Dashboard tiles: endpoints, data sources and permission gaps
Settings screen and content of the three dashboard extensions, the AJAX endpoints, the models used, and the gaps in permission and content scope checks.
The tiles are dashboard extensions of the framework: each has a settings screen (width, status, sort order; saved with basic modify permission through the settings model) and its content.
Total Entry (dashboard/entry)
- AJAX:
supplierchart,chart,suppliertotalitems,suppliertotal,ledger. - Filters: year (default 2025 fixed in the code), company group (by content scope), company (looked up by NAV login), supplier (from the company list).
- Data: supplier net and VAT yearly chart from the
finance/invoicemodel, supplier and ledger summary from thefinance/entrymodel (getEntryDashboard,getLedgerDashboard);chartalso returns the framework's order and customer statistics by day, week, month. - Tables (with the installation prefix):
invoice,entry,company; the framework'sorderandcustomerreport models.
Credit balance (dashboard/credit)
The logged-in user's own account (balance, negative allowance, credit limit, the 5 latest allowance counters) from getAccountByUser of the subscription/account model; no parameter, no other account can be requested. No permission key.
NAV response time (dashboard/checksite)
Daily response time chart of the NAV Online Invoice site from the site_status table.
Permissions
- The five AJAX endpoints use
canAction(dashboard/entry, list); the key is not classified in the seeds. - The
dashboard()method and the public chart and summary methods check no permission; the company and supplier pickers are not filled by content scope. - The chart endpoint of
dashboard/checksitechecks no permission; it also has two public copy methods without permission checks.
Known limitations
The default year is hard-coded; the company and supplier pickers are filled without content scope; the public methods without permission checks are a risk.