Files
accounted/components/bookkeeping/ActivateAccountsDialog.tsx
T
Mattsson f8db38f989 fix(analytics): mask session replays by default, chrome-only unmask (#1639)
* fix(analytics): mask session replays by default, chrome-only unmask

Invert PostHog session-replay masking from visible-by-default with pattern
masking to deny-by-default: every input value is masked wholesale (rrweb
maskAllInputs, no maskInputFn) and every text node is masked unless it sits
under data-ph-unmask chrome or a table column header (th). Chrome tags live
on the shared UI primitives (PageHeader, Label, Button except combobox
triggers, TabsTrigger, Badge, Card/Dialog/Sheet titles, tooltips, help
popovers, empty states, settings labels), and tagged chrome is still
pattern-scrubbed for amounts and person-/organisationsnummer. data-ph-mask
beats data-ph-unmask, so call sites that interpolate user data into chrome
stay masked; a very-thorough audit swept every unmasked primitive and each
found site got a call-site mask. Confirm-dialog wrappers and toasts stay
masked centrally: their copy describes user objects by design. Untagged new
UI over-masks instead of leaking. Privacy policy, RoPA and decision log
updated in the same change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): tag detail-section chrome merged from main

The register-detail primitives landed on main after the replay-masking
audit ran: kickers and DefRow labels are static i18n chrome, values stay
masked.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(analytics): close skeptic and review findings on replay masking

Explicit data-ph tags now resolve before the th chrome fallback, so a th
nested inside a data-ph-mask container masks correctly (regression test
added). Seven missed text-leak sites get call-site masks: delete-invoice
and credit-page invoice numbers, IB-correction voucher reference, TIC
orgnr (served unnormalized, so the separator-based scrub cannot be relied
on), articles search-term empty state, dimension segment labels, and
activate-account buttons. The attribute channel is closed with rrweb's
blockClass: inputs whose placeholder carries an effective user value
(salary overrides, correction description, danger-zone confirms, credit
confirm) get ph-no-capture, removing the element from recordings while
the prefill UX stays intact; the pivot-th title attribute is dropped.
Privacy-policy effective date bumped to 2026-08-17.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-17 11:32:45 +02:00

182 lines
6.0 KiB
TypeScript

'use client'
import { useEffect, useState } from 'react'
import {
Dialog,
DialogContent,
DialogHeader,
DialogTitle,
DialogDescription,
DialogFooter,
} from '@/components/ui/dialog'
import { Button } from '@/components/ui/button'
import { Loader2, Plus } from 'lucide-react'
export interface ActivateAccountsDialogProps {
open: boolean
accountNumbers: string[]
onConfirm: () => Promise<void> | void
onCancel: () => void
// Optional: invoked when the user wants to create a custom (non-BAS) account
// for a number that isn't in the BAS catalogue. The host should close this
// dialog and open AddAccountDialog prefilled with the number.
onCreateUnknown?: (accountNumber: string) => void
// Confirm button label. Defaults to the bookkeeping wording; non-booking
// hosts (e.g. the article register) pass their own.
confirmLabel?: string
}
interface BasLookupRow {
account_number: string
account_name: string | null
known: boolean
// Present since the lookup learned about the company's own chart: an account
// that is in_chart but not is_active is being reactivated, not added.
in_chart?: boolean
is_active?: boolean
}
export function ActivateAccountsDialog({
open,
accountNumbers,
onConfirm,
onCancel,
onCreateUnknown,
confirmLabel,
}: ActivateAccountsDialogProps) {
const [rows, setRows] = useState<BasLookupRow[]>([])
const [loading, setLoading] = useState(false)
const [submitting, setSubmitting] = useState(false)
useEffect(() => {
if (!open || accountNumbers.length === 0) return
let cancelled = false
setLoading(true)
fetch(`/api/bookkeeping/accounts/bas-lookup?numbers=${encodeURIComponent(accountNumbers.join(','))}`)
.then((r) => r.json())
.then((body) => {
if (cancelled) return
setRows((body?.data as BasLookupRow[]) || [])
})
.catch(() => {
if (cancelled) return
setRows(
accountNumbers.map((n) => ({
account_number: n,
account_name: null,
known: false,
in_chart: false,
is_active: false,
})),
)
})
.finally(() => {
if (!cancelled) setLoading(false)
})
return () => {
cancelled = true
}
}, [open, accountNumbers])
const knownRows = rows.filter((r) => r.known)
const unknownRows = rows.filter((r) => !r.known)
// Disable confirm when any entered number isn't a valid BAS account: activating
// only the knowns would leave the unknowns to fail again on retry.
const canConfirm = knownRows.length > 0 && unknownRows.length === 0 && !submitting
async function handleConfirm() {
setSubmitting(true)
try {
await onConfirm()
} finally {
setSubmitting(false)
}
}
return (
<Dialog open={open} onOpenChange={(next) => { if (!next) onCancel() }}>
<DialogContent className="sm:max-w-md">
<DialogHeader>
<DialogTitle>Aktivera konton</DialogTitle>
<DialogDescription>
{knownRows.length > 0
? 'Följande konton behöver aktiveras i din kontoplan innan bokföringen kan slutföras.'
: 'Inga giltiga BAS-konton att aktivera.'}
</DialogDescription>
</DialogHeader>
<div className="space-y-2 text-sm">
{loading && (
<div className="flex items-center gap-2 text-muted-foreground">
<Loader2 className="h-4 w-4 animate-spin" />
Hämtar kontouppgifter...
</div>
)}
{!loading && knownRows.length > 0 && (
<ul className="divide-y divide-border rounded-lg border">
{knownRows.map((r) => (
<li key={r.account_number} className="flex items-baseline gap-3 px-3 py-2">
<span className="font-mono text-foreground w-14 shrink-0">{r.account_number}</span>
<span className="truncate">{r.account_name}</span>
{r.in_chart && !r.is_active && (
<span className="ml-auto shrink-0 text-xs text-muted-foreground">
Aktiveras igen
</span>
)}
</li>
))}
</ul>
)}
{!loading && unknownRows.length > 0 && (
<div className="rounded-lg border border-border bg-muted/30 px-3 py-2 text-xs text-attn">
<p className="font-medium">Finns inte i BAS-katalogen:</p>
<p className="mt-1 font-mono">{unknownRows.map((r) => r.account_number).join(', ')}</p>
<p className="mt-1 text-attn/80">
Skapa dem som egna konton, eller kontrollera inmatningen.
</p>
{onCreateUnknown && (
<div className="mt-2 flex flex-wrap gap-1.5">
{unknownRows.map((r) => (
<Button
key={r.account_number}
type="button"
variant="outline"
size="sm"
className="h-8 text-xs"
onClick={() => onCreateUnknown(r.account_number)}
>
<Plus className="mr-1 h-3 w-3" />
Skapa <span data-ph-mask="">{r.account_number}</span>
</Button>
))}
</div>
)}
</div>
)}
</div>
<DialogFooter>
<Button variant="outline" onClick={onCancel} disabled={submitting}>
Avbryt
</Button>
<Button onClick={handleConfirm} disabled={!canConfirm}>
{submitting ? (
<>
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
Aktiverar...
</>
) : (
<>
<Plus className="mr-2 h-4 w-4" />
{confirmLabel ?? 'Aktivera och bokför'}
</>
)}
</Button>
</DialogFooter>
</DialogContent>
</Dialog>
)
}