Jakob WennbergandClaude Sonnet 5
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
62 lines
2.5 KiB
TypeScript
62 lines
2.5 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { requireAuth } from '@/lib/auth/require-auth'
|
|
import { normalizeOrgNumber } from '@/lib/company-lookup/normalize-org-number'
|
|
|
|
/**
|
|
* GET /api/company/check-org-number?org_number=XXXXXXXXXX
|
|
*
|
|
* Returns `{ data: { exists: boolean, companies: { id, name }[] } }` for the
|
|
* companies the CURRENT USER already has with the given organisation number:
|
|
* scoped to their own account only.
|
|
*
|
|
* Org-number reuse across the platform is intentionally allowed (see
|
|
* lib/company/actions.ts), so this is a soft, account-scoped warning, NOT a
|
|
* uniqueness gate. It uses the normal authenticated client on purpose: the
|
|
* `companies` SELECT RLS policy limits results to companies the caller is a
|
|
* member of (id IN user_company_ids()), so it can never reveal another user's
|
|
* companies and can't be used to enumerate org numbers platform-wide.
|
|
*
|
|
* Normalizes input with the same rule as the create action so a 12-digit form
|
|
* still matches a stored 10-digit canonical. Returns no matches for malformed
|
|
* input: the create action rejects that separately as `org_number_invalid`.
|
|
*/
|
|
export async function GET(request: Request) {
|
|
// requireAuth() (not a raw getUser()) so MFA AAL2 is enforced on hosted before
|
|
// we run the account-scoped lookup. The returned client carries the caller's
|
|
// RLS context, which is what scopes the companies SELECT below.
|
|
const { supabase, error: authError } = await requireAuth()
|
|
if (authError) return authError
|
|
|
|
const url = new URL(request.url)
|
|
const raw = url.searchParams.get('org_number') ?? ''
|
|
if (!raw) {
|
|
return NextResponse.json({ error: 'org_number is required' }, { status: 400 })
|
|
}
|
|
|
|
const canonical = normalizeOrgNumber(raw)
|
|
if (!canonical) {
|
|
// Malformed input is not a duplicate of anything by definition.
|
|
return NextResponse.json({ data: { exists: false, companies: [] } })
|
|
}
|
|
|
|
// RLS scopes this SELECT to the caller's own memberships (companies_select:
|
|
// id IN user_company_ids()), so the result is inherently account-scoped.
|
|
const { data, error } = await supabase
|
|
.from('companies')
|
|
.select('id, name')
|
|
.eq('org_number', canonical)
|
|
.is('archived_at', null)
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: error.message }, { status: 500 })
|
|
}
|
|
|
|
const companies = (data ?? []).map((c: { id: string; name: string }) => ({
|
|
id: c.id,
|
|
name: c.name,
|
|
}))
|
|
return NextResponse.json({
|
|
data: { exists: companies.length > 0, companies },
|
|
})
|
|
}
|