- Add bc-proxy and bc-export serverless API handlers
- Add businessCentral service with updateCpnpNoInBC and downloadBusinessCentralItemsExcel
- Sync cpnpNo to BC on save (CosmeticItemsView and handleSaveAll)
- Parallelize handleSaveAll with Promise.all
- Fix array index key, a11y click/keyboard handlers, autoFocus
- Grant Change History and Pending Validation access to jingying.shi@craze-group.com
Co-Authored-By: claude-flow <ruv@ruv.net>
Adds HSTS, CSP, X-Frame-Options, X-Content-Type-Options, Referrer-Policy,
and Permissions-Policy to all responses. CSP allowlist includes only
Supabase and Dropbox as external connect targets.
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Replace unreliable third-party CORS proxies (allorigins, cors-anywhere,
thingproxy) with a local /dropbox-file route proxied server-side:
- vite.config.ts: add dev server proxy for /dropbox-file -> dl.dropboxusercontent.com
- vercel.json: add rewrite rule for the same route in production
- App.tsx: simplify fetch logic to use single reliable proxy path
Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
Christian Vidal Wolf
