* feat(peppol): gate Peppol per company: request access, operator enables with a sending cap
Peppol is no longer available to every company by default. Each transmission
is billed per document by the access point and each receiving identifier
consumes a contracted tenant slot, so the product now works like this:
- peppol_access (new table, RLS read-only for members, service-role writes):
status requested | enabled | disabled, max_sends (null = no cap),
receive_enabled as a separate grant, who asked and who enabled.
- POST /api/settings/peppol/access: the company asks from Settings >
Fakturering; the row is written and the operators are e-mailed (best effort,
the row is the source of truth).
- scripts/peppol/access.ts list | enable <company|orgnr> [--max-sends N]
[--receive] | disable | show: the operator side.
- POST /api/invoices/[id]/peppol/send refuses PEPPOL_ACCESS_REQUIRED /
PEPPOL_SEND_LIMIT_REACHED before touching the invoice; the invoice page's
send item says so instead of pretending. Registration for receiving refuses
PEPPOL_ACCESS_REQUIRED / PEPPOL_RECEIVING_NOT_ENABLED.
- Settings UI: access status row with "Begär åtkomst", sends used of cap,
receiving switch only once receiving is granted.
Refs #546
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ
* test(peppol): pass route params to the settings handlers; baseline-align the access row
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ
* fix(peppol): revoke default table privileges from authenticated on the access and receiving tables
Supabase grants ALL on new tables to authenticated by default; the earlier
REVOKE covered PUBLIC and anon only, so a member's UPDATE on peppol_access was
an RLS-filtered no-op instead of a permission error (pg-real caught it).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TqFpxeWqbpR7bcwUJLRERQ
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
3ac80edc96