fix: downgrade missing extension env vars to warning, add error boundaries and cron auth fixes

- Change missing extension env vars from throw to log.warn (graceful degradation)
- Move initialized flag after all init steps complete
- Add error.tsx and loading.tsx for dashboard error boundaries
- Fix cron route auth header checks
- Add ensureInitialized() to journal entry reverse and invoice mark-paid/sent routes

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/(dashboard)/deadlines/page.tsx

@@ -10,13 +10,14 @@ import { Badge } from '@/components/ui/badge'
 import { AlertTriangle, ArrowRight } from 'lucide-react'
 import type { Deadline } from '@/types'
 
+const supabase = createClient()
+
 export default function DeadlinesPage() {
   const [deadlines, setDeadlines] = useState<Deadline[]>([])
   const [customers, setCustomers] = useState<{ id: string; name: string }[]>([])
   const [overdueInvoices, setOverdueInvoices] = useState<{ count: number; total: number }>({ count: 0, total: 0 })
   const [isLoading, setIsLoading] = useState(true)
   const { toast } = useToast()
-  const supabase = createClient()
 
   const fetchData = useCallback(async () => {
     setIsLoading(true)
@@ -66,7 +67,7 @@ export default function DeadlinesPage() {
     } finally {
       setIsLoading(false)
     }
-  }, [supabase, toast])
+  }, [toast])
 
   useEffect(() => {
     fetchData()

app/(dashboard)/error.tsx

@@ -0,0 +1,27 @@
+'use client'
+
+import { useEffect } from 'react'
+import { Button } from '@/components/ui/button'
+
+export default function DashboardError({
+  error,
+  reset,
+}: {
+  error: Error & { digest?: string }
+  reset: () => void
+}) {
+  useEffect(() => {
+    console.error('[dashboard] Unhandled error:', error)
+  }, [error])
+
+  return (
+    <div className="flex flex-col items-center justify-center min-h-[50vh] gap-4">
+      <h2 className="text-xl font-semibold">Nagot gick fel</h2>
+      <p className="text-muted-foreground text-sm max-w-md text-center">
+        Ett oväntat fel uppstod. Försök igen eller kontakta support om problemet
+        kvarstår.
+      </p>
+      <Button onClick={reset}>Försök igen</Button>
+    </div>
+  )
+}

app/(dashboard)/loading.tsx

@@ -0,0 +1,9 @@
+export default function DashboardLoading() {
+  return (
+    <div className="space-y-6 animate-pulse">
+      <div className="h-8 bg-muted rounded w-48" />
+      <div className="h-4 bg-muted rounded w-96" />
+      <div className="h-64 bg-muted rounded" />
+    </div>
+  )
+}

app/api/bookkeeping/journal-entries/[id]/reverse/__tests__/route.test.ts

@@ -12,6 +12,10 @@ vi.mock('@/lib/supabase/server', () => ({
   createClient: () => mockCreateClient(),
 }))
 
+vi.mock('@/lib/init', () => ({
+  ensureInitialized: vi.fn(),
+}))
+
 const mockReverseEntry = vi.fn()
 vi.mock('@/lib/bookkeeping/engine', () => ({
   reverseEntry: (...args: unknown[]) => mockReverseEntry(...args),

app/api/bookkeeping/journal-entries/[id]/reverse/route.ts

@@ -1,6 +1,9 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { reverseEntry } from '@/lib/bookkeeping/engine'
+import { ensureInitialized } from '@/lib/init'
+
+ensureInitialized()
 
 export async function POST(
   request: Request,

app/api/deadlines/status/cron/route.ts

@@ -14,7 +14,7 @@ export async function GET(request: Request) {
   const authHeader = request.headers.get('authorization')
   const cronSecret = process.env.CRON_SECRET
 
-  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+  if (!cronSecret || authHeader !== `Bearer ${cronSecret}`) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 

app/api/documents/verify/cron/route.ts

@@ -16,7 +16,7 @@ export async function GET(request: Request) {
   const authHeader = request.headers.get('authorization')
   const cronSecret = process.env.CRON_SECRET
 
-  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+  if (!cronSecret || authHeader !== `Bearer ${cronSecret}`) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 

app/api/extensions/enable-banking/sync/cron/route.ts

@@ -21,7 +21,7 @@ export async function GET(request: Request) {
   const authHeader = request.headers.get('authorization')
   const cronSecret = process.env.CRON_SECRET
 
-  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+  if (!cronSecret || authHeader !== `Bearer ${cronSecret}`) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 

app/api/extensions/push-notifications/cron/route.ts

@@ -22,7 +22,7 @@ export async function GET(request: Request) {
   const authHeader = request.headers.get('authorization')
   const cronSecret = process.env.CRON_SECRET
 
-  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+  if (!cronSecret || authHeader !== `Bearer ${cronSecret}`) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 

app/api/invoices/[id]/mark-paid/__tests__/route.test.ts

@@ -13,6 +13,10 @@ vi.mock('@/lib/supabase/server', () => ({
   createClient: () => Promise.resolve(mockSupabase),
 }))
 
+vi.mock('@/lib/init', () => ({
+  ensureInitialized: vi.fn(),
+}))
+
 const mockCreateInvoicePaymentJournalEntry = vi.fn()
 const mockCreateInvoiceCashEntry = vi.fn()
 vi.mock('@/lib/bookkeeping/invoice-entries', () => ({

app/api/invoices/[id]/mark-paid/route.ts

@@ -5,8 +5,11 @@ import {
   createInvoiceCashEntry,
 } from '@/lib/bookkeeping/invoice-entries'
 import { MarkInvoicePaidSchema } from '@/lib/api/schemas'
+import { ensureInitialized } from '@/lib/init'
 import type { EntityType, Invoice } from '@/types'
 
+ensureInitialized()
+
 /**
  * POST /api/invoices/[id]/mark-paid
  *

app/api/invoices/[id]/mark-sent/route.ts

@@ -1,8 +1,11 @@
 import { createClient } from '@/lib/supabase/server'
 import { NextResponse } from 'next/server'
 import { createInvoiceJournalEntry } from '@/lib/bookkeeping/invoice-entries'
+import { ensureInitialized } from '@/lib/init'
 import type { EntityType, Invoice } from '@/types'
 
+ensureInitialized()
+
 /**
  * POST /api/invoices/[id]/mark-sent
  *

app/api/tax-deadlines/cron/route.ts

@@ -14,7 +14,7 @@ export async function GET(request: Request) {
   const authHeader = request.headers.get('authorization')
   const cronSecret = process.env.CRON_SECRET
 
-  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+  if (!cronSecret || authHeader !== `Bearer ${cronSecret}`) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
 

app/api/transactions/[id]/categorize/route.ts

@@ -201,7 +201,7 @@ export async function POST(
   if (is_business && body.account_override) {
     // Validate the account exists in the user's chart of accounts
     const { data: accountExists } = await supabase
-      .from('accounts')
+      .from('chart_of_accounts')
       .select('account_number, account_class')
       .eq('user_id', user.id)
       .eq('account_number', body.account_override)

lib/bookkeeping/engine.ts

@@ -394,14 +394,23 @@ export async function reverseEntry(
     throw new Error(`Failed to post reversal entry: ${postError.message}`)
   }
 
-  // Mark original as reversed with reversed_by_id link
-  await supabase
+  // Mark original as reversed with reversed_by_id link (CAS guard: only if still 'posted')
+  const { data: updatedOriginal, error: casError } = await supabase
     .from('journal_entries')
     .update({
       status: 'reversed',
       reversed_by_id: reversalEntry.id,
     })
     .eq('id', entryId)
+    .eq('status', 'posted')
+    .select('id')
+
+  if (casError || !updatedOriginal || updatedOriginal.length === 0) {
+    // Another concurrent reversal already changed the status — roll back our reversal
+    await supabase.from('journal_entry_lines').delete().eq('journal_entry_id', reversalEntry.id)
+    await supabase.from('journal_entries').delete().eq('id', reversalEntry.id)
+    throw new Error('Entry was already reversed by a concurrent operation')
+  }
 
   // Fetch complete reversal entry with lines
   const { data: completeEntry } = await supabase

lib/init.ts

@@ -46,7 +46,7 @@ function validateEnvironment(): void {
   }
 
   if (missingExt.length > 0) {
-    throw new Error(`Missing required extension environment variables: ${missingExt.join(', ')}`)
+    log.warn(`Missing extension environment variables (extensions needing them may not work): ${missingExt.join(', ')}`)
   }
 
   for (const v of OPTIONAL_VARS) {
@@ -64,10 +64,11 @@ function validateEnvironment(): void {
  */
 export function ensureInitialized(): void {
   if (initialized) return
-  initialized = true
 
   validateEnvironment()
   setContextFactory(createExtensionContext)
   registerSupplierInvoiceHandler()
   loadExtensions()
+
+  initialized = true
 }