Re: Translation question: "bill" VS "invoice"

Karsten Hilbert <[email protected]> Sun, 7 Jun 2026 20:06:24 +0200
Newsgroups gmane.comp.gnu.medical.devel
Message-ID <[email protected]>
> I will double-check the UI and remove any functionality to
> edit the invoice ID.

I have double-checked the UI. There is no built-in way to
_edit_ an invoice ID. Given sufficient criminal intent one
can always (in nearly any system) reach out to lower levels
and manipulate what's there. Simply editing the database
with, say pgAdmin, won't cut it, though, becase a trigger on
the bills table logs the invoice ID along with other mods.
And, yes, uniqueness checks take into account logged IDs.

- Whenever a new bill (not even an invoice just yet) is
created a brand new invoice ID is generated as well.

- That ID is guarantueed to be unique insofar as one would
have to manipulate computer time and hit the exact same time
in order to duplicate an invoice ID. Leading/trailing blanks
are disregarded.

- Interestingly the "time" placeholder format was
(programmatically, not by UI) configurable which would make
it easier to create dupes by setting it to hours
granularity (the built-in default is seconds).

- I have now added code that double-checks whether an
invoice ID generated with a time placeholder but without a
counter placeholder already exists. If so a counter
placeholder is forced onto the template and processing
continues. The only theoretical loophole left there is a
TOCTOU race condition.

- In case an invoice ID with counter also exists, a
microseconds timestamp is added in.

Karsten
=2D-=20
GPG  40BE 5B0E C98E 1713 AFA6  5BC0 3BEA AC80 7D4F C89B