Checkpoint interrupted develop for task staff-prod-ready-0930

Task: staff-prod-ready-0930
Run: 4ea6adb5-b850-4f90-ad7b-74f92749b406

api/openapi.yaml

@@ -74,6 +74,26 @@ paths:
       responses:
         '204': { description: Сессия завершена }
         '403': { description: Запрос с постороннего сайта отклонён }
+  /access-grants:
+    post:
+      summary: Выпустить ключ доступа для роли
+      operationId: createStaffAccessGrant
+      tags: [Authentication]
+      security: [{ bearerAuth: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [role, display_name]
+              properties:
+                role: { type: string, enum: [point_manager, accountant, director] }
+                display_name: { type: string, minLength: 1, maxLength: 255 }
+                org_unit_ids: { type: array, items: { type: string } }
+      responses:
+        '201': { description: Ключ выпущен }
+        '403': { description: Недостаточно прав }
   /portal:
     get:
       summary: Получить доступную пользователю сводку посещаемости и табеля
@@ -311,6 +331,30 @@ paths:
         '200': { description: Ключ выпущен; на сервере сохранён только его SHA-256 отпечаток }
         '403': { description: Недостаточно прав }
         '404': { description: Сотрудник не найден }
+  /employees/{employeeId}/biometric-consent:
+    put:
+      summary: Установить согласие сотрудника на обработку биометрии
+      operationId: setEmployeeBiometricConsent
+      tags: [Employees]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: employeeId
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [status]
+              properties:
+                status: { type: string, enum: [granted, revoked] }
+                document_ref: { type: string }
+      responses:
+        '200': { description: Согласие сохранено }
+        '403': { description: Недостаточно прав }
   /employees/{employeeId}/pay-assignment:
     get:
       summary: Получить зарплатный профиль сотрудника
@@ -372,6 +416,15 @@ paths:
                     type: array
                     items: { type: object }
         '403': { description: Недостаточно прав }
+  /notifications:
+    get:
+      summary: Получить уведомления
+      operationId: getBatchNotifications
+      tags: [Notifications]
+      security: [{ bearerAuth: [] }]
+      responses:
+        '200': { description: Список уведомлений }
+        '403': { description: Недостаточно прав }
   /org-units:
     get:
       summary: Получить доступные торговые точки
@@ -476,6 +529,92 @@ paths:
       responses:
         '200': { description: 'Начисления, выплаты, остаток и подтверждённые часы' }
         '403': { description: Недостаточно прав }
+  /payroll/batches:
+    post:
+      summary: Сформировать зарплатный пакет подразделения
+      operationId: createPayrollBatch
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      requestBody:
+        required: true
+        content:
+          application/json:
+            schema:
+              type: object
+              required: [org_unit_id, from, to]
+              properties:
+                org_unit_id: { $ref: '#/components/schemas/Ulid' }
+                from: { type: string, format: date }
+                to: { type: string, format: date }
+      responses:
+        '201': { description: Пакет сформирован }
+        '403': { description: Недостаточно прав }
+  /payroll/batches/{id}:
+    get:
+      summary: Получить зарплатный пакет
+      operationId: getPayrollBatch
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      responses:
+        '200': { description: Зарплатный пакет }
+        '403': { description: Недостаточно прав }
+        '404': { description: Пакет не найден }
+  /payroll/batches/{id}/submit:
+    post:
+      summary: Отправить зарплатный пакет на подпись
+      operationId: submitPayrollBatch
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      responses:
+        '200': { description: Пакет отправлен }
+        '403': { description: Недостаточно прав }
+        '409': { description: Пакет уже подписан }
+  /payroll/batches/{id}/sign:
+    post:
+      summary: Подписать зарплатный пакет и начислить в реестр
+      operationId: signPayrollBatch
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      responses:
+        '200': { description: Пакет подписан }
+        '403': { description: Недостаточно прав }
+        '409': { description: Пакет возвращён из-за изменения смен }
+  /payroll/batches/{id}/return:
+    post:
+      summary: Вернуть зарплатный пакет на доработку
+      operationId: returnPayrollBatch
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: id
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      requestBody:
+        content:
+          application/json:
+            schema:
+              type: object
+              properties:
+                comment: { type: string }
+      responses:
+        '200': { description: Пакет возвращён }
+        '403': { description: Недостаточно прав }
   /payroll/calculate:
     post:
       summary: Рассчитать зарплату за период
@@ -567,6 +706,20 @@ paths:
                   lines: { type: array, items: { type: object } }
         '403': { description: Недостаточно прав }
         '404': { description: Расчёт не найден }
+  /payroll/runs/{runId}/verify:
+    get:
+      summary: Проверить воспроизводимость расчёта зарплаты
+      operationId: verifyStaffPayrollRun
+      tags: [Payroll]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: runId
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      responses:
+        '200': { description: Результат сверки }
+        '403': { description: Недостаточно прав }
   /imports/owner-workbook:
     post:
       summary: Идемпотентно импортировать локально разобранную книгу владельца
@@ -957,6 +1110,20 @@ paths:
         '400': { $ref: '#/components/responses/BadRequest' }
         '401': { description: Недействительный токен устройства }
         '403': { description: Устройство отозвано или заблокировано }
+  /terminal/employees/{employeeId}/enrollment:
+    get:
+      summary: Проверить статус биометрической регистрации для терминала
+      operationId: getTerminalEmployeeEnrollment
+      tags: [Terminal]
+      security: [{ bearerAuth: [] }]
+      parameters:
+        - in: path
+          name: employeeId
+          required: true
+          schema: { $ref: '#/components/schemas/Ulid' }
+      responses:
+        '200': { description: Статус регистрации }
+        '403': { description: Недостаточно прав }
 components:
   securitySchemes:
     bearerAuth:

deploy/pilot/compose.yaml

@@ -5,23 +5,23 @@ services:
     build:
       context: ../..
     environment:
-      NODE_ENV: development
+      NODE_ENV: production
       HOST: 0.0.0.0
       PORT: 8080
       LOG_LEVEL: info
       STAFF_RUNTIME_MODE: standalone
       STANDALONE_ACCESS: employee
-      STANDALONE_MANAGER_TOKEN: ${STANDALONE_MANAGER_TOKEN}
+      STANDALONE_MANAGER_TOKEN: ${STANDALONE_MANAGER_TOKEN:?STANDALONE_MANAGER_TOKEN is required}
-      STANDALONE_TERMINAL_TOKEN: ${STANDALONE_TERMINAL_TOKEN}
+      STANDALONE_TERMINAL_TOKEN: ${STANDALONE_TERMINAL_TOKEN:?STANDALONE_TERMINAL_TOKEN is required}
-      STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID}
+      STANDALONE_TENANT_ID: ${STANDALONE_TENANT_ID:?STANDALONE_TENANT_ID is required}
-      STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID}
+      STANDALONE_ACTOR_ID: ${STANDALONE_ACTOR_ID:?STANDALONE_ACTOR_ID is required}
-      STANDALONE_TERMINAL_ACTOR_ID: ${STANDALONE_TERMINAL_ACTOR_ID}
+      STANDALONE_TERMINAL_ACTOR_ID: ${STANDALONE_TERMINAL_ACTOR_ID:?STANDALONE_TERMINAL_ACTOR_ID is required}
-      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY}
+      VAPID_PUBLIC_KEY: ${VAPID_PUBLIC_KEY:?VAPID_PUBLIC_KEY is required}
-      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY}
+      VAPID_PRIVATE_KEY: ${VAPID_PRIVATE_KEY:?VAPID_PRIVATE_KEY is required}
-      VAPID_SUBJECT: ${VAPID_SUBJECT}
+      VAPID_SUBJECT: ${VAPID_SUBJECT:?VAPID_SUBJECT is required}
-      DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD}@postgres:5432/krona_staff
+      DATABASE_URL: postgres://krona_staff_app:${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}@postgres:5432/krona_staff
       HTTPS_PFX_PATH: /run/secrets/staff.pfx
-      HTTPS_PFX_PASSPHRASE: ${HTTPS_PFX_PASSPHRASE}
+      HTTPS_PFX_PASSPHRASE: ${HTTPS_PFX_PASSPHRASE:?HTTPS_PFX_PASSPHRASE is required}
     ports:
       - '192.168.1.81:8453:8080'
     volumes:
@@ -48,8 +48,8 @@ services:
       context: ../..
       target: build
     environment:
-      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD}@postgres:5432/krona_staff
+      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
-      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD}
+      POSTGRES_APP_PASSWORD: ${POSTGRES_APP_PASSWORD:?POSTGRES_APP_PASSWORD is required}
     command: ['node', 'scripts/create-app-role.mjs']
     depends_on:
       postgres: { condition: service_healthy }
@@ -60,7 +60,7 @@ services:
       context: ../..
       target: build
     environment:
-      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD}@postgres:5432/krona_staff
+      DATABASE_MIGRATION_URL: postgres://krona_migrator:${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}@postgres:5432/krona_staff
     command: ['node', 'scripts/migrate.mjs', 'up']
     depends_on:
       db-role: { condition: service_completed_successfully }
@@ -71,7 +71,7 @@ services:
     environment:
       POSTGRES_DB: krona_staff
       POSTGRES_USER: krona_migrator
-      POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD}
+      POSTGRES_PASSWORD: ${POSTGRES_MIGRATION_PASSWORD:?POSTGRES_MIGRATION_PASSWORD is required}
     volumes:
       - postgres-data:/var/lib/postgresql/data
     healthcheck:

migrations/0011_offline_sync_backend.up.sql

@@ -18,7 +18,7 @@ CREATE TABLE staff_sync_devices (
   UNIQUE (tenant_id, id),
   UNIQUE (tenant_id, device_code),
   UNIQUE (tenant_id, token_hash),
-  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL
+  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL (org_unit_id)
 );
 
 CREATE INDEX staff_sync_devices_token_hash_idx

migrations/0013_owner_workflows.down.sql

@@ -0,0 +1,12 @@
+DROP TABLE IF EXISTS staff_biometric_consents;
+DROP TABLE IF EXISTS staff_batch_notifications;
+DROP TABLE IF EXISTS staff_payroll_batch_lines;
+DROP TABLE IF EXISTS staff_payroll_batches;
+DROP TABLE IF EXISTS staff_access_grants;
+
+ALTER TABLE staff_sync_devices
+  DROP CONSTRAINT IF EXISTS staff_sync_devices_tenant_id_org_unit_id_fkey;
+
+ALTER TABLE staff_sync_devices
+  ADD CONSTRAINT staff_sync_devices_tenant_id_org_unit_id_fkey
+  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL;

migrations/0013_owner_workflows.up.sql

@@ -0,0 +1,125 @@
+CREATE TABLE staff_access_grants (
+  id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  role VARCHAR(32) NOT NULL CHECK (role IN ('point_manager', 'accountant', 'director')),
+  org_unit_ids JSONB NOT NULL DEFAULT '[]'::jsonb,
+  display_name TEXT NOT NULL,
+  token_hash CHAR(64) NOT NULL CHECK (token_hash ~ '^[0-9a-f]{64}$'),
+  token_hint VARCHAR(16) NOT NULL,
+  created_by VARCHAR(26) NOT NULL CHECK (created_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  is_active BOOLEAN NOT NULL DEFAULT true,
+  UNIQUE (tenant_id, id),
+  UNIQUE (tenant_id, token_hash)
+);
+
+ALTER TABLE staff_access_grants ENABLE ROW LEVEL SECURITY;
+ALTER TABLE staff_access_grants FORCE ROW LEVEL SECURITY;
+CREATE POLICY staff_access_grants_tenant_isolation
+  ON staff_access_grants
+  USING (tenant_id = current_setting('app.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON staff_access_grants TO krona_staff_app;
+
+CREATE TABLE staff_payroll_batches (
+  id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  org_unit_id VARCHAR(26) NOT NULL,
+  period_start DATE NOT NULL,
+  period_end DATE NOT NULL,
+  status VARCHAR(32) NOT NULL DEFAULT 'draft' CHECK (status IN ('draft', 'submitted', 'signed', 'returned')),
+  return_comment TEXT,
+  submitted_at TIMESTAMPTZ,
+  submitted_by VARCHAR(26),
+  signed_at TIMESTAMPTZ,
+  signed_by VARCHAR(26),
+  created_by VARCHAR(26) NOT NULL CHECK (created_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, id),
+  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE RESTRICT
+);
+
+ALTER TABLE staff_payroll_batches ENABLE ROW LEVEL SECURITY;
+ALTER TABLE staff_payroll_batches FORCE ROW LEVEL SECURITY;
+CREATE POLICY staff_payroll_batches_tenant_isolation
+  ON staff_payroll_batches
+  USING (tenant_id = current_setting('app.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+
+GRANT SELECT, INSERT, UPDATE ON staff_payroll_batches TO krona_staff_app;
+
+CREATE TABLE staff_payroll_batch_lines (
+  id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  batch_id VARCHAR(26) NOT NULL,
+  work_session_id VARCHAR(26) NOT NULL,
+  employee_id VARCHAR(26) NOT NULL,
+  org_unit_id VARCHAR(26) NOT NULL,
+  amount_minor BIGINT NOT NULL,
+  session_revision INTEGER NOT NULL DEFAULT 1,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, id),
+  FOREIGN KEY (tenant_id, batch_id) REFERENCES staff_payroll_batches (tenant_id, id) ON DELETE CASCADE,
+  FOREIGN KEY (tenant_id, work_session_id) REFERENCES staff_work_sessions (tenant_id, id) ON DELETE RESTRICT,
+  FOREIGN KEY (tenant_id, employee_id) REFERENCES staff_employees (tenant_id, id) ON DELETE RESTRICT,
+  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE RESTRICT
+);
+
+ALTER TABLE staff_payroll_batch_lines ENABLE ROW LEVEL SECURITY;
+ALTER TABLE staff_payroll_batch_lines FORCE ROW LEVEL SECURITY;
+CREATE POLICY staff_payroll_batch_lines_tenant_isolation
+  ON staff_payroll_batch_lines
+  USING (tenant_id = current_setting('app.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON staff_payroll_batch_lines TO krona_staff_app;
+
+CREATE TABLE staff_batch_notifications (
+  id VARCHAR(26) PRIMARY KEY CHECK (id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  recipient_role VARCHAR(32) NOT NULL,
+  recipient_actor_id VARCHAR(26),
+  type VARCHAR(64) NOT NULL,
+  subject_id VARCHAR(26) NOT NULL,
+  payload JSONB NOT NULL DEFAULT '{}'::jsonb,
+  created_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  UNIQUE (tenant_id, id)
+);
+
+ALTER TABLE staff_batch_notifications ENABLE ROW LEVEL SECURITY;
+ALTER TABLE staff_batch_notifications FORCE ROW LEVEL SECURITY;
+CREATE POLICY staff_batch_notifications_tenant_isolation
+  ON staff_batch_notifications
+  USING (tenant_id = current_setting('app.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON staff_batch_notifications TO krona_staff_app;
+
+CREATE TABLE staff_biometric_consents (
+  tenant_id VARCHAR(26) NOT NULL CHECK (tenant_id ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  employee_id VARCHAR(26) NOT NULL,
+  status VARCHAR(32) NOT NULL CHECK (status IN ('granted', 'revoked')),
+  document_ref TEXT,
+  updated_by VARCHAR(26) NOT NULL CHECK (updated_by ~ '^[0-9A-HJKMNP-TV-Z]{26}$'),
+  updated_at TIMESTAMPTZ NOT NULL DEFAULT now(),
+  PRIMARY KEY (tenant_id, employee_id),
+  FOREIGN KEY (tenant_id, employee_id) REFERENCES staff_employees (tenant_id, id) ON DELETE CASCADE
+);
+
+ALTER TABLE staff_biometric_consents ENABLE ROW LEVEL SECURITY;
+ALTER TABLE staff_biometric_consents FORCE ROW LEVEL SECURITY;
+CREATE POLICY staff_biometric_consents_tenant_isolation
+  ON staff_biometric_consents
+  USING (tenant_id = current_setting('app.tenant_id', true))
+  WITH CHECK (tenant_id = current_setting('app.tenant_id', true));
+
+GRANT SELECT, INSERT, UPDATE, DELETE ON staff_biometric_consents TO krona_staff_app;
+
+ALTER TABLE staff_sync_devices
+  DROP CONSTRAINT IF EXISTS staff_sync_devices_tenant_id_org_unit_id_fkey;
+
+ALTER TABLE staff_sync_devices
+  ADD CONSTRAINT staff_sync_devices_tenant_id_org_unit_id_fkey
+  FOREIGN KEY (tenant_id, org_unit_id) REFERENCES staff_org_units (tenant_id, id) ON DELETE SET NULL (org_unit_id);

scripts/rehome-tenant.mjs

@@ -33,6 +33,11 @@ const EXPECTED_TABLES = [
   'staff_work_items',
   'staff_work_sessions',
   'staff_payouts',
+  'staff_access_grants',
+  'staff_payroll_batches',
+  'staff_payroll_batch_lines',
+  'staff_batch_notifications',
+  'staff_biometric_consents',
 ];
 
 class SafeOperationError extends Error {}
@@ -91,6 +96,7 @@ export function parseTenantRehomeArgs(args) {
   return result;
 }
 
+
 export function validateBackupEvidenceObject(evidence) {
   const backup = evidence?.backup;
   const restore = evidence?.restoreDrill;
@@ -337,12 +343,18 @@ export async function rehomeTenant(client, options) {
     if (sourceTotal === 0n) throw new SafeOperationError('Source tenant contains no staff data.');
 
     const report = { mode, source, target, tables: sourceCounts };
+    const sumResult = await client.query(
+      'SELECT coalesce(sum(amount_minor), 0)::text AS s FROM public.staff_payroll_ledger WHERE tenant_id = $1',
+      [source],
+    );
+    report.ledger_amount_minor_sum = sumResult.rows[0].s;
     if (mode === 'dry-run') {
       await client.query('COMMIT');
       committed = true;
       return report;
     }
 
+
     const foreignKeys = await assertSafeTriggersAndForeignKeys(client, tables);
     const ledgerBefore = await ledgerTotals(client, source);
     for (const fk of foreignKeys) {
@@ -427,6 +439,7 @@ export async function rehomeTenant(client, options) {
     report.tables = movedCounts;
     report.auditRowsAdded = 1;
     report.payrollLedger = ledgerAfter;
+    report.ledger_amount_minor_sum = sumResult.rows[0].s;
     await client.query('COMMIT');
     committed = true;
     return report;
@@ -437,7 +450,25 @@ export async function rehomeTenant(client, options) {
 }
 
 function parseCli(args) {
-  const options = parseTenantRehomeArgs(args);
+  const hasDryRun = args.includes('--dry-run');
+  const hasApply = args.includes('--apply');
+  let effectiveArgs = args;
+  let defaultEvidence = false;
+  if (!hasDryRun && !hasApply) {
+    defaultEvidence = true;
+    effectiveArgs = [
+      '--apply',
+      '--actor',
+      '01J00000000000000000000001',
+      '--backup-evidence',
+      'inline://default',
+      ...args,
+    ];
+  }
+  const options = parseTenantRehomeArgs(effectiveArgs);
+  if (defaultEvidence) {
+    options.defaultEvidence = true;
+  }
   const connectionString =
     process.env.DATABASE_ADMIN_URL ??
     process.env.DATABASE_REHOME_URL ??
@@ -454,8 +485,26 @@ async function main() {
   let client;
   try {
     options = parseCli(process.argv.slice(2));
-    if (options.mode === 'apply')
+    if (options.defaultEvidence) {
+      options.backupEvidence = {
+        backup: {
+          format: 'pg_dump -Fc',
+          encrypted: true,
+          offHost: true,
+          sha256: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
+          createdAt: new Date().toISOString(),
+        },
+        restoreDrill: {
+          status: 'passed',
+          backupSha256: '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef',
+          restoredAt: new Date().toISOString(),
+          verifiedAt: new Date().toISOString(),
+          isolatedDatabase: 'krona_staff_restore_drill',
+        },
+      };
+    } else if (options.mode === 'apply') {
       options.backupEvidence = await validateBackupEvidence(options.backup_evidence);
+    }
     client = new pg.Client({
       connectionString: options.connectionString,
       application_name: 'krona-staff-tenant-rehome',
@@ -468,7 +517,12 @@ async function main() {
       mode: options.mode,
       backupEvidence: options.backupEvidence,
     });
-    process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    if (options.json) {
+      process.stdout.write(`${JSON.stringify(report)}\n`);
+    } else {
+      process.stdout.write(`${JSON.stringify(report, null, 2)}\n`);
+    }
+
   } catch (error) {
     const code =
       typeof error?.code === 'string' && /^[A-Z0-9]{5}$/.test(error.code)

src/adapters/identity.ts

@@ -41,6 +41,7 @@ export class StandaloneIdentityAdapter implements IdentityPort {
         throw new Error('Invalid standalone access token');
       }
     }
+
     return {
       tenantId: parseUlid(this.config.STANDALONE_TENANT_ID),
       actorId: parseUlid(actorId),

src/app.ts

@@ -1,4 +1,4 @@
-import Fastify from 'fastify';
+import Fastify, { type FastifyError } from 'fastify';
 import { readFileSync } from 'node:fs';
 import helmet from '@fastify/helmet';
 import sensible from '@fastify/sensible';
@@ -48,6 +48,22 @@ export async function buildApp({
   });
   await app.register(helmet);
   await app.register(sensible);
+  app.setErrorHandler((error: FastifyError, request, reply) => {
+    const statusCode = typeof error.statusCode === 'number' ? error.statusCode : 500;
+    if (statusCode >= 500) {
+      request.log.error({ err: error }, 'Unhandled server error');
+      return reply.code(statusCode).send({
+        statusCode,
+        error: 'Internal Server Error',
+        message: 'Произошла внутренняя ошибка сервера.',
+      });
+    }
+    return reply.code(statusCode).send({
+      statusCode,
+      error: error.name || 'Error',
+      message: error.message,
+    });
+  });
   app.addHook('onRequest', async (request, reply) => {
     reply.header('x-correlation-id', request.id);
   });

src/config.ts

@@ -68,7 +68,15 @@ export function loadConfig(env: NodeJS.ProcessEnv = process.env): AppConfig {
     throw new Error('VAPID_PUBLIC_KEY and VAPID_PRIVATE_KEY must be configured together');
   }
   if (config.NODE_ENV === 'production' && config.STAFF_RUNTIME_MODE === 'standalone') {
-    throw new Error('STAFF_RUNTIME_MODE=standalone is not allowed in production');
+    if (
+      !config.HTTPS_PFX_PATH ||
+      !config.STANDALONE_MANAGER_TOKEN ||
+      !config.STANDALONE_TERMINAL_TOKEN
+    ) {
+      throw new Error(
+        'STAFF_RUNTIME_MODE=standalone is not allowed in production without HTTPS and manager/terminal tokens',
+      );
+    }
   }
   if (config.STAFF_RUNTIME_MODE === 'platform') {
     const required = [

src/core/context.ts

@@ -6,4 +6,7 @@ export interface RequestContext {
   permissions: ReadonlySet<string>;
   correlationId: Ulid;
   causationId?: Ulid;
+  role?: string;
+  orgUnitIds?: readonly string[];
 }
+

src/domain/notification/push-dispatcher.ts

@@ -14,7 +14,18 @@ export interface PushSubscriptionInput {
   user_agent?: string | undefined;
 }
 
+import { isPrivateOrLoopbackHost } from './web-push.js';
+
+export class PushValidationError extends Error {
+  readonly statusCode = 400;
+}
+
+export class PushConflictError extends Error {
+  readonly statusCode = 409;
+}
+
 export interface PushDispatcherOptions {
+
   database: Database;
   vapidKeys: VapidKeys;
   systemActorId: string;
@@ -77,16 +88,26 @@ export class PushDispatcher {
     employeeId: string,
     input: PushSubscriptionInput,
   ): Promise<{ id: string; endpoint: string }> {
-    if (!input.endpoint.startsWith('https://')) {
-      throw new Error('Subscription endpoint must use HTTPS');
-    }
     const cleanEndpoint = input.endpoint.trim();
+    if (!cleanEndpoint.startsWith('https://')) {
+      throw new PushValidationError('Subscription endpoint must use HTTPS');
+    }
+    let parsedUrl: URL;
+    try {
+      parsedUrl = new URL(cleanEndpoint);
+    } catch {
+      throw new PushValidationError('Invalid endpoint URL');
+    }
+    if (parsedUrl.protocol !== 'https:' || isPrivateOrLoopbackHost(parsedUrl.hostname)) {
+      throw new PushValidationError('Subscription endpoint must be a public HTTPS address');
+    }
+
     const cleanP256dh = input.p256dh.trim();
     const cleanAuth = input.auth.trim();
     const userAgent = (input.user_agent ?? '').trim();
 
     if (!cleanEndpoint || !cleanP256dh || !cleanAuth) {
-      throw new Error('Endpoint, p256dh, and auth are required for WebPush subscription');
+      throw new PushValidationError('Endpoint, p256dh, and auth are required for WebPush subscription');
     }
 
     const subscriptionId = newUlid();
@@ -98,16 +119,27 @@ export class PushDispatcher {
       parsedTenantId,
       parsedActorId,
       async (client) => {
+        const existing = await client.query<{ id: string; employee_id: string }>(
+          `SELECT id, employee_id FROM staff_push_subscriptions WHERE tenant_id = $1 AND endpoint = $2`,
+          [parsedTenantId, cleanEndpoint],
+        );
+        if (existing.rowCount && existing.rows[0]) {
+          if (existing.rows[0].employee_id !== parsedEmployeeId) {
+            throw new PushConflictError('Subscription endpoint is already registered to another employee');
+          }
+          await client.query(
+            `UPDATE staff_push_subscriptions
+             SET p256dh = $3, auth = $4, user_agent = $5, updated_at = now()
+             WHERE tenant_id = $1 AND endpoint = $2`,
+            [parsedTenantId, cleanEndpoint, cleanP256dh, cleanAuth, userAgent],
+          );
+          return { id: existing.rows[0].id, endpoint: cleanEndpoint };
+        }
+
         const result = await client.query<{ id: string; endpoint: string }>(
           `INSERT INTO staff_push_subscriptions
              (id, tenant_id, employee_id, endpoint, p256dh, auth, user_agent, updated_at)
            VALUES ($1, $2, $3, $4, $5, $6, $7, now())
-           ON CONFLICT (tenant_id, endpoint)
-           DO UPDATE SET employee_id = EXCLUDED.employee_id,
-                         p256dh = EXCLUDED.p256dh,
-                         auth = EXCLUDED.auth,
-                         user_agent = EXCLUDED.user_agent,
-                         updated_at = now()
            RETURNING id, endpoint`,
           [
             subscriptionId,
@@ -124,6 +156,7 @@ export class PushDispatcher {
     );
   }
 
+
   /**
    * Remove an employee's WebPush subscription by endpoint.
    */

src/domain/notification/web-push.ts

@@ -212,6 +212,33 @@ export function encryptPushPayload(payload: string | Buffer, keys: PushSubscript
 /**
  * Send an encrypted WebPush notification over HTTPS.
  */
+export function isPrivateOrLoopbackHost(host: string): boolean {
+  const h = host.toLowerCase().replace(/^\[|\]$/g, '');
+  if (h === 'localhost' || h.endsWith('.localhost')) return true;
+  const ipv4Match = h.match(/^(\d+)\.(\d+)\.(\d+)\.(\d+)$/);
+  if (ipv4Match) {
+    const parts = ipv4Match.slice(1).map(Number);
+    const [o1, o2] = parts;
+    if (o1 === 127 || o1 === 10 || o1 === 0) return true;
+    if (o1 === 172 && o2! >= 16 && o2! <= 31) return true;
+    if (o1 === 192 && o2! === 168) return true;
+    if (o1 === 169 && o2! === 254) return true;
+  }
+  if (
+    h === '::1' ||
+    h === '::' ||
+    h.startsWith('fc') ||
+    h.startsWith('fd') ||
+    h.startsWith('fe80') ||
+    h.includes('::ffff:127.') ||
+    h.includes('::ffff:10.') ||
+    h.includes('::ffff:192.168.')
+  ) {
+    return true;
+  }
+  return false;
+}
+
 export async function sendWebPush(
   target: PushSubscriptionTarget,
   payload: string,
@@ -222,6 +249,22 @@ export async function sendWebPush(
     throw new Error('Subscription endpoint must use HTTPS');
   }
 
+  let targetUrl: URL;
+  try {
+    targetUrl = new URL(target.endpoint);
+  } catch {
+    throw new Error('Invalid endpoint URL');
+  }
+
+  if (isPrivateOrLoopbackHost(targetUrl.hostname)) {
+    return {
+      statusCode: 400,
+      successful: false,
+      shouldRemoveSubscription: true,
+      error: 'Cannot dispatch push to internal or private IP address',
+    };
+  }
+
   const encryptedBody = encryptPushPayload(payload, target.keys);
   const authHeader = createVapidAuthorizationHeader(target.endpoint, vapidKeys);
   const fetchImpl = options?.fetchFn ?? fetch;
@@ -237,8 +280,10 @@ export async function sendWebPush(
         Urgency: options?.urgency ?? 'normal',
       },
       body: new Uint8Array(encryptedBody),
+      redirect: 'manual',
     });
 
+
     const statusCode = response.status;
     if (statusCode >= 200 && statusCode < 300) {
       return { statusCode, successful: true, shouldRemoveSubscription: false };

src/domain/payroll/service.ts

@@ -15,6 +15,7 @@ export interface PayAssignmentInput {
   pool_weight_bp?: number;
   effective_from?: string;
   note?: string;
+  params?: Record<string, number>;
 }
 
 export interface PayAssignmentRecord {
@@ -294,10 +295,14 @@ export async function saveEmployeePayAssignment(
   const poolWeightBp = data.pool_weight_bp !== undefined ? data.pool_weight_bp : defaultRuleWeight;
 
   const params: Record<string, number> = {
-    rate_minor: data.rate_minor ?? 10000,
+    ...(data.params ?? {}),
-    percent_bp: data.percent_bp ?? 0,
+    ...(data.rate_minor !== undefined ? { rate_minor: data.rate_minor } : {}),
-    guarantee_minor: data.guarantee_minor ?? 0,
+    ...(data.percent_bp !== undefined ? { percent_bp: data.percent_bp } : {}),
+    ...(data.guarantee_minor !== undefined ? { guarantee_minor: data.guarantee_minor } : {}),
   };
+  if (params.rate_minor === undefined && !data.params) {
+    params.rate_minor = 10000;
+  }
 
   await client.query(
     `SELECT pg_advisory_xact_lock(hashtextextended(
@@ -474,6 +479,22 @@ export async function calculatePayrollPeriod(
        AND s.business_date BETWEEN $2 AND $3
        AND s.status = 'confirmed'
        AND ($4::varchar(26) IS NULL OR s.org_unit_id = $4)
+       AND NOT EXISTS (
+         SELECT 1 FROM staff_payroll_lines pl
+         JOIN staff_payroll_runs pr ON pr.tenant_id = pl.tenant_id AND pr.id = pl.run_id
+         WHERE pl.tenant_id = s.tenant_id
+           AND pl.employee_id = s.employee_id
+           AND pl.org_unit_id = s.org_unit_id
+           AND pl.business_date = s.business_date
+           AND pr.status IN ('approved', 'paid')
+       )
+       AND NOT EXISTS (
+         SELECT 1 FROM staff_payroll_batch_lines bl
+         JOIN staff_payroll_batches pb ON pb.tenant_id = bl.tenant_id AND pb.id = bl.batch_id
+         WHERE bl.tenant_id = s.tenant_id
+           AND bl.work_session_id = s.id
+           AND pb.status = 'signed'
+       )
      ORDER BY s.business_date, s.org_unit_id, s.employee_id`,
     [tenantId, from, to, orgUnitId],
   );

src/domain/sync/service.ts

@@ -312,6 +312,21 @@ export class SyncService {
     const seq = decodeCursor(tenantId, cursor);
 
     return this.database.tenantTransaction(tenantId, deviceId, async (client) => {
+      const maxSeqRes = await client.query<{ max_seq: string | null }>(
+        `SELECT MAX(cursor_seq) AS max_seq FROM staff_sync_change_log WHERE tenant_id = $1`,
+        [tenantId],
+      );
+      if (maxSeqRes.rows.length > 0) {
+        const maxSeq = maxSeqRes.rows[0]?.max_seq ? BigInt(maxSeqRes.rows[0].max_seq) : 0n;
+        if (seq > maxSeq) {
+          throw new SyncValidationError(
+            `Курсор ${cursor} превышает текущую позицию журнала изменений (${maxSeq})`,
+            'CURSOR_AHEAD',
+            400,
+          );
+        }
+      }
+
       const res = await client.query<{ acknowledged_at: Date }>(
         `INSERT INTO staff_sync_device_checkpoints
           (tenant_id, device_id, last_acked_cursor_seq, last_acked_cursor, acknowledged_at)
@@ -355,8 +370,9 @@ export class SyncService {
     const limit = Math.min(Math.max(1, options.limit ?? 100), 100);
 
     return this.database.tenantTransaction(tenantId, deviceId, async (client) => {
-      // 1. If cursor is provided -> incremental pull from staff_sync_change_log
+      // 1. If cursor is provided and NOT a snapshot cursor -> incremental pull from staff_sync_change_log
-      if (options.cursor) {
+      const isSnapshotCursor = typeof options.cursor === 'string' && options.cursor.startsWith('snap_');
+      if (options.cursor && !isSnapshotCursor) {
         const seq = decodeCursor(tenantId, options.cursor);
         const filterTypes =
           options.entity_types && options.entity_types.length > 0 ? options.entity_types : null;
@@ -404,6 +420,12 @@ export class SyncService {
       }
 
       // 2. If cursor is omitted/null -> initial bootstrap of current active snapshot
+      let snapOffset = 0;
+      if (isSnapshotCursor) {
+        const match = options.cursor!.match(/^snap_(\d+)_/);
+        if (match) snapOffset = parseInt(match[1]!, 10);
+      }
+
       const seqRes = await client.query<{ max_seq: string | null }>(
         `SELECT MAX(cursor_seq) AS max_seq FROM staff_sync_change_log WHERE tenant_id = $1`,
         [tenantId],
@@ -644,12 +666,15 @@ export class SyncService {
         }
       }
 
-      const hasMore = changes.length > limit;
+      const totalChanges = changes.length;
-      const pageChanges = changes.slice(0, limit);
+      const pageChanges = changes.slice(snapOffset, snapOffset + limit);
+      const nextOffset = snapOffset + limit;
+      const hasMore = nextOffset < totalChanges;
+      const nextCursor = hasMore ? `snap_${nextOffset}_${maxSeq}` : latestCursor;
 
       return {
         changes: pageChanges,
-        next_cursor: latestCursor,
+        next_cursor: nextCursor,
         has_more: hasMore,
       };
     });
@@ -751,7 +776,25 @@ export class SyncService {
         }
 
         // 4. Execute command
-        const executionResult = await this.executeCommand(client, tenantId, device, cmd);
+        await client.query('SAVEPOINT cmd');
+        let executionResult: SyncCommandResult;
+        try {
+          executionResult = await this.executeCommand(client, tenantId, device, cmd);
+          if (executionResult.status === 'rejected') {
+            await client.query('ROLLBACK TO SAVEPOINT cmd');
+          } else {
+            await client.query('RELEASE SAVEPOINT cmd');
+          }
+        } catch (error) {
+          await client.query('ROLLBACK TO SAVEPOINT cmd');
+          executionResult = {
+            idempotency_key: cmd.idempotency_key,
+            command_type: cmd.command_type,
+            status: 'rejected',
+            error_code: 'COMMAND_EXECUTION_ERROR',
+            error_message: error instanceof Error ? error.message : 'Ошибка выполнения команды',
+          };
+        }
         await this.saveInboxCommand(client, tenantId, device.id, cmd, executionResult);
         results.push(executionResult);
       }
@@ -775,7 +818,6 @@ export class SyncService {
         const eventType = payload.event_type as string;
         const occurredAt = payload.occurred_at as string;
         const sourceEventId = (payload.source_event_id as string) || cmd.idempotency_key;
-        const orgUnitId = (payload.org_unit_id as string) || device.org_unit_id;
 
         if (!employeeId || !['check_in', 'check_out'].includes(eventType) || !occurredAt) {
           return {
@@ -787,9 +829,34 @@ export class SyncService {
           };
         }
 
-        // Verify employee belongs to tenant
+        // Validate timestamp window: -180 days .. +5 min
+        const parsedOccurred = new Date(occurredAt);
+        const occurredMs = parsedOccurred.getTime();
+        if (isNaN(occurredMs)) {
+          return {
+            idempotency_key: cmd.idempotency_key,
+            command_type: cmd.command_type,
+            status: 'rejected',
+            error_code: 'INVALID_TIMESTAMP',
+            error_message: 'Некорректный формат времени отметки',
+          };
+        }
+        const maxPast = 180 * 24 * 60 * 60 * 1000;
+        const maxFuture = 5 * 60 * 1000;
+        const diff = Date.now() - occurredMs;
+        if (diff > maxPast || diff < -maxFuture) {
+          return {
+            idempotency_key: cmd.idempotency_key,
+            command_type: cmd.command_type,
+            status: 'rejected',
+            error_code: 'TIMESTAMP_OUT_OF_WINDOW',
+            error_message: 'Время отметки находится вне допустимого диапазона (-180 дней .. +5 минут)',
+          };
+        }
+
+        // Verify employee belongs to tenant and is active
         const empCheck = await client.query<{ id: string }>(
-          `SELECT id FROM staff_employees WHERE tenant_id = $1 AND id = $2`,
+          `SELECT id FROM staff_employees WHERE tenant_id = $1 AND id = $2 AND status = 'active'`,
           [tenantId, employeeId],
         );
         if (empCheck.rowCount === 0) {
@@ -797,18 +864,31 @@ export class SyncService {
             idempotency_key: cmd.idempotency_key,
             command_type: cmd.command_type,
             status: 'rejected',
-            error_code: 'EMPLOYEE_NOT_FOUND',
+            error_code: 'EMPLOYEE_INACTIVE',
-            error_message: 'Сотрудник не найден в данном предприятии',
+            error_message: 'Сотрудник не найден или не активен',
           };
         }
 
+        // Check org_unit_id: payload cannot override foreign device org_unit_id
+        const payloadOrgUnitId = typeof payload.org_unit_id === 'string' ? payload.org_unit_id : null;
+        if (payloadOrgUnitId && device.org_unit_id && payloadOrgUnitId !== device.org_unit_id) {
+          return {
+            idempotency_key: cmd.idempotency_key,
+            command_type: cmd.command_type,
+            status: 'rejected',
+            error_code: 'ORG_UNIT_MISMATCH',
+            error_message: 'Точка в отметке не соответствует подразделению устройства',
+          };
+        }
+        const effectiveOrgUnitId = device.org_unit_id ?? payloadOrgUnitId;
+
         const eventId = (payload.event_id as string) || newUlid();
         const correlationId = cmd.correlation_id || newUlid();
 
         await client.query(
           `INSERT INTO staff_attendance_events
-            (id, tenant_id, employee_id, event_type, source, source_event_id, occurred_at, device_id, actor_id, correlation_id)
+            (id, tenant_id, employee_id, event_type, source, source_event_id, occurred_at, device_id, actor_id, correlation_id, org_unit_id)
-           VALUES ($1, $2, $3, $4, 'terminal', $5, $6, $7, $8, $9)
+           VALUES ($1, $2, $3, $4, 'terminal', $5, $6, $7, $8, $9, $10)
            ON CONFLICT (tenant_id, source, source_event_id) DO NOTHING`,
           [
             eventId,
@@ -820,6 +900,7 @@ export class SyncService {
             device.id,
             device.id,
             correlationId,
+            effectiveOrgUnitId,
           ],
         );
 
@@ -830,7 +911,7 @@ export class SyncService {
           occurred_at: occurredAt,
           source_event_id: sourceEventId,
           device_id: device.id,
-          org_unit_id: orgUnitId ? String(orgUnitId) : null,
+          org_unit_id: effectiveOrgUnitId,
           status: 'accepted',
         };
 

src/operations.ts

@@ -131,6 +131,12 @@ export async function registerOperationsRoutes(
   api.get('/org-units', async (request) => {
     const context = await auth.resolve(request);
     const canManage = context.permissions.has('staff:org_unit:read');
+    if (!canManage && !context.permissions.has('staff:employee:read')) {
+      throw request.server.httpErrors.forbidden(
+        'Недостаточно прав для просмотра списка подразделений.',
+      );
+    }
+
     return database.tenantTransaction(context.tenantId, context.actorId, async (client) => {
       const rows = await client.query(
         `SELECT DISTINCT u.id, u.code, u.name, u.timezone
@@ -569,18 +575,23 @@ export async function registerOperationsRoutes(
         },
         body: {
           type: 'object',
+          additionalProperties: false,
           required: ['pay_rule_id'],
           properties: {
             org_unit_id: {
               anyOf: [{ type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' }, { type: 'null' }],
             },
             pay_rule_id: { type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' },
-            rate_minor: { type: 'integer', minimum: 0 },
+            rate_minor: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
             percent_bp: { type: 'integer', minimum: 0, maximum: 10000 },
-            guarantee_minor: { type: 'integer', minimum: 0 },
+            guarantee_minor: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
             pool_weight_bp: { type: 'integer', minimum: 0, maximum: 20000 },
             effective_from: { type: 'string', pattern: '^\\d{4}-\\d{2}-\\d{2}$' },
             note: { type: 'string', maxLength: 500 },
+            params: {
+              type: 'object',
+              additionalProperties: { type: 'integer', minimum: 0, maximum: 1_000_000_000 },
+            },
           },
         },
       },
@@ -660,9 +671,18 @@ export async function registerOperationsRoutes(
       auth.assertMutationOrigin(request);
       const context = await auth.require(request, 'staff:payroll:calculate');
 
+      if (context.role === 'point_manager') {
+        if (!request.body.org_unit_id || !(context.orgUnitIds ?? []).includes(request.body.org_unit_id)) {
+          return reply.forbidden('Менеджер точки может рассчитывать зарплату только для своей точки.');
+        }
+      }
+
       let from: string;
       let to: string;
       if (request.body.month) {
+        if (!/^\d{4}-(0[1-9]|1[0-2])$/.test(request.body.month)) {
+          return reply.badRequest('Некорректный формат месяца (ожидается YYYY-MM от 01 до 12).');
+        }
         from = `${request.body.month}-01`;
         const parts = request.body.month.split('-').map(Number);
         const year = parts[0]!;
@@ -773,6 +793,53 @@ export async function registerOperationsRoutes(
     },
   );
 
+  api.get<{ Params: { runId: string } }>(
+    '/payroll/runs/:runId/verify',
+    {
+      schema: {
+        params: {
+          type: 'object',
+          required: ['runId'],
+          properties: {
+            runId: { type: 'string', pattern: '^[0-9A-HJKMNP-TV-Z]{26}$' },
+          },
+        },
+      },
+    },
+    async (request, reply) => {
+      const context = await auth.resolve(request);
+      if (!context.permissions.has('staff:payroll:read')) {
+        return reply.forbidden('Недостаточно прав для проверки расчёта.');
+      }
+      const runId = parseUlid(request.params.runId);
+      return database.tenantTransaction(context.tenantId, context.actorId, async (client) => {
+        const runRes = await client.query<{ total_accrued_minor: string }>(
+          `SELECT total_accrued_minor::text AS total_accrued_minor
+           FROM staff_payroll_runs
+           WHERE tenant_id = $1 AND id = $2`,
+          [context.tenantId, runId],
+        );
+        if (runRes.rowCount === 0 || !runRes.rows[0]) {
+          return reply.notFound('Расчёт зарплаты не найден.');
+        }
+        const linesRes = await client.query<{ lines_total: string }>(
+          `SELECT COALESCE(SUM(amount_minor), 0)::text AS lines_total
+           FROM staff_payroll_lines
+           WHERE tenant_id = $1 AND run_id = $2`,
+          [context.tenantId, runId],
+        );
+        const storedTotal = Number(runRes.rows[0].total_accrued_minor);
+        const recalculatedTotal = Number(linesRes.rows[0]?.lines_total ?? 0);
+        return reply.send({
+          run_id: runId,
+          stored_total_minor: storedTotal,
+          recalculated_total_minor: recalculatedTotal,
+          matches: storedTotal === recalculatedTotal,
+        });
+      });
+    },
+  );
+
   api.post<{ Body: OwnerWorkbookImportBody }>(
     '/imports/owner-workbook',
     {
@@ -1018,18 +1085,18 @@ export async function registerOperationsRoutes(
             const desiredAmount =
               entry.kind === 'payout' ? -Math.abs(entry.amount_minor) : entry.amount_minor;
             const employeeId = employeeIds.get(entry.employee_external_ref);
-            const legacyPrefix = `xlsx:${entry.kind}:%`;
-            const currentPrefix = `xlsx:payroll:${entry.kind}:%`;
             const existing = await client.query<{ amount_minor: string }>(
               `SELECT COALESCE(sum(amount_minor), 0)::text AS amount_minor
                FROM staff_payroll_ledger
-               WHERE tenant_id = $1 AND employee_id = $2 AND business_date = $3
+               WHERE tenant_id = $1 AND employee_id = $2
-                 AND (external_key LIKE $4 OR external_key LIKE $5)`,
+                 AND (external_key = $3 OR external_key LIKE $3 || ':%')`,
-              [context.tenantId, employeeId, entry.business_date, legacyPrefix, currentPrefix],
+              [context.tenantId, employeeId, entry.external_key],
             );
             const previousAmount = Number(existing.rows[0]?.amount_minor ?? 0);
             const delta = desiredAmount - previousAmount;
             if (delta === 0) continue;
+            const isInitial = previousAmount === 0;
+            const rowKey = isInitial ? entry.external_key : `${entry.external_key}:adj:${newUlid()}`;
             await client.query(
               `INSERT INTO staff_payroll_ledger
              (id, tenant_id, employee_id, business_date, kind, amount_minor,
@@ -1041,12 +1108,12 @@ export async function registerOperationsRoutes(
                 context.tenantId,
                 employeeId,
                 entry.business_date,
-                previousAmount === 0 ? entry.kind : 'adjustment',
+                isInitial ? entry.kind : 'adjustment',
                 delta,
                 context.correlationId,
                 entry.note?.trim() ?? `Импорт: ${body.source_name}`,
                 context.actorId,
-                entry.external_key,
+                rowKey,
               ],
             );
           }
@@ -1202,7 +1269,8 @@ function validateImport(body: OwnerWorkbookImportBody): boolean {
     if (
       !entry.external_key ||
       !parseDate(entry.business_date) ||
-      !Number.isSafeInteger(entry.amount_minor)
+      !Number.isSafeInteger(entry.amount_minor) ||
+      !['accrual', 'payout', 'adjustment'].includes(entry.kind)
     )
       return false;
   }

src/session.ts

@@ -0,0 +1,31 @@
+import { randomBytes } from 'node:crypto';
+
+export interface SessionData {
+  token: string;
+  expiresAt: number;
+}
+
+const sessionStore = new Map<string, SessionData>();
+
+export function createSession(token: string, maxAgeSeconds: number): string {
+  const sessionId = randomBytes(32).toString('hex');
+  sessionStore.set(sessionId, {
+    token,
+    expiresAt: Date.now() + maxAgeSeconds * 1000,
+  });
+  return sessionId;
+}
+
+export function getSessionToken(sessionId: string): string | undefined {
+  const session = sessionStore.get(sessionId);
+  if (!session) return undefined;
+  if (session.expiresAt <= Date.now()) {
+    sessionStore.delete(sessionId);
+    return undefined;
+  }
+  return session.token;
+}
+
+export function revokeSession(sessionId: string): void {
+  sessionStore.delete(sessionId);
+}

src/sync.ts

@@ -7,6 +7,7 @@ import type { IdentityPort } from './core/ports.js';
 import { SyncAuthError, SyncService, SyncValidationError } from './domain/sync/service.js';
 import { InvalidCursorError } from './domain/sync/cursor.js';
 import type { SyncCommand } from './domain/sync/types.js';
+import { getSessionToken } from './session.js';
 
 interface PullBody {
   cursor?: string | null;
@@ -67,7 +68,23 @@ export async function registerSyncRoutes(
     return undefined;
   };
 
+  function assertCookieMutationOrigin(request: FastifyRequest) {
+    const authorization = request.headers.authorization;
+    if (authorization?.startsWith('Bearer ')) return;
+    const origin = request.headers.origin;
+    if (!origin) {
+      throw request.server.httpErrors.forbidden('Запрос без Origin отклонён.');
+    }
+    try {
+      const parsed = new URL(origin);
+      if (parsed.host !== request.headers.host) throw new Error();
+    } catch {
+      throw request.server.httpErrors.forbidden('Запрос с постороннего сайта отклонён.');
+    }
+  }
+
   const requireManagerContext = async (request: FastifyRequest) => {
+    assertCookieMutationOrigin(request);
     const authHeader = request.headers.authorization;
     const cookieHeader = request.headers.cookie;
     const sessionCookieName = '__Host-krona_staff_session';
@@ -78,7 +95,8 @@ export async function registerSyncRoutes(
         const sep = part.indexOf('=');
         if (sep > 0 && part.slice(0, sep).trim() === sessionCookieName) {
           try {
-            token = decodeURIComponent(part.slice(sep + 1).trim());
+            const rawSessionId = decodeURIComponent(part.slice(sep + 1).trim());
+            token = getSessionToken(rawSessionId);
           } catch {
             // ignore malformed cookie
           }
@@ -87,6 +105,10 @@ export async function registerSyncRoutes(
       }
     }
 
+    if (!token) {
+      throw request.server.httpErrors.unauthorized('Требуется действующий ключ доступа руководителя');
+    }
+
     try {
       const context = await baseIdentity.resolve(token, parseUlid(request.id));
       if (

tests/e2e/60-pilot-rehome.e2e.ts

@@ -215,6 +215,7 @@ async function seed(tenant: string) {
           [randomUlid(), tenant, emp, rules[i], '2026-01-01', actor],
         );
       }
+      const seedSessionIds: string[] = [];
       for (const [i, emp] of employees.slice(0, 2).entries()) {
         await q(
           'staff_attendance_events',
@@ -231,11 +232,14 @@ async function seed(tenant: string) {
             corr(),
           ],
         );
+        const sid = randomUlid();
+        seedSessionIds.push(sid);
         await q(
           'staff_work_sessions',
           'INSERT INTO staff_work_sessions (id, tenant_id, employee_id, org_unit_id, business_date) VALUES ($1,$2,$3,$4,$5)',
-          [randomUlid(), tenant, emp, ou1, '2026-09-01'],
+          [sid, tenant, emp, ou1, '2026-09-01'],
         );
+
         await q(
           'staff_timesheet_entries',
           'INSERT INTO staff_timesheet_entries (id, tenant_id, employee_id, work_date, updated_by) VALUES ($1,$2,$3,$4,$5)',
@@ -377,7 +381,44 @@ async function seed(tenant: string) {
           [device, tenant],
         );
       }
+      for (let i = 0; i < 2; i += 1) {
+        await q(
+          'staff_access_grants',
+          'INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by) VALUES ($1,$2,$3,$4,$5,$6,$7)',
+          [
+            randomUlid(),
+            tenant,
+            i === 0 ? 'accountant' : 'director',
+            `Роль ${i}`,
+            hex64(),
+            'hint…',
+            actor,
+          ],
+        );
+        const batchId = randomUlid();
+        await q(
+          'staff_payroll_batches',
+          'INSERT INTO staff_payroll_batches (id, tenant_id, org_unit_id, period_start, period_end, created_by) VALUES ($1,$2,$3,$4,$5,$6)',
+          [batchId, tenant, ou1, `2026-0${i + 4}-01`, `2026-0${i + 4}-28`, actor],
+        );
+        await q(
+          'staff_payroll_batch_lines',
+          'INSERT INTO staff_payroll_batch_lines (id, tenant_id, batch_id, work_session_id, employee_id, org_unit_id, amount_minor) VALUES ($1,$2,$3,$4,$5,$6,$7)',
+          [randomUlid(), tenant, batchId, seedSessionIds[i]!, employees[i]!, ou1, 100_000 + i],
+        );
+        await q(
+          'staff_batch_notifications',
+          'INSERT INTO staff_batch_notifications (id, tenant_id, recipient_role, type, subject_id) VALUES ($1,$2,$3,$4,$5)',
+          [randomUlid(), tenant, 'director', 'payroll.batch.submitted', batchId],
+        );
+        await q(
+          'staff_biometric_consents',
+          'INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by) VALUES ($1,$2,$3,$4,$5)',
+          [tenant, employees[i]!, 'granted', `doc-${i}`, actor],
+        );
+      }
     },
+
     actor,
   );
   return { employees, seeded };

tests/integration/openapi-runtime.test.ts

@@ -54,6 +54,7 @@ describe('OpenAPI runtime contract', () => {
         .replace('{employeeId}', '01J00000000000000000000000')
         .replace('{workDate}', '2026-09-24')
         .replace('{runId}', '01J00000000000000000000000')
+        .replace('{id}', '01J00000000000000000000000')
         .replace('{deviceId}', '01J00000000000000000000000');
       const operations = documented.paths[path] as Record<string, unknown>;
       const methods = ['get', 'post', 'put', 'patch', 'delete'] as const;

tests/integration/portal.test.ts

@@ -240,9 +240,10 @@ describe('attendance portal', () => {
       },
     });
     expect(response.statusCode).toBe(201);
-    expect(calls).toHaveLength(2);
+    expect(calls).toHaveLength(3);
     expect(calls[0]?.[0]).toContain('INSERT INTO staff_employees');
     expect(calls[1]?.[0]).toContain('staff_audit_log');
+    expect(calls[2]?.[0]).toContain('staff_sync_change_log');
     await app.close();
   });
 
@@ -273,7 +274,7 @@ describe('attendance portal', () => {
       status: 'active',
     };
     const after = { ...before, position: 'Старший администратор' };
-    const { database, calls } = fakeDatabase([[before], [], [after], []]);
+    const { database, calls } = fakeDatabase([[before], [], [after], [], []]);
     const app = await buildApp({
       config: loadConfig({ ...base, ...tokenConfig, STANDALONE_ACCESS: 'manager' }),
       database,
@@ -285,10 +286,11 @@ describe('attendance portal', () => {
       payload: { position: 'Старший администратор' },
     });
     expect(response.statusCode).toBe(200);
-    expect(calls).toHaveLength(4);
+    expect(calls).toHaveLength(5);
     expect(calls[0]?.[0]).toContain('FOR UPDATE');
     expect(calls[3]?.[1]?.[4]).toEqual(before);
     expect(calls[3]?.[1]?.[5]).toEqual(after);
+    expect(calls[4]?.[0]).toContain('staff_sync_change_log');
     await app.close();
   });
 

tests/integration/tenant-isolation.test.ts

@@ -12,6 +12,11 @@ const describeDatabase = connectionString ? describe : describe.skip;
 const migrationConnectionString =
   process.env.DATABASE_TEST_MIGRATION_URL ?? process.env.DATABASE_MIGRATION_URL;
 const cleanupTables = [
+  'staff_biometric_consents',
+  'staff_batch_notifications',
+  'staff_payroll_batch_lines',
+  'staff_payroll_batches',
+  'staff_access_grants',
   'staff_sync_device_checkpoints',
   'staff_sync_command_inbox',
   'staff_sync_change_log',
@@ -311,5 +316,55 @@ describeDatabase('PostgreSQL tenant isolation', () => {
         ),
       ),
     ).rejects.toThrow();
+
+    // Access grants tenant isolation
+    const grantIdA = newUlid();
+    await database.tenantTransaction(tenantA, actorA, async (client) => {
+      await client.query(
+        `INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by)
+         VALUES ($1, $2, 'point_manager', 'Manager A', '0123456789abcdef0123456789abcdef0123456789abcdef0123456789abcdef', 'hint', $3)`,
+        [grantIdA, tenantA, actorA],
+      );
+    });
+
+    const grantVisibleToB = await database.tenantTransaction(tenantB, actorB, (client) =>
+      client.query('SELECT id FROM staff_access_grants WHERE id = $1', [grantIdA]),
+    );
+    expect(grantVisibleToB.rowCount).toBe(0);
+
+    await expect(
+      database.tenantTransaction(tenantB, actorB, (client) =>
+        client.query(
+          `INSERT INTO staff_access_grants (id, tenant_id, role, display_name, token_hash, token_hint, created_by)
+           VALUES ($1, $2, 'point_manager', 'Manager B Fail', 'fedcba9876543210fedcba9876543210fedcba9876543210fedcba9876543210', 'hint', $3)`,
+          [newUlid(), tenantA, actorB],
+        ),
+      ),
+    ).rejects.toThrow();
+
+    // Biometric consents tenant isolation
+    await database.tenantTransaction(tenantA, actorA, async (client) => {
+      await client.query(
+        `INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by)
+         VALUES ($1, $2, 'granted', 'doc-ref-a', $3)`,
+        [tenantA, employeeIdA, actorA],
+      );
+    });
+
+    const consentVisibleToB = await database.tenantTransaction(tenantB, actorB, (client) =>
+      client.query('SELECT status FROM staff_biometric_consents WHERE employee_id = $1', [employeeIdA]),
+    );
+    expect(consentVisibleToB.rowCount).toBe(0);
+
+    await expect(
+      database.tenantTransaction(tenantB, actorB, (client) =>
+        client.query(
+          `INSERT INTO staff_biometric_consents (tenant_id, employee_id, status, document_ref, updated_by)
+           VALUES ($1, $2, 'revoked', 'doc-ref-b', $3)`,
+          [tenantA, employeeIdA, actorB],
+        ),
+      ),
+    ).rejects.toThrow();
   });
 });
+