currencies_list.auto_update — yes → 1, no → 0. Rows with auto-update off keep whatever rate an operator last saved; the nightly job skips them entirely.,
},
{
key: "currency", label: "Currency", type: "text", icon: "globe", grow: true, placeholder: "Currency",
tip: <>Server-side currency LIKE %value% — a substring match on the ISO code, not an exact lookup.,
},
];
/* ==================================================================
Edit modal — generics/models/currency.blade.php inside the generic
generaModalGestione() shell. Title = the currency code. Two fields
only: rate + auto_update. Save posts to admin.currencies.store.
================================================================== */
const Hsc2EditModal = ({ row, onClose, onSave }) => {
const [rate, setRate] = hsc2UseState(hsc2Rate4(row.rate));
const [auto, setAuto] = hsc2UseState(!!row.auto_update);
const [err, setErr] = hsc2UseState("");
/* Inline Validator::make in store() (L112-115): rate → required|gt:0,
auto_update → in:on,off. Failure returns ajaxError JSON whose
`campierrati` keys paint the message under the field. */
const submit = () => {
const raw = String(rate).trim();
if (raw === "") { setErr("The rate field is required."); return; }
const n = Number(raw);
if (!Number.isFinite(n) || n <= 0) { setErr("The rate must be greater than 0."); return; }
onSave({ currency: row.currency, rate: hsc2Round4(n), auto_update: auto });
};
return (
DECIMAL(15,4)Currency::updateOrCreate(['currency' => '{row.currency}', 'date_currency' => '{hsc2Iso(HSC2_TODAY)}'], ['rate' => …]) — and updates currencies_list.auto_update.
A rate already stored for {hsc2Dmy(HSC2_TODAY)} is overwritten; earlier days are never touched and cannot be edited from this screen.
DownloadExchangeRatesJob is scheduled three times (Console/Kernel.php L70-73). The extra two are retries, not extra downloads:
the job is ShouldBeUnique with a static uniqueId(), so a run still in flight swallows the next tick.
GET {"{host}"}/api/generic/currency/latest, EUR-based. The job reads currencies_list where auto_update = 1 in
chunks of 10, upserts currencies on (currency, date_currency), and appends the same rows to exchange_rates —
whose rate is DOUBLE(8,2), i.e. the audit copy is less precise than the record it audits, and nothing in the app reads it back.
api.bluelytics.com.ar/v2/latest →
blue_euro.value_sell — the Argentine "blue" parallel rate, deliberately not the official one. Every ARS figure converted
anywhere in the backoffice inherits that choice.
$.get(route('crons.exchange.rates')) to GET /crons/downloadExchangeRates. That route lives in the
cronjobs middleware group, which is only throttle:api + SubstituteBindings (app/Http/Kernel.php L66-70) —
no auth, no 2FA, no role check. Anyone who can reach the crons domain can queue the rate-download job, on any schedule they like.
Rate-limiting is the only thing standing in the way.
checkUserBoPerm gate: the sidebar item sits inside @if (isadmin()) and every controller action calls{" "}
authorize('viewAny', new Currency) → CurrencyPolicy::viewAny() = isadmin() — Super Admin (user_level 0) only.{" "}
}
gateNote={<>
Unusually for Batch 3, this one is enforced server-side on every action, not just on index. Two caveats: the policy is not registered
in AuthServiceProvider::$policies (it resolves through Laravel's model→policy auto-discovery, so renaming either class silently removes the
gate), and store() authorizes with viewAny because the policy has no update ability — view permission is write
permission. The Edit pencil itself is only hidden client-side via user.is_admin == 1.
}
explainer={{
title: "What this screen is, in plain English",
bullets: [
<>Each row is a currency the platform knows (currencies_list) shown with today's rate from currencies — the number of units of that currency one euro buys. EUR is the base, so EUR → EUR is 1.0000.,
<>Nearest-date fallback, in both directions. The rate shown is the row whose date_currency is closest to today by absolute difference — so a missing day is filled by carrying a rate forward or backward. A weekend gap, or a rate you save today, can therefore change how yesterday converts.,
<>Conversion is always via EUR: (amount / rate[from]) * rate[to]. That is what every report's "Cumulable" switch runs, what commissions and the KRA daily iTax report use, and what the frontend API hands out at Fapi\CurrencyController::index.,
<>Editing writes today only. The form has exactly two fields — rate and auto update — and the save always targets today's (currency, date_currency) row. Historic rates are readable by the code but not editable from here.,
<>Auto update decides whether the nightly job overwrites your value: with it on, anything you type here is replaced at 00:01. Turn it off for a currency you want pinned by hand.,
],
}}
actions={
/* On the real screen this green download button sits in the filter row
next to Search (filters/currencies.blade.php L61, currencies.js L78-88);
moved into the header slot here so the filter strip stays scannable.
Disabled — see the Update-button comment above saveRow/filtered. */
GET /crons/downloadExchangeRates (crons.exchange.rates) →{" "}
CronsController::downloadExchangeRates → DownloadExchangeRatesJob. Note that route is
unauthenticated today — see “Automatic rate sync” below.