* fix(documents): RFC 5987 Content-Disposition so NFD filenames stop crashing inline view
macOS/iOS uploads carry NFD-decomposed filenames (base letter + combining
diaeresis U+0308, char code 776). undici Headers require ByteString values
(every code unit <= 0xFF), so splicing the raw filename into the
Content-Disposition header threw while building the response and the
inline document route 500ed. 122 prod documents across 35 companies hit
this; last crash 2026-07-09T16:17.
Add lib/api/content-disposition.ts emitting the RFC 6266 dual form:
an ASCII quoted fallback (NFC-normalize, then replace anything outside
printable ASCII plus quote and backslash with _) and
filename*=UTF-8''<percent-encoded> per RFC 5987 (encodeURIComponent on
the NFC name, additionally escaping ! ' ( ) * which it leaves bare).
Use it in the inline document route and in the two latent same-shape
sites that embed raw employee names in payslip PDF headers.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(api): sanitize lone surrogates before percent-encoding Content-Disposition (CodeRabbit)
Unpaired UTF-16 surrogates survive normalize('NFC') and make encodeURIComponent throw a URIError, so replace them with U+FFFD via String.prototype.toWellFormed() before encoding so the helper always returns a valid header value.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Em dashes (—) and en dashes (–) had spread across comments, docs, tests,
and a few UI strings, reading as AI-generated boilerplate rather than
house style. Replaced each with punctuation matching its context: colon
for explanatory clauses, comma for asides, plain hyphen for numeric/legal
ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for
paired-dash asides. messages/en.json and messages/sv.json were fixed by
hand together to keep sv/en in sync.
Left untouched where the dash is the functional subject rather than
decorative punctuation: date-range-parser.ts's separator regex,
charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE
encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the
agent system-prompt files that already instruct against em dashes, and
a golden iXBRL test fixture compared byte-for-byte.
Also fixes two bugs surfaced along the way: an off-by-one in
ApiKeysPanel's scope-label split (a leftover from an earlier partial
pass), and a charset-repair test that had lost the literal en-dash it
exists to verify.
Regenerated the agent atom seed migration (skills:generate) since 27
SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes,
with an explicit carve-out for the functional-dash cases above.
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
* fix(dashboard): exclude credit notes from unpaid invoices widget
Credit notes (status='sent', negative total) were summed into the
"Att få betalt" widget, producing confusing negative totals like
"2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL,
matching the existing pattern in reminder-processor and the AR ledger.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(documents): harden PDF preview and upload validation
- JournalEntryAttachments: switch inline PDF preview from <iframe> to
<object type="application/pdf">. Mirrors the AttachmentPreviewSheet
fix from #572 — Chrome's frame pipeline intermittently surfaced
"Det här innehållet har blockerats" on iframes even with permissive
CSP. <object> invokes the PDF plugin directly. crbug.com/271452.
- /api/documents/:id/inline: resolve Content-Type via file extension
when mime_type is null or application/octet-stream. Legacy uploads
landed with empty File.type from some drag sources; combined with
the new X-Content-Type-Options: nosniff header on this route,
Chrome refused to render valid PDFs. Extension fallback covers
every legacy row without a DB backfill.
- /api/documents POST: surface DB-trigger period-lock errors as a
400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously
every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 /
"Filen kunde inte sparas") which hid the real cause from users
attaching to verifikationer in closed/locked fiscal periods.
- document-service: add validateDocumentMagicBytes() that inspects
the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates
a leading UTF-8 BOM). Wired into uploadDocument() and
createNewVersion() so every upload path is protected — UI, MCP,
and future email/webhook ingestion. Defends against agents that
send a base64-encoded text placeholder instead of real binary
bytes via the gnubok_upload_document MCP tool, which produced
tiny (15-561 byte) "PDFs" that failed to render in Chrome and
in external viewers.
Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal
Five compliance gaps fixed in the K2 and K3 noter builders:
- Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB
anskaffningsvärde, tillkommande, avgående, UB and accumulated
avskrivningar movement (was only emitting avskrivningstider).
- Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §.
- Ställda säkerheter and Eventualförpliktelser as separate notes per
ÅRL 5:14-15 § (K2 previously combined them).
- Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8.
Replaces medelantal anställda — the old query filtered employees by an
is_active column that doesn't exist, so the note never emitted. Now
uses an FTE-weighted day-based average per ÅRL 5:20 §.
Six disclosure fields persist on arsredovisning_narratives as per-period
overrides; the UI extends the existing förvaltningsberättelse editor
with a "Lagstadgade upplysningar" subsection sharing the same Spara
button — no new pages, no settings changes.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(invoices): respect vat_registered=false and hide personnummer for B2C
- PDF address block no longer prints org_number for individual customers
(GDPR data minimization; ML 17 kap 24§ requires name + address only).
- Wire company_settings.vat_registered through the rule helpers, invoice
creation API, preview-pdf API, and the new-invoice form so a non-VAT-
registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses
the empty "Moms 0%" row and shows a dedicated "Företaget är inte
momsregistrerat" notice instead of the ML 3 kap. exempt notice.
- Engine unchanged: 'exempt' treatment already routes to 3004/3100 and
skips VAT lines.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(settings): remove approval rules from sidebar and routes
* fix(invoices): ensure vat_registered defaults to true for invoice previews and API
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* Fixed user issues
* feat: add personal_number column to customers for individual identification
* feat: add personal_number field to makeCustomer function for enhanced customer identification
* feat: add personal_number column with constraint check for customer identification
Mattsson