Fix/mcp fixes and bugs (#518)

* feat(voucher): add create voucher and correct entry previews; update commit methods

* feat: add support for pending operations in API key scopes and OAuth client management

- Introduced new API key scopes for reading and approving pending operations.
- Updated the scope groups to include pending operations.
- Added new tools for listing and managing pending operations.
- Implemented OAuth client registration and revocation endpoints.
- Created a UI panel for managing OAuth clients, including registration and revocation.
- Added tests for pending operations tools and OAuth allowlist functionality.
- Implemented a database migration for OAuth client registrations with appropriate policies and constraints.

* feat: Implement OAuth client registration rate limiting and enhance security measures

- Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks.
- Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained.
- Updated error responses to be uniform across different types of redirect URI validation failures.
- Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided.
- Improved handling of high-risk pending operations, requiring explicit confirmation for approvals.
- Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail.
- Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.

app/api/pending-operations/bulk-commit/__tests__/route.test.ts

@@ -235,7 +235,10 @@ describe('POST /api/pending-operations/bulk-commit', () => {
       'user-1',
       'company-1',
       expect.objectContaining({ id: VALID_ID_1 }),
-      { userEmail: 'test@test.se' }
+      // commit_method must be 'bulk_accept' so any journal_entries created
+      // during bulk approval are tagged distinctly from single-approval ones
+      // (BFNAR 2013:2 behandlingshistorik).
+      { userEmail: 'test@test.se', commitMethod: 'bulk_accept' }
     )
   })
 

app/api/pending-operations/bulk-commit/route.ts

@@ -67,6 +67,7 @@ export async function POST(request: Request) {
 
     const result = await commitPendingOperation(supabase, user.id, companyId, op, {
       userEmail: user.email,
+      commitMethod: 'bulk_accept',
     })
     if (result.status === 'committed') {
       results.push({ id, status: 'committed' })