MattssonandClaude Fable 5 024420d655 fix(auth): exempt allowlisted emails from home-domain brand-host bounce (#2077) ...

A signup-allowlisted partner owner (brand_signup_allowlist) could sign up
on an invite-only brand domain but was then exiled to the canonical domain
by the middleware home-domain affinity rule before any team membership
existed: the layout-level exemption in resolveBrandDomainBounce was
unreachable because the middleware redirect runs first. Rule 2 now checks
the allowlist (fail-closed) and lets those sessions stay, caching the
verdict like other home verdicts. Found via the Ziffr owner lockout.


Claude-Session: https://claude.ai/code/session_011eQDGWLppyy6BZ6Rx6shjd

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

2026-08-31 13:44:31 +02:00

..

__tests__

feat(auth): base available login methods off GoTrue providers (#1869)

2026-08-31 09:13:39 +01:00

agent

fix(agent): chat console keeps its thread across turns and reloads (#1859)

2026-08-24 16:37:30 +02:00

agent-context

feat(inbox): promote a single prominent amount into the editable total (#2073)

2026-08-31 11:40:30 +02:00

agent-panel

fix(agent): chat console keeps its thread across turns and reloads (#1859)

2026-08-24 16:37:30 +02:00

ai

fix(invoice-inbox): read whole PDFs (last-page slice + truncation retry) (#2014)

2026-08-28 18:57:02 +02:00

analytics

fix(selfhost): stop NEXT_PUBLIC_* flags being constant-folded out of the Docker build (#1656)

2026-08-19 19:52:31 +02:00

api

feat(transactions): steer private marking in locked periods to ignore, with v1 and MCP ignore verbs (#1661) (#2031)

2026-08-31 08:39:04 +01:00

articles

feat(articles): filter the article register by currency (#1229)

2026-07-27 14:39:13 +02:00

auth

feat(auth): base available login methods off GoTrue providers (#1869)

2026-08-31 09:13:39 +01:00

bankgiro

Add/api and invoice (#911)

2026-07-07 01:14:59 +02:00

bokslut

fix(pdf): keep the minus sign on losses in standard-font PDFs (#1982) (#1987)

2026-08-30 11:22:05 +02:00

bookkeeping

fix(invoices): ROT/RUT kontantmetoden invoices could not be marked paid (#2040)

2026-08-30 15:12:37 +02:00

branding

feat(white-label): invite-only signup for brand domains (#1995)

2026-08-27 18:32:52 +02:00

browser

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

byra

feat(white-label): byra white-label infrastructure: brands, cockpit, home domains, branded email (#1956)

2026-08-26 16:56:39 +02:00

calendar

feat(calendar): enable calendar sync for Viktiga datum (#1853)

2026-08-24 16:32:44 +02:00

cash-accounts

fix(cash-accounts): rebind movable transactions when remapping a PSD2 ledger (#2023)

2026-08-30 11:23:15 +02:00

clients

feat(white-label): byra white-label infrastructure: brands, cockpit, home domains, branded email (#1956)

2026-08-26 16:56:39 +02:00

company

feat(settings): per-company data-analysis opt-in gating the calibration corpus (#1346) (#2007)

2026-08-28 17:38:36 +02:00

company-lookup

feat(invariants): shared format contracts + upgrade-path CI (#1364)

2026-08-03 16:30:14 +02:00

core

feat(inbox): direct-to-storage upload for files over the hosted body limit (#1551) (#2030)

2026-08-30 11:55:42 +02:00

currency

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

customers

fix(customers): personnummer via MCP lands in personal_number, masked everywhere; MCP payment terms follow settings (#1788)

2026-08-21 18:32:17 +02:00

dashboard

perf(layout): dashboard layout in two waves, nav flags as one RPC, local JWT verification (#1946)

2026-08-26 15:14:49 +02:00

deadlines

feat(deadlines): gate F-skatt reminders on debited preliminary tax + durable dismissal (#1057)

2026-07-17 15:48:25 +02:00

docs

feat(transactions): steer private marking in locked periods to ignore, with v1 and MCP ignore verbs (#1661) (#2031)

2026-08-31 08:39:04 +01:00

documents

feat(inbox): match non-invoice documents via prominent amounts (#2048)

2026-08-30 23:52:29 +02:00

domains

fix: block staging backend on production white-label hosts (#1903)

2026-08-25 19:55:53 +02:00

email

fix(auth): email-change recovery re-send and confirmation feedback (#2034)

2026-08-30 20:21:16 +02:00

entitlements

feat(white-label): byra white-label infrastructure: brands, cockpit, home domains, branded email (#1956)

2026-08-26 16:56:39 +02:00

env

fix(selfhost): stop NEXT_PUBLIC_* flags being constant-folded out of the Docker build (#1656)

2026-08-19 19:52:31 +02:00

errors

feat(arcim-migration): import the Fortnox asset register during migration (#1999)

2026-08-31 09:25:55 +01:00

events

feat(mcp): make search-only read tools reachable, and put the payload ceiling into reverse (#1976)

2026-08-27 17:45:40 +02:00

export

feat(import/export): article import + register export (xlsx/csv) (#750)

2026-06-17 14:38:44 +02:00

extensions

feat(email): SMTP mailer behind the EmailService seam (EMAIL_PROVIDER=smtp); Resend stays the hosted default (#1746)

2026-08-30 11:54:47 +02:00

hooks

feat(ai): job-shaped AI service with OpenAI-compatible backend, extraction-first; stop extracting every inbox document twice (#1740)

2026-08-20 19:39:08 +02:00

http

Fix/critical issues (#351)

2026-04-22 18:14:01 +02:00

import

feat(periods): undo klarmarkera so an externally closed year can be reopened (#1978)

2026-08-27 14:34:02 +02:00

invariants

fix(payroll): normalize KU10 organisation numbers (#1583)

2026-08-13 15:39:49 +02:00

invoices

fix(reminders): settings UI discloses that automatic sending is disabled (#2033)

2026-08-30 21:43:19 +02:00

mail-search

fix(mail): stop Gmail refusing the search, and stop calling that "hittade inget" (#1521)

2026-08-11 14:23:58 +02:00

mileage

feat(mileage): suggest driving distance from the from/to addresses (#1778)

2026-08-21 12:19:35 +02:00

navigation

feat(ui): prev/next record navigation on detail pages (#1530)

2026-08-12 21:07:57 +02:00

notices

perf(hem): stream the home page in three sections and trim its query plan (#1945)

2026-08-26 14:02:09 +02:00

notifications

feat(skatteverket): repair notification recipients + make the agent the SKV notification surface (#1887)

2026-08-25 12:09:20 +02:00

observability

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

onboarding

feat(onboarding): activation quick wins on the Hem checklist (#1461)

2026-08-08 15:14:34 +02:00

onboarding-journey

feat(onboarding): the branch question becomes its own journey step (#1615)

2026-08-14 12:25:23 +02:00

packs

fix(bookkeeping): drop non-standard account 2012, book EF F-skatt on 2013 (#1409) (#1489)

2026-08-10 14:04:08 +02:00

payments

fix(payments): make supplier payment batch creation atomic via create_supplier_payment_batch RPC (#1989)

2026-08-27 22:24:36 +02:00

pdf

fix(pdf): keep the minus sign on losses in standard-font PDFs (#1982) (#1987)

2026-08-30 11:22:05 +02:00

pending-operations

feat(transactions): steer private marking in locked periods to ignore, with v1 and MCP ignore verbs (#1661) (#2031)

2026-08-31 08:39:04 +01:00

processing-history

fix(inbox): booked items no longer strand in Att gora as matched-forever (#1547)

2026-08-13 00:49:20 +02:00

providers

feat(fortnox): make scope-approval flags overridable via env for self-hosted apps (#2069)

2026-08-31 09:27:31 +01:00

rate-limits

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

receipt-hunt

feat(inbox): promote a single prominent amount into the editable total (#2073)

2026-08-31 11:40:30 +02:00

reconciliation

feat(reconciliation): match one bank event to several verifikationer (1:N) (#1553) (#2029)

2026-08-30 11:56:15 +02:00

reference-data

feat(booking-templates): per-company opt-in hiding of system templates (#2004)

2026-08-28 12:12:47 +02:00

reports

fix(pdf): keep the minus sign on losses in standard-font PDFs (#1982) (#1987)

2026-08-30 11:22:05 +02:00

salary

feat(salary): update_salary_run MCP tool and editable draft payment date (#2041)

2026-08-30 21:43:23 +02:00

sandbox

feat(sandbox): call the sandbox assistant Assistenten, not Anna (#1244)

2026-07-28 18:55:16 +02:00

skatteverket

fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed (#1888)

2026-08-25 14:25:00 +02:00

stripe

feat(shopify): Shopify order/refund feed into the transactions inbox (#1474)

2026-08-09 12:44:08 +02:00

supabase

fix(auth): exempt allowlisted emails from home-domain brand-host bounce (#2077)

2026-08-31 13:44:31 +02:00

supplier-invoices

feat(supplier-invoices): dokument-forst editor rebuild (prototype shell + 4 flow optimizations) (#1653)

2026-08-18 09:50:48 +02:00

suppliers

fix(inbox): match suppliers on VAT number, not just org-nr and name (#1630)

2026-08-17 14:52:50 +02:00

support

feat(support): attach images and PDFs to the in-app contact form

2026-08-26 12:32:29 +02:00

tax

fix(mcp): use canonical VAT deadlines (#1679)

2026-08-18 17:22:52 +02:00

theme

feat: add theme palettes (#1326)

2026-08-01 16:02:12 +02:00

transactions

fix(inbox): name the FK in the underlag lock-state embed so locked items classify (#1548) (#2022)

2026-08-31 10:16:21 +01:00

ui-state

feat(ui): shared migration primitives (UI migration PR 3) (#1122)

2026-07-23 21:29:36 +02:00

vat

fix(webshop-orders): shared effective-rate helper and order-context refusal for the rate-0 slot (#1912) (#2008)

2026-08-28 17:22:38 +02:00

webhooks

fix(api): register the v1 stamp endpoint scope and derive the webhook event catalogue from one source (#1930)

2026-08-26 13:34:27 +02:00

webshop-orders

feat(woo): selectable revenue accounts per VAT rate in the bulk order sweep (#1908)

2026-08-25 21:04:06 +02:00

worklist

perf(hem): stream the home page in three sections and trim its query plan (#1945)

2026-08-26 14:02:09 +02:00

concurrency.ts

fix(ux): smoothness follow-ups - detail pages, batches, toasts, and the last edges (#1633)

2026-08-17 14:30:25 +02:00

init.ts

feat(peppol): Qvalia access-point adapter, send flow and delivery webhook (#1780)

2026-08-21 12:45:11 +02:00

logger.ts

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

money.ts

fix(salary): declare, book and pay AGI in whole kronor (SKV per-sats computation) (#1611)

2026-08-14 02:22:07 +02:00

support.ts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

utils.ts

feat(auth): base available login methods off GoTrue providers (#1869)

2026-08-31 09:13:39 +01:00