Mattsson f7f40c04e4 fix: return provider OAuth callbacks to the initiating brand domain (#2305) ...

* fix: hand provider OAuth callbacks back to initiating brand

* fix: encrypt provider OAuth handoff payloads

* fix: purge expired provider OAuth handoffs

2026-09-05 13:35:11 +02:00

..

account

fix(auth): land stock email-change links on the status page and stop retries voiding pending mails (#2199)

2026-09-03 10:55:12 +02:00

agent

feat(auth): base available login methods off GoTrue providers (#1869)

2026-08-31 09:13:39 +01:00

articles

Bug/resend and invoices (#1192)

2026-07-25 22:56:17 +02:00

assets

fix(copy): make K3 and year-end claims match what the code actually does (#1431)

2026-08-06 11:54:57 +02:00

audit-trail

Check/salary bankid api (#892)

2026-07-05 03:05:09 +02:00

auth

feat(white-label): invite-only signup for brand domains (#1995)

2026-08-27 18:32:52 +02:00

billing

feat(white-label): byra white-label infrastructure: brands, cockpit, home domains, branded email (#1956)

2026-08-26 16:56:39 +02:00

bookkeeping

feat(dimensions): show the value's name after picking, and let an unused custom dimension be deleted (#2219) (#2255)

2026-09-03 19:20:09 +02:00

byra/brand

fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)

2026-09-02 11:38:30 +02:00

calendar/feed

feat(invoices): offert (quote) document type with own OF-series, decisions, conversion, MCP and v1 (#2163)

2026-09-02 22:40:25 +02:00

cash-accounts

feat(invoices): named payee accounts and per-invoice choice of bank account (#2233)

2026-09-03 21:06:45 +02:00

clients

feat(white-label): invite-only signup for brand domains (#1995)

2026-08-27 18:32:52 +02:00

company

chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers (#2150)

2026-09-02 11:51:16 +02:00

connect

refactor(connect): validate the Peppol connector with the shared contract schemas (#2193)

2026-09-02 21:08:49 +02:00

connector

feat(connect): connector status + Synka nu row in Settings -> Abonnemang (PR6b-3) (#2104)

2026-09-01 11:44:33 +02:00

currency/rate

Fix/fdb fr usrs (#1125)

2026-07-23 16:16:55 +02:00

customers

fix(customers): make country ISO-2 everywhere and check it against the customer type (#2241)

2026-09-03 18:09:46 +02:00

deadlines

fix(supabase): stop server clients leaking a 30s refresh ticker per request (#1612)

2026-08-17 14:30:17 +02:00

dimensions

feat(dimensions): show the value's name after picking, and let an unused custom dimension be deleted (#2219) (#2255)

2026-09-03 19:20:09 +02:00

documents

fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)

2026-09-02 11:38:30 +02:00

events

feat(mcp-oauth): let an account with no company connect and sign up from the OAuth popup (#1814 PR 1) (#1855)

2026-08-25 11:25:42 +02:00

export

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

extensions

fix: return provider OAuth callbacks to the initiating brand domain (#2305)

2026-09-05 13:35:11 +02:00

health

fix(mcp): honest tool text and build-derived server version (#1923)

2026-08-26 13:35:15 +02:00

idempotency/cleanup/cron

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

import

fix(import): attach underlag by the basename of a folder-picked upload (#2288)

2026-09-04 19:14:33 +02:00

invoices

fix(payments): refuse to book a bank row that unlinked vouchers already explain (#2300)

2026-09-05 11:59:59 +02:00

kpi/preferences

fix: similar-sweep currency remediation, security hardening and v1 API fixes (#1215)

2026-07-27 03:34:56 +02:00

log

Check/salary bankid api (#892)

2026-07-05 03:05:09 +02:00

mcp-oauth

fix(mcp-oauth): allowlist Cursor's OAuth callbacks so its dynamic registration succeeds (#2225)

2026-09-03 15:33:58 +02:00

mileage

feat(mileage): suggest driving distance from the from/to addresses (#1778)

2026-08-21 12:19:35 +02:00

notices

feat(notices): one aggregated notice line instead of stacked degraded-state banners (#1733)

2026-08-20 10:27:52 +02:00

notifications

feat(billing): multi-user paywall: multi_user capability, 20-day grace, owner-only dormancy (#2099)

2026-09-01 11:29:12 +02:00

onboarding/state

feat(home): first-run block as a numbered four-step thread with partner marks (#1149)

2026-07-24 16:37:51 +02:00

parties

feat(parties): one suggestion per legal person, rename on rebuild, review list for SCB matches, model reading for memos (#2274)

2026-09-04 17:01:10 +02:00

payslip/[token]/pdf

chore: repo-wide bloat sweep, remove dead code and fold duplicate helpers (#2150)

2026-09-02 11:51:16 +02:00

pending-operations

fix(bookkeeping): settle unbound transactions on the company's single enabled cash account (#1831)

2026-08-24 13:26:08 +02:00

peppol

feat(peppol): poll outbound delivery status + cap receiving registrations (#1793)

2026-08-21 17:06:57 +02:00

receipt-hunt

fix(mail): stop Gmail refusing the search, and stop calling that "hittade inget" (#1521)

2026-08-11 14:23:58 +02:00

reconciliation

fix(reconciliation): judge bank sign-off from the fiscal period start and show the refusal (#2200)

2026-09-02 23:11:42 +02:00

reports

feat(invoices): offert (quote) document type with own OF-series, decisions, conversion, MCP and v1 (#2163)

2026-09-02 22:40:25 +02:00

rot-rut

feat(rot-rut): match Skatteverket's payout against the begäran from the bank row (#2271)

2026-09-04 14:33:41 +02:00

salary

fix(payroll): enforce the jamkning both-dates invariant with a CHECK constraint (#2279)

2026-09-04 17:01:34 +02:00

sales-orders

fix(sales-orders): pin the sales_order_items embed FK and teach the embed guard composite keys (#2207)

2026-09-03 12:18:47 +02:00

sandbox

fix(sandbox): use posting engine and recover failed seeds (#2297)

2026-09-05 10:42:14 +02:00

settings

fix(migrations): re-issue the invoice payee migrations skipping migration-reset source companies (#2260)

2026-09-04 06:45:56 +02:00

skatteverket/tax-payments/[period]

fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed (#1888)

2026-08-25 14:25:00 +02:00

storage

fix(security): audit remediation 2026-09-01: api_keys identity, viewer gates, OAuth binding, XSS, MFA gate (#2155)

2026-09-02 11:38:30 +02:00

stripe/webhook

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00

supplier-invoices

fix(supplier-invoices): a credit note is never a payable, so it never waits for attest (#2289)

2026-09-05 09:43:00 +02:00

suppliers

fix(customers): allow 0-day payment terms and say why the field is invalid (#2070) (#2251)

2026-09-03 18:54:28 +02:00

support/contact

feat(support): attach images and PDFs to the in-app contact form

2026-08-26 12:32:29 +02:00

tax-assessment-notices

Bug/gh issues fiz (#1103)

2026-07-21 23:00:15 +02:00

tax-deadlines

fix(supabase): stop server clients leaking a 30s refresh ticker per request (#1612)

2026-08-17 14:30:17 +02:00

team

fix(white-label): accept byrå-team invites before landing, so admins reach /clients (#2002)

2026-08-27 23:08:04 +02:00

transactions

fix(payments): refuse to book a bank row that unlinked vouchers already explain (#2300)

2026-09-05 11:59:59 +02:00

user

feat(billing): make the expired-trial state visible with a clear upgrade path (#1725)

2026-08-20 10:05:39 +02:00

v1

fix(supplier-invoices): a credit note is never a payable, so it never waits for attest (#2289)

2026-09-05 09:43:00 +02:00

vat/validate

Fix/attributes config (#926)

2026-07-08 09:54:46 +02:00

version

feat(reports): log behandlingsregler changes and program versions (BFNAR 2013:2 p. 9.16) (#2097)

2026-09-01 20:31:10 +02:00

webhooks

feat(peppol): Qvalia access-point adapter, send flow and delivery webhook (#1780)

2026-08-21 12:45:11 +02:00

webshop-orders

fix(customers): make country ISO-2 everywhere and check it against the customer type (#2241)

2026-09-03 18:09:46 +02:00

worklist/counts

style: remove em/en dashes repo-wide, add CLAUDE.md rule against them (#890)

2026-07-04 15:58:06 +02:00