4 Commits

Include renames

Author	SHA1	Message	Date
admin	04813c34b0	feat(collab): order-anteckningar — @siax/collaboration-kernelns första produktkonsument (spår C) ... Kernel 0.3.0 används som capability, inte som paket-dekor: - lib/order-notes-store.ts: varje note ÄR en CollaborationOperation; nextLamportClock för nya klockor, mergeOperationLog/compareOperations för deterministisk listning; optimistisk version -> 409 vid stale skrivning. - lib/order-notes-client.ts: kernel-CollaborationTransport över host-API; offline = medvetet no-op + varning (ingen tyst förlust), 409 -> ConflictError. - app/api/admin/order-notes: requireRouteAuth (fail-closed 401), server-authoritative tenant-guard (403), AUD0-audit via hostens klient. - app/admin/notes: admin-yta med offline-växel, konflikt-banner + reload. - sql/016_order_notes.sql: persistens (DB-tabell, version + Lamport-klocka). Tester: API (happy/conflict 409/empty/400/401/403/404), klient-adapter (offline no-op utan fetch, 409-mappning, presence), SSR-render. 18 nya test.	2026-09-30 17:07:21 +02:00
admin	c7fd9d45a2	fix(prod): map SiaxError in the 7 legacy money routes — DEPENDENCY_UNAVAILABLE/503 instead of opaque 500 (0pt#53) ... getSqlForDurableStore throws SiaxError(DEPENDENCY_UNAVAILABLE, httpStatus 503, retryable) when a money-bearing store would fall back to an in-memory Map in a production runtime (the durable-store guard). The /api/0pt/* surface already maps it via src/http/siax-error-response.ts; the seven legacy routes outside the middleware matcher did not — the documented 503 leaked as Next's opaque 500 with no body. - app/api/siax-error-mapping.ts: shared isSiaxError + siaxErrorResponseForLegacy - orders (POST/GET), orders/[id] (GET/PATCH), subscriptions (GET/POST), payments/deposit, payments/release, admin/metrics: try/catch -> mapper, each route's own typed error contract preserved (idempotency conflict 409 etc.) - webhooks/stripe: store outage -> 503 received:false reason:store_unavailable so Stripe's delivery retry path stays open (never a silent received:true) - tests/api/legacy-routes-siax-error-mapping.test.ts: pins the 503 + body	2026-09-22 04:33:57 +02:00
adminandClaude Sonnet 5	15a0dbe3b1	fix(security): require auth on GET /api/orders and GET /api/admin/metrics ... A live compliance audit against 0pt.app confirmed both endpoints returned HTTP 200 with zero authentication -- the full order queue and financial pipeline aggregates (deposit/pipeline totals) were readable by anyone. Root cause: middleware.ts's matcher only covers /api/0pt/:path*, by design ("does NOT touch ... the unrelated payment/order APIs"), so nothing upstream of these two handlers ever verified the caller. Fix: both GET handlers now call the same fail-closed Zitadel verifier /api/0pt/* relies on (resolveAuthContext, src/auth/context.ts) directly, via a new thin wrapper (src/auth/require-route-auth.ts) that maps a rejected decision to the same 401/403 JSON shape middleware.ts already returns. The wrapper re-verifies the bearer token itself rather than trusting any x-0pt-verified-* header on the request, since middleware never runs in front of these routes to overwrite a client-supplied one. POST /api/orders (anonymous draft/quote creation before the deposit-payment step) is intentionally left as-is -- only the read paths that leaked data are gated. Tracked as part of docs/compliance/BACKLOG.md P0-3. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>	2026-08-11 04:06:13 +02:00
adminandClaude Opus 4.8	f4fa1c0a5e	feat(portal+admin): shared shell, customer portal (dashboard nav, subscriptions, settings) + admin portal (order queue w/ status actions, source registry) + admin/subscriptions APIs ... PortalShell (sidebar + session bar via /api/auth/me + logout). Customer: /portal nav, /portal/subscriptions (create feed), /portal/settings (dev-login + DPA). Admin: /admin (metrics + order queue with inline status advance), /admin/sources. APIs: /api/admin/metrics, /api/subscriptions. tsc 0, build green. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>	2026-06-24 21:29:27 +02:00