Jakob Wennberg
c74b19df1b
* feat(reconciliation): close the bank-feed loop on voucher links and re-tag mis-typed opening balances
Two related fixes to bank reconciliation correctness:
1. Auto-reconcile on voucher link. Linking an invoice or supplier invoice to
an existing voucher previously advanced only the invoice — the bank
transaction that paid it kept sitting in the Transactions inbox with a null
journal_entry_id. linkInvoiceToVoucher / linkSupplierInvoiceToVoucher now
call autoReconcileTransactionForLinkedVoucher (lib/reconciliation), which
links the bank transaction to the same verifikat when exactly one unbooked
line matches it. Best-effort and post-commit: a failure here never fails the
link. The result surfaces reconciledTransactionId; the inbox row leaves the
list and the UI shows link_success_tx_reconciled.
2. Re-tag mis-typed opening balances. getReconciliationStatus and the GL-line
matching RPCs identify a cash account's ingående balans solely by
journal_entries.source_type='opening_balance'. Companies migrated from other
systems often booked the bank IB as an ordinary voucher (source_type
'import' or 'manual'), so it was never excluded and surfaced as a phantom
reconciliation difference equal to the opening balance. Adds:
- migration mark_entry_as_opening_balance: a GUC-gated carve-out in the
immutability trigger plus a SECURITY DEFINER RPC that validates the entry
(balance-sheet lines only, dated on a fiscal-period boundary), flips the
source_type, and writes an audit row — no blanket data sweep.
- POST /api/reconciliation/bank/mark-opening-balance + MarkOpeningBalanceSchema.
- BankReconciliationView action to trigger it from the IB diff.
The gnubok_create_voucher executor now accepts a typed is_opening_balance flag
and derives source_type='opening_balance' only after validating class 1/2 lines
on the period start, so new IBs land correctly typed.
Covered by lib/reconciliation auto-reconcile tests, voucher-executors tests,
and a mark-entry-as-opening-balance pg-real test.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore: rebrand gnubok → Accounted and prune swarm agent skills
Product rebrand and skills housekeeping. No runtime behaviour change.
Rebrand: replace user-visible "gnubok" with "Accounted" across docs, READMEs,
in-code comments, doc-site content, MCP skill/resource prose, and the
gnubok-mcp package description. The MCP resource URI scheme is moved gnubok://
→ Accounted:// consistently across resource registrations, the event-type
comment, and the resource/skill tests. Deliberately preserved as stable
identifiers (NOT rebranded): the gnubok-company-id cookie, gnubok_sk_ / gnubok_inv_
token prefixes, the gnubok-mcp npm bridge name, and the AGI <gem:Programnamn>
value (kept 'gnubok' per its source comment — it is the software identifier sent
to Skatteverket and must not churn across visual rebrands).
Skills: remove the 27 swarm-* agent SKILL.md atoms (no longer used; already
absent from the agent_atom_registry in prod), refresh the remaining skill docs,
add the .claude/rules/ path-scoped rule set, and regenerate the
seed_agent_atom_bodies migration + .skill-body-manifest.json via
`npm run skills:generate` so the DB-backed skill bodies match the trimmed set.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
57 lines
2.5 KiB
TypeScript
57 lines
2.5 KiB
TypeScript
/**
|
|
* Common security headers for public v1 responses.
|
|
*
|
|
* Applied to discovery routes (`/llms.txt`, `/.well-known/skills/index.json`,
|
|
* `/api/v1/openapi.json`) that bypass the auth wrapper.
|
|
*
|
|
* The wrapped routes don't need these explicitly: NextResponse's defaults +
|
|
* the auth wrapper's stamping cover them. Public routes are an exception
|
|
* because they're plain `NextResponse.json/text` returns with caching.
|
|
*
|
|
* X-Content-Type-Options: nosniff — block MIME sniffing on text/json
|
|
* Referrer-Policy: strict-origin... — limit referrer leakage if a link is
|
|
* embedded somewhere unexpected
|
|
* X-Frame-Options: DENY — discovery surfaces should never
|
|
* legitimately render in a frame
|
|
*/
|
|
|
|
/**
|
|
* Headers applied to BOTH public discovery routes and authenticated v1
|
|
* responses. Includes CSP, HSTS, and frame/sniff/referrer protections, but
|
|
* NOT X-Robots-Tag — discovery routes (llms.txt, skills index, OpenAPI)
|
|
* exist to be crawled by AI agents; authenticated routes get an additional
|
|
* X-Robots-Tag at the wrapper level via WRAPPED_RESPONSE_NOAI_HEADERS.
|
|
*/
|
|
export const PUBLIC_SECURITY_HEADERS: Record<string, string> = {
|
|
'X-Content-Type-Options': 'nosniff',
|
|
'Referrer-Policy': 'strict-origin-when-cross-origin',
|
|
'X-Frame-Options': 'DENY',
|
|
// Discovery routes return JSON or plain text — no script, style, image, or
|
|
// form contexts. `default-src 'none'` is the strictest possible CSP and
|
|
// costs nothing here.
|
|
'Content-Security-Policy': "default-src 'none'; frame-ancestors 'none'",
|
|
// HSTS — every Accounted deployment is HTTPS-only. 1 year is the standard
|
|
// production value; includeSubDomains because the apex serves everything.
|
|
'Strict-Transport-Security': 'max-age=31536000; includeSubDomains',
|
|
}
|
|
|
|
/**
|
|
* Additional headers applied ONLY to authenticated v1 responses. AI bots
|
|
* that respect X-Robots-Tag (Claude, ChatGPT, Perplexity, Google-Extended)
|
|
* will skip these payloads for training; others will ignore the hint.
|
|
* Public discovery routes deliberately omit this so they remain
|
|
* AI-discoverable.
|
|
*/
|
|
export const WRAPPED_RESPONSE_HEADERS: Record<string, string> = {
|
|
...PUBLIC_SECURITY_HEADERS,
|
|
'X-Robots-Tag': 'noai, noimageai',
|
|
}
|
|
|
|
/**
|
|
* Merge the public security headers onto an arbitrary header dict so callers
|
|
* can keep their own Content-Type / Cache-Control entries.
|
|
*/
|
|
export function withPublicSecurityHeaders(extra: Record<string, string> = {}): Record<string, string> {
|
|
return { ...PUBLIC_SECURITY_HEADERS, ...extra }
|
|
}
|