feat: MCP server, API keys, OAuth, and KPI dashboard (#72)

* fix: prevent Chrome auto-translate from crashing React during onboarding Chrome auto-translate modifies DOM text nodes when it detects a Swedish page (lang="sv") in a browser set to English. React does not expect external DOM mutations and throws, crashing the entire component tree into global-error.tsx on every step transition. Add translate="no" and <meta name="google" content="notranslate"> to suppress browser translation. Also fix timezone-unsafe date parsing in fiscal period validation (new Date("YYYY-MM-DD") + getDate() returns local-timezone values, shifting dates by -1 day in Western timezones). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add notranslate meta tag to global-error.tsx for consistency Per review feedback — global-error.tsx renders its own <html> document, so it needs the same <meta name="google" content="notranslate"> tag as layout.tsx to fully suppress Chrome translation on error pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add MCP server extension with OAuth, API keys, and KPI dashboard Let users do bookkeeping through Claude Desktop, Claude Code, or any MCP-compatible client. "Show my uncategorized transactions." "Book that as office supplies." "Invoice Acme for 15,000 kr." MCP server (extension): - 10 tools: transactions, categorization, customers, invoices, trial balance, VAT report, KPI report, income statement - JSON-RPC 2.0 protocol (no SDK dependency, works in serverless) - Tool annotations, pagination, input validation per MCP best practices - Same engine as web UI (VAT rules, exchange rates, event emission) API key infrastructure (core): - api_keys table with RLS, rate limiting (100 RPM), scopes column - Atomic rate limit via DB RPC (validate_and_increment_api_key) - Key management API routes + settings UI panel OAuth 2.1 for Claude Desktop connectors: - .well-known/oauth-protected-resource + oauth-authorization-server - Authorization endpoint with consent page - Token endpoint with PKCE verification - Stateless encrypted auth codes (AES-256-GCM, no DB storage) - Dynamic client registration KPI dashboard: - /nyckeltal page with hero cards, operational grid, trend chart - GET /api/reports/kpi endpoint - Gross margin, cash position, expense ratio, avg payment days, VAT liability, revenue/expense trend Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OAuth security vulnerabilities from code review Critical fixes: - Auth code replay: Track used codes in oauth_used_codes table with unique constraint. Codes are single-use per OAuth 2.1 §4.1.2. - Open redirect: Validate redirect_uri against hardcoded allowlist of known Claude callback URLs + localhost for dev. P1 fixes: - Move API key creation from /authorize to /token endpoint. Keys are only created after PKCE verification, preventing orphaned keys on abandoned OAuth flows. - Add ensureInitialized() to MCP server so event handlers load and transaction.categorized events reach extensions. P2 fixes: - Remove 'plain' from PKCE methods — only S256 is advertised and accepted. - Fix extension count in sectors test (10 → 11 for mcp-server). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: remove duplicate ensureInitialized() that caused circular import The extension router (ext/[...path]/route.ts) already calls ensureInitialized() before dispatching to handlers. The duplicate call in server.ts created a circular import that Turbopack couldn't resolve, breaking the Vercel build. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 12:57:14 +01:00
parent 2b75ef6538
commit 5d66dd6bfc
41 changed files with 6742 additions and 4 deletions
@@ -0,0 +1,31 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+
+/**
+ * DELETE /api/settings/api-keys/[id] — Revoke an API key (soft delete)
+ */
+export async function DELETE(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+  const { id } = await params
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { error } = await supabase
+    .from('api_keys')
+    .update({ revoked_at: new Date().toISOString() })
+    .eq('id', id)
+    .eq('user_id', user.id)
+    .is('revoked_at', null)
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ success: true })
+}
@@ -0,0 +1,89 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { generateApiKey, hashApiKey } from '@/lib/auth/api-keys'
+
+/**
+ * GET /api/settings/api-keys — List user's API keys (never exposes the key itself)
+ */
+export async function GET() {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { data, error } = await supabase
+    .from('api_keys')
+    .select('id, key_prefix, name, scopes, rate_limit_rpm, last_used_at, revoked_at, created_at')
+    .eq('user_id', user.id)
+    .order('created_at', { ascending: false })
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ data })
+}
+
+/**
+ * POST /api/settings/api-keys — Create a new API key
+ * Returns the full key ONCE. After this, only the prefix is available.
+ */
+export async function POST(request: Request) {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  let name = 'Unnamed key'
+  try {
+    const body = await request.json()
+    if (body.name && typeof body.name === 'string') {
+      name = body.name.slice(0, 100)
+    }
+  } catch {
+    // Empty body is fine, use default name
+  }
+
+  // Limit to 10 active keys per user
+  const { count } = await supabase
+    .from('api_keys')
+    .select('id', { count: 'exact', head: true })
+    .eq('user_id', user.id)
+    .is('revoked_at', null)
+
+  if (count !== null && count >= 10) {
+    return NextResponse.json(
+      { error: 'Maximum 10 active API keys allowed' },
+      { status: 400 }
+    )
+  }
+
+  const { key, hash, prefix } = generateApiKey()
+
+  const { data, error } = await supabase
+    .from('api_keys')
+    .insert({
+      user_id: user.id,
+      key_hash: hash,
+      key_prefix: prefix,
+      name,
+    })
+    .select('id, key_prefix, name, created_at')
+    .single()
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  // Return the full key exactly once
+  return NextResponse.json({
+    data: {
+      ...data,
+      key, // Only time the full key is returned
+    },
+  })
+}