From a6c13a85a3e20697e589963e6fe47c1bb997c368 Mon Sep 17 00:00:00 2001
From: Heidrich Digital <mail@tillheidrich.de>
Date: Tue, 16 Jun 2026 08:56:07 +0000
Subject: [PATCH] Fix: Astro checkOrigin aus (Admin-Form-POSTs hinter
 Basic-Auth) + robustere Directus-Bestellnummer

---
 astro.config.mjs          | 1 +
 src/lib/store-directus.js | 2 +-
 2 files changed, 2 insertions(+), 1 deletion(-)

diff --git a/astro.config.mjs b/astro.config.mjs
index 5999fe1..e8db744 100644
--- a/astro.config.mjs
+++ b/astro.config.mjs
@@ -5,4 +5,5 @@ export default defineConfig({
   output: 'server',
   adapter: node({ mode: 'standalone' }),
   server: { host: '0.0.0.0', port: 4321 },
+  security: { checkOrigin: false },
 });
diff --git a/src/lib/store-directus.js b/src/lib/store-directus.js
index 2c2f290..024e455 100644
--- a/src/lib/store-directus.js
+++ b/src/lib/store-directus.js
@@ -33,7 +33,7 @@ function payload(d){
 export const listOrders = async () => (await api('/items/orders?limit=-1&sort=-created_at')).map(O);
 export const getOrderById = async (id) => O(await api(`/items/orders/${id}`));
 export async function createOrder({ email, customer_name, items, total_cents, status='pending', address='' }) {
-  const existing = await api('/items/orders?limit=1&sort=-id&fields=number');
+  const existing = await api('/items/orders?limit=1&sort=-number&fields=number');
   let n = 1042; if (existing[0]?.number) { const m = parseInt(String(existing[0].number).split('-')[1]); if (!isNaN(m)) n = m; }
   const number = 'PMPNZNG-' + (n + 1);
   const o = await api('/items/orders', { method:'POST', body: JSON.stringify({ number, email:email||'', customer_name:customer_name||'', status, total_cents:total_cents||0, items:items||[], address:address||'', created_at: new Date().toISOString() }) });