feat(bookkeeping): dashboard deep link filters verifikat utan underlag server-side (#1840)

* feat(bookkeeping): dashboard deep link filters verifikat utan underlag server-side

The dashboard "Verifikat utan underlag" card (and the push-notification
link) pointed at /bookkeeping?missingUnderlag=true, but nothing read the
param: the user landed on the plain unfiltered ledger. The existing
"Visa saknade underlag" toggle also only filtered the already-fetched
page, so it could not represent the badge count across pages.

- lib/bookkeeping/missing-underlag.ts: shared resolver of "posted
  verifikat lacking underlag" (document-requiring source types, no
  current-version document, no anchored supplier-invoice reference per
  BFL 5 kap 7 §, no exemption), extracted from the bulk "Inget underlag
  krävs" route so list, bulk remedy and dashboard badge share one
  predicate.
- GET /api/bookkeeping/journal-entries?missing_underlag=true: resolves
  the full missing set server-side, applies the active sort stack, pages
  it, and returns the full-set count, fetching page rows in id chunks so
  the "Alla" page size cannot blow the PostgREST URL limit.
- JournalEntryList: the toggle is now server-backed (refetch on change,
  honest count in the dialog badge); client-side re-filtering against
  late-arriving attachment counts removed. Deep-link arrival turns the
  filter on and scopes the visit to all fiscal years in memory only,
  matching the all-years badge count without touching the saved
  preference.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(bookkeeping): harden the saknade-underlag filter after skeptic review

Three skeptic subagents refuted the first cut; this fixes every confirmed
finding in one pass:

- FyPicker: new suppressAutoRestore prop. The deep-link visit opens as
  "Alla räkenskapsår" in memory, and FyPicker's on-load restore of the
  persisted year (value === null) snapped the scope back right after
  load, desyncing the list from the all-years badge that launched it.
  Manual picks still persist as usual.
- Voucher-label search: the resolver now carries the same parseVoucher
  OR-branch as the direct list path, so searching "A209" with the filter
  on finds verifikat A209 instead of silently returning 0 rows.
- Staleness while the filter is on: batch exempt, the single-row "Inget
  underlag krävs" toggle, and a row gaining its first underlag now
  refetch in place so fixed rows leave the filtered list and the count
  stays honest (the pre-server-filter behavior). The attachment-driven
  refetch is guarded per entry id against predicate-disagreement loops.
- Drafts view: the filter switch is disabled there; the predicate is
  posted-only and the badge would mislabel the draft count.
- Perf: the bulk-exempt route resolves ids only, skipping the per-row
  total_amount computed column on its full post-import candidate scan.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(bookkeeping): keep the underlag resolver statically checkable

The skeptic-fix commit tripped the phantom-column scanner ceiling
(tests/schema/no-phantom-columns.test.ts, 382 > 380): a computed
select() string and a runtime-built .or() are expressions the scanner
cannot resolve against the schema. Restructured instead of raising the
ceiling: the idOnly/full column choice is two literal select() calls
behind a lazy branch, and a voucher-label search fans out to two
statically-checkable candidate queries (description ilike, series+number
eq) unioned by id, same semantics as before.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
2026-08-24 15:06:30 +02:00
committed by GitHub
co-authored by Claude Fable 5
parent 2e669a64e3
commit 0676f5a564
8 changed files with 673 additions and 146 deletions
@@ -355,6 +355,160 @@ describe('GET /api/bookkeeping/journal-entries', () => {
// Raw Supabase messages never reach the response field (issue #337).
expect(body.error).toBe('Verifikationerna kunde inte hämtas. Försök igen.')
})
describe('missing_underlag=true (the dashboard deep-link filter)', () => {
// Candidate ids must be UUID-shaped: the resolver interpolates them into
// the supplier-invoice .or() filter behind a UUID guard.
const E1 = '11111111-1111-4111-8111-111111111111'
const E2 = '22222222-2222-4222-8222-222222222222'
const E3 = '33333333-3333-4333-8333-333333333333'
const candidate = (id: string, voucherNumber: number) => ({
id,
entry_date: '2026-06-08',
voucher_series: 'A',
voucher_number: voucherNumber,
description: 'test',
total_amount: 100,
})
it('returns only entries without documents, exemption-aware, with the full-set count', async () => {
enqueue({ data: [candidate(E1, 1), candidate(E2, 2), candidate(E3, 3)], error: null }) // candidates
enqueue({ data: [{ journal_entry_id: E1 }], error: null }) // E1 has a document
enqueue({ data: [], error: null }) // no SI references
enqueue({ data: [], error: null }) // no SI payment-row references
enqueue({ data: [{ journal_entry_id: E3 }], error: null }) // E3 exempt
const fullRow = makeJournalEntry({ id: E2 })
enqueue({ data: [fullRow], error: null }) // page rows
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: { missing_underlag: 'true', exclude_draft: 'true' },
})
const { status, body } = await parseJsonResponse<{ data: { id: string }[]; count: number }>(
await GET(request)
)
expect(status).toBe(200)
expect(body.data.map((e) => e.id)).toEqual([E2])
expect(body.count).toBe(1)
})
it('takes this path instead of the include_related RPC when a period is selected', async () => {
enqueue({ data: [], error: null }) // candidates: none
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: { missing_underlag: 'true', period_id: 'period-1', exclude_draft: 'true' },
})
const { status, body } = await parseJsonResponse<{ data: unknown[]; count: number }>(
await GET(request)
)
expect(status).toBe(200)
expect(body.data).toEqual([])
expect(body.count).toBe(0)
expect(mockSupabase.rpc).not.toHaveBeenCalled()
})
it('paginates over the missing set with count spanning all pages', async () => {
// Out of voucher order on purpose: default sort is series+number asc.
enqueue({ data: [candidate(E3, 3), candidate(E1, 1), candidate(E2, 2)], error: null })
enqueue({ data: [], error: null }) // no documents
enqueue({ data: [], error: null }) // no SI references
enqueue({ data: [], error: null }) // no SI payment-row references
enqueue({ data: [], error: null }) // no exemptions
enqueue({ data: [makeJournalEntry({ id: E2 })], error: null }) // page rows
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: {
missing_underlag: 'true',
exclude_draft: 'true',
limit: '1',
offset: '1',
},
})
const { status, body } = await parseJsonResponse<{ data: { id: string }[]; count: number }>(
await GET(request)
)
expect(status).toBe(200)
// Page 2 of size 1 under voucher-asc = A2.
expect(body.data.map((e) => e.id)).toEqual([E2])
expect(body.count).toBe(3)
})
it('treats an anchored supplier-invoice reference as underlag (BFL 5 kap 7 §)', async () => {
enqueue({ data: [candidate(E1, 1), candidate(E2, 2)], error: null })
enqueue({ data: [], error: null }) // no direct documents
enqueue({
data: [
{
registration_journal_entry_id: E1,
payment_journal_entry_id: null,
document: { journal_entry_id: E1 }, // anchored → counts as underlag
},
],
error: null,
})
enqueue({ data: [], error: null }) // no SI payment-row references
enqueue({ data: [], error: null }) // no exemptions
enqueue({ data: [makeJournalEntry({ id: E2 })], error: null }) // page rows
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: { missing_underlag: 'true', exclude_draft: 'true' },
})
const { status, body } = await parseJsonResponse<{ data: { id: string }[]; count: number }>(
await GET(request)
)
expect(status).toBe(200)
expect(body.data.map((e) => e.id)).toEqual([E2])
expect(body.count).toBe(1)
})
it('matches a voucher-label search against series+number, like the direct path', async () => {
// A voucher-shaped needle fans out to TWO candidate queries (description
// ilike, then series+number), unioned by id: a runtime-built .or()
// would count against the phantom-column scanner's ceiling.
enqueue({ data: [], error: null }) // candidates by description: none
enqueue({ data: [candidate(E1, 209)], error: null }) // candidates by voucher label
enqueue({ data: [], error: null }) // no documents
enqueue({ data: [], error: null }) // no SI references
enqueue({ data: [], error: null }) // no SI payment-row references
enqueue({ data: [], error: null }) // no exemptions
enqueue({ data: [makeJournalEntry({ id: E1 })], error: null }) // page rows
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: { missing_underlag: 'true', exclude_draft: 'true', search: 'A209' },
})
const { status, body } = await parseJsonResponse<{ data: { id: string }[]; count: number }>(
await GET(request)
)
expect(status).toBe(200)
// Searching "A209" with the filter on must find verifikat A209 even
// when its description never mentions it.
expect(body.data.map((e) => e.id)).toEqual([E1])
expect(body.count).toBe(1)
const eqCalls = findCalls('journal_entries', 'eq')
expect(eqCalls).toContainEqual(['voucher_series', 'A'])
expect(eqCalls).toContainEqual(['voucher_number', 209])
})
it('is ignored for the drafts view', async () => {
enqueue({ data: [], error: null, count: 0 })
const request = createMockRequest('/api/bookkeeping/journal-entries', {
searchParams: { missing_underlag: 'true', status: 'draft' },
})
const { status } = await parseJsonResponse(await GET(request))
expect(status).toBe(200)
// The drafts view goes through the normal direct query, not the
// resolver: no lookup-table queries.
expect(mockSupabase.from).toHaveBeenCalledWith('journal_entries')
expect(mockSupabase.from).not.toHaveBeenCalledWith('document_attachments')
expect(mockSupabase.from).not.toHaveBeenCalledWith('journal_entry_no_doc_required')
})
})
})
const VALID_UUID = '550e8400-e29b-41d4-a716-446655440000'
@@ -8,6 +8,11 @@ import { CreateJournalEntrySchema } from '@/lib/api/schemas'
import { escapeLikePattern } from '@/lib/invoices/duplicate-payment-guard'
import { parseVoucher } from '@/lib/bookkeeping/voucher-series-resolver'
import { getErrorMessage } from '@/lib/errors/get-error-message'
import {
MissingUnderlagQueryError,
resolveMissingUnderlagEntries,
type MissingUnderlagEntry,
} from '@/lib/bookkeeping/missing-underlag'
ensureInitialized()
@@ -75,10 +80,135 @@ export const GET = withRouteContext('bookkeeping.journal_entries.list', async (r
// is dated inside the selected period. Pass include_related=false to
// restore strict fiscal_period_id filtering.
const includeRelated = searchParams.get('include_related') !== 'false'
// Server-side "saknar underlag" filter (dashboard deep link + the list
// dialog's "Visa saknade underlag" toggle). Committed view only: the
// predicate is posted-only, so it is meaningless for the drafts view.
const missingUnderlag = searchParams.get('missing_underlag') === 'true' && status !== 'draft'
const dateAscending = sortDate === 'asc'
const sortDateParam = soloDateKey ? (soloDateKey.ascending ? 'asc' : 'desc') : sortDate === 'asc' ? 'asc' : 'desc'
if (missingUnderlag) {
// The missing-underlag predicate spans three tables (current-version
// documents, anchored supplier-invoice references per BFL 5 kap 7 §, and
// journal_entry_no_doc_required exemptions), which PostgREST cannot
// express as a row filter. So this path resolves the FULL missing set via
// the shared helper (the same code the bulk "Inget underlag krävs" route
// uses, mirroring the verifikat_without_documents RPC that feeds the
// dashboard badge), sorts it with the active sort stack, pages it, and
// fetches only the page's rows. count is the full filtered total, so
// pagination and the dialog badge stay honest.
//
// collapse_corrections is deliberately NOT applied here: the dashboard
// badge has no collapse notion, and hiding corrected originals would make
// the filtered list disagree with the count that led the user here.
let missing
try {
missing = await resolveMissingUnderlagEntries(supabase, companyId, {
periodId,
series: seriesFilter,
dateFrom,
dateTo,
search,
})
} catch (err) {
if (err instanceof MissingUnderlagQueryError) {
log.error('failed to resolve missing-underlag entries', err)
return NextResponse.json(
{ error: 'Verifikationerna kunde inte hämtas. Försök igen.' },
{ status: 500 }
)
}
throw err
}
// Sort the full set with the same key semantics as the direct query
// below: the sort stack in priority order, a voucher tiebreak in the last
// key's direction unless voucher is already a key, and a final id
// tiebreak for a stable total order across page requests.
const keys =
sortKeys.length > 0
? sortKeys
: sortDate === 'asc' || sortDate === 'desc'
? [{ column: 'date' as const, ascending: dateAscending }]
: []
const compareVoucher = (a: MissingUnderlagEntry, b: MissingUnderlagEntry) => {
const seriesA = a.voucher_series ?? ''
const seriesB = b.voucher_series ?? ''
if (seriesA !== seriesB) return seriesA < seriesB ? -1 : 1
return (a.voucher_number ?? 0) - (b.voucher_number ?? 0)
}
const compareBy = (
column: 'date' | 'voucher' | 'total' | 'description',
a: MissingUnderlagEntry,
b: MissingUnderlagEntry,
) => {
switch (column) {
case 'date': {
const dateA = a.entry_date ?? ''
const dateB = b.entry_date ?? ''
return dateA < dateB ? -1 : dateA > dateB ? 1 : 0
}
case 'voucher':
return compareVoucher(a, b)
case 'total':
return (a.total_amount ?? 0) - (b.total_amount ?? 0)
case 'description': {
const descA = a.description ?? ''
const descB = b.description ?? ''
return descA < descB ? -1 : descA > descB ? 1 : 0
}
}
}
const lastAscending = keys.length > 0 ? keys[keys.length - 1].ascending : true
const sorted = [...missing].sort((a, b) => {
for (const key of keys) {
const cmp = compareBy(key.column, a, b)
if (cmp !== 0) return key.ascending ? cmp : -cmp
}
if (!keys.some((k) => k.column === 'voucher')) {
const cmp = compareVoucher(a, b)
if (cmp !== 0) return lastAscending ? cmp : -cmp
}
const cmp = a.id < b.id ? -1 : a.id > b.id ? 1 : 0
return lastAscending ? cmp : -cmp
})
const total = sorted.length
const pageIds = sorted.slice(offset, offset + limit).map((e) => e.id)
if (pageIds.length === 0) {
return NextResponse.json({ data: [], count: total })
}
// Fetch the page's full rows in id chunks: "Alla" as page size can put
// thousands of ids on this page, and a single .in() with that many ids
// would blow PostgREST's URL length limit.
const ROW_CHUNK = 100
const rowsById = new Map<string, unknown>()
for (let i = 0; i < pageIds.length; i += ROW_CHUNK) {
const chunk = pageIds.slice(i, i + ROW_CHUNK)
const { data: chunkRows, error } = await supabase
.from('journal_entries')
.select('*, lines:journal_entry_lines(*)')
.eq('company_id', companyId)
.in('id', chunk)
if (error) {
log.error('failed to fetch missing-underlag page rows', error)
return NextResponse.json(
{ error: 'Verifikationerna kunde inte hämtas. Försök igen.' },
{ status: 500 }
)
}
for (const row of (chunkRows ?? []) as { id: string }[]) {
rowsById.set(row.id, row)
}
}
// Reassemble in the sorted page order (the .in() fetch has no order).
const data = pageIds.map((id) => rowsById.get(id)).filter(Boolean)
return NextResponse.json({ data, count: total })
}
// Non-date sorts (and stacked sorts): the include_related RPC only orders
// by date, so fall through to the direct query below. This means these
// sorts are *strict by fiscal_period_id*: cross-period follow-up entries
@@ -2,11 +2,11 @@ import { NextResponse } from 'next/server'
import { z } from 'zod'
import { withRouteContext } from '@/lib/api/with-route-context'
import { validateBody } from '@/lib/api/validate'
import { fetchAllRows } from '@/lib/supabase/fetch-all'
import { markEntriesNoDocRequired } from '@/lib/bookkeeping/no-doc-required'
import { NEEDS_DOC_SOURCE_TYPES } from '@/lib/worklist/categories'
import { escapeLikePattern } from '@/lib/invoices/duplicate-payment-guard'
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
import {
MissingUnderlagQueryError,
resolveMissingUnderlagEntries,
} from '@/lib/bookkeeping/missing-underlag'
// A real calendar date in YYYY-MM-DD form. Rejects shaped-but-invalid values
// (e.g. 9999-99-99 or 2026-02-30) that a bare /^\d{4}-\d{2}-\d{2}$/ regex would
@@ -25,12 +25,6 @@ const isoDate = z.string().refine(
{ message: 'Ogiltigt datum (förväntat YYYY-MM-DD)' },
)
// Journal-entry ids are interpolated into the supplier-invoice .or() filter
// string below, so they must be UUIDs. They originate from journal_entries.id
// (DB-sourced, never request input), but this guard keeps the injection-safety
// contract identical to /api/documents/counts.
const uuidSchema = z.string().uuid()
const BulkMissingSchema = z.object({
period_id: z.string().uuid().nullable().optional(),
// Single uppercase verifikationsserie (A-Z); the list sends null for "all".
@@ -51,9 +45,11 @@ const BulkMissingSchema = z.object({
* scalable remedy for the "thousands of saknade underlag after a migration"
* problem; the per-entry batch route handles selective marking.
*
* The missing-doc predicate mirrors countVerifikatMissingDocument: posted +
* NEEDS_DOC source type, no current-version document_attachment, not already
* exempt.
* The missing-doc predicate lives in resolveMissingUnderlagEntries (shared
* with the journal list's missing_underlag filter) and mirrors
* countVerifikatMissingDocument: posted + NEEDS_DOC source type, no
* current-version document_attachment, no anchored supplier-invoice reference,
* not already exempt.
*/
export const POST = withRouteContext(
'journal_entry.bulk_missing_no_document_required',
@@ -64,124 +60,32 @@ export const POST = withRouteContext(
// All formats are enforced by the schema above, so these are already valid
// (or null). No re-validation needed before they reach the query layer.
const { period_id, reason, dry_run } = validation.data
const series = validation.data.series ?? null
const dateFrom = validation.data.date_from ?? null
const dateTo = validation.data.date_to ?? null
const search = validation.data.search?.trim() || null
// Candidate entries: posted, document-requiring, matching the active filters.
const candidates = await fetchAllRows<{ id: string }>(({ from, to }) => {
let q = supabase
.from('journal_entries')
.select('id')
.eq('company_id', companyId)
.eq('status', 'posted')
.in('source_type', [...NEEDS_DOC_SOURCE_TYPES])
if (period_id) q = q.eq('fiscal_period_id', period_id)
if (series) q = q.eq('voucher_series', series)
if (dateFrom) q = q.gte('entry_date', dateFrom)
if (dateTo) q = q.lte('entry_date', dateTo)
if (search) q = q.ilike('description', `%${escapeLikePattern(search)}%`)
return q.order('id').range(from, to)
})
if (candidates.length === 0) {
return NextResponse.json({ data: dry_run ? { count: 0 } : { exempted: 0 } })
let missing
try {
missing = await resolveMissingUnderlagEntries(
supabase,
companyId,
{
periodId: period_id ?? null,
series: validation.data.series ?? null,
dateFrom: validation.data.date_from ?? null,
dateTo: validation.data.date_to ?? null,
search: validation.data.search ?? null,
},
// No sorting here, so skip the per-row total_amount computed column
// on what can be a full post-import candidate scan.
{ idOnly: true },
)
} catch (err) {
if (err instanceof MissingUnderlagQueryError) {
// userMessage is already mapped through getErrorMessage() in the
// resolver: user-facing Swedish, never a raw driver message.
return NextResponse.json({ error: err.userMessage }, { status: 400 })
}
throw err
}
// Resolve which candidates already have a document or an exemption by
// querying ONLY for the candidate ids (chunked), rather than loading the
// company's full document_attachments + journal_entry_no_doc_required tables
// into memory. Data minimisation + bounded memory for large migrations.
const candidateIds = candidates.map((e) => e.id)
const withDoc = new Set<string>()
const exempt = new Set<string>()
// 150 keeps the embedded id lists well under PostgREST's URL-length limit:
// the supplier-invoice .or() below repeats the chunk twice (registration +
// payment FK), so a larger chunk would risk truncating the GET filter.
const LOOKUP_CHUNK = 150
for (let i = 0; i < candidateIds.length; i += LOOKUP_CHUNK) {
const chunk = candidateIds.slice(i, i + LOOKUP_CHUNK)
// Only UUIDs reach the interpolated .or() string (the .in() array filters
// are already injection-safe); mirrors the guard in documents/counts.
const chunkInList = `(${chunk.filter((id) => uuidSchema.safeParse(id).success).join(',')})`
const [docRes, siRefRes, sipRefRes, exemptRes] = await Promise.all([
supabase
.from('document_attachments')
.select('journal_entry_id')
.eq('company_id', companyId)
.eq('is_current_version', true)
.in('journal_entry_id', chunk),
// BFL 5 kap 7 § hänvisning: an entry referenced by a supplier invoice
// whose source document is retained AND anchored to a journal entry
// is NOT missing underlag (only anchored docs sit behind the WORM
// deletion guards). Mirrors the verifikat_without_documents RPC;
// without this the bulk action would waive entries the warning no
// longer counts.
supabase
.from('supplier_invoices')
.select(
'registration_journal_entry_id, payment_journal_entry_id, document:document_attachments(journal_entry_id)',
)
.eq('company_id', companyId)
.not('document_id', 'is', null)
.or(
`registration_journal_entry_id.in.${chunkInList},payment_journal_entry_id.in.${chunkInList}`,
),
supabase
.from('supplier_invoice_payments')
.select(
'journal_entry_id, supplier_invoice:supplier_invoices(document_id, document:document_attachments(journal_entry_id))',
)
.eq('company_id', companyId)
.in('journal_entry_id', chunk),
supabase
.from('journal_entry_no_doc_required')
.select('journal_entry_id')
.eq('company_id', companyId)
.in('journal_entry_id', chunk),
])
if (docRes.error) {
return NextResponse.json({ error: getUserErrorMessage(docRes.error) }, { status: 400 })
}
if (siRefRes.error) {
return NextResponse.json({ error: getUserErrorMessage(siRefRes.error) }, { status: 400 })
}
if (sipRefRes.error) {
return NextResponse.json({ error: getUserErrorMessage(sipRefRes.error) }, { status: 400 })
}
if (exemptRes.error) {
return NextResponse.json({ error: getUserErrorMessage(exemptRes.error) }, { status: 400 })
}
for (const r of (docRes.data ?? []) as { journal_entry_id: string }[]) {
withDoc.add(r.journal_entry_id)
}
for (const r of (siRefRes.data ?? []) as unknown as {
registration_journal_entry_id: string | null
payment_journal_entry_id: string | null
document: { journal_entry_id: string | null } | null
}[]) {
if (!r.document?.journal_entry_id) continue // unanchored: not underlag
if (r.registration_journal_entry_id) withDoc.add(r.registration_journal_entry_id)
if (r.payment_journal_entry_id) withDoc.add(r.payment_journal_entry_id)
}
for (const r of (sipRefRes.data ?? []) as unknown as {
journal_entry_id: string | null
supplier_invoice: {
document_id: string | null
document: { journal_entry_id: string | null } | null
} | null
}[]) {
if (r.journal_entry_id && r.supplier_invoice?.document?.journal_entry_id) {
withDoc.add(r.journal_entry_id)
}
}
for (const r of (exemptRes.data ?? []) as { journal_entry_id: string }[]) {
exempt.add(r.journal_entry_id)
}
}
const missingIds = candidateIds.filter((id) => !withDoc.has(id) && !exempt.has(id))
const missingIds = missing.map((e) => e.id)
if (dry_run) {
return NextResponse.json({ data: { count: missingIds.length } })