books/backend/Books.Api/Domain/Attachments/Events/AttachmentEvents.cs
Nicolaj Hartmann 709d0a4739 Audit v2: fix security, data integrity, compliance, bugs, encoding, UX
Backend Security & Data Integrity:
- Block negative debit/credit amounts that bypass balance validation
- Require document date at posting (was optional, bypassing fiscal year checks)
- Fix event sourcing anti-pattern: timestamps now stored in events, not UtcNow in Apply
- Add [Authorize] to BankingController OAuth callback
- Add company access check on attachment downloads
- Validate CVR in CompanyAggregate.Create and CompanyAggregate.Update
- Require company CVR for invoice creation (Momsloven §52)
- Delete leftover WeatherForecastController
- Fix duplicate migration number 007 (renamed to 007b)
- Remove dead code in VatCalculationService (identical if/else branches)

Accounting Compliance:
- Add missing VAT accounts to StandardDanishAccounts (5610, 5611, 5620)
- Populate SAF-T TaxInformation on transaction lines (was always null)
- Add AuditFileCountry and TaxRegistrationNumber to SAF-T header

Critical Frontend Bugs:
- Fix Dashboard <a href> causing full page reloads (now uses React Router Link)
- Wire Kassekladde filters to actual data (account, status, date range)
- Pre-populate form when editing existing Kassekladde drafts
- Add detail drawer for "Vis detaljer" action (was just a toast)
- Toggle advanced filters with "Flere filtre" button
- CloseFiscalYearWizard now actually posts closing entries via mutations
- "Create next year" checkbox now creates the next fiscal year

Danish Character Encoding (~50 fixes):
- Fix ø/æ/å across Momsindberetning, DocumentUploadModal, Bankafstemning,
  Kontooversigt, CloseFiscalYearWizard, vatCodes, periodStore, periods,
  accounting, types/periods

Dead Buttons & UX:
- Disable Momsindberetning PDF/Export buttons with tooltips
- FiscalYearSelector "Administrer" now navigates to Settings
- Settings bank tab now uses real BankConnectionsTab component
- Bankafstemning save button disabled with development tooltip
- Replace hardcoded account options with real API data (Bankafstemning, Fakturaer)
- Header help button shows info message, notification bell shows popover

Consistency & Quality:
- Remove 7 console.log statements from production code
- Adopt PageHeader on 6 remaining pages (Kreditnotaer, Settings, Admin, etc.)
- Standardize loading states to Skeleton pattern (5 pages)
- Replace deprecated bodyStyle prop on Ant Design Cards
- Standardize date format to DD-MM-YYYY
- Fix sidebar width mismatch in designTokens
- Fix Kontooversigt breadcrumb pointing to non-existent route

Accessibility:
- Add aria-label to sidebar navigation
- Add +/- prefix to AmountText for color-blind users
- Fix CompanySwitcher permanent skeleton when no companies

Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-02-06 00:18:19 +01:00

86 lines
2.5 KiB
C#

using EventFlow.Aggregates;
namespace Books.Api.Domain.Attachments.Events;
/// <summary>
/// Event raised when an attachment (bilag) is uploaded.
/// Required by Bogføringsloven § 6 for document retention.
/// </summary>
public class AttachmentUploadedEvent(
string companyId,
string fileName,
string originalFileName,
string contentType,
long fileSize,
string storagePath,
string uploadedBy,
DateTimeOffset uploadedAt,
string? draftId = null,
string? transactionId = null) : AggregateEvent<AttachmentAggregate, AttachmentId>
{
public string CompanyId { get; } = companyId;
/// <summary>
/// Stored filename (sanitized/unique).
/// </summary>
public string FileName { get; } = fileName;
/// <summary>
/// Original filename as uploaded by user.
/// </summary>
public string OriginalFileName { get; } = originalFileName;
/// <summary>
/// MIME type (e.g., application/pdf, image/png).
/// </summary>
public string ContentType { get; } = contentType;
/// <summary>
/// File size in bytes.
/// </summary>
public long FileSize { get; } = fileSize;
/// <summary>
/// Path to the stored file (local path or blob URL).
/// </summary>
public string StoragePath { get; } = storagePath;
public string UploadedBy { get; } = uploadedBy;
/// <summary>
/// Timestamp when the attachment was uploaded.
/// </summary>
public DateTimeOffset UploadedAt { get; } = uploadedAt;
/// <summary>
/// Optional reference to journal entry draft.
/// </summary>
public string? DraftId { get; } = draftId;
/// <summary>
/// Optional reference to posted transaction.
/// </summary>
public string? TransactionId { get; } = transactionId;
}
/// <summary>
/// Event raised when an attachment is linked to a transaction after posting.
/// </summary>
public class AttachmentLinkedToTransactionEvent(
string transactionId) : AggregateEvent<AttachmentAggregate, AttachmentId>
{
public string TransactionId { get; } = transactionId;
}
/// <summary>
/// Event raised when an attachment is deleted.
/// Note: Per Bogføringsloven § 6, attachments should be retained for 5 years.
/// This event is for administrative cleanup only.
/// </summary>
public class AttachmentDeletedEvent(
string deletedBy,
string reason) : AggregateEvent<AttachmentAggregate, AttachmentId>
{
public string DeletedBy { get; } = deletedBy;
public string Reason { get; } = reason;
}