607 Commits

Author	SHA1	Message	Date
Jakob Wennberg	338ac4e913	fix(vat): make the ruta drill-down reconcile with the figure it explains (#2016) ... * fix(vat): make the ruta drill-down reconcile with the figure it explains get_vat_declaration_totals drops four classes of entry before summing: posted closing entries, source_type 'vat_settlement', the two kontantmetod year-end reversals, and anything shaped like a momsredovisning. The drill-down behind each ruta filtered on company, status and date only. So expanding a ruta listed verifikat that are not in the number it claims to explain, and the panel shows no total that would reveal the mismatch. On production, 322 posted/reversed entries carrying 26xx lines across 214 companies sit in those excluded classes. A momsdeklaration is räkenskapsinformation under BFL 5 kap. and this drill-down is what a consultant uses to substantiate a filed figure, so the two have to agree exactly. The exclusion CTEs are lifted verbatim from the figure rather than re-derived, because any divergence reintroduces exactly this bug. The new pg test asserts the equality for the whole account set at once, so editing one function and not the other fails CI instead of silently misreporting. opening_balance entries are deliberately kept: the figure exempts them from its `shaped` set, which leaves their lines in the totals, so excluding them here would break the equality in the other direction. That has its own test. Verified the test catches the defect by reinstalling the old function body and watching it fail with the real numbers (2611: drill-down 250/240 vs figure 0/200), then restoring. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(vat): update the existing drill-down pg test to the new signature get_vat_ruta_source_lines gained p_ruta_accounts / p_net_accounts, and production-error-regressions.pg.test.ts still called the old 9-argument form, so pg-real failed with 42883 "function does not exist". I had grepped app/, lib/ and extensions/ for callers and not tests/. Neither fixture in that paging test is settlement-shaped, so paging behaviour is unchanged; the equality itself is covered by the new reconcile test. Also documents, in the tool-pg reset script, that its blanket grant to `anon` (which PostgREST requires) makes that database invalid for the pg-real suite: ~29 of those files assert least privilege and fail there even on unmodified main. That cost a confusing local run. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-29 00:29:11 +02:00
Jakob Wennberg	4e1eb3d662	fix(cash-accounts): never propose or accept an orphaned twin ledger as counter-account; match and re-point across sibling ledgers (#1643) (#2010) ... * fix(cash-accounts): never propose or accept an orphaned cash-account ledger as counter-account (#1643) A broken bank reconnect leaves cash_accounts rows that share the live account's IBAN (held by a revoked connection, or demoted to manual by the #916 fix). Three consequences are fixed here: - Problem 4 (silent mis-booking): the own-account transfer detector paired with such an orphan and proposed its ledger as the counter-account, and a counterparty template learned from that result replayed as 1940/1931 in the booking dialog. The detector now tolerates several rows on one IBAN, never pairs with the transaction's own row, a disabled row, or a revoked holder; the mapping engine drops a "transfer" whose counter equals the settlement account; suggest-categories withholds learned suggestions that reference an orphaned ledger; and both commit paths (POST /api/transactions/[id]/categorize, categorizeMatchedTransaction) reject with the new TX_CATEGORIZE_ORPHANED_COUNTER_ACCOUNT (400). Orphans are only refused in the COUNTER position: a stranded row still settles on its own ledger, and a manual account without a live IBAN twin is never treated as orphaned, so transfers between two live accounts keep booking. - Problem 1 (match dialog): the ranked unmatched-entries path also offers vouchers booked on sibling ledgers of the same IBAN, and manualLink accepts a voucher line on a sibling ledger. When it does, the same locked UPDATE re-points transactions.cash_account_id to the live sibling row (currency-gated, like PATCH /api/transactions/[id]/cash-account) so the account-keyed reconciliation does not count a cross-account link as an imbalance on both ledgers. - Problem 3 (naming): allocatePsd2LedgerAccount names the chart account BAS-style (BAS reference name for a standard slot, else "Bankkonto <CUR>") instead of the ASPSP-reported holder name. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): address review findings on the orphaned-ledger guards (#1643) One in-memory topology (cash_accounts rows + bank_connections status) now defines "live", "orphaned" and "same physical account" for the transfer detector, the match/link flows and every commit guard, so a proposal is never made that a guard later rejects. - Finding 1/4/6 (own IBAN as counterparty): findPairableCashAccountByIban treats the transaction's own IBAN as "not a transfer": every same-currency row on that IBAN is the same physical account, whichever is live, so interest stamped with the own IBAN never pairs with a twin (two active rows, a demoted-manual twin, or a live twin of a stranded row). Only a pocket in another currency on that IBAN can still pair. guardCounterLegs refuses a same-IBAN same-currency twin in the counter position on every commit path, even when both rows are active. - Finding 3: with several surviving candidates (currency pockets with no discriminator, or two active twins) the finder returns null instead of picking the lowest ledger, which is what the pre-PR lookup did. - Finding 5: the finder drops every row in the orphaned set, the same predicate the commit guards use (demoted-manual twins included). - Finding 9: "live" means enabled + connection status 'active'; an expired/error twin of a live row is orphaned, a lone expired connection (re-auth window) is not. - Finding 2: siblings are keyed on (normalized IBAN, currency) in describeCashAccountSiblings and the unmatched-entries route, so a SEK transaction can no longer link to a voucher whose only bank leg is on the EUR pocket of the same IBAN; manualLink rejects that as before. - Finding 8: manualLink re-points a row only when the voucher sits on the LIVE sibling and the own row is not live; the reverse direction links without moving the row. - Finding 7: the v1 REST categorize route runs the same guardCounterLegs check after account_override and returns TX_CATEGORIZE_ORPHANED_COUNTER_ACCOUNT. MCP stages through categorizeMatchedTransaction, already covered. - Finding 10: a learned template whose stale 19xx leg is a twin of the settlement row is rewritten to the settlement account (it is the bank leg, not the counter) instead of refused; suggest-categories exempts each transaction's own settlement ledger before withholding a suggestion. The error message now covers both the twin and the disconnected case. Tests pin each behavior (service, detector, manualLink, unmatched-entries, dashboard and v1 categorize routes, suggest-categories). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): address round-2 review findings (#1643) 1+3. Orphan derivation keyed on (IBAN, currency): loadCashAccountTopology now keys the live twin on normalized IBAN plus currency (the rule every other "same physical account" check in the PR already used), so a manual or deselected GBP/EUR pocket beside a live SEK pocket of a multi-currency account is never orphaned, still pairs in the transfer detector and is accepted as counter at commit. Twin computation is shared (twinLedgersOf). 2. suggest-categories mirrors guardCounterLegs: a learned 19xx leg that is a twin of the transaction's own row is rewritten to the settlement ledger in the offered suggestion instead of being withheld; only a true counter-position orphan (or a twin that would book the settlement ledger against itself) is withheld. One topology load per batch (loadCounterLegTopology). 4. The free-form dialog path (POST /api/transactions/[id]/book) gets a line-level guard (guardBookedCounterLines): a 19xx line that is a twin of the transaction's own row or an orphaned ledger, alongside the settlement leg, is refused with TX_CATEGORIZE_ORPHANED_COUNTER_ACCOUNT. Only runs when the lines touch two distinct 19xx ledgers. The twin rewrite in suggest-categories (2) covers the both-active shape before the dialog is even opened. 5. manualLink re-points the row onto the sibling ledger the voucher was booked on whenever the sibling is live or the own row is not (both-live twins and both-dead rows included); only a live row whose voucher sits on a dead sibling links without moving. unmatched-entries now uses describeCashAccountSiblings and does not offer dead-sibling vouchers to a live row. DECISIONS.md: the PR's existing review follow-up line amended. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): address round-3 review findings (#1643) 1. Revoked-held rows are no longer orphaned unconditionally. A row whose connection is revoked is orphaned only under the twin rule (not live AND a live row shares its normalized IBAN + currency), so a disconnected-but-real account (the company's only 1930, or two real accounts on one revoked connection) stays pairable by the transfer detector and bookable as counter on every guarded path. Tests cover the no-twin case for getOrphanedCounterLedgers, findPairableCashAccountByIban, detectOwnAccountTransfer, guardCounterLegs and guardBookedCounterLines; the existing revoked tests now use a twin shape. 2. manualLink / unmatched-entries decide the re-point on the destination: a new shouldRepointToSibling moves onto a live sibling, or onto a dead one only when the own row's holder is gone (released: bank_connection_id null or revoked) and no sibling is live. An expired/error/pending own row links without moving. SiblingCashAccount gains `released`. Tests: expired own row + demoted twin links without moving and the twin's vouchers are not offered. 3. loadCounterLegTopology is exercised directly: settlement ledger and twins, other-currency pocket, null/unknown ids, cache, orphan set equal to guardCounterLegs' refusals on the same fixture, lookup failure. 4. guardBookedCounterLines docstring and the /book route comment now state that only the two-cash-legs shape is inspected; a single hand-typed 19xx line is not (covering it would cost a cash_accounts lookup on every ordinary booking). DECISIONS.md lines amended accordingly. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): address round-4 review findings (#1643) 1. Same-connection re-registration twins (the dominant prod shape): two enabled rows on one active connection sharing (IBAN, currency) are now told apart by balance_updated_at; only the most recently synced row is live, the other is a stale twin (orphaned as a counter, never a re-point destination, and the transfer detector pairs with the syncing row alone). Rows with no stamp or the same stamp both stay live. 2. POST /book: a single 19xx line that is a sibling ledger the row should move to (the live twin of a stranded row) re-points cash_account_id in the same locked UPDATE that links the voucher, mirroring manualLink. guardBookedCounterLines returns { refusedLedger, repointCashAccountId }; an ordinary booking pays one PK read of the own row. 3. manualLink refuses the link (success:false, Swedish error) when the voucher sits only on a dead sibling instead of writing a cross-account link with a server-side warn; the REST and MCP link callers reach it without the unmatched-entries filter. 4. manualLink judges a voucher touching several sibling ledgers on the best of them (a live sibling, else the first the row may move to) instead of the first line PostgREST returns. Tests pinned in lib/cash-accounts, lib/reconciliation and the /book route; the two DECISIONS.md lines for #1643 amended in place. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): address round-5 review findings (#1643) 1/2/5. Same-connection twin liveness no longer ranks on cash_accounts.balance_updated_at (a connect-time snapshot the sync never refreshes, inverted on prod in 4 of 5 stamped groups). The live row is the one whose external_uid the bank still lists in bank_connections.accounts_data (rewritten on every sync); no listing, both listed or neither listed keeps both rows live (round-3 behavior). getConnectionStatuses selects accounts_data in the same query. 3. guardBookedCounterLines single-19xx-line shape: a twin the row may not move to (dead or disabled) is refused with TX_CATEGORIZE_ORPHANED_COUNTER_ACCOUNT instead of posting the only bank leg on the dead ledger; an unrelated 19xx line still posts as typed. Route test added. 4. Disabled cash_accounts rows are never siblings, so neither manualLink nor /book re-points a transaction onto a deselected row; a voucher booked only there is refused as a cross-account link. 6. PR body rewritten to the final rules; DECISIONS.md round-4 line amended (signal correction, /book refusal, disabled siblings). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): never treat a null external_uid as listed by the bank (#1643) CashAccount.external_uid is nullable in the shared type; the same-connection twin rule now skips null uids instead of passing them to Set.has, which failed the strict type check in CI. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(cash-accounts): drop the same-connection twin liveness rule; both rows stay live (#1643) Two enabled rows on one active bank connection sharing (IBAN, currency) are no longer ranked. Round 4 ranked on cash_accounts.balance_updated_at and round 5 on external_uid presence in bank_connections.accounts_data; each was verified against prod and each was contradicted by it (ingest routes by the accounts_data entry's ledger_account, which in two groups points at the OLD row, so the "stale" row is the one still being fed). Restores the round-3 behavior: neither twin is orphaned, the transfer finder returns null when both survive, no guard refuses either, and shouldRepointToSibling treats both as live siblings. No replacement signal; how to model the shape is a founder decision (PR #2010 review). getConnectionStatuses no longer selects accounts_data. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-29 00:26:47 +02:00
Mattsson	7f0f25b558	feat(account): self-service login email change with double confirmation (#2017) ... * feat(account): self-service login email change with double confirmation New POST /api/account/email requests the change via the user session so Supabase's AAL2 guard applies, and the account settings page gets an email row with pending-confirmation state. Confirmation mails (both addresses) and the /auth/callback email_change verification already existed; this wires the missing initiation. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p * feat(account): map email_exists to a 409 with Swedish copy Changing to an address that already has an account is refused by GoTrue (addresses are unique per auth user); surface that as a clear conflict instead of the generic fallback. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p * fix(account): trusted redirect origin + profiles.email sync trigger (skeptic findings) - emailRedirectTo now derives from resolveRequestAppOrigin(): request.url can be an internal origin behind a proxy (dead confirmation links on self-hosted) and auth links must not follow attacker-chosen hosts; registered white-label hosts keep their brand. - New migration 20260828191950: sync_profile_email trigger mirrors auth.users.email changes into profiles.email (member lists, notification recipients, AGI/KU contact, invite dedup all read profiles.email), plus a backfill for already-diverged rows. pg-real test included. - Save button disabled while the same address awaits confirmation (no rate-limit re-fires); GoTrue's 'error sending email change email' now maps to the Swedish SMTP guidance. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p * fix(account): idempotent repeat request for the pending address CodeRabbit follow-up: a second POST for the address already awaiting confirmation now returns the pending state without another GoTrue round trip (no duplicate confirmation mails, no rate-limit burn). Claims-mapped sessions lack new_email; GoTrue's send rate limit remains the backstop. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018sbGMZQE5W7KfSVFjK7E4p --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 22:12:20 +02:00
Mattsson	e8aa0670ca	feat(salary): agent path to set this month's per-run salary (#2015) ... * feat(salary): agent path to set this month's per-run salary Agents could not do variable owner pay: the only per-run edit tool, gnubok_update_payslip_line, edits the display-only Grundlon line that every recalculation rebuilds from salary_run_employees.monthly_salary, so the fixed employee salary silently won (user-reported). - lib/salary/run-employees.ts: setRunEmployeeSalary() shared service (draft gate, roundOre, 0 = nollkorning, display-line refresh); the cookie route PATCH now delegates to it (behavior unchanged) - MCP: gnubok_set_run_salary staged tool (search catalog: tools/list budget at zero headroom), op type set_run_salary (medium risk), commitSetRunSalary executor, payroll:write scope, payroll_month loadout + payroll-monthly skill step; update_payslip_line description now warns that recalc rebuilds base salary lines - v1 REST: PATCH /salary-runs/{id}/employees/{employeeId} accepting monthly_salary (draft only, dry-run, idempotency key) - Migration pair (NOT VALID + VALIDATE) adds set_run_salary to the pending_operations op-type CHECK; base list verified against prod live - Tests: service, staged tool, executor, cookie route, v1 route; spec snapshot updated Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP37pE3zk667nP6S766iJG * fix(salary): harden set_run_salary per skeptic + CI findings - Clear calculation_breakdown when the per-run salary changes so the existing book preflights force a recalculation: a run can no longer be booked with gross/tax derived from the old salary (skeptic R1) - Enforce SALARY_OVERRIDE_MAX (10 MSEK) in the shared service and the v1 body schema: closes the unbounded/1e307-overflow path that wrote Infinity -> NULL -> 500 (skeptic R2) - Promote gnubok_set_run_salary to the default catalog: a search-only WRITE is uncallable on Claude.ai (update_customer lesson) while three surfaces pointed agents at it; payload ceiling bumped 63.8K -> 64.4K with a ledger entry, read-demotion left as its own change (skeptic R3) - Granskning label type_set_run_salary in vocabulary.ts + sv/en (R4) - Display-line refresh is fire-and-forget again (write already committed; matches pre-refactor route behavior) and DB error details carry the SQLSTATE code for Swedish error mapping - v1 risk metadata aligned to 'medium'; NOT_DRAFT message now covers salary edits, not just roster changes - npm run apiskill:generate committed (CI apiskill:check failure) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP37pE3zk667nP6S766iJG * chore(migrations): rename set_run_salary pair past main's newest versions origin/main gained 20260828120000 and 20260828154800 after this branch staged 20260828110000/1; out-of-order versions are skipped at merge, so the pair moves to 20260828160000/1 (byte-identical SQL, reference in the VALIDATE header updated). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP37pE3zk667nP6S766iJG * chore: retrigger Supabase preview after migration-version repair The preview branch tracked 20260828110000/1 before the rename to 20260828160000/1; the orphan rows are deleted from the preview branch's schema_migrations (preview only, prod never saw those versions) and this empty commit re-runs the tasks. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MP37pE3zk667nP6S766iJG --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 18:14:31 +02:00
Jakob Wennberg	a4ceaafa4f	feat(inbox): per-item underlag anchoring status and a daily reconcile cron for stranded underlag (#1548) (#2012) ... * feat(invoice-inbox): per-item underlag status and daily reconcile of stranded booked items (#1548) The inbox derives "booked" from the matched transaction's verifikat, but that says nothing about whether THIS item's document reached it: a link that failed at propagation time, or a document anchored to another verifikat, read as booked while the verifikat sat without its underlag (BFL 5 kap 6-7 §). GET /items and /items/:id now also emit underlag_status (anchored | unlinked | anchored_elsewhere) from one batched document_attachments read; the workspace keeps divergent items in "Att göra", drops the booking bridge for them (the book routes 409 on a booked transaction) and shows one explanatory line with a link to the verifikat. The backfill script's loop moves into lib/transactions/ inbox-underlag-reconcile.ts and runs daily from a new extension-owned cron (vercel.json plus the generated Docker crontabs): transient link failures heal without an ad-hoc script run, permanent conflicts are counted in one summary, and each repaired transaction leaves an InboxUnderlagReconciled row in behandlingshistorik. That event type is registered by migration 20260828154800: processing_history.event_type has an FK to processing_event_types, and the script's previous InboxUnderlagBackfilled type was never registered, so its appends had always failed silently. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(invoice-inbox): address review findings on the underlag reconcile (#1548) Findings 1, 3, 6 (scan cap starves the tail): the reconcile no longer caps the read. The matched-unconsumed candidate set holds permanent residents (samlingsverifikat siblings, anchored-elsewhere items) that never leave it, so a uuid-ordered read cap would revisit the same 1000 rows every night and never reach a stranded item sorting past the cut. The scan now pages through every candidate (four columns per row) and maxItems bounds the WORK: at most that many unlinked (or unreadable) items are propagated per run; already-anchored, anchored-elsewhere and locked items are counted from the pre-state without a propagation or budget. Items past the budget are counted as deferred and truncated is logged at warn level. Findings 2, 5 (false "linked automatically" promise for locked periods): resolveUnderlagAnchoring reads the fiscal period lock state of the verifikat for every unlinked item and reports unlinked_locked when is_closed or locked_at is set, the same pair enforce_period_lock_documents checks. The reconciler counts it separately (unlinkedLocked), never propagates it and never warns "still unlinked after re-run"; the rail shows a message that says the period must be unlocked first. Findings 4, 7 (absent anchoring read as booked): the list and detail enrichment emit underlag_status 'unknown' when the helper could not read the document row, and the workspace treats any status but 'anchored' as divergent (stays in Att göra, no booking bridge, own message). classify() counts a repair only when the pre-state was explicitly unlinked, so an unreadable before-read never earns an InboxUnderlagReconciled event. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(invoice-inbox): address round-2 review findings (#1548) 1. [minor] Round-1 fix dropped propagation for transactions whose inbox items already read anchored, so the pinned-document leg (transactions.document_id) was never repaired and settled items never received their created_journal_entry_id stamp, staying in the scan and inflating alreadyAnchored every night. reconcileCompany now propagates every stranded transaction that has an unlinked (budgeted) item or an anchored / document-less item, outside the maxItems budget: the helper is idempotent and the stamp shrinks its own population. Locked-only and anchored-elsewhere-only transactions stay skipped. Counting and the behandlingshistorik trail are unchanged (anchored items keep their pre-state verdict, no event). Tests updated and a new case pins the anchored-item plus document-less-item transaction: propagated, no after-read, no history. DECISIONS line amended. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 17:45:10 +02:00
Jakob Wennberg	ad8566f1ae	feat(settings): per-company data-analysis opt-in gating the calibration corpus (#1346) (#2007) ... * feat(settings): per-company opt-in for data analysis of bookkeeping outcomes (#1346) Adds company_settings.data_analysis_opt_in (default false, no grandfathering) and gates every path that reads bookkeeping outcomes across companies on it: POST /api/agent/categorize/outcome stops writing calibration samples for companies that have not opted in, and the backtest / calibration-fit scripts filter to opted-in company ids. One helper (lib/company/data-analysis.ts) is the single gate for future analysis paths. A toggle on Inställningar > Företag states plainly what is analysed (proposed vs booked account, amount, confidence; no free text, no personal data) in sv and en. The flag is UI-only by design: consent is a human action, so it is absent from the v1 REST / MCP settings pick lists. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(settings): make data-analysis consent copy true for the backtest path (#1346) Addresses adversarial review findings on PR #2007: - Findings 1-3 (consent narrower than the gated processing): the flag also gates scripts/backtest-categorize.ts, which re-runs transaction descriptions, merchant names and matched underlag through the model. The sv/en toggle help and disclosure now state that explicitly as "evaluation runs" and no longer claim that free text or underlag are excluded. The migration header and COMMENT, the lib/company/data-analysis.ts docstring, the backtest script header and the DECISIONS line say the same. Kept the gate (un-gating would put the script back to reading every company with no consent at all). A test pins that both locales name those inputs and contain no "no free text / no underlag" denial. - Finding 4 (member sees an active switch that RLS rejects): the toggle is now enabled only for owner/admin, matching the company_settings update policy; the disclosure says only administrators can change the choice. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(scripts): address round-2 review findings (#1346) 1. [minor] Opted-in company filter was an unbounded PostgREST `in` list in the URL (scripts/fit-categorize-calibration.ts, scripts/backtest-categorize.ts). Both scripts now read the opted-in ids through a shared, paginated helper (listDataAnalysisOptedInCompanyIds, fetchAllRows so the pre-fetch no longer caps at 1000) and query per chunk of 100 ids (chunkCompanyIds). The fit script pages each chunk on the id PK; the backtest merges per-chunk results and re-cuts to the N most recent overall. Early exit on zero opt-ins is kept. Pinned with tests in lib/company/__tests__/data-analysis.test.ts. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(scripts): coerce a null transaction description in the backtest (#1346) The typed row from the chunked consent query made description nullable, which TransactionForSelect does not accept; fall back to the original description or an empty string, as the untyped row did implicitly before. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 17:38:36 +02:00
Jakob Wennberg	33a58bec51	fix(webshop-orders): shared effective-rate helper and order-context refusal for the rate-0 slot (#1912) (#2008) ... * fix(webshop): share rate classification and check rate-0 order context in bulk book (#1912) The bulk revenue template's guard copied fetchDynamicVatAccounts' effective-rate precedence (explicit momssats > treatment > class-3 number+name inference), so the two could drift. Both now call one exported helper, resolveEffectiveVatRate, and a sibling resolveRevenueVatBox resolves the momsdeklaration box for a revenue account (treatment ruta first, then the static BAS map). The rate-0 slot also ignored order context: a domestic 0% order could be routed to an export account (ruta 36) and vice versa, misstating rutor 35-42 with no VAT amount to catch it. The sweep now refuses, per order, a 0% bucket whose billing country contradicts the chosen account's box: ruta 36 vs SE or an EU country, ruta 40 vs SE, ruta 35/38/39 vs SE or a non-EU country. Unknown country (Shopify), domestic boxes (42/41/07) and unclassified accounts are unchanged; the domestic-account + foreign- country direction stays advisory in the dialog. Item 1 of the issue (require a positive momsfri/export/EU classification for the slot) is deferred: most such accounts are unconfigured today and the strict rule needs a configure path first (DECISIONS.md). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(webshop): address review findings (#1912) - Finding 1: the rate-0 context guard keys on customer_country, which the WooCommerce sync stores from the billing address; the goods boxes 35/36/38 follow the delivery destination, so a Swedish-billed order shipped outside the EU is a legitimate ruta 36 export the sweep refuses. Soften the WEBSHOP_ORDER_ZERO_RATE_CONTEXT_MISMATCH copy (sv/en) to say the check is based on the billing country and the account may still be right for the delivery address, and ask the user to confirm rather than change the account. Document the limitation in the route comment; storing shipping country in the sync is a follow-up. Test pins the new wording. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 17:22:38 +02:00
Jakob Wennberg	22f0647d6c	feat(bookkeeping): make inline rattelse discoverable on the verifikat page (#1554) (#2011) ... * feat(bookkeeping): make inline rättelse discoverable on the verifikat page (#1554) A user who wanted Fortnox-style "stryk rader" went looking on the verifikat page and concluded the feature did not exist: since #1739 every correction action sits behind an icon-only ⋯ menu, nothing says which correction track applies when, and the struck-line marker showed only a date. - Promote "Stryk rader i verifikatet" to a visible outline button for a posted, non-structural entry whose period the period-status endpoint reports as open; the ⋯ item stays so the menu remains the complete list. - Add the convention-7 "?" after the H1 with the two-sentence track rule: inline rättelse while the period is open and unlocked, storno once it is locked, closed or declared. - The rattelse-log route now returns an additive actor_label resolved from profiles via the service client (same precedent as behandlingshistorik); struck rows read "Struken {date} av {actor}" and the Rättelsehistorik rows carry the actor beside the date. No change to the RPCs, the log table, or which corrections are legal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(bookkeeping): address review findings on inline rättelse discoverability (#1554) - Tie the un-awaited period-status fetch to the fetchData run that issued it (monotonic request ref), so an earlier response resolving last can no longer set periodStatus='open' for an entry in a locked period and promote the "Stryk rader" button the RPC would refuse. - Align the "?" help copy with what the system enforces: storno is the only path once the period is locked or closed; a VAT-declared month is stated as a caveat (same wording as the StrikeLinesDialog explainer), not as a gate the product does not apply. Both sv and en. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 17:15:25 +02:00
Jakob Wennberg	ca93ef3fb6	fix(salary): surface employee-save failures and a typed 503 for the missing encryption key (#1996) (#2009) ... * fix(salary): surface employee-save failures in the dialog and type the missing encryption key (#1996) Pressing Spara in "Ny anställd" could fail without any feedback: a thrown fetch or a non-JSON 5xx body escaped handleSubmit before setSaving(false) ran, leaving the button stuck on "Sparar..." and the dialog silent. Even when the toast did fire, the Radix modal aria-hides the root-layout Toaster, so assistive tech (and the E2E driver that found this) heard nothing, and the requestId support needs was never shown anywhere. - NewEmployeeDialog: fetch + parse run in a never-throwing helper, saving is released in finally, the body is parsed with json().catch(() => null) so an HTML/plain-text error page still maps through the HTTP-status map, and the failure is rendered inline (role="alert" in the footer) with "Ärende-id: <requestId>" next to the single destructive toast. - personnummer.ts: the production "key missing" throw now carries the registry code PERSONNUMMER_ENCRYPTION_NOT_CONFIGURED, and the SALARY registry gains a 503 entry naming PERSONNUMMER_ENCRYPTION_KEY with a "contact support" message and a remediation hint. withRouteContext emits the typed envelope automatically instead of INTERNAL_ERROR 500, which read as transient and invited retries that can never succeed. - Tests for the route (401, 400, 503 with requestId and no insert), the key guard, the registry entry, errorResponse dispatch on a coded Error, and getErrorMessage locale handling of the new envelope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna * fix(salary): address review findings (#1996) - NewEmployeeDialog: fall back to the X-Request-Id response header when the body carries no error.requestId. The route hand-builds its 409 (duplicate personnummer) and generic insert-failure 500 bodies as flat strings, so the inline "Ärende-id" line was hidden for exactly the DB-failure class the issue names; withRouteContext sets the header on every response. - Route tests pin that the 409 and 500 insert-error arms carry X-Request-Id. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015nAd8XJ2RPCmG2eKoLBdna --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 16:57:54 +02:00
Mattsson	57d4359d1a	feat(booking-templates): per-company opt-in hiding of system templates (#2004) ... * feat(booking-templates): per-company opt-in hiding of system templates Users cannot delete or hide the 26 standard konteringspaket, which clutter the settings panel and every template picker. Deletion stays off the table (shared global rows); instead a company can now hide individual system templates for itself only. - New booking_template_hidden table (insert=hide, delete=unhide), RLS gated on active company + write role; nothing hidden by default - POST/DELETE /api/settings/booking-templates/[id]/hide (system templates only; company/team templates keep their real delete path) - List route decorates rows with per-company is_hidden; pickers filter them out; the settings panel shows hidden ones in a collapsed restore section so hiding is never silent - Classified in full-archive-export exclusions (UI preference, not rakenskapsinformation) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PU1KN431c9gp5zKvFaa1NL * fix(booking-templates): idempotent re-hide, system-only RLS insert, hidden filter in bulk-book Skeptic + CodeRabbit findings on #2004, one pass: - hide upsert now passes ignoreDuplicates (DO NOTHING): the table has no UPDATE policy on purpose, so the DO UPDATE conflict arm turned a concurrent re-hide into an RLS 42501/500; pg test pins the conflict shape - bth_insert policy additionally requires the referenced template to be an active system template (migration is unmerged, edited in place); negative pg test for company templates - BulkBookDialog excludes templates hidden by the company (was reading the table directly and ignoring hides) - panel shows the failure toast when the hide/unhide fetch itself rejects - picker category chips built from the hidden-filtered list Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01PU1KN431c9gp5zKvFaa1NL --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-28 12:12:47 +02:00
Mattsson	52e99295de	fix(white-label): accept byrå-team invites before landing, so admins reach /clients (#2002) ... A newly-invited byrå admin/member who signed up with email+password landed on /onboarding instead of the cockpit. Root cause: team-invite acceptance lived only in POST /api/team/accept, which the email-confirmation signup flow never reaches before the dashboard (no session for the register page's client-side accept), while the auth callback and the onboarding/select-company recovery only understood company_invitations. So the invitee's byrå membership did not exist when landing resolved, and they were funneled into creating a company. - New shared helper acceptPendingTeamInviteByToken (lib/company/pending-invites) is the single server-side implementation of team-invite acceptance. - POST /api/team/accept delegates to it; HTTP contract unchanged. - /auth/callback accepts a team invite BEFORE the silent-team check and before resolveLandingDestination runs, so an owner/admin resolves to /clients; the invite cookie is cleared on success, kept otherwise for the retry. - acceptPendingInviteByToken (onboarding/select-company recovery) tries the company path, then falls back to the team helper. - hasPendingInviteForEmail checks both invite tables, so a tokenless byrå invitee is not misread as a first-timer. No migration (team invite tables already exist). Company-invite and non-invite flows are untouched. Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 23:08:04 +02:00
Jakob Wennberg	f0af4ad4ee	fix(transactions): categorize fails closed when the verifikat cannot be created (#1990) ... * fix(transactions): categorize fails closed when the verifikat cannot be created (#1947) Booking into a locked period refused the verifikat but still wrote is_business/category, so the row left "Att bokföra" and the nav badge while journal_entry_id stayed NULL (canonical worklist predicate: is_business IS NULL). The verifikat is the booking: when it cannot be created nothing is written and the request returns a typed 409 TX_CATEGORIZE_JOURNAL_ENTRY_FAILED (Swedish reason preserved, details.cause = underlying code); a null engine return maps to 400 NO_OPEN_PERIOD_FOR_DATE. Same shape on the dashboard route, the v1 single route and per item in v1 batch-categorize. journal_entry_error stays in the 200 body, always null, for client compatibility. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 * fix(transactions): fail closed on the engine's null return in the MCP/bulk door too Review findings on #1990: categorizeMatchedTransaction (pending-op approval, Underlag bulk-book) still wrote is_business/category with journal_entry_id NULL when createTransactionJournalEntry returned null (closed year or missing period return null without throwing), recreating the exact #1947 stranding while the tool reported success. The core now refuses before the transactions update with a structured 400 whose errorCode (PERIOD_LOCKED or NO_OPEN_PERIOD_FOR_DATE, told apart via checkPeriodLock) flows into result_data.error_code; the bulk driver skips such items with reason no_open_period. The dashboard route's null guard gets the same disambiguation: a closed covering year answers PERIOD_LOCKED (reason period_is_closed) instead of claiming the rakenskapsar does not exist, and the thrown-error branch now pairs messageSv with messageEn per the errorResponseFromCode contract. TX_CATEGORIZE_JOURNAL_ENTRY_FAILED message_en no longer embeds API-doc prose (details.cause guidance lives in remediation). DECISIONS line corrected: the MCP door was fail-closed only for thrown engine errors, not the null return. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 22:25:11 +02:00
Jakob Wennberg	cb9ae15d46	fix(storno): return stornoed bank transactions to Att bokfora (#1985) ... * fix(storno): return stornoed bank transactions to Att bokfora reverseEntry() unlinked bank transactions from the reversed entry by clearing only journal_entry_id. The worklist's "unbooked" predicate is is_business IS NULL AND is_ignored = false (lib/worklist/types.ts), so the row stayed "handled": absent from Att bokfora and from the nav badge, while the storno dialog (reverse_warning) promised the opposite (#1950). The engine now resets the same triple the uncategorize paths write (journal_entry_id, is_business, category) plus reconciliation_method, scoped to rows linked to the reversed entry. Fixed in the engine so the dashboard, v1 and MCP reverse doors all agree. Closes #1950 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 * fix(storno): release bulk-booked bank rows anchored through transaction_voucher_links The #1950 fix reset transactions scoped by journal_entry_id, but bulk-booked samlingsverifikat (bulk_book_transactions RPC) anchor their N>1 bank rows through transaction_voucher_links only (journal_entry_id stays NULL), so the reset matched nothing there: all rows kept is_business = true against a status='reversed' entry, stayed out of Att bokfora and the nav badge, and is_transaction_booked() still reported them booked. The N=1 variant left a dangling link row that blocked re-booking (BULK_BOOK_TX_ALREADY_BOOKED) and kept the reconciliation bridge bucketing the row as matched. reverseEntry now deletes the reversed entry's junction rows (the same removal koppla-bort performs) and releases is_business, category and reconciliation_method only for rows left with no anchor: a remaining-links read plus journal_entry_id IS NULL guards residual bookings (main verifikat in journal_entry_id, junction row to the residual verifikat) and multi-allocated rows so stornoing one voucher never unbooks a still-booked row. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 * fix(bookkeeping): restore the booked triple in fix-cash-mismatch's transaction relink The widened reverseEntry reset (#1950) now nulls is_business, category and reconciliation_method together with journal_entry_id on the linked transaction, but the fix-cash-mismatch remediation relinked with only journal_entry_id. The repaired row ended up booked (pointer at the posted clearing entry) yet visible in Att bokfora and the nav badge (worklist predicate: is_business IS NULL), the inverted #1950 symptom; booking it from the list would conflict-storno the correct clearing entry and corrupt the AR chain the route just repaired. The relink now restores the full booked triple, mirroring the match-invoice route's final update. New route tests cover auth 401, validation 400, the no-targets path, and assert both relink payloads. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 22:24:55 +02:00
Jakob Wennberg	533df34369	fix(payments): make supplier payment batch creation atomic via create_supplier_payment_batch RPC (#1989) ... createSupplierPaymentBatch wrote the batch header and its items as two separate PostgREST inserts, and the active-batch recheck ran app-side before either. Two concurrent creates selecting the same invoice could both pass that check and both land an active batch without confirm_already_batched, and an item-insert failure after the header landed could leave an empty 'created' batch behind when the best-effort cancel also failed. The new SECURITY DEFINER RPC is now the single write path: it locks the selected invoices FOR UPDATE in id order, re-checks payability, amounts and active batches inside the transaction, and inserts header + items together so a constraint violation rolls both back. TypeScript keeps the shared eligibility evaluation and the msg_id minting (branding lives in TS); the service result union is unchanged so the route and UI are untouched. Closes #1503 Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 22:24:36 +02:00
Jakob Wennberg	4f939ebb21	fix(payroll): expose jämkning percentage and validity on the employee tax form (#1988) ... * fix(payroll): expose jämkning percentage and validity on the employee tax form (#1913) An employee with a Skatteverket jämkning decision could not have the adjusted withholding percentage set anywhere in the app: model, API and engine supported jamkning_percentage / jamkning_valid_from / jamkning_valid_to end to end, but EmployeeTaxCard never exposed them. - EmployeeTaxCard: percentage input plus required from/to dates in the A-skatt branch; null (= clear the beslut) when emptied or when no table applies, mirroring tax_table_number. Both dates are required because isJamkningValid only applies a beslut when both are set. - Edit page: PATCH body sends the three fields as explicit values (guarded on the card having reported), card initial seeded from the employee, read-only Jämkning row in the tax section. - NewEmployeeDialog: initial tax state and POST body carry the fields. - Legacy PATCH /api/salary/employees/[id]: merged-state jämkning check (start date required, dates ordered), same rule and messages as v1 and employee-commands, gated on the PATCH touching a jamkning key. - lib/api/schemas.ts: truthful comment on the engine's both-dates gate. - i18n: salary_employee.tax_jamkning_* in sv and en. - Tests on the legacy PATCH route (400 x4, 200 x3) and the POST route. The engine is deliberately untouched; the API/MCP contract (valid_to optional) stays as is, follow-up filed in the PR body. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 * fix(payroll): jämkning keys reach the employee PATCH only when visible and edited (#1913) Review findings on #1988: the card reported null for the three jämkning fields whenever its inputs were hidden (sidoinkomst, F-skatt, FA-skatt, ej verifierad) and the edit page forwarded those nulls, so toggling sidoinkomst or fixing a phone number on an FA-skatt employee silently wiped a stored beslut (which the engine still applies for FA-skatt). The two date inputs were also natively required whenever a percentage was present, so a beslut stored via the API/MCP without valid_to (allowed by the schema) blocked the whole form on unrelated edits. - lib/salary/jamkning-patch.ts (new): isJamkningEditable() and jamkningPatch(); the keys are spread into the PATCH body with explicit values (null = clear) only when the inputs were visible and edited, otherwise omitted like every other sparse field. - EmployeeTaxCard: jamkning_touched flag on EmployeeTaxValue, set by the three handlers; required on both dates gated on it; non-blocking hint (tax_jamkning_incomplete_hint, sv + en) on a seeded beslut missing a date. - Edit page spreads jamkningPatch(tax); NewEmployeeDialog initial state carries the flag. - Tests: lib/salary/__tests__/jamkning-patch.test.ts (keys omitted for sidoinkomst / f_skatt / fa_skatt / not_verified / untouched seeded row, explicit nulls when cleared, spread shape). - DECISIONS.md: one line. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 * test(payroll): type the insert mock's payload so the typecheck ratchet accepts the jamkning tests vi.fn(() => ...) infers an empty parameter tuple, so insert.mock.calls[0][0] failed TS2493 under the new check:types gate (#1980) on CI. Declaring the payload parameter keeps the assertions and makes the tuple indexable. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FkUfWtuFCUkNtRAgMQCse2 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 22:24:16 +02:00
Mattsson	4f6ecad549	feat(white-label): invite-only signup for brand domains (#1995) ... * feat(white-label): invite-only signup for brand domains A brand domain belongs to the partner's people (founder decision 2026-08-27): only allowlisted or invited users may create an account on an invite-only brand domain; everyone else is shown an interstitial that sends them to the canonical Accounted signup. - brands.signup_mode ('open' default / 'invite_only') + brand_signup_allowlist (lowercase emails, team-scoped RLS, owner/admin writes) + create_company_for_brand_signup RPC, with pg-real coverage - server-side gate (lib/auth/brand-signup-gate.ts) enforced on every signup path: email signup moved to POST /api/auth/signup (the browser used to call GoTrue directly, so a client-side check would be bypassable), BankID gated in /bankid/complete, Google covered by the dashboard layout's brand-domain bounce - company invites bypass the allowlist: the invite is the authorization - register page interstitial on gated brands (no email in the outbound URL), sv+en strings - dashboard layout bounces non-belonging sessions off gated brand hosts to the canonical domain (navigation rule like WL-01, not a security boundary) - allowlisted signups' onboarding-created companies attach to the brand's byra team via the new RPC, so WL-01 homes them on the brand domain; the allowlist entry recorded by an owner/admin stands in for the WL-15 admin gate - byra cockpit page /clients/access + /api/clients/signup-access to manage the mode and the allowlist All existing brands default to 'open': behavior is byte-identical until a brand is flipped to invite_only. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * fix(white-label): rollback brand-signup company with the service client Skeptic (correctness) found that a brand-signup company created under the service role rolled back with the cookie-session client: `companies` has RLS and no FOR DELETE policy, so the delete was a silent 0-row no-op, stranding a member-less ghost company on the partner's byra team. Pass an optional rollbackClient to createCompanyCore and hand it the service client on that path; user_preferences.active_company_id then clears itself via its ON DELETE SET NULL FK once the company row is actually deleted. Also map a validateBody 400 (flat envelope, no code) on the register page to the specific email-invalid field message instead of the generic one, since the client already pre-gates password strength. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * fix(white-label): fail-safe brand lookup, pg-test seed, anonymize fixtures Second resolve-pr cycle: skeptic + CodeRabbit findings and a green-up. - Fail safe on a brands-table error (CodeRabbit CWE-285): the gate treated a failed resolveBrandByHost as an unbranded host, opening invite-only signup during a transient DB blip. resolveBrandResultByHost now distinguishes "no brand" from "lookup failed"; the gate returns lookupFailed and the email + BankID routes answer 503 (retry), never creating an account. - pg-real: the RLS delete test seeded its row inside withUserContext, which always rolls back, so the owner DELETE saw zero rows. Seed on the superuser pool instead. - Anonymize every test/fixture brand to the repo's existing synthetic placeholder (Siffra / app.siffra.se): no real partner names in code. - SignupAccessManager: functional setData updates so a concurrent mode toggle and an add/remove do not clobber each other's snapshot (CodeRabbit). - Route a transient-error message through i18n instead of the raw envelope (raw-user-error guard); new register.error_temporary sv+en. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 * test(white-label): anonymize new signup-gate fixtures; log oracle residual Rename the placeholder brand in the four new brand-signup test files to a clearly-fake, partner-unrelated name (Testbrand / app.testbrand.example); the previous placeholder echoed a real partner. Scoped to files this PR creates; the repo-wide legacy placeholder is left for a separate cleanup. Also record in DECISIONS.md that the feature ships accepting the low-severity allowlist-enumeration residual (captcha-free 403 vs 200 on the signup endpoint), with rate-limiting as the follow-up option. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01ByL5dQXG8gGLtNBPj8g2C4 --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 18:32:52 +02:00
Jakob Wennberg	3447da027a	feat(api): agent-substrate quick wins: worked examples in the spec, honest Retry-After, and a payload guard that covers the namespace new installs get (#1974) ... * feat(api): surface the registry's worked examples in the OpenAPI spec and generated skill EndpointDefinition.example is required and every one of the 125 v1 endpoints populates example.response, but generateOpenApiSpec() never emitted it. The examples reached only the docs markdown builder, so /api/v1/openapi.json carried none and the generated skills/accounted-api had zero json blocks in all 12 reference files: every agent reading the spec or installing the skill got schemas with no concrete body. Emit example on the application/json media types (request body and 200 response) and teach the portable renderOperationMd to print it as a fenced json block. 178 worked examples now reach the skill. SKILL.md is unchanged: the examples land in the on-demand reference files, not the entry file. Attached to JSON media types only, so a multipart body and a binary application/pdf response do not advertise an example they cannot send. Adds the one missing example.request (currency-revaluation) so the new exhaustive coverage assertions hold. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(api): emit Retry-After on a v1 429 so the documented contract is real The published accounted-api skill has told agents to honor Retry-After on a 429 since it shipped, but no /api/v1 route ever sent one: the wrapper's auth failure path early-returns through v1ErrorResponseFromCode, whose finalize() set only X-Request-Id and Gnubok-Version. Unattended clients had nothing to pace against and had to back off blindly. 60 seconds is an exact upper bound rather than a guess: the rate limiter is a fixed one-minute tumbling window per key row and the limited branch does not slide it. The value moves into an exported constant next to that limiter, so the MCP server's hardcoded '60' now reads from the same place. Also corrects the withApiV1 doc comment, which claimed step 8 stamps X-RateLimit-Limit. It never did. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * test(mcp): guard the tools/list payload for the namespace new installs get The payload ratchet only ever serialized the gnubok_* projection. The accounted_* projection is inherently larger (every tool reference gains 3 chars, ~209 tokens across the default catalog) and CLAUDE.md points new MCP installs at exactly that namespace, so the payload a new user's client receives was never measured. It had already drifted ~90 tokens past the 63.4K ceiling while the guarded number sat comfortably under it. Measure both and assert on the larger. The ceiling moves to 63.6K to cover the real worst case; this buys no new catalog surface. A second test pins the direction of the delta so Math.max cannot silently stop describing reality. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-27 17:35:47 +02:00
Jakob Wennberg	dfed55cb6c	feat(periods): undo klarmarkera so an externally closed year can be reopened (#1978) ... markPeriodClosedExternally ("klarmarkera") closes and locks an imported year without a closing entry, and nothing could reverse it: unlockPeriod refuses closed periods and the SIE replace flow refuses closed or locked years. An owner who klarmarkerade five imported years and then found the prior-year SIE file was wrong had no way back (Forsslund Systems, 2026-08-27). reopenExternallyClosedPeriod reverses the mark while the closed state still comes from klarmarkera (closed_externally set, no closing entry), clears the lock, writes the audit_log row, and emits period.unlocked. New route POST /api/bookkeeping/fiscal-periods/[id]/reopen-external with envelope codes PERIOD_REOPEN_NOT_CLOSED / PERIOD_REOPEN_NOT_EXTERNAL; "Öppna igen" action and "Avslutat i tidigare program" chip in Settings > Bookkeeping > Fiscal years; unlock and SIE replace refusals now point at that path. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 14:34:02 +02:00
Mattsson	a860c690ed	feat(white-label): WL-14 cockpit landing for BankID and OAuth/magic-link logins (#1972) ... * feat(white-label): WL-14 cockpit landing for BankID and OAuth/magic-link logins Byra staff logging in via BankID or the Google/magic-link callback on their brand domain landed on /select-company resp. / instead of the cockpit, because those two paths bypassed the WL-14 landing rule. - Extract the rule into resolveLandingDestination (lib/company/landing-server.ts) so server code can call it without an HTTP round-trip; /api/clients/landing becomes a thin wrapper. - Auth callback: with no explicit destination, AAL1 sessions resolve the landing from the request host, degrading to / on any failure (MFA-enrolled users already get the rule via /mfa/verify). - BankID login: byra staff on their brand host get /clients; everyone else keeps the deliberate /select-company picker byte-identically. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): address PR 1972 review findings - /api/clients/landing: requireAuth() directly instead of withRouteContext, which 4xxed byra staff without a company of their own (COMPANY_CONTEXT_MISSING) and silently sent the cockpit's primary persona to /select-company. MFA enforcement unchanged. - landing-server: log the byra membership query error before degrading to '/' so a persistent failure is distinguishable from no membership. - Deduplicate the clientWithTeamMembership test mock to file scope. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): paginate the byra membership query fetchAllRows per repo convention: PostgREST silently caps unpaginated selects at 1000 rows, which could hide a qualifying owner/admin membership. Errors still degrade to '/' with a log. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 13:37:20 +02:00
Mattsson	b30c71086e	feat(byra): gate the automatic cockpit landing to owner/admin (#1970) ... * feat(byra): gate the automatic cockpit landing to owner/admin Plain byra members now land like regular users; owner/admin keep the cockpit landing at both decision sites (post-login /api/clients/landing and the '/' bounce). The middleware zero-company steer stays ungated: a member with zero companies has nowhere else to land. Cockpit access itself is unchanged (nav + /clients remain membership-based). Supersedes the 2026-08-05 all-members widening (DECISIONS.md). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(byra): keep byra members out of the first-run wizard on auto-landing Skeptic finding: a member whose auto-resolved active company is onboarding-incomplete (e.g. mid migration-reset, which repoints active_company_id itself) fell through the new role gate into /onboarding, a dead end for role member (WL-15 refuses client creation). Byra members without a picked-company cookie now go to /byra at the onboarding check, restoring the pre-gate shield. Also pins the role column into the landing route's select assertion so dropping it can't pass the mocked tests silently. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-27 11:49:00 +02:00
Mattsson	5e9cd6f761	fix(enable-banking): unstarve the daily bank sync cron (#1969) ... * fix(enable-banking): unstarve the daily bank sync cron The sync cron self-limited to 50s (no maxDuration export, so the route ran under the 60s platform default) and processed ~17 connections per day against 123 entitled active connections: any given connection only got an automatic sync every 4-7 days, and users bridged the gap by clicking 'Synka' manually, which pushed them to the back of the queue. - export maxDuration = 300 (Vercel Pro ceiling the code always assumed) - sync loop budget 50s -> 230s; health probe gets the 280s leftover - connections sync in concurrent waves of 4 with per-connection error isolation preserved - MAX_CONNECTIONS_PER_RUN 50 -> 300 (safety cap only; one run now covers the whole entitled queue) Cadence stays once daily at 05:00 UTC by design; users who want more can sync manually. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(enable-banking): serialize same-company connections within sync waves Skeptic refutation: the post-sync unattended reconciliation sweep is company-scoped, so two connections of one company syncing concurrently run two identical whole-company sweeps whose unlinked-GL-line snapshots race; both can claim the same journal entry for different bank transactions, leaving the GL short while every surface shows reconciled. Waves now fan out over company groups instead of raw connections: one company's connections sync sequentially inside a single wave slot, unrelated companies still run 4-wide. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(enable-banking): re-check the sync time budget inside company groups Review finding (PR Reviewer Guide): the budget was only checked between waves, so one company with many connections could run past 230s inside a single wave and eat the health-probe and teardown margin. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 23:39:29 +02:00
Mattsson	fdb5f6f891	feat(white-label): byra white-label infrastructure: brands, cockpit, home domains, branded email (#1956) ... * feat(white-label): brand and team-kind foundation - brands table: one white-label identity per byra team (unique mutable domain, row presence = live, email sender identity, hex color CHECKs) - teams.kind ('personal'|'byra'): ops-only kind changes, deterministic ensure_user_team (personal team only), AFTER UPDATE role re-sync so a demoted consultant loses admin in client books immediately - resolveBrandByHost/resolveBrandForCompany with 60s TTL cache, derived chrome tone and WCAG contrast gate; no brand row = default appearance Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): per-request brand theming, wordmark slot and source footer - root layout resolves the brand from the Host header and injects a server-rendered style block (light + dark), font pair classes and a BrandProvider/useBranding context; default hosts render byte-identically - BrandWordmark logo slot, host-aware manifest and favicon, images.remotePatterns for Supabase Storage logos - curated font menu mechanism (font_key -> variable pair, preload:false for non-default entries) - AGPL source-code footer link on login and public pages, both brands Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): byra team invites, member management and team billing - team invites unfrozen behind a kind gate (byra teams only, owner/admin invite); members route handles multi-team membership; members/[id] unfrozen with last-owner protection; invite management UI in settings - billing/status learns team-scoped grants and the settings page shows a read-only "part of the byra agreement" state instead of the upgrade pitch - 30-day trial suppressed for companies created under a byra team Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): brand-aware outbound mail, auth email hook and public invoice branding - every outbound mail is sent in the brand of the company it concerns: getSenderForCompany/getBaseUrlForCompany chain (verified brand domain, "via Accounted" fallback, canonical default) wired into invites, payslips, invoice deliveries and reminders - Supabase Send Email hook endpoint (signature-verified with node:crypto, dormant until configured) renders auth mail per brand via redirect origin - public invoice pages carry the company's brand mark - snapshot suite per template class guards against wrong-brand mail Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): byra cockpit, home-domain rule and tab guard - Klienter route: five urgency-sorted columns (company, unbooked, inbox, next deadline via the status engine, last booked) for byra team members, who land there after login on their home domain - soft switch straight into a client and back; blocking two-exit tab guard against writes to the wrong active company - client company creation admin-gated at the DB level (a created company is +1 on the byra invoice), bound to the byra team, no trial - home-domain rule in the UI: switcher partitions companies by host, signpost page for companies homed elsewhere Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): brand-aware app name across UI strings - 24 message keys per locale converted to the {appName} ICU parameter, 27 call sites pass the active brand name (useBranding client-side, getRequestAppName server-side) - 6 hardcoded JSX literals swept; statutory filing and API identity surfaces deliberately keep the Accounted name - 34 new i18n keys for the cockpit, team invites, billing state, tab guard, signpost and source footer (sv/en parity verified) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(white-label): domain glossary and decision log entries - CONTEXT.md: the white-label ubiquitous language (brand, byra team, home domain, signpost, umbrella subdomain, brand color, cockpit) - DECISIONS.md entries from the build waves Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): lean byra cockpit sidebar with company-mode back link Byra team members now get a two-mode sidebar: on cockpit routes (/clients and the new /byra pages) only Hem, Klienter, Automationer and Nyckeltal show; entering a client company brings back the full company sidebar with a pinned back-to-clients link (expanded, rail and mobile). New pages: /byra home with client count, needs-action count and per-client urgent deadlines reusing the fetchClientOverview aggregation, plus designed empty states for /byra/automations and /byra/kpi. Signpost gate allows the byra routes; non-byra users are unaffected. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): cockpit shows no active company and keeps lean sidebar under settings In cockpit mode the bottom user widget no longer shows the active company subline or the company-switcher flyout: the cockpit sits above the companies and clients are entered through the Klienter list. The settings modal previously flipped the sidebar to the full company nav behind it because the pathname becomes /settings/*; the sidebar now keeps the mode of the surface underneath. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): keep company picker in cockpit with nothing selected The cockpit user menu gets the company-switcher flyout back, but neutral: the row reads "Valj bolag", no company carries the check mark or active styling, and picking any company (including the technically-active one) enters it with a full navigation. Company mode is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(db): renumber white-label migrations past main and add byra settings scope Renumber 20260801100000-120000 to 20260804110000-113000: main already carries applied versions up to 20260803231000, and Supabase branching refuses local migrations stamped before the remote head (the repo rule from 5932632f5: keep new versions strictly newest). Comment references updated in the pg tests, route docs and onboarding precheck. Also ships the byra settings scope: settings opened from the cockpit (?ctx=byra, honored only for byra team members) show account-level sections only (Konto, Medlemmar och roller), hide company-scoped sections and the company kicker, and the team section is registered in SETTINGS_SECTIONS so Medlemmar och roller renders inside the settings window. The cockpit user menu drops Abonnemang and carries the scope on its links; section switches preserve it. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(byra): cross-client nyckeltal view in the cockpit Period presets and company chips in the URL, summary tiles, merged monthly income/expense chart and a sortable per-client KPI table. Numbers come from the existing get_kpi_report_aggregates RPC per client (no new migrations); calendar months are the cross-client axis since clients can have different fiscal years. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): byra self-service brand logo and app name New Varumarke settings section (byra scope, owner/admin): logo upload/remove and an editable app name; domain stays read-only. brands has no write RLS by design, so writes go through /api/byra/brand routes with the service client behind an explicit owner/admin team check. Files land in logos/byra/{teamId}/. The expanded sidebar shows the brand app name beside the logo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): route root layout through the shared brand resolver app/layout.tsx carried a private copy of resolveRequestBrand, so it and lib/branding/request-brand.ts could drift. The layout now uses the shared function, which also gains a BRAND_DEV_DOMAIN override: on literal localhost hosts only, resolve that brand so branding is testable in local dev. Real domains are unaffected even if the variable leaks into a deployment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(byra): automations roadmap teaser and cockpit i18n strings The Automationer tab now previews the planned automation set (Monday briefing, deadline watch, rule-driven bookkeeping, connection watch, monthly checklist, report delivery) instead of a bare empty state. Bundles the sv/en strings for the whole cockpit wave (nyckeltal, varumarke, automations) and the decision-log entries. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): byra owners/admins land in the cockpit, not an auto-picked company After login "/" resolved the first-membership fallback and opened a client company nobody chose, and the top-left brand mark always linked back to it. Byra owners/admins now home to /byra: the logo links there always, and "/" redirects there unless a company was explicitly picked this browser session. The middleware writes the fallback company back to user_preferences, so the DB cannot tell picked from auto-picked; setActiveCompany stamps a session cookie (gnubok-company-picked) on every explicit switch instead. The byra check on "/" reuses the layout's team_members query via a request-cached helper, so it costs no extra round trip. Byra members and regular users are unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(white-label): drop brand color theming, keep monochrome everywhere White-label is logo + app name + domain only (founder call): the layout no longer injects brand color CSS variables, stamps data-brand or colors the browser chrome. buildBrandVarsCss, its WCAG gate and the brand_color/chrome_color columns stay dormant for a future opt-in. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(db): arm SIE RPC statement_timeout via pgrst.db_pre_request hook ALTER FUNCTION ... SET statement_timeout (20260629160100, 20260721144311) never re-arms the running statement's timer, so large SIE imports still died at the role default 8s. The pre-request hook runs as its own statement before the main query, so set_config there is what the main statement's timer is armed with. Scoped by request path to the three SIE RPCs; every other request keeps 8s. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(byra): drop the 'what's coming' tail from the automations intro Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): byra owners/admins with zero companies land in the empty cockpit Both no-company gates (Edge middleware and the dashboard layout) sent every company-less user to the onboarding wizard, which forced a fresh byra owner to create a personal company before ever seeing the cockpit. Byra owners/admins now pass through to cockpit routes (/byra, /clients, /companies/new, /settings, /api) and are steered to /byra elsewhere. Plain byra members and regular users keep the onboarding redirect. The membership lookup runs only in the rare no-company state, so the middleware hot path is untouched. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): auth wordmark shows the brand logo alone Byra logos usually carry their own name, so logo + app name text on the login/register hero read as a duplicate. Branded hosts with an uploaded logo now render the logo only, with the app name as the image's alt text. Hosts without a logo keep the text wordmark unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): per-brand favicon via brands.favicon_url Branded hosts used logo_url as the tab icon, which squashes wide byra lockups at 16px. New optional brands.favicon_url holds a square mark; the root layout prefers it and falls back to logo_url as before. Migration applied to staging (idempotent DDL). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(auth): wire the villkor and integritetspolicy footer links Both auth pages shipped with href="#" placeholders. Villkor now points at the platform terms on the marketing site (accounted.se/terms; the terms are the platform's even on branded byra hosts) and integritetspolicy at the in-app /privacy page, host-relative so it resolves on every branded domain. Both open in a new tab so the auth form state survives. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(settings): styled popup for the team role dropdowns The byra team panel's role pickers (member rows + invite form) were native selects, so the opened list rendered as the unstylable OS menu. Swapped to the Radix Select with the popup styled like every other overlay; the trigger keeps the flat quiet SettingsSelect look. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(email): branded sender shows the brand name alone, no via-platform Byra invite mail read "Willem via Accounted" in the From display name. The tier-2 fallback (brand on the platform address) now renders just the brand name; the platform stays visible in the actual From address until the brand verifies its own sender domain (tier 1, unchanged). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): byra landing applies to every team member, not only owners/admins An invited byra consultant (role member) still landed in an auto-picked client company after signup. The cockpit landing rules ("/" redirect, brand-mark home link, and both no-company gates) now key on byra team MEMBERSHIP instead of the owner/admin role: anyone with cockpit access homes to /byra. Regular users unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(email): branded team invite names the byra, not "ett team pa <platform>" Subject, headline, body and text variant now read "Du har blivit inbjuden till <Byra>" (brand casing kept) when the team has a brand. Brandless teams keep the platform phrasing byte-identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): sidebar keeps cockpit mode after refresh on settings The sidebar's cockpit/company decision on /settings/* rested on React state remembering the surface underneath, which a hard reload wipes: a byra user refreshing settings opened from the cockpit got the full company nav and read it as landing in a client company. The ?ctx=byra marker already in the URL survives reloads, so the sidebar now honors it as the cockpit signal alongside the in-session memory. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): hide the active-company chip in byra-scoped settings The full-page settings header (the hard-refresh fallback surface) showed the ActiveCompanyBadge even under ?ctx=byra, so a byra user read the auto-active client as "the company I am in". The chip now follows the same byra-scope rule as the modal's kicker. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): tab guard no longer fires in the tab that initiated the switch BroadcastChannel delivers the company-switch broadcast to every listener in the same tab too, so the cockpit tab raised its own WL-09 "switched in another tab" dialog over the hard navigation into the clicked client. performCompanySwitch now marks the switch as self-initiated; CompanyTabSync suppresses only the dialog for that observation (stray writes still get their 409) and clears the marker on bfcache restore so back-navigation regains the full guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(settings): styled popups for every settings dropdown SettingsSelect rendered a native <select>, whose OS listbox cannot be styled and clashes with the panel (same problem the team-panel role dropdowns had). It now renders through Radix Select with the flat dashed-underline trigger, keeping the native prop surface so all 13 call sites work unchanged: value/defaultValue, onChange(e.target.value), <option> children, and a hidden input that carries `name` into SettingsFormWrapper's FormData read and raises the bubbling input event its dirty tracking listens for. Empty-string option values map onto a sentinel at the Radix boundary. The backup form's boxed fiscal-year select moves to the shadcn Select with a placeholder. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): home-domain affinity redirect in middleware Every signed-in user now homes on a domain: byra team members on their brand's domain, everyone else on the platform app URL, except a byra's client users, whose home is the byra domain their companies live under. On any other product host the request redirects to the home domain's root, where the user meets the RIGHT branded login (sessions are per-domain by design). localhost, direct *.vercel.app hosts and IP hosts are exempt; a 15-minute host-scoped cookie caches the "this is home" verdict so the hot path costs zero extra queries; lookup failures fail open. Complements the WL-01 signpost, which keeps handling per-company homing inside a domain. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): render hero brand logo at 64px on auth pages Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(white-label): shareable invite link and re-send for byra team invites A failed invite mail previously surfaced only as a toast description while the invitation quietly waited for a mail that never arrived (the Arbore case). The inviter now always has a recovery path: - persistent share-link line after invite create/re-send: ochre attn line with a copy action when the mail did not go out, quiet muted line with the same action when it did - POST /api/team/invite/[id] re-sends a pending invitation with a fresh token and expiry (same byra-only owner/admin gates as DELETE) - brand mail sending extracted to lib/email/send-team-invite.ts, shared by create and re-send so the two paths cannot drift Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): sidebar shows uploaded brand logo alone, no app-name label Byra logos usually carry their own name, so logo + text in the expanded sidebar read as a duplicate (same founder call as BrandWordmark, 2026-08-05). The app-name label now renders only for branded hosts without an uploaded logo. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): close the four skeptic refutations before merge - trial seed: migration 130300 now carries the seven-key PAID body from 20260818170000 plus the byra guard, instead of silently reverting it; pg test pins the full key set against PAID_CAPABILITIES - byra gate: new migration 130600 adds the owner/admin gate to create_company_for_user (v1 API + MCP path), and both surfaces resolve the default team personal-only, so a consultant's private company can never attach to the byra team - home-domain: byra staff who also have canonical-homed companies are no longer redirected off the platform host; the signpost handles per-company homing (5 new middleware tests) - settings selects: the Radix popup renders optgroup group headers again (ROT/RUT work-type picker) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(schema): re-baseline unresolvable-expression ceiling after #1954 catch-up merge Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(white-label): pg-real rollback-safe assertions and deep-link-preserving affinity redirect The byra company-creation pg test asserted persisted rows through the pool after withUserContext, which always rolls back its transaction; the assertions now run inside the transaction after RESET ROLE. The home-domain affinity redirect carries the original path and query across the domain hop (PR Agent finding), so invite links and deep links survive the correction. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 16:56:39 +02:00
Jakob Wennberg	4af7469523	feat(onboarding): minimal input: orgnr + moms period is the whole ask (#1952) ... * feat(onboarding): minimal input: orgnr + moms period is the whole ask Two fixes from the third E2E attempt (2026-08-26): 1. accounting_method is now optional in CompanySetupSchema and defaults by form in planCompanySetup: aktiebolag = accrual (the norm), enskild firma = cash (the common small-EF choice; legal under 3 MSEK, BFL 4 kap 4 paragraf). The plan flags the default (resolved.accountingMethodDefaulted) and gnubok_create_company's preview carries accounting_method_defaulted so the readback names it and the user overrides in the same 'ja'. Never silent: the preview is the checkpoint. Applies to the MCP tool and POST /api/v1/companies (additive; response shows the resolved value). The lookup tool's still_to_ask no longer lists it. 2. The agent refused a real orgnr because the user said 'nytt bolag' and the registry showed an established company ('Stopp. Numret matchar inte ett nytt bolag'): lookup instructions now state that an established company with F-skatt/VAT is the NORMAL case (new = new to Accounted) and the orgnr is never second-guessed for looking established. Skill + plugin (v1.2.1) updated; API skill regenerated; DECISIONS.md entry. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(onboarding): surface the kontantmetod 3-MSEK condition on the defaulted cash method Compliance-review finding on #1952: the EF cash default carries a legal eligibility condition (turnover normally under 3 MSEK, BFL 4 kap 4 §) that a client not reading the onboarding skill would never see. The create preview now carries accounting_method_note with the condition whenever cash was defaulted, and the v1 pitfall states it for API integrators. The registry cannot verify turnover, so the confirm-time human check is the gate; the default itself stays (a brand-new EF has zero turnover by definition). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 15:15:09 +02:00
Jakob Wennberg	e7e4efbfbc	feat(oauth): one-click consent: all scopes pre-selected, list collapsed, Allow above the fold (#1953) ... The read-only default forced every agent-first user to scroll a scope list and hand-tick write rows before the flow could work. Founder call 2026-08-26: pre-check ALL scopes when the client requests none (Claude's connector case), collapse the scope list into an expandable details fold ('Alla förvalda, visa och justera'), and keep the Allow button visible without scrolling. Why this is defensible: every write is STAGED for explicit approval before anything touches the ledger, each scope row stays individually untickable inside the fold, the warn line states the staging rule right above the button, and the grant is revocable under Inställningar > API-nycklar. A client that requests explicit scopes still gets exactly that set (RFC 6749 3.3 least-privilege unchanged), and the tampered/empty POST fallback stays read-only. CONNECTORS.md gains the share link (connectorName/connectorUrl params) plus the starter prompt to pair with it. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 15:06:46 +02:00
Jakob Wennberg	c31933b15b	perf(api): write routes stop re-resolving the active company (#1928) ... * perf(api): write routes stop re-resolving the active company withRouteContext resolves the active company (one resolve_active_company RPC, ~40 ms p50 on prod) and then, for the 256 routes that pass requireWrite: true, called requireWritePermission(), which resolved it a second time before its role select. Two sequential round trips repeating work the wrapper had just done, on every mutating request. requireWritePermission() and getCompanyRole() now accept an optional `known` context; the wrapper passes { companyId }, so the helper goes straight to the membership select. Callers that pass nothing behave exactly as before, and the shared selectRole() keeps both helpers on the same query. The role is still looked up, never trusted from the caller. Tests: known companyId skips resolution, known role skips the select, a known viewer is still 403, a known company without a membership row is still 403, legacy calls unchanged; new lib/api/__tests__/with-route- context.test.ts pins that the wrapper resolves the company exactly once, hands it to the guard, never calls the guard on read routes, passes the guard's 403 through with a request id, and emits Server-Timing. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(customers): viewer gate expects the wrapper to hand over the resolved company Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:55:48 +02:00
Jakob Wennberg	b8605aabfc	fix(settings): derive API-key scope groups and tool counts from the scope catalogue (#1924) ... The API-key settings panel carried a hand-copied list of scope groups that had drifted to 24 of the 30 scopes in API_KEY_SCOPES: articles:read/write, companies:write and the three reconciliation scopes were missing, so a key minted in the dashboard could not call gnubok_create_company, the article tools, the seven reconciliation tools or the matching v1 endpoints. The per-scope "N verktyg" counts in the panel and in the API_KEY_SCOPES descriptions were hand-maintained and wrong (reports:read said 18, actual 30; bookkeeping:write said 11, actual 22). - Move the pure scope catalogue (API_KEY_SCOPES, scope lists, SCOPE_GROUPS, TOOL_SCOPE_MAP) into lib/auth/scope-catalog.ts with no server imports, so the client-side panel can bundle it. api-keys.ts re-exports everything, so existing imports are unchanged. - SCOPE_GROUPS becomes a list of { domain, label, scopes } covering every scope (reconciliation has three), shared by the panel and the OAuth consent page. scopeKind() replaces the ad hoc suffix checks. - TOOL_COUNT_BY_SCOPE is derived from TOOL_SCOPE_MAP at module load; the hand-written counts are removed from the catalogue descriptions. - The panel renders groups and cards from the catalogue; i18n keys are derived from domain and scope id. The "(REST API)" heading suffix is computed from the counts instead of baked into the labels. - New unit test asserts every scope belongs to exactly one group and that counts equal TOOL_SCOPE_MAP occurrences. - New sv/en strings for the articles, companies:write and reconciliation scopes. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:35:42 +02:00
Jakob Wennberg	f338850bd0	fix: hide API-archived customers and suppliers from lists and pickers (#1927) ... * fix: hide API-archived customers and suppliers from lists and pickers The v1 API soft-archives customers and suppliers (archived_at, plus is_active=false on suppliers) and its own list routes hide those rows behind ?include_archived=true. No other surface filtered archived_at, so an archived counterparty stayed a normal row in the dashboard rosters, the internal /api/customers and /api/suppliers list routes, the MCP list tools and every customer/supplier picker. Apply the same canonical `archived_at IS NULL` filter on every non-v1 list and picker path: - /api/customers GET, /api/suppliers GET (feeds the customers page and the supplier-invoice form) - suppliers dashboard page (reads suppliers via browser Supabase) - InvoiceEditor and NewRecurringScheduleDialog customer pickers; an invoice or schedule being edited keeps its current customer visible (archiving does not refuse on drafts, so a draft can point at one) - deadlines page and CalendarWorkspace customer pickers - InvoicePreviewCard sample customer - gnubok_list_customers and gnubok_list_suppliers: hidden by default, optional include_archived boolean mirroring the v1 flag; rows now carry archived_at so an agent can tell them apart when opted in Detail routes and by-id lookups are untouched: an archived row still opens. The delete-vs-archive semantics are unchanged. The tools/list payload guard moves 60.7K to 60.8K: main had ~6 tokens of headroom, so even the bare boolean contract crossed. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(schema): raise the unresolvable-expression ceiling by 2 for the archived-customer picker filters The two .or('archived_at.is.null,id.eq.<uuid>') filters keep an edited draft's archived customer selectable. The uuid is a runtime value, so the scanner cannot resolve the expression; both columns exist and the filter is covered by the archived-counterparty tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:35:27 +02:00
Jakob Wennberg	1185ab4294	fix(mcp): honest tool text and build-derived server version (#1923) ... Tool text that lied to agents: - gnubok_create_voucher pointed at gnubok_reverse_entry, which does not exist; the tool is gnubok_reverse_journal_entry. A scan of server.ts, skills/, prompts/ and structured-errors.ts found no other phantom names. - gnubok_reverse_journal_entry said reversal_date defaults to today; the executor passes undefined and reverseEntry() uses the original entry date (same as the dashboard). Description now states that. No behaviour change. - gnubok_get_vacation_balance promised an estimated semesterloneskuld in SEK but returned none. The tool now returns estimated_liability_sek using the same BFNAR 2016:10 day valuation as the year-close and the v1 vacation-balance route (dayValueSek exported from semesterberedning), floored at zero for overdrawn balances. Descriptions trimmed so the tools/list payload stays under the 60.7K-token ceiling (60,696 after). - gnubok_create_invoice said the invoice number is assigned at approval; it is assigned on send or mark-as-sent (ensureInvoiceNumber). - gnubok_convert_invoice: "har redan makuleras" -> "har redan makulerats". - lib/entitlements/keys.ts comment claimed bank_sync has no MCP tool while the map right below gates gnubok_connect_bank on it. Version: MCP serverInfo.version, the extension version and /api/health all hardcoded '1.0.0', so clients could not tell deploys apart. They now share currentAppVersion() (commit SHA prefix inlined at build), resolved once at module load so the definitions layer stays deterministic, with '1.0.0' as the self-hosted fallback so Docker healthchecks keep a value. serverInfo is not part of tools/list, so the catalog payload is unaffected by this part. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:35:15 +02:00
Jakob Wennberg	1a27b5bd4a	fix(auth): route document integrity, transaction delete/list and agent categorize through withRouteContext (#1926) ... Two handlers hand-rolled supabase.auth.getUser() and therefore skipped the MFA (AAL2) gate on hosted: DELETE /api/transactions/[id] and GET /api/transactions. Both sat next to a sibling handler that was already wrapped, and the raw-route-auth ratchet exempted a file as soon as any withRouteContext call appeared in it, so they were never flagged. GET /api/documents/[id]/integrity and POST /api/agent/categorize called requireAuth() directly (MFA enforced, but no request id, no completion log, no canonical error envelope). All four are now withRouteContext handlers with identical company scoping and responses; the transaction delete keeps its viewer rejection via requireWrite. The guard now judges each top-level export segment of a route file on its own, so a wrapped handler no longer exempts a hand-rolled sibling. Baseline is unchanged (mcp-oauth/authorize remains the one grandfathered file). Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:34:31 +02:00
Jakob Wennberg	d3869e6694	fix(api): register the v1 stamp endpoint scope and derive the webhook event catalogue from one source (#1930) ... POST /api/v1/companies/{companyId}/inbox-items/{id}/stamp registered itself with scope documents:write but had no V1_ENDPOINT_SCOPES entry, and the wrapper resolves the required scope from that map before it validates the bearer token, so the route answered NOT_FOUND to every caller. Add the entry, drop the three phantom entries that had no route (GET openapi.yaml, GET companies/:companyId, GET companies/:companyId/events), and add a parity test that pins the scope map to the endpoint registry in both directions, checks every pattern against an existing route file, and checks every v1 route file is imported by load-routes.ts. The webhook event catalogue was hand-copied in three places and had drifted: the fan-out handler delivered 28 events while the v1 create enum, the OpenAPI spec, the generated agent skill and the docs page listed 24, so the four reconciliation.* events could not be subscribed to. lib/webhooks/public-events.ts is now the single source; the handler set, the Zod enum and the docs section derive from it, with tests that pin each surface to the catalogue. The PATCH webhook docs no longer tell agents to delete and recreate a webhook to rotate its secret: POST .../rotate-secret exists. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:34:27 +02:00
Jakob Wennberg	f08fc2c274	fix(invoices): honour defer_invoice_booking on MCP, REST v1 and inbox convert (#1921) ... The #967 "Registrera men bokför inte" setting was only respected by the dashboard routes. Six other paths decided whether to post the issue-time verifikat with `accounting_method === 'accrual'` alone, so a company that had switched booking to the explicit Bokför step still got vouchers posted at issue through MCP, the REST v1 API and the invoice-inbox convert route: - lib/pending-operations/commit.ts: send_invoice, mark_invoice_sent, create_supplier_invoice_from_inbox executors - app/api/v1/.../invoices/[id]/send and mark-sent (commit + dry-run preview) - app/api/v1/.../supplier-invoices POST - extensions/general/invoice-inbox convert All of them now call booksInvoicesOnIssue() from lib/bookkeeping/booking-mode, the helper the dashboard already uses, and select defer_invoice_booking where the settings projection did not include it. Behaviour for accrual companies without the flag and for kontantmetoden companies is unchanged. Tests: one deferred-company case per door (8 new), verified to fail without the fix. skills/accounted-api regenerated for the changed v1 descriptions. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 13:18:57 +02:00
Mattsson	00e7ac92ae	feat(support): attach images and PDFs to the in-app contact form ... Add optional image and PDF attachments to the existing in-app support contact form, with client-side limits, server-side validation, and email delivery. Preserve the existing subject, rate-limit, analytics, and storage behavior.	2026-08-26 12:32:29 +02:00
Jakob Wennberg	b1a03de34e	fix(mcp-oauth): api_keys.company_id nullable so companyless signups can mint their key (#1919) ... Every fresh Claude.ai authorization died at POST /api/mcp-oauth/token with a silent 500: the multi-tenant refactor's dynamic loop (20260330130000, line ~250) set company_id NOT NULL on api_keys, and the companyless key insert from the popup-signup flow (#1814) violates it. Nothing exercised the real insert before (unit tests mock the client; no pg test inserted an unbound key), so repo, CI and prod all agreed and all were wrong. DROP NOT NULL, log the insert/rotation failures at the token endpoint, and pin the unbound insert + lazy bind on real Postgres. Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 09:58:25 +02:00
Jakob Wennberg	c93a97bb4e	fix(invoices): force 0% VAT on recurring and bulk-created invoices when the company is not VAT registered (#1838) ... Issue #1719: moms lands on an invoice even though momskrysset (company_settings.vat_registered) is off. The web and v1 create/update routes, the MCP commit, and the webshop route all zero every line via buildInvoiceWriteData, but two paths insert invoices directly and never consult vat_registered: 1. executeRecurringSchedule (cron + run-now): the schedule dialog defaults template lines to 25%, stores vat_rate with no gate, and the spawn falls back to the customer default (25% for Swedish customers) for null-rate lines. The generated invoice carried 25% output VAT and could be auto-emailed to the customer and booked against 2611. 2. POST /api/v1/.../invoices/bulk-create: same fallback, same direct insert. Both now mirror buildInvoiceWriteData: when vat_registered is false, every line is forced to 0% at spawn/create time, and the header lands as treatment 'exempt' with moms_ruta and reverse_charge_text null. Self-billed received invoices deliberately keep their stated VAT: the counterparty issued that document, and the books must mirror it (ML 16 kap 23 §). Credit notes keep mirroring the invoice they credit. Claude-Session: https://claude.ai/code/session_01SyDuePXxUFowaPBKpAv8SF Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 09:35:31 +02:00
Jakob Wennberg	64119d30bc	fix(bank): Swedish provider errors and a durable failure trail for bank connect attempts (#1841) ... Issue #1716: a user stuck in Handelsbankens fullmakt step got a raw provider token back (server_error, invalid_state) and support had nothing to look at afterwards: the failed pending row is deleted by design, the callback only logged to console (short retention), and event_log recorded successes only. Diagnosis of the reported case: the failures were on the bank's side (the corporate fullmakt requirement); both of the reporter's companies connected successfully on 2026-08-12 with no code change on our side in between, and the connections have been active and syncing since. Changes: - lib/errors/get-error-message.ts: getBankConnectionErrorMessage() maps PSD2 callback outcomes (access_denied, server_error, temporarily_unavailable, session expiry, plus the internal invalid_state, missing_parameters and invalid_code_format tokens) to Swedish user messages, appending the raw provider description so the underlying error is still surfaced. - callback route: every bank_error redirect and the stored error_message now carry the mapped Swedish text; bank_error_code, bank_name and psu_type still flow so the settings page keeps its targeted guidance (Handelsbanken fullmakt steps included). - New audit events bank_connection.consent_denied and bank_connection.finalize_failed are emitted on the two failure paths and persisted to event_log, so support can answer which attempt failed, with which provider error, on whose side, even after the row is gone. Claude-Session: https://claude.ai/code/session_01SyDuePXxUFowaPBKpAv8SF Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-26 09:35:26 +02:00
Jakob Wennberg	0743717033	fix(salary): keep the payslip's Ackumulerat total from going stale (#1911) ... * fix(salary): keep the payslip's Ackumulerat total from going stale `salary_run_employees.ytd_*` (the "Ackumulerat {år}" block on the lönespecifikation) was written once at calculation time and never recomputed, from a query that only counted prior runs already in `booked`. Preparing next month's run before the current one is booked (entirely normal) therefore froze a YTD that is permanently missing the month in between, and the employee's payslip understates the year. Seen in production: an August run calculated on 2026-07-23, three days before the July run was booked, shipped a payslip whose Ackumulerat brutto was 60 000 kr instead of 95 000 kr. Two fixes, both in the new lib/salary/ytd.ts: - `computePriorYtd` counts `approved`, `paid` and `booked` prior runs, not only `booked`. `corrected` stays excluded: its correction run replaces the whole month, so counting both would double it. - `refreshRunYtd` recomputes and rewrites the snapshot, and is now called at approval (the first status lönebesked can be sent from) and at booking, on both the dashboard and v1 surfaces. Rows already correct are left untouched; a failure is logged and never blocks an approval or a booking. The snapshot stays a snapshot rather than becoming a render-time sum: an employee re-opening a lönebesked must see the figures it had when it was issued. YTD is display and reporting only, so nothing here can move a verifikation: the per-month tax lookup and the avgifter caps never read it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * fix(salary): fail loudly on a YTD read error and paginate the reads Review follow-up on both counts: - The opening-balance and prior-run reads discarded their `error`. A failed read looked exactly like a month with no prior pay, so `refreshRunYtd` would rewrite the snapshot to the current month alone and still report success. Both now throw; `refreshRunYtd` turns that into `ok: false` for its callers to log, and `runSalaryCalculation` returns DATABASE_ERROR the way it already does for every other query error in that function. - The prior-run and roster reads now page through `fetchAllRows()` ordered on the primary key. A full roster times eleven prior months passes PostgREST's 1000-row cap well before an employer is large by Swedish standards, and a silent truncation there understates somebody's Ackumulerat. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor(salary): one paginated loader for cutover opening balances Review follow-up. `run-calculation` and `ytd` each read employee_opening_balances with their own unpaginated, error-discarding query. Both now go through `loadOpeningBalances()`: paged via fetchAllRows() ordered on the primary key, and throwing on a read error. The error path matters more than the paging one here. That row carries `karens_periods_adjustment` as well as the YTD carry-in, and a discarded error looked exactly like "nobody has a cutover balance" - which would drop a karensavdrag from sjuklön silently, not just understate a display figure. runSalaryCalculation now maps it to DATABASE_ERROR. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-25 21:40:14 +02:00
Mattsson	d035d283ef	feat(woo): selectable revenue accounts per VAT rate in the bulk order sweep (#1908) ... * feat(woo): selectable revenue accounts per VAT rate in the bulk order sweep The bulk sweep hardcoded the revenue side to the standard 3001-series, so a store selling both goods and services could not route tjansteordrar to its own revenue accounts (user request, follow-up to #1900). The bulk dialog now has a "bokforingsmall" section: per-VAT-rate revenue account inputs, shown only for rates present in the selection, prefilled with the effective defaults; only diffs from the default map are sent. Server side, BulkBookWebshopOrdersSchema gains an optional revenue_accounts map (class 3 accounts only) that buildOrderBookingLines routes each rate bucket's revenue line through; output VAT accounts stay derived from the rate and are not overridable. User-chosen accounts are never auto-created: the route verifies them against the company chart up front and aborts the whole sweep with WEBSHOP_ORDER_REVENUE_ACCOUNT_UNKNOWN naming the offenders, while accounts in the closed prefill set keep riding the existing chart repair. No hardcoded varor/tjanster preset on purpose: BAS 2026 has no standard 30xx goods/services subdivision (see DECISIONS.md). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): harden the bulk revenue template per skeptic and review findings Three findings from the adversarial review of the revenue-template commit, fixed in one pass: - Build breaker: revenueAccountByRate was typed Partial<Record<...>>, making Object.values() return (string | undefined)[] and failing the production build's type-check (Vitest and ESLint both miss it). Typed as Record<number, string>; only truthy strings are ever inserted. - 3740 template collision (two skeptics, independently): choosing 3740 as a revenue account passed the class-3 gate, skipped the chart guard (it is in the closed prefill set), and made the residual bound read the templated revenue line instead of the residual, so a mangled gift-card order the sweep must refuse could book a ~499 kr gap as "oresavrundning" in an immutable verifikat. 3740 is now banned by the schema and the dialog mirror, and the residual line is identified structurally (always the last line) instead of by account lookup, which also fixes the pre-existing misdiagnosis when 3740 is used as payment_account. - Rate-classification guard (Swedish accounting review): output VAT books 2611/2621/2631 per rate regardless of template, but a custom account counts toward ruta 05 only when configured for that rate (explicit momssats, rate-mapped treatment, or rate-conforming 30x1/2/3 number + name, i.e. exactly inferDomesticSalesRate, now exported and reused). A mismatched pair is refused up front with WEBSHOP_ORDER_REVENUE_ACCOUNT_RATE_MISMATCH naming the offenders; default-set accounts are valid only for the rate they are the default for; rate-0 buckets are exempt (no output VAT, legitimate momsfri/ export accounts). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): explicit momssats wins over name inference in the revenue-template guard Two Swedish accounting review findings on the rate-classification guard: - Precedence: the OR check let number+name inference qualify an account whose explicit default_vat_rate says a DIFFERENT rate (6%-configured account passing a 25% slot on its name). The guard now resolves ONE effective rate exactly like fetchDynamicVatAccounts does (explicit momssats, then rate-mapped treatment, inference only when nothing is configured) and compares that. - Rate 0 slots no longer skip the check entirely: an account whose resolved rate is TAXABLE contradicts the 0% bucket and is refused, while unconfigured momsfri/export/EU accounts stay accepted (no contradicting configuration required, not positive proof of 0%). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 21:04:06 +02:00
Mattsson	85e039035d	feat(reports): custom date ranges on report endpoints in REST v1 and MCP, plus PDF export via API (#1909) ... * feat(reports): custom date ranges on report endpoints in REST v1 and MCP, plus PDF export via API Requested by a v1/MCP user: the web UI can produce resultat- and balansrapport for a custom period with PDF export, but REST v1 and the MCP tools only served whole fiscal years and silently ignored from_date/to_date. - v1 income-statement: optional from_date/to_date (validated against the fiscal period via the same parseReportDateRange the dashboard uses) - v1 balance-sheet: same, plus as_of as the natural alias for to_date (mutually exclusive with it) - Unknown query params on these report routes now return VALIDATION_ERROR with the unknown and allowed names instead of being silently dropped (scoped to these routes, not a global v1 change) - MCP gnubok_get_income_statement: from_date/to_date; gnubok_get_balance_sheet: as_of_date; both validate format, in-period and ordering, and reject unknown args (tools/list payload bench held under the ceiling by trimming the same tools' descriptions) - New v1 PDF endpoints reports/{income-statement,balance-sheet}/pdf, byte-equivalent to the dashboard export: the K2/K3 grouping and the balance gate moved to lib/reports/financial-statement-pdf.ts, shared by both surfaces - Both JSON endpoints echo the effective range in data.period Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reports): range semantics, empty-date validation, and review findings on PR #1909 Consolidated resolution of the skeptic refutations, CI failures, and CodeRabbit findings: - Ranged income statement summed closing balances, so from_date after period start returned year-to-date figures mislabeled as the range (July revenue reported as Jan-Jul on JSON, PDF, and MCP). The trial balance rolls pre-range P&L activity into opening columns, so generateIncomeStatement now builds from period movements whenever fromDate is set, matching the resultatrapport convention. Full-period behavior is unchanged; generator-level regression tests added. - from_date dropped from the v1 balance-sheet routes (JSON + PDF): a balansraking is a cumulative position, not a flow over a window (ÅRL 3 kap); matches the MCP tool's as_of_date-only surface. - Empty date values (from_date=) now fail validation instead of silently producing a full-period report with an empty period echo (null-check instead of truthiness in parseReportDateRange). - dry_run, read by the withApiV1 wrapper on every request, is tolerated by the strict param check instead of being rejected as unknown. - Unbalanced balansrakning on the v1 PDF route returns 400 (caller-data condition), matching the dashboard export, instead of 500. - skills/accounted-api regenerated (apiskill:check gate). - Removed the ISO_DATE_RE import that collided with the pre-existing local declaration in the MCP server (TS2440 on core build). - CodeRabbit: 401 tests for both PDF endpoints; event bus cleared in the new MCP test's beforeEach. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 20:34:21 +02:00
Mattsson	c634430677	feat(woo): select multiple orders and book them with one template sweep (#1900) ... * feat(woo): select multiple orders and book them with one template sweep Adds bulk booking to the orders page (issue #1880): hover-reveal checkbox column, a bulkbar with select-all/clear, and a confirm dialog that books every selected order with the standard order template (per-store payment- method mapping, optionally one override account for the whole selection). Server side, POST /api/webshop-orders/bulk-book books each order as its OWN verifikat through the exact same flow as the single-order endpoint: the guards, FX retry and race-free draft -> claim -> commit sequence are extracted to lib/webshop-orders/book-order.ts and shared by both routes, so nothing added to the single path can miss the bulk path. Partial failure is reported per order and never aborts the batch. Fixes #1880 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): replace mangled NUL byte in bulk dialog grouping key with a pipe The account-group key template literal picked up a raw 0x00 byte during generation (known escape-mangling hazard), making git treat the file as binary. Same grouping semantics, plain '|' separator. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): bulk sweep only books derived lines, never guessed ones (skeptic findings) The sweep has no reviewing user, so everything the single dialog relies on a human to catch is now refused per order or aborted: - empty vat_breakdown: the ratio-inferred fallback split (a 25%+6% mixed sale classified as 12%, refunds reversing zero moms via 3004) is only allowed as the single dialog's editable prefill; bulk refuses with WEBSHOP_ORDER_VAT_BREAKDOWN_MISSING - invoice-mode payment methods: booking would foreclose Skapa faktura and post a wrong clearing leg; refused with WEBSHOP_ORDER_INVOICE_MODE_METHOD (the account override does not bypass the merchant's configured flow) - 3740 residual above ore scale (gift-card gaps booked as 'oresavrundning'): refused with WEBSHOP_ORDER_RESIDUAL_TOO_LARGE - settings-fetch failure now aborts the sweep instead of silently rebooking every order to 1686 against the confirmed dialog - maxDuration 300 so a platform kill cannot strand an order between claim and commit - per-order guard details (e.g. journal_entry_id) survive into the failure envelope The dialog mirrors the skip rules up front (named order numbers, not an anonymous count) so the confirmation describes exactly what will book. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): refuse non-Swedish VAT-rate buckets in the bulk sweep A foreign OSS bucket (e.g. German 19%) passes the non-empty breakdown gate with zero residual, but the rate-to-account maps would fall back to the 25% accounts and book foreign VAT as Swedish utgaende moms 2611 (skeptic finding). The sweep now refuses such orders per order with WEBSHOP_ORDER_UNSUPPORTED_VAT_RATE (details.rates names the offending rates); the dialog mirrors the rule and names the skipped orders. Only the single dialog may show that prefill, as an editable guess. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 15:34:34 +02:00
Mattsson	5fc0be9ed7	feat(webshop): generate orderunderlag and attach it to the verifikat at booking (#1899) ... * feat(webshop): generate orderunderlag PDF and attach it to the verifikat at booking Booked webshop orders only carried the VAT split; the verifikat showed no product lines, customer or payment method although the sync already stores all of it in webshop_orders.line_items (#1881). - lib/webshop-orders/order-underlag.tsx: pure model builder + react-pdf template (order lines, customer, payment method, per-rate VAT summary, SEK conversion facts) + archiveWebshopOrderUnderlag, which renders and archives the PDF on the committed verifikat through uploadDocument (upload_source system, extraction none), mirroring archiveIssuedInvoicePdf. Never throws: the booking is immutable by then. - book route: archive after commitEntry; response gains underlag_archived. FX-retry now also syncs the in-memory row so the underlag shows the resolved SEK facts. - webshop_order added to NEEDS_DOC_SOURCE_TYPES and (new migration 20260825140000) to the verifikat_without_documents needs-doc list, so a failed attach or a historical booking surfaces on the saknar-underlag worklist. transactions_without_documents is deliberately unchanged. - tests: underlag model/render/archive unit tests, book-route archive and failure-isolation cases, pg test extended (per-source-type probe now covers webshop_order; explicit flagged/silenced pair). Fixes #1881 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(migrations): move webshop needs-doc migration after main's 20260825150000 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * test(webshop): add manually_booked fields to the underlag order fixture Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(webshop): skeptic findings on the orderunderlag (#1881) Two refutations from the skeptic pass on PR #1899, both fixed: 1. Correctness: sv-SE Intl emits U+2212 MINUS SIGN for negatives, which Helvetica/WinAnsi PDF fonts drop silently, so refund and discount amounts on the archived underlag rendered as POSITIVE. formatAmount now replaces U+2212 with an ASCII hyphen (same guard as formatPdfCurrency), is exported, and is pinned by a regression test. 2. Regression: NEEDS_DOC_SOURCE_TYPES had two hardcoded copies that missed webshop_order, so flagged rows rendered without the "Underlag saknas" chip, waiver toggle, or batch-exempt selection, and the weekly missing-underlag push cron disagreed with the badge. The constant now lives in dependency-free lib/worklist/types.ts (client-safe), is re-exported from categories.ts, and both JournalEntryList.tsx and push-notifications/notification-scheduler.ts consume it instead of their own copies. Also: "Bokfört i SEK" reworded to "Motsvarande i SEK" (compliance skeptic observation: the dialog's lines are user-editable, so the underlag must state the order's conversion, not claim a booking fact). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 15:15:33 +02:00
Mattsson	c6f2bebab9	fix(sie): selectable IB voucher series, smarter IB toggle on re-import, orphan-IB guard (#1896) ... * fix(sie): selectable IB voucher series that never collides with the file's numbering The Ingående balanser voucher was hardcoded to series A and created before the file's vouchers, so it consumed the A series' next number and shifted every imported A voucher one number higher than in the source system (issue #1882). - IB voucher series is now selectable in the import wizard; the default is the first of M,O,P,Q,R,S,T,V,W,X,Y,Z not used by the file's #VER records (M matches the existing migration-adjustment series). - Plumbed end to end: wizard -> /api/import/sie/execute -> executeSIEImport, v1 REST options.openingBalanceSeries, MCP gnubok_import_sie opening_balance_series -> commitImportSie. - The wizard's 'Importera ingående balanser' toggle now defaults OFF when a posted IB voucher already exists inside the file's fiscal year, with a hint saying why. - Orphan-IB guard in executeSIEImport: replace_sie_import deletes only source_type='import' entries and clears the period's OB pointer, so a prior import's IB voucher survived every replace cycle and each re-import created another one (field report: five accumulated). The import now skips IB creation with a warning when a posted opening_balance entry already exists in the period. - MCP import_opening_balances default (false) vs web (true) documented as deliberate in the tool schema and DECISIONS.md. Fixes #1882 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(sie): harden IB series fix after skeptic review (relink orphan, exclude fallback series, type-check option) Skeptic findings on PR #1896, all four blocking items: - Orphan-IB guard now relinks a single surviving opening-balance voucher as the period's OB entry (permitted by the immutability trigger while the pointer is NULL): without it, reports showed IB 0, year-end's duplicate-IB blocker never armed, and the manual IB flow could double-book. It also diffs the survivor's lines against the file's IB and calls out stale amounts in the warning instead of keeping them silently; reverseEntry clears the pointer again for the storno-then-reimport path. - Series-less #VER records resolve to the transaction fallback series at import time, so the IB default picker now treats that series as used by the file (the same #1882 shift pattern through the fallback). The wizard recomputes its IB default with the effective transaction series once loaded. - openingBalanceSeries is type-checked on the web execute route, the MCP stage, and the staged-operation commit: a non-string falls back to the default instead of crashing mid-import after side effects. - The wizard's IB series select flags series used by the file and shows an attention line when the chosen series collides; the engine warns when an explicitly chosen series collides with the file's series (the choice is honored). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(sie): uppercase caller-chosen IB series before persisting Swedish accounting review on PR #1896: a lowercase series from v1 or MCP was persisted as-is, booking a case-distinct parallel series next to its uppercase sibling (BFL 5 kap requires one systematic series) and slipping past the file-collision warning. Normalize centrally in executeSIEImport, the single funnel for web, v1, and MCP. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 15:14:59 +02:00
Mattsson	79013cf092	feat(bookkeeping): guarded fiscal-year reset + findable Angra import (#1883) (#1897) ... * feat(bookkeeping): guarded fiscal-year reset + findable Angra import (#1883) Two deliverables from the community report where a bad SIE test import left no way out short of deleting the company: A) Discoverability: the voucher list shows one attn line linking to /import?history=sie whenever the page contains import-sourced vouchers, and /import?history=sie deep-links straight into the fold-open SIE import history where per-import Angra already lives. B) Reset of an UNLOCKED fiscal year regardless of how the entries arrived: new reset_fiscal_year RPC (same gnubok.allow_delete escape hatch as undo_sie_import; no enforcement trigger touched) behind GET/POST /api/bookkeeping/fiscal-periods/[id]/reset and a typed type-the-year-name confirmation dialog on the fiscal years settings list. Refuses on: locked/closed year, company lock date over any part of the year, executed year-end, arsredovisning state, later year depending on this year's UB, VAT-declared evidence (vat_settlement verifikat, SKV lock/submit audit rows, extension workflow keys, fail closed) and AGI-declared months. Entries referenced by RESTRICT/NO ACTION FKs abort the whole reset (all-or-nothing). Documents are detached, never deleted (BFL 7 kap); every delete is audit-logged plus one behandlingshistorik summary row. Fixes #1883 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(bookkeeping): harden fiscal-year reset after skeptic review (#1883) Blocking skeptic findings on PR #1897, one consolidated pass: - New snapshot blocker cross_year_reference: an entry outside the year whose correction_of_id / reverses_id / reversed_by_id points into the year made the delete crash with an uncaught P0001 (immutability trigger refusing the ON DELETE SET NULL referential UPDATE) after an eligible:true preview, and silently severed draft chains. 12 such chains exist in prod today. - New snapshot blocker rot_rut_state: a begaran om utbetalning that reached Skatteverket (submitted/paid/partially_paid/rejected) was silently unlinked via SET NULL, erasing the bokforing behind a filed and possibly decided myndighetsarende. - Rakenskapsinformation preservation (BFL 7 kap): line-level trigger audit rows carry no company_id and header rows no amounts, so a reset destroyed konton/belopp with no company-readable trace. The RPC now archives the full content of every verifikat in company-scoped RESET_SNAPSHOT audit rows before deleting (action added to audit_log_action_check, NOT VALID), and behandlingshistorik renders them. - Dimension registry lockstep on reset (mirrors undo_sie_import): flipped imports can never be undone again, so their dimensions/values would have been orphaned forever. - EXCEPTION WHEN raise_exception now returns a typed FISCAL_YEAR_RESET_LINKED_ENTRIES envelope instead of a bare 500; gnubok.allow_delete is cleared before leaving the guarded block. - Voucher-list attn line fires only for source_type 'import': opening_balance is also written by year-end closing and the manual IB flows, which mislabelled every year-2+ company as SIE-imported. - /import?history=sie now scrolls the SIE history into view. - Reset dialog copy (sv+en) discloses that linked invoices, payments and bank transactions become unbooked; new blocker strings in both locales. - pg fixture fix: document_attachments seeded without company_id (23502); new pg tests for both blockers, RESET_SNAPSHOT rows and the lockstep. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 14:36:18 +02:00
Jakob Wennberg	d80103a2f5	fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed (#1888) ... * fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed Two reports from the same salary run (Fabian, Specific AI Sweden AB). 1. The payment file carried an OCR Skatteverket does not accept. generateSkattekontoOcr built the reference from the TEN-digit org number plus a Luhn check digit (11 digits). Skatteverket's reference is the TWELVE-digit identity plus a check digit: an organisationsnummer carries the "16" prefix, a personnummer its century. For 559547-0021 we emitted 55954700211 where Skatteverket prints 1655954700217. The twelve-digit form is the same "redovisare" identity the AGI and moms APIs take, so it now goes through the shared toRedovisare12 converter instead of a second local rule: the payment file and the declaration it pays must not disagree about who the taxpayer is. That needs the entity type, which the route now reads alongside org_number. The route also prefers saldo.ocrNummer from the cached skattekonto snapshot over the derived value. It is Skatteverket's own answer for the account we actually sync, it covers identities the converter has no rule for (samordningsnummer, GD-nummer), and it covers the companies whose companies.org_number has drifted from company_settings.org_number. 2. AGI status stayed on "väntar på BankID-signatur i Mina Sidor" after the user had signed. Reading the kvittens needs a live Skatteverket session, and the personal token lives ~65 minutes, so by the time anyone signs in Mina Sidor the 2-hourly kvittens cron finds a dead token and skips quietly. The panel kept asserting a state it could no longer observe. It now says so instead, and the reconnect action already on the panel is the fix: runPostConnectRefresh reconciles pending declarations on a fresh consent. sessionExpiredStatus also counts the needs_reconsent health flag, which a cron can set while the access token is still inside its hour; without it the panel reported a dead connection as healthy. Background reconciliation without a reconnect needs the läsombud grant, which is a registration decision and not part of this change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(skatteverket): say why the entity_type collapse in the payment-file route is total companies.entity_type is NOT NULL with CHECK IN ('enskild_firma', 'aktiebolag'), so the ternary cannot silently mis-tag an enskild firma as a legal entity and give a personnummer the "16" prefix. Two review bots read it as an unguarded default; write down the constraint that makes it safe instead of leaving the next reader to re-derive it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(decisions): record why the cached skattekonto OCR needs no freshness gate Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>	2026-08-25 14:25:00 +02:00
Mattsson	cbfb2201ff	fix(rot-rut): surface drop-out reasons in payout request dialog and keep selectors usable (#1884) (#1891) ... * fix(rot-rut): surface drop-out reasons in payout request dialog and keep selectors usable (#1884) Four silent drop paths made a paid RUT invoice invisible in the begaran dialog (neither eligible nor blocked), and the empty list hid the year picker so the dialog looked dead: 1. deduction lines without a header deduction_total: a second line-based candidate query now finds them and they block as DEDUCTION_TOTAL_MISSING (also at file generation: the 1513 receivable was never booked). 2. partially_paid with the customer share settled: remaining_amount = 0 (total - paid_amount - deduction_total, migration 20260817191708) now counts as paid in evaluateInvoiceForFile; a genuine partial blocks as NOT_PAID with the outstanding amount. 3. NO_DEDUCTION_OF_TYPE is no longer filtered out of blocked: the message points at the other type, and the dialog's empty state adds a switch-type hint. 4. invoices held by a generated/submitted begaran block as ALREADY_REQUESTED naming the request; decided requests stay omitted (finished business, visible in the history list). The dialog keeps the year picker rendered when the list is empty (current year as inert fallback) and opens the blocked list by default when nothing is eligible. Fixes #1884 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(rot-rut): skeptic hardening: decided requests vanish on both tabs, customer share derived from header fields (#1884) Two skeptic refutations against the frozen PR head: 1. Regression: the wrong-type branch ran before the active-request lookup, so invoices of the OTHER type whose begaran was already decided resurfaced forever as NO_DEDUCTION_OF_TYPE in the opposite tab's blocked list, and the empty-state hint pointed at a tab where they never appear. The decided-request skip now runs first, on every tab. 2. Correctness: the paid gate and the NOT_PAID message trusted remaining_amount, but payment-sync's storno path recomputes it WITHOUT subtracting deduction_total, so the stored column can carry Skatteverkets 1513 share and the dialog could assert a wrong customer-outstanding figure. The gate now derives the customer share as total - paid_amount - deduction_total (the buildInvoiceWriteData / migration 20260817191708 formula) from fields every settlement path maintains. Tests pin both: decided+wrong-type omitted from both lists, corrupted remaining still classified and reported from the derived share. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * docs(rot-rut): align CANDIDATE_STATUSES comment with the derived-share gate (#1884) The skeptic-hardening commit moved the paid gate off remaining_amount to the derived customer share (total - paid_amount - deduction_total); the comment still named remaining_amount as the signal. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(rot-rut): explicit decided-status set + correction-path wording (#1884) Swedish accounting review findings on the candidate list: 1. The decided-begaran skip inferred 'decided' by exclusion (anything not generated/submitted), so a future request status would make an invoice vanish from both lists, exactly the silent drop the module forbids. DECIDED_REQUEST_STATUSES now names paid/partially_paid; any other status held by a request lands in blocked as ALREADY_REQUESTED with a generic message. Test pins it. 2. The DEDUCTION_TOTAL_MISSING message said only 'ratta fakturan', which could read as an invitation to edit a booked invoice directly. The invoice edit route already refuses sent/paid/booked invoices, and the message now names the sanctioned path: drafts edit directly, sent or paid invoices are corrected via credit note + new invoice. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 14:24:01 +02:00
Mattsson	1f9578ca76	feat(woo): mark an order as already booked outside the integration (#1895) ... * feat(woo): mark an order as already booked outside the integration Orders booked by hand before the store was connected sat under Att bokfora forever: the only exits were the book and create-invoice routes. - Migration: manually_booked_at/_by + optional manually_booked_journal_entry_id on webshop_orders (informational link, no financial freeze; the mark produced no accounting objects). - POST/DELETE /api/webshop-orders/[id]/mark-booked: mark with optional posted-verifikat reference (validated per company), conditional claim against concurrent booking/invoicing; unmark is a plain revert. - book and create-invoice routes refuse marked rows (409 WEBSHOP_ORDER_MANUALLY_BOOKED) and exclude them in their atomic claims. - List route: booked/unbooked filters treat a manual mark as a closed exit, so marked rows leave the Att bokfora tab and join Bokforda. - Orders page: row overflow menu with Markera som bokford / Angra markering, MarkOrderBookedDialog with a searchable candidate list of posted entries near the order date, muted status text linking to the referenced verifikat. Fixes #1879 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): close skeptic findings on the manual-booked mark - mark-booked applies the same open-twin gate as book/create-invoice: an OPEN legacy feed transaction blocks the mark (409 WEBSHOP_ORDER_LEGACY_TRANSACTION_OPEN); ignored or booked feed rows unlock it, so no open path to a duplicate remains. - ingest treats manually marked rows as frozen for drift purposes: remote financial deltas set remote_changed_after_freeze (same badge as booked rows) instead of silently refreshing the row under the user's assertion. - re-marking with a journal_entry_id updates the informational link instead of silently dropping it. - dialog: candidate amount computed from the returned lines (the list API does not return total_amount), newest-first ordering, cap hint. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(migrations): bump webshop manual-booking migration past freshly merged 20260825120000 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(woo): resolve PR review findings in one pass - freeze v3 migration: financial fields are frozen at the DB level while a row is manually marked as booked (review finding: the mark's freeze lived only in ingest.ts, so any other write path could silently mutate a marked row); unmark stays the escape hatch. pg test added. - pass the active locale to getErrorMessage in the orders page and MarkOrderBookedDialog (CodeRabbit: English users got Swedish errors). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 14:23:56 +02:00
Jakob Wennberg	31e0cd6e05	feat(onboarding): company setup from the conversation and POST /api/v1/companies (#1814 PR 3) (#1864) ... * feat(onboarding): company setup from the conversation and POST /api/v1/companies Third PR of agent-first onboarding (#1814). Once connected, the agent can now set up a company end to end without the web wizard, and partner platforms can provision companies over REST. - create_company_for_user: service-role-only SECURITY DEFINER twin of create_company_with_owner taking the owner explicitly (service clients have no auth.uid()). pg-real test covers creation, role gating, unknown owner and foreign team. - lib/company/create-company.ts: the wizard's creation sequence (org number, TIC snapshot, BAS chart, settings, first fiscal period, tax deadlines, rollback) extracted into createCompanyCore; the Server Action delegates to it, behaviour unchanged. - lib/company/onboarding-input.ts: one Zod schema + planner for the agent/API paths; a VAT-registered company without moms_period is refused (a missing period silently yields zero VAT deadlines). - MCP: gnubok_create_company (two-phase: preview, then confirm=true; companies:write, company-independent), gnubok_connect_bank and gnubok_connect_skatteverket (status + the browser link, gated on bank_sync / skatteverket, search-only in the catalog), the "onboarding" skill, and initialize instructions pointing at it. - Consent page pre-ticks companies:write for an account with no company yet, so the setup does not dead-end on insufficient scope after signup. - POST /api/v1/companies (companies:write, dry-run aware) on the same core; scope map, registry, spec snapshot and the generated API skill updated. - tools/list payload ceiling raised 59.95K -> 60.4K for the one new default-catalog tool (documented in the guard). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(onboarding): explicit f_skatt, org number when VAT-registered, EF first year ends 31 Dec Review findings on #1864 (Swedish compliance review): - f_skatt is required, never defaulted to approved (SE-R-005 risk). - org_number is required when vat_registered: the invoice momsregistreringsnummer derives from it (ML 17 kap 24 §). - An enskild firma's first fiscal year must end on 31 December and its start month is forced to 1 even with first_fiscal_year set, mirroring the wizard's own rule text (BFL 3 kap. 1 §). - POST /api/v1/companies no longer claims Idempotency-Key support (the wrapper only honours it on company-scoped routes). - pg-real: createCompanyCore's chart seed runs under the real service_role, which the unit tests could not prove. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * test(pg): starter chart has 41 accounts, assert non-empty The service_role chart-seed proof passed the part that mattered (no 42501 from seed_chart_of_accounts) and failed on a wrong row-count guess: the seeded chart is a curated starter set, not the full BAS list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(migrations): move create_company_for_user to 20260825120000 main gained 20260824170000_bulk_book_transactions_service_actor.sql with the same version while this branch was open; two files on one version abort every Supabase branch apply and the prod auto-apply. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * chore(api): refresh spec snapshot and generated skill after rebasing onto main Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(mcp): flat create_company result, refuse localhost connect links, test hygiene CodeRabbit on #1864: the confirmed-create result was wrapped in the { data, next } envelope while its outputSchema promised top-level fields; it now returns the fields with next as a sibling. The two connect-link tools refuse to build a link when NEXT_PUBLIC_APP_URL is unset instead of handing a remote user a localhost URL. Tests clear mocks and the event bus in beforeEach. Not changed: the rollback already survives user_preferences.active_company_id (that FK is ON DELETE SET NULL since 20260331010000), and v1 error details stay in the surface's English developer convention. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 12:41:02 +02:00
Mattsson	1fa34aa7ca	feat(skatteverket): repair notification recipients + make the agent the SKV notification surface (#1887) ... * feat(skatteverket): repair notification recipients + make the agent the SKV notification surface The company_members -> profiles!inner(email) PostgREST embed has no FK to traverse (company_members.user_id references auth.users), so it 400'd and silently killed all four notification emails since they shipped. Recipient lookup is now a shared two-step helper (lib/notifications/member-email): kvittens confirmations, skattekonto drift alerts (tax-contact routing preserved via the plural variant) and backup alerts deliver again. The connection-expired email is deleted instead of fixed: with SKV's 65-minute personal sessions it was one mail per connect (see DECISIONS.md); the event and needs_reconsent flagging stay. For MCP-first users the agent is the notification surface, so: - SKATTEVERKET_NOT_CONNECTED copy is now agent-directive: session expiry is normal (~1h by SKV design), only a person can reconnect with BankID, do not retry until they confirm. Inline strings (declaration-status, read routes, v1 pitfalls, accounted-api skill) aligned. - gnubok_get_agent_briefing gains an optional skatteverket_connection block (status/source/connected_at + directive message on needs_reconsent), emitted only when a connection or verified system grant exists, so agents warn the user at session start instead of failing mid-task. Payload bench ceiling bumped 59.95K -> 60.15K for the outputSchema contract. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(skatteverket): drift email resolves recipients via service client; review fixes The skeptic pass refuted the drift-email repair: skattekonto.drift_detected is emitted only by the nightly cron, and the extension registry builds each event handler a fresh ctx from the anonymous cookie client (or none at all on cookieless requests), so RLS returned zero company_members rows and the two-step lookup still resolved no recipient. The handler now builds its own service-role client, the same documented pattern as the retired connection-expired handler; drift tests exercise the handler without ctx, matching the cron reality. CodeRabbit findings: resolveMemberEmails pages both queries through fetchAllRows with stable ordering (PostgREST caps unpaged reads at 1000 rows); the v1 vat-declarations pitfall and regenerated accounted-api docs now name both auth paths (member BankID connection or verified ombud grant); the briefing's system-before-user priority carries a cross-reference to resolveReadAuth explaining why it is not reused. member-email.ts JSDoc states the service-role-client requirement (profiles RLS is own-row-only). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 12:09:20 +02:00
Jakob Wennberg	a717f03898	feat(mcp-oauth): let an account with no company connect and sign up from the OAuth popup (#1814 PR 1) (#1855) ... * feat(mcp-oauth): let an account with no company connect and sign up from the OAuth popup Identity unlock for agent-first onboarding (#1814, shape B+). A person with no Accounted account can now connect from an MCP client, create the account inside the Connect popup and finish the OAuth dance. - authorize/token no longer require a company: consent renders a companyless variant and the key is minted with company_id NULL. - validateApiKey returns companyId string|null and binds an unbound key to the user's first company on the first validation after it exists. - MCP server: company-dependent tools and data resources answer with a structured NO_COMPANY_YET error; the company-independent tools still run; telemetry skips when there is no company scope. - /api/events fails closed instead of throwing for an unbound key. - authorize forces TOTP enrollment (not just verification) for password accounts with no factor, since the middleware skips enrollment for zero-company users; BankID-linked accounts stay exempt. - /login forwards next to /register; register, GoogleAuthButton and /auth/callback carry it back to the consent page (callback honours only /api/mcp-oauth/authorize, via safeReturnTo); /mfa/enroll hard-navigates to /api/* destinations like /mfa/verify. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * refactor(company): move getActiveCompanyId out of the next/headers module lib/auth/api-keys.ts needs the resolver for unbound-key binding, but lib/company/context.ts imports next/headers for the legacy company cookie and Turbopack refuses that import on some of api-keys' import paths (the preview build failed). The resolver and CompanyContextError now live in lib/company/active-company.ts; context.ts re-exports them so every caller and test mock is unchanged. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(mcp-oauth): fail closed on a failed assurance lookup; enroll Back aborts instead of looping Review findings on #1855: requireAal2 let consent through at AAL1 when getAuthenticatorAssuranceLevel() returned nothing and a verified factor existed. Only a positive AAL2 answer passes now; a failed lookup and the inconsistent verified-factor-at-AAL1 case both step up to /mfa/verify. Back on /mfa/enroll with the consent page as returnTo went straight back into the redirect loop; it now aborts to the app. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 11:25:42 +02:00
Jakob Wennberg	9ce1ebc65f	feat(reports): bokslutsbilagor, the pärm per räkenskapsår (Reko bilagor, PR 4) (#1874) ... * feat(reports): bokslutsbilagor, the pärm per räkenskapsår (Reko bilagor, PR 4) One bilaga per balance account as of the balansdag: IB, movement and UB from the trial balance, what it was reconciled against, the difference, the sign-off with who, when and note, and every attached file with its SHA-256; the closing checklist as the first page. JSON and PDF through /api/reports/bokslutsbilagor, in the reports library and on the Avstämning page, and written into every period folder of the full archive. Built from the attested rows, never by recomputing live status. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz * fix(reports): load the pärm renderer on demand in the full archive so PDF stubs elsewhere keep working Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz * fix(reconciliation): neutral rail dot for a manual account that is merely not attested yet An unsigned manual account without a system specification has nothing to compare against, so an amber dot read as a problem on every balance account of a freshly migrated company. Neutral until it is signed or a specification differs. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 09:35:02 +02:00
Jakob Wennberg	c62321988b	feat(reconciliation,bokslut): underlag on a balansdag + persisted closing checklist (Reko bilagor, PR 2 + PR 3) (#1873) ... * feat(reconciliation): underlag on a balansdag, the files behind a sign-off (Reko bilagor, PR 2) A konsult attaches the kontoutdrag, engagemangsbesked or reskontralista an account was reconciled against to (account_key, through_date), before or after the sign-off, from every account body on the Avstämning page. Rows live in account_reconciliation_attachments (append-only, removal stamp by trigger, RLS like account_reconciliations), bytes in the documents bucket under the company prefix so its RLS applies unchanged, and the full archive copies them into bilagor/ with a hash manifest. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz * fix(reconciliation): literal selects and payload in the attachments store so the phantom-column scanner can read them Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz * feat(bokslut): persisted closing checklist and missing-fiscal-year warning (Reko bilagor, PR 3) (#1867) * feat(bokslut): persisted closing checklist and missing-fiscal-year warning (Reko bilagor, PR 3) The bokslut checklist is a catalogue in code with one state row per period (bokslut_checklist_items): the steps the system can judge (sign-offs through balansdagen, reskontra tie-outs, drafts, voucher gaps, trial balance) are computed live and a stored row only overrides them; the manual steps are the konsult's ticks, with who and when. It sits on the wizard's Kontroll step and is dumped into the full archive. A hole between fiscal years (one-file SIE migrations) is now named on the bokslut readiness screen and on the import result screen, where the next file is one click away. Non-adjacent period links are #1849's fix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz * fix(bokslut): count unexplained voucher gaps, literal select and payload for the checklist store Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01RvFveUpbdPBXdm7f5FEYoz --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>	2026-08-25 09:34:05 +02:00