Fix staff analytics

backend/src/main/java/com/petshop/backend/controller/AnalyticsController.java

@@ -5,9 +5,11 @@ import com.petshop.backend.entity.User;
 import com.petshop.backend.repository.UserRepository;
 import com.petshop.backend.service.AnalyticsService;
 import com.petshop.backend.util.AuthenticationHelper;
+import org.springframework.http.HttpStatus;
 import org.springframework.http.ResponseEntity;
 import org.springframework.security.access.prepost.PreAuthorize;
 import org.springframework.web.bind.annotation.*;
+import org.springframework.web.server.ResponseStatusException;
 
 @RestController
 @RequestMapping("/api/v1/analytics")
@@ -26,6 +28,12 @@ public class AnalyticsController {
     public ResponseEntity<DashboardResponse> getDashboard(
             @RequestParam(defaultValue = "30") int days,
             @RequestParam(defaultValue = "10") int top) {
+        if (days < 1 || days > 365) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "days must be between 1 and 365");
+        }
+        if (top < 1 || top > 50) {
+            throw new ResponseStatusException(HttpStatus.BAD_REQUEST, "top must be between 1 and 50");
+        }
         User user = AuthenticationHelper.getAuthenticatedUser(userRepository);
         return ResponseEntity.ok(analyticsService.getDashboardData(days, top, user));
     }

backend/src/main/java/com/petshop/backend/service/AnalyticsService.java

@@ -107,6 +107,9 @@ public class AnalyticsService {
         Map<Long, DashboardResponse.TopProduct> productSalesMap = new HashMap<>();
 
         for (Sale sale : sales) {
+            if (sale.getIsRefund()) {
+                continue;
+            }
             for (var item : sale.getItems()) {
                 Long productId = item.getProduct().getProdId();
                 String productName = item.getProduct().getProdName();
@@ -142,6 +145,9 @@ public class AnalyticsService {
         }
 
         for (Sale sale : sales) {
+            if (sale.getIsRefund()) {
+                continue;
+            }
             LocalDate saleDate = sale.getSaleDate().toLocalDate();
             if (dailySalesMap.containsKey(saleDate)) {
                 DashboardResponse.DailySales dailySale = dailySalesMap.get(saleDate);