Jakob WennbergandClaude Sonnet 5
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
3.9 KiB
3.9 KiB
paths
| paths | |
|---|---|
|
API Route Pattern
Use the /erp-api-route skill when scaffolding new endpoints.
Default: wrap every cookie-session route in withRouteContext (lib/api/with-route-context.ts). It is the only path that enforces MFA (AAL2) on hosted: it calls requireAuth(), resolves the active companyId, optionally gates non-viewer role (requireWrite: true), and converts thrown errors into the canonical envelope. Never hand-roll supabase.auth.getUser() in a route: that skips MFA. CI enforces this via the ratchet guard (npm run check:guards); a new route calling getUser() directly fails the build.
import { NextResponse } from 'next/server'
import { ensureInitialized } from '@/lib/init'
import { withRouteContext } from '@/lib/api/with-route-context'
import { validateBody } from '@/lib/api/validate'
import { MySchema } from '@/lib/api/schemas'
ensureInitialized() // Module-level: loads extensions for event emission
// Dynamic route: pass the params type as the generic.
export const POST = withRouteContext<{ params: Promise<{ id: string }> }>(
'resource.action',
async (request, { supabase, companyId, user, log }, { params }) => {
const { id } = await params
const validation = await validateBody(request, MySchema)
if (!validation.success) return validation.response
// Business logic... always filter by company_id (defense in depth alongside RLS).
// Throw typed domain errors (e.g. lib/bookkeeping/errors): the wrapper maps
// them to the right status + canonical { error: { code, message, message_en } }.
return NextResponse.json({ data: result })
},
{ requireWrite: true }, // omit for read-only routes
)
- Dynamic route params:
{ params }: { params: Promise<{ id: string }> }(Next.js 16, params are async). WithwithRouteContext, pass that shape as the generic and destructureparamsfrom the 3rd handler arg. - Response shapes:
{ data }for success; failures are the canonical{ error: { code, message, message_en?, requestId? } }envelope (thrown errors →errorResponse). Don't hand-build{ error: 'string' }. - Zod schemas in
lib/api/schemas.ts: 100+ schemas with shared primitives (uuid, isoDate, accountNumber, nonNegativeAmount). - Routes that emit events must call
ensureInitialized()at module level. - Opt out of
withRouteContextonly when the route genuinely can't guarantee a company context (e.g. onboarding): then callrequireAuth()directly so MFA is still enforced. - API-key auth (
/api/v1/*) usescreateServiceClientNoCookies()+v1ErrorResponse; every query still filters bycompany_id.
Endpoint map (app/api/)
/api/bookkeeping/*: accounts, fiscal periods, journal entries (CRUD/reverse/correct), mapping rules, voucher gaps/api/invoices/*,/api/supplier-invoices/*: CRUD + state transitions/api/transactions/*: categorize, describe, book, match-{invoice,supplier-invoice}, batch, AI suggestions/api/customers/*,/api/suppliers/*: CRUD/api/documents/*: CRUD, versions, link, match-sweep, verify cron/api/reports/*: report endpoints (GL, TB, BS, IS, AR/supplier ledger, VAT, SIE, INK2, NE-bilaga, KPI, audit, continuity, monthly, full-archive, salary, vacation, avgifter)/api/salary/*: employees, payroll-config, tax-tables, KU, runs/api/import/*: bank-file, SIE (parse/execute/mappings)/api/reconciliation/bank/*,/api/settings/*,/api/company/*,/api/team/*/api/deadlines/*,/api/tax-deadlines/*: CRUD + crons/api/pending-operations/*,/api/events/*,/api/audit-trail/*/api/calendar/feed/[token],/api/mcp-oauth/*,/api/support/contact,/api/account/delete/api/log,/api/health,/api/vat/validate,/api/currency/rate,/api/sandbox/*/api/extensions/ext/[...path]: dynamic extension routes (catch-all →/api/extensions/ext/{extensionId}/{routePath}, path params as_paramNamequery)