correction, cancellation).
• shared/secure-invoice-folder.ts resolves the folder. If unset, the upload still happens (invoicing must not break), but a warning is logged and a Slack alert is sent once per process, since this needs a human to fix the configuration.
• No schema changes. The access restriction itself is Directus configuration (below), documented in docs/tickets.md → "Invoice File Privacy".
• Tests: folder lookup (set / unset / empty / once-per-process / Slack failure), folder in the upload metadata (and absent when unset), and the folder on every call site.
• Merges cleanly with Show Leistungsdatum on ticket invoices #280, Store the ticket billing country as an ISO code #281, Mail every invoice document to the accounting mailbox #282, Issue ticket invoices as ZUGFeRD / Factur-X e-invoices (EN 16931) #284, Mail Rechnungsberichtigungen and Stornorechnungen to the customer #286 (checked locally; tests and prettier pass on each merge result).

Deployment

1. File Library → create a folder (e.g. Rechnungen); its id is the last URL segment. No subfolders.
2. Set INVOICE_FILES_FOLDER=<folder-id> in the Directus environment.
3. Deploy / restart Directus.
4. Settings → Access Policies → Public → directus_files → Read → Use Custom → Item Permissions:

   { "_or": [{ "folder": { "_null": true } }, { "folder": { "_neq": "<folder-id>" } }] }

   The _null branch is required: Directus 11 runs _neq as SQL NOT folder = '<id>', which excludes files without a folder, so _neq alone would hide all root-level files (website images). Apply the same filter to any other policy that grants Public read on directus_files.
5. Move existing invoice PDFs into the folder (File Library → search Rechnung → select → Move to Folder). File ids do not change, so existing references stay valid.
6. Check in an incognito window: /assets/<invoice-file-id> returns 403, /files lists no invoices, a regular public image still loads.

---

Generated by Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
programmierbar-website	Ready	Preview	Oct 21, 2026 8:59am UTC

[claude]

The failing check is Vercel (preview deployment). This PR is not the cause: it changes only directus-cms/ and docs/, and its nuxt-app/ and shared-code/ trees are identical to main at 551765f.

• main at 551765f deployed fine yesterday (2026-10-20 15:47 UTC).
• Running nuxt build (Node 24) locally on that identical tree fails today, in prerendering against the live CMS: 14 routes return 500, e.g. Cannot read properties of null (reading 'first_name') / (reading 'split') on podcast pages.
• The cause is CMS data, not code: the public API now returns draft and test podcasts that have no speaker or cover image, and the build prerenders them.

So a fresh main deploy would fail the same way.

---

Generated by Claude Code

[Jan0707]

@claude What happens if the provided folder id is invalid and the folder cannot be found / used as a target destination ?

[claude]

Update: this describes 01b3520. Since 10476fb, an invalid folder no longer aborts anything. The upload is retried without the folder (stored publicly, warning plus Slack alert), and both the paid hook and invoice-lifecycle carry on normally. Only a failing retry still behaves as described below.

What happens if the provided folder id is invalid and the folder cannot be found / used as a target destination?

I checked this against the @directus/api 35.2.0 source and our call sites. Short answer: the upload fails cleanly, nothing is written, and the error is only logged.

• Why nothing is written: FilesService.uploadOne inserts the directus_files row first, then writes to storage. directus_files.folder has a foreign key to directus_folders, so a bad id makes the insert fail. Storage is never touched, so there is no orphaned file or row.
  • A valid but unknown UUID is a foreign key violation and throws InvalidForeignKeyError.
  • A malformed id fails Postgres' uuid cast and throws the raw DB error.
• Paid hook: the invoice is generated before tickets are created, so the outer try/catch catches the error. It is logged with logger.error only: no tickets, no confirmation email, no Slack alert. The order stays paid without an invoice.
• invoice-lifecycle (regenerate / correction / cancellation): responds 500 Failed to run invoice <action> and logs the error. No document row is created or changed.

Following the "no runtime guards for once-verified setup" rule, I'm not adding validation. After the deploy, verify once:

• run regenerate on an unsent test invoice (or wait for the next real invoice) and check that the PDF shows up in the invoice folder in the File Library;
• open /assets/<that-file-id> in an incognito window and check it returns 403.

Separate follow-up idea, not part of this PR: send a Slack alert when the paid hook aborts, since today that failure only shows up in the logs.

---

Generated by Claude Code

[Jan0707]

@claude directus-cms/extensions/directus-extension-programmierbar-bundle/src/shared/secure-invoice-folder.ts Seems to imply that invoices are indeed created but stored publicly if the folder is missing.

That way, the user-flow would not be broken, and we would simply need to remedy this after the fact (that's what the slack message is for)

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-21T08:48:57.146663Z	01b3520	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 01b3520fe7

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[Copilot]

🟡 Changes recommended

Missing folder configuration still allows customer invoices to be uploaded into the publicly readable library.

1 open issue

• Prevent public invoice uploads when private folder is unconfigured · New

What changed in this PR

Routes ticket invoice PDFs into a configured Directus folder, with privacy enforced through deployment permissions.

Changes:

• Passes the invoice folder through all invoice upload paths.
• Adds missing-configuration alerts and folder propagation tests.
• Documents access restrictions and migration of existing invoices.

File	Description
docs/​tickets.md	Documents private-folder setup and verification.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​ticket-order-processing/​index.ts	Passes the folder for original invoices.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​ticket-order-processing/​__tests__/​index.test.ts	Tests original-invoice folder propagation.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​shared/​secure-invoice-folder.ts	Resolves configuration and alerts when missing.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​shared/​invoice-service.ts	Adds folder metadata to uploads.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​shared/​__tests__/​secure-invoice-folder.test.ts	Tests configuration, alerts, and upload metadata.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​invoice-lifecycle/​index.ts	Sets the folder for lifecycle uploads.
directus-cms/​extensions/​directus-extension-programmierbar-bundle/​src/​invoice-lifecycle/​__tests__/​index.test.ts	Tests folder propagation across lifecycle operations.
directus-cms/​.env.example	Documents the folder environment variable.

_{Review effort: Balanced}

[claude]

#287 (comment)

The fallback is in 10476fb. An invalid INVOICE_FILES_FOLDER now behaves like a missing one: if the upload into the folder fails, it is retried once without the folder, so the PDF is stored publicly. A warning with the invoice number is logged, Slack is alerted with the invoice number and the folder value, and the invoice flow continues.

---

Generated by Claude Code

[Copilot]

🟡 Changes recommended

Unrelated upload failures can publish invoices through the fallback even when private-folder configuration is correct.

2 open issues

• Avoid public fallback after unrelated upload errors · New
• Prevent public invoice uploads when private folder is unconfigured

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Invoice confidentiality depends on deployment-time Directus permissions that require human verification of anonymous access.

No open issues 🎉

1 resolved since last review

• Prevent public invoice uploads when private folder is unconfigured

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

Invoice confidentiality depends on manually configured Directus permissions that require verification in the deployed environment.

No open issues 🎉

_{Review effort: Balanced}