f8db38f989
* fix(analytics): mask session replays by default, chrome-only unmask Invert PostHog session-replay masking from visible-by-default with pattern masking to deny-by-default: every input value is masked wholesale (rrweb maskAllInputs, no maskInputFn) and every text node is masked unless it sits under data-ph-unmask chrome or a table column header (th). Chrome tags live on the shared UI primitives (PageHeader, Label, Button except combobox triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help popovers, empty states, settings labels), and tagged chrome is still pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask beats data-ph-unmask, so call sites that interpolate user data into chrome stay masked; a very-thorough audit swept every unmasked primitive and each found site got a call-site mask. Confirm-dialog wrappers and toasts stay masked centrally: their copy describes user objects by design. Untagged new UI over-masks instead of leaking. Privacy policy, RoPA and decision log updated in the same change. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): tag detail-section chrome merged from main The register-detail primitives landed on main after the replay-masking audit ran: kickers and DefRow labels are static i18n chrome, values stay masked. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(analytics): close skeptic and review findings on replay masking Explicit data-ph tags now resolve before the th chrome fallback, so a th nested inside a data-ph-mask container masks correctly (regression test added). Seven missed text-leak sites get call-site masks: delete-invoice and credit-page invoice numbers, IB-correction voucher reference, TIC orgnr (served unnormalized, so the separator-based scrub cannot be relied on), articles search-term empty state, dimension segment labels, and activate-account buttons. The attribute channel is closed with rrweb's blockClass: inputs whose placeholder carries an effective user value (salary overrides, correction description, danger-zone confirms, credit confirm) get ph-no-capture, removing the element from recordings while the prefill UX stays intact; the pivot-th title attribute is dropped. Privacy-policy effective date bumped to 2026-08-17. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
248 lines
8.4 KiB
TypeScript
248 lines
8.4 KiB
TypeScript
'use client'
|
|
|
|
import { useState } from 'react'
|
|
import { useTranslations } from 'next-intl'
|
|
import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
|
|
import { Button } from '@/components/ui/button'
|
|
import { Input } from '@/components/ui/input'
|
|
import { Label } from '@/components/ui/label'
|
|
import { Textarea } from '@/components/ui/textarea'
|
|
import { Badge } from '@/components/ui/badge'
|
|
import { Settings2, Loader2 } from 'lucide-react'
|
|
import { useToast } from '@/components/ui/use-toast'
|
|
import { formatCurrency } from '@/lib/utils'
|
|
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
|
|
|
interface SalaryOverridePanelProps {
|
|
runId: string
|
|
employeeId: string
|
|
taxWithheld: number
|
|
taxOverride: number | null
|
|
avgifterAmount: number
|
|
avgifterOverride: number | null
|
|
avgifterBasis: number
|
|
avgifterBasisOverride: number | null
|
|
reason: string | null
|
|
onSaved: () => void
|
|
disabled?: boolean
|
|
}
|
|
|
|
function num(v: string): number | null {
|
|
const trimmed = v.trim()
|
|
if (!trimmed) return null
|
|
const n = Number(trimmed.replace(',', '.'))
|
|
return Number.isFinite(n) ? n : null
|
|
}
|
|
|
|
export function SalaryOverridePanel(props: SalaryOverridePanelProps) {
|
|
const t = useTranslations('salary_override')
|
|
const { toast } = useToast()
|
|
const [expanded, setExpanded] = useState(
|
|
props.taxOverride !== null ||
|
|
props.avgifterOverride !== null ||
|
|
props.avgifterBasisOverride !== null,
|
|
)
|
|
const [taxStr, setTaxStr] = useState(props.taxOverride !== null ? String(props.taxOverride) : '')
|
|
const [avgStr, setAvgStr] = useState(
|
|
props.avgifterOverride !== null ? String(props.avgifterOverride) : '',
|
|
)
|
|
const [basisStr, setBasisStr] = useState(
|
|
props.avgifterBasisOverride !== null ? String(props.avgifterBasisOverride) : '',
|
|
)
|
|
const [reason, setReason] = useState(props.reason ?? '')
|
|
const [saving, setSaving] = useState(false)
|
|
|
|
const hasOverride =
|
|
props.taxOverride !== null ||
|
|
props.avgifterOverride !== null ||
|
|
props.avgifterBasisOverride !== null
|
|
|
|
async function handleSave() {
|
|
setSaving(true)
|
|
try {
|
|
// Skatteavdrag is stated in whole kronor (öretal bortfaller): the
|
|
// schema rejects öre, so drop them here instead of bouncing the save
|
|
// with a 400 when someone types a decimal.
|
|
const taxOverride = num(taxStr)
|
|
const body = {
|
|
tax_withheld_override: taxOverride === null ? null : Math.trunc(taxOverride),
|
|
avgifter_amount_override: num(avgStr),
|
|
avgifter_basis_override: num(basisStr),
|
|
reason: reason.trim() || null,
|
|
}
|
|
const res = await fetch(`/api/salary/runs/${props.runId}/employees/${props.employeeId}`, {
|
|
method: 'PATCH',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify(body),
|
|
})
|
|
const data = await res.json()
|
|
if (!res.ok) {
|
|
toast({
|
|
title: t('save_failed'),
|
|
description: typeof data?.error === 'string' ? data.error : t('unknown_error'),
|
|
variant: 'destructive',
|
|
})
|
|
return
|
|
}
|
|
toast({ title: t('saved') })
|
|
props.onSaved()
|
|
} catch (err) {
|
|
toast({
|
|
title: t('save_failed'),
|
|
description: err instanceof Error ? getUserErrorMessage(err) : t('unknown_error'),
|
|
variant: 'destructive',
|
|
})
|
|
} finally {
|
|
setSaving(false)
|
|
}
|
|
}
|
|
|
|
async function handleClear() {
|
|
setSaving(true)
|
|
try {
|
|
const res = await fetch(`/api/salary/runs/${props.runId}/employees/${props.employeeId}`, {
|
|
method: 'PATCH',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
tax_withheld_override: null,
|
|
avgifter_amount_override: null,
|
|
avgifter_basis_override: null,
|
|
reason: null,
|
|
}),
|
|
})
|
|
if (!res.ok) {
|
|
const data = await res.json()
|
|
toast({
|
|
title: t('clear_failed'),
|
|
description: typeof data?.error === 'string' ? data.error : t('unknown_error'),
|
|
variant: 'destructive',
|
|
})
|
|
return
|
|
}
|
|
setTaxStr('')
|
|
setAvgStr('')
|
|
setBasisStr('')
|
|
setReason('')
|
|
toast({ title: t('cleared') })
|
|
props.onSaved()
|
|
} finally {
|
|
setSaving(false)
|
|
}
|
|
}
|
|
|
|
return (
|
|
<Card>
|
|
<CardHeader className="flex flex-row items-center justify-between space-y-0">
|
|
<div className="flex items-center gap-2">
|
|
<CardTitle className="text-base">{t('title')}</CardTitle>
|
|
{hasOverride && <Badge variant="warning">{t('adjusted_badge')}</Badge>}
|
|
</div>
|
|
<Button
|
|
variant="outline"
|
|
size="sm"
|
|
onClick={() => setExpanded((v) => !v)}
|
|
disabled={props.disabled}
|
|
>
|
|
<Settings2 className="mr-1.5 h-3.5 w-3.5" />
|
|
{expanded ? t('hide') : t('show')}
|
|
</Button>
|
|
</CardHeader>
|
|
{expanded && (
|
|
<CardContent className="space-y-4">
|
|
<p className="text-xs text-muted-foreground">
|
|
{t('description')}
|
|
</p>
|
|
|
|
<div className="grid gap-4 sm:grid-cols-3">
|
|
<div className="space-y-1.5">
|
|
<Label htmlFor="tax_override" className="text-xs">
|
|
{t('tax_label')}
|
|
</Label>
|
|
<Input
|
|
id="tax_override"
|
|
inputMode="decimal"
|
|
placeholder={String(props.taxWithheld)}
|
|
value={taxStr}
|
|
onChange={(e) => setTaxStr(e.target.value)}
|
|
disabled={props.disabled || saving}
|
|
// ph-no-capture: the placeholder is the employee's effective
|
|
// amount, and replay masking covers values, not attributes.
|
|
className="tabular-nums ph-no-capture"
|
|
/>
|
|
<p className="text-[11px] text-muted-foreground">
|
|
{t('calculated')} <span className="tabular-nums">{formatCurrency(props.taxWithheld)}</span>
|
|
</p>
|
|
</div>
|
|
|
|
<div className="space-y-1.5">
|
|
<Label htmlFor="avgifter_override" className="text-xs">
|
|
{t('avgifter_label')}
|
|
</Label>
|
|
<Input
|
|
id="avgifter_override"
|
|
inputMode="decimal"
|
|
placeholder={String(props.avgifterAmount)}
|
|
value={avgStr}
|
|
onChange={(e) => setAvgStr(e.target.value)}
|
|
disabled={props.disabled || saving}
|
|
className="tabular-nums ph-no-capture"
|
|
/>
|
|
<p className="text-[11px] text-muted-foreground">
|
|
{t('calculated')} <span className="tabular-nums">{formatCurrency(props.avgifterAmount)}</span>
|
|
</p>
|
|
</div>
|
|
|
|
<div className="space-y-1.5">
|
|
<Label htmlFor="avgifter_basis_override" className="text-xs">
|
|
{t('basis_label')}
|
|
</Label>
|
|
<Input
|
|
id="avgifter_basis_override"
|
|
inputMode="decimal"
|
|
placeholder={String(props.avgifterBasis)}
|
|
value={basisStr}
|
|
onChange={(e) => setBasisStr(e.target.value)}
|
|
disabled={props.disabled || saving}
|
|
className="tabular-nums ph-no-capture"
|
|
/>
|
|
<p className="text-[11px] text-muted-foreground">
|
|
{t('calculated')} <span className="tabular-nums">{formatCurrency(props.avgifterBasis)}</span>
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="space-y-1.5">
|
|
<Label htmlFor="override_reason" className="text-xs">
|
|
{t('reason_label')}
|
|
</Label>
|
|
<Textarea
|
|
id="override_reason"
|
|
rows={2}
|
|
placeholder={t('reason_placeholder')}
|
|
value={reason}
|
|
onChange={(e) => setReason(e.target.value)}
|
|
disabled={props.disabled || saving}
|
|
/>
|
|
</div>
|
|
|
|
<div className="flex flex-wrap gap-2">
|
|
<Button onClick={handleSave} disabled={props.disabled || saving}>
|
|
{saving && <Loader2 className="mr-1.5 h-3.5 w-3.5 animate-spin" />}
|
|
{t('save')}
|
|
</Button>
|
|
{hasOverride && (
|
|
<Button
|
|
variant="outline"
|
|
onClick={handleClear}
|
|
disabled={props.disabled || saving}
|
|
>
|
|
{t('clear')}
|
|
</Button>
|
|
)}
|
|
</div>
|
|
</CardContent>
|
|
)}
|
|
</Card>
|
|
)
|
|
}
|