admin/accounted
3
0
Fork 0
Code Issues 1 Pull Requests Actions Packages Projects Releases Wiki Activity
Files
4b5fe9ee5769dccfff05853abe2fa67e7e84bb35
accounted/scripts/checks/antipatterns-baseline.json
T
Jakob WennbergandClaude Opus 4.8 f8504f3bd0 fix: audit batch — pagination truncation, MFA/dead-code cleanup, mark-paid fail-closed (#841) 
* fix(reports): paginate 8 more report/ledger queries (1000-row truncation)

Raw .select() without fetchAllRows() silently caps at PostgREST's 1000-row
limit, producing wrong statutory output for high-volume companies. Following
#806 (trial-balance/VAT), wrap the remaining offenders in
fetchAllRows + a stable .order('id') + dedupeBy:

- ink2-engine / ne-engine: INK2 & NE-bilaga tax declarations under-counted
- ar-reconciliation (1510/1513), supplier-reconciliation (2440): phantom
  "Ej avstämd" gaps
- full-archive-export: 7-year DR archive (added a unique total order so rows
  are not silently skipped/duplicated across pages)
- avgifter-basis, currency-revaluation, vat-declaration

Adds a regression guard test asserting >1000 ledger lines are summed, not
truncated at 1000.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(api): close extension-dispatcher MFA gap, scope /api/events to API key, sweep dead code

Security/correctness:
- ext/[...path] dispatcher now uses requireAuth() instead of inline
  supabase.auth.getUser(), enforcing MFA (AAL2) on hosted across the whole
  enabled-extension surface (banking sync, document upload/booking, supplier
  invoices, migration). Ratchets antipatterns-baseline raw-route-auth 168->165.
- /api/events now filters by the API key's bound company_id instead of the
  user's active company (was a cross-company read with a scoped key).
- enable-banking OAuth callback calls ensureInitialized() at module load so
  the PSD2 consent audit event (ASVS V16 / GDPR Art.30) isn't dropped on a
  cold-start instance.

Dead-code sweep (all confirmed zero importers):
- delete lib/tax/calculator.ts, lib/salary/engangsskatt.ts (+test),
  lib/email/resend.ts, lib/salary/salary-transaction-matcher.ts,
  lib/webhooks/diff.ts, lib/salary/effective-values.ts,
  lib/bookkeeping/template-prompt.ts
- trim unused lib/vat/eu-countries.ts helpers (keep EU_COUNTRIES)
- remove dead getAutomaticStatus() and the abandoned Activepieces CSP entry

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(invoices): fail closed when a payment journal entry doesn't post

Three mark-paid paths (legacy route, v1 API, agent commit) diverged on the
"mark paid but the JE failed" case — two would flip the invoice to paid (or
leave an orphaned posted voucher) with no booking, silently diverging the GL
from the AR/AP sub-ledger. Unify on fail-closed:

- legacy + v1 + agent commitMarkInvoicePaid: never mark paid without a posted
  voucher; on a null/failed JE return INVOICE_PAID_BOOK_FAILED before any
  state mutation (v1 mirrors the match-invoice strict mode).
- agent path: add the .in('status',[...]).select('id') CAS guard and cancel
  the orphaned voucher (cancelOrphanedPaymentEntry) on a lost race or update
  error, matching the web route.
- legacy route: cancel the orphan on a non-race update error too (was only
  handled on the race branch).
- supplier mark-paid: stop swallowing a failed supplier_invoice_payments
  insert — that row drives the reversal amount in payment-sync; roll back the
  status flip and cancel the voucher instead.
- pending-ops orchestrator: error-check the terminal 'committed' write so an
  op stranded in 'committing' (the expire sweep only targets 'pending') is at
  least logged loudly.

Adds a guard test for the legacy fail-closed path. Full unit suite green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): unblock core build + address compliance-review findings

- avgifter-basis.ts: fix the core-build TypeScript error — PostgREST's
  type-level select parser models the salary_run embed as an array, which
  wasn't assignable to the object-typed generic. Type it `unknown` (rows are
  read via an explicit cast), making it robust across postgrest-js versions.
- /api/events: add a non-null companyId guard before the event_log query
  (defense-in-depth for the API-key-bound scope) — addresses ASVS V8.2.1 /
  ISO A.5.15.
- supplier mark-paid: add a CAS guard (.eq('status', newStatus)) to the
  payment-insert-failure rollback so a concurrent settlement can't be
  clobbered — addresses ASVS V2.3.
- dispatcher: add an AAL2 regression test asserting a non-MFA session is
  rejected (403) and the extension handler never runs — addresses the
  GDPR Art.32 review ask for the single extension chokepoint.

Verified deletions are safe: effective-values.ts was a dead duplicate — the
live AGI/payslip path inlines the same `?? override` coalescing
(generate-declaration.ts), so AGI correctness is unaffected.

next build: exit 0. Full unit suite: 6147 passing. ESLint clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 14:34:23 +02:00

177 lines
8.8 KiB
JSON
Raw Blame History

{
"_comment": "Ratchet baseline for scripts/checks/no-new-antipatterns.mjs. These counts may only decrease. Re-run with --update after a migration lowers them. Goal: both reach 0 (A1 route-auth campaign, D1 rounding codemod).",
"rawRouteAuth": {
"count": 165,
"files": [
"app/api/account/delete/route.ts",
"app/api/account/password/route.ts",
"app/api/agent/composer/route.ts",
"app/api/agent/conversations/[id]/route.ts",
"app/api/agent/conversations/route.ts",
"app/api/agent/invoke/route.ts",
"app/api/agent/memory/[id]/route.ts",
"app/api/agent/memory/route.ts",
"app/api/agent/onboarding/stream/route.ts",
"app/api/agent/profile/route.ts",
"app/api/agent/profile/verify/route.ts",
"app/api/agent/skills/route.ts",
"app/api/audit-trail/route.ts",
"app/api/bookkeeping/account-balances/route.ts",
"app/api/bookkeeping/account-totals/route.ts",
"app/api/bookkeeping/accounts/[number]/route.ts",
"app/api/bookkeeping/accounts/activate/route.ts",
"app/api/bookkeeping/accounts/bas-lookup/route.ts",
"app/api/bookkeeping/accounts/reference/route.ts",
"app/api/bookkeeping/accounts/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/close/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/entry-count/route.ts",
"app/api/bookkeeping/fiscal-periods/[id]/route.ts",
"app/api/bookkeeping/fiscal-periods/period-status/route.ts",
"app/api/bookkeeping/fiscal-periods/route.ts",
"app/api/bookkeeping/journal-entries/[id]/chain/route.ts",
"app/api/bookkeeping/journal-entries/[id]/no-document-required/route.ts",
"app/api/bookkeeping/journal-entries/[id]/notes/route.ts",
"app/api/bookkeeping/journal-entries/route.ts",
"app/api/bookkeeping/mapping-rules/evaluate/route.ts",
"app/api/bookkeeping/mapping-rules/route.ts",
"app/api/bookkeeping/no-doc-required/route.ts",
"app/api/bookkeeping/voucher-gaps/route.ts",
"app/api/calendar/feed/route.ts",
"app/api/cash-accounts/route.ts",
"app/api/company/current/route.ts",
"app/api/company/members/[id]/route.ts",
"app/api/company/members/invite/[id]/route.ts",
"app/api/company/members/invite/route.ts",
"app/api/company/members/route.ts",
"app/api/company/route.ts",
"app/api/currency/rate/route.ts",
"app/api/deadlines/[id]/complete/route.ts",
"app/api/deadlines/[id]/route.ts",
"app/api/deadlines/[id]/status/route.ts",
"app/api/deadlines/route.ts",
"app/api/documents/[id]/extraction-status/route.ts",
"app/api/documents/[id]/route.ts",
"app/api/documents/[id]/verify/route.ts",
"app/api/documents/[id]/versions/route.ts",
"app/api/documents/counts/route.ts",
"app/api/events/route.ts",
"app/api/extensions/[sector]/[slug]/data/route.ts",
"app/api/extensions/[sector]/[slug]/settings/route.ts",
"app/api/extensions/skatteverket/skattekonto/drift/route.ts",
"app/api/import/sie/[id]/route.ts",
"app/api/import/sie/create-accounts/route.ts",
"app/api/import/sie/mappings/route.ts",
"app/api/import/sie/route.ts",
"app/api/invoices/[id]/convert/route.ts",
"app/api/invoices/[id]/mark-sent/route.ts",
"app/api/invoices/[id]/pdf/route.ts",
"app/api/invoices/preview-pdf/route.ts",
"app/api/kpi/preferences/route.ts",
"app/api/mcp-oauth/authorize/route.ts",
"app/api/pending-operations/[id]/commit/route.ts",
"app/api/pending-operations/[id]/reject/route.ts",
"app/api/pending-operations/[id]/route.ts",
"app/api/pending-operations/bulk-commit/route.ts",
"app/api/pending-operations/route.ts",
"app/api/reconciliation/bank/link/route.ts",
"app/api/reconciliation/bank/mark-opening-balance/route.ts",
"app/api/reconciliation/bank/run/route.ts",
"app/api/reconciliation/bank/status/route.ts",
"app/api/reconciliation/bank/unlink/route.ts",
"app/api/reconciliation/bank/unmatched-entries/route.ts",
"app/api/reports/ar-ledger/customer/[customerId]/invoices/route.ts",
"app/api/reports/ar-ledger/route.ts",
"app/api/reports/ar-ledger/xlsx/route.ts",
"app/api/reports/audit-trail/route.ts",
"app/api/reports/avgifter-basis/route.ts",
"app/api/reports/balance-sheet/pdf/route.ts",
"app/api/reports/balance-sheet/xlsx/route.ts",
"app/api/reports/balansrapport/pdf/route.ts",
"app/api/reports/balansrapport/route.ts",
"app/api/reports/balansrapport/xlsx/route.ts",
"app/api/reports/continuity-check/route.ts",
"app/api/reports/full-archive/route.ts",
"app/api/reports/general-ledger/xlsx/route.ts",
"app/api/reports/income-statement/pdf/route.ts",
"app/api/reports/income-statement/xlsx/route.ts",
"app/api/reports/journal-register/route.ts",
"app/api/reports/journal-register/xlsx/route.ts",
"app/api/reports/kassaflodesanalys/pdf/route.ts",
"app/api/reports/kassaflodesanalys/route.ts",
"app/api/reports/kpi/route.ts",
"app/api/reports/kpi/xlsx/route.ts",
"app/api/reports/monthly-breakdown/route.ts",
"app/api/reports/monthly-breakdown/xlsx/route.ts",
"app/api/reports/resultatrapport/pdf/route.ts",
"app/api/reports/resultatrapport/route.ts",
"app/api/reports/resultatrapport/xlsx/route.ts",
"app/api/reports/salary-journal/route.ts",
"app/api/reports/salary-journal/xlsx/route.ts",
"app/api/reports/supplier-ledger/route.ts",
"app/api/reports/supplier-ledger/supplier/[supplierId]/invoices/route.ts",
"app/api/reports/supplier-ledger/xlsx/route.ts",
"app/api/reports/trial-balance/account/[accountNumber]/sources/route.ts",
"app/api/reports/trial-balance/route.ts",
"app/api/reports/trial-balance/xlsx/route.ts",
"app/api/reports/vacation-liability/route.ts",
"app/api/reports/vat-declaration/ruta/[ruta]/sources/route.ts",
"app/api/reports/vat-declaration/xlsx/route.ts",
"app/api/salary/employees/[id]/absence/route.ts",
"app/api/salary/employees/[id]/benefits/[benefitId]/route.ts",
"app/api/salary/employees/[id]/benefits/route.ts",
"app/api/salary/employees/[id]/route.ts",
"app/api/salary/employees/[id]/worked-hours/batch/route.ts",
"app/api/salary/employees/[id]/worked-hours/route.ts",
"app/api/salary/employees/route.ts",
"app/api/salary/ku/[year]/route.ts",
"app/api/salary/payroll-config/[year]/route.ts",
"app/api/salary/runs/[id]/agi/submit/route.ts",
"app/api/salary/runs/[id]/agi/xml/route.ts",
"app/api/salary/runs/[id]/correct/route.ts",
"app/api/salary/runs/[id]/employees/[employeeId]/route.ts",
"app/api/salary/runs/[id]/employees/route.ts",
"app/api/salary/runs/[id]/lines/[lineId]/route.ts",
"app/api/salary/runs/[id]/lines/route.ts",
"app/api/salary/runs/[id]/payment/bg-lb/route.ts",
"app/api/salary/runs/[id]/payment/pain001/route.ts",
"app/api/salary/runs/[id]/payslips/[employeeId]/pdf/route.ts",
"app/api/salary/runs/[id]/payslips/send/route.ts",
"app/api/salary/runs/[id]/preview/route.ts",
"app/api/salary/runs/[id]/review/route.ts",
"app/api/salary/tax-tables/lookup/route.ts",
"app/api/salary/tax-tables/status/route.ts",
"app/api/settings/api-keys/[id]/route.ts",
"app/api/settings/booking-templates/[id]/route.ts",
"app/api/settings/booking-templates/[id]/touch/route.ts",
"app/api/settings/booking-templates/export/route.ts",
"app/api/settings/booking-templates/import/route.ts",
"app/api/settings/booking-templates/route.ts",
"app/api/settings/counterparty-templates/route.ts",
"app/api/settings/logo/route.ts",
"app/api/settings/oauth-clients/[id]/route.ts",
"app/api/settings/oauth-clients/route.ts",
"app/api/settings/route.ts",
"app/api/skatteverket/tax-payments/[period]/mark-paid/route.ts",
"app/api/skatteverket/tax-payments/[period]/payment-file/route.ts",
"app/api/skatteverket/tax-payments/[period]/route.ts",
"app/api/supplier-invoices/[id]/route.ts",
"app/api/supplier-invoices/[id]/uncredit/route.ts",
"app/api/support/contact/route.ts",
"app/api/tax-deadlines/generate/route.ts",
"app/api/team/accept/route.ts",
"app/api/team/members/route.ts",
"app/api/transactions/[id]/attach-document/route.ts",
"app/api/transactions/[id]/book/route.ts",
"app/api/transactions/[id]/ignore/route.ts",
"app/api/transactions/[id]/uncategorize/route.ts",
"app/api/transactions/batch-match-invoices/route.ts",
"app/api/transactions/create-from-document/route.ts",
"app/api/transactions/suggest-categories/route.ts",
"app/api/vat/validate/route.ts"
]
},
"naiveOreRound": {
"count": 655
}
}
Reference in New Issue View Git Blame Copy Permalink