* feat(voucher): add create voucher and correct entry previews; update commit methods
* feat: add support for pending operations in API key scopes and OAuth client management
- Introduced new API key scopes for reading and approving pending operations.
- Updated the scope groups to include pending operations.
- Added new tools for listing and managing pending operations.
- Implemented OAuth client registration and revocation endpoints.
- Created a UI panel for managing OAuth clients, including registration and revocation.
- Added tests for pending operations tools and OAuth allowlist functionality.
- Implemented a database migration for OAuth client registrations with appropriate policies and constraints.
* feat: Implement OAuth client registration rate limiting and enhance security measures
- Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks.
- Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained.
- Updated error responses to be uniform across different types of redirect URI validation failures.
- Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided.
- Improved handling of high-risk pending operations, requiring explicit confirmation for approvals.
- Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail.
- Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
* feat: add recurring invoice scheduling functionality
- Implemented recurring invoice schedules with a new database schema.
- Created API routes for managing recurring invoices (GET and POST).
- Added cron job to automatically generate invoices based on schedules.
- Developed service functions for computing next run dates and executing schedules.
- Added tests for the new functionality, including validation and success cases.
- Introduced error handling for various scenarios in the invoice creation process.
* feat: refine VAT rate validation and enhance recurring invoice handling
* feat(branding): implement dynamic branding in service worker and reports
* refactor(service-worker): remove push notification handling code
* feat(service-worker): implement dynamic branding in service worker and related scripts
- Replace magic-link-only login with email+password (primary) and magic link (toggle)
- Add registration page with strong password validation
- Add MFA enrollment (/mfa/enroll) with QR code and manual secret
- Add MFA verification (/mfa/verify) with 6-digit TOTP input
- Add password reset flow (/reset-password)
- Add middleware MFA enforcement gated by NEXT_PUBLIC_REQUIRE_MFA env var
- Self-hosted deployments (NEXT_PUBLIC_SELF_HOSTED=true) skip MFA entirely
- Add Security tab in Settings for password change and MFA management
- Add requireAuth() API route helper with MFA check
- Update CLAUDE.md with Authentication section and env var docs
- Update Dockerfile and docker-entrypoint.sh for new env var placeholders
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
- Add setup.sh interactive script for guided .env configuration
- Add env var validation and placeholder detection to docker-entrypoint.sh
- Fix migration count (52 → 63) in SELF-HOSTING.md
- Align Docker image name to ghcr.io/erp-mafia/gnubok in docker-compose.yml
- Update README and SELF-HOSTING.md to reference setup.sh
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Multi-stage Dockerfile (Node 22 Alpine), docker-compose for self-hosted
and hosted deployments, CI workflow for GHCR publishing, runtime env var
substitution, and cron sidecar with supercronic.
Aligns hosted extension preset with dev config (enable-banking,
ai-categorization, ai-chat, email).
Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
Mattsson