Files
accounted/lib/onboarding/checklist.ts
T
Mattsson 4f33184a9a fix(mcp): explain the Claude-side steps after "Anslut till Claude" and tick the checklist on a real connection (#2133) (#2147)
* fix(mcp): explain the Claude-side steps after "Anslut till Claude" and tick the checklist on a real connection (#2133)

Lazy auth is by design: Claude lists the tools before any sign-in and the
first company-scoped call answers 401, which opens the Accounted sign-in.
Nothing told the user, so a "connected" status with an unanswered first
question read as a broken connection (Axel, Discord).

- Settings -> API & MCP: one sentence of expectation under the button, and
  the step-by-step guide link moved from under two disclosures to directly
  under the button.
- Docs (connect-claude / anslut-claude): new "What happens after you click"
  section for Path A covering the connector dialog, the tools appearing
  before sign-in, the first-call login + consent screen, "ask again", and
  the "Required when the server asks" auth setting that only the manual
  path mentioned.
- Hem checklist step "Anslut till Claude": deep link now carries
  client=claude-connector like the settings button (claudeConnectorLink),
  the footnote carries the same expectation line plus the guide link, and
  the done-signal is an unrevoked api_keys row minted by the MCP OAuth
  token route (OAUTH_MCP_KEY_NAME) instead of the in-app AI-profile flag,
  which never meant "connected to Claude".
- Tests: claudeStepDone with/without a key row, deep-link snapshot.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W7iJQwKiRTDWSMnRm4WM4L

* fix(mcp): correct consent-page claims, stop the completion PATCH loop, count OAuth keys past RLS (#2133)

Three skeptic refutations on PR #2147, fixed in one pass:

- Docs (EN + SV): the consent page shows the company active in the app and
  pre-selects every scope for Claude's connector (founder decision
  2026-08-26); it has no company picker and nothing to tick. Steps 3-4 of
  the new section, the "Read-only by default" paragraph above it, the
  sandbox note and the 10-minute test now describe Endast läs under
  Behörigheter instead.
- Checklist completion: users with initial_setup_path NULL (skipped the
  books question, then imported) hit the route's "Välj först hur du vill
  komma igång" 400 and, with saving as an effect dependency, retried it
  forever with a toast. completionPatchBody() records path=migration when
  none was chosen, and a rejected PATCH is not retried within the session.
- hasMcpKey: api_keys' SELECT policy is company-scoped, so the user client
  could not see companyless (NULL company_id) or archived-company keys and
  the step stayed open for the user who had just connected. The head count
  now runs through the service client with an explicit user_id filter.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W7iJQwKiRTDWSMnRm4WM4L

* fix(mcp): surface a failed OAuth-key count and reserve the marker name (#2133)

CodeRabbit round on PR #2147:

- app/(dashboard)/page.tsx: a failed api_keys count answered count null,
  which claudeStepDone read as "never connected". Throw to the error
  boundary like the settings fetch does instead of guessing.
- app/api/settings/api-keys: reject a hand-minted key named
  MCP-klient (OAuth) (400 VALIDATION_ERROR): that name is the marker the
  Hem checklist reads as "connected to Claude", so a manual key with it
  would tick the step without any connection. Test added.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01W7iJQwKiRTDWSMnRm4WM4L

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 00:04:31 +02:00

95 lines
4.1 KiB
TypeScript

import type { InitialSetupPath, MomsPeriod } from '@/types'
/**
* What the Skatteverket checklist step should say about VAT deadlines.
*
* - 'date': the company's next momsdeklaration due date is known; show it.
* - 'missing_period': the company is VAT-registered but moms_period is unset,
* which makes the deadline engine silently generate ZERO VAT deadlines
* (lib/tax/deadline-config.ts conditions all require a concrete period).
* An empty deadlines query in that state means misconfiguration, not
* "no VAT duty", so the UI must prompt for the period instead of showing
* nothing.
* - null: not VAT-registered (no line), or VAT-registered with a period set
* but no upcoming row surfaced (transient or horizon gap; say nothing
* rather than guessing).
*/
export type VatDeadlineLine =
| { kind: 'date'; dueDate: string }
| { kind: 'missing_period' }
| null
export function vatDeadlineLine(input: {
vatRegistered: boolean | null | undefined
momsPeriod: MomsPeriod | null | undefined
nextVatDueDate: string | null | undefined
}): VatDeadlineLine {
if (!input.vatRegistered) return null
if (!input.momsPeriod) return { kind: 'missing_period' }
if (!input.nextVatDueDate) return null
return { kind: 'date', dueDate: input.nextVatDueDate }
}
/**
* Display ordinals for the setup checklist steps. Books and bank are always
* present; Skatteverket and the receipts/inbox step render only when their
* extensions are enabled; the assistant step is always last. `count` drives
* the "{count} steg så är bokföringen igång" title.
*/
export function checklistNumbers(gates: { hasSkatteverket: boolean; hasInbox: boolean }): {
count: number
skv: number
receipts: number
assistant: number
} {
const skv = 3
const receipts = 3 + (gates.hasSkatteverket ? 1 : 0)
const assistant = receipts + (gates.hasInbox ? 1 : 0)
return { count: assistant, skv, receipts, assistant }
}
/**
* Body of the PATCH that retires the checklist once every step is done.
* The route refuses `completed: true` without a path ("Välj först hur du
* vill komma igång"). `path` is null when the journey's books question was
* skipped and the books then arrived through /import or MCP; in that state
* step 1 can only be done via an import, so `migration` is the truthful path
* to record. Without it that cohort looped on a 400 (PR #2147 skeptic).
*/
export function completionPatchBody(
path: InitialSetupPath | null,
): { completed: true; path?: InitialSetupPath } {
return path ? { completed: true } : { completed: true, path: 'migration' }
}
/**
* Done-state for the "Anslut till Claude" step. The only thing that means
* "connected" is a live API key minted by the MCP OAuth token route: it
* exists exactly when a client (claude.ai, Claude Desktop, Claude Code)
* completed the first-call sign-in. `oauthKeyCount` is the head count of
* that user's unrevoked rows named by OAUTH_MCP_KEY_NAME (lib/auth/api-keys).
* Before issue #2133 the step ticked on the in-app AI-profile flag, which
* has nothing to do with Claude; the step could show done for a user who
* never connected and stay open for one who had.
*/
export function claudeStepDone(input: { oauthKeyCount: number | null | undefined }): boolean {
return (input.oauthKeyCount ?? 0) > 0
}
/**
* The claude.ai Add-custom-connector deep link the checklist's Claude step
* opens. Same shape as the Settings → API & MCP button: `tool_namespace` is
* load-bearing (without it the server hands out legacy `gnubok_` tool
* names), `client` is a telemetry-only distribution marker, and the origin
* comes from the page so self-hosted and white-label domains link to
* themselves. The link only prefills the dialog; the user reviews there.
*/
export function claudeConnectorLink(input: { origin: string; appName: string }): string {
const serverUrl = `${input.origin}/api/extensions/ext/mcp-server/mcp?tool_namespace=accounted&client=claude-connector`
return (
'https://claude.ai/customize/connectors?modal=add-custom-connector' +
`&connectorName=${encodeURIComponent(input.appName)}` +
`&connectorUrl=${encodeURIComponent(serverUrl)}`
)
}