Auth fixes, show correct cost each value on pos

inventory-server/dashboard/acot-server/routes/events.js

@@ -51,7 +51,8 @@ router.get('/stats', async (req, res) => {
       console.log(`[STATS] Getting DB connection... (excludeCherryBox: ${excludeCB})`);
       const { connection, release } = await getDbConnection();
       console.log(`[STATS] DB connection obtained in ${Date.now() - startTime}ms`);
-    
+      try {
+
     const { whereClause, params, dateRange } = getTimeRangeConditions(timeRange, startDate, endDate);
     
     // Main order stats query (optionally excludes Cherry Box orders)
@@ -374,33 +375,27 @@ router.get('/stats', async (req, res) => {
       }
     };
     
-    return { response, release };
-    };
-    
-    // Race between the main operation and timeout
-    let result;
-    try {
-      result = await Promise.race([mainOperation(), timeoutPromise]);
-    } catch (error) {
-      // If it's a timeout, we don't have a release function to call
-      if (error.message.includes('timeout')) {
-        console.log(`[STATS] Request timed out in ${Date.now() - startTime}ms`);
-        throw error;
+    return response;
+      } finally {
+        // Always release the connection regardless of whether the outer Promise.race
+        // used our result. If the timeout wins, this IIFE keeps running in the
+        // background until MySQL responds, then this finally releases. Without it,
+        // every timed-out request permanently leaks one pool slot.
+        release();
       }
-      // For other errors, re-throw
-      throw error;
-    }
-    
-    const { response, release } = result;
-    
-    // Release connection back to pool
-    if (release) release();
-    
+    };
+
+    const response = await Promise.race([mainOperation(), timeoutPromise]);
+
     console.log(`[STATS] Request completed in ${Date.now() - startTime}ms`);
     res.json(response);
-    
+
   } catch (error) {
-    console.error('Error in /stats:', error);
+    if (error.message.includes('timeout')) {
+      console.log(`[STATS] Request timed out in ${Date.now() - startTime}ms`);
+    } else {
+      console.error('Error in /stats:', error);
+    }
     console.log(`[STATS] Request failed in ${Date.now() - startTime}ms`);
     res.status(500).json({ error: error.message });
   }