Mattsson
d54b43f80f
* fix(invoices): anchor the PDF logo to the top-left of its header cell The logo box is always the full 240x80pt reserved area (any larger logo is clamped to exactly that), so objectFit: 'contain' placed the image inside it with the default 50% 50% centering. A wide banner logo fills the width and lands on the left margin, but a near-square logo scaled down to the 80pt height cap is only ~117pt wide and got pushed ~60pt in from the margin, which reads as a misaligned logo and forced companies to reshape their artwork. Anchor the image top-left so every aspect ratio starts at the margin. Covered by a test that renders the real PDF and reads the image placement matrix out of the content stream, for both a wide and a near-square logo. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(invoices): show the real delivery outcome in the send history "Skickad" only meant the email provider accepted the message, so a bounced invoice looked identical to one that arrived. Resend reports the outcome asynchronously; that report now lands on the delivery row and drives the history: green is reserved for a confirmed delivery, bounce/blocked reads red, delayed and spam-marked read amber, and an accepted-but-unconfirmed send is neutral instead of falsely green. The report arrives on a signed webhook and may only touch the three new provider status columns of an already sent, unredacted row: the WORM trigger proves nothing else changed, and a lower ranked or older report can never downgrade an observed failure. The provider reason text can quote the failing address, so it is masked on read and cleared by the daily PII redaction job. Timestamps also formatted in Europe/Stockholm instead of falling back to the runtime zone, which rendered a 14:05 send as 12:05 on Vercel. Delivery reports are per message, never per recipient: Resend sends one event for the whole message, so splitting a send per recipient would be the only way to get finer granularity, at the cost of CC. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(stripe): make the integration feed-only Stripe sync now only imports balance transactions into the transactions inbox, like any bank feed; nothing auto-books. The event/settlement sync (lib/sync.ts, lib/payouts.ts) stays in the repo but is no longer wired to any route or cron: the 15-min sync cron is removed from vercel.json. Payment links on invoice send are unchanged; their payments arrive as feed rows and are matched manually. - /sync runs only syncStripeBalanceTransactions; response is { success, transactions } - connecting via OAuth enables the nightly feed by default (toggle stays as opt-out) - panel: needs-review section and plumbing removed, copy rewritten to transactions-first (sv + en), toast reports fetched/imported/linked and calls out an empty result instead of silent all-zeros Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): return the article currency from the v1 article list The dashboard, importer, export and MCP article surfaces all learned to carry a non-SEK article price (#1166, #1183, #1184), but the v1 projection still omitted currency. An API or agent caller therefore read price_excl_vat with nothing marking it as EUR and would copy the number straight onto a SEK invoice line, at a nine-to-one error. Adds currency to the projection, the response shape and the example, plus a pitfall stating the price is not always SEK and that this endpoint does no FX conversion. Additive field only; no migration (articles.currency already exists). Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat(settings): replace the settings modal with a routed panel sheet Settings now renders as a sheet that fills the main panel, sliding up over the page the user came from and back down on close, with the sidebar and frame left visible and usable. Behind it sits one shared master-detail surface: underline search across every section and subsection, the grouped section rail, and the active section as a direct-editing accordion. All 11 sections are decomposed into subsections, and the legacy *SettingsContent components compose the same pieces so the stacked and accordion layouts cannot drift. The sheet is the only presentation, on every entry path. The intercepting route handles in-app navigation and closes by popping the history entry, landing back on the page underneath. @settingsModal/default.tsx handles cold loads (refresh, deep link, new tab), where interception never fires; nothing is mounted underneath there, so it closes to the dashboard. Both branch on one shared predicate, isSheetSection, together with the settings layout, which must render nothing for those sections or the surface would stack twice behind the sheet and run every section's fetches twice. Closing is deliberate rather than incidental: the X, Esc, or navigating away. The dialog is non-modal so the sidebar's account popover and company switcher keep working with settings up, and an outside click no longer dismisses it. Sections land fully collapsed, and the scroll position of the page behind survives opening and closing the sheet. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * feat: enhance article management and settings UI - Add PATCH test for toggling article active state without other fields. - Remove unused MessageCircle icon from DashboardContent. - Refactor AccountingFrameworkForm to use SettingsFieldRow for better help text display. - Update CompanyInfoForm, DimensionsToggle, and various settings forms to replace description with help text. - Remove redundant headings and intros in several settings components to streamline UI. - Improve help text for various settings in English and Swedish translations. - Update structured error messages for better clarity on article deletion. * refactor(ArticleDetailPage): remove unused imports and duplicate state variable * fix(settings): own deep-linked settings routes by route list, not nav visibility Review fixes from the settings panel sheet work: * isSheetSection reads the full settings route list so a hidden-but-deep-linked section (assistant before BankID, banking in sandbox, api without MCP) is claimed by the sheet instead of rendering the legacy shell around an empty panel * keep 503 on the Resend delivery webhook when the signing secret is unset, with a test pinning the behaviour * stripe callback route test coverage Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * refactor: update salary, tax, and templates settings components - Refactored SalarySettingsContent to use a form wrapper and improved payment settings UI. - Enhanced TaxSettingsContent with new signals for EU sales, KU obligations, and ROT/RUT deductions. - Updated TemplatesSettingsContent to remove legacy comments and improve readability. - Simplified navigation items by removing unnecessary constants and directly using hrefs. - Cleaned up translation files by removing deprecated keys and adding new descriptions for clarity. --------- Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
5.0 KiB
DPIA screening: invoice delivery history
Classification: Confidential
Date: 2026-07-22 Updated: 2026-07-24 (provider delivery outcome) Owner: Accounted controller Status: Screening completed
Processing
The service records each customer-invoice delivery attempt, its recipient and message payload, delivery result, and the exact attached PDF. The purpose is to provide operational delivery history and evidence that accounting information was sent. The lawful bases are contract performance under GDPR Article 6(1)(b) and legal obligations under Article 6(1)(c) and BFL 7 kap.
Necessity and proportionality
The exact payload is needed server-side to resolve delivery disputes and retain the sent accounting document. It is not necessary in the routine browser list. The list therefore exposes only status, timestamps, masked recipient domains, provider name, the provider delivery outcome with its masked reason text, error code, and an active-company-scoped link to the archived PDF. Subjects, bodies, full addresses, reply-to addresses, provider message IDs, BCC recipients, filenames, and checksums are excluded.
The provider delivery outcome (provider_status, provider_status_at,
provider_status_detail) is received from the email provider over a signed
webhook after the send. The outcome and its timestamp are delivery metadata.
The reason text is provider-authored and routinely quotes the recipient address
that failed, so it is treated as recipient personal data: local parts are masked
before it leaves the server, the stored text is capped at 500 characters, and it
is cleared by the same daily redaction job as the rest of the delivery PII. No
open or click tracking is enabled, so no recipient behaviour is recorded.
The owner/admin full statutory archive has a different legal and operational
purpose from the routine list, so it intentionally does not apply the list's
field minimization to data/invoice_deliveries.json. That export contains the
delivery and tenant identifiers, actor identifier, channel and status, full To,
CC, and BCC recipient arrays, reply-to and sender name, subject, plain-text and
HTML bodies, provider and provider message identifier, error code, archived
document identifier, attachment filename, content type and SHA-256 checksum,
delivery timestamps, retention and redaction timestamps, and creation time. The
ZIP may also contain the exact sent PDF and other company accounting records.
Access is therefore restricted to owner/admin and returned only as a private
server-generated export.
Risks and controls
- Cross-tenant disclosure: route context, explicit
company_idfilters, RLS, active-company document authorization, and a second owner/admin membership verification through the stateless service-role client before export. Every service-role archive query uses the verifiedcompany_iddirectly or IDs derived from rows scoped to that company. - Excess browser disclosure: allow-listed response fields, domain masking, and
private, no-storecaching. BCC recipients never leave the server-side delivery evidence through the list endpoint. The exact table payload is sender-only under RLS; other members use a masked summary function. Complete statutory exports are owner/admin-only server operations. Their exact payload exception is limited to the downloadable statutory archive purpose described above and is not reused by the routine history endpoint. The summary function is defined in migration20260724160000and the route applies domain masking again before returning its allow-listed fields, including inside the provider reason text. - Forged delivery outcome: the provider webhook is Svix-signature verified before anything is written, and the applying function is service-role only. It matches on the provider's own message identifier, may only touch an already sent, unredacted row, and can never downgrade an observed failure.
- Forged delivery evidence: authenticated PostgREST INSERT and UPDATE access is removed. Server-only functions bind reservations and state transitions to a verified writable company member. Payload-free crashed reservations may be reclaimed by another sender only after 15 minutes.
- Undocumented mutation: immutable status transitions plus a metadata-only audit trigger. Audit state excludes recipients and message content.
- Excess retention: fiscal-period-derived
retention_expires_atand daily PII redaction after the statutory minimum expires. - Misleading failed evidence: a provider failure detaches and deletes the unsent archived PDF while retaining attempt metadata.
Screening conclusion
The processing is limited to ordinary invoice contact and communication data, does not involve systematic monitoring, special-category data, automated legal decisions, or large-scale combination of datasets. With the controls above it does not meet the GDPR Article 35 high-risk threshold, so a full DPIA is not required. Re-screen before adding message search, analytics, special-category content, or cross-customer profiling.