Jakob Wennberg
19cbb0094b
The Dokumentinkorg (invoice-inbox) leaked past the paywall: visible in the sidebar, command palette, and home "Att gora" list, its page directly reachable, and every non-AI HTTP route open. Its whole value is AI field extraction (Claude Sonnet 4.6 via Bedrock), already the paid chokepoint elsewhere, so gate the whole surface on CAPABILITY.ai. - EXTENSION_REQUIRED_CAPABILITY map + resolvers (keys.ts, sectors.ts) as the single source the nav item, the page, and the API dispatcher all read. - Hide the sidebar item, command-palette entry, and home inbox row for non-payers; subtract inbox_document from the "Att gora" total via one shared visibleWorklistTotal helper (KPI tile + header cannot drift), clamped to >= 0. - Block the /e/[sector]/[slug] page (fail-closed) with an upsell EmptyState. - Enforce the capability in the extension API dispatcher (the single chokepoint that already enforces MFA), so every company-context inbox route 403s. The skipAuth /inbound webhook stays open (freeze-and-retain). - FORCE_PAYWALL=true override so the real gate is exercisable in local dev. - Tests: gating resolver, FORCE_PAYWALL, dispatcher 403/allow/webhook-exempt, visibleWorklistTotal, and enable-banking /connect + /sync 403. Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
78 lines
2.9 KiB
TypeScript
78 lines
2.9 KiB
TypeScript
import type { Sector, SectorSlug, ExtensionDefinition } from './types'
|
|
import { EXTENSION_DEFINITIONS } from './_generated/sector-definitions'
|
|
import { WORKSPACES } from './_generated/workspace-map'
|
|
import { requiredCapabilityForExtension } from '@/lib/entitlements/keys'
|
|
import type { CapabilityKey } from '@/lib/entitlements/keys'
|
|
|
|
// ============================================================
|
|
// Sector & Extension Registry
|
|
// ============================================================
|
|
//
|
|
// Sector shells are structural and always present.
|
|
// Extension definitions per sector come from the generated file
|
|
// (controlled by extensions.config.json).
|
|
// ============================================================
|
|
|
|
/** Sector shells: structural metadata, always available */
|
|
const SECTOR_SHELLS: Omit<Sector, 'extensions'>[] = [
|
|
{
|
|
slug: 'general',
|
|
name: 'Generella verktyg',
|
|
icon: 'Layers',
|
|
description: 'Verktyg som passar alla verksamheter',
|
|
},
|
|
]
|
|
|
|
/** Full sectors with extensions merged from generated definitions */
|
|
export const SECTORS: Sector[] = SECTOR_SHELLS.map(shell => ({
|
|
...shell,
|
|
extensions: EXTENSION_DEFINITIONS[shell.slug] ?? [],
|
|
}))
|
|
|
|
// ============================================================
|
|
// Helper functions
|
|
// ============================================================
|
|
|
|
export function getSector(slug: SectorSlug): Sector | undefined {
|
|
return SECTORS.find(s => s.slug === slug)
|
|
}
|
|
|
|
export function getExtensionDefinition(sectorSlug: string, extensionSlug: string): ExtensionDefinition | undefined {
|
|
const sector = SECTORS.find(s => s.slug === sectorSlug)
|
|
return sector?.extensions.find(e => e.slug === extensionSlug)
|
|
}
|
|
|
|
/**
|
|
* Paid capability an extension requires, resolved by its registry id (== slug).
|
|
* The API-route dispatcher keys off this so a paid extension is gated at the
|
|
* request chokepoint, reusing the same EXTENSION_REQUIRED_CAPABILITY map that
|
|
* hides its sidebar item and blocks its page (lib/entitlements/keys).
|
|
*/
|
|
export function requiredCapabilityForExtensionId(extensionId: string): CapabilityKey | undefined {
|
|
const ext = getAllExtensions().find(e => e.slug === extensionId)
|
|
return ext ? requiredCapabilityForExtension(ext.sector, ext.slug) : undefined
|
|
}
|
|
|
|
export function getAllExtensions(): ExtensionDefinition[] {
|
|
return SECTORS.flatMap(s => s.extensions)
|
|
}
|
|
|
|
export function getExtensionsBySector(slug: SectorSlug): ExtensionDefinition[] {
|
|
return getSector(slug)?.extensions ?? []
|
|
}
|
|
|
|
/** Extensions with a workspace and a quickAction href, for sidebar nav. */
|
|
export function getExtensionNavItems(): { href: string; label: string; icon: string }[] {
|
|
return getAllExtensions()
|
|
.filter(e => {
|
|
const key = `${e.sector}/${e.slug}`
|
|
return key in WORKSPACES && !!e.quickAction?.href
|
|
})
|
|
.sort((a, b) => (a.quickAction!.order ?? 0) - (b.quickAction!.order ?? 0))
|
|
.map(e => ({
|
|
href: e.quickAction!.href!,
|
|
label: e.quickAction!.label,
|
|
icon: e.quickAction!.icon,
|
|
}))
|
|
}
|