* refactor(ui): normalize dense pages to the locked design system
Sweep of the info-dense surfaces against .claude/rules/design.md; no
behavior changes, classNames and primitive adoption only.
- Replace hand-rolled h1s with PageHeader (import, suppliers, kpi,
salary/employees, skattekonto, settings layout) and drop the one
double title (SalarySettingsContent under the settings h1)
- Replace hand-rolled empty states with EmptyState (skattekonto,
banking/api-keys/oauth/counterparty settings) and hand-rolled
pulse divs with Skeleton (deadlines, report view loaders)
- Remove semantic colors used as chrome: amber/emerald banners in
AGIPanel and SkatteverketPanel, success/warning tints in
kassaflodesanalys, arsredovisning and import become neutral
surfaces with the tint kept on the icon only
- Full-opacity borders everywhere (border-border/30-60,
border-destructive/20-40, border-foreground/30, text-destructive/80)
- Snap off-scale spacing (p-5 to p-6, p-2.5 to p-3, gap/mt-x.5 to
scale values); KPI metric tiles p-6 to p-4 per the tile rule
- Remove the mobile Select that duplicated the invoices status Tabs
(TabsList already scrolls horizontally); single Tabs now serves
both breakpoints
- supplier-invoices: shared formatCurrency instead of a local
formatAmount helper; skattekonto: formatDate/formatDateLong/
formatDateTime instead of raw dates and toLocaleString
- arsredovisning flerarsoversikt converted to the Table primitive
with right-aligned tabular-nums cells
- Settings: CardTitle text-base on section cards, one heading idiom
in AccountSettingsContent, h3 to h2 in CompanyProfileView
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(i18n): trim text bloat and fix an untranslated sv string
- Fix invoice_credit.create_failed_fallback: sv catalog carried the
English "Failed to create credit note"; now "Kunde inte skapa
kreditfaktura". Translate new_user_checklist.step3_title in en
- Drop descriptions that paraphrase their own title (design.md
forbidden pattern): invoice_detail.credited_description,
invoice_credit.original_card_description, invoice_editor
customer/notes card descriptions (keys deleted from both
catalogs, zero remaining usages); the transaction booking
DialogDescription becomes sr-only so screen readers keep it
- Trim redundant sentences from settings_salary.info_payroll_scope,
settings_backup.intro, ext_cloud_backup_long_description,
settings.name_description, salary_payments.open_payments_note and
shorten invoice_credit.reason_card_description; statutory BFL/tax
prose untouched
- Normalize toast punctuation (dimensions/self_billing
created_description lose the trailing period like their siblings)
- common.delete "Radera" to "Ta bort" (zero live call sites; Radera
stays reserved for irreversible account/company deletion)
Catalogs verified key-identical (4795 keys each) and JSON-parseable.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
* feat: add user locale preference to user_preferences table
- Introduced a new column 'locale' in the user_preferences table to store per-user UI language preferences.
- Added a CHECK constraint to ensure only supported locales ('sv', 'en') are allowed.
- Triggered a schema reload notification for the changes.
chore: declare CSS module support in TypeScript
- Added a declaration for CSS modules in globals.d.ts to enable TypeScript support for importing CSS files.
* feat: add Swish as an invoice payment method in company settings
* fix: simplify COMING_SOON_PROVIDERS to include only bjornlunden and briox
* feat: add supplier creation functionality and related operations
* feat: reorder and enhance OAuth scopes in Visma integration
* feat: implement create supplier functionality with validation and risk tier management
* feat(voucher): add create voucher and correct entry previews; update commit methods
* feat: add support for pending operations in API key scopes and OAuth client management
- Introduced new API key scopes for reading and approving pending operations.
- Updated the scope groups to include pending operations.
- Added new tools for listing and managing pending operations.
- Implemented OAuth client registration and revocation endpoints.
- Created a UI panel for managing OAuth clients, including registration and revocation.
- Added tests for pending operations tools and OAuth allowlist functionality.
- Implemented a database migration for OAuth client registrations with appropriate policies and constraints.
* feat: Implement OAuth client registration rate limiting and enhance security measures
- Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks.
- Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained.
- Updated error responses to be uniform across different types of redirect URI validation failures.
- Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided.
- Improved handling of high-risk pending operations, requiring explicit confirmation for approvals.
- Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail.
- Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks.
