MattssonandClaude Opus 4.8
241959513b
* feat(api): test-mode API keys force dry-run on the v1 REST API A key created with mode='test' (prefix gnubok_sk_test_) binds to the real company, but the v1 wrapper forces dry_run on every write so nothing is persisted or sent. Mutations on endpoints that can't be simulated (dryRunSupported=false or unregistered) are refused with 403 TEST_KEY_WRITE_BLOCKED — fail-closed. Reads pass through unchanged and every test-key response carries X-Gnubok-Mode: test. Live keys are unaffected (mode defaults to 'live'). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(invoices): company default "Vår referens" + per-line sales-account override Add company_settings.default_our_reference (settings form, schema, type); the invoice editor pre-fills our_reference from it on new invoices only, never overwriting an edited draft. Separately, add an optional per-line försäljningskonto (class-3) override in the editor — left blank, the engine still derives the revenue account from the VAT rate, and reverse-charge/export lines ignore the override. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(invoices): render a Swish payment QR on invoice PDFs Build the Swish "Type C" QR payload offline (no Swish API call) and embed it as a PNG in the invoice PDF payment box when Swish display is enabled, the invoice is in SEK, and the amount is positive. Also surface the invoice number in the payment box. Wired through every PDF render path: send, mark-sent and pdf routes (both legacy and v1), the recurring-schedule sender, and the staged-send commit. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bookkeeping): draft exclusion + correction-chain collapse on verifikationslista Extend list_fiscal_period_entries_with_related with two opt-in params: p_exclude_draft (keep drafts off the committed list — they get their own surface) and p_collapse_corrections (render a correction group as the single live correction, hiding the mechanical storno and the reversed original). Both default false; nothing is deleted, every voucher keeps its number, and a "show all" toggle exposes the full chain. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(reports): link multi-year SIE periods so resultatrapport shows the prior year SIE import now sets fiscal_periods.previous_period_id in both directions when creating a period, so multi-year files chain correctly regardless of #RAR order. A backfill migration repairs periods imported before this (idempotent; only touches NULL links on first-of-month periods). generateResultatrapport falls back to the date-adjacent prior period when the chain is still null, so the comparison column works for legacy data too. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(articles): hide the VAT field for non-momsregistrerade companies The article form reads company_settings.vat_registered and, when false, hides the moms field and forces vat_rate to 0 on submit — mirroring the invoice editor so a non-VAT-registered company never sets a rate it can't charge. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(import): allow file-based imports in the sandbox Bank-file, CSV/Excel and SIE imports run entirely on uploaded data with no external service, so they're now reachable in the sandbox. Only the API-backed options that need live third-party credentials (PSD2 bank connection, provider migration) stay disabled. Updates the sandbox notice copy to match. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bookkeeping): add edit draft functionality for journal entries * feat(database): add default "Vår referens" column to company_settings for invoicing * fix(tests): set SHOW_SWISH_ON_INVOICE to false in PDF template mocks * @ fix(payments): use roundOre for Swish amount formatting Replace naive Math.round(x*100)/100 with roundOre from @/lib/money to satisfy the antipattern guard. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> @ --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
81 lines
3.4 KiB
TypeScript
81 lines
3.4 KiB
TypeScript
/**
|
|
* /llms.txt — agent-discoverable index of the Accounted API.
|
|
*
|
|
* Convention adopted by Stripe, Anthropic, and other agent-facing platforms:
|
|
* a plain-text Markdown file at the doc root that points LLM crawlers and
|
|
* IDE agents (Cursor, Claude Code, Windsurf) at the canonical resources
|
|
* they need. Cheaper than scraping HTML.
|
|
*/
|
|
|
|
import { NextResponse } from 'next/server'
|
|
import { API_V1_VERSION } from '@/lib/api/v1/version'
|
|
import { withPublicSecurityHeaders } from '@/lib/api/v1/security-headers'
|
|
import { getCanonicalBaseUrl } from '@/lib/api/v1/base-url'
|
|
|
|
export async function GET(_request: Request) {
|
|
const base = getCanonicalBaseUrl()
|
|
|
|
const body = `# Accounted API
|
|
|
|
> Swedish double-entry bookkeeping as a public REST API. API version ${API_V1_VERSION}.
|
|
|
|
This API lets agents and integrations do anything the Accounted dashboard can do —
|
|
read transactions, create invoices, mark them paid, run VAT reports, file year-end
|
|
declarations, ingest SIE files, and subscribe to webhooks for state changes.
|
|
|
|
## Quickstart
|
|
|
|
1. Create an API key in the Accounted dashboard at /settings/api.
|
|
2. Authenticate with \`Authorization: Bearer gnubok_sk_<live|test>_<random>\`.
|
|
3. List companies the key can access: \`GET ${base}/api/v1/companies\`.
|
|
4. Use the returned \`id\` as \`{companyId}\` in subsequent paths.
|
|
|
|
## Core principles
|
|
|
|
- **Dry-run on every write.** Add \`?dry_run=true\` or \`X-Dry-Run: true\` to any
|
|
POST/PATCH/DELETE to preview the effect (journal lines, voucher number,
|
|
account deltas) without committing. The same call without dry-run commits.
|
|
- **Idempotency-Key on every write.** Pass a UUID in \`Idempotency-Key\`; replays
|
|
return the cached response (24h TTL) with \`Idempotent-Replayed: true\`.
|
|
- **Test mode.** Create a key with mode \`test\` (prefix \`gnubok_sk_test_\`) in the
|
|
dashboard. A test key forces \`dry_run\` on every write against your real company —
|
|
you get a realistic 200 + preview of what *would* happen, but nothing is ever
|
|
saved or sent. Reads return real data; responses carry \`X-Gnubok-Mode: test\`.
|
|
Writes on endpoints that can't be simulated are refused (403
|
|
\`TEST_KEY_WRITE_BLOCKED\`). It's \`?dry_run=true\` baked into the credential, so
|
|
you can develop safely before switching to a live key.
|
|
- **Compliance pre-flight.** \`GET /api/v1/companies/{id}/compliance/check?type=…\`
|
|
returns structured findings (voucher gaps, locked-period violations, VAT close
|
|
blockers, missing receipts) before you submit.
|
|
|
|
## Resources
|
|
|
|
- OpenAPI 3.1 spec: ${base}/api/v1/openapi.json
|
|
- Skills catalogue: ${base}/.well-known/skills/index.json
|
|
- Health check: ${base}/api/v1/health
|
|
- Docs (cookbook + reference): ${base}/docs/api
|
|
- Error reference: ${base}/docs/api/errors
|
|
- Security disclosure policy: ${base}/SECURITY.md (responsible disclosure to security@arcim.io)
|
|
|
|
## Schema discovery
|
|
|
|
Every \`.md\` URL under /docs/api is served as plain Markdown so agents can
|
|
ingest it without HTML parsing.
|
|
|
|
## Versioning
|
|
|
|
The URL major version is \`/api/v1/\`. Within v1, the response shape is pinned to
|
|
\`${API_V1_VERSION}\`. Future breaking changes inside v1 will accept an optional
|
|
\`Gnubok-Version: YYYY-MM-DD\` header for opt-in upgrades; older versions keep
|
|
working until explicitly retired.
|
|
`
|
|
|
|
return new NextResponse(body, {
|
|
status: 200,
|
|
headers: withPublicSecurityHeaders({
|
|
'Content-Type': 'text/markdown; charset=utf-8',
|
|
'Cache-Control': 'public, max-age=300, s-maxage=300',
|
|
}),
|
|
})
|
|
}
|