Products that have entries in products_history were edited at some point.
If their status was accidentally reset to 'excel', the sync would overwrite
their data. Now also check products_history to build the protected set.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Instead of relying on resolvedCols.PRODUCT_TYPE (which can resolve to the
wrong index if the column header doesn't match the pattern), compare the
saved Supabase row against the fresh Excel row: any index where they differ
is a user edit and gets applied. This fixes TYPE / 'Surprise Bath bomb'
not appearing after reload.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
The column header in the Excel is 'TYPE', not 'Product Type', so the
old pattern never matched. resolveColumnIndices fell back to the hardcoded
index 103, causing the PRODUCT_TYPE editable column index to be wrong on
reload and edited values (e.g. 'Surprise Bath bomb') to never be applied.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
resetAllPendingRows was setting status to 'synced' instead of 'edited',
causing the merge logic on reload to skip those rows. Also keep 'edited'
and 'saved' statuses locally after export instead of clearing all.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Automatically detects if saved data uses the old Excel structure.
- Shifts indices dynamically to ensure UVP and SRP values match current columns.
- Fixes the 2.41 UVP and 4.95 SRP Int discrepancy.
- Migrated 126 manual edits to 'edited' status.
- Updated App.tsx to merge rows with 'edited' or 'synced' status.
- Protected manual edits from being overwritten by automated Dropbox syncs.
Mirrors Check Ying with its own checkbox and note editor (pink theme).
Stored in virtual columns ANNA_CHECK (105) and ANNA_NOTE (106).
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
- Integrated new column after TYPE.
- Enabled inline editing with auto-save.
- Added field to the full row EditPanel.
- Configured dynamic column detection in types.ts.
Adds HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
and Permissions-Policy to all responses. CSP allowlist includes only
Supabase and Dropbox as external connect targets.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Both Vercel serverless functions now enforce CORS, returning 403 for
requests from any origin other than craze-data-check.vercel.app.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replaced hardcoded anon key as Bearer token with authHeaders() helper
that uses the authenticated user's access_token when available, enabling
Row Level Security policies to identify the calling user correctly.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
