Fix/critical issues (#351)

* fix: add 15s timeout to accounting provider HTTP clients

Node's built-in fetch has no default timeout, so a stalled provider
could hold a serverless worker open for many minutes — worse with
withRetry (6x on Fortnox, 3x on others) and getPaginated stacking
across pages.

Wrap each fetch() in the Fortnox, Visma, Bokio, Briox, and Björn
Lundén clients with signal: AbortSignal.timeout(15_000), and treat
TimeoutError/AbortError as retryable so a single stalled attempt
retries cleanly instead of hanging the request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: add timeouts to OAuth token endpoints

Wrap every OAuth2 token exchange, refresh, and revoke POST in an
AbortController via a new fetchWithTimeout helper. Without this, a
hung provider endpoint holds the request thread indefinitely — worst
case being Skatteverket, where refreshAccessToken sits on the hot
path of every bookkeeping action and exchangeCodeForTokens races the
5-minute BankID auth-code TTL.

On timeout, the Skatteverket OAuth callback now redirects to
/reports?tab=vat-declaration with a Swedish retry message instead
of leaving the user stranded on the callback URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: close RLS escalation on membership and settings tables

Any authenticated user who was a member (including viewer) could issue a
direct PostgREST PATCH against company_members and promote themselves to
owner, bypassing the app-layer requireWritePermission guard entirely.
Reproduced on prod, then verified the fix on staging.

Tighten INSERT/UPDATE/DELETE policies on company_members, team_members,
api_keys, company_invitations, team_invitations, companies, teams, and
company_settings to require the caller to hold role IN ('owner','admin')
in the target company/team. Role check is wrapped in SECURITY DEFINER
helpers (user_is_company_admin, user_is_team_admin, user_role_in_company)
to avoid RLS recursion when a policy on company_members references
company_members in its subquery.

Add a BEFORE UPDATE trigger on company_members that rejects any role
change unless the caller already holds role='owner', so admins cannot
mint further owners even though they can otherwise write.

Legitimate write paths are unaffected: company creation goes through the
create_company_with_owner SECURITY DEFINER RPC, invite acceptance uses
the service role, and team->company membership syncs via SECURITY
DEFINER triggers. All bypass RLS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(migrations): resolve duplicate schema_migrations version 20260421160000

Two migration files shared timestamp 20260421160000 on main
(booking_template_usage.sql and opening_balances_rpc.sql), causing
supabase_migrations.schema_migrations PK collisions on any fresh CI run:

  duplicate key value violates unique constraint "schema_migrations_pkey"
  Key (version)=(20260421160000) already exists.

Bump opening_balances_rpc.sql to 20260421160500. booking_template_usage
keeps 20260421160000 because its table already exists on prod; the
renamed file has an idempotent CREATE OR REPLACE FUNCTION body and has
not yet been deployed to prod, so moving its version is free.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(migrations): make booking_template_usage migration idempotent

The table already exists on prod (applied out-of-band) but prod's
schema_migrations does not track version 20260421160000, so the next
PR-driven deploy would re-run this migration and fail on
`CREATE TABLE public.booking_template_usage` with a duplicate-relation
error.

Add IF NOT EXISTS to CREATE TABLE and CREATE INDEX, and DROP POLICY
IF EXISTS before each CREATE POLICY. No functional change on fresh
databases; prod just silently no-ops the table/index creates and
re-declares policies without dropping-then-missing them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: implement isTimeoutError utility and enforce role restrictions on company_members insert

* fix: implement fallback for user_id in commit_journal_entry function when auth.uid() is NULL

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

extensions/general/cloud-backup/lib/google-oauth.ts

@@ -7,6 +7,12 @@
  *   re-issued even if the user has previously authorised the app.
  */
 
+import {
+  fetchWithTimeout,
+  OAUTH_TIMEOUT_MS,
+  OAUTH_REVOKE_TIMEOUT_MS,
+} from '@/lib/http/fetch-with-timeout'
+
 const DRIVE_SCOPE = 'https://www.googleapis.com/auth/drive.file'
 const AUTH_ENDPOINT = 'https://accounts.google.com/o/oauth2/v2/auth'
 const TOKEN_ENDPOINT = 'https://oauth2.googleapis.com/token'
@@ -65,11 +71,15 @@ export async function exchangeCodeForTokens(
     redirect_uri: env.redirectUri,
     grant_type: 'authorization_code',
   })
-  const res = await fetch(TOKEN_ENDPOINT, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: body.toString(),
-  })
+  const res = await fetchWithTimeout(
+    TOKEN_ENDPOINT,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+    },
+    { timeoutMs: OAUTH_TIMEOUT_MS, description: 'Google token exchange' },
+  )
   if (!res.ok) {
     const errText = await res.text()
     throw new Error(`Google token exchange failed: ${res.status} ${errText}`)
@@ -99,11 +109,15 @@ export async function refreshAccessToken(
     refresh_token: refreshToken,
     grant_type: 'refresh_token',
   })
-  const res = await fetch(TOKEN_ENDPOINT, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-    body: body.toString(),
-  })
+  const res = await fetchWithTimeout(
+    TOKEN_ENDPOINT,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      body: body.toString(),
+    },
+    { timeoutMs: OAUTH_TIMEOUT_MS, description: 'Google token refresh' },
+  )
   if (!res.ok) {
     const errText = await res.text()
     throw new Error(`Google token refresh failed: ${res.status} ${errText}`)
@@ -112,16 +126,28 @@ export async function refreshAccessToken(
 }
 
 export async function revokeToken(token: string): Promise<void> {
-  await fetch(`https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(token)}`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
-  })
+  try {
+    await fetchWithTimeout(
+      `https://oauth2.googleapis.com/revoke?token=${encodeURIComponent(token)}`,
+      {
+        method: 'POST',
+        headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+      },
+      { timeoutMs: OAUTH_REVOKE_TIMEOUT_MS, description: 'Google token revoke' },
+    )
+  } catch {
+    // Best-effort revoke: swallow timeouts and network errors so disconnect flows still complete locally.
+  }
 }
 
 export async function fetchUserEmail(accessToken: string): Promise<string> {
-  const res = await fetch(USERINFO_ENDPOINT, {
-    headers: { Authorization: `Bearer ${accessToken}` },
-  })
+  const res = await fetchWithTimeout(
+    USERINFO_ENDPOINT,
+    {
+      headers: { Authorization: `Bearer ${accessToken}` },
+    },
+    { timeoutMs: OAUTH_TIMEOUT_MS, description: 'Google userinfo fetch' },
+  )
   if (!res.ok) {
     throw new Error(`Failed to fetch Google user info: ${res.status}`)
   }

extensions/general/skatteverket/index.ts

@@ -1,6 +1,7 @@
 import crypto from 'crypto'
 import type { Extension, ExtensionContext } from '@/lib/extensions/types'
 import { NextResponse } from 'next/server'
+import { TimeoutError } from '@/lib/http/fetch-with-timeout'
 import { buildAuthorizeUrl, exchangeCodeForTokens } from './lib/oauth'
 import { storeTokens, getTokens, deleteTokens } from './lib/token-store'
 import { skvRequest, SkatteverketAuthError } from './lib/api-client'
@@ -162,10 +163,15 @@ export const skatteverketExtension: Extension = {
           )
         } catch (err) {
           console.error('[skatteverket] Token exchange failed:', err)
+          // BankID auth codes expire after 5 minutes. Surface timeouts distinctly
+          // so the user retries quickly instead of exhausting the code window.
+          const message = err instanceof TimeoutError
+            ? 'Tidsgränsen mot Skatteverket överskreds — försök igen med BankID'
+            : err instanceof Error
+              ? err.message
+              : 'Token exchange misslyckades'
           return NextResponse.redirect(
-            `${appUrl}/reports?tab=vat-declaration&skv_error=${encodeURIComponent(
-              err instanceof Error ? err.message : 'Token exchange misslyckades'
-            )}`
+            `${appUrl}/reports?tab=vat-declaration&skv_error=${encodeURIComponent(message)}`
           )
         }
       },

extensions/general/skatteverket/lib/oauth.ts

@@ -1,4 +1,9 @@
 import type { SkatteverketTokens } from '../types'
+import {
+  fetchWithTimeout,
+  OAUTH_TIMEOUT_MS,
+  SKATTEVERKET_EXCHANGE_TIMEOUT_MS,
+} from '@/lib/http/fetch-with-timeout'
 
 /**
  * Skatteverket OAuth2 helpers for the `per` (BankID) flow.
@@ -68,11 +73,18 @@ export async function exchangeCodeForTokens(
     code,
   })
 
-  const response = await fetch(`${base}/token`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
-    body: body.toString(),
-  })
+  const response = await fetchWithTimeout(
+    `${base}/token`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
+      body: body.toString(),
+    },
+    {
+      timeoutMs: SKATTEVERKET_EXCHANGE_TIMEOUT_MS,
+      description: 'Skatteverket token exchange',
+    },
+  )
 
   if (!response.ok) {
     const text = await response.text()
@@ -110,11 +122,18 @@ export async function refreshAccessToken(
     refresh_token: refreshToken,
   })
 
-  const response = await fetch(`${base}/token`, {
-    method: 'POST',
-    headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
-    body: body.toString(),
-  })
+  const response = await fetchWithTimeout(
+    `${base}/token`,
+    {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/x-www-form-urlencoded;charset=UTF-8' },
+      body: body.toString(),
+    },
+    {
+      timeoutMs: OAUTH_TIMEOUT_MS,
+      description: 'Skatteverket token refresh',
+    },
+  )
 
   if (!response.ok) {
     const text = await response.text()