# ERP Frontend — Continuation

Branch: `authz-audit-2026-08-25`

## Session 2026-08-26d — Frontend Production Audit

Stack: Go backend :8080, ERP :5173 (Vite 8, Vue 3.5), Postgres km-pg, Redis km-redis.
Backend CORS `http://localhost:5173` included; dev proxy `/api,/uploads → localhost:8080` added to `vite.config.js`.

### Fixed
- **P0** `src/services/api/products.js` `UPLOAD_PATH` `'/uploads'` resolved to `/api/v1/uploads` (404) — now `UPLOAD_BASE = VITE_API_URL.replace(/\/api\/v1\/?$/,'')` + `${UPLOAD_BASE}/uploads`.
- **P1** `src/config/navigation.js` missing nav for 2 report routes — tambah `Laporan Penjualan (reports-sales)` + `Laporan Stok (reports-stock)`.
- **P1** `src/mocks/registry.js` + `controllers/finance.js` — 12 endpoint parity miss (`/accounts`, `/cash-accounts`, `/cashflow-balances`, `/payment-vouchers/*`, `/payments/me`, `/warehouses/options`, `/purchase-orders/:id/print`) stub → `registry.test.js` 14/14.
- **P1** `src/pages/system/UsersPage.test.js` explicit-false permission overrides — test expect `{perm:false}` bukan `{}`, impl `openEdit/buildPermissions` tri-state benar.
- **P1** `vite.config.js` — `chunkSize 5.7 MB (gzip 1.2 MB) single index` → `manualChunks(id)` `vendor-vue` 44KB, `vendor-http` 47KB, `vendor-map` 182KB, `vendor-charts` 256KB, `vendor-misc` 5.6MB (phosphor-icons full bundle, 1.18 MB gzip — tree-shake follow-up).
- **P1** `vite.config.js` proxy `/api,/uploads → localhost:8080` — sebelumnya dev cross-origin tanpa proxy, preflight 403.
- **P0** `src/components/ui/AppSelect.vue` (prior session) options/placeholder support — kept.

### Verification
- `bun run build` 2.3s ✓ (index 32KB)
- `bun run test` 14/14 ✓
- `curl GET /products`, `/sales-orders`, `/invoices/receivables` 200 via `VITE_API_URL=/api/v1` + proxy.

### Still open (P1/P2)
- `vendor-misc` 5.6 MB — `@phosphor-icons/vue` tidak tree-shaken (`src/vendor/phosphor.js` re-export all). Split per-icon import.
- `MODULES` store `warehouses.store_id` belum ada — cross-warehouse masih possible by design.
- `ListUsers ?role=&status=` filter ignored, `users.employee_id` dead field — query/handler change needed.