* feat(mileage): körjournal with milersättning booking, MCP tools and CSV export
New mileage_trips table (RLS, booked-delete trigger per BFL retention),
lib/mileage service reusing the payroll schablon rates, /api/mileage routes
(trips CRUD, period booking to 7331, salary-run push, körjournal CSV),
Körjournal dashboard page + nav, and three staged MCP tools (search-only
catalog). Trips book as one verifikat per period via the engine; salary
path inserts mileage_taxfree line items. mileage_trips classified in the
full-archive export.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* refactor(mileage): use shared roundOre helper per tightened ratchet baseline
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mileage): pending_operations op-type migration + Swedish review findings
- New migration pair adds log_mileage_trip/book_mileage_period to the
pending_operations operation_type CHECK (pg-real audit).
- bookMileagePeriod refuses a period spanning several employees and names
the employee in the verifikationstext when scoped (BFL motpart).
- vehicle_registration required for förmånsbil trips (schema, service,
MCP staging, UI surfaces the field).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mileage): claim-first booking, CSV injection guard and driver column
- bookMileagePeriod claims trips (draft to booked CAS) before creating the
verifikat, so a concurrent second booking loses the race instead of
double-booking; claim reverts if verifikat creation fails.
- Körjournal CSV neutralizes formula-injection triggers (OWASP) and adds a
Förare column naming the employee per trip.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mileage): resolve CodeRabbit + Swedish review round: race, drift and hardening
- Copying a round trip no longer re-doubles the stored distance.
- pushMileageToSalaryRun claims trips before inserting line items (retry can
no longer double-pay); CLAIM_LOST replaces misleading NO_TRIPS on lost races.
- Booked trips are DB-immutable via a BEFORE UPDATE trigger (new migration
20260807113215): only claim/link/revert transitions and notes edits pass.
- Cross-year periods rejected (schablon rates are per calendar year); payroll
config year read from the date string, not TZ-dependent getFullYear().
- MCP staged bookings freeze the previewed trip set (trip_ids in params) and
the commit fails on drift; validation errors return 400, not 500.
- PATCH enforces the förmånsbil regnr rule on the effective row; export
validates dates before they reach the Content-Disposition header; employee_id
is verified company-scoped on trip creation; stale orphaned claims released.
- UI: fetch flags reset in finally; ICU plural for draft summary; distance
stored at the column's 1-decimal precision.
- Tests: [id] route suite, pushMileageToSalaryRun suite, claim-race, drift,
cross-year and update-trigger pg cases.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mileage): revert-to-draft must clear salary_run_id at the trigger level
New migration 20260807114924 replaces the booked-immutability function: a
booked -> draft revert now rejects rows keeping salary_run_id, closing the
DB-level double-pay path CodeRabbit flagged. pg test pins both directions;
the CLAIM_LOST unit test now asserts the revert.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(mileage): company-scope employee_id on PATCH (Superagent P2)
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* test(mileage): valid v4 uuid in cross-company employee PATCH test
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(providers): surface migration step errors instead of silent empty syncs
A Visma company without the API module activated (403 ErrorCode 4002,
"No access to module: api_standard") failed every provider call during
migration, yet the wizard reported success with zero rows and mapped the
403 to "reconnect", which loops forever since OAuth succeeds against
Visma's shared identity server. A real user burned time re-syncing and
reconnecting, then filed the config issue as a bug.
- New PROVIDER_API_MODULE_INACTIVE code; classifyProviderError reads the
error body and recognizes the module error before the 403 to
AUTH_EXPIRED mapping. Registry entry carries the remediation in
Swedish and English (activate the API under Appar och tillagg, paid
add-on on smaller plans, clear standardforetag, SIE fallback).
- Orchestrator: connection-level failures (auth expired, license
missing, module inactive) rethrow and abort the doomed run so /migrate
answers with the typed code; other step failures stay non-fatal but
land on results.stepErrors instead of only in server logs.
- /preview fails fast on the two subscription codes so the user reads
the remediation at connect time, before any sync.
- Wizard: preview treats the new code like the Fortnox license case
(CTA + SIE fallback); the result step renders error cards per cause
and says "Migrering delvis genomford" instead of "Allt ar uppdaterat";
the completion toast is honest on partial failure.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(ink2): SRU field 1.1 is 7104, not 7113 (Skatteverket rejects 7113)
The INK2 huvudblankett code for 1.1 Overskott av naringsverksamhet is
7104 per Skatteverket's official 2025P4 faltkoder (INK2_SKV2002-33-01-24-04).
We emitted 7113, which does not exist on INK2, so filoverforing rejected
every profitable company's BLANKETTER.SRU with 'UPPGIFT 7113 ar inte ett
giltigt postnamn' (reported by a user for FY 2024-10-07..2025-12-31).
Underskott (7114) was already correct.
The wrong code originated in the swedish-sru-filing skill reference;
fixed there too and regenerated the atom seed. All other emitted
INK2/INK2R/INK2S codes verified against the official 2025P4 lists.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(invoices): keep the AI chat usable over the new-invoice dialog
The new-invoice dialog was a modal Radix dialog: modal mode sets body
pointer-events: none, aria-hidden on body siblings, and a focus trap, so
the agent sheet (z-60, painted above the dialog) was visible but dead:
clicks swallowed, input unfocusable, and all three dismiss paths
preventDefaulted, leaving no way out except the header X.
Now non-modal: page modality is restored by hand instead. A new
DialogVeil primitive supplies the backdrop (Radix renders no overlay in
non-modal mode) at z-40, under dialog content (z-50) and the agent sheet
(z-60), and inert on #dash-shell blocks pointer, keyboard, and AT access
to the page behind while the sheet (a body-level sibling) stays live.
The lazy-load fallback dialog on /invoices gets the same treatment so a
hung or 404'd chunk cannot dead-lock the route.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Mattsson
39f4ecdad4