13 Commits

Include renames

Author	SHA1	Message	Date
admin	1c87b82e70	feat(import): ImportDispatchPolicy (DES1GN ADR D3 §31) — ett objekt, en sanning ... - lib/import-dispatch-policy.ts: maxInlineRows=500 (inline-tak, oförändrat kontrakt), maxRows=5000 (N0D-dispatch-signal), maxBytes=1_000_000 (bytes, UTF-8), format-allowlist ['csv']; ren evaluateImportDispatch() med deterministisk precedens format > bytes > rows - route: taken härstammar från policyn; bytes-koll (ersätter chars); rows > maxRows -> 413 n0d_dispatch_required med hint {capability_id: 0pt.import_execute, job_type: 0pt.import_execute_job, status: UNVERIFIED} (descriptor-gate stängd: aldrig tyst trunkering, aldrig tyst dispatch) - tester: 9 nya (verdict per kombination inkl. gränsvärden 500/501/5000/5001, bytes-gräns, allowlist, precedens; route-koppling 200/413/413) — 21/21 gröna i sviten; full N0D-worker-integration markeras UNVERIFIED	2026-09-30 21:48:16 +02:00
admin	c1648c04a7	feat(orders): CSV-import admin-yta — första riktiga ImportWizard-värden (C8) ... Symmetrisk mot våg 3.4 CSV-export: POST /api/orders/import (validate | dry_run | execute) + /admin/import som renderar @siax/ui ImportWizard (0.14.0) över @siax/import-export runtime (0.2.0). - Servern är enda auktoritet: RFC4180-parse (ingen eval), omvalidering via frysta @siax/contracts-kerneln (validateRows) + hostregler, exekvering genom BEFINTLIG orderlogik (createOrder, tenant-guardad). - Fail-closed: 401 utan principal, 400 okänd header, 413 vid radtak (500), per-rad-atomsäkra inserts — felrad kan aldrig skada OK-rader. - Partiell import: OK-rader skapas, felrader rapporteras per rad (row/field/code). AUD0-audit via 0pts enda producer-boundary (durable outbox under DATABASE_URL). - Reload-persistens: efter execute läses /api/orders om och de nya raderna listas på sidan. - Tester: 12 route-test (happy, partial, auth fail-closed, tak, no-write validate, header, quoting, rad-fel mitt i batch) + 3 SSR-render-test av ImportWizard över runtime-storen. - Deps: @siax/ui ^0.14.0, @siax/charts ^0.5.0, @siax/import-export ^0.2.0; pnpm-overrides till contracts 0.10.0 / import-export 0.2.0 (ui 0.14.0 deklarerar 0.11.0/0.2.1 som ännu ej publicerats).	2026-09-30 15:36:02 +02:00
admin	bc76ebc5e5	feat(orders): CSV-export-endpoint — export-kernelns första adoption (våg 3.4)	2026-09-29 17:01:13 +02:00
admin	a2377215e7	feat(admin): InboxList — orderkön som universal inkorg (våg 3.3-adoption) ... Servern projicerar öppna ordrar (draft/quoted/in_production/review) på universal-inbox-konvolverna via createInboxItem (buildOrderInboxItem i lib/order-flow, ADR-0001-mönstret: policy/resolution i serverlagret). Admin renderar InboxList (@siax/ui 0.11.1) ovanpå orderkön — resolve- aktionen gateras genom advance_action-state (available krävs). Terminala statusar ger ingen post. tests/order-flow 6/6; full svit 1144/1144; build ✓.	2026-09-29 16:10:10 +02:00
admin	a49bc148fc	feat(admin): authz-pilot — server-renderad advance-resolution + ActionGate (ADR-0001) ... GET /api/orders returnerar per order frozen advance_action (resolveAction ur lib/order-flow); admin renderar via ActionGate — policy i serverlagret, presentation i klienten (DoD §21). Terminala/okända statusar → read_only med varför-text i stället för missvisande 'klar'. tests/order-flow.test.ts 3/3; full svit 1138 godkända; typecheck grön.	2026-09-29 12:21:02 +02:00
admin	c7fd9d45a2	fix(prod): map SiaxError in the 7 legacy money routes — DEPENDENCY_UNAVAILABLE/503 instead of opaque 500 (0pt#53) ... getSqlForDurableStore throws SiaxError(DEPENDENCY_UNAVAILABLE, httpStatus 503, retryable) when a money-bearing store would fall back to an in-memory Map in a production runtime (the durable-store guard). The /api/0pt/* surface already maps it via src/http/siax-error-response.ts; the seven legacy routes outside the middleware matcher did not — the documented 503 leaked as Next's opaque 500 with no body. - app/api/siax-error-mapping.ts: shared isSiaxError + siaxErrorResponseForLegacy - orders (POST/GET), orders/[id] (GET/PATCH), subscriptions (GET/POST), payments/deposit, payments/release, admin/metrics: try/catch -> mapper, each route's own typed error contract preserved (idempotency conflict 409 etc.) - webhooks/stripe: store outage -> 503 received:false reason:store_unavailable so Stripe's delivery retry path stays open (never a silent received:true) - tests/api/legacy-routes-siax-error-mapping.test.ts: pins the 503 + body	2026-09-22 04:33:57 +02:00
admin	a1557b2a7d	feat(payments): bind orders to verified tenant and buyer	2026-09-15 19:53:58 +02:00
admin	cecc2bc637	fix(payments): authenticate order detail and deposit checkout	2026-09-15 19:09:53 +02:00
admin	7ce92827c0	fix: close demo payment bypass and guard order transitions	2026-09-15 18:52:23 +02:00
Simon AxelssonandClaude Sonnet 5	dc6aaa0e10	fix(data-os): P014 — close tenant-isolation + idempotency gaps, execute real restore drill ... Tenant isolation (security-critical): every app/api/0pt/** route reading tenant_id from client-controlled query/body never cross-checked it against the token middleware.ts already verified (x-0pt-verified-tenant). Adds a shared assertTenantMatchesVerified guard and wires it into all 20+ affected routes. Also closes two full-leak-by-omission bugs found in this pass (documents/capture and lakehouse/mappings GETs returned every tenant's rows when tenant_id was simply omitted) and two "no tenant check at all" reads (rate-policies/[id], lakehouse/mappings/[id]) reachable by ID alone. Duplicate-delivery idempotency (correctness-critical): POST /api/orders now honors Idempotency-Key (sql/006, replay-or-409-on-conflict, Postgres + in-memory); the Python orchestrator's POST /orders/{id}/run — the actual delivery trigger — is now idempotent under an asyncio lock, closing a real concurrent-request race, not just the sequential-retry case. Engine-duplication resolution: adaptive_router.py's docstring wrongly invited a bypass ("see b0ts for scraping") contradicting the product's own compliance stance; corrected, and given real (additive, not escalating) block-signal tracking so a rate-limited/blocked source is excluded from the plan instead of hammered. Also fixes a previously-undiscovered production bug: the Python engine's only call into the TS quality bridge (X-Internal-Token) was unconditionally 401'd by middleware.ts, which never checked that credential — the advisory quality bridge was unreachable in any environment enforcing auth. Restore drill: executed for real against throwaway Docker Postgres containers (not simulated). Found and fixed two real blockers along the way: sql/004 referenced opt_datasets, which no migration ever created (chain was never actually runnable end to end); lib/db.ts hardcoded ssl:"require", making any non-TLS Postgres (incl. compose.dev.yaml's own local-dev container) unreachable. After both fixes: full migration chain applies cleanly, pg_dump/pg_restore round-trip is byte-identical (row counts + content checksums), and real application code (lib/orders-store.ts, SourceRegistryService's Postgres repository) reads the restored data back correctly, including cross-tenant isolation still holding. 82 new tests (55 TS + 27 Python), all passing; full existing suite (291 TS + 55 Python) still green; typecheck clean on every changed/added file. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-09-03 12:00:43 +02:00
adminandClaude Sonnet 5	15a0dbe3b1	fix(security): require auth on GET /api/orders and GET /api/admin/metrics ... A live compliance audit against 0pt.app confirmed both endpoints returned HTTP 200 with zero authentication -- the full order queue and financial pipeline aggregates (deposit/pipeline totals) were readable by anyone. Root cause: middleware.ts's matcher only covers /api/0pt/:path*, by design ("does NOT touch ... the unrelated payment/order APIs"), so nothing upstream of these two handlers ever verified the caller. Fix: both GET handlers now call the same fail-closed Zitadel verifier /api/0pt/* relies on (resolveAuthContext, src/auth/context.ts) directly, via a new thin wrapper (src/auth/require-route-auth.ts) that maps a rejected decision to the same 401/403 JSON shape middleware.ts already returns. The wrapper re-verifies the bearer token itself rather than trusting any x-0pt-verified-* header on the request, since middleware never runs in front of these routes to overwrite a client-supplied one. POST /api/orders (anonymous draft/quote creation before the deposit-payment step) is intentionally left as-is -- only the read paths that leaked data are gated. Tracked as part of docs/compliance/BACKLOG.md P0-3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 04:06:13 +02:00
adminandClaude Opus 4.8	e6d3101501	fix: 17 confirmed bugs from full-repo audit (edge + Python engine) (#5) ... * docs: correct stale quality-check-service.ts comment references Two source comments still cited src/services/quality-check-service.ts as an existing precedent. It doesn't exist anywhere in this repo's history (git log --all: zero commits, any branch, ever) -- confirmed during the earlier full-doc-corpus accuracy pass. Points each comment at the real precedent instead (document-extraction-service.ts / iceberg-write-service.ts). Applied from task_05ec36aa, spun off during that pass. * fix: 17 confirmed bugs from full-repo audit (edge + Python engine) Found by an 8-finder bug hunt across app/api, src/services, src/clients, frontend, the Python engine, the data layer, config/infra, and tests, then independently adversarially verified per finding (32 raw findings -> 27 confirmed real bugs; 5 refuted). This commit applies the 17 confirmed as safe, mechanical fixes -- no architecture/design decision required. The other 10 need a decision and are reported separately, not touched here. Most consequential, app/api/payments/[order_id]/deposit/route.ts: the client-supplied Origin request header was trusted unsanitized both as a server-side fetch target (SSRF) and as Stripe Checkout success/cancel redirect URLs (open redirect tied to a real payment flow), and a failed order lookup silently fell through to a hardcoded deposit amount instead of 404. Fixed by reading the order directly via lib/orders-store.ts (mirroring the sibling release/route.ts, which already did this correctly) instead of both trusting the Origin header and self-issuing an HTTP fetch. Also fixed: - 5 routes (orders, orders/[id], estimates, subscriptions, ai/parse) that 500'd instead of 400ing on a literal JSON `null` body, since req.json() resolves (not rejects) for that input and bypasses the try/catch guard. - app/api/0pt/lakehouse/mappings/{,[mappingId]/{,writes/}}route.ts each instantiated their own private service instances, so a mapping created via POST was invisible to the sibling GET and writes routes even before the separately-tracked dataset-registration gap. Extracted a shared singleton module, src/services/lakehouse-mapping-registry.ts. - app/api/0pt/documents/[documentId]/extraction/route.ts collapsed every error (not-configured, policy-denied, policy-approval-required, not-found) into a blanket 400; now status-mapped like the sibling sources/[sourceId]/query route. - app/api/vehicles/route.ts: plate query param wasn't URL-encoded before being concatenated into the outbound RDW request, allowing extra query parameters to be injected; added a strict allowlist + encodeURIComponent. - app/api/uploads/route.ts: POST returned a fake 200 success with put_url: null even when "configured", instead of continuing to report 501 until presign generation is actually implemented. - src/adapters/document-intelligence-adapter.ts: the result-polling loop never checked response.ok, so a non-2xx poll response (auth expiry, 429, 5xx) was silently retried until a generic timeout masked the real error. - app/order/[id]/page.tsx: finish() never cleared the production-simulation setInterval, so it kept firing (and re-rendering) forever after delivery. - app/admin/page.tsx: the metrics fetch had no response/shape validation (unlike the adjacent orders fetch), rendering literal "undefined" stat tiles on a malformed response instead of falling back to <ErrorState/>. - services/api/workers/pipeline.py: `config.get("seeds") or DEMO_SEEDS` used truthy-or, so an explicit empty seeds dict was silently replaced with hardcoded demo org numbers instead of being respected as empty. - services/api/workers/resolve.py: corroboration (confidence/agreed_sources bump) no longer fires for two hits from the same source under fuzzy match -- only a genuinely independent source now counts, per docs/06's own ">=2 independent sources agree" definition -- and a merged record's provenance array now actually includes the corroborating source's fields instead of only a bare source-name string. - services/api/orchestrator/main.py: create_order's int(...) on unvalidated client volume/confidence fields raised on any decimal-formatted input (int("92.5") -> ValueError); now coerced via float() first with a safe default. /vehicles/{plate} and /screen also now catch connector exceptions and degrade gracefully, matching pipeline.py's existing pattern for the same connectors. - lib/orders-store.ts: postgres.js (pinned v3.4.9) returns bigint/numeric columns as strings by default; getOrder/listOrders/setStatus were silently handing callers stringified money fields. Added a narrow per-row coercion instead of touching the shared client's global type map (which would affect unrelated tables' bigint/numeric columns too). - lib/subscriptions-store.ts: the in-memory fallback returned oldest-first while the Postgres branch explicitly orders newest-first; now consistent, mirroring the identical fix already in orders-store.ts. - app/api/auth/login/route.ts: DEV_LOGIN_KEY was compared with a plain !==, a non-constant-time comparison; replaced with crypto.timingSafeEqual. Verified before commit: tsc --noEmit clean; vitest run 88 passed, 1 todo, 0 failures (13 files, unchanged from before this commit -- no existing test's assertions needed to change). services/api/workers/resolve.py's source-novelty and provenance-merge logic additionally verified by direct execution against synthetic same-source/cross-source inputs (no Python test suite exists in this repo to add to). services/api/workers/pipeline.py and services/api/orchestrator/main.py verified with python -m py_compile (no httpx/fastapi installed in this environment to run them directly). Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com> * fix(engine): treat explicit seeds:null as missing to avoid 500 in run_job Four-eyes follow-up to this PR's own seeds change. Switching from `config.get('seeds') or DEMO_SEEDS` to `config['seeds'] if 'seeds' in config` correctly stopped an explicit empty {} from being backfilled with DEMO_SEEDS, but regressed on client-controlled `{"seeds": null}`: seeds became None and the downstream `seeds.get(market, [])` raised AttributeError -> 500. That path is reachable (POST /orders stores raw body.config; POST /orders/{id}/run passes it straight to run_job). Using `config.get('seeds') is not None` keeps the intended behaviour (explicit {} honoured, never silently seeded with demo data) while restoring the None-tolerance the old idiom had. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com> --------- Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>	2026-07-22 18:52:19 +02:00
adminandClaude Opus 4.8	0b09ee5795	feat(api): order persistence (Postgres or in-memory fallback) + orders API ... lib/db (env-guarded postgres-js), lib/orders-store (createOrder/getOrder/listOrders/setStatus, DB-or-memory), /api/orders (POST create+estimate, GET list), /api/orders/[id] (GET, PATCH status with escrow-safe state machine). Activates fully on DATABASE_URL/POSTGRES_URL. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 18:11:34 +02:00