Jakob Wennberg
0b86901a2b
* feat(lib): add canonical money + format + fetch primitives (audit Tier 0) Foundation for post-audit cleanup: shared primitives so subsequent refactors import one helper instead of reinventing (the duplication the audit found). - lib/money.ts: canonical roundOre/ORE_TOLERANCE (+ equalOre/isZeroOre/sumOre); lib/bokslut/rounding.ts re-exports for back-compat - lib/utils.ts: formatAmount, formatWholeKr, formatDateTime - lib/hooks/use-fetch.ts: generic client fetch hook (abort, bilingual errors, refetch) - components/common/DataState.tsx: loading/error/empty wrapper over Skeleton/EmptyState - messages: common.retry / common.load_error (sv+en) - tests: 16 tests incl. the 1.005 half-ore case and locale-robust format assertions Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * ci(guards): ratchet against new MFA-bypassing routes and naive ore-rounding Adds scripts/checks/no-new-antipatterns.mjs + committed baseline. Fails CI only when a PR ADDS a route hand-rolling supabase.auth.getUser() (which skips MFA AAL2 enforcement) or a new Math.round(x*100)/100. Baseline: 178 raw-auth routes, 668 naive rounds — ratchets down as the A1 (route-auth) and D1 (rounding) migrations land. Wired into core-build.yml; green at baseline. Note: scripts/ is gitignored (.gitignore:70 '/scripts') yet tracks 39 files via force-add; these two were force-added to match that existing pattern. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(api,errors): enforce MFA on journal-entry mutation routes via withRouteContext (A1) Migrates the 4 journal-entry mutation routes (commit, correct, reverse, recordate) off hand-rolled supabase.auth.getUser() onto withRouteContext, which enforces MFA AAL2 (requireAuth) + non-viewer role (requireWrite) and routes thrown errors through the canonical errorResponse envelope. Fixes audit finding A1 for the most compliance-critical mutations and folds in C8 for these routes (drops bookkeepingErrorResponse; they now emit message_en). Also fixes a latent bug: errorResponse()/extractBookkeepingDetails only handled 11 of 15 typed bookkeeping errors, so MeaninglessCorrection / NoOpenPeriodForDate / TargetPeriodClosed / TargetPeriodLocked silently degraded to a generic 500 (affecting existing v1 callers too). Adds the 4 missing registry codes + extract cases -> correct 400/409. Behavior change: untyped engine throws now return the canonical 500 envelope instead of 400+raw-string; typed errors keep their status (verified against the registry). Tests updated to the realistic typed-error contract + a 403 write-gate test on commit. Updates .claude/rules/api-routes.md to prescribe withRouteContext. Ratchets the antipattern guard 178 -> 174. Full unit suite green (5023); tsc: no new errors. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(api): enforce MFA on salary run authorization routes via withRouteContext (A1) Migrates the salary-run lifecycle write routes (approve, paid, revert) — the highest-PII A1 surface — off hand-rolled supabase.auth.getUser() onto withRouteContext (enforces MFA AAL2 + non-viewer role). Explicit { error } returns are preserved unchanged (passed through the wrapper); only auth changes, so no error-shape regression. Salary unit suite green (8). Ratchets the antipattern guard 174 -> 171. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review: address PR #646 bot findings - guard: match withRouteContext/requireAuth at the CALL site (withRouteContext[<(]), not a bare import — closes the false-negative greptile flagged. It surfaced app/api/sandbox/seed (hand-rolled getUser; the loose regex had matched a code comment). Switched that route to requireAuth() — the documented stopgap for routes that can't use withRouteContext (it runs before a company exists; anonymous users, so MFA is a no-op but the auth path is now consistent). Guard stays at 171. - money.test: add the negative half-ore case roundOre(-1.005) === -1 to lock the rounding direction against regressions. - use-fetch: document keep-previous-data + deferred-loading (effect-tick) semantics. - structured-errors: drop the BFL 5 kap. 5 § citation from MEANINGLESS_CORRECTION per the swedish-compliance bot (5 § governs correction procedure, not the no-op precondition). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * review: enrich wrapper error logging + document sandbox GDPR controls (PR #646) - with-route-context: log unhandled errors and route errorResponse through the resolved { userId, companyId } logger, not just { requestId, operation } — closes the OWASP V16 audit-trail finding for all 82+ routes using the wrapper. Documented in the JSDoc. - sandbox/seed: document the GDPR Art.32 compensating controls for the anonymous write path (anonymous-only, /24 rate limit, synthetic demo data, own-company RLS scope). No functional change — the flagged behaviour is pre-existing by design; this records the reasoning inline. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
89 lines
2.7 KiB
JSON
89 lines
2.7 KiB
JSON
{
|
|
"name": "erp-base",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "AGPL-3.0-or-later",
|
|
"scripts": {
|
|
"setup:extensions": "npx tsx scripts/generate-extension-registry.ts",
|
|
"skills:generate": "npx tsx scripts/generate-skill-bodies.ts",
|
|
"skills:check": "npx tsx scripts/generate-skill-bodies.ts --check",
|
|
"predev": "npm run setup:extensions && node scripts/inject-public-branding.mjs",
|
|
"dev": "next dev",
|
|
"prebuild": "npm run setup:extensions && node scripts/inject-public-branding.mjs",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"check:guards": "node scripts/checks/no-new-antipatterns.mjs",
|
|
"test": "vitest run --project unit",
|
|
"test:pg": "vitest run --project pg-real"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/bedrock-sdk": "^0.29.1",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@radix-ui/react-checkbox": "^1.3.3",
|
|
"@radix-ui/react-dialog": "^1.1.15",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.16",
|
|
"@radix-ui/react-label": "^2.1.8",
|
|
"@radix-ui/react-progress": "^1.1.8",
|
|
"@radix-ui/react-select": "^2.2.6",
|
|
"@radix-ui/react-slot": "^1.2.4",
|
|
"@radix-ui/react-switch": "^1.2.6",
|
|
"@radix-ui/react-tabs": "^1.1.13",
|
|
"@radix-ui/react-toast": "^1.2.15",
|
|
"@radix-ui/react-tooltip": "^1.2.8",
|
|
"@react-pdf/renderer": "^4.3.2",
|
|
"@supabase/ssr": "^0.8.0",
|
|
"@supabase/supabase-js": "^2.93.1",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@upstash/ratelimit": "^2.0.8",
|
|
"@upstash/redis": "^1.37.0",
|
|
"@use-gesture/react": "^10.3.1",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"framer-motion": "^12.29.2",
|
|
"fuse.js": "^7.1.0",
|
|
"ics": "^3.8.1",
|
|
"jszip": "^3.10.1",
|
|
"lucide-react": "^0.563.0",
|
|
"mailparser": "^3.9.8",
|
|
"next": "16.1.5",
|
|
"next-intl": "^4.12.0",
|
|
"next-themes": "^0.4.6",
|
|
"pdf-lib": "^1.17.1",
|
|
"qrcode": "^1.5.4",
|
|
"react": "19.2.3",
|
|
"react-dom": "19.2.3",
|
|
"react-hook-form": "^7.71.1",
|
|
"react-markdown": "^10.1.0",
|
|
"recharts": "^3.7.0",
|
|
"remark-gfm": "^4.0.1",
|
|
"resend": "^6.9.1",
|
|
"server-only": "^0.0.1",
|
|
"sharp": "^0.34.5",
|
|
"svix": "^1.85.0",
|
|
"tailwind-merge": "^3.4.0",
|
|
"web-push": "^3.6.7",
|
|
"xlsx": "^0.18.5",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/mailparser": "^3.4.6",
|
|
"@types/node": "^20",
|
|
"@types/pg": "^8.20.0",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/sharp": "^0.31.1",
|
|
"@types/web-push": "^3.6.4",
|
|
"dotenv": "^17.2.3",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.1.5",
|
|
"pg": "^8.20.0",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5",
|
|
"vitest": "^4.0.18"
|
|
}
|
|
}
|