MattssonandClaude Opus 4.8
43925bc2d3
* fix(import): SIE bulk-delete on service client + provider/reporting/banking fixes Rebuilt branch onto main as a single commit. - import: run SIE bulk-delete RPCs on the service client to escape the 8s statement_timeout; undo_sie_import now takes an explicit actor (p_user_id) so its owner/admin gate works when auth.uid() is NULL on the service client (migration 20260624120000) + pg-real regression test - providers: distinguish missing Fortnox license from expired connection; provider_consent_tokens PK regression test - reports: include unmapped BAS expense groups in the income statement - enable-banking: reconnect closed/expired bank sessions in place - bookkeeping: surface linked invoices as underlag on the verifikat view - scripts: track BL cleanup/diagnostic tooling; data files (*.csv) are git-ignored and consentId is now a required arg with no silent default Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(import): add Cache-Control header to journal entry references response --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
31 lines
1.3 KiB
TypeScript
31 lines
1.3 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
import { getJournalEntryUnderlagReferences } from '@/lib/core/bookkeeping/journal-entry-references'
|
|
|
|
/**
|
|
* GET /api/bookkeeping/journal-entries/[id]/references
|
|
*
|
|
* Resolves the verifikation's followable underlag references — the linked
|
|
* customer / supplier invoices that identify the affärshändelse. Lets the
|
|
* verifikat view make the verifieringskedja traceable from the verifikat side,
|
|
* not only from the invoice side (BFL 5 kap 7§ — hänvisning till underlag;
|
|
* BFNAR 2013:2). Read-only.
|
|
*
|
|
* An id that doesn't belong to the active company resolves to no references
|
|
* (every underlying query is company-scoped), so this neither leaks nor 404s.
|
|
*
|
|
* Marked private, no-store: the payload carries invoice numbers (financial
|
|
* data), so no shared proxy / CDN may cache it across users or companies.
|
|
*/
|
|
export const GET = withRouteContext<{ params: Promise<{ id: string }> }>(
|
|
'journal_entry.references',
|
|
async (_request, { supabase, companyId }, { params }) => {
|
|
const { id } = await params
|
|
const references = await getJournalEntryUnderlagReferences(supabase, companyId, id)
|
|
return NextResponse.json(
|
|
{ data: { references } },
|
|
{ headers: { 'Cache-Control': 'private, no-store' } },
|
|
)
|
|
},
|
|
)
|