Jakob Wennberg
ec27228a8e
Em dashes (—) and en dashes (–) had spread across comments, docs, tests, and a few UI strings, reading as AI-generated boilerplate rather than house style. Replaced each with punctuation matching its context: colon for explanatory clauses, comma for asides, plain hyphen for numeric/legal ranges (e.g. "21-23§"), "to"/"till" for date ranges, parentheses for paired-dash asides. messages/en.json and messages/sv.json were fixed by hand together to keep sv/en in sync. Left untouched where the dash is the functional subject rather than decorative punctuation: date-range-parser.ts's separator regex, charset-repair.ts's CP1252 byte-mapping table (and its test), the SIE encoding mojibake docs, generic-csv.ts's minus-sign normalizer, the agent system-prompt files that already instruct against em dashes, and a golden iXBRL test fixture compared byte-for-byte. Also fixes two bugs surfaced along the way: an off-by-one in ApiKeysPanel's scope-label split (a leftover from an earlier partial pass), and a charset-repair test that had lost the literal en-dash it exists to verify. Regenerated the agent atom seed migration (skills:generate) since 27 SKILL.md files changed. Added a CLAUDE.md rule against em/en dashes, with an explicit carve-out for the functional-dash cases above. Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
61 lines
2.1 KiB
TypeScript
61 lines
2.1 KiB
TypeScript
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import { NextResponse } from 'next/server'
|
|
|
|
/**
|
|
* Sandbox guard: returns true if the given company is a sandbox company
|
|
* (`company_settings.is_sandbox = true`). Used to short-circuit API routes
|
|
* that would otherwise call paid external services (Anthropic Bedrock, the
|
|
* Resend email API, Riksbanken FX, VIES, Skatteverket, Enable Banking, TIC).
|
|
*
|
|
* The sandbox is intentionally read-only against external systems: it must
|
|
* never send a real email, charge a token, or speak to a tax authority on
|
|
* behalf of an anonymous demo user. RLS and the `is_sandbox` flag on
|
|
* company_settings are the single source of truth: we check it here on
|
|
* every gated entry point so the demo can't accidentally outgrow its sandbox.
|
|
*/
|
|
export async function isSandboxCompany(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
): Promise<boolean> {
|
|
const { data } = await supabase
|
|
.from('company_settings')
|
|
.select('is_sandbox')
|
|
.eq('company_id', companyId)
|
|
.maybeSingle()
|
|
return data?.is_sandbox === true
|
|
}
|
|
|
|
/**
|
|
* Standard 403 response for sandbox-blocked endpoints. The bilingual envelope
|
|
* matches the rest of the app's error shape: the UI picks the right field
|
|
* via the active locale.
|
|
*/
|
|
export function sandboxBlockedResponse(): NextResponse {
|
|
return NextResponse.json(
|
|
{
|
|
error: 'Inte tillgängligt i sandlådan. Skapa ett konto för att använda AI-assistenten och externa tjänster.',
|
|
error_en: 'Not available in the sandbox. Create an account to use the AI assistant and external services.',
|
|
sandbox_blocked: true,
|
|
},
|
|
{ status: 403 },
|
|
)
|
|
}
|
|
|
|
/**
|
|
* Convenience wrapper: check + return the 403 in one call. Returns the
|
|
* NextResponse to return from the route, or `null` when the company is not
|
|
* a sandbox and the route should proceed.
|
|
*
|
|
* const blocked = await guardSandbox(supabase, companyId)
|
|
* if (blocked) return blocked
|
|
*/
|
|
export async function guardSandbox(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
): Promise<NextResponse | null> {
|
|
if (await isSandboxCompany(supabase, companyId)) {
|
|
return sandboxBlockedResponse()
|
|
}
|
|
return null
|
|
}
|