* fix: prevent Chrome auto-translate from crashing React during onboarding
Chrome auto-translate modifies DOM text nodes when it detects a Swedish
page (lang="sv") in a browser set to English. React does not expect
external DOM mutations and throws, crashing the entire component tree
into global-error.tsx on every step transition.
Add translate="no" and <meta name="google" content="notranslate"> to
suppress browser translation. Also fix timezone-unsafe date parsing in
fiscal period validation (new Date("YYYY-MM-DD") + getDate() returns
local-timezone values, shifting dates by -1 day in Western timezones).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: add notranslate meta tag to global-error.tsx for consistency
Per review feedback — global-error.tsx renders its own <html> document,
so it needs the same <meta name="google" content="notranslate"> tag as
layout.tsx to fully suppress Chrome translation on error pages.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* feat: add MCP server extension with OAuth, API keys, and KPI dashboard
Let users do bookkeeping through Claude Desktop, Claude Code, or any
MCP-compatible client. "Show my uncategorized transactions." "Book that
as office supplies." "Invoice Acme for 15,000 kr."
MCP server (extension):
- 10 tools: transactions, categorization, customers, invoices,
trial balance, VAT report, KPI report, income statement
- JSON-RPC 2.0 protocol (no SDK dependency, works in serverless)
- Tool annotations, pagination, input validation per MCP best practices
- Same engine as web UI (VAT rules, exchange rates, event emission)
API key infrastructure (core):
- api_keys table with RLS, rate limiting (100 RPM), scopes column
- Atomic rate limit via DB RPC (validate_and_increment_api_key)
- Key management API routes + settings UI panel
OAuth 2.1 for Claude Desktop connectors:
- .well-known/oauth-protected-resource + oauth-authorization-server
- Authorization endpoint with consent page
- Token endpoint with PKCE verification
- Stateless encrypted auth codes (AES-256-GCM, no DB storage)
- Dynamic client registration
KPI dashboard:
- /nyckeltal page with hero cards, operational grid, trend chart
- GET /api/reports/kpi endpoint
- Gross margin, cash position, expense ratio, avg payment days,
VAT liability, revenue/expense trend
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: address OAuth security vulnerabilities from code review
Critical fixes:
- Auth code replay: Track used codes in oauth_used_codes table with
unique constraint. Codes are single-use per OAuth 2.1 §4.1.2.
- Open redirect: Validate redirect_uri against hardcoded allowlist
of known Claude callback URLs + localhost for dev.
P1 fixes:
- Move API key creation from /authorize to /token endpoint. Keys are
only created after PKCE verification, preventing orphaned keys on
abandoned OAuth flows.
- Add ensureInitialized() to MCP server so event handlers load and
transaction.categorized events reach extensions.
P2 fixes:
- Remove 'plain' from PKCE methods — only S256 is advertised and
accepted.
- Fix extension count in sectors test (10 → 11 for mcp-server).
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
* fix: remove duplicate ensureInitialized() that caused circular import
The extension router (ext/[...path]/route.ts) already calls
ensureInitialized() before dispatching to handlers. The duplicate
call in server.ts created a circular import that Turbopack couldn't
resolve, breaking the Vercel build.
Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
108 lines
3.8 KiB
TypeScript
108 lines
3.8 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { NextResponse } from 'next/server'
|
|
import { generateIncomeStatement } from '@/lib/reports/income-statement'
|
|
import { generateTrialBalance } from '@/lib/reports/trial-balance'
|
|
import { generateARLedger } from '@/lib/reports/ar-ledger'
|
|
import { generateMonthlyBreakdown } from '@/lib/reports/monthly-breakdown'
|
|
import {
|
|
calculateGrossMargin,
|
|
calculateCashPosition,
|
|
calculateRevenueGrowth,
|
|
calculateExpenseRatio,
|
|
calculateAvgPaymentDays,
|
|
} from '@/lib/reports/kpi'
|
|
import type { KPIReport } from '@/types'
|
|
|
|
export async function GET(request: Request) {
|
|
const supabase = await createClient()
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
|
|
const { searchParams } = new URL(request.url)
|
|
const periodId = searchParams.get('period_id')
|
|
if (!periodId) {
|
|
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
|
|
}
|
|
|
|
// Fetch fiscal period info
|
|
const { data: period, error: periodError } = await supabase
|
|
.from('fiscal_periods')
|
|
.select('*')
|
|
.eq('id', periodId)
|
|
.eq('user_id', user.id)
|
|
.single()
|
|
|
|
if (periodError || !period) {
|
|
return NextResponse.json({ error: 'Fiscal period not found' }, { status: 404 })
|
|
}
|
|
|
|
// Run independent queries in parallel
|
|
const [
|
|
incomeStatement,
|
|
trialBalanceResult,
|
|
arLedger,
|
|
monthlyBreakdown,
|
|
paidInvoicesResult,
|
|
] = await Promise.all([
|
|
generateIncomeStatement(supabase, user.id, periodId),
|
|
generateTrialBalance(supabase, user.id, periodId),
|
|
generateARLedger(supabase, user.id),
|
|
generateMonthlyBreakdown(supabase, user.id, periodId),
|
|
supabase
|
|
.from('invoices')
|
|
.select('invoice_date, paid_at')
|
|
.eq('user_id', user.id)
|
|
.eq('status', 'paid')
|
|
.not('paid_at', 'is', null)
|
|
.gte('invoice_date', period.period_start)
|
|
.lte('invoice_date', period.period_end),
|
|
])
|
|
|
|
const paidInvoices = (paidInvoicesResult.data || []) as { invoice_date: string; paid_at: string }[]
|
|
|
|
// Calculate VAT liability from trial balance (output VAT - input VAT)
|
|
const vatOutputAccounts = ['2611', '2621', '2631']
|
|
const vatInputAccounts = ['2641', '2645']
|
|
const outputVat = trialBalanceResult.rows
|
|
.filter((r) => vatOutputAccounts.includes(r.account_number))
|
|
.reduce((sum, r) => sum + (r.closing_credit - r.closing_debit), 0)
|
|
const inputVat = trialBalanceResult.rows
|
|
.filter((r) => vatInputAccounts.includes(r.account_number))
|
|
.reduce((sum, r) => sum + (r.closing_debit - r.closing_credit), 0)
|
|
const vatLiability = Math.round((outputVat - inputVat) * 100) / 100
|
|
|
|
// Revenue growth: only for closed periods, compare with previous period
|
|
let revenueGrowth: number | null = null
|
|
if (period.is_closed && period.previous_period_id) {
|
|
const prevStatement = await generateIncomeStatement(
|
|
supabase,
|
|
user.id,
|
|
period.previous_period_id
|
|
)
|
|
revenueGrowth = calculateRevenueGrowth(
|
|
incomeStatement.total_revenue,
|
|
prevStatement.total_revenue
|
|
)
|
|
}
|
|
|
|
const report: KPIReport = {
|
|
grossMargin: calculateGrossMargin(incomeStatement),
|
|
netResult: incomeStatement.net_result,
|
|
cashPosition: calculateCashPosition(trialBalanceResult.rows),
|
|
outstandingReceivables: arLedger.total_outstanding,
|
|
overdueReceivables: arLedger.total_overdue,
|
|
revenueGrowth,
|
|
expenseRatio: calculateExpenseRatio(incomeStatement),
|
|
avgPaymentDays: calculateAvgPaymentDays(paidInvoices),
|
|
paidInvoiceCount: paidInvoices.length,
|
|
vatLiability,
|
|
totalRevenue: incomeStatement.total_revenue,
|
|
totalExpenses: incomeStatement.total_expenses,
|
|
periodComplete: period.is_closed,
|
|
months: monthlyBreakdown.months,
|
|
period: { start: period.period_start, end: period.period_end },
|
|
}
|
|
|
|
return NextResponse.json({ data: report })
|
|
}
|