fix(auth): route document integrity, transaction delete/list and agent categorize through withRouteContext (#1926)

Two handlers hand-rolled supabase.auth.getUser() and therefore skipped the
MFA (AAL2) gate on hosted: DELETE /api/transactions/[id] and
GET /api/transactions. Both sat next to a sibling handler that was already
wrapped, and the raw-route-auth ratchet exempted a file as soon as any
withRouteContext call appeared in it, so they were never flagged.

GET /api/documents/[id]/integrity and POST /api/agent/categorize called
requireAuth() directly (MFA enforced, but no request id, no completion log,
no canonical error envelope). All four are now withRouteContext handlers
with identical company scoping and responses; the transaction delete keeps
its viewer rejection via requireWrite.

The guard now judges each top-level export segment of a route file on its
own, so a wrapped handler no longer exempts a hand-rolled sibling. Baseline
is unchanged (mcp-oauth/authorize remains the one grandfathered file).

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/transactions/__tests__/route.test.ts

@@ -1,6 +1,7 @@
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import {
   createMockRequest,
+  createMockRouteParams,
   parseJsonResponse,
   createQueuedMockSupabase,
   makeTransaction,
@@ -16,7 +17,14 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
 }))
 
+// GET goes through withRouteContext, which resolves the session via requireAuth.
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: vi.fn(),
+}))
+
 import { GET } from '../route'
+import { requireAuth } from '@/lib/auth/require-auth'
+import { NextResponse } from 'next/server'
 
 describe('GET /api/transactions', () => {
   const mockUser = { id: 'user-1', email: 'test@test.se' }
@@ -26,14 +34,22 @@ describe('GET /api/transactions', () => {
     vi.clearAllMocks()
     reset()
     mockSupabase.from = originalFrom
-    mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
+    vi.mocked(requireAuth).mockResolvedValue({
+      user: mockUser as never,
+      supabase: mockSupabase as never,
+      error: null,
+    })
   })
 
   it('returns 401 when not authenticated', async () => {
-    mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
+    vi.mocked(requireAuth).mockResolvedValue({
+      user: null as never,
+      supabase: mockSupabase as never,
+      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+    })
 
     const request = createMockRequest('/api/transactions')
-    const response = await GET(request)
+    const response = await GET(request, createMockRouteParams({}))
     const { status, body } = await parseJsonResponse(response)
 
     expect(status).toBe(401)
@@ -48,7 +64,7 @@ describe('GET /api/transactions', () => {
     enqueue({ data: txs, error: null })
 
     const request = createMockRequest('/api/transactions')
-    const response = await GET(request)
+    const response = await GET(request, createMockRouteParams({}))
     const { status, body } = await parseJsonResponse<{
       data: typeof txs
       has_more: boolean
@@ -70,7 +86,7 @@ describe('GET /api/transactions', () => {
     enqueue({ data: txs, error: null })
 
     const request = createMockRequest('/api/transactions')
-    const response = await GET(request)
+    const response = await GET(request, createMockRouteParams({}))
     const { status, body } = await parseJsonResponse<{
       data: typeof txs
       has_more: boolean
@@ -102,7 +118,7 @@ describe('GET /api/transactions', () => {
     mockSupabase.from = fromSpy as unknown as typeof mockSupabase.from
 
     const request = createMockRequest('/api/transactions?unmatched=true')
-    await GET(request)
+    await GET(request, createMockRouteParams({}))
 
     expect(fromSpy).toHaveBeenCalledWith('transactions')
     const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
@@ -129,7 +145,7 @@ describe('GET /api/transactions', () => {
     mockSupabase.from = fromSpy as unknown as typeof mockSupabase.from
 
     const request = createMockRequest('/api/transactions?reconciled=true')
-    await GET(request)
+    await GET(request, createMockRouteParams({}))
 
     const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
     const notCall = chain.__calls.find((c) => c.method === 'not')
@@ -160,7 +176,7 @@ describe('GET /api/transactions', () => {
     const request = createMockRequest(
       '/api/transactions?currency=SEK&date_from=2024-01-01&date_to=2024-12-31'
     )
-    await GET(request)
+    await GET(request, createMockRouteParams({}))
 
     const chain = fromSpy.mock.results[0].value as { __calls: { method: string; args: unknown[] }[] }
     const eqCalls = chain.__calls.filter((c) => c.method === 'eq')
@@ -183,7 +199,7 @@ describe('GET /api/transactions', () => {
     enqueue({ data: null, error: { message: 'boom' } })
 
     const request = createMockRequest('/api/transactions')
-    const response = await GET(request)
+    const response = await GET(request, createMockRouteParams({}))
     const { status, body } = await parseJsonResponse<{ error: string }>(response)
 
     expect(status).toBe(500)