feat: MCP server, API keys, OAuth, and KPI dashboard (#72)

* fix: prevent Chrome auto-translate from crashing React during onboarding Chrome auto-translate modifies DOM text nodes when it detects a Swedish page (lang="sv") in a browser set to English. React does not expect external DOM mutations and throws, crashing the entire component tree into global-error.tsx on every step transition. Add translate="no" and <meta name="google" content="notranslate"> to suppress browser translation. Also fix timezone-unsafe date parsing in fiscal period validation (new Date("YYYY-MM-DD") + getDate() returns local-timezone values, shifting dates by -1 day in Western timezones). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: add notranslate meta tag to global-error.tsx for consistency Per review feedback — global-error.tsx renders its own <html> document, so it needs the same <meta name="google" content="notranslate"> tag as layout.tsx to fully suppress Chrome translation on error pages. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * feat: add MCP server extension with OAuth, API keys, and KPI dashboard Let users do bookkeeping through Claude Desktop, Claude Code, or any MCP-compatible client. "Show my uncategorized transactions." "Book that as office supplies." "Invoice Acme for 15,000 kr." MCP server (extension): - 10 tools: transactions, categorization, customers, invoices, trial balance, VAT report, KPI report, income statement - JSON-RPC 2.0 protocol (no SDK dependency, works in serverless) - Tool annotations, pagination, input validation per MCP best practices - Same engine as web UI (VAT rules, exchange rates, event emission) API key infrastructure (core): - api_keys table with RLS, rate limiting (100 RPM), scopes column - Atomic rate limit via DB RPC (validate_and_increment_api_key) - Key management API routes + settings UI panel OAuth 2.1 for Claude Desktop connectors: - .well-known/oauth-protected-resource + oauth-authorization-server - Authorization endpoint with consent page - Token endpoint with PKCE verification - Stateless encrypted auth codes (AES-256-GCM, no DB storage) - Dynamic client registration KPI dashboard: - /nyckeltal page with hero cards, operational grid, trend chart - GET /api/reports/kpi endpoint - Gross margin, cash position, expense ratio, avg payment days, VAT liability, revenue/expense trend Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: address OAuth security vulnerabilities from code review Critical fixes: - Auth code replay: Track used codes in oauth_used_codes table with unique constraint. Codes are single-use per OAuth 2.1 §4.1.2. - Open redirect: Validate redirect_uri against hardcoded allowlist of known Claude callback URLs + localhost for dev. P1 fixes: - Move API key creation from /authorize to /token endpoint. Keys are only created after PKCE verification, preventing orphaned keys on abandoned OAuth flows. - Add ensureInitialized() to MCP server so event handlers load and transaction.categorized events reach extensions. P2 fixes: - Remove 'plain' from PKCE methods — only S256 is advertised and accepted. - Fix extension count in sectors test (10 → 11 for mcp-server). Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> * fix: remove duplicate ensureInitialized() that caused circular import The extension router (ext/[...path]/route.ts) already calls ensureInitialized() before dispatching to handlers. The duplicate call in server.ts created a circular import that Turbopack couldn't resolve, breaking the Vercel build. Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
2026-03-21 12:57:14 +01:00
parent 2b75ef6538
commit 5d66dd6bfc
41 changed files with 6742 additions and 4 deletions
@@ -0,0 +1,65 @@
+import crypto from 'crypto'
+import { createClient } from '@supabase/supabase-js'
+
+const KEY_PREFIX = 'gnubok_sk_'
+
+/**
+ * Create a Supabase service client that doesn't require cookies.
+ * Used for API key validation (MCP, webhooks) where there's no browser session.
+ */
+export function createServiceClientNoCookies() {
+  return createClient(
+    process.env.NEXT_PUBLIC_SUPABASE_URL!,
+    process.env.SUPABASE_SERVICE_ROLE_KEY!
+  )
+}
+
+export function generateApiKey(): { key: string; hash: string; prefix: string } {
+  const random = crypto.randomBytes(32).toString('base64url')
+  const key = `${KEY_PREFIX}${random}`
+  const hash = hashApiKey(key)
+  const prefix = key.slice(0, KEY_PREFIX.length + 8)
+  return { key, hash, prefix }
+}
+
+export function hashApiKey(key: string): string {
+  return crypto.createHash('sha256').update(key).digest('hex')
+}
+
+export function extractBearerToken(request: Request): string | null {
+  const authHeader = request.headers.get('authorization')
+  if (!authHeader?.startsWith('Bearer ')) return null
+  return authHeader.slice(7)
+}
+
+/**
+ * Validate an API key and enforce rate limiting.
+ * Uses the DB RPC for atomic check + increment.
+ * Returns the user_id on success, or an error with HTTP status.
+ */
+export async function validateApiKey(
+  key: string
+): Promise<{ userId: string } | { error: string; status: number }> {
+  if (!key.startsWith(KEY_PREFIX)) {
+    return { error: 'Invalid API key format', status: 401 }
+  }
+
+  const hash = hashApiKey(key)
+  const supabase = createServiceClientNoCookies()
+
+  const { data, error } = await supabase.rpc('validate_and_increment_api_key', {
+    p_key_hash: hash,
+  })
+
+  if (error || !data || data.length === 0) {
+    return { error: 'Invalid API key', status: 401 }
+  }
+
+  const row = data[0]
+
+  if (row.rate_limited) {
+    return { error: 'Rate limit exceeded', status: 429 }
+  }
+
+  return { userId: row.user_id }
+}
@@ -0,0 +1,90 @@
+import crypto from 'crypto'
+
+/**
+ * Stateless OAuth auth codes.
+ * The auth code is an AES-256-GCM encrypted JSON payload containing
+ * the user ID, PKCE code_challenge, and expiry.
+ *
+ * The API key is NOT embedded — it gets created at token exchange
+ * after PKCE verification, preventing orphaned keys.
+ */
+
+const ALGORITHM = 'aes-256-gcm'
+const CODE_TTL_MS = 5 * 60 * 1000 // 5 minutes
+
+function getEncryptionKey(): Buffer {
+  const secret = process.env.SUPABASE_SERVICE_ROLE_KEY
+  if (!secret) throw new Error('SUPABASE_SERVICE_ROLE_KEY is required')
+  return crypto.createHash('sha256').update(secret).digest()
+}
+
+export interface AuthCodePayload {
+  userId: string
+  codeChallenge: string
+  codeChallengeMethod: string
+  redirectUri: string
+  exp: number
+}
+
+export function createAuthCode(payload: Omit<AuthCodePayload, 'exp'>): string {
+  const data: AuthCodePayload = {
+    ...payload,
+    exp: Date.now() + CODE_TTL_MS,
+  }
+
+  const key = getEncryptionKey()
+  const iv = crypto.randomBytes(12)
+  const cipher = crypto.createCipheriv(ALGORITHM, key, iv)
+
+  const json = JSON.stringify(data)
+  const encrypted = Buffer.concat([cipher.update(json, 'utf8'), cipher.final()])
+  const tag = cipher.getAuthTag()
+
+  const combined = Buffer.concat([iv, tag, encrypted])
+  return combined.toString('base64url')
+}
+
+export function decryptAuthCode(code: string): AuthCodePayload | null {
+  try {
+    const key = getEncryptionKey()
+    const combined = Buffer.from(code, 'base64url')
+
+    const iv = combined.subarray(0, 12)
+    const tag = combined.subarray(12, 28)
+    const encrypted = combined.subarray(28)
+
+    const decipher = crypto.createDecipheriv(ALGORITHM, key, iv)
+    decipher.setAuthTag(tag)
+
+    const decrypted = Buffer.concat([decipher.update(encrypted), decipher.final()])
+    const payload: AuthCodePayload = JSON.parse(decrypted.toString('utf8'))
+
+    if (Date.now() > payload.exp) return null
+
+    return payload
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Verify PKCE: SHA256(code_verifier) must equal the stored code_challenge.
+ * Only S256 is supported (plain is insecure and not advertised).
+ */
+export function verifyPkce(
+  codeVerifier: string,
+  codeChallenge: string
+): boolean {
+  const hash = crypto
+    .createHash('sha256')
+    .update(codeVerifier)
+    .digest('base64url')
+  return hash === codeChallenge
+}
+
+/**
+ * Hash an auth code for replay tracking.
+ */
+export function hashAuthCode(code: string): string {
+  return crypto.createHash('sha256').update(code).digest('hex')
+}