admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
0b86901a2b4d67b8f290dba465a7f2869459174a
accounted/scripts/checks/antipatterns-baseline.json
T
Jakob WennbergandClaude Opus 4.8 0b86901a2b Enforce MFA on critical mutation routes + post-audit foundation (A1) (#646) 
* feat(lib): add canonical money + format + fetch primitives (audit Tier 0)

Foundation for post-audit cleanup: shared primitives so subsequent refactors import one helper instead of reinventing (the duplication the audit found).

- lib/money.ts: canonical roundOre/ORE_TOLERANCE (+ equalOre/isZeroOre/sumOre); lib/bokslut/rounding.ts re-exports for back-compat
- lib/utils.ts: formatAmount, formatWholeKr, formatDateTime
- lib/hooks/use-fetch.ts: generic client fetch hook (abort, bilingual errors, refetch)
- components/common/DataState.tsx: loading/error/empty wrapper over Skeleton/EmptyState
- messages: common.retry / common.load_error (sv+en)
- tests: 16 tests incl. the 1.005 half-ore case and locale-robust format assertions

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* ci(guards): ratchet against new MFA-bypassing routes and naive ore-rounding

Adds scripts/checks/no-new-antipatterns.mjs + committed baseline. Fails CI only when a PR ADDS a route hand-rolling supabase.auth.getUser() (which skips MFA AAL2 enforcement) or a new Math.round(x*100)/100. Baseline: 178 raw-auth routes, 668 naive rounds — ratchets down as the A1 (route-auth) and D1 (rounding) migrations land. Wired into core-build.yml; green at baseline.

Note: scripts/ is gitignored (.gitignore:70 '/scripts') yet tracks 39 files via force-add; these two were force-added to match that existing pattern.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(api,errors): enforce MFA on journal-entry mutation routes via withRouteContext (A1)

Migrates the 4 journal-entry mutation routes (commit, correct, reverse, recordate) off hand-rolled supabase.auth.getUser() onto withRouteContext, which enforces MFA AAL2 (requireAuth) + non-viewer role (requireWrite) and routes thrown errors through the canonical errorResponse envelope. Fixes audit finding A1 for the most compliance-critical mutations and folds in C8 for these routes (drops bookkeepingErrorResponse; they now emit message_en).

Also fixes a latent bug: errorResponse()/extractBookkeepingDetails only handled 11 of 15 typed bookkeeping errors, so MeaninglessCorrection / NoOpenPeriodForDate / TargetPeriodClosed / TargetPeriodLocked silently degraded to a generic 500 (affecting existing v1 callers too). Adds the 4 missing registry codes + extract cases -> correct 400/409.

Behavior change: untyped engine throws now return the canonical 500 envelope instead of 400+raw-string; typed errors keep their status (verified against the registry). Tests updated to the realistic typed-error contract + a 403 write-gate test on commit. Updates .claude/rules/api-routes.md to prescribe withRouteContext. Ratchets the antipattern guard 178 -> 174. Full unit suite green (5023); tsc: no new errors.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(api): enforce MFA on salary run authorization routes via withRouteContext (A1)

Migrates the salary-run lifecycle write routes (approve, paid, revert) — the highest-PII A1 surface — off hand-rolled supabase.auth.getUser() onto withRouteContext (enforces MFA AAL2 + non-viewer role). Explicit { error } returns are preserved unchanged (passed through the wrapper); only auth changes, so no error-shape regression. Salary unit suite green (8). Ratchets the antipattern guard 174 -> 171.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* review: address PR #646 bot findings

- guard: match withRouteContext/requireAuth at the CALL site (withRouteContext[<(]), not a bare import — closes the false-negative greptile flagged. It surfaced app/api/sandbox/seed (hand-rolled getUser; the loose regex had matched a code comment). Switched that route to requireAuth() — the documented stopgap for routes that can't use withRouteContext (it runs before a company exists; anonymous users, so MFA is a no-op but the auth path is now consistent). Guard stays at 171.
- money.test: add the negative half-ore case roundOre(-1.005) === -1 to lock the rounding direction against regressions.
- use-fetch: document keep-previous-data + deferred-loading (effect-tick) semantics.
- structured-errors: drop the BFL 5 kap. 5 § citation from MEANINGLESS_CORRECTION per the swedish-compliance bot (5 § governs correction procedure, not the no-op precondition).

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* review: enrich wrapper error logging + document sandbox GDPR controls (PR #646)

- with-route-context: log unhandled errors and route errorResponse through the resolved { userId, companyId } logger, not just { requestId, operation } — closes the OWASP V16 audit-trail finding for all 82+ routes using the wrapper. Documented in the JSDoc.
- sandbox/seed: document the GDPR Art.32 compensating controls for the anonymous write path (anonymous-only, /24 rate limit, synthetic demo data, own-company RLS scope). No functional change — the flagged behaviour is pre-existing by design; this records the reasoning inline.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-03 15:34:58 +02:00

183 lines
9.0 KiB
JSON
Raw Blame History

{
"_comment": "Ratchet baseline for scripts/checks/no-new-antipatterns.mjs. These counts may only decrease. Re-run with --update after a migration lowers them. Goal: both reach 0 (A1 route-auth campaign, D1 rounding codemod).",
"rawRouteAuth": {
"count": 171,
"files": [
"app/api/account/delete/route.ts",
"app/api/account/password/route.ts",
"app/api/agent/composer/route.ts",
"app/api/agent/conversations/[id]/route.ts",
"app/api/agent/conversations/route.ts",
"app/api/agent/invoke/route.ts",
"app/api/agent/memory/[id]/route.ts",
"app/api/agent/memory/route.ts",
"app/api/agent/onboarding/stream/route.ts",
"app/api/agent/profile/route.ts",
"app/api/agent/profile/verify/route.ts",
"app/api/agent/skills/route.ts",
"app/api/audit-trail/route.ts",
"app/api/bookkeeping/account-balances/route.ts",
"app/api/bookkeeping/account-totals/route.ts",
"app/api/bookkeeping/accounts/[number]/route.ts",
"app/api/bookkeeping/accounts/activate/route.ts",
"app/api/bookkeeping/accounts/bas-lookup/route.ts",
"app/api/bookkeeping/accounts/reference/route.ts",
"app/api/bookkeeping/accounts/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/close/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/entry-count/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/route.ts",
"app/api/bookkeeping/fiscal-periods/period-status/route.ts",
"app/api/bookkeeping/fiscal-periods/route.ts",
"app/api/bookkeeping/journal-entries/[id]/chain/route.ts",
"app/api/bookkeeping/journal-entries/[id]/no-document-required/route.ts",
"app/api/bookkeeping/journal-entries/[id]/notes/route.ts",
"app/api/bookkeeping/journal-entries/[id]/route.ts",
"app/api/bookkeeping/journal-entries/route.ts",
"app/api/bookkeeping/mapping-rules/evaluate/route.ts",
"app/api/bookkeeping/mapping-rules/route.ts",
"app/api/bookkeeping/no-doc-required/route.ts",
"app/api/bookkeeping/voucher-gaps/route.ts",
"app/api/calendar/feed/route.ts",
"app/api/cash-accounts/route.ts",
"app/api/company/check-org-number/route.ts",
"app/api/company/current/route.ts",
"app/api/company/members/[id]/route.ts",
"app/api/company/members/invite/[id]/route.ts",
"app/api/company/members/invite/route.ts",
"app/api/company/members/route.ts",
"app/api/company/route.ts",
"app/api/currency/rate/route.ts",
"app/api/deadlines/[id]/complete/route.ts",
"app/api/deadlines/[id]/route.ts",
"app/api/deadlines/[id]/status/route.ts",
"app/api/deadlines/route.ts",
"app/api/documents/[id]/extraction-status/route.ts",
"app/api/documents/[id]/route.ts",
"app/api/documents/[id]/verify/route.ts",
"app/api/documents/[id]/versions/route.ts",
"app/api/documents/counts/route.ts",
"app/api/events/route.ts",
"app/api/extensions/[sector]/[slug]/data/route.ts",
"app/api/extensions/[sector]/[slug]/settings/route.ts",
"app/api/extensions/ext/[...path]/route.ts",
"app/api/extensions/skatteverket/skattekonto/drift/route.ts",
"app/api/import/sie/[id]/route.ts",
"app/api/import/sie/create-accounts/route.ts",
"app/api/import/sie/mappings/route.ts",
"app/api/import/sie/route.ts",
"app/api/invoices/[id]/convert/route.ts",
"app/api/invoices/[id]/mark-sent/route.ts",
"app/api/invoices/[id]/pdf/route.ts",
"app/api/invoices/[id]/route.ts",
"app/api/invoices/preview-pdf/route.ts",
"app/api/kpi/preferences/route.ts",
"app/api/mcp-oauth/authorize/route.ts",
"app/api/pending-operations/[id]/commit/route.ts",
"app/api/pending-operations/[id]/reject/route.ts",
"app/api/pending-operations/[id]/route.ts",
"app/api/pending-operations/bulk-commit/route.ts",
"app/api/pending-operations/route.ts",
"app/api/reconciliation/bank/link/route.ts",
"app/api/reconciliation/bank/mark-opening-balance/route.ts",
"app/api/reconciliation/bank/run/route.ts",
"app/api/reconciliation/bank/status/route.ts",
"app/api/reconciliation/bank/unlink/route.ts",
"app/api/reconciliation/bank/unmatched-entries/route.ts",
"app/api/reports/ar-ledger/customer/[customerId]/invoices/route.ts",
"app/api/reports/ar-ledger/route.ts",
"app/api/reports/ar-ledger/xlsx/route.ts",
"app/api/reports/audit-trail/route.ts",
"app/api/reports/avgifter-basis/route.ts",
"app/api/reports/balance-sheet/pdf/route.ts",
"app/api/reports/balance-sheet/xlsx/route.ts",
"app/api/reports/balansrapport/pdf/route.ts",
"app/api/reports/balansrapport/route.ts",
"app/api/reports/balansrapport/xlsx/route.ts",
"app/api/reports/continuity-check/route.ts",
"app/api/reports/full-archive/route.ts",
"app/api/reports/general-ledger/xlsx/route.ts",
"app/api/reports/income-statement/pdf/route.ts",
"app/api/reports/income-statement/xlsx/route.ts",
"app/api/reports/journal-register/route.ts",
"app/api/reports/journal-register/xlsx/route.ts",
"app/api/reports/kassaflodesanalys/pdf/route.ts",
"app/api/reports/kassaflodesanalys/route.ts",
"app/api/reports/kpi/route.ts",
"app/api/reports/kpi/xlsx/route.ts",
"app/api/reports/monthly-breakdown/route.ts",
"app/api/reports/monthly-breakdown/xlsx/route.ts",
"app/api/reports/resultatrapport/pdf/route.ts",
"app/api/reports/resultatrapport/route.ts",
"app/api/reports/resultatrapport/xlsx/route.ts",
"app/api/reports/salary-journal/route.ts",
"app/api/reports/salary-journal/xlsx/route.ts",
"app/api/reports/supplier-ledger/route.ts",
"app/api/reports/supplier-ledger/supplier/[supplierId]/invoices/route.ts",
"app/api/reports/supplier-ledger/xlsx/route.ts",
"app/api/reports/trial-balance/account/[accountNumber]/sources/route.ts",
"app/api/reports/trial-balance/route.ts",
"app/api/reports/trial-balance/xlsx/route.ts",
"app/api/reports/vacation-liability/route.ts",
"app/api/reports/vat-declaration/ruta/[ruta]/sources/route.ts",
"app/api/reports/vat-declaration/xlsx/route.ts",
"app/api/salary/employees/[id]/absence/route.ts",
"app/api/salary/employees/[id]/benefits/[benefitId]/route.ts",
"app/api/salary/employees/[id]/benefits/route.ts",
"app/api/salary/employees/[id]/route.ts",
"app/api/salary/employees/[id]/worked-hours/batch/route.ts",
"app/api/salary/employees/[id]/worked-hours/route.ts",
"app/api/salary/employees/route.ts",
"app/api/salary/ku/[year]/route.ts",
"app/api/salary/payroll-config/[year]/route.ts",
"app/api/salary/runs/[id]/agi/submit/route.ts",
"app/api/salary/runs/[id]/agi/xml/route.ts",
"app/api/salary/runs/[id]/correct/route.ts",
"app/api/salary/runs/[id]/employees/[employeeId]/route.ts",
"app/api/salary/runs/[id]/employees/route.ts",
"app/api/salary/runs/[id]/lines/[lineId]/route.ts",
"app/api/salary/runs/[id]/lines/route.ts",
"app/api/salary/runs/[id]/payment/bg-lb/route.ts",
"app/api/salary/runs/[id]/payment/pain001/route.ts",
"app/api/salary/runs/[id]/payslips/[employeeId]/pdf/route.ts",
"app/api/salary/runs/[id]/payslips/send/route.ts",
"app/api/salary/runs/[id]/preview/route.ts",
"app/api/salary/runs/[id]/review/route.ts",
"app/api/salary/runs/[id]/route.ts",
"app/api/salary/tax-tables/lookup/route.ts",
"app/api/salary/tax-tables/status/route.ts",
"app/api/settings/api-keys/[id]/route.ts",
"app/api/settings/booking-templates/[id]/route.ts",
"app/api/settings/booking-templates/[id]/touch/route.ts",
"app/api/settings/booking-templates/export/route.ts",
"app/api/settings/booking-templates/import/route.ts",
"app/api/settings/booking-templates/route.ts",
"app/api/settings/counterparty-templates/route.ts",
"app/api/settings/logo/route.ts",
"app/api/settings/oauth-clients/[id]/route.ts",
"app/api/settings/oauth-clients/route.ts",
"app/api/settings/route.ts",
"app/api/skatteverket/tax-payments/[period]/mark-paid/route.ts",
"app/api/skatteverket/tax-payments/[period]/payment-file/route.ts",
"app/api/skatteverket/tax-payments/[period]/route.ts",
"app/api/supplier-invoices/[id]/route.ts",
"app/api/supplier-invoices/[id]/uncredit/route.ts",
"app/api/support/contact/route.ts",
"app/api/tax-deadlines/generate/route.ts",
"app/api/team/accept/route.ts",
"app/api/team/members/route.ts",
"app/api/transactions/[id]/attach-document/route.ts",
"app/api/transactions/[id]/book/route.ts",
"app/api/transactions/[id]/ignore/route.ts",
"app/api/transactions/[id]/uncategorize/route.ts",
"app/api/transactions/batch-match-invoices/route.ts",
"app/api/transactions/create-from-document/route.ts",
"app/api/transactions/route.ts",
"app/api/transactions/suggest-categories/route.ts",
"app/api/vat/validate/route.ts"
]
},
"naiveOreRound": {
"count": 668
}
}
Reference in New Issue View Git Blame Copy Permalink