Feat: new invoice status

[nielsdrost7]

Summary by CodeRabbit

• New Features

  • Added unpaid, partial, and archived invoice status categories with corresponding filter buttons
  • New PDF invoice templates for partial and unpaid invoices
  • Automated smoke test workflow for continuous validation

• Style

  • Updated color scheme for invoice status labels

• Chores

  • Default settings now install during initial setup

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: fbd78b8e-0f60-4fec-94d3-28be49436aff

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• ✅ Review completed - (🔄 Check again to review again)

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/1402-new-invoice-status

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 12

Caution

Some comments are outside the diff and can’t be posted inline due to platform limitations.

⚠️ Outside diff range comments (2)

assets/core/scss/_core.scss (1)

671-686: ⚠️ Potential issue | 🟠 Major

Fix the archived typo and add the unpaid label style.

&.archvied will not match archived, and unpaid has no label background. With .label forcing white text, those statuses can render without a readable background.

Proposed fix

-  &.archvied,
+  &.archived {
+    background-color: lighten($color_status_archived, 10%);
+  }
+
   &.draft {
     background-color: lighten($color_status_draft, 10%);
   }
@@
   &.partial {
     background-color: lighten($color_status_partial, 10%);
   }
+
+  &.unpaid {
+    background-color: lighten($color_status_unpaid, 10%);
+  }

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@assets/core/scss/_core.scss` around lines 671 - 686, Rename the mistaken
selector &.archvied to &.archived and add a new status selector &.unpaid that
sets a background color (use the same pattern as &.sent / &.viewed:
lighten($color_status_unpaid, 10%) or the appropriate unpaid color variable) so
labels with .label (which forces white text) have a readable background; update
the block containing &.draft, &.sent, &.viewed, &.partial to include &.archived
and &.unpaid following the same lighten(...) pattern.

application/modules/reports/models/Mdl_reports.php (1)

555-586: ⚠️ Potential issue | 🟠 Major

Remove the (int) cast before escaping; it converts the quoted SQL literal to zero.

Line 564 applies an integer cast to an escaped value. Since $this->db->escape() returns a quoted SQL string (e.g., '100'), casting it to (int) yields 0, breaking the minimum quantity filter in the tax-included report.

Fix

-                                    AND ' . (int) $this->db->escape($minQuantity) . ' <=
+                                    AND ' . $this->db->escape($minQuantity) . ' <=

The parameter is already cast to int at line 214, making the second cast redundant and harmful. The correct pattern appears at lines 326, 449, and 687 without the extra cast.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/modules/reports/models/Mdl_reports.php` around lines 555 - 586,
The where-clause uses an erroneous (int) cast around
$this->db->escape($minQuantity) which turns the quoted SQL literal into 0;
remove the (int) cast so the code uses $this->db->escape($minQuantity) directly
(leave $this->db->escape($maxQuantity) as-is), locating the change in
Mdl_reports.php in the block that builds the nested SELECTs (look for
$this->db->where(... and the uses of $this->db->escape, $minQuantity and
$maxQuantity) to correct the filter.

🧹 Nitpick comments (2)

application/modules/invoices/views/index.php (1)

37-56: Use strict comparisons and escape the new view attributes.

The added links should follow the view policy for html_escape() and ===.

Proposed fix

-            <a href="<?php echo site_url('invoices/status/partial'); ?>"
-               class="btn  <?php echo $status == 'partial' ? 'btn-primary' : 'btn-default' ?>">
+            <a href="<?php echo html_escape(site_url('invoices/status/partial')); ?>"
+               class="btn <?php echo $status === 'partial' ? 'btn-primary' : 'btn-default'; ?>">
                 <?php _trans('partially paid'); ?>
             </a>
@@
-            <a href="<?php echo site_url('invoices/status/unpaid'); ?>"
-               class="btn  <?php echo $status == 'unpaid' ? 'btn-primary' : 'btn-default' ?>">
+            <a href="<?php echo html_escape(site_url('invoices/status/unpaid')); ?>"
+               class="btn <?php echo $status === 'unpaid' ? 'btn-primary' : 'btn-default'; ?>">
                 <?php _trans('unpaid'); ?>
             </a>
@@
-            <a href="<?php echo site_url('invoices/status/archived'); ?>"
-               class="btn  <?php echo $status == 'archived' ? 'btn-primary' : 'btn-default' ?>">
+            <a href="<?php echo html_escape(site_url('invoices/status/archived')); ?>"
+               class="btn <?php echo $status === 'archived' ? 'btn-primary' : 'btn-default'; ?>">
                 <?php _trans('archived'); ?>
             </a>
@@
-                <a href="<?php echo site_url('invoices/status/partial'); ?>"
-                   class="btn  <?php echo $status == 'partial' ? 'btn-primary' : 'btn-default' ?>">
+                <a href="<?php echo html_escape(site_url('invoices/status/partial')); ?>"
+                   class="btn <?php echo $status === 'partial' ? 'btn-primary' : 'btn-default'; ?>">
                     <?php _trans('partially paid'); ?>
                 </a>
@@
-                <a href="<?php echo site_url('invoices/status/unpaid'); ?>"
-                   class="btn  <?php echo $status == 'unpaid' ? 'btn-primary' : 'btn-default' ?>">
+                <a href="<?php echo html_escape(site_url('invoices/status/unpaid')); ?>"
+                   class="btn <?php echo $status === 'unpaid' ? 'btn-primary' : 'btn-default'; ?>">
                     <?php _trans('unpaid'); ?>
                 </a>
@@
-                <a href="<?php echo site_url('invoices/status/archived'); ?>"
-                   class="btn  <?php echo $status == 'archived' ? 'btn-primary' : 'btn-default' ?>">
+                <a href="<?php echo html_escape(site_url('invoices/status/archived')); ?>"
+                   class="btn <?php echo $status === 'archived' ? 'btn-primary' : 'btn-default'; ?>">
                     <?php _trans('archived'); ?>
                 </a>

As per coding guidelines, **/*.php: Use strict comparison (===, !==) instead of loose comparison; Always use html_escape() for output encoding in views to prevent XSS vulnerabilities.

Also applies to: 87-106

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/modules/invoices/views/index.php` around lines 37 - 56, The view
uses loose comparisons and unescaped outputs; update each anchor's class
conditional to use strict comparison (===) against $status (e.g., $status ===
'partial') and wrap any dynamic output used in attributes or displayed text with
html_escape(), including the site_url() output and the translation output from
_trans() (e.g., class="<?php echo html_escape($status === 'partial' ?
'btn-primary' : 'btn-default') ?>" and <?php echo html_escape(_trans('partially
paid')); ?> or html_escape(site_url(...)) for hrefs). Apply the same
strict-comparison and html_escape() changes to the other similar blocks (the
later invoice status link group as well).

application/third_party/MX/Controller.php (1)

54-58: Restore the block indentation.

The changed assignments should stay indented inside the if/else blocks.

Proposed fix

         if (CI::$APP->config->item('controller_suffix') == null) {
-        $class = str_replace('', '', get_class($this));
+            $class = str_replace('', '', get_class($this));
         } else {
-        $class = str_replace(CI::$APP->config->item('controller_suffix'), '', get_class($this));
+            $class = str_replace(CI::$APP->config->item('controller_suffix'), '', get_class($this));
         }

As per coding guidelines, **/*.php: Follow PSR-12 coding standards.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/third_party/MX/Controller.php` around lines 54 - 58, The
assignment to $class has been unindented and should be nested inside the if/else
block; restore proper block indentation so the $class = str_replace(...) lines
remain inside the if and else branches that check
CI::$APP->config->item('controller_suffix'), keeping the existing condition
logic using get_class($this) and str_replace intact and following PSR-12 block
indentation for the Controller class in Controller.php.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Inline comments:
In @.junie/PR-1441-security-dry-analysis.md:
- Around line 1-424: The file .junie/PR-1441-security-dry-analysis.md is an
unrelated analysis for PR `#1441` and must be removed from this PR; delete that
file from the branch (or revert the commit that added it) so only changes
relevant to PR `#1419` remain, then amend the branch/commit history and push the
update; also scan for any references to .junie/PR-1441-security-dry-analysis.md
in the diff or CI/config and remove those references if present.

In `@application/modules/invoices/models/Mdl_invoices.php`:
- Line 90: The overdue CASE currently checks ip_invoices.invoice_status_id NOT
IN (1,4,5,7) but doesn't exclude the archived status; update the condition in
Mdl_invoices.php where (CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7)
AND DATEDIFF(NOW(), invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue to also
exclude the archived status by adding its ID to the NOT IN list (or, if a
constant exists, use that constant such as INVOICE_STATUS_ARCHIVED) so archived
invoices are never marked is_overdue.

In `@application/modules/setup/models/Mdl_setup.php`:
- Around line 60-109: Fix the syntax error and duplicate method: change the
malformed insert closure that uses "));" to "]);" for the ip_payment_methods
insert, remove the entire duplicate private function install_default_settings()
block shown in the diff, and merge the additional default keys from that removed
block (notably 'pdf_invoice_template_unpaid' and 'pdf_invoice_template_partial'
— and any other template defaults present) into the existing
install_default_settings() implementation (the single install_default_settings
function already defined elsewhere) so all defaults are present once.

In `@application/views/invoice_templates/pdf/InvoicePlane` - partial.php:
- Line 308: The watermark uses a capitalized translation key _trans('Partial')
which can miss the existing lowercase key; update the watermarktext content call
(watermarktext content="<?php _trans('Partial'); ?>") to use the lowercase key
_trans('partial') so it matches the status label translation and resolves the
missing translation.
- Around line 31-36: Escape user-controlled invoice fields by wrapping outputs
like $invoice->user_vat_id and $invoice->user_tax_code with html_escape() before
echoing them, and apply the same treatment to other custom fields referenced
around lines 132-137 and 170-177 (e.g., any $invoice->custom_* or similar). Also
fix the Sales Person guard by checking the "Sales Person" field exists/is
non-empty before reading it (do the Sales Person existence check prior to or
instead of relying on the "Lead Source" check) to avoid PHP notices and raw HTML
output; update the view logic (the conditional that reads Sales Person) to first
verify the Sales Person property on $invoice is set and then echo
html_escape($invoice->sales_person) (or the exact property name used in the
diff).
- Around line 190-205: Rows are rendering description before name, which is the
reverse of the table headers; inside the foreach ($items as $item) block swap
the two <td> cells so the first cell outputs the item name and the second
outputs the item description — specifically swap the outputs using
_htmlsc($item->item_name) and nl2br(htmlsc($item->item_description)) in the <td>
elements for the row so they align with the <th class="item-name"> and <th
class="item-desc"> headers.
- Around line 310-324: The footer partial currently contains hard-coded Arox
Marketing legal copy and links inside the <footer> block (the table with class
"w-10" and the "More Links" table); remove this company-specific static HTML and
instead render configurable invoice/footer settings (e.g., use the existing
invoice footer/terms variables or settings such as invoice_footer_text,
invoice_terms, or similar template variables) so site owners control the text
and links; if no such settings exist, replace the static block with a call to
the central footer/terms renderer or leave it empty until a configurable value
is provided.

In `@application/views/invoice_templates/pdf/InvoicePlane` - unpaid.php:
- Around line 31-36: The view is outputting user-controlled fields without
escaping and is reading Sales Person before guarding for its existence; update
the usages of $invoice->user_vat_id and $invoice->user_tax_code (and the other
mentioned blocks at lines ~186-190 and ~224-231) to wrap values with
html_escape() before echoing, and change the Sales Person/Lead Source checks so
you verify isset($invoice->sales_person) (or !empty($invoice->sales_person))
before referencing or echoing it (i.e., check the Sales Person guard prior to
reading/printing it, and only then check Lead Source), ensuring all
user-controlled invoice properties are html_escape()'d in the InvoicePlane -
unpaid.php view.
- Around line 244-259: Row cells inside the foreach loop are emitted in the
wrong order: the code outputs item_description then item_name, but the headers
expect item (name) then description; to fix, swap the two <td> outputs inside
the foreach so the cell that renders $item->item_name (using _htmlsc) appears
first and the cell that renders $item->item_description (using echo
nl2br(htmlsc(...))) appears second, keeping their existing classes (e.g., "py-2
px-1 bt") and any formatting intact.
- Around line 364-378: Remove the hard-coded Arox Marketing legal copy and links
from the footer block in the "InvoicePlane - unpaid.php" template and replace
them with the application's configurable invoice/footer settings (e.g. use the
existing invoice terms/footer variables or settings API such as $invoice_terms
or $invoice_footer provided by the app) so default installs don't ship
company-specific links; update the footer HTML in the template to render those
configurable variables (falling back to an empty or generic notice if unset)
rather than the static Arox Marketing text and anchors.

In `@assets/invoiceplane_blue/sass/_ip_variables.scss`:
- Around line 15-30: The blue theme currently reuses the bright status colors
(e.g. $color_status_unpaid, $color_status_partial, $color_status_viewed,
$color_status_rejected_overdue) which fail contrast with white badge text—update
the blue-theme variables or badge text color so contrast meets accessibility
standards: locate the blue theme's SCSS variables for those same status names
(or the badge component that uses them) and either replace the bright hexes with
darker alternatives or set badge text to a dark color (e.g. switch from white to
a high-contrast text variable) for badges using $color_status_unpaid,
$color_status_partial, $color_status_viewed, $color_status_rejected_overdue and
any other bright status variables to ensure readable contrast.

In `@assets/invoiceplane/sass/_ip_variables.scss`:
- Around line 15-30: The status label colors $color_status_unpaid,
$color_status_partial and $color_status_viewed fail WCAG AA contrast for white
text in the .label styling; fix by either darkening those three variables to
values that reach at least 3:1 contrast against white (replace the hexes for
$color_status_unpaid, $color_status_partial, $color_status_viewed with darker
hexes) or change the label text for those states to a dark text token (e.g. use
an existing $color_text_dark) and update any logic that applies .label text
color so these three statuses use the dark text; ensure after change each status
meets the 3:1 contrast requirement.

---

Outside diff comments:
In `@application/modules/reports/models/Mdl_reports.php`:
- Around line 555-586: The where-clause uses an erroneous (int) cast around
$this->db->escape($minQuantity) which turns the quoted SQL literal into 0;
remove the (int) cast so the code uses $this->db->escape($minQuantity) directly
(leave $this->db->escape($maxQuantity) as-is), locating the change in
Mdl_reports.php in the block that builds the nested SELECTs (look for
$this->db->where(... and the uses of $this->db->escape, $minQuantity and
$maxQuantity) to correct the filter.

In `@assets/core/scss/_core.scss`:
- Around line 671-686: Rename the mistaken selector &.archvied to &.archived and
add a new status selector &.unpaid that sets a background color (use the same
pattern as &.sent / &.viewed: lighten($color_status_unpaid, 10%) or the
appropriate unpaid color variable) so labels with .label (which forces white
text) have a readable background; update the block containing &.draft, &.sent,
&.viewed, &.partial to include &.archived and &.unpaid following the same
lighten(...) pattern.

---

Nitpick comments:
In `@application/modules/invoices/views/index.php`:
- Around line 37-56: The view uses loose comparisons and unescaped outputs;
update each anchor's class conditional to use strict comparison (===) against
$status (e.g., $status === 'partial') and wrap any dynamic output used in
attributes or displayed text with html_escape(), including the site_url() output
and the translation output from _trans() (e.g., class="<?php echo
html_escape($status === 'partial' ? 'btn-primary' : 'btn-default') ?>" and <?php
echo html_escape(_trans('partially paid')); ?> or html_escape(site_url(...)) for
hrefs). Apply the same strict-comparison and html_escape() changes to the other
similar blocks (the later invoice status link group as well).

In `@application/third_party/MX/Controller.php`:
- Around line 54-58: The assignment to $class has been unindented and should be
nested inside the if/else block; restore proper block indentation so the $class
= str_replace(...) lines remain inside the if and else branches that check
CI::$APP->config->item('controller_suffix'), keeping the existing condition
logic using get_class($this) and str_replace intact and following PSR-12 block
indentation for the Controller class in Controller.php.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 8b3331dc-bfa4-4f0b-b1bc-e83a4dd5b935

📥 Commits

Reviewing files that changed from the base of the PR and between 15ea0a8 and a60d3dd.

📒 Files selected for processing (15)

• .github/workflows/quickstart.yml
• .junie/PR-1441-security-dry-analysis.md
• application/modules/invoices/controllers/Invoices.php
• application/modules/invoices/models/Mdl_invoices.php
• application/modules/invoices/views/index.php
• application/modules/reports/models/Mdl_reports.php
• application/modules/setup/models/Mdl_setup.php
• application/modules/setup/sql/016_1.4.4.sql
• application/third_party/MX/Controller.php
• application/views/invoice_templates/pdf/.gitignore
• application/views/invoice_templates/pdf/InvoicePlane - partial.php
• application/views/invoice_templates/pdf/InvoicePlane - unpaid.php
• assets/core/scss/_core.scss
• assets/invoiceplane/sass/_ip_variables.scss
• assets/invoiceplane_blue/sass/_ip_variables.scss

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Remove the unrelated PR #1441 analysis document.

This new file documents security/DRY work for PR #1441, while this PR is #1419 for invoice statuses. Keeping it in the branch adds unrelated internal analysis to the repository and can confuse release notes/reviews.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.junie/PR-1441-security-dry-analysis.md around lines 1 - 424, The file
.junie/PR-1441-security-dry-analysis.md is an unrelated analysis for PR `#1441`
and must be removed from this PR; delete that file from the branch (or revert
the commit that added it) so only changes relevant to PR `#1419` remain, then
amend the branch/commit history and push the update; also scan for any
references to .junie/PR-1441-security-dry-analysis.md in the diff or CI/config
and remove those references if present.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Exclude archived invoices from computed overdue state.

Line 90 excludes draft/paid/partial/unpaid, but not the new archived status. Archived invoices with old due dates can still enter overdue filters and pick overdue PDF/email styling through existing is_overdue consumers.

🐛 Proposed fix

-            (CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7) AND DATEDIFF(NOW(), invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue,
+            (CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7,99) AND DATEDIFF(NOW(), invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue,

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	(CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7) AND DATEDIFF(NOW(), invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue,
	(CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7,99) AND DATEDIFF(NOW(), invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue,

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/modules/invoices/models/Mdl_invoices.php` at line 90, The overdue
CASE currently checks ip_invoices.invoice_status_id NOT IN (1,4,5,7) but doesn't
exclude the archived status; update the condition in Mdl_invoices.php where
(CASE WHEN ip_invoices.invoice_status_id NOT IN (1,4,5,7) AND DATEDIFF(NOW(),
invoice_date_due) > 0 THEN 1 ELSE 0 END) is_overdue to also exclude the archived
status by adding its ID to the NOT IN list (or, if a constant exists, use that
constant such as INVOICE_STATUS_ARCHIVED) so archived invoices are never marked
is_overdue.

[coderabbitai]

⚠️ Potential issue | 🔴 Critical

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Verify the changed setup block and duplicate method declaration without executing repository code.

sed -n '56,110p' application/modules/setup/models/Mdl_setup.php

printf '\ninstall_default_settings declarations:\n'
rg -nP '^\s*private\s+function\s+install_default_settings\s*\(' application/modules/setup/models/Mdl_setup.php

Repository: InvoicePlane/InvoicePlane

Length of output: 2169

---

Remove the duplicate method declaration and fix the malformed array closure.

Line 62 closes the insert with )); instead of ]);, causing a parse error. Lines 68–109 also redeclare install_default_settings(), which already exists at line 451, creating a fatal error. Delete the duplicate method and merge its new template defaults (pdf_invoice_template_unpaid and pdf_invoice_template_partial) into the existing method at line 451.

Proposed fix

         $this->db->insert('ip_payment_methods', [
             'payment_method_name' => 'Credit Card',
-        ));
-    }
-
-    /**
-     *
-     */
-    private function install_default_settings()
-    {
-        $this->load->helper('string');
-
-        $default_settings = array(
-            'default_language' => $this->session->userdata('ip_lang'),
-            'date_format' => 'm/d/Y',
-            'currency_symbol' => '$',
-            'currency_symbol_placement' => 'before',
-            'currency_code' => 'USD',
-            'invoices_due_after' => 30,
-            'quotes_expire_after' => 15,
-            'default_invoice_group' => 3,
-            'default_quote_group' => 4,
-            'thousands_separator' => ',',
-            'decimal_point' => '.',
-            'cron_key' => random_string('alnum', 16),
-            'tax_rate_decimal_places' => 2,
-            'pdf_invoice_template' => 'InvoicePlane',
-            'pdf_invoice_template_paid' => 'InvoicePlane - paid',
-            'pdf_invoice_template_unpaid' => 'InvoicePlane - unpaid',
-            'pdf_invoice_template_partial' => 'InvoicePlane - partial',
-            'pdf_invoice_template_overdue' => 'InvoicePlane - overdue',
-            'pdf_quote_template' => 'InvoicePlane',
-            'public_invoice_template' => 'InvoicePlane_Web',
-            'public_quote_template' => 'InvoicePlane_Web',
-            'disable_sidebar' => 1,
-        );
-
-        foreach ($default_settings as $setting_key => $setting_value) {
-            $this->db->where('setting_key', $setting_key);
-
-            if (!$this->db->get('ip_settings')->num_rows()) {
-                $db_array = array(
-                    'setting_key' => $setting_key,
-                    'setting_value' => $setting_value
-                );
-
-                $this->db->insert('ip_settings', $db_array);
-            }
-        }
+        ]);
     }

Then add the missing defaults to the existing method at line 451:

             'pdf_invoice_template'         => 'InvoicePlane',
             'pdf_invoice_template_paid'    => 'InvoicePlane - paid',
+            'pdf_invoice_template_unpaid'  => 'InvoicePlane - unpaid',
+            'pdf_invoice_template_partial' => 'InvoicePlane - partial',
             'pdf_invoice_template_overdue' => 'InvoicePlane - overdue',

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	$this->db->insert('ip_payment_methods', [
	'payment_method_name' => 'Credit Card',
	]);
	));
	}
	/**
	*
	*/
	private function install_default_settings()
	{
	$this->load->helper('string');
	$default_settings = array(
	'default_language' => $this->session->userdata('ip_lang'),
	'date_format' => 'm/d/Y',
	'currency_symbol' => '$',
	'currency_symbol_placement' => 'before',
	'currency_code' => 'USD',
	'invoices_due_after' => 30,
	'quotes_expire_after' => 15,
	'default_invoice_group' => 3,
	'default_quote_group' => 4,
	'thousands_separator' => ',',
	'decimal_point' => '.',
	'cron_key' => random_string('alnum', 16),
	'tax_rate_decimal_places' => 2,
	'pdf_invoice_template' => 'InvoicePlane',
	'pdf_invoice_template_paid' => 'InvoicePlane - paid',
	'pdf_invoice_template_unpaid' => 'InvoicePlane - unpaid',
	'pdf_invoice_template_partial' => 'InvoicePlane - partial',
	'pdf_invoice_template_overdue' => 'InvoicePlane - overdue',
	'pdf_quote_template' => 'InvoicePlane',
	'public_invoice_template' => 'InvoicePlane_Web',
	'public_quote_template' => 'InvoicePlane_Web',
	'disable_sidebar' => 1,
	);
	foreach ($default_settings as $setting_key => $setting_value) {
	$this->db->where('setting_key', $setting_key);
	if (!$this->db->get('ip_settings')->num_rows()) {
	$db_array = array(
	'setting_key' => $setting_key,
	'setting_value' => $setting_value
	);
	$this->db->insert('ip_settings', $db_array);
	}
	}
	}
	$this->db->insert('ip_payment_methods', [
	'payment_method_name' => 'Credit Card',
	]);
	}

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/modules/setup/models/Mdl_setup.php` around lines 60 - 109, Fix
the syntax error and duplicate method: change the malformed insert closure that
uses "));" to "]);" for the ip_payment_methods insert, remove the entire
duplicate private function install_default_settings() block shown in the diff,
and merge the additional default keys from that removed block (notably
'pdf_invoice_template_unpaid' and 'pdf_invoice_template_partial' — and any other
template defaults present) into the existing install_default_settings()
implementation (the single install_default_settings function already defined
elsewhere) so all defaults are present once.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Escape these invoice fields and fix the Sales Person guard.

VAT/tax IDs and custom fields are user-controlled. Line 170 also checks Lead Source before reading Sales Person, which can emit notices and raw HTML.

🛡️ Proposed fix

                         <?php if ($invoice->user_vat_id) {
-                            echo lang('vat_id_short') . ': ' . $invoice->user_vat_id . '<br>';
+                            echo lang('vat_id_short') . ': ' . htmlsc($invoice->user_vat_id) . '<br>';
                         } ?>
                         <?php if ($invoice->user_tax_code) {
-                            echo lang('tax_code_short') . ': ' . $invoice->user_tax_code . '<br>';
+                            echo lang('tax_code_short') . ': ' . htmlsc($invoice->user_tax_code) . '<br>';
                         } ?>

                         <?php if ($invoice->client_vat_id) {
-                            echo lang('vat_id_short') . ': ' . $invoice->client_vat_id . '<br>';
+                            echo lang('vat_id_short') . ': ' . htmlsc($invoice->client_vat_id) . '<br>';
                         } ?>
                         <?php if ($invoice->client_tax_code) {
-                            echo lang('tax_code_short') . ': ' . $invoice->client_tax_code . '<br>';
+                            echo lang('tax_code_short') . ': ' . htmlsc($invoice->client_tax_code) . '<br>';
                         } ?>

-                            <?php if (isset($custom_fields['invoice']['Lead Source'])): ?>     
+                            <?php if (isset($custom_fields['invoice']['Sales Person'])): ?>     
                                 <tr>                                    
                                     <td class="text-bold bt px-1">
                                         <?php echo trans('Sales Person:'); ?>
                                     </td>
                                     <td class="text-right bt px-1">
-                                        <?php echo $custom_fields['invoice']['Sales Person'] ?>
+                                        <?php echo htmlsc($custom_fields['invoice']['Sales Person']); ?>
                                     </td>                                    
                                 </tr>
                             <?php endif; ?>

As per coding guidelines, “Always use html_escape() for output encoding in views to prevent XSS vulnerabilities.”

Also applies to: 132-137, 170-177

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/views/invoice_templates/pdf/InvoicePlane` - partial.php around
lines 31 - 36, Escape user-controlled invoice fields by wrapping outputs like
$invoice->user_vat_id and $invoice->user_tax_code with html_escape() before
echoing them, and apply the same treatment to other custom fields referenced
around lines 132-137 and 170-177 (e.g., any $invoice->custom_* or similar). Also
fix the Sales Person guard by checking the "Sales Person" field exists/is
non-empty before reading it (do the Sales Person existence check prior to or
instead of relying on the "Lead Source" check) to avoid PHP notices and raw HTML
output; update the view logic (the conditional that reads Sales Person) to first
verify the Sales Person property on $invoice is set and then echo
html_escape($invoice->sales_person) (or the exact property name used in the
diff).

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Swap item name and description cells to match the headers.

The table header renders item before description, but each row currently outputs description before name.

🐛 Proposed fix

-                            <td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>
-                            <td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
+                            <td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
+                            <td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/views/invoice_templates/pdf/InvoicePlane` - partial.php around
lines 190 - 205, Rows are rendering description before name, which is the
reverse of the table headers; inside the foreach ($items as $item) block swap
the two <td> cells so the first cell outputs the item name and the second
outputs the item description — specifically swap the outputs using
_htmlsc($item->item_name) and nl2br(htmlsc($item->item_description)) in the <td>
elements for the row so they align with the <th class="item-name"> and <th
class="item-desc"> headers.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Escape these invoice fields and fix the Sales Person guard.

VAT/tax IDs and custom fields are user-controlled. Line 224 also checks Lead Source before reading Sales Person, which can emit notices and raw HTML.

🛡️ Proposed fix

                             <?php if ($invoice->user_vat_id) {
-                                echo lang('vat_id_short') . ': ' . $invoice->user_vat_id . '<br>';
+                                echo lang('vat_id_short') . ': ' . htmlsc($invoice->user_vat_id) . '<br>';
                             } ?>
                             <?php if ($invoice->user_tax_code) {
-                                echo lang('tax_code_short') . ': ' . $invoice->user_tax_code . '<br>';
+                                echo lang('tax_code_short') . ': ' . htmlsc($invoice->user_tax_code) . '<br>';
                             } ?>

                             <?php if ($invoice->client_vat_id) {
-                                echo lang('vat_id_short') . ': ' . $invoice->client_vat_id . '<br>';
+                                echo lang('vat_id_short') . ': ' . htmlsc($invoice->client_vat_id) . '<br>';
                             } ?>
                             <?php if ($invoice->client_tax_code) {
-                                echo lang('tax_code_short') . ': ' . $invoice->client_tax_code . '<br>';
+                                echo lang('tax_code_short') . ': ' . htmlsc($invoice->client_tax_code) . '<br>';
                             } ?>

-                                <?php if (isset($custom_fields['invoice']['Lead Source'])): ?>     
+                                <?php if (isset($custom_fields['invoice']['Sales Person'])): ?>     
                                     <tr>                                    
                                         <td class="text-bold bt px-1">
                                            <?php echo trans('Sales Person:'); ?>
                                         </td>
                                         <td class="text-right bt px-1">
-                                           <?php echo $custom_fields['invoice']['Sales Person'] ?>
+                                           <?php echo htmlsc($custom_fields['invoice']['Sales Person']); ?>
                                         </td>                                    
                                     </tr>
                                 <?php endif; ?>

As per coding guidelines, “Always use html_escape() for output encoding in views to prevent XSS vulnerabilities.”

Also applies to: 186-190, 224-231

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/views/invoice_templates/pdf/InvoicePlane` - unpaid.php around
lines 31 - 36, The view is outputting user-controlled fields without escaping
and is reading Sales Person before guarding for its existence; update the usages
of $invoice->user_vat_id and $invoice->user_tax_code (and the other mentioned
blocks at lines ~186-190 and ~224-231) to wrap values with html_escape() before
echoing, and change the Sales Person/Lead Source checks so you verify
isset($invoice->sales_person) (or !empty($invoice->sales_person)) before
referencing or echoing it (i.e., check the Sales Person guard prior to
reading/printing it, and only then check Lead Source), ensuring all
user-controlled invoice properties are html_escape()'d in the InvoicePlane -
unpaid.php view.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Swap item name and description cells to match the headers.

The table header renders item before description, but each row currently outputs description before name.

🐛 Proposed fix

-                                <td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>
-                                <td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
+                                <td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
+                                <td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>

📝 Committable suggestion

‼️ IMPORTANT
Carefully review the code before committing. Ensure that it accurately replaces the highlighted code, contains no missing lines, and has no issues with indentation. Thoroughly test & benchmark the code to ensure it meets the requirements.

Suggested change

	<th class="item-name"><?php _trans('item'); ?></th>
	<th class="item-desc"><?php _trans('description'); ?></th>
	<th class="item-amount text-right py-2 px-1"><?php _trans('qty'); ?></th>
	<th class="item-price text-right py-2 px-1"><?php _trans('price'); ?></th>
	<?php if ($show_item_discounts) : ?>
	<th class="item-discount text-right py-2 px-1"><?php _trans('discount'); ?></th>
	<?php endif; ?>
	<th class="item-total text-right py-2 px-1"><?php _trans('total'); ?></th>
	</tr>
	</thead>
	<tbody>
	<?php
	foreach ($items as $item) { ?>
	<tr>
	<td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>
	<td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
	<th class="item-name"><?php _trans('item'); ?></th>
	<th class="item-desc"><?php _trans('description'); ?></th>
	<th class="item-amount text-right py-2 px-1"><?php _trans('qty'); ?></th>
	<th class="item-price text-right py-2 px-1"><?php _trans('price'); ?></th>
	<?php if ($show_item_discounts) : ?>
	<th class="item-discount text-right py-2 px-1"><?php _trans('discount'); ?></th>
	<?php endif; ?>
	<th class="item-total text-right py-2 px-1"><?php _trans('total'); ?></th>
	</tr>
	</thead>
	<tbody>
	<?php
	foreach ($items as $item) { ?>
	<tr>
	<td class="py-2 px-1 bt"><?php _htmlsc($item->item_name); ?></td>
	<td class="py-2 px-1 bt"><?php echo nl2br(htmlsc($item->item_description)); ?></td>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/views/invoice_templates/pdf/InvoicePlane` - unpaid.php around
lines 244 - 259, Row cells inside the foreach loop are emitted in the wrong
order: the code outputs item_description then item_name, but the headers expect
item (name) then description; to fix, swap the two <td> outputs inside the
foreach so the cell that renders $item->item_name (using _htmlsc) appears first
and the cell that renders $item->item_description (using echo
nl2br(htmlsc(...))) appears second, keeping their existing classes (e.g., "py-2
px-1 bt") and any formatting intact.

[coderabbitai]

⚠️ Potential issue | 🟠 Major

Remove company-specific legal copy from the default template.

This new unpaid template is installed as a default, so the Arox Marketing policy/terms/blog links would appear on other users’ invoices. Use configurable invoice terms/footer settings instead.

🧹 Proposed fix

-            <table class="w-10">
-                <tr>
-                    <td class="text-red" style="font-size: 12px;">
-                    <b>Note:</b> Payment/Order Confirmation automatically confirms customer declaration to Accept All <a href="https://aroxmarketing.com/policies">Policies</a>, & <a href="https://aroxmarketing.com/terms">Terms & Conditions</a> of Arox Marketing (Pvt) Ltd.
-                    </td>
-                </tr>
-            </table>
-            <table class="mt-2">
-                <tr>
-                    <td style="font-size: 10px">
-                        <b>More Links: </b><a href="https://aroxmarketing.com/blog">Latest News</a> | <a href="https://aroxmarketing.com/about">About Us</a> | <a href="https://aroxmarketing.com/contact">Contact Us</a>
-                    </td>
-                </tr>
-            </table>

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@application/views/invoice_templates/pdf/InvoicePlane` - unpaid.php around
lines 364 - 378, Remove the hard-coded Arox Marketing legal copy and links from
the footer block in the "InvoicePlane - unpaid.php" template and replace them
with the application's configurable invoice/footer settings (e.g. use the
existing invoice terms/footer variables or settings API such as $invoice_terms
or $invoice_footer provided by the app) so default installs don't ship
company-specific links; update the footer HTML in the template to render those
configurable variables (falling back to an empty or generic notice if unset)
rather than the static Arox Marketing text and anchors.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

Apply the same contrast check to the blue theme.

The blue theme inherits the same bright status colors, so any white-text status badges will have the same readability issue.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@assets/invoiceplane_blue/sass/_ip_variables.scss` around lines 15 - 30, The
blue theme currently reuses the bright status colors (e.g. $color_status_unpaid,
$color_status_partial, $color_status_viewed, $color_status_rejected_overdue)
which fail contrast with white badge text—update the blue-theme variables or
badge text color so contrast meets accessibility standards: locate the blue
theme's SCSS variables for those same status names (or the badge component that
uses them) and either replace the bright hexes with darker alternatives or set
badge text to a dark color (e.g. switch from white to a high-contrast text
variable) for badges using $color_status_unpaid, $color_status_partial,
$color_status_viewed, $color_status_rejected_overdue and any other bright status
variables to ensure readable contrast.

[coderabbitai]

⚠️ Potential issue | 🟡 Minor

🧩 Analysis chain

🏁 Script executed:

#!/bin/bash
# Check contrast ratios for the changed colors against white and dark text, and find status-label usage.

python - <<'PY'
def lum(hex_color):
    rgb = [int(hex_color[i:i+2], 16) / 255 for i in (1, 3, 5)]
    vals = []
    for c in rgb:
        vals.append(c / 12.92 if c <= 0.03928 else ((c + 0.055) / 1.055) ** 2.4)
    return 0.2126 * vals[0] + 0.7152 * vals[1] + 0.0722 * vals[2]

def contrast(a, b):
    la, lb = lum(a), lum(b)
    hi, lo = max(la, lb), min(la, lb)
    return (hi + 0.05) / (lo + 0.05)

for color in ['#FFD700', '#FF951B', '#F85306', '#FB110F']:
    print(color, 'vs white:', round(contrast(color, '#FFFFFF'), 2), 'vs `#212529`:', round(contrast(color, '#212529'), 2))
PY

rg -n '\$color_status_(unpaid|partial|viewed|rejected_overdue|inactive)|\.label\.(unpaid|partial|viewed|overdue|archived)' --glob '*.scss'

Repository: InvoicePlane/InvoicePlane

Length of output: 1670

---

🏁 Script executed:

# Check the context around lines 681, 685, 695, 707 where background-color is set
sed -n '680,710p' assets/core/scss/_core.scss

Repository: InvoicePlane/InvoicePlane

Length of output: 656

---

🏁 Script executed:

# Find the broader context - look for the parent rule and any text color definitions
sed -n '670,710p' assets/core/scss/_core.scss

Repository: InvoicePlane/InvoicePlane

Length of output: 817

---

🏁 Script executed:

# Look further up to find the parent rule and any color/text-color definitions
sed -n '650,710p' assets/core/scss/_core.scss

Repository: InvoicePlane/InvoicePlane

Length of output: 1213

---

🏁 Script executed:

# Calculate the lightened color values and their contrast with white text
python - <<'PY'
from colorsys import rgb_to_hls, hls_to_rgb

def hex_to_rgb(hex_color):
    return tuple(int(hex_color[i:i+2], 16) for i in (1, 3, 5))

def rgb_to_hex(rgb):
    return '#{:02x}{:02x}{:02x}'.format(int(rgb[0]), int(rgb[1]), int(rgb[2]))

def lighten_scss(hex_color, percent):
    """Simulate SCSS lighten() function - increase lightness by percent in HSL"""
    r, g, b = [x / 255.0 for x in hex_to_rgb(hex_color)]
    h, l, s = rgb_to_hls(r, g, b)
    l = min(1.0, l + percent / 100.0)  # Increase lightness
    r, g, b = hls_to_rgb(h, l, s)
    return rgb_to_hex(tuple(x * 255 for x in (r, g, b)))

def lum(hex_color):
    rgb = [int(hex_color[i:i+2], 16) / 255 for i in (1, 3, 5)]
    vals = []
    for c in rgb:
        vals.append(c / 12.92 if c <= 0.03928 else ((c + 0.055) / 1.055) ** 2.4)
    return 0.2126 * vals[0] + 0.7152 * vals[1] + 0.0722 * vals[2]

def contrast(a, b):
    la, lb = lum(a), lum(b)
    hi, lo = max(la, lb), min(la, lb)
    return (hi + 0.05) / (lo + 0.05)

colors = {'#FFD700': 'unpaid', '#FF951B': 'partial', '#F85306': 'viewed', '#FB110F': 'rejected_overdue/inactive'}
print("Original colors vs white text:")
for orig, name in colors.items():
    lightened = lighten_scss(orig, 10)
    c = contrast(lightened, '#FFFFFF')
    status = "✓ PASS" if c >= 3.0 else "✗ FAIL"
    print(f"  {name:20s} {orig} → {lightened} (lightened 10%) = {c:.2f}:1 {status}")
PY

Repository: InvoicePlane/InvoicePlane

Length of output: 396

---

Fix insufficient contrast for white text on lightened status label backgrounds.

The .label class uses white text on lightened background colors. Three status labels fail WCAG AA contrast requirements:

• Unpaid (#FFD700 → #ffdf32): 1.32:1 (fails; needs 3:1)
• Partial (#FF951B → #ffac4d): 1.86:1 (fails; needs 3:1)
• Viewed (#F85306 → #fa7436): 2.76:1 (fails; needs 3:1)

Use darker background colors or switch to dark text for these labels.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In `@assets/invoiceplane/sass/_ip_variables.scss` around lines 15 - 30, The status
label colors $color_status_unpaid, $color_status_partial and
$color_status_viewed fail WCAG AA contrast for white text in the .label styling;
fix by either darkening those three variables to values that reach at least 3:1
contrast against white (replace the hexes for $color_status_unpaid,
$color_status_partial, $color_status_viewed with darker hexes) or change the
label text for those states to a dark text token (e.g. use an existing
$color_text_dark) and update any logic that applies .label text color so these
three statuses use the dark text; ensure after change each status meets the 3:1
contrast requirement.