Upload 2 files

db.py

@@ -1,215 +1,245 @@
-import os
-from contextlib import contextmanager
-from typing import Any, Dict, List, Optional, Sequence
-
-import psycopg2
-from psycopg2.extras import RealDictCursor
-
-DATABASE_URL = os.environ.get("NEON_DATABASE_URL")
-
-if not DATABASE_URL:
-    raise RuntimeError(
-        "Brak zmiennej NEON_DATABASE_URL. Ustaw sekret w Hugging Face lub "
-        "ustaw zmienną środowiskową lokalnie."
-    )
-
-
-
-@contextmanager
-def db_conn():
-    conn = psycopg2.connect(DATABASE_URL, cursor_factory=RealDictCursor)
-    try:
-        yield conn
-        conn.commit()
-    except Exception:
-        conn.rollback()
-        raise
-    finally:
-        conn.close()
-
-
-def fetch_one(query: str, params: Sequence[Any]) -> Optional[Dict[str, Any]]:
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(query, params)
-        return cur.fetchone()
-
-
-def fetch_all(query: str, params: Sequence[Any] = ()) -> List[Dict[str, Any]]:
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(query, params)
-        return cur.fetchall()
-
-
-def execute(query: str, params: Sequence[Any]) -> None:
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(query, params)
-
-
-def create_account(login: str, email: str, password_hash: str) -> int:
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(
-            """
-            INSERT INTO accounts (login, password_hash)
-            VALUES (%s, %s)
-            RETURNING id
-            """,
-            (login, password_hash),
-        )
-        account_id = cur.fetchone()["id"]
-        cur.execute(
-            """
-            INSERT INTO business_profiles (account_id, company_name, owner_name,
-                                           address_line, postal_code, city, tax_id, bank_account)
-            VALUES (%s, '', '', '', '', '', '', '')
-            """,
-            (account_id,),
-        )
-        return account_id
-
-
-def update_business(account_id: int, data: Dict[str, str]) -> None:
-    execute(
-        """
-        UPDATE business_profiles
-        SET company_name = %s,
-            owner_name = %s,
-            address_line = %s,
-            postal_code = %s,
-            city = %s,
-            tax_id = %s,
-            bank_account = %s
-        WHERE account_id = %s
-        """,
-        (
-            data["company_name"],
-            data["owner_name"],
-            data["address_line"],
-            data["postal_code"],
-            data["city"],
-            data["tax_id"],
-            data["bank_account"],
-            account_id,
-        ),
-    )
-
-
-def upsert_client(account_id: int, payload: Dict[str, str]) -> int:
-    row = fetch_one(
-        """
-        SELECT id FROM clients
-        WHERE account_id = %s AND tax_id = %s
-        """,
-        (account_id, payload["tax_id"]),
-    )
-    if row:
-        client_id = row["id"]
-        execute(
-            """
-            UPDATE clients
-            SET name = %s,
-                address_line = %s,
-                postal_code = %s,
-                city = %s,
-                phone = %s
-            WHERE id = %s
-            """,
-            (
-                payload["name"],
-                payload["address_line"],
-                payload["postal_code"],
-                payload["city"],
-                payload.get("phone"),
-                client_id,
-            ),
-        )
-        return client_id
-
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(
-            """
-            INSERT INTO clients (account_id, name, address_line, postal_code, city, tax_id, phone)
-            VALUES (%s, %s, %s, %s, %s, %s, %s)
-            RETURNING id
-            """,
-            (
-                account_id,
-                payload["name"],
-                payload["address_line"],
-                payload["postal_code"],
-                payload["city"],
-                payload["tax_id"],
-                payload.get("phone"),
-            ),
-        )
-        return cur.fetchone()["id"]
-
-
-def insert_invoice(account_id: int, client_id: int, invoice: Dict[str, Any]) -> int:
-    with db_conn() as conn, conn.cursor() as cur:
-        cur.execute(
-            """
-            INSERT INTO invoices (account_id, client_id, invoice_number, issued_at,
-                                  sale_date, payment_term_days, exemption_note,
-                                  total_net, total_vat, total_gross)
-            VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
-            RETURNING id
-            """,
-            (
-                account_id,
-                client_id,
-                invoice["invoice_id"],
-                invoice["issued_at"],
-                invoice["sale_date"],
-                invoice.get("payment_term", 14),
-                invoice.get("exemption_note"),
-                invoice["totals"]["net"],
-                invoice["totals"]["vat"],
-                invoice["totals"]["gross"],
-            ),
-        )
-        invoice_id = cur.fetchone()["id"]
-
-        cur.executemany(
-            """
-            INSERT INTO invoice_items (invoice_id, line_no, name, quantity, unit,
-                                       vat_code, vat_label, unit_price_net,
-                                       unit_price_gross, net_total, vat_amount, gross_total)
-            VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
-            """,
-            [
-                (
-                    invoice_id,
-                    idx + 1,
-                    item["name"],
-                    item["quantity"],
-                    item.get("unit"),
-                    item.get("vat_code"),
-                    item.get("vat_label"),
-                    item["unit_price_net"],
-                    item["unit_price_gross"],
-                    item["net_total"],
-                    item["vat_amount"],
-                    item["gross_total"],
-                )
-                for idx, item in enumerate(invoice["items"])
-            ],
-        )
-
-        cur.executemany(
-            """
-            INSERT INTO invoice_vat_summary (invoice_id, vat_label, net_total, vat_total, gross_total)
-            VALUES (%s, %s, %s, %s, %s)
-            """,
-            [
-                (
-                    invoice_id,
-                    row["vat_label"],
-                    row["net_total"],
-                    row["vat_total"],
-                    row["gross_total"],
-                )
-                for row in invoice["summary"]
-            ],
-        )
-
-        return invoice_id
+import os
+from contextlib import contextmanager
+from typing import Any, Dict, List, Optional, Sequence
+
+import psycopg2
+from psycopg2.extras import RealDictCursor
+
+DATABASE_URL = os.environ.get("NEON_DATABASE_URL")
+
+if not DATABASE_URL:
+    raise RuntimeError(
+        "Brak zmiennej NEON_DATABASE_URL. Ustaw sekret w Hugging Face lub "
+        "ustaw zmienną środowiskową lokalnie."
+    )
+
+
+
+@contextmanager
+def db_conn():
+    conn = psycopg2.connect(DATABASE_URL, cursor_factory=RealDictCursor)
+    try:
+        yield conn
+        conn.commit()
+    except Exception:
+        conn.rollback()
+        raise
+    finally:
+        conn.close()
+
+
+def fetch_one(query: str, params: Sequence[Any]) -> Optional[Dict[str, Any]]:
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(query, params)
+        return cur.fetchone()
+
+
+def fetch_all(query: str, params: Sequence[Any] = ()) -> List[Dict[str, Any]]:
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(query, params)
+        return cur.fetchall()
+
+
+def execute(query: str, params: Sequence[Any]) -> None:
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(query, params)
+
+
+def create_account(login: str, email: str, password_hash: str) -> int:
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(
+            """
+            INSERT INTO accounts (login, password_hash)
+            VALUES (%s, %s)
+            RETURNING id
+            """,
+            (login, password_hash),
+        )
+        account_id = cur.fetchone()["id"]
+        cur.execute(
+            """
+            INSERT INTO business_profiles (account_id, company_name, owner_name,
+                                           address_line, postal_code, city, tax_id, bank_account)
+            VALUES (%s, '', '', '', '', '', '', '')
+            """,
+            (account_id,),
+        )
+        return account_id
+
+
+def update_business(account_id: int, data: Dict[str, str]) -> None:
+    execute(
+        """
+        UPDATE business_profiles
+        SET company_name = %s,
+            owner_name = %s,
+            address_line = %s,
+            postal_code = %s,
+            city = %s,
+            tax_id = %s,
+            bank_account = %s
+        WHERE account_id = %s
+        """,
+        (
+            data["company_name"],
+            data["owner_name"],
+            data["address_line"],
+            data["postal_code"],
+            data["city"],
+            data["tax_id"],
+            data["bank_account"],
+            account_id,
+        ),
+    )
+
+
+
+def fetch_business_logo(account_id: int) -> Optional[Dict[str, Optional[str]]]:
+    row = fetch_one(
+        """
+        SELECT logo_mime_type, logo_data_base64
+        FROM business_profiles
+        WHERE account_id = %s
+        """,
+        (account_id,),
+    )
+    if not row:
+        return None
+    mime_type = row.get("logo_mime_type")
+    data_base64 = row.get("logo_data_base64")
+    if not mime_type or not data_base64:
+        return None
+    return {"mime_type": mime_type, "data": data_base64}
+
+
+def update_business_logo(account_id: int, mime: Optional[str], data_base64: Optional[str]) -> None:
+    execute(
+        """
+        UPDATE business_profiles
+        SET logo_mime_type = %s,
+            logo_data_base64 = %s
+        WHERE account_id = %s
+        """,
+        (mime, data_base64, account_id),
+    )
+
+def upsert_client(account_id: int, payload: Dict[str, str]) -> int:
+    row = fetch_one(
+        """
+        SELECT id FROM clients
+        WHERE account_id = %s AND tax_id = %s
+        """,
+        (account_id, payload["tax_id"]),
+    )
+    if row:
+        client_id = row["id"]
+        execute(
+            """
+            UPDATE clients
+            SET name = %s,
+                address_line = %s,
+                postal_code = %s,
+                city = %s,
+                phone = %s
+            WHERE id = %s
+            """,
+            (
+                payload["name"],
+                payload["address_line"],
+                payload["postal_code"],
+                payload["city"],
+                payload.get("phone"),
+                client_id,
+            ),
+        )
+        return client_id
+
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(
+            """
+            INSERT INTO clients (account_id, name, address_line, postal_code, city, tax_id, phone)
+            VALUES (%s, %s, %s, %s, %s, %s, %s)
+            RETURNING id
+            """,
+            (
+                account_id,
+                payload["name"],
+                payload["address_line"],
+                payload["postal_code"],
+                payload["city"],
+                payload["tax_id"],
+                payload.get("phone"),
+            ),
+        )
+        return cur.fetchone()["id"]
+
+
+def insert_invoice(account_id: int, client_id: int, invoice: Dict[str, Any]) -> int:
+    with db_conn() as conn, conn.cursor() as cur:
+        cur.execute(
+            """
+            INSERT INTO invoices (account_id, client_id, invoice_number, issued_at,
+                                  sale_date, payment_term_days, exemption_note,
+                                  total_net, total_vat, total_gross)
+            VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+            RETURNING id
+            """,
+            (
+                account_id,
+                client_id,
+                invoice["invoice_id"],
+                invoice["issued_at"],
+                invoice["sale_date"],
+                invoice.get("payment_term", 14),
+                invoice.get("exemption_note"),
+                invoice["totals"]["net"],
+                invoice["totals"]["vat"],
+                invoice["totals"]["gross"],
+            ),
+        )
+        invoice_id = cur.fetchone()["id"]
+
+        cur.executemany(
+            """
+            INSERT INTO invoice_items (invoice_id, line_no, name, quantity, unit,
+                                       vat_code, vat_label, unit_price_net,
+                                       unit_price_gross, net_total, vat_amount, gross_total)
+            VALUES (%s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s, %s)
+            """,
+            [
+                (
+                    invoice_id,
+                    idx + 1,
+                    item["name"],
+                    item["quantity"],
+                    item.get("unit"),
+                    item.get("vat_code"),
+                    item.get("vat_label"),
+                    item["unit_price_net"],
+                    item["unit_price_gross"],
+                    item["net_total"],
+                    item["vat_amount"],
+                    item["gross_total"],
+                )
+                for idx, item in enumerate(invoice["items"])
+            ],
+        )
+
+        cur.executemany(
+            """
+            INSERT INTO invoice_vat_summary (invoice_id, vat_label, net_total, vat_total, gross_total)
+            VALUES (%s, %s, %s, %s, %s)
+            """,
+            [
+                (
+                    invoice_id,
+                    row["vat_label"],
+                    row["net_total"],
+                    row["vat_total"],
+                    row["gross_total"],
+                )
+                for row in invoice["summary"]
+            ],
+        )
+
+        return invoice_id

server.py

@@ -1,672 +1,711 @@
-import base64
-import binascii
-import hashlib
-import json
-import os
-import re
-import uuid
-from datetime import date, datetime, timedelta
-from decimal import Decimal, ROUND_HALF_UP, getcontext
-from pathlib import Path
-from typing import Any, Dict, List, Optional, Tuple
-
-from flask import Flask, jsonify, request, send_from_directory
-
-from db import (
-    create_account,
-    fetch_all,
-    fetch_one,
-    insert_invoice,
-    update_business,
-    upsert_client,
-)
-
-APP_ROOT = Path(__file__).parent.resolve()
-DATA_DIR = Path(os.environ.get("DATA_DIR", APP_ROOT))
-DATA_FILE = DATA_DIR / "web_invoice_store.json"
-INVOICE_HISTORY_LIMIT = 200
-MAX_LOGO_SIZE = 512 * 1024  # 512 KB
-TOKEN_TTL = timedelta(hours=12)
-ALLOWED_LOGO_MIME_TYPES = {"image/png", "image/jpeg"}
-
-DATABASE_AVAILABLE = bool(os.environ.get("NEON_DATABASE_URL"))
-
-VAT_RATES: Dict[str, Optional[Decimal]] = {
-    "23": Decimal("0.23"),
-    "8": Decimal("0.08"),
-    "5": Decimal("0.05"),
-    "0": Decimal("0.00"),
-    "ZW": None,
-    "NP": None,
-}
-
-DEFAULT_UNIT = "szt."
-ALLOWED_UNITS = {"szt.", "godz."}
-PASSWORD_MIN_LENGTH = 4
-
-SESSION_TOKENS: Dict[str, Dict[str, Any]] = {}
-
-ALLOWED_STATIC = {
-    "index.html",
-    "styles.css",
-    "main.js",
-    "favicon.ico",
-    "Roboto-VariableFont_wdth,wght.ttf",
-}
-
-
-app = Flask(__name__, static_folder=str(APP_ROOT), static_url_path="")
-
-getcontext().prec = 10
-
-
-def _quantize(value: Decimal) -> Decimal:
-    return value.quantize(Decimal("0.01"), rounding=ROUND_HALF_UP)
-
-
-def _decimal(value: Any) -> Decimal:
-    try:
-        return Decimal(str(value))
-    except Exception as error:  # pragma: no cover - defensive
-        raise ValueError(f"Niepoprawna wartosc liczby: {value}") from error
-
-
-def hash_password(password: str) -> str:
-    return hashlib.sha256(password.encode("utf-8")).hexdigest()
-
-
-EMAIL_PATTERN = re.compile(r"^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$")
-
-
-def normalize_email(raw_email: str) -> Tuple[str, str]:
-    display_email = (raw_email or "").strip()
-    if not display_email:
-        raise ValueError("Email nie moze byc pusty.")
-    if not EMAIL_PATTERN.fullmatch(display_email):
-        raise ValueError("Podaj poprawny adres email.")
-    return display_email.lower(), display_email
-
-
-def sanitize_filename(filename: Optional[str]) -> str:
-    if not filename:
-        return "logo"
-    name = str(filename).split("/")[-1].split("\\")[-1]
-    sanitized = re.sub(r"[^A-Za-z0-9._-]", "_", name).strip("._")
-    return sanitized or "logo"
-
-
-def find_account_identifier(accounts: Dict[str, Any], identifier: str) -> Tuple[Optional[str], Optional[Dict[str, Any]]]:
-    key = (identifier or "").strip().lower()
-    if not key:
-        return None, None
-    account = accounts.get(key)
-    if account:
-        return key, account
-    for login_key, candidate in accounts.items():
-        candidate_login = (candidate.get("login") or "").strip().lower()
-        candidate_email = (candidate.get("email") or "").strip().lower()
-        if key in {candidate_login, candidate_email}:
-            return login_key, candidate
-    return None, None
-
-
-def load_store() -> Dict[str, Any]:
-    if not DATA_FILE.exists():
-        return {"accounts": {}}
-    try:
-        with DATA_FILE.open("r", encoding="utf-8") as handle:
-            data = json.load(handle)
-    except json.JSONDecodeError:
-        raise ValueError("Plik z danymi jest uszkodzony.")
-    return data
-
-
-def save_store(data: Dict[str, Any]) -> None:
-    DATA_DIR.mkdir(parents=True, exist_ok=True)
-    tmp_path = DATA_FILE.with_suffix(".tmp")
-    with tmp_path.open("w", encoding="utf-8") as handle:
-        json.dump(data, handle, ensure_ascii=False, indent=2)
-    tmp_path.replace(DATA_FILE)
-
-
-def get_account(data: Dict[str, Any], login_key: str) -> Dict[str, Any]:
-    accounts = data.get("accounts") or {}
-    account = accounts.get(login_key)
-    if not account:
-        raise KeyError("Nie znaleziono konta.")
-    return account
-
-
-def get_account_row(login_key: str) -> Dict[str, Any]:
-    row = fetch_one("SELECT id, login FROM accounts WHERE login = %s", (login_key,))
-    if not row:
-        raise KeyError("Nie znaleziono konta.")
-    return row
-
-
-def require_auth() -> str:
-    auth_header = request.headers.get("Authorization")
-    if not auth_header or not auth_header.startswith("Bearer "):
-        raise PermissionError("Brak tokenu.")
-    token = auth_header.split(" ", 1)[1].strip()
-    session = SESSION_TOKENS.get(token)
-    if not session:
-        raise PermissionError("Nieprawidlowy token.")
-    if session["expires_at"] < datetime.utcnow():
-        SESSION_TOKENS.pop(token, None)
-        raise PermissionError("Token wygasl.")
-    return session["login_key"]
-
-
-@app.route("/")
-def index() -> Any:
-    return send_from_directory(app.static_folder, "index.html")
-
-
-@app.route("/<path:filename>")
-def static_files(filename: str) -> Any:
-    if filename not in ALLOWED_STATIC:
-        return jsonify({"error": "Nie ma takiego zasobu."}), 404
-    return send_from_directory(app.static_folder, filename)
-
-
-@app.route("/api/register", methods=["POST"])
-def api_register() -> Any:
-    payload = request.get_json(force=True)
-    email = payload.get("email")
-    password = payload.get("password")
-    confirm = payload.get("confirm_password")
-
-    if password != confirm:
-        return jsonify({"error": "Hasla musza byc identyczne."}), 400
-    if len(password or "") < PASSWORD_MIN_LENGTH:
-        return jsonify({"error": "Haslo jest za krotkie."}), 400
-
-    login_key, display_email = normalize_email(email)
-    password_hash = hash_password(password)
-
-    if DATABASE_AVAILABLE:
-        if fetch_one("SELECT 1 FROM accounts WHERE login = %s", (login_key,)):
-            return jsonify({"error": "Konto o podanym emailu juz istnieje."}), 400
-        create_account(login_key, display_email, password_hash)
-        return jsonify({"message": "Konto zostalo utworzone."})
-
-    data = load_store()
-    if login_key in data["accounts"]:
-        return jsonify({"error": "Konto o podanym emailu juz istnieje."}), 400
-
-    data["accounts"][login_key] = {
-        "login": login_key,
-        "email": display_email,
-        "password_hash": password_hash,
-        "business": None,
-        "invoices": [],
-        "logo": None,
-        "created_at": datetime.utcnow().isoformat(timespec="seconds"),
-    }
-    save_store(data)
-    return jsonify({"message": "Konto zostalo utworzone."})
-
-
-@app.route("/api/login", methods=["POST"])
-def api_login() -> Any:
-    payload = request.get_json(force=True)
-    identifier = payload.get("identifier") or payload.get("email")
-    password = payload.get("password")
-    if not identifier or not password:
-        return jsonify({"error": "Podaj email/login i haslo."}), 400
-
-    login_key, _ = normalize_email(identifier)
-
-    if DATABASE_AVAILABLE:
-        row = fetch_one(
-            "SELECT id, password_hash FROM accounts WHERE login = %s",
-            (login_key,),
-        )
-        if not row or row["password_hash"] != hash_password(password):
-            return jsonify({"error": "Niepoprawne dane logowania."}), 401
-        token = uuid.uuid4().hex
-        SESSION_TOKENS[token] = {
-            "login_key": login_key,
-            "account_id": row["id"],
-            "expires_at": datetime.utcnow() + TOKEN_TTL,
-        }
-        return jsonify({"token": token, "login": login_key})
-
-    data = load_store()
-    accounts = data.get("accounts") or {}
-    login_key, account = find_account_identifier(accounts, login_key)
-    if not account or account.get("password_hash") != hash_password(password):
-        return jsonify({"error": "Niepoprawne dane logowania."}), 401
-    token = uuid.uuid4().hex
-    SESSION_TOKENS[token] = {
-        "login_key": login_key,
-        "expires_at": datetime.utcnow() + TOKEN_TTL,
-    }
-    return jsonify({"token": token, "login": account.get("login", login_key)})
-
-
-@app.route("/api/logout", methods=["POST"])
-def api_logout() -> Any:
-    token = request.headers.get("Authorization", "").replace("Bearer ", "")
-    SESSION_TOKENS.pop(token, None)
-    return jsonify({"message": "Wylogowano."})
-
-
-@app.route("/api/business", methods=["GET", "POST"])
-def api_business() -> Any:
-    try:
-        login_key = require_auth()
-    except PermissionError:
-        return jsonify({"error": "Brak autoryzacji."}), 401
-
-    data = load_store()
-    account = data.get("accounts", {}).get(login_key)
-    account_row = None
-    if DATABASE_AVAILABLE:
-        try:
-            account_row = get_account_row(login_key)
-        except KeyError:
-            return jsonify({"error": "Nie znaleziono konta."}), 404
-
-    if request.method == "GET":
-        if DATABASE_AVAILABLE:
-            profile = fetch_one(
-                """
-                SELECT company_name, owner_name, address_line, postal_code,
-                       city, tax_id, bank_account
-                FROM business_profiles
-                WHERE account_id = %s
-                """,
-                (account_row["id"],),
-            )
-            return jsonify({"business": profile})
-        if not account:
-            return jsonify({"business": None})
-        return jsonify({"business": account.get("business")})
-
-    payload = request.get_json(force=True)
-    required_fields = [
-        "company_name",
-        "owner_name",
-        "address_line",
-        "postal_code",
-        "city",
-        "tax_id",
-        "bank_account",
-    ]
-    for field in required_fields:
-        if not (payload.get(field) or "").strip():
-            return jsonify({"error": f"Pole {field} jest wymagane."}), 400
-
-    if DATABASE_AVAILABLE:
-        update_business(account_row["id"], payload)
-        return jsonify({"message": "Dane sprzedawcy zostaly zaktualizowane."})
-
-    if not account:
-        return jsonify({"error": "Nie znaleziono konta."}), 404
-    account["business"] = payload
-    save_store(data)
-    return jsonify({"message": "Dane sprzedawcy zostaly zaktualizowane."})
-
-
-@app.route("/api/logo", methods=["GET", "POST", "DELETE"])
-def api_logo() -> Any:
-    try:
-        login_key = require_auth()
-    except PermissionError:
-        return jsonify({"error": "Brak autoryzacji."}), 401
-
-    data = load_store()
-    try:
-        account = get_account(data, login_key)
-    except KeyError:
-        return jsonify({"error": "Nie znaleziono konta."}), 404
-
-    if request.method == "GET":
-        logo = account.get("logo")
-        if not logo:
-            return jsonify({"logo": None})
-        encoded = logo.get("data")
-        mime_type = logo.get("mime_type")
-        data_url = None
-        if encoded and mime_type:
-            data_url = f"data:{mime_type};base64,{encoded}"
-        return jsonify(
-            {
-                "logo": {
-                    "filename": logo.get("filename"),
-                    "mime_type": mime_type,
-                    "data": encoded,
-                    "data_url": data_url,
-                    "uploaded_at": logo.get("uploaded_at"),
-                }
-            }
-        )
-
-    if request.method == "DELETE":
-        account["logo"] = None
-        save_store(data)
-        return jsonify({"message": "Logo zostalo usuniete."})
-
-    payload = request.get_json(force=True)
-    raw_content = (payload.get("content") or payload.get("data") or "").strip()
-    if not raw_content:
-        return jsonify({"error": "Brak danych logo."}), 400
-
-    provided_mime = (payload.get("mime_type") or "").strip()
-    filename = sanitize_filename(payload.get("filename"))
-
-    if raw_content.startswith("data:"):
-        try:
-            header, encoded_content = raw_content.split(",", 1)
-        except ValueError:
-            return jsonify({"error": "Niepoprawny format danych logo."}), 400
-        header = header.strip()
-        if ";base64" not in header:
-            return jsonify({"error": "Niepoprawny format danych logo (oczekiwano base64)."}), 400
-        mime_type = header.split(";")[0].replace("data:", "", 1) or provided_mime
-        base64_content = encoded_content.strip()
-    else:
-        mime_type = provided_mime
-        base64_content = raw_content
-
-    mime_type = (mime_type or "").lower()
-    if mime_type not in ALLOWED_LOGO_MIME_TYPES:
-        return jsonify({"error": "Dozwolone formaty logo to PNG lub JPG."}), 400
-
-    try:
-        logo_bytes = base64.b64decode(base64_content, validate=True)
-    except (ValueError, binascii.Error):
-        return jsonify({"error": "Nie udalo sie odczytac danych logo (base64)."}), 400
-
-    if len(logo_bytes) > MAX_LOGO_SIZE:
-        return jsonify({"error": f"Logo jest zbyt duze (maksymalnie {MAX_LOGO_SIZE // 1024} KB)."}), 400
-
-    stored_logo = {
-        "filename": filename,
-        "mime_type": mime_type,
-        "data": base64.b64encode(logo_bytes).decode("ascii"),
-        "uploaded_at": datetime.utcnow().isoformat(timespec="seconds"),
-    }
-
-    account["logo"] = stored_logo
-    save_store(data)
-    return jsonify({"logo": stored_logo})
-
-
-def normalize_phone(phone: Optional[str]) -> Optional[str]:
-    if not phone:
-        return None
-    digits = re.sub(r"[^\d+]", "", phone)
-    return digits or None
-
-
-def validate_client(payload: Dict[str, Any]) -> Dict[str, str]:
-    client = {
-        "name": (payload.get("clientName") or "").strip(),
-        "tax_id": (payload.get("clientTaxId") or "").strip(),
-        "address_line": (payload.get("clientAddress") or "").strip(),
-        "postal_code": (payload.get("clientPostalCode") or "").strip(),
-        "city": (payload.get("clientCity") or "").strip(),
-        "phone": normalize_phone(payload.get("clientPhone")),
-    }
-    return client
-
-
-def build_invoice(payload: Dict[str, Any], business: Dict[str, Any], client: Dict[str, str]) -> Dict[str, Any]:
-    now = datetime.now()
-    invoice_id = f"FV-{now.strftime('%Y%m%d-%H%M%S')}"
-    issued_at = now.strftime("%Y-%m-%d %H:%M")
-    sale_date = payload.get("saleDate") or date.today().isoformat()
-    payment_term = int(payload.get("paymentTerm") or 14)
-    items = payload.get("items") or []
-
-    normalized_items: List[Dict[str, Any]] = []
-    for item in items:
-        name = (item.get("name") or "").strip()
-        if not name:
-            raise ValueError("Nazwa pozycji nie moze byc pusta.")
-        quantity = _quantize(_decimal(item.get("quantity") or "0"))
-        if quantity <= Decimal("0"):
-            raise ValueError("Ilosc musi byc dodatnia.")
-        unit = item.get("unit") or DEFAULT_UNIT
-        vat_code = str(item.get("vat") or "23")
-        if vat_code not in VAT_RATES:
-            raise ValueError("Niepoprawna stawka VAT.")
-        unit_price_gross = _quantize(_decimal(item.get("unitPrice") or "0"))
-        if unit_price_gross <= Decimal("0"):
-            raise ValueError("Cena musi byc dodatnia.")
-        vat_rate = VAT_RATES[vat_code]
-        if vat_rate is None:
-            unit_price_net = unit_price_gross
-            vat_amount = Decimal("0.00")
-        else:
-            unit_price_net = _quantize(unit_price_gross / (Decimal("1.0") + vat_rate))
-            vat_amount = _quantize(unit_price_gross - unit_price_net)
-        net_total = _quantize(unit_price_net * quantity)
-        vat_total = _quantize(vat_amount * quantity)
-        gross_total = _quantize(unit_price_gross * quantity)
-        normalized_items.append(
-            {
-                "name": name,
-                "quantity": str(quantity),
-                "unit": unit,
-                "vat_code": vat_code,
-                "vat_label": item.get("vatLabel") or vat_code,
-                "unit_price_net": str(unit_price_net),
-                "unit_price_gross": str(unit_price_gross),
-                "net_total": str(net_total),
-                "vat_amount": str(vat_amount),
-                "gross_total": str(gross_total),
-            }
-        )
-
-    totals = {"net": Decimal("0"), "vat": Decimal("0"), "gross": Decimal("0")}
-    summary: Dict[str, Dict[str, Decimal]] = {}
-    for item in normalized_items:
-        totals["net"] += Decimal(item["net_total"])
-        totals["vat"] += Decimal(item["vat_amount"])
-        totals["gross"] += Decimal(item["gross_total"])
-        label = item["vat_label"]
-        summary.setdefault(label, {"net_total": Decimal("0"), "vat_total": Decimal("0"), "gross_total": Decimal("0")})
-        summary[label]["net_total"] += Decimal(item["net_total"])
-        summary[label]["vat_total"] += Decimal(item["vat_amount"])
-        summary[label]["gross_total"] += Decimal(item["gross_total"])
-
-    totals = {key: str(_quantize(value)) for key, value in totals.items()}
-    summary_list = [
-        {
-            "vat_label": label,
-            "net_total": str(_quantize(values["net_total"])),
-            "vat_total": str(_quantize(values["vat_total"])),
-            "gross_total": str(_quantize(values["gross_total"])),
-        }
-        for label, values in summary.items()
-    ]
-
-    exemption_note = payload.get("exemptionNote", "").strip()
-
-    return {
-        "invoice_id": invoice_id,
-        "issued_at": issued_at,
-        "sale_date": sale_date,
-        "payment_term": payment_term,
-        "items": normalized_items,
-        "summary": summary_list,
-        "totals": totals,
-        "client": client,
-        "business": business,
-        "exemption_note": exemption_note,
-    }
-
-
-@app.route("/api/invoices", methods=["GET", "POST"])
-def api_invoices() -> Any:
-    try:
-        login_key = require_auth()
-    except PermissionError:
-        return jsonify({"error": "Brak autoryzacji."}), 401
-
-    if request.method == "GET":
-        if DATABASE_AVAILABLE:
-            try:
-                account_row = get_account_row(login_key)
-            except KeyError:
-                return jsonify({"error": "Nie znaleziono konta."}), 404
-            rows = fetch_all(
-                """
-                SELECT invoice_number AS invoice_id,
-                       to_char(issued_at, 'YYYY-MM-DD HH24:MI') AS issued_at,
-                       sale_date,
-                       total_gross
-                FROM invoices
-                WHERE account_id = %s
-                ORDER BY issued_at DESC
-                LIMIT %s
-                """,
-                (account_row["id"], INVOICE_HISTORY_LIMIT),
-            )
-            return jsonify({"invoices": rows})
-
-        data = load_store()
-        try:
-            account = get_account(data, login_key)
-        except KeyError:
-            return jsonify({"error": "Nie znaleziono konta."}), 404
-        invoices = account.get("invoices", [])[:INVOICE_HISTORY_LIMIT]
-        return jsonify({"invoices": invoices})
-
-    payload = request.get_json(force=True)
-    data = load_store()
-    try:
-        account = get_account(data, login_key)
-    except KeyError:
-        return jsonify({"error": "Nie znaleziono konta."}), 404
-
-    business = account.get("business")
-    if not business:
-        return jsonify({"error": "Ustaw dane sprzedawcy przed dodaniem faktury."}), 400
-
-    client = validate_client(payload)
-    try:
-        invoice = build_invoice(payload, business, client)
-    except ValueError as error:
-        return jsonify({"error": str(error)}), 400
-
-    if DATABASE_AVAILABLE:
-        account_row = get_account_row(login_key)
-        client_id = upsert_client(
-            account_row["id"],
-            {
-                "name": client["name"],
-                "address_line": client["address_line"],
-                "postal_code": client["postal_code"],
-                "city": client["city"],
-                "tax_id": client["tax_id"],
-                "phone": client.get("phone"),
-            },
-        )
-        insert_invoice(account_row["id"], client_id, invoice)
-        return jsonify({"message": "Faktura zostala zapisana."})
-
-    invoices = account.setdefault("invoices", [])
-    invoices.insert(0, invoice)
-    account["invoices"] = invoices[:INVOICE_HISTORY_LIMIT]
-    save_store(data)
-    return jsonify({"message": "Faktura zostala zapisana."})
-
-
-@app.route("/api/invoices/summary", methods=["GET"])
-def api_invoice_summary() -> Any:
-    try:
-        login_key = require_auth()
-    except PermissionError:
-        return jsonify({"error": "Brak autoryzacji."}), 401
-
-    now = datetime.utcnow()
-    last_month_start = now - timedelta(days=30)
-    quarter_first_month = ((now.month - 1) // 3) * 3 + 1
-    quarter_start = now.replace(month=quarter_first_month, day=1, hour=0, minute=0, second=0, microsecond=0)
-    year_start = now.replace(month=1, day=1, hour=0, minute=0, second=0, microsecond=0)
-
-    def aggregate_from_rows(rows: List[Dict[str, Any]], start: datetime) -> Dict[str, Any]:
-        count = 0
-        gross_total = Decimal("0.00")
-        for row in rows:
-            issued_dt = row["issued_at"]
-            if issued_dt < start:
-                continue
-            count += 1
-            gross_total += Decimal(row["total_gross"])
-        return {"count": count, "gross_total": str(_quantize(gross_total))}
-
-    if DATABASE_AVAILABLE:
-        try:
-            account_row = get_account_row(login_key)
-        except KeyError:
-            return jsonify({"error": "Nie znaleziono konta."}), 404
-        rows = fetch_all(
-            """
-            SELECT issued_at, total_gross
-            FROM invoices
-            WHERE account_id = %s
-            """,
-            (account_row["id"],),
-        )
-        # rows zwraca datetime, ale upewniamy się, że są w Python datetime
-        parsed = [
-            {
-                "issued_at": row["issued_at"],
-                "total_gross": row["total_gross"],
-            }
-            for row in rows
-        ]
-        summary = {
-            "last_month": aggregate_from_rows(parsed, last_month_start),
-            "quarter": aggregate_from_rows(parsed, quarter_start),
-            "year": aggregate_from_rows(parsed, year_start),
-        }
-        return jsonify({"summary": summary})
-
-    data = load_store()
-    try:
-        account = get_account(data, login_key)
-    except KeyError:
-        return jsonify({"error": "Nie znaleziono konta."}), 404
-    invoices = account.get("invoices", [])
-
-    def parse_issued_at(value: Optional[str]) -> Optional[datetime]:
-        if not value:
-            return None
-        try:
-            return datetime.strptime(value, "%Y-%m-%d %H:%M")
-        except ValueError:
-            return None
-
-    def aggregate(start: datetime) -> Dict[str, Any]:
-        count = 0
-        gross_total = Decimal("0.00")
-        for invoice in invoices:
-            issued_dt = parse_issued_at(invoice.get("issued_at"))
-            if issued_dt is None or issued_dt < start:
-                continue
-            count += 1
-            gross_value = invoice.get("totals", {}).get("gross", "0")
-            try:
-                gross_total += _decimal(gross_value)
-            except ValueError:
-                continue
-        return {"count": count, "gross_total": str(_quantize(gross_total))}
-
-    summary = {
-        "last_month": aggregate(last_month_start),
-        "quarter": aggregate(quarter_start),
-        "year": aggregate(year_start),
-    }
-    return jsonify({"summary": summary})
-
-
-if __name__ == "__main__":
-    port = int(os.environ.get("PORT", "5000"))
-    app.run(host="0.0.0.0", port=port, debug=True)
+import base64
+import binascii
+import hashlib
+import json
+import os
+import re
+import uuid
+from datetime import date, datetime, timedelta
+from decimal import Decimal, ROUND_HALF_UP, getcontext
+from pathlib import Path
+from typing import Any, Dict, List, Optional, Tuple
+
+from flask import Flask, jsonify, request, send_from_directory
+
+from db import (
+    create_account,
+    fetch_all,
+    fetch_one,
+    fetch_business_logo,
+    insert_invoice,
+    update_business,
+    update_business_logo,
+    upsert_client,
+)
+
+APP_ROOT = Path(__file__).parent.resolve()
+DATA_DIR = Path(os.environ.get("DATA_DIR", APP_ROOT))
+DATA_FILE = DATA_DIR / "web_invoice_store.json"
+INVOICE_HISTORY_LIMIT = 200
+MAX_LOGO_SIZE = 512 * 1024  # 512 KB
+TOKEN_TTL = timedelta(hours=12)
+ALLOWED_LOGO_MIME_TYPES = {"image/png", "image/jpeg"}
+
+DATABASE_AVAILABLE = bool(os.environ.get("NEON_DATABASE_URL"))
+
+VAT_RATES: Dict[str, Optional[Decimal]] = {
+    "23": Decimal("0.23"),
+    "8": Decimal("0.08"),
+    "5": Decimal("0.05"),
+    "0": Decimal("0.00"),
+    "ZW": None,
+    "NP": None,
+}
+
+DEFAULT_UNIT = "szt."
+ALLOWED_UNITS = {"szt.", "godz."}
+PASSWORD_MIN_LENGTH = 4
+
+SESSION_TOKENS: Dict[str, Dict[str, Any]] = {}
+
+ALLOWED_STATIC = {
+    "index.html",
+    "styles.css",
+    "main.js",
+    "favicon.ico",
+    "Roboto-VariableFont_wdth,wght.ttf",
+}
+
+
+app = Flask(__name__, static_folder=str(APP_ROOT), static_url_path="")
+
+getcontext().prec = 10
+
+
+def _quantize(value: Decimal) -> Decimal:
+    return value.quantize(Decimal("0.01"), rounding=ROUND_HALF_UP)
+
+
+def _decimal(value: Any) -> Decimal:
+    try:
+        return Decimal(str(value))
+    except Exception as error:  # pragma: no cover - defensive
+        raise ValueError(f"Niepoprawna wartosc liczby: {value}") from error
+
+
+def hash_password(password: str) -> str:
+    return hashlib.sha256(password.encode("utf-8")).hexdigest()
+
+
+EMAIL_PATTERN = re.compile(r"^[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Za-z]{2,}$")
+
+
+def normalize_email(raw_email: str) -> Tuple[str, str]:
+    display_email = (raw_email or "").strip()
+    if not display_email:
+        raise ValueError("Email nie moze byc pusty.")
+    if not EMAIL_PATTERN.fullmatch(display_email):
+        raise ValueError("Podaj poprawny adres email.")
+    return display_email.lower(), display_email
+
+
+def sanitize_filename(filename: Optional[str]) -> str:
+    if not filename:
+        return "logo"
+    name = str(filename).split("/")[-1].split("\\")[-1]
+    sanitized = re.sub(r"[^A-Za-z0-9._-]", "_", name).strip("._")
+    return sanitized or "logo"
+
+
+def find_account_identifier(accounts: Dict[str, Any], identifier: str) -> Tuple[Optional[str], Optional[Dict[str, Any]]]:
+    key = (identifier or "").strip().lower()
+    if not key:
+        return None, None
+    account = accounts.get(key)
+    if account:
+        return key, account
+    for login_key, candidate in accounts.items():
+        candidate_login = (candidate.get("login") or "").strip().lower()
+        candidate_email = (candidate.get("email") or "").strip().lower()
+        if key in {candidate_login, candidate_email}:
+            return login_key, candidate
+    return None, None
+
+
+def load_store() -> Dict[str, Any]:
+    if not DATA_FILE.exists():
+        return {"accounts": {}}
+    try:
+        with DATA_FILE.open("r", encoding="utf-8") as handle:
+            data = json.load(handle)
+    except json.JSONDecodeError:
+        raise ValueError("Plik z danymi jest uszkodzony.")
+    return data
+
+
+def save_store(data: Dict[str, Any]) -> None:
+    DATA_DIR.mkdir(parents=True, exist_ok=True)
+    tmp_path = DATA_FILE.with_suffix(".tmp")
+    with tmp_path.open("w", encoding="utf-8") as handle:
+        json.dump(data, handle, ensure_ascii=False, indent=2)
+    tmp_path.replace(DATA_FILE)
+
+
+def get_account(data: Dict[str, Any], login_key: str) -> Dict[str, Any]:
+    accounts = data.get("accounts") or {}
+    account = accounts.get(login_key)
+    if not account:
+        raise KeyError("Nie znaleziono konta.")
+    return account
+
+
+def get_account_row(login_key: str) -> Dict[str, Any]:
+    row = fetch_one("SELECT id, login FROM accounts WHERE login = %s", (login_key,))
+    if not row:
+        raise KeyError("Nie znaleziono konta.")
+    return row
+
+
+def require_auth() -> str:
+    auth_header = request.headers.get("Authorization")
+    if not auth_header or not auth_header.startswith("Bearer "):
+        raise PermissionError("Brak tokenu.")
+    token = auth_header.split(" ", 1)[1].strip()
+    session = SESSION_TOKENS.get(token)
+    if not session:
+        raise PermissionError("Nieprawidlowy token.")
+    if session["expires_at"] < datetime.utcnow():
+        SESSION_TOKENS.pop(token, None)
+        raise PermissionError("Token wygasl.")
+    return session["login_key"]
+
+
+@app.route("/")
+def index() -> Any:
+    return send_from_directory(app.static_folder, "index.html")
+
+
+@app.route("/<path:filename>")
+def static_files(filename: str) -> Any:
+    if filename not in ALLOWED_STATIC:
+        return jsonify({"error": "Nie ma takiego zasobu."}), 404
+    return send_from_directory(app.static_folder, filename)
+
+
+@app.route("/api/register", methods=["POST"])
+def api_register() -> Any:
+    payload = request.get_json(force=True)
+    email = payload.get("email")
+    password = payload.get("password")
+    confirm = payload.get("confirm_password")
+
+    if password != confirm:
+        return jsonify({"error": "Hasla musza byc identyczne."}), 400
+    if len(password or "") < PASSWORD_MIN_LENGTH:
+        return jsonify({"error": "Haslo jest za krotkie."}), 400
+
+    login_key, display_email = normalize_email(email)
+    password_hash = hash_password(password)
+
+    if DATABASE_AVAILABLE:
+        if fetch_one("SELECT 1 FROM accounts WHERE login = %s", (login_key,)):
+            return jsonify({"error": "Konto o podanym emailu juz istnieje."}), 400
+        create_account(login_key, display_email, password_hash)
+        return jsonify({"message": "Konto zostalo utworzone."})
+
+    data = load_store()
+    if login_key in data["accounts"]:
+        return jsonify({"error": "Konto o podanym emailu juz istnieje."}), 400
+
+    data["accounts"][login_key] = {
+        "login": login_key,
+        "email": display_email,
+        "password_hash": password_hash,
+        "business": None,
+        "invoices": [],
+        "logo": None,
+        "created_at": datetime.utcnow().isoformat(timespec="seconds"),
+    }
+    save_store(data)
+    return jsonify({"message": "Konto zostalo utworzone."})
+
+
+@app.route("/api/login", methods=["POST"])
+def api_login() -> Any:
+    payload = request.get_json(force=True)
+    identifier = payload.get("identifier") or payload.get("email")
+    password = payload.get("password")
+    if not identifier or not password:
+        return jsonify({"error": "Podaj email/login i haslo."}), 400
+
+    login_key, _ = normalize_email(identifier)
+
+    if DATABASE_AVAILABLE:
+        row = fetch_one(
+            "SELECT id, password_hash FROM accounts WHERE login = %s",
+            (login_key,),
+        )
+        if not row or row["password_hash"] != hash_password(password):
+            return jsonify({"error": "Niepoprawne dane logowania."}), 401
+        token = uuid.uuid4().hex
+        SESSION_TOKENS[token] = {
+            "login_key": login_key,
+            "account_id": row["id"],
+            "expires_at": datetime.utcnow() + TOKEN_TTL,
+        }
+        return jsonify({"token": token, "login": login_key})
+
+    data = load_store()
+    accounts = data.get("accounts") or {}
+    login_key, account = find_account_identifier(accounts, login_key)
+    if not account or account.get("password_hash") != hash_password(password):
+        return jsonify({"error": "Niepoprawne dane logowania."}), 401
+    token = uuid.uuid4().hex
+    SESSION_TOKENS[token] = {
+        "login_key": login_key,
+        "expires_at": datetime.utcnow() + TOKEN_TTL,
+    }
+    return jsonify({"token": token, "login": account.get("login", login_key)})
+
+
+@app.route("/api/logout", methods=["POST"])
+def api_logout() -> Any:
+    token = request.headers.get("Authorization", "").replace("Bearer ", "")
+    SESSION_TOKENS.pop(token, None)
+    return jsonify({"message": "Wylogowano."})
+
+
+@app.route("/api/business", methods=["GET", "POST"])
+def api_business() -> Any:
+    try:
+        login_key = require_auth()
+    except PermissionError:
+        return jsonify({"error": "Brak autoryzacji."}), 401
+
+    data = load_store()
+    account = data.get("accounts", {}).get(login_key)
+    account_row = None
+    if DATABASE_AVAILABLE:
+        try:
+            account_row = get_account_row(login_key)
+        except KeyError:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+
+    if request.method == "GET":
+        if DATABASE_AVAILABLE:
+            profile = fetch_one(
+                """
+                SELECT company_name, owner_name, address_line, postal_code,
+                       city, tax_id, bank_account
+                FROM business_profiles
+                WHERE account_id = %s
+                """,
+                (account_row["id"],),
+            )
+            return jsonify({"business": profile})
+        if not account:
+            return jsonify({"business": None})
+        return jsonify({"business": account.get("business")})
+
+    payload = request.get_json(force=True)
+    required_fields = [
+        "company_name",
+        "owner_name",
+        "address_line",
+        "postal_code",
+        "city",
+        "tax_id",
+        "bank_account",
+    ]
+    for field in required_fields:
+        if not (payload.get(field) or "").strip():
+            return jsonify({"error": f"Pole {field} jest wymagane."}), 400
+
+    if DATABASE_AVAILABLE:
+        update_business(account_row["id"], payload)
+        return jsonify({"message": "Dane sprzedawcy zostaly zaktualizowane."})
+
+    if not account:
+        return jsonify({"error": "Nie znaleziono konta."}), 404
+    account["business"] = payload
+    save_store(data)
+    return jsonify({"message": "Dane sprzedawcy zostaly zaktualizowane."})
+
+
+@app.route("/api/logo", methods=["GET", "POST", "DELETE"])
+def api_logo() -> Any:
+    try:
+        login_key = require_auth()
+    except PermissionError:
+        return jsonify({"error": "Brak autoryzacji."}), 401
+
+    account_row = None
+    account = None
+    data = None
+
+    if DATABASE_AVAILABLE:
+        try:
+            account_row = get_account_row(login_key)
+        except KeyError:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+    else:
+        data = load_store()
+        try:
+            account = get_account(data, login_key)
+        except KeyError:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+
+    if request.method == "GET":
+        if DATABASE_AVAILABLE:
+            logo_row = fetch_business_logo(account_row["id"])
+            if not logo_row:
+                return jsonify({"logo": None})
+            mime_type = logo_row["mime_type"]
+            encoded = logo_row["data"]
+            data_url = f"data:{mime_type};base64,{encoded}" if mime_type and encoded else None
+            return jsonify(
+                {
+                    "logo": {
+                        "filename": None,
+                        "mime_type": mime_type,
+                        "data": encoded,
+                        "data_url": data_url,
+                        "uploaded_at": None,
+                    }
+                }
+            )
+        logo = account.get("logo") if account else None
+        if not logo:
+            return jsonify({"logo": None})
+        encoded = logo.get("data")
+        mime_type = logo.get("mime_type")
+        data_url = None
+        if encoded and mime_type:
+            data_url = f"data:{mime_type};base64,{encoded}"
+        return jsonify(
+            {
+                "logo": {
+                    "filename": logo.get("filename"),
+                    "mime_type": mime_type,
+                    "data": encoded,
+                    "data_url": data_url,
+                    "uploaded_at": logo.get("uploaded_at"),
+                }
+            }
+        )
+
+    if request.method == "DELETE":
+        if DATABASE_AVAILABLE:
+            update_business_logo(account_row["id"], None, None)
+            return jsonify({"message": "Logo zostalo usuniete."})
+        if not account or data is None:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+        account["logo"] = None
+        save_store(data)
+        return jsonify({"message": "Logo zostalo usuniete."})
+
+    payload = request.get_json(force=True)
+    raw_content = (payload.get("content") or payload.get("data") or "").strip()
+    if not raw_content:
+        return jsonify({"error": "Brak danych logo."}), 400
+
+    provided_mime = (payload.get("mime_type") or "").strip()
+    filename = sanitize_filename(payload.get("filename"))
+
+    if raw_content.startswith("data:"):
+        try:
+            header, encoded_content = raw_content.split(",", 1)
+        except ValueError:
+            return jsonify({"error": "Niepoprawny format danych logo."}), 400
+        header = header.strip()
+        if ";base64" not in header:
+            return jsonify({"error": "Niepoprawny format danych logo (oczekiwano base64)."}), 400
+        mime_type = header.split(";")[0].replace("data:", "", 1) or provided_mime
+        base64_content = encoded_content.strip()
+    else:
+        mime_type = provided_mime
+        base64_content = raw_content
+
+    mime_type = (mime_type or "").lower()
+    if mime_type not in ALLOWED_LOGO_MIME_TYPES:
+        return jsonify({"error": "Dozwolone formaty logo to PNG lub JPG."}), 400
+
+    try:
+        logo_bytes = base64.b64decode(base64_content, validate=True)
+    except (ValueError, binascii.Error):
+        return jsonify({"error": "Nie udalo sie odczytac danych logo (base64)."}), 400
+
+    if len(logo_bytes) > MAX_LOGO_SIZE:
+        return jsonify({"error": f"Logo jest zbyt duze (maksymalnie {MAX_LOGO_SIZE // 1024} KB)."}), 400
+
+    encoded_logo = base64.b64encode(logo_bytes).decode("ascii")
+    stored_logo = {
+        "filename": filename,
+        "mime_type": mime_type,
+        "data": encoded_logo,
+        "uploaded_at": datetime.utcnow().isoformat(timespec="seconds"),
+    }
+
+    if DATABASE_AVAILABLE:
+        update_business_logo(account_row["id"], stored_logo["mime_type"], stored_logo["data"])
+        return jsonify({"logo": stored_logo})
+
+    account["logo"] = stored_logo
+    save_store(data)
+    return jsonify({"logo": stored_logo})
+
+def normalize_phone(phone: Optional[str]) -> Optional[str]:
+    if not phone:
+        return None
+    digits = re.sub(r"[^\d+]", "", phone)
+    return digits or None
+
+
+def validate_client(payload: Dict[str, Any]) -> Dict[str, str]:
+    client = {
+        "name": (payload.get("clientName") or "").strip(),
+        "tax_id": (payload.get("clientTaxId") or "").strip(),
+        "address_line": (payload.get("clientAddress") or "").strip(),
+        "postal_code": (payload.get("clientPostalCode") or "").strip(),
+        "city": (payload.get("clientCity") or "").strip(),
+        "phone": normalize_phone(payload.get("clientPhone")),
+    }
+    return client
+
+
+def build_invoice(payload: Dict[str, Any], business: Dict[str, Any], client: Dict[str, str]) -> Dict[str, Any]:
+    now = datetime.now()
+    invoice_id = f"FV-{now.strftime('%Y%m%d-%H%M%S')}"
+    issued_at = now.strftime("%Y-%m-%d %H:%M")
+    sale_date = payload.get("saleDate") or date.today().isoformat()
+    payment_term = int(payload.get("paymentTerm") or 14)
+    items = payload.get("items") or []
+
+    normalized_items: List[Dict[str, Any]] = []
+    for item in items:
+        name = (item.get("name") or "").strip()
+        if not name:
+            raise ValueError("Nazwa pozycji nie moze byc pusta.")
+        quantity = _quantize(_decimal(item.get("quantity") or "0"))
+        if quantity <= Decimal("0"):
+            raise ValueError("Ilosc musi byc dodatnia.")
+        unit = item.get("unit") or DEFAULT_UNIT
+        vat_code = str(item.get("vat") or "23")
+        if vat_code not in VAT_RATES:
+            raise ValueError("Niepoprawna stawka VAT.")
+        unit_price_gross = _quantize(_decimal(item.get("unitPrice") or "0"))
+        if unit_price_gross <= Decimal("0"):
+            raise ValueError("Cena musi byc dodatnia.")
+        vat_rate = VAT_RATES[vat_code]
+        if vat_rate is None:
+            unit_price_net = unit_price_gross
+            vat_amount = Decimal("0.00")
+        else:
+            unit_price_net = _quantize(unit_price_gross / (Decimal("1.0") + vat_rate))
+            vat_amount = _quantize(unit_price_gross - unit_price_net)
+        net_total = _quantize(unit_price_net * quantity)
+        vat_total = _quantize(vat_amount * quantity)
+        gross_total = _quantize(unit_price_gross * quantity)
+        normalized_items.append(
+            {
+                "name": name,
+                "quantity": str(quantity),
+                "unit": unit,
+                "vat_code": vat_code,
+                "vat_label": item.get("vatLabel") or vat_code,
+                "unit_price_net": str(unit_price_net),
+                "unit_price_gross": str(unit_price_gross),
+                "net_total": str(net_total),
+                "vat_amount": str(vat_amount),
+                "gross_total": str(gross_total),
+            }
+        )
+
+    totals = {"net": Decimal("0"), "vat": Decimal("0"), "gross": Decimal("0")}
+    summary: Dict[str, Dict[str, Decimal]] = {}
+    for item in normalized_items:
+        totals["net"] += Decimal(item["net_total"])
+        totals["vat"] += Decimal(item["vat_amount"])
+        totals["gross"] += Decimal(item["gross_total"])
+        label = item["vat_label"]
+        summary.setdefault(label, {"net_total": Decimal("0"), "vat_total": Decimal("0"), "gross_total": Decimal("0")})
+        summary[label]["net_total"] += Decimal(item["net_total"])
+        summary[label]["vat_total"] += Decimal(item["vat_amount"])
+        summary[label]["gross_total"] += Decimal(item["gross_total"])
+
+    totals = {key: str(_quantize(value)) for key, value in totals.items()}
+    summary_list = [
+        {
+            "vat_label": label,
+            "net_total": str(_quantize(values["net_total"])),
+            "vat_total": str(_quantize(values["vat_total"])),
+            "gross_total": str(_quantize(values["gross_total"])),
+        }
+        for label, values in summary.items()
+    ]
+
+    exemption_note = payload.get("exemptionNote", "").strip()
+
+    return {
+        "invoice_id": invoice_id,
+        "issued_at": issued_at,
+        "sale_date": sale_date,
+        "payment_term": payment_term,
+        "items": normalized_items,
+        "summary": summary_list,
+        "totals": totals,
+        "client": client,
+        "business": business,
+        "exemption_note": exemption_note,
+    }
+
+
+@app.route("/api/invoices", methods=["GET", "POST"])
+def api_invoices() -> Any:
+    try:
+        login_key = require_auth()
+    except PermissionError:
+        return jsonify({"error": "Brak autoryzacji."}), 401
+
+    if request.method == "GET":
+        if DATABASE_AVAILABLE:
+            try:
+                account_row = get_account_row(login_key)
+            except KeyError:
+                return jsonify({"error": "Nie znaleziono konta."}), 404
+            rows = fetch_all(
+                """
+                SELECT invoice_number AS invoice_id,
+                       to_char(issued_at, 'YYYY-MM-DD HH24:MI') AS issued_at,
+                       sale_date,
+                       total_gross
+                FROM invoices
+                WHERE account_id = %s
+                ORDER BY issued_at DESC
+                LIMIT %s
+                """,
+                (account_row["id"], INVOICE_HISTORY_LIMIT),
+            )
+            return jsonify({"invoices": rows})
+
+        data = load_store()
+        try:
+            account = get_account(data, login_key)
+        except KeyError:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+        invoices = account.get("invoices", [])[:INVOICE_HISTORY_LIMIT]
+        return jsonify({"invoices": invoices})
+
+    payload = request.get_json(force=True)
+    data = load_store()
+    try:
+        account = get_account(data, login_key)
+    except KeyError:
+        return jsonify({"error": "Nie znaleziono konta."}), 404
+
+    business = account.get("business")
+    if not business:
+        return jsonify({"error": "Ustaw dane sprzedawcy przed dodaniem faktury."}), 400
+
+    client = validate_client(payload)
+    try:
+        invoice = build_invoice(payload, business, client)
+    except ValueError as error:
+        return jsonify({"error": str(error)}), 400
+
+    if DATABASE_AVAILABLE:
+        account_row = get_account_row(login_key)
+        client_id = upsert_client(
+            account_row["id"],
+            {
+                "name": client["name"],
+                "address_line": client["address_line"],
+                "postal_code": client["postal_code"],
+                "city": client["city"],
+                "tax_id": client["tax_id"],
+                "phone": client.get("phone"),
+            },
+        )
+        insert_invoice(account_row["id"], client_id, invoice)
+        return jsonify({"message": "Faktura zostala zapisana."})
+
+    invoices = account.setdefault("invoices", [])
+    invoices.insert(0, invoice)
+    account["invoices"] = invoices[:INVOICE_HISTORY_LIMIT]
+    save_store(data)
+    return jsonify({"message": "Faktura zostala zapisana."})
+
+
+@app.route("/api/invoices/summary", methods=["GET"])
+def api_invoice_summary() -> Any:
+    try:
+        login_key = require_auth()
+    except PermissionError:
+        return jsonify({"error": "Brak autoryzacji."}), 401
+
+    now = datetime.utcnow()
+    last_month_start = now - timedelta(days=30)
+    quarter_first_month = ((now.month - 1) // 3) * 3 + 1
+    quarter_start = now.replace(month=quarter_first_month, day=1, hour=0, minute=0, second=0, microsecond=0)
+    year_start = now.replace(month=1, day=1, hour=0, minute=0, second=0, microsecond=0)
+
+    def aggregate_from_rows(rows: List[Dict[str, Any]], start: datetime) -> Dict[str, Any]:
+        count = 0
+        gross_total = Decimal("0.00")
+        for row in rows:
+            issued_dt = row["issued_at"]
+            if issued_dt < start:
+                continue
+            count += 1
+            gross_total += Decimal(row["total_gross"])
+        return {"count": count, "gross_total": str(_quantize(gross_total))}
+
+    if DATABASE_AVAILABLE:
+        try:
+            account_row = get_account_row(login_key)
+        except KeyError:
+            return jsonify({"error": "Nie znaleziono konta."}), 404
+        rows = fetch_all(
+            """
+            SELECT issued_at, total_gross
+            FROM invoices
+            WHERE account_id = %s
+            """,
+            (account_row["id"],),
+        )
+        # rows zwraca datetime, ale upewniamy się, że są w Python datetime
+        parsed = [
+            {
+                "issued_at": row["issued_at"],
+                "total_gross": row["total_gross"],
+            }
+            for row in rows
+        ]
+        summary = {
+            "last_month": aggregate_from_rows(parsed, last_month_start),
+            "quarter": aggregate_from_rows(parsed, quarter_start),
+            "year": aggregate_from_rows(parsed, year_start),
+        }
+        return jsonify({"summary": summary})
+
+    data = load_store()
+    try:
+        account = get_account(data, login_key)
+    except KeyError:
+        return jsonify({"error": "Nie znaleziono konta."}), 404
+    invoices = account.get("invoices", [])
+
+    def parse_issued_at(value: Optional[str]) -> Optional[datetime]:
+        if not value:
+            return None
+        try:
+            return datetime.strptime(value, "%Y-%m-%d %H:%M")
+        except ValueError:
+            return None
+
+    def aggregate(start: datetime) -> Dict[str, Any]:
+        count = 0
+        gross_total = Decimal("0.00")
+        for invoice in invoices:
+            issued_dt = parse_issued_at(invoice.get("issued_at"))
+            if issued_dt is None or issued_dt < start:
+                continue
+            count += 1
+            gross_value = invoice.get("totals", {}).get("gross", "0")
+            try:
+                gross_total += _decimal(gross_value)
+            except ValueError:
+                continue
+        return {"count": count, "gross_total": str(_quantize(gross_total))}
+
+    summary = {
+        "last_month": aggregate(last_month_start),
+        "quarter": aggregate(quarter_start),
+        "year": aggregate(year_start),
+    }
+    return jsonify({"summary": summary})
+
+
+if __name__ == "__main__":
+    port = int(os.environ.get("PORT", "5000"))
+    app.run(host="0.0.0.0", port=port, debug=True)