Upload invoice PDFs into a private Directus folder

directus-cms/.env.example

@@ -44,6 +44,11 @@ STORAGE_LOCATIONS="local"
 STORAGE_LOCAL_DRIVER="local"
 STORAGE_LOCAL_ROOT="./uploads"
 
+# Id of the directus_files folder invoice PDFs are uploaded into. The Public policy must not be able
+# to read this folder — see "Invoice File Privacy" in docs/tickets.md. Unset or invalid: invoices still
+# upload, but into the public file library (warning + Slack alert).
+# INVOICE_FILES_FOLDER=""
+
 ####################################################################################################
 ## Security
 

directus-cms/extensions/directus-extension-programmierbar-bundle/src/invoice-lifecycle/__tests__/index.test.ts

@@ -588,3 +588,39 @@ describe('invoice-lifecycle endpoint', () => {
         })
     })
 })
+
+// Invoice PDFs must not land in the public file library. The folder lookup itself
+// (env var, unset warning + Slack alert) is covered in
+// shared/__tests__/secure-invoice-folder.test.ts; here it is stubbed, which also
+// keeps the unset-folder Slack alert offline for the empty `env` above.
+jest.mock('../../shared/secure-invoice-folder.ts', () => ({
+    ...jest.requireActual<object>('../../shared/secure-invoice-folder.ts'),
+    invoiceFilesFolder: () => 'folder-invoices',
+}))
+
+describe('invoice-lifecycle upload folder', () => {
+    const correctionRow = () =>
+        issuedOriginalRow({
+            id: 'doc-correction-1',
+            type: 'correction',
+            invoice_number: 'PB-CON26-002',
+            related_invoice: 'doc-original',
+            date_created: '2026-02-01T00:00:00.000Z',
+            sent_at: null,
+        })
+
+    test.each([
+        ['regenerate (invoice)', 'regenerate', () => [issuedOriginalRow({ sent_at: null })]],
+        ['regenerate (correction)', 'regenerate', () => [issuedOriginalRow(), correctionRow()]],
+        ['correction', 'correction', () => [issuedOriginalRow()]],
+        ['cancellation', 'cancellation', () => [issuedOriginalRow()]],
+    ])('%s uploads the PDF into the invoice folder', async (_label, action, invoices) => {
+        const { call, calls } = await setup({ invoices: invoices() })
+
+        const res = await call(action)
+
+        expect(res.statusCode).toBe(200)
+        expect(calls.uploads).toHaveLength(1)
+        expect(calls.uploads[0].folder).toBe('folder-invoices')
+    })
+})

directus-cms/extensions/directus-extension-programmierbar-bundle/src/invoice-lifecycle/index.ts

@@ -15,6 +15,7 @@ import {
     type InvoiceDocument,
     type RenderInvoiceResult,
 } from '../shared/invoice-service.js'
+import { invoiceFilesFolder } from '../shared/secure-invoice-folder.js'
 
 const ENDPOINT_NAME = 'invoice-lifecycle'
 
@@ -265,7 +266,9 @@ export default defineEndpoint(async (router: SandboxEndpointRouter, context) =>
                 referenceNumber: predecessor.invoice_number,
                 referenceDate: new Date(predecessor.invoice_date),
                 filesService: ctx.filesService,
+                folder: invoiceFilesFolder(env, logger),
                 storageLocation: storageLocation(),
+                logger,
             })
         } else {
             rendered = await renderAndUploadInvoice({
@@ -274,7 +277,9 @@ export default defineEndpoint(async (router: SandboxEndpointRouter, context) =>
                 invoiceDate: new Date(current.invoice_date),
                 documentKind: 'invoice',
                 filesService: ctx.filesService,
+                folder: invoiceFilesFolder(env, logger),
                 storageLocation: storageLocation(),
+                logger,
             })
         }
 
@@ -330,7 +335,9 @@ export default defineEndpoint(async (router: SandboxEndpointRouter, context) =>
             referenceNumber: current.invoice_number,
             referenceDate: new Date(current.invoice_date),
             filesService: ctx.filesService,
+            folder: invoiceFilesFolder(env, logger),
             storageLocation: storageLocation(),
+            logger,
         })
 
         const documentId = await ctx.invoicesService.createOne({
@@ -410,7 +417,9 @@ export default defineEndpoint(async (router: SandboxEndpointRouter, context) =>
             referenceNumber: current.invoice_number,
             referenceDate: new Date(current.invoice_date),
             filesService: ctx.filesService,
+            folder: invoiceFilesFolder(env, logger),
             storageLocation: storageLocation(),
+            logger,
         })
 
         const documentId = await ctx.invoicesService.createOne({