Files
accounted/app/(dashboard)/assets/page.tsx
T
MattssonandClaude Opus 4.7 32d9978f1b Fix/chrome pdf preview csp (#572)
* feat: add option to exclude year-end closing entries in SIE export and related reports

* delete docs

* fix: allow Chrome's PDF viewer in verifikat document preview

The /api/documents/:id/inline route shipped with
`object-src 'none'` in its CSP, which blocked Chrome's built-in PDF
viewer (it renders inline PDFs via an internal <embed>). Users on
Chrome saw "Det här innehållet har blockerats" when expanding a PDF
attachment in the bookkeeping view; Firefox (PDF.js) and Edge (own
viewer) were unaffected, and JPGs worked because <img> isn't subject
to object-src.

Drops the CSP for this route to the minimum needed for embeddability:
`frame-ancestors 'self'`. X-Content-Type-Options: nosniff plus the
fixed Content-Type from the handler already block MIME confusion;
X-Frame-Options: SAMEORIGIN + frame-ancestors still block clickjacking.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(auth): add webmail deep link to email confirmation screens

Mirrors Stripe's signup UX: after asking the user to verify their email,
detect their webmail provider from the domain and show a button that
opens the inbox in a new tab. Gmail gets a from:<sender> search
pre-populated; Outlook/Yahoo/iCloud/Proton open the inbox directly.
Unknown / custom domains fall back to the existing copy.

Sender address is configurable via NEXT_PUBLIC_BRANDING_AUTH_EMAIL_FROM
(default noreply@gnubok.se) so white-label installs can match their
Supabase Auth SMTP config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(auth): unblock first-time password set for BankID users with MFA

Supabase rejects updateUser({password}) and mfa.unenroll with "AAL2 session
is required" whenever a TOTP factor is enrolled. BankID magic-link logins
produce AAL1, and middleware skips MFA enforcement for bankid_linked users,
so they had no path to AAL2 — leaving them unable to set a backup password
or disable MFA without going through the email-recovery escape hatch.

- /api/account/password: branch on app_metadata.has_password. First-time set
  writes via service.auth.admin.updateUserById (no existing credential to
  protect, AAL2 guard does not apply). Change-password keeps the user-session
  updateUser so AAL2 still fires for credential rotation.
- /mfa/verify: accept a safeReturnTo query param and route there after
  successful verify, so step-up flows can land back where they came from.
- SecuritySettings: detect the AAL2 error from both change-password and
  mfa.unenroll and redirect through /mfa/verify?returnTo=/settings/account
  instead of toasting a dead-end error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add tests and rounding utility for öre precision in bokslut calculations

- Implemented `roundOre` function for rounding SEK amounts to two decimal places, ensuring consistent monetary calculations.
- Introduced `ORE_TOLERANCE` constant for comparing rounded amounts, facilitating invariant checks in financial entries.
- Created comprehensive tests for `roundOre`, covering typical cases, edge cases, and idempotency.
- Added year-end invariants tests to verify database-level guarantees for closing entries, ensuring they balance to the öre and reject discrepancies.
- Developed end-to-end tests for the dispositions chain, validating the correctness of calculations across various scenarios.

* fix: update PDF rendering to remove Swish QR code generation and set default to disable Swish visibility

* fix: enhance security by rejecting data URIs in safeReturnTo function tests

* fix: improve rounding logic in roundOre function and add customer_type migration

* fix: add customer_type column to customers and enforce CHECK constraint

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 22:29:41 +02:00

173 lines
5.9 KiB
TypeScript

'use client'
import { useCallback, useEffect, useState } from 'react'
import Link from 'next/link'
import { useTranslations } from 'next-intl'
import { Card, CardContent } from '@/components/ui/card'
import { Button } from '@/components/ui/button'
import { Badge } from '@/components/ui/badge'
import { PageHeader } from '@/components/ui/page-header'
import { EmptyState } from '@/components/ui/empty-state'
import { Skeleton } from '@/components/ui/skeleton'
import { Package, Plus } from 'lucide-react'
import {
Table,
TableBody,
TableCell,
TableHead,
TableHeader,
TableRow,
} from '@/components/ui/table'
import { formatCurrency, formatDate } from '@/lib/utils'
import type { Asset, AssetCategory } from '@/types'
import { CreateAssetDialog } from '@/components/bookkeeping/assets/CreateAssetDialog'
const CATEGORY_LABEL_KEYS: Record<AssetCategory, string> = {
immaterial: 'category_immaterial',
building: 'category_building',
land_improvement: 'category_land_improvement',
machinery: 'category_machinery',
equipment: 'category_equipment',
vehicle: 'category_vehicle',
computer: 'category_computer',
other_tangible: 'category_other_tangible',
}
export default function AssetsPage() {
const t = useTranslations('assets')
const [assets, setAssets] = useState<Asset[] | null>(null)
const [error, setError] = useState<string | null>(null)
const [dialogOpen, setDialogOpen] = useState(false)
const [reloadKey, setReloadKey] = useState(0)
useEffect(() => {
let cancelled = false
fetch('/api/assets')
.then(async (res) => {
if (cancelled) return
if (!res.ok) {
setError(t('load_failed'))
return
}
const { data } = (await res.json()) as { data: Asset[] }
if (cancelled) return
setError(null)
setAssets(data)
})
.catch(() => {
if (!cancelled) setError(t('load_failed'))
})
return () => {
cancelled = true
}
}, [reloadKey, t])
const handleCreated = useCallback(() => {
setDialogOpen(false)
setReloadKey((k) => k + 1)
}, [])
return (
<div className="space-y-8">
<PageHeader
title={t('title')}
action={
<Button onClick={() => setDialogOpen(true)}>
<Plus className="mr-1 h-4 w-4" /> {t('new_asset')}
</Button>
}
/>
{assets === null && !error && (
<Card>
<CardContent className="p-6 space-y-2">
<Skeleton className="h-6 w-1/3" />
<Skeleton className="h-4 w-full" />
</CardContent>
</Card>
)}
{error && (
<Card>
<CardContent className="p-6 text-destructive">{error}</CardContent>
</Card>
)}
{assets !== null && assets.length === 0 && (
<EmptyState
icon={Package}
title={t('empty_title')}
description={t('empty_description')}
actionLabel={t('new_asset')}
onAction={() => setDialogOpen(true)}
/>
)}
{assets !== null && assets.length > 0 && (
<Card>
<CardContent className="p-0">
<Table>
<TableHeader>
<TableRow>
<TableHead>{t('th_name')}</TableHead>
<TableHead>{t('th_category')}</TableHead>
<TableHead>{t('th_acquired')}</TableHead>
<TableHead className="text-right">{t('th_acquisition_cost')}</TableHead>
<TableHead>{t('th_useful_life')}</TableHead>
<TableHead>{t('th_status')}</TableHead>
<TableHead className="text-right">{t('th_actions')}</TableHead>
</TableRow>
</TableHeader>
<TableBody>
{assets.map((asset) => {
const years = Math.round(asset.useful_life_months / 12)
return (
<TableRow key={asset.id}>
<TableCell className="font-medium">{asset.name}</TableCell>
<TableCell className="text-sm">{t(CATEGORY_LABEL_KEYS[asset.category])}</TableCell>
<TableCell className="tabular-nums">
{formatDate(asset.acquisition_date)}
</TableCell>
<TableCell className="text-right tabular-nums">
{formatCurrency(Number(asset.acquisition_cost))}
</TableCell>
<TableCell className="text-sm">
{t('useful_life_format', { years, months: asset.useful_life_months })}
</TableCell>
<TableCell>
{asset.disposed_at ? (
<div className="flex flex-col gap-1">
<Badge variant="secondary">{t('status_disposed')}</Badge>
<span className="text-xs text-muted-foreground tabular-nums">
{formatDate(asset.disposed_at)}
</span>
</div>
) : (
<Badge variant="success">{t('status_active')}</Badge>
)}
</TableCell>
<TableCell className="text-right">
{!asset.disposed_at && (
<Link href={`/assets/${asset.id}/dispose`}>
<Button variant="ghost" size="sm">
{t('action_dispose')}
</Button>
</Link>
)}
</TableCell>
</TableRow>
)
})}
</TableBody>
</Table>
</CardContent>
</Card>
)}
<CreateAssetDialog open={dialogOpen} onOpenChange={setDialogOpen} onCreated={handleCreated} />
</div>
)
}