Bump version from 2.3.2 to 2.3.3

Closes the residual surface from the three published SSRF advisories (GHSA-pc5v-8xwc-v9xq, GHSA-38hf-fq8x-q49r, GHSA-q9wx-ggwq-mcgh / CVE-2026-34365 to 34367). The original fix in 07757e74 only sanitized the Notes field via Invoice/Estimate/Payment::getNotes(), but the same blade templates also render company/billing/shipping address fields with {!! !!} (Blade unescaped output). Those address strings are produced by getCompanyAddress(), getCustomerBillingAddress(), getCustomerShippingAddress() which feed into GeneratesPdfTrait::getFormattedString() — and that method does not call PdfHtmlSanitizer.

Customer-controlled fields (name, street, phone, custom field values) are substituted into address templates via getFieldsArray() without HTML-escaping. A malicious customer name like "Acme <img src='http://attacker/probe'>" therefore reaches Dompdf as raw HTML through the address path, exactly the same CWE-918 SSRF pattern the advisories describe — only blocked today by the secondary defense of dompdf's enable_remote=false. If a self-hoster sets DOMPDF_ENABLE_REMOTE=true for legitimate remote logos, the address surface immediately re-opens.

Move the PdfHtmlSanitizer::sanitize() call into the chokepoint at GeneratesPdfTrait::getFormattedString(), so all four sinks — notes plus the three address fields, on all three models — get the same treatment via a single call site. The explicit wrapper in each model's getNotes() becomes redundant and is removed (along with the now-unused App\Support\PdfHtmlSanitizer imports). Verified getFormattedString() is only called from PDF code paths (no email body callers, which use strtr() directly) so there is no risk of stripping useful HTML from a non-PDF context.

Extends tests/Unit/PdfHtmlSanitizerTest.php with three new cases covering the address-template scenario, iframe/link tag stripping, and on* event handler removal. All 8 tests pass via vendor/bin/pest tests/Unit/PdfHtmlSanitizerTest.php.

.cursor/mcp.json

@@ -0,0 +1,11 @@
+{
+    "mcpServers": {
+        "laravel-boost": {
+            "command": "php",
+            "args": [
+                "artisan",
+                "boost:mcp"
+            ]
+        }
+    }
+}

.cursor/skills/medialibrary-development/SKILL.md

@@ -0,0 +1,106 @@
+---
+name: medialibrary-development
+description: Build and work with spatie/laravel-medialibrary features including associating files with Eloquent models, defining media collections and conversions, generating responsive images, and retrieving media URLs and paths.
+license: MIT
+metadata:
+  author: Spatie
+---
+
+# Media Library Development
+
+## Overview
+
+Use spatie/laravel-medialibrary to associate files with Eloquent models. Supports image/video conversions, responsive images, multiple collections, and various storage disks.
+
+## When to Activate
+
+- Activate when working with file uploads, media attachments, or image processing in Laravel.
+- Activate when code references `HasMedia`, `InteractsWithMedia`, the `Media` model, or media collections/conversions.
+- Activate when the user wants to add, retrieve, convert, or manage files attached to Eloquent models.
+
+## Scope
+
+- In scope: media uploads, collections, conversions, responsive images, custom properties, file retrieval, path/URL generation.
+- Out of scope: general file storage without Eloquent association, non-Laravel frameworks.
+
+## Workflow
+
+1. Identify the task (model setup, adding media, defining conversions, retrieving files, etc.).
+2. Read `references/medialibrary-guide.md` and focus on the relevant section.
+3. Apply the patterns from the reference, keeping code minimal and Laravel-native.
+
+## Core Concepts
+
+### Model Setup
+
+Every model that should have media must implement `HasMedia` and use the `InteractsWithMedia` trait:
+
+```php
+use Spatie\MediaLibrary\HasMedia;
+use Spatie\MediaLibrary\InteractsWithMedia;
+
+class BlogPost extends Model implements HasMedia
+{
+    use InteractsWithMedia;
+}
+```
+
+### Adding Media
+
+```php
+$blogPost->addMedia($file)->toMediaCollection('images');
+$blogPost->addMediaFromUrl($url)->toMediaCollection('images');
+$blogPost->addMediaFromRequest('file')->toMediaCollection('images');
+```
+
+### Defining Collections
+
+```php
+public function registerMediaCollections(): void
+{
+    $this->addMediaCollection('avatar')->singleFile();
+    $this->addMediaCollection('downloads')->useDisk('s3');
+}
+```
+
+### Defining Conversions
+
+```php
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
+use Spatie\Image\Enums\Fit;
+
+public function registerMediaConversions(?Media $media = null): void
+{
+    $this->addMediaConversion('thumb')
+        ->fit(Fit::Contain, 300, 300)
+        ->nonQueued();
+}
+```
+
+### Retrieving Media
+
+```php
+$url = $model->getFirstMediaUrl('images');
+$thumbUrl = $model->getFirstMediaUrl('images', 'thumb');
+$allMedia = $model->getMedia('images');
+```
+
+## Do and Don't
+
+Do:
+- Always implement the `HasMedia` interface alongside the `InteractsWithMedia` trait.
+- Use `?Media $media = null` as the parameter for `registerMediaConversions()`.
+- Call `->toMediaCollection()` to finalize adding media.
+- Use `->nonQueued()` for conversions that should run synchronously.
+- Use `->singleFile()` on collections that should only hold one file.
+- Use `Spatie\Image\Enums\Fit` enum values for fit methods.
+
+Don't:
+- Don't forget to run `php artisan vendor:publish --provider="Spatie\MediaLibrary\MediaLibraryServiceProvider" --tag="medialibrary-migrations"` before migrating.
+- Don't use `env()` for disk configuration; use `config()` or set it in `config/media-library.php`.
+- Don't call `addMedia()` without calling `toMediaCollection()` — the media won't be saved.
+- Don't reference conversion names that aren't registered in `registerMediaConversions()`.
+
+## References
+
+- `references/medialibrary-guide.md`

.cursor/skills/medialibrary-development/references/medialibrary-guide.md

@@ -0,0 +1,577 @@
+# Laravel Media Library Reference
+
+Complete reference for `spatie/laravel-medialibrary`. Full documentation: https://spatie.be/docs/laravel-medialibrary
+
+## Model Setup
+
+Implement `HasMedia` and use `InteractsWithMedia`:
+
+```php
+use Illuminate\Database\Eloquent\Model;
+use Spatie\MediaLibrary\HasMedia;
+use Spatie\MediaLibrary\InteractsWithMedia;
+
+class BlogPost extends Model implements HasMedia
+{
+    use InteractsWithMedia;
+
+    public function registerMediaCollections(): void
+    {
+        $this->addMediaCollection('images');
+    }
+
+    public function registerMediaConversions(?Media $media = null): void
+    {
+        $this->addMediaConversion('thumb')
+            ->fit(Fit::Contain, 300, 300);
+    }
+}
+```
+
+## Adding Media
+
+### From uploaded file
+
+```php
+$model->addMedia($request->file('image'))->toMediaCollection('images');
+```
+
+### From request (shorthand)
+
+```php
+$model->addMediaFromRequest('image')->toMediaCollection('images');
+```
+
+### From URL
+
+```php
+$model->addMediaFromUrl('https://example.com/image.jpg')->toMediaCollection('images');
+```
+
+### From string content
+
+```php
+$model->addMediaFromString('raw content')->usingFileName('file.txt')->toMediaCollection('files');
+```
+
+### From base64
+
+```php
+$model->addMediaFromBase64($base64Data)->usingFileName('photo.jpg')->toMediaCollection('images');
+```
+
+### From stream
+
+```php
+$model->addMediaFromStream($stream)->usingFileName('file.pdf')->toMediaCollection('files');
+```
+
+### From existing disk
+
+```php
+$model->addMediaFromDisk('path/to/file.jpg', 's3')->toMediaCollection('images');
+```
+
+### Multiple files from request
+
+```php
+$model->addMultipleMediaFromRequest(['images'])->each(function ($fileAdder) {
+    $fileAdder->toMediaCollection('images');
+});
+
+$model->addAllMediaFromRequest()->each(function ($fileAdder) {
+    $fileAdder->toMediaCollection('images');
+});
+```
+
+### Copy instead of move
+
+```php
+$model->copyMedia($pathToFile)->toMediaCollection('images');
+// or
+$model->addMedia($pathToFile)->preservingOriginal()->toMediaCollection('images');
+```
+
+## FileAdder Options
+
+All methods are chainable before calling `toMediaCollection()`:
+
+```php
+$model->addMedia($file)
+    ->usingName('Custom Name')              // display name
+    ->usingFileName('custom-name.jpg')      // filename on disk
+    ->setOrder(3)                           // order within collection
+    ->withCustomProperties(['alt' => 'A landscape photo'])
+    ->withManipulations(['thumb' => ['filter' => 'greyscale']])
+    ->withResponsiveImages()                // generate responsive variants
+    ->storingConversionsOnDisk('s3')         // put conversions on different disk
+    ->addCustomHeaders(['CacheControl' => 'max-age=31536000'])
+    ->toMediaCollection('images');
+```
+
+### Store on cloud disk
+
+```php
+$model->addMedia($file)->toMediaCollectionOnCloudDisk('images');
+```
+
+## Media Collections
+
+Define in `registerMediaCollections()`:
+
+```php
+public function registerMediaCollections(): void
+{
+    // Basic collection
+    $this->addMediaCollection('images');
+
+    // Single file (replacing previous on new upload)
+    $this->addMediaCollection('avatar')
+        ->singleFile();
+
+    // Keep only latest N items
+    $this->addMediaCollection('recent_photos')
+        ->onlyKeepLatest(5);
+
+    // Specific disk
+    $this->addMediaCollection('downloads')
+        ->useDisk('s3');
+
+    // With conversions disk
+    $this->addMediaCollection('photos')
+        ->useDisk('s3')
+        ->storeConversionsOnDisk('s3-thumbnails');
+
+    // MIME type restriction
+    $this->addMediaCollection('documents')
+        ->acceptsMimeTypes(['application/pdf', 'application/zip']);
+
+    // Custom validation
+    $this->addMediaCollection('images')
+        ->acceptsFile(function ($file) {
+            return $file->mimeType === 'image/jpeg';
+        });
+
+    // Fallback URL/path when collection is empty
+    $this->addMediaCollection('avatar')
+        ->singleFile()
+        ->useFallbackUrl('/images/default-avatar.jpg')
+        ->useFallbackPath(public_path('/images/default-avatar.jpg'));
+
+    // Enable responsive images for entire collection
+    $this->addMediaCollection('hero_images')
+        ->withResponsiveImages();
+
+    // Collection-specific conversions
+    $this->addMediaCollection('photos')
+        ->registerMediaConversions(function () {
+            $this->addMediaConversion('card')
+                ->fit(Fit::Crop, 400, 400);
+        });
+}
+```
+
+## Media Conversions
+
+Define in `registerMediaConversions()`:
+
+```php
+use Spatie\MediaLibrary\MediaCollections\Models\Media;
+use Spatie\Image\Enums\Fit;
+
+public function registerMediaConversions(?Media $media = null): void
+{
+    $this->addMediaConversion('thumb')
+        ->fit(Fit::Contain, 300, 300)
+        ->nonQueued();
+
+    $this->addMediaConversion('preview')
+        ->fit(Fit::Crop, 500, 500)
+        ->withResponsiveImages()
+        ->queued();
+
+    $this->addMediaConversion('banner')
+        ->fit(Fit::Max, 1200, 630)
+        ->performOnCollections('images', 'headers')
+        ->nonQueued()
+        ->sharpen(10);
+
+    // Conditional conversion based on media properties
+    if ($media?->mime_type === 'image/png') {
+        $this->addMediaConversion('png-thumb')
+            ->fit(Fit::Contain, 150, 150);
+    }
+
+    // Keep original format instead of converting to jpg
+    $this->addMediaConversion('web')
+        ->fit(Fit::Max, 800, 800)
+        ->keepOriginalImageFormat();
+
+    // PDF page rendering
+    $this->addMediaConversion('pdf-preview')
+        ->pdfPageNumber(1)
+        ->fit(Fit::Contain, 400, 400);
+
+    // Video frame extraction
+    $this->addMediaConversion('video-thumb')
+        ->extractVideoFrameAtSecond(5)
+        ->fit(Fit::Crop, 300, 300);
+}
+```
+
+### Image Manipulation Methods (via spatie/image)
+
+Resizing and fitting:
+- `width(int)`, `height(int)` — constrain dimensions
+- `fit(Fit, int, int)` — fit within bounds using `Fit::Contain`, `Fit::Max`, `Fit::Fill`, `Fit::Stretch`, `Fit::Crop`
+- `crop(int, int)` — crop to exact dimensions
+
+Effects:
+- `sharpen(int)`, `blur(int)`, `pixelate(int)`
+- `greyscale()`, `sepia()`
+- `brightness(int)`, `contrast(int)`, `colorize(int, int, int)`
+
+Orientation:
+- `orientation(int)`, `flip(string)`, `rotate(int)`
+
+Format:
+- `format(string)` — `'jpg'`, `'png'`, `'webp'`, `'avif'`
+- `quality(int)` — 1-100
+
+Other:
+- `border(int, string, string)`, `watermark(string)`
+- `optimize()`, `nonOptimized()`
+
+### Conversion Configuration
+
+- `performOnCollections('col1', 'col2')` — limit to specific collections
+- `queued()` / `nonQueued()` — run async or sync
+- `withResponsiveImages()` — also generate responsive variants for this conversion
+- `keepOriginalImageFormat()` — preserve png/webp/gif instead of converting to jpg
+- `pdfPageNumber(int)` — which PDF page to render
+- `extractVideoFrameAtSecond(int)` — video thumbnail timing
+
+## Retrieving Media
+
+### Getting media items
+
+```php
+$media = $model->getMedia('images');                    // all in collection
+$first = $model->getFirstMedia('images');               // first item
+$last  = $model->getLastMedia('images');                // last item
+$has   = $model->hasMedia('images');                    // boolean check
+```
+
+### Getting URLs
+
+```php
+$url     = $model->getFirstMediaUrl('images');           // original URL
+$thumbUrl = $model->getFirstMediaUrl('images', 'thumb'); // conversion URL
+$lastUrl  = $model->getLastMediaUrl('images', 'thumb');
+```
+
+### Getting paths
+
+```php
+$path     = $model->getFirstMediaPath('images');
+$thumbPath = $model->getFirstMediaPath('images', 'thumb');
+```
+
+### Temporary URLs (S3)
+
+```php
+$tempUrl = $model->getFirstTemporaryUrl(
+    now()->addMinutes(30),
+    'images',
+    'thumb'
+);
+```
+
+### Fallback URLs
+
+```php
+$url = $model->getFallbackMediaUrl('avatar');
+```
+
+### From the Media model
+
+```php
+$media = $model->getFirstMedia('images');
+
+$media->getUrl();                    // original URL
+$media->getUrl('thumb');             // conversion URL
+$media->getPath();                   // disk path
+$media->getFullUrl();                // full URL with domain
+$media->getTemporaryUrl(now()->addMinutes(30));
+$media->hasGeneratedConversion('thumb');  // check if conversion exists
+```
+
+### Filtering media
+
+```php
+$media = $model->getMedia('images', function (Media $media) {
+    return $media->getCustomProperty('featured') === true;
+});
+
+$media = $model->getMedia('images', ['mime_type' => 'image/jpeg']);
+```
+
+## Custom Properties
+
+Store arbitrary metadata on media items:
+
+```php
+// When adding
+$model->addMedia($file)
+    ->withCustomProperties([
+        'alt' => 'Descriptive text',
+        'credits' => 'Photographer Name',
+    ])
+    ->toMediaCollection('images');
+
+// Get/set on existing media
+$media->setCustomProperty('alt', 'Updated text');
+$media->save();
+
+$alt = $media->getCustomProperty('alt');
+$has = $media->hasCustomProperty('alt');
+$media->forgetCustomProperty('alt');
+$media->save();
+```
+
+## Responsive Images
+
+Generate multiple sizes for optimal loading:
+
+```php
+// On the FileAdder
+$model->addMedia($file)
+    ->withResponsiveImages()
+    ->toMediaCollection('images');
+
+// On a conversion
+$this->addMediaConversion('hero')
+    ->fit(Fit::Max, 1200, 800)
+    ->withResponsiveImages();
+
+// On a collection
+$this->addMediaCollection('photos')
+    ->withResponsiveImages();
+```
+
+### Using in Blade
+
+```blade
+{{-- Renders img tag with srcset --}}
+{{ $media->toHtml() }}
+
+{{-- With attributes --}}
+{{ $media->img()->attributes(['class' => 'w-full', 'alt' => 'Photo']) }}
+
+{{-- Get srcset string --}}
+<img src="{{ $media->getUrl() }}" srcset="{{ $media->getSrcset() }}" />
+
+{{-- Responsive conversion --}}
+<img src="{{ $media->getUrl('hero') }}" srcset="{{ $media->getSrcset('hero') }}" />
+```
+
+### Placeholder SVG
+
+```php
+$svg = $media->responsiveImages()->getPlaceholderSvg(); // tiny blurred base64 placeholder
+```
+
+## Managing Media
+
+### Clear a collection
+
+```php
+$model->clearMediaCollection('images');
+```
+
+### Clear except specific items
+
+```php
+$model->clearMediaCollectionExcept('images', $mediaToKeep);
+```
+
+### Delete specific media
+
+```php
+$model->deleteMedia($mediaId);
+```
+
+### Delete all media
+
+```php
+$model->deleteAllMedia();
+```
+
+### Delete model but keep media files
+
+```php
+$model->deletePreservingMedia();
+```
+
+### Reorder media
+
+```php
+Media::setNewOrder([3, 1, 2]); // media IDs in desired order
+```
+
+### Move/copy media between models
+
+```php
+$media->move($otherModel, 'images');
+$media->copy($otherModel, 'images');
+```
+
+## Events
+
+```php
+use Spatie\MediaLibrary\MediaCollections\Events\MediaHasBeenAddedEvent;
+use Spatie\MediaLibrary\Conversions\Events\ConversionWillStartEvent;
+use Spatie\MediaLibrary\Conversions\Events\ConversionHasBeenCompletedEvent;
+use Spatie\MediaLibrary\MediaCollections\Events\CollectionHasBeenClearedEvent;
+```
+
+Listen to these events to hook into the media lifecycle:
+```php
+Event::listen(MediaHasBeenAddedEvent::class, function ($event) {
+    $event->media; // the added Media model
+});
+
+Event::listen(ConversionHasBeenCompletedEvent::class, function ($event) {
+    $event->media;
+    $event->conversion;
+});
+```
+
+## Configuration
+
+Key `config/media-library.php` options:
+
+```php
+return [
+    'disk_name' => 'public',                    // default disk
+    'max_file_size' => 1024 * 1024 * 10,         // 10MB
+    'queue_connection_name' => '',                // queue connection
+    'queue_name' => '',                          // queue name
+    'queue_conversions_by_default' => true,       // queue conversions
+    'media_model' => Spatie\MediaLibrary\MediaCollections\Models\Media::class,
+    'file_namer' => Spatie\MediaLibrary\Support\FileNamer\DefaultFileNamer::class,
+    'path_generator' => Spatie\MediaLibrary\Support\PathGenerator\DefaultPathGenerator::class,
+    'url_generator' => Spatie\MediaLibrary\Support\UrlGenerator\DefaultUrlGenerator::class,
+    'image_driver' => 'gd',                      // 'gd', 'imagick', or 'vips'
+    'image_optimizers' => [/* optimizer config */],
+    'version_urls' => true,                       // cache busting
+    'default_loading_attribute_value' => null,     // 'lazy' for lazy loading
+];
+```
+
+### Custom Path Generator
+
+```php
+use Spatie\MediaLibrary\Support\PathGenerator\PathGenerator;
+
+class CustomPathGenerator implements PathGenerator
+{
+    public function getPath(Media $media): string
+    {
+        return md5($media->id) . '/';
+    }
+
+    public function getPathForConversions(Media $media): string
+    {
+        return $this->getPath($media) . 'conversions/';
+    }
+
+    public function getPathForResponsiveImages(Media $media): string
+    {
+        return $this->getPath($media) . 'responsive/';
+    }
+}
+```
+
+### Custom File Namer
+
+```php
+use Spatie\MediaLibrary\Support\FileNamer\FileNamer;
+
+class CustomFileNamer extends FileNamer
+{
+    public function originalFileName(string $fileName): string
+    {
+        return Str::slug(pathinfo($fileName, PATHINFO_FILENAME));
+    }
+
+    public function conversionFileName(string $fileName, Conversion $conversion): string
+    {
+        return $this->originalFileName($fileName) . '-' . $conversion->getName();
+    }
+
+    public function responsiveFileName(string $fileName): string
+    {
+        return pathinfo($fileName, PATHINFO_FILENAME);
+    }
+}
+```
+
+### Custom Media Model
+
+```php
+use Spatie\MediaLibrary\MediaCollections\Models\Media as BaseMedia;
+
+class Media extends BaseMedia
+{
+    // Add custom methods, scopes, or override behavior
+}
+```
+
+Register in config: `'media_model' => App\Models\Media::class`
+
+## Downloading Media
+
+### Single file
+
+```php
+return $media->toResponse($request); // download
+return $media->toInlineResponse($request); // display inline
+return $media->stream(); // stream
+```
+
+### ZIP download of collection
+
+```php
+use Spatie\MediaLibrary\Support\MediaStream;
+
+return MediaStream::create('photos.zip')
+    ->addMedia($model->getMedia('images'));
+```
+
+## Using with API Resources
+
+```php
+class PostResource extends JsonResource
+{
+    public function toArray($request): array
+    {
+        return [
+            'id' => $this->id,
+            'title' => $this->title,
+            'image' => $this->getFirstMediaUrl('images'),
+            'thumb' => $this->getFirstMediaUrl('images', 'thumb'),
+            'media' => $this->getMedia('images')->map(function ($media) {
+                return [
+                    'id' => $media->id,
+                    'url' => $media->getUrl(),
+                    'thumb' => $media->getUrl('thumb'),
+                    'name' => $media->name,
+                    'size' => $media->size,
+                    'type' => $media->mime_type,
+                ];
+            }),
+        ];
+    }
+}
+```

.cursor/skills/pest-testing/SKILL.md

@@ -0,0 +1,157 @@
+---
+name: pest-testing
+description: "Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Pest Testing 4
+
+## Documentation
+
+Use `search-docs` for detailed Pest 4 patterns and documentation.
+
+## Basic Usage
+
+### Creating Tests
+
+All tests must be written using Pest. Use `php artisan make:test --pest {name}`.
+
+### Test Organization
+
+- Unit/Feature tests: `tests/Feature` and `tests/Unit` directories.
+- Browser tests: `tests/Browser/` directory.
+- Do NOT remove tests without approval - these are core application code.
+
+### Basic Test Structure
+
+<!-- Basic Pest Test Example -->
+```php
+it('is true', function () {
+    expect(true)->toBeTrue();
+});
+```
+
+### Running Tests
+
+- Run minimal tests with filter before finalizing: `php artisan test --compact --filter=testName`.
+- Run all tests: `php artisan test --compact`.
+- Run file: `php artisan test --compact tests/Feature/ExampleTest.php`.
+
+## Assertions
+
+Use specific assertions (`assertSuccessful()`, `assertNotFound()`) instead of `assertStatus()`:
+
+<!-- Pest Response Assertion -->
+```php
+it('returns all', function () {
+    $this->postJson('/api/docs', [])->assertSuccessful();
+});
+```
+
+| Use | Instead of |
+|-----|------------|
+| `assertSuccessful()` | `assertStatus(200)` |
+| `assertNotFound()` | `assertStatus(404)` |
+| `assertForbidden()` | `assertStatus(403)` |
+
+## Mocking
+
+Import mock function before use: `use function Pest\Laravel\mock;`
+
+## Datasets
+
+Use datasets for repetitive tests (validation rules, etc.):
+
+<!-- Pest Dataset Example -->
+```php
+it('has emails', function (string $email) {
+    expect($email)->not->toBeEmpty();
+})->with([
+    'james' => 'james@laravel.com',
+    'taylor' => 'taylor@laravel.com',
+]);
+```
+
+## Pest 4 Features
+
+| Feature | Purpose |
+|---------|---------|
+| Browser Testing | Full integration tests in real browsers |
+| Smoke Testing | Validate multiple pages quickly |
+| Visual Regression | Compare screenshots for visual changes |
+| Test Sharding | Parallel CI runs |
+| Architecture Testing | Enforce code conventions |
+
+### Browser Test Example
+
+Browser tests run in real browsers for full integration testing:
+
+- Browser tests live in `tests/Browser/`.
+- Use Laravel features like `Event::fake()`, `assertAuthenticated()`, and model factories.
+- Use `RefreshDatabase` for clean state per test.
+- Interact with page: click, type, scroll, select, submit, drag-and-drop, touch gestures.
+- Test on multiple browsers (Chrome, Firefox, Safari) if requested.
+- Test on different devices/viewports (iPhone 14 Pro, tablets) if requested.
+- Switch color schemes (light/dark mode) when appropriate.
+- Take screenshots or pause tests for debugging.
+
+<!-- Pest Browser Test Example -->
+```php
+it('may reset the password', function () {
+    Notification::fake();
+
+    $this->actingAs(User::factory()->create());
+
+    $page = visit('/sign-in');
+
+    $page->assertSee('Sign In')
+        ->assertNoJavaScriptErrors()
+        ->click('Forgot Password?')
+        ->fill('email', 'nuno@laravel.com')
+        ->click('Send Reset Link')
+        ->assertSee('We have emailed your password reset link!');
+
+    Notification::assertSent(ResetPassword::class);
+});
+```
+
+### Smoke Testing
+
+Quickly validate multiple pages have no JavaScript errors:
+
+<!-- Pest Smoke Testing Example -->
+```php
+$pages = visit(['/', '/about', '/contact']);
+
+$pages->assertNoJavaScriptErrors()->assertNoConsoleLogs();
+```
+
+### Visual Regression Testing
+
+Capture and compare screenshots to detect visual changes.
+
+### Test Sharding
+
+Split tests across parallel processes for faster CI runs.
+
+### Architecture Testing
+
+Pest 4 includes architecture testing (from Pest 3):
+
+<!-- Architecture Test Example -->
+```php
+arch('controllers')
+    ->expect('App\Http\Controllers')
+    ->toExtendNothing()
+    ->toHaveSuffix('Controller');
+```
+
+## Common Pitfalls
+
+- Not importing `use function Pest\Laravel\mock;` before using mock
+- Using `assertStatus(200)` instead of `assertSuccessful()`
+- Forgetting datasets for repetitive validation tests
+- Deleting tests without approval
+- Forgetting `assertNoJavaScriptErrors()` in browser tests

.cursor/skills/tailwindcss-development/SKILL.md

@@ -0,0 +1,119 @@
+---
+name: tailwindcss-development
+description: "Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS."
+license: MIT
+metadata:
+  author: laravel
+---
+
+# Tailwind CSS Development
+
+## Documentation
+
+Use `search-docs` for detailed Tailwind CSS v4 patterns and documentation.
+
+## Basic Usage
+
+- Use Tailwind CSS classes to style HTML. Check and follow existing Tailwind conventions in the project before introducing new patterns.
+- Offer to extract repeated patterns into components that match the project's conventions (e.g., Blade, JSX, Vue).
+- Consider class placement, order, priority, and defaults. Remove redundant classes, add classes to parent or child elements carefully to reduce repetition, and group elements logically.
+
+## Tailwind CSS v4 Specifics
+
+- Always use Tailwind CSS v4 and avoid deprecated utilities.
+- `corePlugins` is not supported in Tailwind v4.
+
+### CSS-First Configuration
+
+In Tailwind v4, configuration is CSS-first using the `@theme` directive — no separate `tailwind.config.js` file is needed:
+
+<!-- CSS-First Config -->
+```css
+@theme {
+  --color-brand: oklch(0.72 0.11 178);
+}
+```
+
+### Import Syntax
+
+In Tailwind v4, import Tailwind with a regular CSS `@import` statement instead of the `@tailwind` directives used in v3:
+
+<!-- v4 Import Syntax -->
+```diff
+- @tailwind base;
+- @tailwind components;
+- @tailwind utilities;
++ @import "tailwindcss";
+```
+
+### Replaced Utilities
+
+Tailwind v4 removed deprecated utilities. Use the replacements shown below. Opacity values remain numeric.
+
+| Deprecated | Replacement |
+|------------|-------------|
+| bg-opacity-* | bg-black/* |
+| text-opacity-* | text-black/* |
+| border-opacity-* | border-black/* |
+| divide-opacity-* | divide-black/* |
+| ring-opacity-* | ring-black/* |
+| placeholder-opacity-* | placeholder-black/* |
+| flex-shrink-* | shrink-* |
+| flex-grow-* | grow-* |
+| overflow-ellipsis | text-ellipsis |
+| decoration-slice | box-decoration-slice |
+| decoration-clone | box-decoration-clone |
+
+## Spacing
+
+Use `gap` utilities instead of margins for spacing between siblings:
+
+<!-- Gap Utilities -->
+```html
+<div class="flex gap-8">
+    <div>Item 1</div>
+    <div>Item 2</div>
+</div>
+```
+
+## Dark Mode
+
+If existing pages and components support dark mode, new pages and components must support it the same way, typically using the `dark:` variant:
+
+<!-- Dark Mode -->
+```html
+<div class="bg-white dark:bg-gray-900 text-gray-900 dark:text-white">
+    Content adapts to color scheme
+</div>
+```
+
+## Common Patterns
+
+### Flexbox Layout
+
+<!-- Flexbox Layout -->
+```html
+<div class="flex items-center justify-between gap-4">
+    <div>Left content</div>
+    <div>Right content</div>
+</div>
+```
+
+### Grid Layout
+
+<!-- Grid Layout -->
+```html
+<div class="grid grid-cols-1 md:grid-cols-2 lg:grid-cols-3 gap-6">
+    <div>Card 1</div>
+    <div>Card 2</div>
+    <div>Card 3</div>
+</div>
+```
+
+## Common Pitfalls
+
+- Using deprecated v3 utilities (bg-opacity-*, flex-shrink-*, etc.)
+- Using `@tailwind` directives instead of `@import "tailwindcss"`
+- Trying to use `tailwind.config.js` instead of CSS `@theme` directive
+- Using margins for spacing between siblings instead of gap utilities
+- Forgetting to add dark mode variants when the project uses dark mode

.dev/adminer/Dockerfile

@@ -1,14 +0,0 @@
-FROM adminer:latest
-
-USER root
-
-RUN set -x && \
-    apt update &&  \
-    apt install curl -y && \
-    cd /var/www/html/plugins-enabled && \
-    curl -O https://gist.githubusercontent.com/gdarko/00af6e9a754f09c3f81cd3c606c33311/raw/d5f6a30f00edecf30a5d380340d9dae79a3b7352/login-password-less.php
-
-USER adminer
-CMD	[ "php", "-S", "[::]:8080", "-t", "/var/www/html" ]
-
-EXPOSE 8080

.dev/nginx/conf.d/dev.conf

@@ -1,22 +0,0 @@
-server {
-    listen 80;
-
-    root /home/invoiceshelf/app/public;
-    index index.php;
-
-    error_log  /var/log/nginx/dev-error.log;
-    access_log /var/log/nginx/dev-access.log;
-
-    server_name invoiceshelf.test;
-
-    location / {
-        try_files $uri $uri/ /index.php?$query_string;
-    }
-
-    location ~ \.php$ {
-        fastcgi_pass php-fpm:9000;
-        fastcgi_index index.php;
-        fastcgi_param SCRIPT_FILENAME $realpath_root$fastcgi_script_name;
-        include fastcgi_params;
-    }
-}

.dev/php/Dockerfile

@@ -1,64 +0,0 @@
-FROM php:8.3-fpm-bookworm
-
-ARG UID
-ARG GID
-
-ENV UID=${UID}
-ENV GID=${GID}
-
-USER root
-
-# Create user/group
-RUN addgroup --gid ${GID} --system invoiceshelf && \
-    adduser --gid ${GID} --system --disabled-password --shell /bin/sh -u ${UID} --home /home/invoiceshelf invoiceshelf && \
-    sed -i "s/user = www-data/user = invoiceshelf/g" /usr/local/etc/php-fpm.d/www.conf && \
-    sed -i "s/group = www-data/group = invoiceshelf/g" /usr/local/etc/php-fpm.d/www.conf
-
-# Install composer & npm
-RUN curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin --filename=composer && \
-    curl -sL https://deb.nodesource.com/setup_20.x | bash - && \
-    apt install -y nodejs
-
-# install dependencies
-RUN apt update && apt install -y \
-    libpng-dev \
-    zlib1g-dev \
-    libxml2-dev \
-    libzip-dev \
-    libonig-dev \
-    libpq-dev \
-    sqlite3 \
-    postgresql-client \
-    mariadb-client \
-    zip \
-    curl \
-    unzip \
-    webp \
-    && docker-php-ext-configure gd \
-    && docker-php-ext-install -j$(nproc) gd \
-    && docker-php-ext-install bcmath \
-    && docker-php-ext-install mbstring \
-    && docker-php-ext-install mysqli \
-    && docker-php-ext-install pdo_mysql \
-    && docker-php-ext-configure pgsql -with-pgsql=/usr/local/pgsql \
-    && docker-php-ext-install pgsql \
-    && docker-php-ext-install pdo_pgsql \
-    && docker-php-ext-install zip \
-    && docker-php-ext-install xml \
-    && docker-php-ext-install exif \
-    && docker-php-source delete
-
-# Clear cache
-RUN apt-get clean && rm -rf /var/lib/apt/lists/*
-
-# Set workdir
-WORKDIR /home/invoiceshelf/app
-
-# Copy Files
-COPY entrypoint.sh /entrypoint.sh
-
-# Entrypoint
-ENTRYPOINT ["/entrypoint.sh"]
-
-# Launch php-fpm
-CMD ["php-fpm"]

.dev/php/entrypoint.sh

@@ -1,44 +0,0 @@
-#!/bin/bash
-
-echo "############################################"
-echo "### InvoiceShelf Development Environment ###"
-echo "############################################"
-
-cd /home/invoiceshelf/app
-
-
-# Composer build
-if [ ! -d vendor ]; then
-    composer install
-fi
-
-# Empty sqlite database
-if [ ! -f database/database.sqlite ]; then
-    cp database/stubs/sqlite.empty.db database/database.sqlite
-fi
-
-# .env file set up
-if [ ! -f .env ]; then
-    cp .env.example .env
-    php artisan key:generate --force
-fi
-
-# NPM build
-if [ ! -d node_modules ]; then
-    npm install
-    npm run build
-fi
-
-# Storage symlink
-php artisan storage:link
-
-# Permissions
-chmod 775 storage/framework
-chmod 775 storage/logs
-chmod 775 bootstrap/cache
-chown -R ${UID}:${GID} /home/invoiceshelf/app
-chmod +x artisan
-
-echo "Entrypoint complete."
-
-exec $@

.dockerignore

@@ -0,0 +1,45 @@
+.idea/
+.git/
+
+.github/
+docker/
+!docker/production/entrypoint.d
+!docker/production/inject.sh
+
+node_modules/
+
+database/*.sqlite
+storage/app/*
+!storage/app/templates*
+storage/fonts/*
+storage/framework/cache/data/*
+storage/framework/sessions/*
+storage/framework/views/*
+storage/logs/*
+
+tests/
+vendor/
+
+.dockerignore
+.devenvconfig
+.editorconfig
+.env
+.env.testing
+.eslintrc.mjs
+.gitattributes
+.gitignore
+.prettierrc.json
+devenv
+
+CODE_OF_CONDUCT.md
+Dockerfile
+*.Dockerfile
+LICENSE
+Makefile
+SECURITY.md
+_ide_helper.php
+crowdin.yml
+invoiceshelf.code-workspace
+package-lock.json
+phpunit.xml
+readme.md

.env.example

@@ -1,19 +1,11 @@
 APP_ENV=production
+APP_DEBUG=false
 APP_KEY=base64:kgk/4DW1vEVy7aEvet5FPp5un6PIGe/so8H0mvoUtW0=
-APP_DEBUG=true
+
 APP_NAME="InvoiceShelf"
-APP_LOG_LEVEL=debug
 APP_TIMEZONE=UTC
-APP_URL=http://invoiceshelf.test
-
+APP_URL=
 APP_LOCALE=en
-APP_FALLBACK_LOCALE=en
-APP_FAKER_LOCALE=en_US
-
-APP_MAINTENANCE_DRIVER=file
-APP_MAINTENANCE_STORE=database
-
-BCRYPT_ROUNDS=12
 
 DB_CONNECTION=sqlite
 DB_HOST=
@@ -22,35 +14,10 @@ DB_DATABASE=
 DB_USERNAME=
 DB_PASSWORD=
 
-BROADCAST_CONNECTION=log
-CACHE_STORE=file
-QUEUE_CONNECTION=sync
-SESSION_DRIVER=file
-SESSION_LIFETIME=1440
-SESSION_ENCRYPT=false
-SESSION_PATH=/
 SESSION_DOMAIN=null
-
-REDIS_HOST=127.0.0.1
-REDIS_PASSWORD=null
-REDIS_PORT=6379
-
-MAIL_DRIVER=smtp
-MAIL_HOST=
-MAIL_PORT=
-MAIL_USERNAME=
-MAIL_PASSWORD=
-MAIL_ENCRYPTION=
-
-MAIL_FROM_NAME=
-MAIL_FROM_ADDRESS=
-
-PUSHER_APP_ID=
-PUSHER_KEY=
-PUSHER_SECRET=
-
-SANCTUM_STATEFUL_DOMAINS=invoiceshelf.test
+SANCTUM_STATEFUL_DOMAIN=
 TRUSTED_PROXIES="*"
 
-CRON_JOB_AUTH_TOKEN=""
-LOG_STACK=single
+# Dompdf: keep false so untrusted HTML in PDF notes cannot trigger outbound requests (SSRF).
+# Set true only if you fully trust all PDF HTML and need remote images/CSS.
+DOMPDF_ENABLE_REMOTE=false

.env.testing

@@ -3,7 +3,7 @@ APP_DEBUG=true
 APP_KEY=base64:IdDlpLmYyWA9z4Ruj5st1FSYrhCR7lPOscLGCz2Jf4I=
 DB_CONNECTION=sqlite
 
-MAIL_DRIVER=smtp
+MAIL_MAILER=smtp
 MAIL_HOST=smtp.mailtrap.io
 MAIL_PORT=587
 MAIL_USERNAME=ff538f0e1037f4

.eslintrc.mjs

@@ -1,14 +0,0 @@
-// .eslintrc.js
-
-module.exports = {
-  extends: [
-    // add more generic rulesets here, such as:
-    // 'eslint:recommended',
-    "plugin:vue/vue3-recommended",
-    "prettier",
-  ],
-  rules: {
-    // override/add rules settings here, such as:
-    // 'vue/no-unused-vars': 'error'
-  },
-};

.github/CONTRIBUTING.md

@@ -2,7 +2,7 @@
 
 Thank you for investing your time in contributing to our project! :sparkles:.
 
-Read our [Code of Conduct](./CODE_OF_CONDUCT.md) to keep our community approachable and respectable.
+Read our [Code of Conduct](../CODE_OF_CONDUCT.md) to keep our community approachable and respectable.
 
 In this guide you will get an overview of the contribution workflow from opening an issue, creating a PR, reviewing, and merging the PR.
 
@@ -39,7 +39,7 @@ Scan through our [existing issues](https://github.com/InvoiceShelf/InvoiceShelf/
 - Using the command line:
   - [Fork the repo](https://docs.github.com/en/get-started/quickstart/fork-a-repo) so that you can make your changes without affecting the original project until you're ready to merge them.
 
-2. Install or update to **Node.js**, at the version specified in `.node-version`. For more information, see [the development guide](../contributing/development.md).
+2. Install or update to **Node.js**, at the version specified in `.node-version`. For more information, see [the development guide](../docker/development/README.md).
 
 3. Create a working branch and start with your changes!
 

.github/ISSUE_TEMPLATE/bug_report.md

@@ -1,26 +0,0 @@
----
-name: Bug report
-about: Create a report to help us improve
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Describe the bug**
-A clear and concise description of what the bug is.
-
-**Expected behavior**
-A clear and concise description of what you expected to happen.
-
-**Screenshots**
-If applicable, add screenshots to help explain your problem.
-
-**Please complete the following information:**
-- InvoiceShelf version: 
-- PHP version: 
-- Database type and version: 
-
-**Optional info**
-- OS:  [e.g. Ubuntu]
-- Browser: [e.g. chrome, safari]

.github/ISSUE_TEMPLATE/bug_report.yml

@@ -0,0 +1,237 @@
+name: Bug report
+description: Template for bug reports
+labels: ['bug', 'triage']
+type: Bug
+projects: ['InvoiceShelf/2']
+assignees:
+  - rihards-simanovics
+
+body:
+  # Ask user to confirm they've tried to fix or research the issue before
+  # posting a bug report.
+  - type: checkboxes
+    id: confirm-read-documentation
+    attributes:
+      label: Issue filing prerequisites
+      description: 'Prior to filing an issue please confirm that:'
+      options:
+        - label: I've checked the [documentation](https://docs.invoiceshelf.com/).
+          required: true
+        - label: I've looked for similar issues both Open and Closed.
+          required: true
+        - label: >-
+            I've tried clearing both cache and cookies in my browser or tried
+            opening the app in the Incognito/InPrivate window.
+          required: true
+
+  # Thank users for taking time to submit a bug report
+  - type: markdown
+    attributes:
+      value: >-
+        If you did all of the above, we would first like to thank you for taking
+        the time to fill out this bug report. It will help us tremendously to
+        find and fix the issue sooner!
+
+  # Description of the bug
+  - type: textarea
+    id: bug-description
+    attributes:
+      label: Describe the bug
+      description: A clear and concise description of what the bug is.
+      placeholder: >-
+        When doing `x`, `y`, and `z` in that order, an error occurs, but when `x`,
+        `z` and then `y` is done, the error does not occur.
+    validations:
+      required: true
+
+  # Reproduction steps
+  - type: textarea
+    id: reproduce
+    attributes:
+      label: Steps to Reproduce the issue
+      description: A clear step-by-step explanation of how to reproduce your issue
+      placeholder: >-
+        ## Produces an error:
+
+        1. Do X;
+
+        2. Do Y;
+
+        3. Do Z;
+
+
+        ## Works fine:
+
+        4. Do X;
+
+        5. Do Z;
+
+        6. Do Y.
+    validations:
+      required: true
+
+  # Expected Behaviour
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behaviour
+      description: A clear and concise description of what you expected to happen.
+      placeholder: Doing `x`, `y`, and `z` in that order should not generate an error.
+    validations:
+      required: true
+
+  # Actual Behaviour
+  - type: textarea
+    id: actual-behaviour
+    attributes:
+      label: Actual behaviour
+      description: A clear and concise description of what actually happens.
+      placeholder: Doing `x`, `y`, and `z` in that order generates an error.
+    validations:
+      required: true
+
+  # Section break
+  - type: markdown
+    attributes:
+      value: |-
+        ## Environment
+
+        Now let's collect some information about your environment.
+
+  # Use Docker?
+  - type: checkboxes
+    id: confirm-docker-install
+    attributes:
+      label: Docker
+      description: 'Please note that unless the issue is with the app itself, you should file a bug report under the [docker](https://github.com/InvoiceShelf/docker) repository.'
+      options:
+        - label: App running in Docker Container.
+        - label: Docker container running behind Reverse proxy.
+
+  # App Version
+  - type: input
+    id: invoiceshelf-version
+    attributes:
+      label: InvoiceShelf version
+      placeholder: v0.0.0
+    validations:
+      required: true
+
+  # PHP Version
+  - type: input
+    id: php-version
+    attributes:
+      label: PHP version
+      placeholder: v0.0.0
+    validations:
+      required: true
+
+  # DB Type
+  - type: input
+    id: database-type
+    attributes:
+      label: Database type
+      placeholder: MariaDB / MySQL / PostgreSQL / SQLite
+    validations:
+      required: true
+
+  # DB Version
+  - type: input
+    id: db-version
+    attributes:
+      label: Database version
+      placeholder: v0.0.0
+    validations:
+      required: true
+
+  # Web Browser
+  - type: input
+    id: web-browser
+    attributes:
+      label: Web Browser
+      placeholder: 'Firefox / Safari / or any other (Chromium-based browser)'
+
+  # OS Version
+  - type: input
+    id: server-os
+    attributes:
+      label: Server OS
+      description: If Linux, please make sure to provide both the distro name and its version
+      placeholder: Windows / Linux (e.g. Ubuntu 24.04)
+
+  # Associated Logs
+  - type: markdown
+    attributes:
+      value: >-
+        ## Logs
+
+
+        Last but not least, could you please take some time to get us the logs
+        for:
+
+  # Log Reverse proxy
+  - type: textarea
+    id: log-rev-proxy
+    attributes:
+      label: Reverse-proxy logs
+      description: >-
+        Please provide logs from your Apache, Nginx, Traefik, or any other
+        reverse proxy application.
+      placeholder: >-
+        2023-04-12 10:15:32 [NGINX] 172.16.0.5 - - [12/Apr/2023:10:15:32 +0000] "GET /index.html HTTP/1.1" 200 1024 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/58.0.3029.110 Safari/537.3"
+
+        2023-04-12 10:15:33 [NGINX] 172.16.0.7 - - [12/Apr/2023:10:15:33 +0000] "POST /login HTTP/1.1" 302 - "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_12_6) AppleWebKit/603.3.8 (KHTML, like Gecko) Version/10.1.2 Safari/603.3.8"
+
+        2023-04-12 10:15:34 [NGINX] 172.16.0.9 - - [12/Apr/2023:10:15:34 +0000] "GET /about HTTP/1.1" 200 2048 "-" "Mozilla/5.0 (X11; Linux x86_64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/80.0.3987.149 Safari/537.36"
+
+        2023-04-12 10:15:35 [NGINX] 172.16.0.11 - - [12/Apr/2023:10:15:35 +0000] "PUT /api/v1/users/123 HTTP/1.1" 200 - "https://example.com/profile" "Mozilla/5.0 (iPhone; CPU iPhone OS 14_4 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/14.0 Mobile/15E148 Safari/604.1"
+
+        2023-04-12 10:15:36 [NGINX] 172.16.0.13 - - [12/Apr/2023:10:15:36 +0000] "DELETE /api/v1/products/456 HTTP/1.1" 204 - "-" "Dalvik/2.1.0 (Linux; U; Android 10; Pixel 4 Build/QD1A.190821.014.C2)"
+
+        2023-04-12 10:15:37 [NGINX] 172.16.0.15 - - [12/Apr/2023:10:15:37 +0000] "GET /easter-egg HTTP/1.1" 200 42 "-" "Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/89.0.4389.82 Safari/537.3"
+      render: irc logs
+
+  # PHP/Laravel Logs
+  - type: textarea
+    id: log-laravel
+    attributes:
+      label: Laravel/PHP logs
+      description: Please provide logs from either PHP or Laravel or both.
+      placeholder: >-
+        [2015-02-04 10:00:00] production.INFO: Laravel 5.0 released. The world rejoices.
+
+        [2015-12-03 12:00:00] production.INFO: PHP 7.0 introduced scalar type declarations. Minds blown.
+
+        [2016-05-15 14:00:00] production.INFO: Composer installed new dependencies. Dependency hell avoided.
+
+        [2017-08-20 16:00:00] production.INFO: Artisan command executed: migrate. Smooth sailing.
+
+        [2018-01-10 09:00:00] production.INFO: User login successful.
+
+        [2018-01-10 09:05:00] production.ERROR: Database connection failed. Did you try turning it off and on again?
+
+        [2018-01-10 09:10:00] production.WARNING: Deprecated function used in UserController.php. Time to refactor, again.
+
+        [2018-01-10 09:15:00] production.ERROR: Uncaught Exception: Division by zero. Oops, maths is hard.
+
+        [2018-01-10 09:20:00] production.INFO: User logout successful. See you later, alligator.
+
+        [2019-03-25 11:00:00] production.INFO: Cache cleared. Fresh start!
+
+        [2019-06-30 13:00:00] production.ERROR: Syntax error. Missing semicolon strikes again.
+
+        [2020-09-10 15:00:00] production.INFO: User registered. Welcome aboard!
+
+        [2021-11-05 17:00:00] production.WARNING: Low disk space. Time to clean up.
+
+        [2022-12-20 19:00:00] production.INFO: Server rebooted. All systems go.
+
+        [2024-11-14 18:56:20] production.INFO: Unexpected item in the bagging area. Please wait for assistance.
+      render: irc logs
+
+  # Special thanks
+  - type: markdown
+    attributes:
+      value: >-
+        This template was generated with [Issue Forms
+        Creator](https://issue-forms-creator.netlify.app)

.github/ISSUE_TEMPLATE/code_quality_issue.yml

@@ -0,0 +1,94 @@
+# Big thanks to https://github.com/files-community/Files/ for a template of the code_quality_issue
+
+name: Code Quality Issue
+description: Create a code quality issue to help InvoiceShelf keep a clean codebase
+labels:
+  - code quality
+  - triage
+projects: ['InvoiceShelf/2']
+assignees:
+  - rihards-simanovics
+
+body:
+  # Tip to warn of checking for existing issues
+  - type: markdown
+    attributes:
+      value: >
+        > [!TIP]
+
+        > Have you checked for similar code quality issues? There's a
+        possibility your suggestion is already being tracked. Please do a
+        thorough search before creating a new issue.
+
+  # Ask user to confirm they've tried to fix or research the issue before
+  # posting a bug report.
+  - type: checkboxes
+    id: confirm-read-documentation
+    attributes:
+      label: Issue filing prerequisites
+      description: 'Prior to filing an issue please confirm that:'
+      options:
+        - label: I've checked the [documentation](https://docs.invoiceshelf.com/).
+          required: true
+        - label: I've looked for similar issues both Open and Closed.
+          required: true
+        - label: >-
+            I've tried clearing both cache and cookies in my browser or tried
+            opening the app in the Incognito/InPrivate window.
+          required: true
+
+  # Issue body
+  - type: textarea
+    id: description
+    attributes:
+      label: Description
+      description: A clear and concise description of what the code quality issue is.
+    validations:
+      required: true
+
+  # Related code
+  - type: textarea
+    id: code-in-question
+    attributes:
+      label: The code in question
+      description: >-
+        A list of the different InvoiceShelf and/or areas of the code concerned by the issue.
+    validations:
+      required: true
+
+  # Gains
+  - type: textarea
+    id: gains
+    attributes:
+      label: Gains
+      description: What would fixing this code quality issue bring to the source code?
+      placeholder: >-
+        - e.g. Better readability.
+
+        - e.g. Uncoupling concepts X and Y.
+
+        - e.g. Clarifying the responsibility of class C.
+    validations:
+      required: true
+
+  # Requirements
+  - type: textarea
+    id: requirements
+    attributes:
+      label: Requirements
+      description: Describe all the requirements to solve the code quality issue.
+      placeholder: >-
+        - e.g. Using a specific design pattern.
+
+        - e.g. Separating Interface I into three new interfaces I1, I2 and I3.
+
+        - e.g. Regrouping the duplicated process into a new helper.
+
+  # Remarks
+  - type: textarea
+    id: comments
+    attributes:
+      label: Comments
+      description: >-
+        Additional information, comments or screenshots about the code quality
+        issue.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,11 @@
+blank_issues_enabled: false
+contact_links:
+  - name: Documentation
+    url: https://docs.invoiceshelf.com/
+    about: App documentation.
+  - name: Translation issue
+    url: https://crowdin.com/project/invoiceshelf
+    about: Help improve translations on Crowdin.
+  - name: Support, Question & Discussion - Official Discord Server
+    url: https://discord.gg/hwg2FtwWHW
+    about: Post your questions and join the discussion. You can participate in chats on every channel.

.github/ISSUE_TEMPLATE/feature_request.md

@@ -1,17 +0,0 @@
----
-name: Feature request
-about: Suggest an idea for this project
-title: ''
-labels: ''
-assignees: ''
-
----
-
-**Is your feature request related to a problem? Please describe.**
-A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
-
-**Describe the solution you'd like**
-A clear and concise description of what you want to happen.
-
-**Describe alternatives you've considered**
-A clear and concise description of any alternative solutions or features you've considered.

.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,96 @@
+# Big thanks to https://github.com/files-community/Files/ for a template of the feature_request
+
+name: Feature Request
+labels:
+  - feature request
+  - triage
+type: Feature
+projects: ['InvoiceShelf/2']
+assignees:
+  - rihards-simanovics
+description: >-
+  This project thrives from differentiation from competing apps. Suggest an idea
+  for InvoiceShelf.
+body:
+  # Tip to warn of checking for existing issues
+  - type: markdown
+    attributes:
+      value: >
+        > [!TIP]
+
+        >Have you checked for similar feature requests? There's a possibility
+        your suggestion is already being tracked. Please do a thorough search
+        before creating a new issue.
+
+  # Ask user to confirm they've tried to fix or research the issue before
+  # posting a bug report.
+  - type: checkboxes
+    id: confirm-read-documentation
+    attributes:
+      label: Issue filing prerequisites
+      description: 'Prior to filing an issue please confirm that:'
+      options:
+        - label: I've checked the [documentation](https://docs.invoiceshelf.com/).
+          required: true
+        - label: I've looked for similar issues with feature requests both Open and Closed.
+          required: true
+        - label: >-
+            I've tried clearing both cache and cookies in my browser or tried
+            opening the app in the Incognito/InPrivate window.
+          required: true
+
+  # Description
+  - type: textarea
+    id: what-feature
+    attributes:
+      label: What feature or improvement do you think would benefit InvoiceShelf?
+      description: Please include your use case
+      placeholder: >-
+        I propose that feature J be implemented as I believe it will greatly benefit the application.
+    validations:
+      required: true
+
+  # Tooltip about Requirements
+  - type: markdown
+    attributes:
+      value: >
+        ---
+
+
+        Please include a list of changes required to make this improvement. A good
+        rule of thumb is to start your proposal with no more than 7 high-level
+        requirements.
+
+  # Requirements
+  - type: textarea
+    id: requirements
+    attributes:
+      label: Requirements
+      description: Describe all the requirements to make your idea happen.
+      placeholder: >-
+        - This proposal will accomplish X
+
+        - This proposal will accomplish Y
+
+        - This proposal will accomplish Z
+    validations:
+      required: true
+
+  # InvoiceShelf Version
+  - type: input
+    id: invoiceshelf_version
+    attributes:
+      label: App Version
+      description: Which version of InvoiceShelf are you currently using?
+      placeholder: v0.0.0
+    validations:
+      required: true
+
+  # Additional Comments
+  - type: textarea
+    id: comments
+    attributes:
+      label: Comments
+      description: >-
+        Additional information, comments or screenshots about the feature
+        request.

.github/PULL_REQUEST_TEMPLATE/pull_request_template.md

@@ -0,0 +1,17 @@
+## Pre-review request checklist
+
+- [ ] (\*) I have listed all changes in the `Changes` section.
+- [ ] (opt) I have listed all issues this PR addresses in the `Issues` section [with the issue/discussion IDs](https://docs.github.com/en/issues/tracking-your-work-with-issues/using-issues/linking-a-pull-request-to-an-issue).
+- [ ] (\*) I have tested my changes.
+- [ ] (\*) I have considered backwards compatibility.
+
+## Changes
+
+- Added feature X
+- Removed Code Y
+- Refactored code Z
+
+## Issues
+
+- fixes #
+- closes #

.github/workflows/check.yaml

@@ -3,21 +3,41 @@ name: Check
 # Run this workflow every time a new commit pushed to your repository
 on:
     push:
-        paths-ignore:
-            - '**/*.md'
-            - 'public/build/*.js'
-            - 'public/build/**/*.js'
+        tags-ignore:
+            - "*"
+        branches-ignore:
+            - 'translations'
     pull_request:
-        paths-ignore:
-            - '**/*.md'
-            - 'public/build/*.js'
-            - 'public/build/**/*.js'
-        branches-ignore:    
-            - 'l10n_master2'
+        branches-ignore:
+            - 'translations'
     # Allow manually triggering the workflow.
     workflow_dispatch:
 
 jobs:
+    changes:
+        name: 🔍 Detect changes
+        runs-on: ubuntu-latest
+        outputs:
+            php: ${{ steps.filter.outputs.php }}
+        steps:
+            - name: Checkout code
+              uses: actions/checkout@v4
+
+            - name: Check for file changes
+              uses: dorny/paths-filter@v3
+              id: filter
+              with:
+                  filters: |
+                      php:
+                          - 'app/**'
+                          - 'config/**'
+                          - 'database/**'
+                          - 'routes/**'
+                          - 'tests/**'
+                          - 'composer.json'
+                          - 'composer.lock'
+                          - 'phpunit.xml'
+
     kill_previous:
         name: 0️⃣ Kill previous runs
         runs-on: ubuntu-latest
@@ -34,11 +54,13 @@ jobs:
         runs-on: ubuntu-latest
         needs:
             - kill_previous
+            - changes
+        if: needs.changes.outputs.php == 'true'
         steps:
             - name: Set up PHP
               uses: shivammathur/setup-php@v2
               with:
-                  php-version: 8.2
+                  php-version: 8.4
 
             - name: Checkout code
               uses: actions/checkout@v4
@@ -53,18 +75,19 @@ jobs:
         name: 2️⃣ PHP ${{ matrix.php-version }} Tests
         needs:
             - php_syntax_errors
+            - changes
+        if: needs.changes.outputs.php == 'true'
         runs-on: ubuntu-latest
         strategy:
             matrix:
                 php-version:
-                    - 8.2
-                    - 8.3
+                    - 8.4
         env:
             extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
 
         steps:
             - name: Checkout code
-              uses: actions/checkout@v3
+              uses: actions/checkout@v4
 
             - name: Setup PHP Action
               uses: shivammathur/setup-php@v2
@@ -77,10 +100,10 @@ jobs:
             - name: Install Composer dependencies
               uses: ramsey/composer-install@v2
 
-            - name: Use Node.js 20
-              uses: actions/setup-node@v3
+            - name: Use Node.js 24
+              uses: actions/setup-node@v4
               with:
-                  node-version: 20
+                  node-version: 24
 
             - name: Install
               run: npm install
@@ -90,52 +113,3 @@ jobs:
 
             - name: Apply tests ${{ matrix.php-version }}
               run: php artisan test
-
-    createReleaseFile:
-        name: 3️⃣ Build / Upload - Release File
-        if: github.ref_type == 'tag'
-        needs:
-            - tests
-        runs-on: ubuntu-latest
-        env:
-            extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
-
-        steps:
-            - name: Checkout code
-              uses: actions/checkout@v3
-
-            - name: Setup PHP
-              uses: shivammathur/setup-php@v2
-              with:
-                  php-version: 8.2
-                  extensions: ${{ env.extensions }}
-                  coverage: none
-
-            - name: Install Composer dependencies
-              uses: ramsey/composer-install@v2
-              with:
-                  composer-options: --no-dev
-
-            - name: Use Node.js 20
-              uses: actions/setup-node@v3
-              with:
-                  node-version: 20
-
-            - name: Install
-              run: npm install
-
-            - name: Compile Front-end
-              run: npm run build
-
-            - name: Build Dist
-              run: |
-                  make clean dist
-
-            - name: Upload package
-              uses: svenstaro/upload-release-action@v2
-              with:
-                  repo_token: ${{ github.token }}
-                  file: InvoiceShelf.zip
-                  asset_name: InvoiceShelf.zip
-                  tag: ${{ github.ref }}
-                  overwrite: true

.github/workflows/docker.yaml

@@ -0,0 +1,259 @@
+name: Docker Build and Push
+
+on:
+  release:
+    types: [published]
+  schedule:
+    # Run nightly at 2 AM UTC
+    - cron: '0 2 * * *'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Docker tag'
+        required: true
+        default: 'latest'
+
+jobs:
+  php_syntax_errors:
+    name: 1️⃣ PHP Code Style errors
+    if: github.event_name == 'release'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Set up PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.4
+
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Install dependencies
+        uses: ramsey/composer-install@v2
+
+      - name: Check source code for syntax errors
+        run: ./vendor/bin/pint --test
+
+  tests:
+    name: 2️⃣ PHP Tests
+    if: github.event_name == 'release'
+    needs:
+      - php_syntax_errors
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        php-version:
+          - 8.4
+    env:
+      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup PHP Action
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: ${{ matrix.php-version }}
+          extensions: ${{ env.extensions }}
+          coverage: xdebug
+          tools: pecl, composer
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@v2
+
+      - name: Use Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Install
+        run: npm install
+
+      - name: Compile Front-end
+        run: npm run build
+
+      - name: Apply tests ${{ matrix.php-version }}
+        run: php artisan test
+
+  release_artifact_build:
+    name: 🏗️ Build / Upload - Release File
+    if: github.event_name == 'release'
+    needs:
+      - tests
+    runs-on: ubuntu-latest
+    env:
+      extensions: bcmath, curl, dom, gd, imagick, json, libxml, mbstring, pcntl, pdo, pdo_mysql, zip
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Setup PHP
+        uses: shivammathur/setup-php@v2
+        with:
+          php-version: 8.4
+          extensions: ${{ env.extensions }}
+          coverage: none
+
+      - name: Install Composer dependencies
+        uses: ramsey/composer-install@v2
+        with:
+          composer-options: --no-dev
+
+      - name: Use Node.js 24
+        uses: actions/setup-node@v4
+        with:
+          node-version: 24
+
+      - name: Install
+        run: npm install
+
+      - name: Compile Front-end
+        run: npm run build
+
+      - name: Build Dist
+        run: |
+          make clean dist
+
+      - name: Upload package
+        uses: svenstaro/upload-release-action@v2
+        with:
+          repo_token: ${{ github.token }}
+          file: InvoiceShelf.zip
+          asset_name: InvoiceShelf.zip
+          tag: ${{ github.ref }}
+          overwrite: true
+
+  release_docker_build:
+    name: 🐳 Release Docker Build
+    if: github.event_name == 'release'
+    needs:
+      - tests
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Extract metadata
+        id: meta
+        uses: docker/metadata-action@v5
+        with:
+          images: invoiceshelf/invoiceshelf
+          tags: |
+            type=semver,pattern={{version}}
+            type=semver,pattern={{major}}.{{minor}}
+            type=semver,pattern={{major}}
+            type=raw,value=latest,enable={{is_default_branch}}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  manual_docker_build:
+    name: 🛠️ Manual Docker Build
+    if: github.event_name == 'workflow_dispatch'
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+
+      - name: Set up Docker Buildx
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Build and push Docker image
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: invoiceshelf/invoiceshelf:${{ github.event.inputs.tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+  nightly_build:
+    name: 🌙 Nightly Docker Build
+    if: github.event_name == 'schedule'
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        branch: [master, develop]
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 2
+
+      - name: Check for recent changes
+        id: changes
+        run: |
+          # Check if there are commits in the last 24 hours
+          RECENT_COMMITS=$(git log --since="24 hours ago" --oneline | wc -l)
+          echo "recent_commits=$RECENT_COMMITS" >> $GITHUB_OUTPUT
+          if [ "$RECENT_COMMITS" -gt 0 ]; then
+            echo "has_changes=true" >> $GITHUB_OUTPUT
+          else
+            echo "has_changes=false" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Set up Docker Buildx
+        if: steps.changes.outputs.has_changes == 'true'
+        uses: docker/setup-buildx-action@v3
+
+      - name: Log in to Docker Hub
+        if: steps.changes.outputs.has_changes == 'true'
+        uses: docker/login-action@v3
+        with:
+          username: ${{ secrets.DOCKER_HUB_USERNAME }}
+          password: ${{ secrets.DOCKER_HUB_TOKEN }}
+
+      - name: Set Docker tag
+        if: steps.changes.outputs.has_changes == 'true'
+        id: tag
+        run: |
+          if [ "${{ matrix.branch }}" = "master" ]; then
+            echo "tag=nightly" >> $GITHUB_OUTPUT
+          elif [ "${{ matrix.branch }}" = "develop" ]; then
+            echo "tag=alpha" >> $GITHUB_OUTPUT
+          fi
+
+      - name: Build and push Docker image
+        if: steps.changes.outputs.has_changes == 'true'
+        uses: docker/build-push-action@v5
+        with:
+          context: .
+          file: docker/production/Dockerfile
+          platforms: linux/amd64,linux/arm64
+          push: true
+          tags: invoiceshelf/invoiceshelf:${{ steps.tag.outputs.tag }}
+          cache-from: type=gha
+          cache-to: type=gha,mode=max
+
+      - name: No changes detected
+        if: steps.changes.outputs.has_changes == 'false'
+        run: |
+          echo "No commits found in the last 24 hours for ${{ matrix.branch }} branch. Skipping build."

.gitignore

@@ -14,13 +14,16 @@ Homestead.yaml
 .rnd
 /.expo
 /.vscode
+/.devcontainer
 .gitkeep
 /public/docs
 /.scribe
 !storage/fonts/.gitkeep
 .DS_Store
 .php-cs-fixer.cache
+.devenvconfig
 /storage/fonts*
 package-lock.json
-/.dev/docker-compose.yml
-/.dev/docker-compose.yaml
+/docker/development/docker-compose.yml
+/docker/production/docker-compose.yml
+/docker-compose.yaml

.node-version

@@ -0,0 +1 @@
+24

AGENTS.md

@@ -0,0 +1,234 @@
+<laravel-boost-guidelines>
+=== foundation rules ===
+
+# Laravel Boost Guidelines
+
+The Laravel Boost guidelines are specifically curated by Laravel maintainers for this application. These guidelines should be followed closely to ensure the best experience when building Laravel applications.
+
+## Foundational Context
+
+This application is a Laravel application and its main Laravel ecosystems package & versions are below. You are an expert with them all. Ensure you abide by these specific packages & versions.
+
+- php - 8.4
+- laravel/framework (LARAVEL) - v13
+- laravel/prompts (PROMPTS) - v0
+- laravel/sanctum (SANCTUM) - v4
+- phpunit/phpunit (PHPUNIT) - v12
+- laravel/boost (BOOST) - v2
+- laravel/mcp (MCP) - v0
+- laravel/pint (PINT) - v1
+- laravel/sail (SAIL) - v1
+- pestphp/pest (PEST) - v4
+- vue (VUE) - v3
+- eslint (ESLINT) - v9
+- prettier (PRETTIER) - v3
+- tailwindcss (TAILWINDCSS) - v3
+
+## Skills Activation
+
+This project has domain-specific skills available. You MUST activate the relevant skill whenever you work in that domain—don't wait until you're stuck.
+
+- `pest-testing` — Use this skill for Pest PHP testing in Laravel projects only. Trigger whenever any test is being written, edited, fixed, or refactored — including fixing tests that broke after a code change, adding assertions, converting PHPUnit to Pest, adding datasets, and TDD workflows. Always activate when the user asks how to write something in Pest, mentions test files or directories (tests/Feature, tests/Unit, tests/Browser), or needs browser testing, smoke testing multiple pages for JS errors, or architecture tests. Covers: it()/expect() syntax, datasets, mocking, browser testing (visit/click/fill), smoke testing, arch(), Livewire component tests, RefreshDatabase, and all Pest 4 features. Do not use for factories, seeders, migrations, controllers, models, or non-test PHP code.
+- `tailwindcss-development` — Always invoke when the user's message includes 'tailwind' in any form. Also invoke for: building responsive grid layouts (multi-column card grids, product grids), flex/grid page structures (dashboards with sidebars, fixed topbars, mobile-toggle navs), styling UI components (cards, tables, navbars, pricing sections, forms, inputs, badges), adding dark mode variants, fixing spacing or typography, and Tailwind v3/v4 work. The core use case: writing or fixing Tailwind utility classes in HTML templates (Blade, JSX, Vue). Skip for backend PHP logic, database queries, API routes, JavaScript with no HTML/CSS component, CSS file audits, build tool configuration, and vanilla CSS.
+- `medialibrary-development` — Build and work with spatie/laravel-medialibrary features including associating files with Eloquent models, defining media collections and conversions, generating responsive images, and retrieving media URLs and paths.
+
+## Conventions
+
+- You must follow all existing code conventions used in this application. When creating or editing a file, check sibling files for the correct structure, approach, and naming.
+- Use descriptive names for variables and methods. For example, `isRegisteredForDiscounts`, not `discount()`.
+- Check for existing components to reuse before writing a new one.
+
+## Verification Scripts
+
+- Do not create verification scripts or tinker when tests cover that functionality and prove they work. Unit and feature tests are more important.
+
+## Application Structure & Architecture
+
+- Stick to existing directory structure; don't create new base folders without approval.
+- Do not change the application's dependencies without approval.
+
+## Frontend Bundling
+
+- If the user doesn't see a frontend change reflected in the UI, it could mean they need to run `npm run build`, `npm run dev`, or `composer run dev`. Ask them.
+
+## Documentation Files
+
+- You must only create documentation files if explicitly requested by the user.
+
+## Replies
+
+- Be concise in your explanations - focus on what's important rather than explaining obvious details.
+
+=== boost rules ===
+
+# Laravel Boost
+
+- Laravel Boost is an MCP server that comes with powerful tools designed specifically for this application. Use them.
+
+## Artisan Commands
+
+- Run Artisan commands directly via the command line (e.g., `php artisan route:list`, `php artisan tinker --execute "..."`).
+- Use `php artisan list` to discover available commands and `php artisan [command] --help` to check parameters.
+
+## URLs
+
+- Whenever you share a project URL with the user, you should use the `get-absolute-url` tool to ensure you're using the correct scheme, domain/IP, and port.
+
+## Debugging
+
+- Use the `database-query` tool when you only need to read from the database.
+- Use the `database-schema` tool to inspect table structure before writing migrations or models.
+- To execute PHP code for debugging, run `php artisan tinker --execute "your code here"` directly.
+- To read configuration values, read the config files directly or run `php artisan config:show [key]`.
+- To inspect routes, run `php artisan route:list` directly.
+- To check environment variables, read the `.env` file directly.
+
+## Reading Browser Logs With the `browser-logs` Tool
+
+- You can read browser logs, errors, and exceptions using the `browser-logs` tool from Boost.
+- Only recent browser logs will be useful - ignore old logs.
+
+## Searching Documentation (Critically Important)
+
+- Boost comes with a powerful `search-docs` tool you should use before trying other approaches when working with Laravel or Laravel ecosystem packages. This tool automatically passes a list of installed packages and their versions to the remote Boost API, so it returns only version-specific documentation for the user's circumstance. You should pass an array of packages to filter on if you know you need docs for particular packages.
+- Search the documentation before making code changes to ensure we are taking the correct approach.
+- Use multiple, broad, simple, topic-based queries at once. For example: `['rate limiting', 'routing rate limiting', 'routing']`. The most relevant results will be returned first.
+- Do not add package names to queries; package information is already shared. For example, use `test resource table`, not `filament 4 test resource table`.
+
+### Available Search Syntax
+
+1. Simple Word Searches with auto-stemming - query=authentication - finds 'authenticate' and 'auth'.
+2. Multiple Words (AND Logic) - query=rate limit - finds knowledge containing both "rate" AND "limit".
+3. Quoted Phrases (Exact Position) - query="infinite scroll" - words must be adjacent and in that order.
+4. Mixed Queries - query=middleware "rate limit" - "middleware" AND exact phrase "rate limit".
+5. Multiple Queries - queries=["authentication", "middleware"] - ANY of these terms.
+
+=== php rules ===
+
+# PHP
+
+- Always use curly braces for control structures, even for single-line bodies.
+
+## Constructors
+
+- Use PHP 8 constructor property promotion in `__construct()`.
+    - `public function __construct(public GitHub $github) { }`
+- Do not allow empty `__construct()` methods with zero parameters unless the constructor is private.
+
+## Type Declarations
+
+- Always use explicit return type declarations for methods and functions.
+- Use appropriate PHP type hints for method parameters.
+
+<!-- Explicit Return Types and Method Params -->
+```php
+protected function isAccessible(User $user, ?string $path = null): bool
+{
+    ...
+}
+```
+
+## Enums
+
+- Typically, keys in an Enum should be TitleCase. For example: `FavoritePerson`, `BestLake`, `Monthly`.
+
+## Comments
+
+- Prefer PHPDoc blocks over inline comments. Never use comments within the code itself unless the logic is exceptionally complex.
+
+## PHPDoc Blocks
+
+- Add useful array shape type definitions when appropriate.
+
+=== herd rules ===
+
+# Laravel Herd
+
+- The application is served by Laravel Herd and will be available at: `https?://[kebab-case-project-dir].test`. Use the `get-absolute-url` tool to generate valid URLs for the user.
+- You must not run any commands to make the site available via HTTP(S). It is always available through Laravel Herd.
+
+=== tests rules ===
+
+# Test Enforcement
+
+- Every change must be programmatically tested. Write a new test or update an existing test, then run the affected tests to make sure they pass.
+- Run the minimum number of tests needed to ensure code quality and speed. Use `php artisan test --compact` with a specific filename or filter.
+
+=== laravel/core rules ===
+
+# Do Things the Laravel Way
+
+- Use `php artisan make:` commands to create new files (i.e. migrations, controllers, models, etc.). You can list available Artisan commands using `php artisan list` and check their parameters with `php artisan [command] --help`.
+- If you're creating a generic PHP class, use `php artisan make:class`.
+- Pass `--no-interaction` to all Artisan commands to ensure they work without user input. You should also pass the correct `--options` to ensure correct behavior.
+
+## Database
+
+- Always use proper Eloquent relationship methods with return type hints. Prefer relationship methods over raw queries or manual joins.
+- Use Eloquent models and relationships before suggesting raw database queries.
+- Avoid `DB::`; prefer `Model::query()`. Generate code that leverages Laravel's ORM capabilities rather than bypassing them.
+- Generate code that prevents N+1 query problems by using eager loading.
+- Use Laravel's query builder for very complex database operations.
+
+### Model Creation
+
+- When creating new models, create useful factories and seeders for them too. Ask the user if they need any other things, using `php artisan make:model --help` to check the available options.
+
+### APIs & Eloquent Resources
+
+- For APIs, default to using Eloquent API Resources and API versioning unless existing API routes do not, then you should follow existing application convention.
+
+## Controllers & Validation
+
+- Always create Form Request classes for validation rather than inline validation in controllers. Include both validation rules and custom error messages.
+- Check sibling Form Requests to see if the application uses array or string based validation rules.
+
+## Authentication & Authorization
+
+- Use Laravel's built-in authentication and authorization features (gates, policies, Sanctum, etc.).
+
+## URL Generation
+
+- When generating links to other pages, prefer named routes and the `route()` function.
+
+## Queues
+
+- Use queued jobs for time-consuming operations with the `ShouldQueue` interface.
+
+## Configuration
+
+- Use environment variables only in configuration files - never use the `env()` function directly outside of config files. Always use `config('app.name')`, not `env('APP_NAME')`.
+
+## Testing
+
+- When creating models for tests, use the factories for the models. Check if the factory has custom states that can be used before manually setting up the model.
+- Faker: Use methods such as `$this->faker->word()` or `fake()->randomDigit()`. Follow existing conventions whether to use `$this->faker` or `fake()`.
+- When creating tests, make use of `php artisan make:test [options] {name}` to create a feature test, and pass `--unit` to create a unit test. Most tests should be feature tests.
+
+## Vite Error
+
+- If you receive an "Illuminate\Foundation\ViteException: Unable to locate file in Vite manifest" error, you can run `npm run build` or ask the user to run `npm run dev` or `composer run dev`.
+
+=== pint/core rules ===
+
+# Laravel Pint Code Formatter
+
+- If you have modified any PHP files, you must run `vendor/bin/pint --dirty --format agent` before finalizing changes to ensure your code matches the project's expected style.
+- Do not run `vendor/bin/pint --test --format agent`, simply run `vendor/bin/pint --format agent` to fix any formatting issues.
+
+=== pest/core rules ===
+
+## Pest
+
+- This project uses Pest for testing. Create tests: `php artisan make:test --pest {name}`.
+- Run tests: `php artisan test --compact` or filter: `php artisan test --compact --filter=testName`.
+- Do NOT delete tests without approval.
+
+=== spatie/laravel-medialibrary rules ===
+
+## Media Library
+
+- `spatie/laravel-medialibrary` associates files with Eloquent models, with support for collections, conversions, and responsive images.
+- Always activate the `medialibrary-development` skill when working with media uploads, conversions, collections, responsive images, or any code that uses the `HasMedia` interface or `InteractsWithMedia` trait.
+
+</laravel-boost-guidelines>

CLAUDE.md

@@ -0,0 +1,80 @@
+# CLAUDE.md
+
+This file provides guidance to Claude Code (claude.ai/code) when working with code in this repository.
+
+## Project Overview
+
+InvoiceShelf is an open-source invoicing and expense tracking application built with Laravel 13 (PHP 8.4) and Vue 3. It supports multi-company tenancy, customer portals, recurring invoices, and PDF generation.
+
+## Common Commands
+
+### Development
+```bash
+composer run dev          # Starts PHP server, queue listener, log tail, and Vite dev server concurrently
+npm run dev               # Vite dev server only
+npm run build             # Production frontend build
+```
+
+### Testing
+```bash
+php artisan test --compact                        # Run all tests
+php artisan test --compact --filter=testName       # Run specific test
+./vendor/bin/pest --stop-on-failure                # Run via Pest directly
+make test                                          # Makefile shortcut
+```
+
+Tests use SQLite in-memory DB, configured in `phpunit.xml`. Tests seed via `DatabaseSeeder` + `DemoSeeder` in `beforeEach`. Authenticate with `Sanctum::actingAs()` and set the `company` header.
+
+### Code Style
+```bash
+vendor/bin/pint --dirty --format agent    # Fix style on modified PHP files
+vendor/bin/pint --test                    # Check style without fixing (CI uses this)
+```
+
+### Artisan Generators
+Always use `php artisan make:*` with `--no-interaction` to create new files (models, controllers, migrations, tests, etc.).
+
+## Architecture
+
+### Multi-Tenancy
+Every major model has a `company_id` foreign key. The `CompanyMiddleware` sets the active company from the `company` request header. Bouncer authorization is scoped to the company level via `DefaultScope` (`app/Bouncer/Scopes/DefaultScope.php`).
+
+### Authentication
+Three guards: `web` (session), `api` (Sanctum tokens for `/api/v1/`), `customer` (session for customer portal). API routes use `auth:sanctum` middleware; customer portal uses `auth:customer`.
+
+### Routing
+- **API**: All endpoints under `/api/v1/` in `routes/api.php`, grouped with `auth:sanctum`, `company`, and `bouncer` middleware
+- **Web**: `routes/web.php` serves PDF endpoints, auth pages, and catch-all SPA routes (`/admin/{vue?}`, `/{company:slug}/customer/{vue?}`)
+
+### Frontend
+- Entry point: `resources/scripts/main.js`
+- Vue Router: `resources/scripts/admin/admin-router.js` (admin), `resources/scripts/customer/customer-router.js` (customer portal)
+- State: Pinia stores in `resources/scripts/admin/stores/`
+- Path aliases: `@` = `resources/`, `$fonts`, `$images` for static assets
+- Vite dev server expects `invoiceshelf.test` hostname
+
+### Backend Patterns
+- **Authorization**: Silber/Bouncer with policies in `app/Policies/`. Controllers use `$this->authorize()`.
+- **Validation**: Form Request classes, never inline validation
+- **API responses**: Eloquent API Resources in `app/Http/Resources/`
+- **PDF generation**: DomPDF (`GeneratesPdfTrait`) or Gotenberg
+- **Email**: Mailable classes with `EmailLog` tracking
+- **File storage**: Spatie MediaLibrary, supports local/S3/Dropbox
+- **Serial numbers**: `SerialNumberFormatter` service
+- **Company settings**: `CompanySetting` model (key-value per company)
+
+### Database
+Supports MySQL, PostgreSQL, and SQLite. Prefer Eloquent over raw queries. Use `Model::query()` instead of `DB::`. Use eager loading to prevent N+1 queries.
+
+## Code Conventions
+
+- PHP: snake_case, constructor property promotion, explicit return types, PHPDoc blocks over inline comments
+- JS: camelCase
+- Always check sibling files for patterns before creating new ones
+- Use `config()` helper, never `env()` outside config files
+- Every change must have tests (feature tests preferred over unit tests)
+- Run `vendor/bin/pint --dirty --format agent` after modifying PHP files
+
+## CI Pipeline
+
+GitHub Actions (`check.yaml`): runs Pint style check, then builds frontend and runs Pest tests on PHP 8.4.

SECURITY.md

@@ -2,4 +2,6 @@
 
 ## Reporting a Vulnerability
 
-Please email security@invoiceshelf.com to report any security vulnerabilities. We will acknowledge receipt of your vulnerability and strive to send you regular updates about our progress. If you're curious about the status of your disclosure please feel free to email us again.
+Please email **security@invoiceshelf.com** and cc **security@griffin-web.studio** to report any security vulnerabilities. In the unlikely event that you haven’t heard back, try reaching out on Discord to one of our moderators.
+
+We will acknowledge receipt of your report and strive to provide regular updates on our progress. If you're curious about the status of your disclosure, please feel free to email us again.

app/Console/Commands/CreateTemplateCommand.php

@@ -2,8 +2,11 @@
 
 namespace App\Console\Commands;
 
+use App\Space\PdfTemplateUtils;
 use Illuminate\Console\Command;
+use Illuminate\Support\Facades\File;
 use Illuminate\Support\Facades\Storage;
+use Illuminate\Support\Str;
 
 class CreateTemplateCommand extends Command
 {
@@ -37,26 +40,53 @@ class CreateTemplateCommand extends Command
     public function handle(): int
     {
         $templateName = $this->argument('name');
-        $type = $this->option('type');
+        $templateType = $this->option('type');
 
-        if (! $type) {
-            $type = $this->choice('Create a template for?', ['invoice', 'estimate']);
+        if (! $templateType) {
+            $templateType = $this->choice('Create a template for?', ['invoice', 'estimate']);
         }
 
-        if (Storage::disk('views')->exists("/app/pdf/{$type}/{$templateName}.blade.php")) {
+        if (PdfTemplateUtils::customTemplateFileExists($templateType, sprintf('%s.blade.php', $templateName))) {
             $this->info('Template with given name already exists.');
 
-            return 0;
+            return self::INVALID;
         }
 
-        Storage::disk('views')->copy("/app/pdf/{$type}/{$type}1.blade.php", "/app/pdf/{$type}/{$templateName}.blade.php");
-        copy(public_path("/build/img/PDF/{$type}1.png"), public_path("/build/img/PDF/{$templateName}.png"));
-        copy(resource_path("/static/img/PDF/{$type}1.png"), resource_path("/static/img/PDF/{$templateName}.png"));
+        if (! PdfTemplateUtils::toCustomTemplateMarkupFile(
+            Str::replace(
+                sprintf('app.pdf.%s', $templateType),
+                sprintf('pdf_templates::%s', $templateType),
+                Storage::disk('views')->get("/app/pdf/{$templateType}/{$templateType}1.blade.php"),
+            ),
+            $templateType,
+            $templateName
+        )) {
+            $this->error(sprintf('Unable to create %s template.', ucfirst($templateType)));
 
-        $path = resource_path("views/app/pdf/{$type}/{$templateName}.blade.php");
-        $type = ucfirst($type);
-        $this->info("{$type} Template created successfully at ".$path);
+            return self::FAILURE;
+        }
 
-        return 0;
+        PdfTemplateUtils::toCustomTemplateImageFile(
+            File::get(resource_path("static/img/PDF/{$templateType}1.png")),
+            $templateType,
+            $templateName,
+        );
+
+        if (! PdfTemplateUtils::customTemplateFileExists($templateType, 'partials/table.blade.php')) {
+            PdfTemplateUtils::toCustomTemplateFile(
+                Storage::disk('views')->get("/app/pdf/{$templateType}/partials/table.blade.php"),
+                $templateType,
+                'partials/table.blade.php'
+            );
+        }
+
+        $this->info(
+            sprintf('%s Template created successfully at %s',
+                ucfirst($templateType),
+                PdfTemplateUtils::getCustomTemplateFilePath($templateType, sprintf('%s.blade.php', $templateName))
+            )
+        );
+
+        return self::SUCCESS;
     }
 }

app/Console/Commands/ResetApp.php

@@ -6,6 +6,8 @@ use Illuminate\Console\Command;
 use Illuminate\Console\ConfirmableTrait;
 use Illuminate\Support\Facades\Artisan;
 
+use function Laravel\Prompts\confirm;
+
 class ResetApp extends Command
 {
     use ConfirmableTrait;
@@ -22,7 +24,7 @@ class ResetApp extends Command
      *
      * @var string
      */
-    protected $description = 'Clean database, database_created and public/storage folder';
+    protected $description = 'Clean database and public/storage folder';
 
     /**
      * Create a new command instance.
@@ -39,30 +41,49 @@ class ResetApp extends Command
      *
      * @return mixed
      */
+    /**
+     * Execute the console command to reset the application.
+     *
+     * This will:
+     * 1. Enable maintenance mode to prevent access during reset
+     * 2. Fresh migrate the database with initial seeds
+     * 3. Seed demo data using DemoSeeder
+     * 4. Clear all application caches
+     * 5. Disable maintenance mode
+     *
+     * The --force flag can be used to skip confirmation prompt.
+     */
     public function handle(): void
     {
-        if (! $this->confirmToProceed()) {
-            return;
+
+        if (! $this->option('force')) {
+            if (! confirm('Are you sure you want to reset the application?')) {
+                $this->components->error('Reset cancelled');
+
+                return;
+            }
         }
 
-        $this->info('Running migrate:fresh');
+        // Enable maintenance mode to prevent access during reset
+        $this->info('Activating maintenance mode...');
+        Artisan::call('down');
 
+        // Fresh migrate database and run initial seeds
+        $this->info('Running migrate:fresh');
         Artisan::call('migrate:fresh --seed --force');
 
+        // Seed demo data
         $this->info('Seeding database');
-
         Artisan::call('db:seed', ['--class' => 'DemoSeeder', '--force' => true]);
 
-        $path = base_path('.env');
+        // Clear all application caches
+        $this->info('Clearing cache...');
+        Artisan::call('optimize:clear');
 
-        if (file_exists($path)) {
-            file_put_contents($path, str_replace(
-                'APP_DEBUG=true',
-                'APP_DEBUG=false',
-                file_get_contents($path)
-            ));
-        }
+        // Disable maintenance mode
+        $this->info('Deactivating maintenance mode...');
+        Artisan::call('up');
 
-        $this->info('App has been reset successfully');
+        $this->info('App reset completed successfully!');
     }
 }

app/Console/Commands/UpdateCommand.php

@@ -2,9 +2,9 @@
 
 namespace App\Console\Commands;
 
-use App\Models\Setting;
 use App\Space\Updater;
 use Illuminate\Console\Command;
+use Illuminate\Support\Facades\File;
 
 // Implementation taken from Akaunting - https://github.com/akaunting/akaunting
 class UpdateCommand extends Command
@@ -98,7 +98,7 @@ class UpdateCommand extends Command
 
     public function getInstalledVersion()
     {
-        return Setting::getSetting('version');
+        return preg_replace('~[\r\n]+~', '', File::get(base_path('version.md')));
     }
 
     public function getLatestVersionResponse()

app/Facades/Hashids.php

@@ -0,0 +1,22 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Facades;
+
+use Illuminate\Support\Facades\Facade;
+
+/**
+ * @method static string encode(mixed ...$numbers)
+ * @method static array decode(string $hash)
+ * @method static string encodeHex(string $str)
+ * @method static string decodeHex(string $hash)
+ * @method static \Hashids\Hashids connection(string|null $name = null)
+ */
+class Hashids extends Facade
+{
+    protected static function getFacadeAccessor(): string
+    {
+        return 'hashids';
+    }
+}

app/Facades/PDF.php

@@ -0,0 +1,16 @@
+<?php
+
+namespace App\Facades;
+
+use Illuminate\Support\Facades\Facade;
+
+/**
+ * @method static \Psr\Http\Message\ResponseInterface loadView(string $template)
+ */
+class PDF extends Facade
+{
+    protected static function getFacadeAccessor()
+    {
+        return 'pdf.driver';
+    }
+}

app/Hashids/HashidsFactory.php

@@ -0,0 +1,35 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Hashids;
+
+use Hashids\Hashids;
+use Illuminate\Support\Arr;
+
+class HashidsFactory
+{
+    public function make(array $config): Hashids
+    {
+        $config = $this->getConfig($config);
+
+        return $this->getClient($config);
+    }
+
+    /**
+     * @return array{salt: string, length: int, alphabet: string}
+     */
+    protected function getConfig(array $config): array
+    {
+        return [
+            'salt' => Arr::get($config, 'salt', ''),
+            'length' => Arr::get($config, 'length', 0),
+            'alphabet' => Arr::get($config, 'alphabet', 'abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ1234567890'),
+        ];
+    }
+
+    protected function getClient(array $config): Hashids
+    {
+        return new Hashids($config['salt'], $config['length'], $config['alphabet']);
+    }
+}

app/Hashids/HashidsManager.php

@@ -0,0 +1,72 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Hashids;
+
+use Hashids\Hashids;
+use Illuminate\Contracts\Config\Repository;
+use InvalidArgumentException;
+
+/**
+ * Resolves named Hashids clients from config/hashids.php (one "connection" per model class).
+ *
+ * @method string encode(mixed ...$numbers)
+ * @method array decode(string $hash)
+ * @method string encodeHex(string $str)
+ * @method string decodeHex(string $hash)
+ */
+class HashidsManager
+{
+    /**
+     * @var array<string, Hashids>
+     */
+    protected array $connections = [];
+
+    public function __construct(
+        protected Repository $config,
+        protected HashidsFactory $factory
+    ) {}
+
+    public function connection(?string $name = null): Hashids
+    {
+        $name = $name ?? $this->getDefaultConnection();
+
+        if (! isset($this->connections[$name])) {
+            $this->connections[$name] = $this->factory->make(
+                $this->getConnectionConfig($name)
+            );
+        }
+
+        return $this->connections[$name];
+    }
+
+    public function getDefaultConnection(): string
+    {
+        return (string) $this->config->get('hashids.default');
+    }
+
+    public function getFactory(): HashidsFactory
+    {
+        return $this->factory;
+    }
+
+    /**
+     * @return array<string, mixed>
+     */
+    protected function getConnectionConfig(string $name): array
+    {
+        $connections = $this->config->get('hashids.connections', []);
+
+        if (! is_array($connections) || ! isset($connections[$name])) {
+            throw new InvalidArgumentException("Hashids connection [{$name}] not configured.");
+        }
+
+        return $connections[$name];
+    }
+
+    public function __call(string $method, array $parameters): mixed
+    {
+        return $this->connection()->$method(...$parameters);
+    }
+}

app/Hashids/HashidsServiceProvider.php

@@ -0,0 +1,45 @@
+<?php
+
+declare(strict_types=1);
+
+namespace App\Hashids;
+
+use Hashids\Hashids as HashidsClient;
+use Illuminate\Contracts\Container\Container;
+use Illuminate\Support\ServiceProvider;
+
+class HashidsServiceProvider extends ServiceProvider
+{
+    public function register(): void
+    {
+        $this->app->singleton('hashids.factory', function () {
+            return new HashidsFactory;
+        });
+
+        $this->app->alias('hashids.factory', HashidsFactory::class);
+
+        $this->app->singleton('hashids', function (Container $app) {
+            return new HashidsManager($app['config'], $app['hashids.factory']);
+        });
+
+        $this->app->alias('hashids', HashidsManager::class);
+
+        $this->app->bind('hashids.connection', function (Container $app) {
+            return $app['hashids']->connection();
+        });
+
+        $this->app->alias('hashids.connection', HashidsClient::class);
+    }
+
+    /**
+     * @return list<string>
+     */
+    public function provides(): array
+    {
+        return [
+            'hashids',
+            'hashids.factory',
+            'hashids.connection',
+        ];
+    }
+}

app/Http/Controllers/AppVersionController.php

@@ -3,18 +3,20 @@
 namespace App\Http\Controllers;
 
 use App\Models\Setting;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
+use Illuminate\Support\Facades\File;
 
 class AppVersionController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request)
     {
-        $version = Setting::getSetting('version');
+        $version = preg_replace('~[\r\n]+~', '', File::get(base_path('version.md')));
 
         $channel = Setting::getSetting('updater_channel');
         if (is_null($channel)) {

app/Http/Controllers/V1/Admin/Auth/ForgotPasswordController.php

@@ -4,6 +4,8 @@ namespace App\Http\Controllers\V1\Admin\Auth;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Foundation\Auth\SendsPasswordResetEmails;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 
 class ForgotPasswordController extends Controller
@@ -25,7 +27,7 @@ class ForgotPasswordController extends Controller
      * Get the response for a successful password reset link.
      *
      * @param  string  $response
-     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     * @return RedirectResponse|JsonResponse
      */
     protected function sendResetLinkResponse(Request $request, $response)
     {
@@ -39,7 +41,7 @@ class ForgotPasswordController extends Controller
      * Get the response for a failed password reset link.
      *
      * @param  string  $response
-     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     * @return RedirectResponse|JsonResponse
      */
     protected function sendResetLinkFailedResponse(Request $request, $response)
     {

app/Http/Controllers/V1/Admin/Auth/ResetPasswordController.php

@@ -5,7 +5,10 @@ namespace App\Http\Controllers\V1\Admin\Auth;
 use App\Http\Controllers\Controller;
 use App\Providers\AppServiceProvider;
 use Illuminate\Auth\Events\PasswordReset;
+use Illuminate\Contracts\Auth\CanResetPassword;
 use Illuminate\Foundation\Auth\ResetsPasswords;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\RedirectResponse;
 use Illuminate\Http\Request;
 use Illuminate\Support\Str;
 
@@ -35,7 +38,7 @@ class ResetPasswordController extends Controller
      * Get the response for a successful password reset.
      *
      * @param  string  $response
-     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     * @return RedirectResponse|JsonResponse
      */
     protected function sendResetResponse(Request $request, $response)
     {
@@ -47,7 +50,7 @@ class ResetPasswordController extends Controller
     /**
      * Reset the given user's password.
      *
-     * @param  \Illuminate\Contracts\Auth\CanResetPassword  $user
+     * @param  CanResetPassword  $user
      * @param  string  $password
      * @return void
      */
@@ -66,7 +69,7 @@ class ResetPasswordController extends Controller
      * Get the response for a failed password reset.
      *
      * @param  string  $response
-     * @return \Illuminate\Http\RedirectResponse|\Illuminate\Http\JsonResponse
+     * @return RedirectResponse|JsonResponse
      */
     protected function sendResetFailedResponse(Request $request, $response)
     {

app/Http/Controllers/V1/Admin/Backup/BackupsController.php

@@ -5,6 +5,7 @@
 namespace App\Http\Controllers\V1\Admin\Backup;
 
 use App\Jobs\CreateBackupJob;
+use App\Models\FileDisk;
 use App\Rules\Backup\PathToZip;
 use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
@@ -27,6 +28,16 @@ class BackupsController extends ApiController
         $configuredBackupDisks = config('backup.backup.destination.disks');
 
         try {
+            if ($request->file_disk_id) {
+                $fileDisk = FileDisk::find($request->file_disk_id);
+                if ($fileDisk) {
+                    $fileDisk->setConfig();
+                    $prefix = env('DYNAMIC_DISK_PREFIX', 'temp_');
+                    config(['backup.backup.destination.disks' => [$prefix.$fileDisk->driver]]);
+                    $configuredBackupDisks = config('backup.backup.destination.disks');
+                }
+            }
+
             $backupDestination = BackupDestination::create(config('filesystems.default'), config('backup.backup.name'));
 
             $backups = Cache::remember("backups-{$request->file_disk_id}", now()->addSeconds(4), function () use ($backupDestination) {
@@ -65,7 +76,10 @@ class BackupsController extends ApiController
     {
         $this->authorize('manage backups');
 
-        dispatch(new CreateBackupJob($request->all()))->onQueue(config('backup.queue.name'));
+        $data = $request->all();
+        $data['company'] = $request->header('company');
+
+        dispatch(new CreateBackupJob($data))->onQueue(config('backup.queue.name'));
 
         return $this->respondSuccess();
     }
@@ -80,7 +94,7 @@ class BackupsController extends ApiController
         $this->authorize('manage backups');
 
         $validated = $request->validate([
-            'path' => ['required', new PathToZip()],
+            'path' => ['required', new PathToZip],
         ]);
 
         $backupDestination = BackupDestination::create(config('filesystems.default'), config('backup.backup.name'));

app/Http/Controllers/V1/Admin/Backup/DownloadBackupController.php

@@ -18,7 +18,7 @@ class DownloadBackupController extends ApiController
         $this->authorize('manage backups');
 
         $validated = $request->validate([
-            'path' => ['required', new PathToZip()],
+            'path' => ['required', new PathToZip],
         ]);
 
         $backupDestination = BackupDestination::create(config('filesystems.default'), config('backup.backup.name'));

app/Http/Controllers/V1/Admin/Company/CompaniesController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers\V1\Admin\Company;
 
+use App\Facades\Hashids;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\CompaniesRequest;
 use App\Http\Resources\CompanyResource;
@@ -9,7 +10,6 @@ use App\Models\Company;
 use App\Models\User;
 use Illuminate\Http\Request;
 use Silber\Bouncer\BouncerFacade;
-use Vinkla\Hashids\Facades\Hashids;
 
 class CompaniesController extends Controller
 {
@@ -61,10 +61,10 @@ class CompaniesController extends Controller
         $company = Company::find($request->header('company'));
         $this->authorize('transfer company ownership', $company);
 
-        if ($user->hasCompany($company->id)) {
+        if (! $user->hasCompany($company->id)) {
             return response()->json([
                 'success' => false,
-                'message' => 'User does not belongs to this company.',
+                'message' => 'User does not belong to this company.',
             ]);
         }
 

app/Http/Controllers/V1/Admin/Company/CompanyController.php

@@ -6,13 +6,14 @@ use App\Http\Controllers\Controller;
 use App\Http\Resources\CompanyResource;
 use App\Models\Company;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CompanyController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Config/FiscalYearsController.php

@@ -4,13 +4,14 @@ namespace App\Http\Controllers\V1\Admin\Config;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class FiscalYearsController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Config/LanguagesController.php

@@ -4,13 +4,14 @@ namespace App\Http\Controllers\V1\Admin\Config;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class LanguagesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Config/RetrospectiveEditsController.php

@@ -4,13 +4,14 @@ namespace App\Http\Controllers\V1\Admin\Config;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class RetrospectiveEditsController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/CustomField/CustomFieldsController.php

@@ -7,13 +7,14 @@ use App\Http\Requests\CustomFieldRequest;
 use App\Http\Resources\CustomFieldResource;
 use App\Models\CustomField;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CustomFieldsController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function index(Request $request)
     {
@@ -33,7 +34,7 @@ class CustomFieldsController extends Controller
      * Store a newly created resource in storage.
      *
      * @param  \Illuminate\Http\CustomFieldRequest  $request
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function store(CustomFieldRequest $request)
     {
@@ -48,7 +49,7 @@ class CustomFieldsController extends Controller
      * Display the specified resource.
      *
      * @param  int  $id
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function show(CustomField $customField)
     {
@@ -60,9 +61,9 @@ class CustomFieldsController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
+     * @param  Request  $request
      * @param  int  $id
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function update(CustomFieldRequest $request, CustomField $customField)
     {
@@ -77,7 +78,7 @@ class CustomFieldsController extends Controller
      * Remove the specified resource from storage.
      *
      * @param  int  $id
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function destroy(CustomField $customField)
     {

app/Http/Controllers/V1/Admin/Customer/CustomerStatsController.php

@@ -11,13 +11,14 @@ use App\Models\Invoice;
 use App\Models\Payment;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CustomerStatsController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Customer $customer)
     {
@@ -61,7 +62,7 @@ class CustomerStatsController extends Controller
                 )
                     ->whereCompany()
                     ->whereCustomer($customer->id)
-                    ->sum('total') ?? 0
+                    ->sum('base_total') ?? 0
             );
             array_push(
                 $expenseTotals,
@@ -71,7 +72,7 @@ class CustomerStatsController extends Controller
                 )
                     ->whereCompany()
                     ->whereUser($customer->id)
-                    ->sum('amount') ?? 0
+                    ->sum('base_amount') ?? 0
             );
             array_push(
                 $receiptTotals,
@@ -81,7 +82,7 @@ class CustomerStatsController extends Controller
                 )
                     ->whereCompany()
                     ->whereCustomer($customer->id)
-                    ->sum('amount') ?? 0
+                    ->sum('base_amount') ?? 0
             );
             array_push(
                 $netProfits,
@@ -103,21 +104,21 @@ class CustomerStatsController extends Controller
         )
             ->whereCompany()
             ->whereCustomer($customer->id)
-            ->sum('total');
+            ->sum('base_total');
         $totalReceipts = Payment::whereBetween(
             'payment_date',
             [$startDate->format('Y-m-d'), $start->format('Y-m-d')]
         )
             ->whereCompany()
             ->whereCustomer($customer->id)
-            ->sum('amount');
+            ->sum('base_amount');
         $totalExpenses = Expense::whereBetween(
             'expense_date',
             [$startDate->format('Y-m-d'), $start->format('Y-m-d')]
         )
             ->whereCompany()
             ->whereUser($customer->id)
-            ->sum('amount');
+            ->sum('base_amount');
         $netProfit = (int) $totalReceipts - (int) $totalExpenses;
 
         $chartData = [

app/Http/Controllers/V1/Admin/Customer/CustomersController.php

@@ -7,15 +7,15 @@ use App\Http\Requests;
 use App\Http\Requests\DeleteCustomersRequest;
 use App\Http\Resources\CustomerResource;
 use App\Models\Customer;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use Illuminate\Support\Facades\DB;
 
 class CustomersController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function index(Request $request)
     {
@@ -26,13 +26,8 @@ class CustomersController extends Controller
         $customers = Customer::with('creator')
             ->whereCompany()
             ->applyFilters($request->all())
-            ->select(
-                'customers.*',
-                DB::raw('sum(invoices.base_due_amount) as base_due_amount'),
-                DB::raw('sum(invoices.due_amount) as due_amount'),
-            )
-            ->groupBy('customers.id')
-            ->leftJoin('invoices', 'customers.id', '=', 'invoices.customer_id')
+            ->withSum('invoices as base_due_amount', 'base_due_amount')
+            ->withSum('invoices as due_amount', 'due_amount')
             ->paginateData($limit);
 
         return CustomerResource::collection($customers)
@@ -44,8 +39,8 @@ class CustomersController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function store(Requests\CustomerRequest $request)
     {
@@ -59,7 +54,7 @@ class CustomersController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function show(Customer $customer)
     {
@@ -71,8 +66,8 @@ class CustomersController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function update(Requests\CustomerRequest $request, Customer $customer)
     {
@@ -90,14 +85,18 @@ class CustomersController extends Controller
     /**
      * Remove a list of Customers along side all their resources (ie. Estimates, Invoices, Payments and Addresses)
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function delete(DeleteCustomersRequest $request)
     {
         $this->authorize('delete multiple customers');
 
-        Customer::deleteCustomers($request->ids);
+        $ids = Customer::whereCompany()
+            ->whereIn('id', $request->ids)
+            ->pluck('id');
+
+        Customer::deleteCustomers($ids);
 
         return response()->json([
             'success' => true,

app/Http/Controllers/V1/Admin/Dashboard/DashboardController.php

@@ -11,6 +11,7 @@ use App\Models\Expense;
 use App\Models\Invoice;
 use App\Models\Payment;
 use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Silber\Bouncer\BouncerFacade;
 
@@ -19,7 +20,7 @@ class DashboardController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Estimate/ChangeEstimateStatusController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Estimate;
 use App\Http\Controllers\Controller;
 use App\Models\Estimate;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ChangeEstimateStatusController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Estimate $estimate)
     {

app/Http/Controllers/V1/Admin/Estimate/CloneEstimateController.php

@@ -2,29 +2,31 @@
 
 namespace App\Http\Controllers\V1\Admin\Estimate;
 
+use App\Facades\Hashids;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\EstimateResource;
 use App\Models\CompanySetting;
 use App\Models\Estimate;
 use App\Services\SerialNumberFormatter;
 use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use Vinkla\Hashids\Facades\Hashids;
 
 class CloneEstimateController extends Controller
 {
     /**
      * Mail a specific invoice to the corresponding customer's email address.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request, Estimate $estimate)
     {
+        $this->authorize('view', $estimate);
         $this->authorize('create', Estimate::class);
 
         $date = Carbon::now();
 
-        $serial = (new SerialNumberFormatter())
+        $serial = (new SerialNumberFormatter)
             ->setModel($estimate)
             ->setCompany($estimate->company_id)
             ->setCustomer($estimate->customer_id)

app/Http/Controllers/V1/Admin/Estimate/ConvertEstimateController.php

@@ -2,6 +2,7 @@
 
 namespace App\Http\Controllers\V1\Admin\Estimate;
 
+use App\Facades\Hashids;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\InvoiceResource;
 use App\Models\CompanySetting;
@@ -10,15 +11,15 @@ use App\Models\Invoice;
 use App\Services\SerialNumberFormatter;
 use Carbon\Carbon;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Facades\Auth;
-use Vinkla\Hashids\Facades\Hashids;
 
 class ConvertEstimateController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Estimate $estimate, Invoice $invoice)
     {
@@ -42,7 +43,7 @@ class ConvertEstimateController extends Controller
             $due_date = Carbon::now()->addDays($dueDateDays)->format('Y-m-d');
         }
 
-        $serial = (new SerialNumberFormatter())
+        $serial = (new SerialNumberFormatter)
             ->setModel($invoice)
             ->setCompany($estimate->company_id)
             ->setCustomer($estimate->customer_id)

app/Http/Controllers/V1/Admin/Estimate/EstimateTemplatesController.php

@@ -4,6 +4,8 @@ namespace App\Http\Controllers\V1\Admin\Estimate;
 
 use App\Http\Controllers\Controller;
 use App\Models\Estimate;
+use App\Space\PdfTemplateUtils;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class EstimateTemplatesController extends Controller
@@ -11,13 +13,13 @@ class EstimateTemplatesController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return JsonResponse
      */
     public function __invoke(Request $request)
     {
         $this->authorize('viewAny', Estimate::class);
 
-        $estimateTemplates = Estimate::estimateTemplates();
+        $estimateTemplates = PdfTemplateUtils::getFormattedTemplates('estimate');
 
         return response()->json([
             'estimateTemplates' => $estimateTemplates,

app/Http/Controllers/V1/Admin/Estimate/EstimatesController.php

@@ -68,7 +68,11 @@ class EstimatesController extends Controller
     {
         $this->authorize('delete multiple estimates');
 
-        Estimate::destroy($request->ids);
+        $ids = Estimate::whereCompany()
+            ->whereIn('id', $request->ids)
+            ->pluck('id');
+
+        Estimate::destroy($ids);
 
         return response()->json([
             'success' => true,

app/Http/Controllers/V1/Admin/Estimate/SendEstimateController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Estimate;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\SendEstimatesRequest;
 use App\Models\Estimate;
+use Illuminate\Http\JsonResponse;
 
 class SendEstimateController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(SendEstimatesRequest $request, Estimate $estimate)
     {

app/Http/Controllers/V1/Admin/Estimate/SendEstimatePreviewController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\V1\Admin\Estimate;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\SendEstimatesRequest;
 use App\Models\Estimate;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Mail\Markdown;
 
 class SendEstimatePreviewController extends Controller
@@ -12,7 +13,7 @@ class SendEstimatePreviewController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(SendEstimatesRequest $request, Estimate $estimate)
     {

app/Http/Controllers/V1/Admin/ExchangeRate/ExchangeRateProviderController.php

@@ -7,13 +7,14 @@ use App\Http\Requests\ExchangeRateProviderRequest;
 use App\Http\Resources\ExchangeRateProviderResource;
 use App\Models\ExchangeRateProvider;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ExchangeRateProviderController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function index(Request $request)
     {
@@ -29,8 +30,8 @@ class ExchangeRateProviderController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function store(ExchangeRateProviderRequest $request)
     {
@@ -56,7 +57,7 @@ class ExchangeRateProviderController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function show(ExchangeRateProvider $exchangeRateProvider)
     {
@@ -68,8 +69,8 @@ class ExchangeRateProviderController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function update(ExchangeRateProviderRequest $request, ExchangeRateProvider $exchangeRateProvider)
     {
@@ -95,7 +96,7 @@ class ExchangeRateProviderController extends Controller
     /**
      * Remove the specified resource from storage.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function destroy(ExchangeRateProvider $exchangeRateProvider)
     {

app/Http/Controllers/V1/Admin/ExchangeRate/GetActiveProviderController.php

@@ -6,13 +6,14 @@ use App\Http\Controllers\Controller;
 use App\Models\Currency;
 use App\Models\ExchangeRateProvider;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class GetActiveProviderController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Currency $currency)
     {

app/Http/Controllers/V1/Admin/ExchangeRate/GetExchangeRateController.php

@@ -9,6 +9,7 @@ use App\Models\ExchangeRateLog;
 use App\Models\ExchangeRateProvider;
 use App\Traits\ExchangeRateProvidersTrait;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Illuminate\Support\Arr;
 
 class GetExchangeRateController extends Controller
@@ -18,7 +19,7 @@ class GetExchangeRateController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Currency $currency)
     {

app/Http/Controllers/V1/Admin/ExchangeRate/GetSupportedCurrenciesController.php

@@ -6,6 +6,7 @@ use App\Http\Controllers\Controller;
 use App\Models\ExchangeRateProvider;
 use App\Traits\ExchangeRateProvidersTrait;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class GetSupportedCurrenciesController extends Controller
 {
@@ -14,7 +15,7 @@ class GetSupportedCurrenciesController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/ExchangeRate/GetUsedCurrenciesController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\ExchangeRate;
 use App\Http\Controllers\Controller;
 use App\Models\ExchangeRateProvider;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class GetUsedCurrenciesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Expense/ExpenseCategoriesController.php

@@ -2,18 +2,20 @@
 
 namespace App\Http\Controllers\V1\Admin\Expense;
 
+use App\ExpensesCategory;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\ExpenseCategoryRequest;
 use App\Http\Resources\ExpenseCategoryResource;
 use App\Models\ExpenseCategory;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ExpenseCategoriesController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function index(Request $request)
     {
@@ -32,8 +34,8 @@ class ExpenseCategoriesController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function store(ExpenseCategoryRequest $request)
     {
@@ -47,7 +49,7 @@ class ExpenseCategoriesController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function show(ExpenseCategory $category)
     {
@@ -59,9 +61,9 @@ class ExpenseCategoriesController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @param  \App\Models\ExpenseCategory  $ExpenseCategory
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @param  ExpenseCategory  $ExpenseCategory
+     * @return Response
      */
     public function update(ExpenseCategoryRequest $request, ExpenseCategory $category)
     {
@@ -75,8 +77,8 @@ class ExpenseCategoriesController extends Controller
     /**
      * Remove the specified resource from storage.
      *
-     * @param  \App\ExpensesCategory  $category
-     * @return \Illuminate\Http\Response
+     * @param  ExpensesCategory  $category
+     * @return Response
      */
     public function destroy(ExpenseCategory $category)
     {

app/Http/Controllers/V1/Admin/Expense/ExpensesController.php

@@ -7,6 +7,7 @@ use App\Http\Requests\DeleteExpensesRequest;
 use App\Http\Requests\ExpenseRequest;
 use App\Http\Resources\ExpenseResource;
 use App\Models\Expense;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class ExpensesController extends Controller
@@ -14,7 +15,7 @@ class ExpensesController extends Controller
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function index(Request $request)
     {
@@ -39,7 +40,7 @@ class ExpensesController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function store(ExpenseRequest $request)
     {
@@ -53,7 +54,7 @@ class ExpensesController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function show(Expense $expense)
     {
@@ -65,7 +66,7 @@ class ExpensesController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function update(ExpenseRequest $request, Expense $expense)
     {
@@ -80,7 +81,11 @@ class ExpensesController extends Controller
     {
         $this->authorize('delete multiple expenses');
 
-        Expense::destroy($request->ids);
+        $ids = Expense::whereCompany()
+            ->whereIn('id', $request->ids)
+            ->pluck('id');
+
+        Expense::destroy($ids);
 
         return response()->json([
             'success' => true,

app/Http/Controllers/V1/Admin/Expense/ShowReceiptController.php

@@ -4,13 +4,14 @@ namespace App\Http\Controllers\V1\Admin\Expense;
 
 use App\Http\Controllers\Controller;
 use App\Models\Expense;
+use Illuminate\Http\JsonResponse;
 
 class ShowReceiptController extends Controller
 {
     /**
      * Retrieve details of an expense receipt from storage.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Expense $expense)
     {

app/Http/Controllers/V1/Admin/Expense/UploadReceiptController.php

@@ -3,16 +3,18 @@
 namespace App\Http\Controllers\V1\Admin\Expense;
 
 use App\Http\Controllers\Controller;
+use App\Http\Requests\ExpenseRequest;
 use App\Http\Requests\UploadExpenseReceiptRequest;
 use App\Models\Expense;
+use Illuminate\Http\JsonResponse;
 
 class UploadReceiptController extends Controller
 {
     /**
      * Upload the expense receipts to storage.
      *
-     * @param  \App\Http\Requests\ExpenseRequest  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  ExpenseRequest  $request
+     * @return JsonResponse
      */
     public function __invoke(UploadExpenseReceiptRequest $request, Expense $expense)
     {

app/Http/Controllers/V1/Admin/General/BootstrapController.php

@@ -11,6 +11,7 @@ use App\Models\Currency;
 use App\Models\Module;
 use App\Models\Setting;
 use App\Traits\GeneratesMenuTrait;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 use Silber\Bouncer\BouncerFacade;
 
@@ -21,7 +22,7 @@ class BootstrapController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/BulkExchangeRateController.php

@@ -9,14 +9,16 @@ use App\Models\Estimate;
 use App\Models\Invoice;
 use App\Models\Payment;
 use App\Models\Tax;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class BulkExchangeRateController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function __invoke(BulkExchangeRateRequest $request)
     {

app/Http/Controllers/V1/Admin/General/ConfigController.php

@@ -4,13 +4,14 @@ namespace App\Http\Controllers\V1\Admin\General;
 
 use App\Http\Controllers\Controller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ConfigController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/CountriesController.php

@@ -5,6 +5,7 @@ namespace App\Http\Controllers\V1\Admin\General;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\CountryResource;
 use App\Models\Country;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class CountriesController extends Controller
@@ -12,7 +13,7 @@ class CountriesController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/CurrenciesController.php

@@ -6,13 +6,14 @@ use App\Http\Controllers\Controller;
 use App\Http\Resources\CurrencyResource;
 use App\Models\Currency;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CurrenciesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/DateFormatsController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\General;
 use App\Http\Controllers\Controller;
 use App\Space\DateFormatter;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class DateFormatsController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/GetAllUsedCurrenciesController.php

@@ -9,13 +9,14 @@ use App\Models\Invoice;
 use App\Models\Payment;
 use App\Models\Tax;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class GetAllUsedCurrenciesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/NextNumberController.php

@@ -8,19 +8,20 @@ use App\Models\Invoice;
 use App\Models\Payment;
 use App\Services\SerialNumberFormatter;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class NextNumberController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, Invoice $invoice, Estimate $estimate, Payment $payment)
     {
         $key = $request->key;
         $nextNumber = null;
-        $serial = (new SerialNumberFormatter())
+        $serial = (new SerialNumberFormatter)
             ->setCompany($request->header('company'))
             ->setCustomer($request->userId);
 

app/Http/Controllers/V1/Admin/General/NotesController.php

@@ -7,13 +7,14 @@ use App\Http\Requests\NotesRequest;
 use App\Http\Resources\NoteResource;
 use App\Models\Note;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class NotesController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function index(Request $request)
     {
@@ -32,8 +33,8 @@ class NotesController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function store(NotesRequest $request)
     {
@@ -41,13 +42,22 @@ class NotesController extends Controller
 
         $note = Note::create($request->getNotesPayload());
 
+        if ($note->is_default) {
+            Note::where('id', '!=', $note->id)
+                ->where('type', $note->type)
+                ->where('is_default', true)
+                ->update([
+                    'is_default' => false,
+                ]);
+        }
+
         return new NoteResource($note);
     }
 
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function show(Note $note)
     {
@@ -59,8 +69,8 @@ class NotesController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function update(NotesRequest $request, Note $note)
     {
@@ -68,13 +78,22 @@ class NotesController extends Controller
 
         $note->update($request->getNotesPayload());
 
+        if ($note->is_default) {
+            Note::where('id', '!=', $note->id)
+                ->where('type', $note->type)
+                ->where('is_default', true)
+                ->update([
+                    'is_default' => false,
+                ]);
+        }
+
         return new NoteResource($note);
     }
 
     /**
      * Remove the specified resource from storage.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function destroy(Note $note)
     {

app/Http/Controllers/V1/Admin/General/NumberPlaceholdersController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\General;
 use App\Http\Controllers\Controller;
 use App\Services\SerialNumberFormatter;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class NumberPlaceholdersController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/SearchController.php

@@ -6,13 +6,14 @@ use App\Http\Controllers\Controller;
 use App\Models\Customer;
 use App\Models\User;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class SearchController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {
@@ -24,7 +25,8 @@ class SearchController extends Controller
             ->paginate(10);
 
         if ($user->isOwner()) {
-            $users = User::applyFilters($request->only(['search']))
+            $users = User::whereCompany()
+                ->applyFilters($request->only(['search']))
                 ->latest()
                 ->paginate(10);
         }

app/Http/Controllers/V1/Admin/General/SearchUsersController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\General;
 use App\Http\Controllers\Controller;
 use App\Models\User;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class SearchUsersController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/General/TimeFormatsController.php

@@ -0,0 +1,23 @@
+<?php
+
+namespace App\Http\Controllers\V1\Admin\General;
+
+use App\Http\Controllers\Controller;
+use App\Space\TimeFormatter;
+use Illuminate\Http\Request;
+use Illuminate\Http\Response;
+
+class TimeFormatsController extends Controller
+{
+    /**
+     * Handle the incoming request.
+     *
+     * @return Response
+     */
+    public function __invoke(Request $request)
+    {
+        return response()->json([
+            'time_formats' => TimeFormatter::get_list(),
+        ]);
+    }
+}

app/Http/Controllers/V1/Admin/General/TimezonesController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\General;
 use App\Http\Controllers\Controller;
 use App\Space\TimeZones;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class TimezonesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Invoice/ChangeInvoiceStatusController.php

@@ -4,6 +4,7 @@ namespace App\Http\Controllers\V1\Admin\Invoice;
 
 use App\Http\Controllers\Controller;
 use App\Models\Invoice;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class ChangeInvoiceStatusController extends Controller
@@ -11,7 +12,7 @@ class ChangeInvoiceStatusController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request, Invoice $invoice)
     {

app/Http/Controllers/V1/Admin/Invoice/CloneInvoiceController.php

@@ -2,29 +2,31 @@
 
 namespace App\Http\Controllers\V1\Admin\Invoice;
 
+use App\Facades\Hashids;
 use App\Http\Controllers\Controller;
 use App\Http\Resources\InvoiceResource;
 use App\Models\CompanySetting;
 use App\Models\Invoice;
 use App\Services\SerialNumberFormatter;
 use Carbon\Carbon;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
-use Vinkla\Hashids\Facades\Hashids;
 
 class CloneInvoiceController extends Controller
 {
     /**
      * Mail a specific invoice to the corresponding customer's email address.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function __invoke(Request $request, Invoice $invoice)
     {
+        $this->authorize('view', $invoice);
         $this->authorize('create', Invoice::class);
 
         $date = Carbon::now();
 
-        $serial = (new SerialNumberFormatter())
+        $serial = (new SerialNumberFormatter)
             ->setModel($invoice)
             ->setCompany($invoice->company_id)
             ->setCustomer($invoice->customer_id)
@@ -46,6 +48,16 @@ class CloneInvoiceController extends Controller
 
         $exchange_rate = $invoice->exchange_rate;
 
+        $dateFormat = 'Y-m-d';
+        $invoiceTimeEnabled = CompanySetting::getSetting(
+            'invoice_use_time',
+            $request->header('company')
+        );
+
+        if ($invoiceTimeEnabled === 'YES') {
+            $dateFormat .= ' H:i';
+        }
+
         $newInvoice = Invoice::create([
             'invoice_date' => $date->format('Y-m-d'),
             'due_date' => $due_date,

app/Http/Controllers/V1/Admin/Invoice/InvoiceTemplatesController.php

@@ -4,6 +4,9 @@ namespace App\Http\Controllers\V1\Admin\Invoice;
 
 use App\Http\Controllers\Controller;
 use App\Models\Invoice;
+use App\Space\PdfTemplateUtils;
+use Illuminate\Auth\Access\AuthorizationException;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class InvoiceTemplatesController extends Controller
@@ -11,13 +14,16 @@ class InvoiceTemplatesController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     *
+     * @return JsonResponse
+     *
+     * @throws AuthorizationException
      */
     public function __invoke(Request $request)
     {
         $this->authorize('viewAny', Invoice::class);
 
-        $invoiceTemplates = Invoice::invoiceTemplates();
+        $invoiceTemplates = PdfTemplateUtils::getFormattedTemplates('invoice');
 
         return response()->json([
             'invoiceTemplates' => $invoiceTemplates,

app/Http/Controllers/V1/Admin/Invoice/InvoicesController.php

@@ -8,6 +8,7 @@ use App\Http\Requests\DeleteInvoiceRequest;
 use App\Http\Resources\InvoiceResource;
 use App\Jobs\GenerateInvoicePdfJob;
 use App\Models\Invoice;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class InvoicesController extends Controller
@@ -15,7 +16,7 @@ class InvoicesController extends Controller
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function index(Request $request)
     {
@@ -38,8 +39,8 @@ class InvoicesController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function store(Requests\InvoicesRequest $request)
     {
@@ -59,7 +60,7 @@ class InvoicesController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function show(Request $request, Invoice $invoice)
     {
@@ -71,8 +72,8 @@ class InvoicesController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function update(Requests\InvoicesRequest $request, Invoice $invoice)
     {
@@ -92,14 +93,18 @@ class InvoicesController extends Controller
     /**
      * delete the specified resources in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function delete(DeleteInvoiceRequest $request)
     {
         $this->authorize('delete multiple invoices');
 
-        Invoice::deleteInvoices($request->ids);
+        $ids = Invoice::whereCompany()
+            ->whereIn('id', $request->ids)
+            ->pluck('id');
+
+        Invoice::deleteInvoices($ids);
 
         return response()->json([
             'success' => true,

app/Http/Controllers/V1/Admin/Invoice/SendInvoiceController.php

@@ -5,14 +5,16 @@ namespace App\Http\Controllers\V1\Admin\Invoice;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\SendInvoiceRequest;
 use App\Models\Invoice;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 
 class SendInvoiceController extends Controller
 {
     /**
      * Mail a specific invoice to the corresponding customer's email address.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function __invoke(SendInvoiceRequest $request, Invoice $invoice)
     {

app/Http/Controllers/V1/Admin/Invoice/SendInvoicePreviewController.php

@@ -5,6 +5,8 @@ namespace App\Http\Controllers\V1\Admin\Invoice;
 use App\Http\Controllers\Controller;
 use App\Http\Requests\SendInvoiceRequest;
 use App\Models\Invoice;
+use Illuminate\Http\JsonResponse;
+use Illuminate\Http\Request;
 use Illuminate\Mail\Markdown;
 
 class SendInvoicePreviewController extends Controller
@@ -12,8 +14,8 @@ class SendInvoicePreviewController extends Controller
     /**
      * Mail a specific invoice to the corresponding customer's email address.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function __invoke(SendInvoiceRequest $request, Invoice $invoice)
     {

app/Http/Controllers/V1/Admin/Item/ItemsController.php

@@ -8,6 +8,7 @@ use App\Http\Requests\DeleteItemsRequest;
 use App\Http\Resources\ItemResource;
 use App\Models\Item;
 use App\Models\TaxType;
+use Illuminate\Http\JsonResponse;
 use Illuminate\Http\Request;
 
 class ItemsController extends Controller
@@ -15,7 +16,7 @@ class ItemsController extends Controller
     /**
      * Retrieve a list of existing Items.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function index(Request $request)
     {
@@ -41,7 +42,7 @@ class ItemsController extends Controller
      * Create Item.
      *
      * @param  App\Http\Requests\ItemsRequest  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function store(Requests\ItemsRequest $request)
     {
@@ -55,7 +56,7 @@ class ItemsController extends Controller
     /**
      * get an existing Item.
      *
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function show(Item $item)
     {
@@ -68,7 +69,7 @@ class ItemsController extends Controller
      * Update an existing Item.
      *
      * @param  App\Http\Requests\ItemsRequest  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @return JsonResponse
      */
     public function update(Requests\ItemsRequest $request, Item $item)
     {
@@ -82,14 +83,18 @@ class ItemsController extends Controller
     /**
      * Delete a list of existing Items.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\JsonResponse
+     * @param  Request  $request
+     * @return JsonResponse
      */
     public function delete(DeleteItemsRequest $request)
     {
         $this->authorize('delete multiple items');
 
-        Item::destroy($request->ids);
+        $ids = Item::whereCompany()
+            ->whereIn('id', $request->ids)
+            ->pluck('id');
+
+        Item::destroy($ids);
 
         return response()->json([
             'success' => true,

app/Http/Controllers/V1/Admin/Item/UnitsController.php

@@ -7,13 +7,14 @@ use App\Http\Requests\UnitRequest;
 use App\Http\Resources\UnitResource;
 use App\Models\Unit;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class UnitsController extends Controller
 {
     /**
      * Display a listing of the resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function index(Request $request)
     {
@@ -32,8 +33,8 @@ class UnitsController extends Controller
     /**
      * Store a newly created resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function store(UnitRequest $request)
     {
@@ -47,7 +48,7 @@ class UnitsController extends Controller
     /**
      * Display the specified resource.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function show(Unit $unit)
     {
@@ -59,8 +60,8 @@ class UnitsController extends Controller
     /**
      * Update the specified resource in storage.
      *
-     * @param  \Illuminate\Http\Request  $request
-     * @return \Illuminate\Http\Response
+     * @param  Request  $request
+     * @return Response
      */
     public function update(UnitRequest $request, Unit $unit)
     {
@@ -74,7 +75,7 @@ class UnitsController extends Controller
     /**
      * Remove the specified resource from storage.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function destroy(Unit $unit)
     {

app/Http/Controllers/V1/Admin/Modules/ApiTokenController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Modules;
 use App\Http\Controllers\Controller;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ApiTokenController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Modules/CompleteModuleInstallationController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Modules;
 use App\Http\Controllers\Controller;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CompleteModuleInstallationController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Modules/CopyModuleController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Modules;
 use App\Http\Controllers\Controller;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class CopyModuleController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Modules/DisableModuleController.php

@@ -6,6 +6,7 @@ use App\Events\ModuleDisabledEvent;
 use App\Http\Controllers\Controller;
 use App\Models\Module as ModelsModule;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Nwidart\Modules\Facades\Module;
 
 class DisableModuleController extends Controller
@@ -13,7 +14,7 @@ class DisableModuleController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, string $module)
     {

app/Http/Controllers/V1/Admin/Modules/DownloadModuleController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Modules;
 use App\Http\Controllers\Controller;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class DownloadModuleController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {

app/Http/Controllers/V1/Admin/Modules/EnableModuleController.php

@@ -6,6 +6,7 @@ use App\Events\ModuleEnabledEvent;
 use App\Http\Controllers\Controller;
 use App\Models\Module as ModelsModule;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 use Nwidart\Modules\Facades\Module;
 
 class EnableModuleController extends Controller
@@ -13,7 +14,7 @@ class EnableModuleController extends Controller
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, string $module)
     {

app/Http/Controllers/V1/Admin/Modules/ModuleController.php

@@ -6,13 +6,14 @@ use App\Http\Controllers\Controller;
 use App\Http\Resources\ModuleResource;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ModuleController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request, string $module)
     {

app/Http/Controllers/V1/Admin/Modules/ModulesController.php

@@ -5,13 +5,14 @@ namespace App\Http\Controllers\V1\Admin\Modules;
 use App\Http\Controllers\Controller;
 use App\Space\ModuleInstaller;
 use Illuminate\Http\Request;
+use Illuminate\Http\Response;
 
 class ModulesController extends Controller
 {
     /**
      * Handle the incoming request.
      *
-     * @return \Illuminate\Http\Response
+     * @return Response
      */
     public function __invoke(Request $request)
     {