Dashboard Accuracy & Organisation Security

Dashboard Fixes

The dashboard now pulls all financial calculations from the same backend logic as the Reports page, eliminating discrepancies between the two views.

• P&L figures now match Reports exactly — revenue, expenses, and net profit on the dashboard are computed using the same shared calculation path as the Profit & Loss report. Previously, the dashboard used a simplified query that could double-count transactions with contra entries.
• Bank Balance shows ledger balance — the Bank Balance card now displays the actual book balance from your current account (1200), rather than an unrelated account.
• Year-to-date date range — the dashboard now caps at today’s date rather than projecting to the financial year end, matching industry practice used by Xero and FreeAgent.
• Tax Set-Aside computed server-side — Corporation Tax and VAT estimates are now calculated on the backend using precise arithmetic, removing all financial calculations from the browser. The frontend purely displays what the API returns.

Organisation Security

• Production-grade organisation identifiers — all organisation references now use proper random UUIDs, replacing development-era test values across the entire database.

Bug Fixes

• 429 rate limit responses — rate-limited authentication endpoints now correctly return 429 status codes instead of 500 errors. Affects login, TOTP verification, token refresh, registration, and password reset routes.