fix(settings): scope cross-field VAT validations to saves that touch them (#2121)

* fix(settings): scope cross-field VAT validations to saves that touch them

The settings PUT validated the whole effective record on every partial
update, so companies stored as vat_registered without a vat_number were
blocked from saving anything through the endpoint, including the invoice
bank-details dialog, which has no VAT fields (reported by a user stuck on
"Momsregistreringsnummer kravs...").

Each cross-field check (VAT completeness, 40m-monthly, periodisk
sammanstallning) now runs only when the request body touches a field in
its group, so the invariant still holds whenever VAT config is edited.
Explicit null now counts as clearing a value during validation instead of
falling back to the stored one, closing a latent hole where
{ vat_number: null } passed validation but wrote null.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fjJLUucErb1ZHyQ57fe1u

* fix(invoices): gate issuance on the seller VAT number (skeptic finding)

The settings scoping in the previous commit removed what was accidentally
the only enforcement of "momsregistrerad implies momsregnr on file": with
bank details saveable again, a registered company without a stored VAT
number could issue a faktura charging moms with no seller VAT number in
the footer (mandatory element, ML (2023:200) 17 kap. 24 §).

Issuance is now gated the same way the payment account is, at all four
independent issuance points (issueAndBookInvoice, dashboard send, v1 send,
v1 mark-sent), with a structured error pointing at Installningar -> Skatt.
Credit notes, proformas, and delivery notes are exempt like the payment
gate exempts them.

Also, per the Swedish review and the secondary skeptic finding:
- PS/EU-trade edits join the VAT-completeness touch group, so enabling
  periodisk sammanstallning on an incomplete registration keeps failing.
- The stale ML 11 kap. 8 citation is updated to ML 17 kap. 24.

The makeCompanySettings fixture now models a coherent registered company
(vat_number set); the missing-number tests override it explicitly.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fjJLUucErb1ZHyQ57fe1u

* fix(invoices): extend the seller-VAT-number gate to the headless issuance paths

Skeptic round 2 found three more issuance points beside the four gated in
the previous commit: the recurring auto-send service (cron, no human in
the loop), and the MCP staged-operation executors send_invoice and
mark_invoice_sent. Each carried the payment-account gate but not the VAT
gate; mark_invoice_sent additionally had a narrow settings select that
would have made a naive gate silently pass, now widened.

Recurring auto-send fails soft, matching its other guards: the invoice
stays a numbered draft with the standard schedule warning. The executors
return the structured Swedish message. Peppol send was verified
self-gating (BIS preflight requires the supplier VAT number).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fjJLUucErb1ZHyQ57fe1u

* test(email): refresh brand-mail snapshots for the coherent VAT fixture

The makeCompanySettings fixture now carries a VAT number, so the invoice
and reminder mail footers correctly render the VAT line; the snapshots
predate that. Also cites ML 17 kap. 22-23 (andringsfaktura content list)
in the seller-vat-number docstring per the Swedish review suggestion,
documenting why credit notes are exempt. No behavior change.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_016fjJLUucErb1ZHyQ57fe1u

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/invoices/__tests__/issue-and-book-invoice.test.ts

@@ -126,6 +126,30 @@ describe('issueAndBookInvoice', () => {
     expect(mockCreateInvoiceJournalEntry).not.toHaveBeenCalled()
   })
 
+  it('rejects a VAT-registered company without VAT number, before number allocation', async () => {
+    const broken = { ...settings, vat_registered: true, vat_number: null } as CompanySettings
+
+    const result = await issue(makeDraft({ invoice_number: null }), broken)
+
+    expect(result).toEqual({ ok: false, errorCode: 'INVOICE_SEND_VAT_NUMBER_MISSING' })
+    expect(mockEnsureInvoiceNumber).not.toHaveBeenCalled()
+    expect(mockCreateInvoiceJournalEntry).not.toHaveBeenCalled()
+  })
+
+  it('issues for an unregistered company without VAT number', async () => {
+    enqueue({ data: [{ id: 'inv-1' }], error: null }) // CAS flip
+    const unregistered = {
+      ...settings,
+      vat_registered: false,
+      vat_number: null,
+      defer_invoice_booking: true,
+    } as CompanySettings
+
+    const result = await issue(makeDraft(), unregistered)
+
+    expect(result).toEqual({ ok: true, journalEntryId: null, partialFailures: [] })
+  })
+
   it('fails with INVOICE_CREATE_NUMBER_ASSIGN_FAILED when numbering fails', async () => {
     mockEnsureInvoiceNumber.mockRejectedValue(new Error('sequence exhausted'))
 

lib/invoices/__tests__/recurring-schedule-service.test.ts

@@ -508,6 +508,22 @@ describe('executeRecurringSchedule auto-send', () => {
     expect(mockSendEmail).not.toHaveBeenCalled()
   })
 
+  it('keeps the invoice a draft when the registered company has no VAT number', async () => {
+    enqueue({ data: customer, error: null })
+    enqueue({ data: { vat_registered: true }, error: null }) // company_settings VAT gate
+    enqueue({ data: makeInsertedInvoice(), error: null })
+    enqueue({ data: null, error: null })
+    enqueue({ data: makeCompleteInvoice(), error: null })
+    enqueue({ data: { ...company, vat_registered: true, vat_number: null }, error: null }) // company_settings (auto-send)
+
+    const result = await executeRecurringSchedule(client, makeSchedule(), today)
+
+    expect(result.autoSent).toBe(false)
+    expect(result.warning).toContain('Auto-utskick misslyckades')
+    expect(mockReserveInvoiceDelivery).not.toHaveBeenCalled()
+    expect(mockSendEmail).not.toHaveBeenCalled()
+  })
+
   it('does not reserve an auto-send delivery when configured recipients exceed the limit', async () => {
     enqueue({ data: customer, error: null })
     enqueue({ data: { vat_registered: true }, error: null }) // company_settings VAT gate

lib/invoices/__tests__/seller-vat-number.test.ts

@@ -0,0 +1,40 @@
+import { describe, it, expect } from 'vitest'
+import { hasRequiredSellerVatNumber } from '../seller-vat-number'
+
+const realInvoice = { credited_invoice_id: null, document_type: 'invoice' as const }
+
+describe('hasRequiredSellerVatNumber', () => {
+  it('requires a VAT number for a registered company issuing a real invoice', () => {
+    expect(
+      hasRequiredSellerVatNumber({ vat_registered: true, vat_number: null }, realInvoice),
+    ).toBe(false)
+    expect(
+      hasRequiredSellerVatNumber({ vat_registered: true, vat_number: '   ' }, realInvoice),
+    ).toBe(false)
+    expect(
+      hasRequiredSellerVatNumber(
+        { vat_registered: true, vat_number: 'SE556012579001' },
+        realInvoice,
+      ),
+    ).toBe(true)
+  })
+
+  it('does not require a VAT number for an unregistered company', () => {
+    expect(
+      hasRequiredSellerVatNumber({ vat_registered: false, vat_number: null }, realInvoice),
+    ).toBe(true)
+  })
+
+  it('exempts credit notes, proformas, and delivery notes', () => {
+    const broken = { vat_registered: true, vat_number: null }
+    expect(
+      hasRequiredSellerVatNumber(broken, { credited_invoice_id: 'inv-0', document_type: 'invoice' }),
+    ).toBe(true)
+    expect(
+      hasRequiredSellerVatNumber(broken, { credited_invoice_id: null, document_type: 'proforma' }),
+    ).toBe(true)
+    expect(
+      hasRequiredSellerVatNumber(broken, { credited_invoice_id: null, document_type: 'delivery_note' }),
+    ).toBe(true)
+  })
+})

lib/invoices/issue-and-book-invoice.ts

@@ -14,6 +14,7 @@ import {
   hasRequiredInvoicePaymentAccount,
   invoiceRequiresPaymentAccount,
 } from '@/lib/invoices/payment-accounts'
+import { hasRequiredSellerVatNumber } from '@/lib/invoices/seller-vat-number'
 import { uploadDocument } from '@/lib/core/documents/document-service'
 import type { Logger } from '@/lib/logger'
 import type {
@@ -167,6 +168,10 @@ export async function issueAndBookInvoice(
     }
   }
 
+  if (!hasRequiredSellerVatNumber(settings, invoice as Invoice)) {
+    return { ok: false, errorCode: 'INVOICE_SEND_VAT_NUMBER_MISSING' }
+  }
+
   // Assign the number only after all payment-instruction guards pass.
   try {
     await ensureInvoiceNumber(supabase, companyId, invoice as Invoice)

lib/invoices/recurring-schedule-service.ts

@@ -53,6 +53,7 @@ import {
 import {
   hasRequiredInvoicePaymentAccount,
 } from '@/lib/invoices/payment-accounts'
+import { hasRequiredSellerVatNumber } from '@/lib/invoices/seller-vat-number'
 import { createLogger } from '@/lib/logger'
 import type {
   Invoice,
@@ -581,6 +582,12 @@ async function sendInvoiceFromSchedule(
     })
     return false
   }
+  if (!hasRequiredSellerVatNumber(company, invoice)) {
+    log.warn('registered company has no VAT number; recurring schedule cannot auto-send', {
+      invoiceId: invoice.id,
+    })
+    return false
+  }
   const recipients = resolveInvoiceEmailRecipients({
     to: invoice.customer.email,
     configuredCc: company.invoice_email_cc_addresses,

lib/invoices/seller-vat-number.ts

@@ -0,0 +1,32 @@
+import type { CompanySettings, Invoice } from '@/types'
+
+/**
+ * A momsregistrerad seller must state its momsregistreringsnummer on every
+ * faktura (ML (2023:200) 17 kap. 24 §). Issuing without it produces a formally
+ * defective invoice and a defective input-VAT underlag for the buyer, so
+ * issuance is gated the same way the payment account is.
+ *
+ * Proformas and delivery notes are not tax documents. Credit notes are
+ * exempted deliberately: an ändringsfaktura has its own mandatory-content
+ * list (ML 17 kap. 22-23 §§: unambiguous reference to the original, the
+ * change, own number and date, negative amounts, VAT per original rate)
+ * which does not include the seller's VAT number, and blocking a correction
+ * of an already-issued invoice would trap a company that only needs to fix
+ * its settings.
+ */
+export function invoiceRequiresSellerVatNumber(
+  invoice: Pick<Invoice, 'credited_invoice_id' | 'document_type'>,
+): boolean {
+  return !invoice.credited_invoice_id
+    && invoice.document_type !== 'delivery_note'
+    && invoice.document_type !== 'proforma'
+}
+
+export function hasRequiredSellerVatNumber(
+  company: Pick<CompanySettings, 'vat_registered' | 'vat_number'>,
+  invoice: Pick<Invoice, 'credited_invoice_id' | 'document_type'>,
+): boolean {
+  if (!invoiceRequiresSellerVatNumber(invoice)) return true
+  if (!company.vat_registered) return true
+  return !!company.vat_number?.trim()
+}