refactor: clean up codebase, remove dead code and obsolete docs

Remove influencer-era documentation, unused components, boilerplate
assets, and ghost tiktok cron job. Add supplier invoice management,
document API routes, and PWA icons. Replace boilerplate README.

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>

app/api/documents/[id]/link/route.ts

@@ -0,0 +1,55 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { linkToJournalEntry } from '@/lib/core/documents/document-service'
+
+ensureInitialized()
+
+/**
+ * POST /api/documents/:id/link
+ * Link a document to a journal entry (verifikation)
+ *
+ * Request body:
+ * - journal_entry_id: string (required)
+ * - journal_entry_line_id: string (optional)
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { id } = await params
+
+  try {
+    const body = await request.json()
+
+    if (!body.journal_entry_id) {
+      return NextResponse.json(
+        { error: 'journal_entry_id is required' },
+        { status: 400 }
+      )
+    }
+
+    const document = await linkToJournalEntry(
+      user.id,
+      id,
+      body.journal_entry_id,
+      body.journal_entry_line_id
+    )
+
+    return NextResponse.json({ data: document })
+  } catch (error) {
+    console.error('[documents/link/POST] Link failed:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Link failed' },
+      { status: 500 }
+    )
+  }
+}

app/api/documents/[id]/route.ts

@@ -0,0 +1,55 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+
+ensureInitialized()
+
+/**
+ * GET /api/documents/:id
+ * Fetch document metadata + signed download URL (60 min expiry)
+ */
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { id } = await params
+
+  // Fetch document record
+  const { data: doc, error: docError } = await supabase
+    .from('document_attachments')
+    .select('*')
+    .eq('id', id)
+    .eq('user_id', user.id)
+    .single()
+
+  if (docError || !doc) {
+    return NextResponse.json({ error: 'Document not found' }, { status: 404 })
+  }
+
+  // Create signed download URL (60 minutes)
+  const { data: signedUrl, error: signError } = await supabase.storage
+    .from('documents')
+    .createSignedUrl(doc.storage_path, 3600)
+
+  if (signError) {
+    return NextResponse.json(
+      { error: `Failed to create download URL: ${signError.message}` },
+      { status: 500 }
+    )
+  }
+
+  return NextResponse.json({
+    data: {
+      ...doc,
+      download_url: signedUrl.signedUrl,
+    },
+  })
+}

app/api/documents/[id]/verify/route.ts

@@ -0,0 +1,37 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { verifyIntegrity } from '@/lib/core/documents/document-service'
+
+ensureInitialized()
+
+/**
+ * POST /api/documents/:id/verify
+ * Verify document integrity by re-computing SHA-256 and comparing
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { id } = await params
+
+  try {
+    const result = await verifyIntegrity(user.id, id)
+
+    return NextResponse.json({ data: result })
+  } catch (error) {
+    console.error('[documents/verify/POST] Verification failed:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Verification failed' },
+      { status: 500 }
+    )
+  }
+}

app/api/documents/[id]/versions/route.ts

@@ -0,0 +1,101 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { createNewVersion } from '@/lib/core/documents/document-service'
+
+ensureInitialized()
+
+/**
+ * POST /api/documents/:id/versions
+ * Create a new version of an existing document (atomic via RPC)
+ *
+ * Accepts multipart/form-data with:
+ * - file: The new version file
+ */
+export async function POST(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { id } = await params
+
+  try {
+    const formData = await request.formData()
+    const file = formData.get('file') as File | null
+
+    if (!file) {
+      return NextResponse.json({ error: 'No file provided' }, { status: 400 })
+    }
+
+    const buffer = await file.arrayBuffer()
+
+    const newVersion = await createNewVersion(user.id, id, {
+      name: file.name,
+      buffer,
+      type: file.type,
+    })
+
+    return NextResponse.json({ data: newVersion })
+  } catch (error) {
+    console.error('[documents/versions/POST] Version creation failed:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Version creation failed' },
+      { status: 500 }
+    )
+  }
+}
+
+/**
+ * GET /api/documents/:id/versions
+ * List all versions in the document chain
+ */
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> }
+) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { id } = await params
+
+  // First, check if the document belongs to the user
+  const { data: doc, error: docError } = await supabase
+    .from('document_attachments')
+    .select('id, original_id')
+    .eq('id', id)
+    .eq('user_id', user.id)
+    .single()
+
+  if (docError || !doc) {
+    return NextResponse.json({ error: 'Document not found' }, { status: 404 })
+  }
+
+  // The root document is either the original_id or the document itself
+  const rootId = doc.original_id || doc.id
+
+  // Fetch all versions in the chain
+  const { data: versions, error: versionsError } = await supabase
+    .from('document_attachments')
+    .select('*')
+    .eq('user_id', user.id)
+    .or(`id.eq.${rootId},original_id.eq.${rootId}`)
+    .order('version', { ascending: true })
+
+  if (versionsError) {
+    return NextResponse.json({ error: versionsError.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ data: versions })
+}

app/api/documents/route.ts

@@ -0,0 +1,108 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { uploadDocument } from '@/lib/core/documents/document-service'
+
+ensureInitialized()
+
+/**
+ * POST /api/documents
+ * Upload a document to the WORM archive
+ *
+ * Accepts multipart/form-data with:
+ * - file: The document file
+ * - upload_source (optional): 'camera' | 'file_upload' | 'email' | ...
+ * - journal_entry_id (optional): Link to a journal entry
+ * - journal_entry_line_id (optional): Link to a journal entry line
+ */
+export async function POST(request: Request) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  try {
+    const formData = await request.formData()
+    const file = formData.get('file') as File | null
+
+    if (!file) {
+      return NextResponse.json({ error: 'No file provided' }, { status: 400 })
+    }
+
+    const uploadSource = (formData.get('upload_source') as string) || 'file_upload'
+    const journalEntryId = formData.get('journal_entry_id') as string | null
+    const journalEntryLineId = formData.get('journal_entry_line_id') as string | null
+
+    const buffer = await file.arrayBuffer()
+
+    const document = await uploadDocument(user.id, {
+      name: file.name,
+      buffer,
+      type: file.type,
+    }, {
+      upload_source: uploadSource as import('@/types').DocumentUploadSource,
+      journal_entry_id: journalEntryId || undefined,
+      journal_entry_line_id: journalEntryLineId || undefined,
+    })
+
+    return NextResponse.json({ data: document })
+  } catch (error) {
+    console.error('[documents/POST] Upload failed:', error)
+    return NextResponse.json(
+      { error: error instanceof Error ? error.message : 'Upload failed' },
+      { status: 500 }
+    )
+  }
+}
+
+/**
+ * GET /api/documents
+ * List documents with optional filtering
+ *
+ * Query params:
+ * - journal_entry_id: Filter by journal entry
+ * - current_only: If 'true', only return current versions (default: true)
+ * - limit: Number of results (default: 50)
+ * - offset: Pagination offset (default: 0)
+ */
+export async function GET(request: Request) {
+  const supabase = await createClient()
+
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const { searchParams } = new URL(request.url)
+  const journalEntryId = searchParams.get('journal_entry_id')
+  const currentOnly = searchParams.get('current_only') !== 'false'
+  const limit = parseInt(searchParams.get('limit') || '50')
+  const offset = parseInt(searchParams.get('offset') || '0')
+
+  let query = supabase
+    .from('document_attachments')
+    .select('*', { count: 'exact' })
+    .eq('user_id', user.id)
+    .order('created_at', { ascending: false })
+    .range(offset, offset + limit - 1)
+
+  if (journalEntryId) {
+    query = query.eq('journal_entry_id', journalEntryId)
+  }
+
+  if (currentOnly) {
+    query = query.eq('is_current_version', true)
+  }
+
+  const { data, error, count } = await query
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ data, count })
+}

app/api/documents/verify/cron/route.ts

@@ -0,0 +1,117 @@
+import { createClient } from '@supabase/supabase-js'
+import { NextResponse } from 'next/server'
+
+/**
+ * GET /api/documents/verify/cron
+ * Batch integrity verification of WORM document archive
+ *
+ * Runs weekly (Sunday 03:00 UTC / 05:00 Swedish time).
+ * Processes up to 100 documents per run, prioritizing
+ * documents never checked or least recently checked.
+ *
+ * Uses service role for cross-user verification (RLS bypass).
+ */
+export async function GET(request: Request) {
+  // Verify cron secret
+  const authHeader = request.headers.get('authorization')
+  const cronSecret = process.env.CRON_SECRET
+
+  if (cronSecret && authHeader !== `Bearer ${cronSecret}`) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const supabaseUrl = process.env.NEXT_PUBLIC_SUPABASE_URL
+  const supabaseServiceKey = process.env.SUPABASE_SERVICE_ROLE_KEY
+
+  if (!supabaseUrl || !supabaseServiceKey) {
+    return NextResponse.json(
+      { error: 'Missing Supabase configuration' },
+      { status: 500 }
+    )
+  }
+
+  const supabase = createClient(supabaseUrl, supabaseServiceKey)
+
+  // Fetch up to 100 current-version documents, prioritizing unchecked/oldest
+  const { data: documents, error: fetchError } = await supabase
+    .from('document_attachments')
+    .select('id, user_id, storage_path, sha256_hash, file_name')
+    .eq('is_current_version', true)
+    .order('last_integrity_check_at', { ascending: true, nullsFirst: true })
+    .limit(100)
+
+  if (fetchError) {
+    console.error('[doc-verify-cron] Failed to fetch documents:', fetchError)
+    return NextResponse.json({ error: 'Failed to fetch documents' }, { status: 500 })
+  }
+
+  if (!documents || documents.length === 0) {
+    return NextResponse.json({ message: 'No documents to verify', processed: 0 })
+  }
+
+  let verified = 0
+  let failures = 0
+  let errors = 0
+
+  for (const doc of documents) {
+    try {
+      // Download file from storage
+      const { data: fileData, error: downloadError } = await supabase.storage
+        .from('documents')
+        .download(doc.storage_path)
+
+      if (downloadError || !fileData) {
+        console.error(`[doc-verify-cron] Download failed for ${doc.id}:`, downloadError)
+        errors++
+        continue
+      }
+
+      // Compute SHA-256 hash
+      const buffer = await fileData.arrayBuffer()
+      const hashBuffer = await crypto.subtle.digest('SHA-256', buffer)
+      const hashArray = Array.from(new Uint8Array(hashBuffer))
+      const computedHash = hashArray.map((b) => b.toString(16).padStart(2, '0')).join('')
+
+      const isValid = computedHash === doc.sha256_hash
+
+      // Update last_integrity_check_at
+      await supabase
+        .from('document_attachments')
+        .update({ last_integrity_check_at: new Date().toISOString() })
+        .eq('id', doc.id)
+
+      if (!isValid) {
+        // Log integrity failure to audit_log
+        await supabase.from('audit_log').insert({
+          user_id: doc.user_id,
+          action: 'INTEGRITY_FAILURE',
+          table_name: 'document_attachments',
+          record_id: doc.id,
+          description: `Integrity check failed for document "${doc.file_name}": stored hash ${doc.sha256_hash}, computed hash ${computedHash}`,
+          old_state: { sha256_hash: doc.sha256_hash },
+          new_state: { computed_hash: computedHash },
+        })
+
+        console.error(`[doc-verify-cron] INTEGRITY FAILURE: document ${doc.id} (${doc.file_name})`)
+        failures++
+      } else {
+        verified++
+      }
+    } catch (error) {
+      console.error(`[doc-verify-cron] Error verifying document ${doc.id}:`, error)
+      errors++
+      // Continue with other documents
+    }
+  }
+
+  console.log(
+    `[doc-verify-cron] Processed ${documents.length}: ${verified} verified, ${failures} failures, ${errors} errors`
+  )
+
+  return NextResponse.json({
+    processed: documents.length,
+    verified,
+    failures,
+    errors,
+  })
+}