Jakob Wennberg
4f0a7b1db0
* feat(entitlements): capability-grant gate substrate (paywall + modularity) Two-axis capability primitive behind the SaaS paywall and the per-tenant modularity/marketplace vision: - migration: capability_grants (entitlement axis, polymorphic company/firm scope), company_capability_config (enablement axis), metered_events (append-only), company_has_capability() RPC reusing the 20260619130100 tenant guard; SELECT-only RLS (writes service-role only, no self-grant). - lib/entitlements: hasCapability/requireCapability gate (mirrors guardSandbox, fail-closed, NEXT_PUBLIC_SELF_HOSTED bypass), capability key namespace, metering helper. - unit (11) + pg-real tests (RPC/RLS/tenant-guard incl. no-self-grant). Gate not yet wired into call sites (follow-up commit). Paid keys: ai, bank_sync, skatteverket, email_send. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): enforce capability gate at paid external-service chokepoints Wire the gate into the paid surfaces (keys: ai, email_send, bank_sync, skatteverket): - AI routes (agent invoke/composer/onboarding stream): requireCapability(ai) - Invoice send (web + v1): requireCapability(email_send) - document-extraction event handler: skip Bedrock extract if ai not entitled - enable-banking + skatteverket crons: per-company hasCapability skip in loop - colocated send-route test mocks updated (requireCapability -> null) Free per founder decision: TIC org lookup, VIES VAT validation, FX auto-fetch, cloud backup, BankID login, all internal bookkeeping. DEPLOY ORDER: fail-closed by design — do NOT deploy before trial/comp grant seeding lands, or companies without grants lose these features. Seeding + Stripe checkout/webhook are the next steps. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): seed trial + comp capability grants Makes the fail-closed gate safely deployable — nobody is locked out at cutover: - AFTER INSERT trigger on companies grants every NEW company a 30-day trial on the PAID keys (ai, bank_sync, skatteverket, email_send), on ALL creation paths (RPC/MCP/direct) — so a new signup can use onboarding AI immediately. - one-time backfill for EXISTING companies: created <=2026-06-07 -> trial ends 2026-07-07; created later -> created_at + 30 days. - permanent comp grants for Arcim/Mattsson (matched by name, no hardcoded UUIDs). - pg tests: clearGrants() for controlled resolver tests + trigger coverage. Trigger fn is SECURITY DEFINER so it writes grants regardless of caller RLS (table has no INSERT policy for authenticated — no self-grant). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): client capability visibility + billing page Non-payers get a clean upsell instead of broken/empty features: - CompanyContext gains capabilities[] + useCapability(key); resolved once server-side in the dashboard layout via getCompanyCapabilities (batched, 2 queries), all three provider branches wired. - /settings/billing upgrade page — the destination upsells point to (Stripe Payment Link via NEXT_PUBLIC_STRIPE_PAYMENT_LINK; degrades to 'coming soon' until automated checkout lands). - ChatEmptyState: non-payer sees an Uppgradera CTA (mirrors the sandbox state). - SendInvoiceDialog: email send disabled + upsell note when email_send missing (extends the existing sandbox-disable pattern). Fast-follow: chat input/FAB + document-inbox empty state + bank/skatteverket/ AI-suggest buttons + a shared capability_blocked->toast backstop. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): gate remaining paid UI surfaces with upsell (fast-follow) disable-with-upsell across the rest of the paid surfaces (keys: bank_sync, skatteverket, ai): - BankSyncNowButton: sync/reconnect disabled + note when !bank_sync (CSV/SIE stays free) - AGIPanel: AGI submit-to-Skatteverket disabled + note when !skatteverket - SkatteverketConnectPanel: BankID connect/reconnect disabled + upsell - ApprovalCard: AI re-propose (correction) gated; manual approve/reject stay free - InvoiceInboxWorkspace: upsell when extraction empty AND !ai (deterministic parse + manual entry unaffected) - AgentTrigger FAB: routes to /settings/billing when !ai (no dead chat) - settings nav: 'Abonnemang'/'Subscription' link to /settings/billing (sv/en) TaxPaymentPanel + TransactionInboxCard intentionally untouched — only local/ deterministic actions there, nothing paid+external to gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(entitlements): automated Stripe subscription checkout + webhook Self-serve revenue wired to the same capability-grant primitive: - migration: company_subscriptions (company<->Stripe link/status) + stripe_webhook_events (idempotency) - lib/stripe: getStripe singleton, plan->price mapping, subscription-sync (statusGrantsAccess / subscriptionToState / applySubscriptionState / handleStripeEvent). Active sub -> upsert source='stripe' grants for PAID keys (expiry = period_end + 3d grace); canceled/unpaid -> remove ONLY stripe grants (freeze-and-retain). - routes: POST /api/billing/checkout (hosted subscription Checkout, company_id metadata), POST /api/billing/portal (Customer Portal), POST /api/stripe/webhook (raw-body signature verify, event-id dedup; handles checkout.session.completed + customer.subscription.*) - billing page: real plan-toggle Checkout CTA / manage-subscription portal, gated on isStripeConfigured() - adds stripe@22; unit tests for sync logic Provisioning is webhook-driven (never trusts the success redirect). Needs env: STRIPE_SECRET_KEY, STRIPE_WEBHOOK_SECRET, STRIPE_PRICE_MONTHLY, STRIPE_PRICE_YEARLY. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(entitlements): validate UUIDs in capability filter + log webhook errors Addresses PR review (Superagent Security / PR Agent): - has-capability.ts: validate companyId/teamId as UUIDs before interpolating into the PostgREST .or() filter (fail-closed) — removes the latent injection vector flagged in the entitlement gate. Unit tests updated to use UUIDs. - stripe/webhook: log processing failures with event id + type before the generic 500, so a failing webhook is visible to operators. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(salary): always-free AGI XML download for manual filing; only direct API submit is paid Per founder decision on the swedish-compliance-review finding: AGI is a mandatory statutory filing, so producing/downloading the AGI XML must never be paywalled. Adds a free 'Ladda ner AGI-fil' button (generates + downloads the XML for manual upload to Skatteverket's e-service) on all tiers; the gated 'Skicka in underlag' stays the paid convenience (direct API submission — which also requires the paid BankID connection). Upsell reworded to point to the manual path. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(entitlements): harden comp-grant match after prod verification Verified Arcim/Mattsson in prod (pwxtzglxptnnvjrpixpg): the name match was case-sensitive (missed the active 'Arcim technology AB' lowercase variant) and would have granted 3 archived dupes. Now match by org_number (5595386219 / 5595719864) OR case-insensitive name, active companies only — hits exactly the 3 active comp companies, excludes archived dupes and the unrelated 'Amnäs Mattsson, Emil' enskild firma. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
97 lines
3.1 KiB
JSON
97 lines
3.1 KiB
JSON
{
|
|
"name": "erp-base",
|
|
"version": "0.1.0",
|
|
"private": true,
|
|
"license": "AGPL-3.0-or-later",
|
|
"scripts": {
|
|
"setup:extensions": "npx tsx scripts/generate-extension-registry.ts",
|
|
"skills:generate": "npx tsx scripts/generate-skill-bodies.ts",
|
|
"skills:check": "npx tsx scripts/generate-skill-bodies.ts --check",
|
|
"taxonomy:generate": "npx tsx scripts/generate-taxonomy-registry.ts",
|
|
"taxonomy:check": "npx tsx scripts/generate-taxonomy-registry.ts --check",
|
|
"validate:ixbrl": "node scripts/validate-ixbrl.mjs",
|
|
"predev": "npm run setup:extensions && node scripts/inject-public-branding.mjs",
|
|
"dev": "next dev",
|
|
"prebuild": "npm run setup:extensions && node scripts/inject-public-branding.mjs",
|
|
"build": "next build",
|
|
"start": "next start",
|
|
"lint": "eslint",
|
|
"check:guards": "node scripts/checks/no-new-antipatterns.mjs",
|
|
"check:lint": "node scripts/checks/no-new-lint-errors.mjs",
|
|
"test": "vitest run --project unit",
|
|
"test:pg": "vitest run --project pg-real"
|
|
},
|
|
"dependencies": {
|
|
"@anthropic-ai/bedrock-sdk": "^0.29.1",
|
|
"@hookform/resolvers": "^5.2.2",
|
|
"@radix-ui/react-checkbox": "^1.3.3",
|
|
"@radix-ui/react-dialog": "^1.1.15",
|
|
"@radix-ui/react-dropdown-menu": "^2.1.16",
|
|
"@radix-ui/react-label": "^2.1.8",
|
|
"@radix-ui/react-progress": "^1.1.8",
|
|
"@radix-ui/react-select": "^2.2.6",
|
|
"@radix-ui/react-slot": "^1.2.4",
|
|
"@radix-ui/react-switch": "^1.2.6",
|
|
"@radix-ui/react-tabs": "^1.1.13",
|
|
"@radix-ui/react-toast": "^1.2.15",
|
|
"@radix-ui/react-tooltip": "^1.2.8",
|
|
"@react-pdf/renderer": "^4.3.2",
|
|
"@supabase/ssr": "^0.8.0",
|
|
"@supabase/supabase-js": "^2.93.1",
|
|
"@tailwindcss/typography": "^0.5.19",
|
|
"@types/qrcode": "^1.5.6",
|
|
"@upstash/ratelimit": "^2.0.8",
|
|
"@upstash/redis": "^1.37.0",
|
|
"@use-gesture/react": "^10.3.1",
|
|
"class-variance-authority": "^0.7.1",
|
|
"clsx": "^2.1.1",
|
|
"date-fns": "^4.1.0",
|
|
"framer-motion": "^12.29.2",
|
|
"fuse.js": "^7.1.0",
|
|
"ics": "^3.8.1",
|
|
"jszip": "^3.10.1",
|
|
"lucide-react": "^0.563.0",
|
|
"mailparser": "^3.9.8",
|
|
"next": "16.2.9",
|
|
"next-intl": "^4.12.0",
|
|
"next-themes": "^0.4.6",
|
|
"pdf-lib": "^1.17.1",
|
|
"qrcode": "^1.5.4",
|
|
"react": "19.2.3",
|
|
"react-dom": "19.2.3",
|
|
"react-hook-form": "^7.71.1",
|
|
"react-markdown": "^10.1.0",
|
|
"recharts": "^3.7.0",
|
|
"remark-gfm": "^4.0.1",
|
|
"resend": "^6.9.1",
|
|
"server-only": "^0.0.1",
|
|
"sharp": "^0.34.5",
|
|
"stripe": "^22.3.0",
|
|
"svix": "^1.85.0",
|
|
"tailwind-merge": "^3.4.0",
|
|
"web-push": "^3.6.7",
|
|
"xlsx": "^0.18.5",
|
|
"zod": "^4.3.6"
|
|
},
|
|
"devDependencies": {
|
|
"@tailwindcss/postcss": "^4",
|
|
"@types/mailparser": "^3.4.6",
|
|
"@types/node": "^20",
|
|
"@types/pg": "^8.20.0",
|
|
"@types/react": "^19",
|
|
"@types/react-dom": "^19",
|
|
"@types/sharp": "^0.31.1",
|
|
"@types/web-push": "^3.6.4",
|
|
"dotenv": "^17.2.3",
|
|
"eslint": "^9",
|
|
"eslint-config-next": "16.1.5",
|
|
"pg": "^8.20.0",
|
|
"tailwindcss": "^4",
|
|
"typescript": "^5",
|
|
"vitest": "^4.0.18"
|
|
},
|
|
"overrides": {
|
|
"ws": "^8.21.0"
|
|
}
|
|
}
|