@@ -101,7 +106,10 @@ export default function TransactionHistoryList({
)}
-
{transaction.description}
+
+
{transaction.description}
+
+
{formatDate(transaction.date)}
{transaction.is_business !== null &&
diff --git a/components/transactions/TransactionInboxCard.tsx b/components/transactions/TransactionInboxCard.tsx
index 4b8e86e0..0802f887 100644
--- a/components/transactions/TransactionInboxCard.tsx
+++ b/components/transactions/TransactionInboxCard.tsx
@@ -11,6 +11,7 @@ import { Tooltip, TooltipTrigger, TooltipContent, TooltipProvider } from '@/comp
import { getAccountName, formatAccountWithName } from '@/lib/bookkeeping/client-account-names'
import { getTemplateById } from '@/lib/bookkeeping/booking-templates'
import { isCounterpartyTemplateId } from '@/lib/bookkeeping/counterparty-templates'
+import { TransactionAttachmentIndicator } from './TransactionAttachmentIndicator'
import type { TransactionWithInvoice, CategorizeHandler } from './transaction-types'
import type { SuggestedCategory, SuggestedTemplate } from '@/lib/transactions/category-suggestions'
@@ -83,6 +84,7 @@ export default function TransactionInboxCard({
}}
>
-
{transaction.description}
+
+
{transaction.description}
+
+
{formatDate(transaction.date)}
diff --git a/extensions/general/invoice-inbox/__tests__/inbound-webhook.test.ts b/extensions/general/invoice-inbox/__tests__/inbound-webhook.test.ts
index cfa3a7d7..f0a065fb 100644
--- a/extensions/general/invoice-inbox/__tests__/inbound-webhook.test.ts
+++ b/extensions/general/invoice-inbox/__tests__/inbound-webhook.test.ts
@@ -19,6 +19,12 @@ vi.mock('@supabase/supabase-js', () => ({
createClient: vi.fn(),
}))
+// Rate limiter is a thin RPC wrapper; bypass it so the queued-mock sequence
+// in each test doesn't have to account for the extra Supabase call.
+vi.mock('@/lib/rate-limits/inbox', () => ({
+ checkInboxUploadRateLimit: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
import { verifyInboundWebhook, fetchReceivingEmail, fetchInboundAttachment } from '@/extensions/general/invoice-inbox/lib/resend-inbound'
import { createClient } from '@supabase/supabase-js'
diff --git a/extensions/general/invoice-inbox/__tests__/retry-extraction.test.ts b/extensions/general/invoice-inbox/__tests__/retry-extraction.test.ts
new file mode 100644
index 00000000..3021aab4
--- /dev/null
+++ b/extensions/general/invoice-inbox/__tests__/retry-extraction.test.ts
@@ -0,0 +1,175 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { invoiceInboxExtension } from '@/extensions/general/invoice-inbox'
+import {
+ createQueuedMockSupabase,
+ createMockRequest,
+ parseJsonResponse,
+} from '@/tests/helpers'
+import type { ExtensionContext } from '@/lib/extensions/types'
+
+vi.mock('@/extensions/general/invoice-inbox/lib/extract-invoice-fields', () => ({
+ extractInvoiceFields: vi.fn(),
+}))
+
+vi.mock('@/lib/rate-limits/inbox', () => ({
+ checkInboxUploadRateLimit: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+import { extractInvoiceFields } from '@/extensions/general/invoice-inbox/lib/extract-invoice-fields'
+import { checkInboxUploadRateLimit } from '@/lib/rate-limits/inbox'
+
+function findRoute(method: string, path: string) {
+ return invoiceInboxExtension.apiRoutes!.find(
+ (r) => r.method === method && r.path === path,
+ )!
+}
+
+const retryRoute = findRoute('POST', '/items/:id/retry-extraction')
+
+function buildCtx(supabase: unknown): ExtensionContext {
+ return {
+ userId: 'user-1',
+ companyId: 'company-1',
+ extensionId: 'invoice-inbox',
+ supabase: supabase as ExtensionContext['supabase'],
+ emit: vi.fn(),
+ settings: { get: vi.fn(), set: vi.fn() },
+ storage: { from: vi.fn() } as unknown as ExtensionContext['storage'],
+ log: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() } as unknown as ExtensionContext['log'],
+ services: {},
+ } as ExtensionContext
+}
+
+function makeReq() {
+ return createMockRequest('/items/item-1/retry-extraction', {
+ method: 'POST',
+ searchParams: { _id: 'item-1' },
+ })
+}
+
+const EXTRACTION_SUCCESS = {
+ data: {
+ supplier: { name: 'Acme AB', orgNumber: null, vatNumber: null, address: null, bankgiro: null, plusgiro: null },
+ invoice: { invoiceNumber: 'F-1', invoiceDate: '2026-05-01', dueDate: null, paymentReference: null, currency: 'SEK' },
+ lineItems: [],
+ totals: { subtotal: 100, vatAmount: 25, total: 125 },
+ vatBreakdown: [],
+ confidence: 1,
+ },
+ rawText: 'mock',
+}
+
+beforeEach(() => {
+ vi.clearAllMocks()
+ vi.mocked(checkInboxUploadRateLimit).mockResolvedValue({ ok: true })
+})
+
+describe('POST /items/:id/retry-extraction', () => {
+ it('returns 401 when no context', async () => {
+ const res = await retryRoute.handler(makeReq(), undefined)
+ const { status } = await parseJsonResponse(res)
+ expect(status).toBe(401)
+ })
+
+ it('returns 429 when the per-company rate limit is exceeded', async () => {
+ vi.mocked(checkInboxUploadRateLimit).mockResolvedValueOnce({
+ ok: false,
+ scope: 'minute',
+ retryAfterSec: 30,
+ })
+ const { supabase } = createQueuedMockSupabase()
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status, body } = await parseJsonResponse<{ error: string }>(res)
+ expect(status).toBe(429)
+ expect(body.error).toMatch(/för många/i)
+ expect(res.headers.get('Retry-After')).toBe('30')
+ })
+
+ it('returns 404 when the inbox item is missing', async () => {
+ const { supabase, enqueue } = createQueuedMockSupabase()
+ enqueue({ data: null, error: null }) // item lookup
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status } = await parseJsonResponse(res)
+ expect(status).toBe(404)
+ })
+
+ it('returns 409 when already booked as supplier invoice', async () => {
+ const { supabase, enqueue } = createQueuedMockSupabase()
+ enqueue({
+ data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: 'si-1' },
+ error: null,
+ })
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status, body } = await parseJsonResponse<{ error: string }>(res)
+ expect(status).toBe(409)
+ expect(body.error).toMatch(/redan bokfört/i)
+ })
+
+ it('returns 400 when the item has no attached document', async () => {
+ const { supabase, enqueue } = createQueuedMockSupabase()
+ enqueue({
+ data: { id: 'item-1', document_id: null, correlation_id: null, created_supplier_invoice_id: null },
+ error: null,
+ })
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status, body } = await parseJsonResponse<{ error: string }>(res)
+ expect(status).toBe(400)
+ expect(body.error).toMatch(/Ingen bilaga/i)
+ })
+
+ it('returns 200 with re-extracted data on the happy path', async () => {
+ const { supabase, enqueue } = createQueuedMockSupabase()
+ enqueue({
+ data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
+ error: null,
+ })
+ enqueue({
+ data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
+ error: null,
+ })
+ enqueue({ data: null, error: null }) // inbox update on success
+
+ supabase.storage.from = vi.fn().mockReturnValue({
+ download: vi.fn().mockResolvedValue({
+ data: new Blob([new Uint8Array([1, 2, 3])], { type: 'application/pdf' }),
+ error: null,
+ }),
+ })
+
+ vi.mocked(extractInvoiceFields).mockResolvedValueOnce(EXTRACTION_SUCCESS as never)
+
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status, body } = await parseJsonResponse<{ data: { extracted_data: { totals: { total: number } } } }>(res)
+ expect(status).toBe(200)
+ expect(body.data.extracted_data.totals.total).toBe(125)
+ })
+
+ it('marks the item as error and returns 500 when extraction throws', async () => {
+ const { supabase, enqueue } = createQueuedMockSupabase()
+ enqueue({
+ data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
+ error: null,
+ })
+ enqueue({
+ data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
+ error: null,
+ })
+ enqueue({ data: null, error: null }) // error-state update
+
+ supabase.storage.from = vi.fn().mockReturnValue({
+ download: vi.fn().mockResolvedValue({
+ data: new Blob([new Uint8Array([1])], { type: 'application/pdf' }),
+ error: null,
+ }),
+ })
+
+ vi.mocked(extractInvoiceFields).mockRejectedValueOnce(new Error('pdfjs blew up'))
+ const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
+
+ const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
+ const { status, body } = await parseJsonResponse<{ error: string }>(res)
+ expect(status).toBe(500)
+ expect(body.error).toBe('pdfjs blew up')
+ spy.mockRestore()
+ })
+})
diff --git a/extensions/general/invoice-inbox/index.ts b/extensions/general/invoice-inbox/index.ts
index ed1e9aac..171ac01c 100644
--- a/extensions/general/invoice-inbox/index.ts
+++ b/extensions/general/invoice-inbox/index.ts
@@ -20,9 +20,11 @@ import {
import { createSupplierInvoiceRegistrationEntry } from '@/lib/bookkeeping/supplier-invoice-entries'
import { CreateSupplierInvoiceSchema } from '@/lib/api/schemas'
import { appendProcessingHistory } from '@/lib/processing-history/append'
+import { checkInboxUploadRateLimit } from '@/lib/rate-limits/inbox'
import type { InvoiceExtractionResult, InvoiceInboxItem, SupplierInvoice, SupplierInvoiceItem } from '@/types'
const MAX_FILE_SIZE = 10 * 1024 * 1024
+const MAX_ATTACHMENTS_PER_EMAIL = 20
// Partial-update schema for the /items/:id/fields PATCH route. Only the
// scalar fields the UI exposes for inline editing — line items and
@@ -251,6 +253,23 @@ export const invoiceInboxExtension: Extension = {
handler: async (request: Request, ctx?: ExtensionContext) => {
if (!ctx) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+ // Per-company rate limit (30/min, 500/day). Defense against script
+ // floods and compromised sessions; never hit by real users in normal
+ // monthly receipt-clearing.
+ const limit = await checkInboxUploadRateLimit(ctx.supabase, ctx.companyId)
+ if (!limit.ok) {
+ return NextResponse.json(
+ {
+ error:
+ limit.scope === 'minute'
+ ? 'För många uppladdningar på kort tid. Försök igen om en stund.'
+ : 'Dagsgränsen för uppladdningar är nådd. Försök igen imorgon.',
+ retry_after: limit.retryAfterSec,
+ },
+ { status: 429, headers: { 'Retry-After': String(limit.retryAfterSec ?? 60) } },
+ )
+ }
+
const formData = await request.formData()
const file = formData.get('file') as File | null
@@ -547,6 +566,179 @@ export const invoiceInboxExtension: Extension = {
},
},
+ // ── Match a supplier to an inbox item ───────────────────
+ {
+ method: 'POST',
+ path: '/items/:id/match-supplier',
+ handler: async (request: Request, ctx?: ExtensionContext) => {
+ if (!ctx) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+ const url = new URL(request.url)
+ const id = url.searchParams.get('_id')
+ if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+ let body: { supplier_id?: string }
+ try {
+ body = await request.json()
+ } catch {
+ return NextResponse.json({ error: 'Invalid JSON' }, { status: 400 })
+ }
+ if (!body.supplier_id || typeof body.supplier_id !== 'string') {
+ return NextResponse.json({ error: 'supplier_id required' }, { status: 400 })
+ }
+
+ // Confirm supplier exists in this company before linking.
+ const { data: supplier } = await ctx.supabase
+ .from('suppliers')
+ .select('id')
+ .eq('id', body.supplier_id)
+ .eq('company_id', ctx.companyId)
+ .maybeSingle()
+ if (!supplier) {
+ return NextResponse.json({ error: 'Supplier not found' }, { status: 404 })
+ }
+
+ const { error: updateError } = await ctx.supabase
+ .from('invoice_inbox_items')
+ .update({ matched_supplier_id: body.supplier_id })
+ .eq('id', id)
+ .eq('company_id', ctx.companyId)
+
+ if (updateError) {
+ return NextResponse.json({ error: updateError.message }, { status: 500 })
+ }
+ return NextResponse.json({ data: { id, matched_supplier_id: body.supplier_id } })
+ },
+ },
+
+ // ── Retry extraction on a stored document ──────────────
+ {
+ method: 'POST',
+ path: '/items/:id/retry-extraction',
+ handler: async (request: Request, ctx?: ExtensionContext) => {
+ if (!ctx) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+ // Retry runs pdfjs extraction synchronously and is CPU-heavy; counts
+ // against the same per-company quota as a fresh upload so an
+ // attacker can't burn server CPU by repeatedly re-extracting one doc.
+ const limit = await checkInboxUploadRateLimit(ctx.supabase, ctx.companyId)
+ if (!limit.ok) {
+ return NextResponse.json(
+ {
+ error:
+ limit.scope === 'minute'
+ ? 'För många tolkningsförsök på kort tid. Försök igen om en stund.'
+ : 'Dagsgränsen för tolkningar är nådd. Försök igen imorgon.',
+ retry_after: limit.retryAfterSec,
+ },
+ { status: 429, headers: { 'Retry-After': String(limit.retryAfterSec ?? 60) } },
+ )
+ }
+
+ const url = new URL(request.url)
+ const id = url.searchParams.get('_id')
+ if (!id) return NextResponse.json({ error: 'Missing id' }, { status: 400 })
+
+ const { data: item } = await ctx.supabase
+ .from('invoice_inbox_items')
+ .select('id, document_id, correlation_id, created_supplier_invoice_id')
+ .eq('id', id)
+ .eq('company_id', ctx.companyId)
+ .maybeSingle()
+
+ if (!item) return NextResponse.json({ error: 'Inbox item not found' }, { status: 404 })
+ if (item.created_supplier_invoice_id) {
+ return NextResponse.json(
+ { error: 'Redan bokfört — kan inte köra om tolkningen.' },
+ { status: 409 },
+ )
+ }
+ if (!item.document_id) {
+ return NextResponse.json(
+ { error: 'Ingen bilaga att tolka om.' },
+ { status: 400 },
+ )
+ }
+
+ const { data: doc } = await ctx.supabase
+ .from('document_attachments')
+ .select('storage_path, mime_type, file_name')
+ .eq('id', item.document_id)
+ .eq('company_id', ctx.companyId)
+ .maybeSingle()
+
+ if (!doc) {
+ return NextResponse.json({ error: 'Bilagan kunde inte hittas.' }, { status: 404 })
+ }
+
+ const { data: blob, error: dlError } = await ctx.supabase.storage
+ .from('documents')
+ .download(doc.storage_path)
+
+ if (dlError || !blob) {
+ console.error('[invoice-inbox/retry-extraction] download failed:', dlError)
+ return NextResponse.json(
+ { error: 'Kunde inte ladda ner bilagan.' },
+ { status: 500 },
+ )
+ }
+
+ try {
+ const buffer = Buffer.from(await blob.arrayBuffer())
+ const { data: extracted } = await extractInvoiceFields({
+ buffer,
+ mimeType: doc.mime_type,
+ fileName: doc.file_name,
+ })
+
+ const { error: updateError } = await ctx.supabase
+ .from('invoice_inbox_items')
+ .update({
+ status: 'received',
+ error_message: null,
+ extracted_data: extracted as unknown as Record
,
+ })
+ .eq('id', id)
+ .eq('company_id', ctx.companyId)
+
+ if (updateError) {
+ return NextResponse.json({ error: updateError.message }, { status: 500 })
+ }
+
+ if (item.correlation_id) {
+ try {
+ await appendProcessingHistory({
+ companyId: ctx.companyId,
+ correlationId: item.correlation_id,
+ aggregateType: 'Document',
+ aggregateId: item.document_id,
+ eventType: 'DocumentExtractionRetried',
+ payload: {
+ inbox_item_id: id,
+ document_id: item.document_id,
+ },
+ actor: { type: 'user', id: ctx.userId },
+ occurredAt: new Date(),
+ })
+ } catch (logErr) {
+ console.error('[invoice-inbox/retry-extraction] history append failed:', logErr)
+ }
+ }
+
+ return NextResponse.json({ data: { extracted_data: extracted } })
+ } catch (error) {
+ console.error('[invoice-inbox/retry-extraction] extraction failed:', error)
+ const message = error instanceof Error ? error.message : 'Tolkning misslyckades'
+ await ctx.supabase
+ .from('invoice_inbox_items')
+ .update({ status: 'error', error_message: message })
+ .eq('id', id)
+ .eq('company_id', ctx.companyId)
+ return NextResponse.json({ error: message }, { status: 500 })
+ }
+ },
+ },
+
// ── Get this company's inbox address ────────────────────
{
method: 'GET',
@@ -692,7 +884,64 @@ export const invoiceInboxExtension: Extension = {
}
const bodyText = fullEmail.text ?? null
- const attachments = fullEmail.attachments ?? []
+ const rawAttachments = fullEmail.attachments ?? []
+
+ // Per-company rate limit (30/min, 500/day). Same Postgres-backed
+ // RPC as /upload. Acknowledge + drop on cap — returning 429 to
+ // Resend would just consume more budget via their retry.
+ const limit = await checkInboxUploadRateLimit(serviceSupabase, inbox.company_id)
+ if (!limit.ok) {
+ try {
+ await appendProcessingHistory({
+ companyId: inbox.company_id,
+ correlationId: email_id,
+ aggregateType: 'System',
+ aggregateId: email_id,
+ eventType: 'RateLimitedDropped',
+ payload: {
+ scope: limit.scope,
+ retry_after_sec: limit.retryAfterSec,
+ attachment_count: rawAttachments.length,
+ from,
+ subject,
+ },
+ actor: { type: 'system', id: 'resend-inbound' },
+ occurredAt: new Date(),
+ })
+ } catch (err) {
+ console.error('[invoice-inbox/inbound] RateLimitedDropped append failed:', err)
+ }
+ return NextResponse.json({ data: { processed: 0, reason: 'rate_limited' } })
+ }
+
+ // Per-email attachment cap. 20 covers any legitimate batched
+ // supplier email; an attacker stuffing 500 PDFs into one message
+ // gets truncated and a single history event records the drop.
+ const totalAttachments = rawAttachments.length
+ const attachments = rawAttachments.slice(0, MAX_ATTACHMENTS_PER_EMAIL)
+ const truncatedCount = totalAttachments - attachments.length
+ if (truncatedCount > 0) {
+ try {
+ await appendProcessingHistory({
+ companyId: inbox.company_id,
+ correlationId: email_id,
+ aggregateType: 'System',
+ aggregateId: email_id,
+ eventType: 'AttachmentsTruncated',
+ payload: {
+ total: totalAttachments,
+ processed: attachments.length,
+ dropped: truncatedCount,
+ from,
+ subject,
+ },
+ actor: { type: 'system', id: 'resend-inbound' },
+ occurredAt: new Date(),
+ })
+ } catch (err) {
+ console.error('[invoice-inbox/inbound] AttachmentsTruncated append failed:', err)
+ }
+ }
if (attachments.length === 0) {
await serviceSupabase.from('invoice_inbox_items').insert({
diff --git a/lib/api/schemas.ts b/lib/api/schemas.ts
index 8c2a479d..1f7898d1 100644
--- a/lib/api/schemas.ts
+++ b/lib/api/schemas.ts
@@ -340,6 +340,13 @@ export const MatchInvoiceSchema = z.object({
invoice_id: uuid,
})
+export const CreateTransactionFromDocumentSchema = z.object({
+ inbox_item_id: uuid,
+ amount: z.number().refine((n) => n !== 0, 'Amount must be non-zero'),
+ transaction_date: isoDate,
+ description: z.string().min(1).max(500),
+})
+
export const MatchSupplierInvoiceSchema = z.object({
supplier_invoice_id: uuid,
})
diff --git a/lib/errors/structured-errors.ts b/lib/errors/structured-errors.ts
index 90f393da..2edd9cd6 100644
--- a/lib/errors/structured-errors.ts
+++ b/lib/errors/structured-errors.ts
@@ -365,6 +365,13 @@ const MATCH_SI: Record = {
message_sv: 'Kunde inte koppla transaktionen till leverantörsfakturan.',
message_en: 'Failed to link transaction to supplier invoice.',
},
+ MATCH_SI_CASH_FX_UNSUPPORTED: {
+ httpStatus: 400,
+ message_sv:
+ 'Kontantmetoden stödjer inte valutakursdifferenser. Byt till löpande bokföring eller bokför valutakursdifferensen manuellt.',
+ message_en:
+ 'Cash accounting does not support exchange-rate differences. Switch to accrual or book the FX difference manually.',
+ },
}
const INVOICE: Record = {
diff --git a/lib/rate-limits/__tests__/inbox.test.ts b/lib/rate-limits/__tests__/inbox.test.ts
new file mode 100644
index 00000000..146ce6fb
--- /dev/null
+++ b/lib/rate-limits/__tests__/inbox.test.ts
@@ -0,0 +1,59 @@
+import { describe, it, expect, vi } from 'vitest'
+import { checkInboxUploadRateLimit } from '../inbox'
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+function makeSupabase(rpcResult: { data?: unknown; error?: unknown }) {
+ return {
+ rpc: vi.fn().mockResolvedValue(rpcResult),
+ } as unknown as SupabaseClient
+}
+
+describe('checkInboxUploadRateLimit', () => {
+ it('returns ok=true when the RPC says ok', async () => {
+ const supabase = makeSupabase({ data: { ok: true }, error: null })
+ const result = await checkInboxUploadRateLimit(supabase, 'company-1')
+ expect(result.ok).toBe(true)
+ expect(result.scope).toBeUndefined()
+ })
+
+ it('returns ok=false with minute scope and retry_after when minute window hit', async () => {
+ const supabase = makeSupabase({
+ data: { ok: false, scope: 'minute', retry_after_sec: 42 },
+ error: null,
+ })
+ const result = await checkInboxUploadRateLimit(supabase, 'company-1')
+ expect(result.ok).toBe(false)
+ expect(result.scope).toBe('minute')
+ expect(result.retryAfterSec).toBe(42)
+ })
+
+ it('returns ok=false with day scope when day window hit', async () => {
+ const supabase = makeSupabase({
+ data: { ok: false, scope: 'day', retry_after_sec: 3600 },
+ error: null,
+ })
+ const result = await checkInboxUploadRateLimit(supabase, 'company-1')
+ expect(result.ok).toBe(false)
+ expect(result.scope).toBe('day')
+ expect(result.retryAfterSec).toBe(3600)
+ })
+
+ it('fails open (ok=true) when the RPC errors — better to accept than 500 a real user', async () => {
+ const supabase = makeSupabase({ data: null, error: { message: 'boom' } })
+ // Silence the console.error the helper emits on infra error.
+ const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
+ const result = await checkInboxUploadRateLimit(supabase, 'company-1')
+ expect(result.ok).toBe(true)
+ spy.mockRestore()
+ })
+
+ it('passes the configured minute and day caps to the RPC', async () => {
+ const supabase = makeSupabase({ data: { ok: true }, error: null })
+ await checkInboxUploadRateLimit(supabase, 'company-xyz')
+ expect(supabase.rpc).toHaveBeenCalledWith('check_and_increment_inbox_quota', {
+ p_company_id: 'company-xyz',
+ p_minute_max: 30,
+ p_day_max: 500,
+ })
+ })
+})
diff --git a/lib/rate-limits/inbox.ts b/lib/rate-limits/inbox.ts
new file mode 100644
index 00000000..7d628cf9
--- /dev/null
+++ b/lib/rate-limits/inbox.ts
@@ -0,0 +1,52 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+/**
+ * Per-company rate limiter for document-inbox ingestion. Backed by the
+ * `check_and_increment_inbox_quota` Postgres RPC (atomic check + increment),
+ * not Upstash — keeps the limiter on the same shared distributed store the
+ * rest of the app already hits, and works without extra env vars on Vercel
+ * and Docker self-hosters alike.
+ *
+ * Both windows are per-company:
+ * - MINUTE_MAX: a real user could only ever hit this with a script or by
+ * holding the upload button. The defense is against burst floods.
+ * - DAY_MAX: the backstop against slow drip abuse. A legitimate end-of-
+ * month batch is well under this number.
+ */
+export interface InboxLimitResult {
+ ok: boolean
+ retryAfterSec?: number
+ scope?: 'minute' | 'day'
+}
+
+const MINUTE_MAX = 30
+const DAY_MAX = 500
+
+export async function checkInboxUploadRateLimit(
+ supabase: SupabaseClient,
+ companyId: string,
+): Promise {
+ const { data, error } = await supabase.rpc('check_and_increment_inbox_quota', {
+ p_company_id: companyId,
+ p_minute_max: MINUTE_MAX,
+ p_day_max: DAY_MAX,
+ })
+ if (error) {
+ // Fail open on infra error. The limiter is defense-in-depth — per-file
+ // size + MIME checks still apply on the upload route. Better to accept
+ // an upload than 500 a real user because Postgres blipped.
+ console.error('[inbox-rate-limit] RPC failed:', error)
+ return { ok: true }
+ }
+ // RPC returns jsonb_build_object payload. The JS client decodes as object.
+ const result = (data ?? { ok: true }) as {
+ ok: boolean
+ scope?: 'minute' | 'day'
+ retry_after_sec?: number
+ }
+ return {
+ ok: result.ok,
+ scope: result.scope,
+ retryAfterSec: result.retry_after_sec,
+ }
+}
diff --git a/supabase/migrations/20260511184255_invoice_inbox_matched_transaction.sql b/supabase/migrations/20260511184255_invoice_inbox_matched_transaction.sql
new file mode 100644
index 00000000..b940997f
--- /dev/null
+++ b/supabase/migrations/20260511184255_invoice_inbox_matched_transaction.sql
@@ -0,0 +1,22 @@
+-- Re-add matched_transaction_id on invoice_inbox_items.
+--
+-- The 20260504180000 migration removed this column along with all the AI
+-- metadata (match_confidence / match_method / match_reasoning) because the
+-- AI subsystem was retired. But the back-reference itself isn't an AI
+-- artifact — it's how the inbox UI knows an item has been linked to a
+-- bank transaction (symmetric with `created_supplier_invoice_id` which
+-- already marks supplier-invoice processing).
+--
+-- The "Koppla till transaktion" and "Skapa transaktion från underlag"
+-- flows both need this column so the inbox can show a "Kopplad" badge
+-- and link back to the matched transaction.
+
+ALTER TABLE public.invoice_inbox_items
+ ADD COLUMN IF NOT EXISTS matched_transaction_id uuid
+ REFERENCES public.transactions(id) ON DELETE SET NULL;
+
+CREATE INDEX IF NOT EXISTS idx_inbox_items_matched_transaction
+ ON public.invoice_inbox_items(company_id, matched_transaction_id)
+ WHERE matched_transaction_id IS NOT NULL;
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260512083712_inbox_rate_limit.sql b/supabase/migrations/20260512083712_inbox_rate_limit.sql
new file mode 100644
index 00000000..1a0578d6
--- /dev/null
+++ b/supabase/migrations/20260512083712_inbox_rate_limit.sql
@@ -0,0 +1,79 @@
+-- Per-company minute + day counters for inbox ingestion (manual upload + email
+-- inbound). Backstops against:
+-- 1) A logged-in user (or compromised session) flooding /upload.
+-- 2) An attacker who discovered a company's inbox address and mails in
+-- hundreds of large attachments.
+--
+-- Atomic check-and-increment under INSERT…ON CONFLICT row locking — same
+-- shape as validate_and_increment_api_key. No Upstash dependency.
+
+CREATE TABLE IF NOT EXISTS public.inbox_rate_counters (
+ company_id uuid NOT NULL REFERENCES public.companies(id) ON DELETE CASCADE,
+ window_kind text NOT NULL CHECK (window_kind IN ('minute','day')),
+ window_key text NOT NULL,
+ count integer NOT NULL DEFAULT 0,
+ updated_at timestamptz NOT NULL DEFAULT now(),
+ PRIMARY KEY (company_id, window_kind, window_key)
+);
+
+ALTER TABLE public.inbox_rate_counters ENABLE ROW LEVEL SECURITY;
+-- No user-facing policies — only SECURITY DEFINER fn writes this.
+
+CREATE OR REPLACE FUNCTION public.check_and_increment_inbox_quota(
+ p_company_id uuid,
+ p_minute_max integer,
+ p_day_max integer
+) RETURNS jsonb
+LANGUAGE plpgsql
+SECURITY DEFINER
+SET search_path = public
+AS $$
+DECLARE
+ v_minute_key text := to_char(now() AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI');
+ v_day_key text := to_char(now() AT TIME ZONE 'Europe/Stockholm', 'YYYY-MM-DD');
+ v_minute_count integer;
+ v_day_count integer;
+BEGIN
+ -- 1) Minute window — slide upsert + increment, then check.
+ INSERT INTO public.inbox_rate_counters (company_id, window_kind, window_key, count)
+ VALUES (p_company_id, 'minute', v_minute_key, 1)
+ ON CONFLICT (company_id, window_kind, window_key)
+ DO UPDATE SET count = inbox_rate_counters.count + 1, updated_at = now()
+ RETURNING count INTO v_minute_count;
+
+ IF v_minute_count > p_minute_max THEN
+ UPDATE public.inbox_rate_counters
+ SET count = count - 1
+ WHERE company_id = p_company_id
+ AND window_kind = 'minute'
+ AND window_key = v_minute_key;
+ RETURN jsonb_build_object('ok', false, 'scope', 'minute', 'retry_after_sec', 60);
+ END IF;
+
+ -- 2) Day window — only checked when minute passed.
+ INSERT INTO public.inbox_rate_counters (company_id, window_kind, window_key, count)
+ VALUES (p_company_id, 'day', v_day_key, 1)
+ ON CONFLICT (company_id, window_kind, window_key)
+ DO UPDATE SET count = inbox_rate_counters.count + 1, updated_at = now()
+ RETURNING count INTO v_day_count;
+
+ IF v_day_count > p_day_max THEN
+ -- Roll both counters back: the request didn't go through.
+ UPDATE public.inbox_rate_counters
+ SET count = count - 1
+ WHERE company_id = p_company_id
+ AND window_kind = 'day'
+ AND window_key = v_day_key;
+ UPDATE public.inbox_rate_counters
+ SET count = count - 1
+ WHERE company_id = p_company_id
+ AND window_kind = 'minute'
+ AND window_key = v_minute_key;
+ RETURN jsonb_build_object('ok', false, 'scope', 'day', 'retry_after_sec', 3600);
+ END IF;
+
+ RETURN jsonb_build_object('ok', true);
+END;
+$$;
+
+NOTIFY pgrst, 'reload schema';
diff --git a/supabase/migrations/20260512092446_inbox_rate_counters_trigger_rls.sql b/supabase/migrations/20260512092446_inbox_rate_counters_trigger_rls.sql
new file mode 100644
index 00000000..4090aa30
--- /dev/null
+++ b/supabase/migrations/20260512092446_inbox_rate_counters_trigger_rls.sql
@@ -0,0 +1,40 @@
+-- Address review feedback on the inbox_rate_counters table:
+--
+-- 1) Add the standard updated_at trigger so any future write path that
+-- bypasses the SECURITY DEFINER RPC keeps the column semantically
+-- correct (matches every other table in the schema — CLAUDE.md
+-- migration rule 2).
+--
+-- 2) Make the "no user access" intent explicit instead of implicit.
+-- RLS is enabled on the table but had no policies. The default behavior
+-- when RLS is on without policies is to deny everything except the
+-- table owner / SECURITY DEFINER functions — which is exactly what we
+-- want — but a future admin tool or diagnostic query running under
+-- the authenticated role will silently get zero rows, which is hard
+-- to debug. The explicit USING (false) policies below state the
+-- intent and surface no-access situations more clearly when running
+-- EXPLAIN or auditing the schema (CLAUDE.md migration rule 1).
+-- Writes still go exclusively through check_and_increment_inbox_quota
+-- (SECURITY DEFINER), which bypasses RLS by design.
+
+CREATE TRIGGER update_inbox_rate_counters_updated_at
+ BEFORE UPDATE ON public.inbox_rate_counters
+ FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();
+
+CREATE POLICY inbox_rate_counters_no_select
+ ON public.inbox_rate_counters FOR SELECT
+ USING (false);
+
+CREATE POLICY inbox_rate_counters_no_insert
+ ON public.inbox_rate_counters FOR INSERT
+ WITH CHECK (false);
+
+CREATE POLICY inbox_rate_counters_no_update
+ ON public.inbox_rate_counters FOR UPDATE
+ USING (false);
+
+CREATE POLICY inbox_rate_counters_no_delete
+ ON public.inbox_rate_counters FOR DELETE
+ USING (false);
+
+NOTIFY pgrst, 'reload schema';
diff --git a/tests/pg/inbox-rate-limit.pg.test.ts b/tests/pg/inbox-rate-limit.pg.test.ts
new file mode 100644
index 00000000..ff709ae0
--- /dev/null
+++ b/tests/pg/inbox-rate-limit.pg.test.ts
@@ -0,0 +1,162 @@
+import { describe, expect, it } from 'vitest'
+import { seedCompany } from '@/tests/pg/fixtures'
+import { getPool } from '@/tests/pg/setup'
+
+/**
+ * Smoke for check_and_increment_inbox_quota (migration 20260512083644).
+ *
+ * Locks in:
+ * - Two atomic upsert windows (minute + day) with serializable counter increment.
+ * - Successful calls return ok=true.
+ * - Minute-cap rejection returns ok=false + scope='minute' + retry_after_sec.
+ * - Day-cap rejection returns ok=false + scope='day'.
+ * - Decrement-on-rejection: counter is rolled back when the call is denied,
+ * so a failed attempt doesn't permanently consume budget. Both minute and
+ * day rejections must roll back the minute counter; day-cap rejection
+ * must also roll back the day counter it just incremented.
+ *
+ * Mock-based tests can't catch a PL/pgSQL syntax error, a wrong column
+ * reference, or an INSERT…ON CONFLICT predicate that targets the wrong index.
+ * This test exercises the RPC against a real Postgres so a broken function
+ * fails loudly at the DB layer instead of passing the unit suite and failing
+ * in production.
+ */
+
+interface QuotaResult {
+ ok: boolean
+ scope?: 'minute' | 'day'
+ retry_after_sec?: number
+}
+
+async function callQuota(
+ companyId: string,
+ minuteMax: number,
+ dayMax: number,
+): Promise {
+ const res = await getPool().query<{ result: QuotaResult }>(
+ `SELECT public.check_and_increment_inbox_quota($1::uuid, $2::int, $3::int) AS result`,
+ [companyId, minuteMax, dayMax],
+ )
+ return res.rows[0]!.result
+}
+
+async function getCounters(
+ companyId: string,
+): Promise<{ minute: number; day: number }> {
+ const res = await getPool().query<{
+ window_kind: 'minute' | 'day'
+ count: number
+ }>(
+ `SELECT window_kind, count
+ FROM public.inbox_rate_counters
+ WHERE company_id = $1`,
+ [companyId],
+ )
+ let minute = 0
+ let day = 0
+ for (const row of res.rows) {
+ if (row.window_kind === 'minute') minute = row.count
+ if (row.window_kind === 'day') day = row.count
+ }
+ return { minute, day }
+}
+
+describe('check_and_increment_inbox_quota.pg', () => {
+ it('returns ok=true and increments both windows on a successful call', async () => {
+ const { companyId } = await seedCompany()
+
+ const result = await callQuota(companyId, 30, 500)
+ expect(result.ok).toBe(true)
+ expect(result.scope).toBeUndefined()
+
+ const counters = await getCounters(companyId)
+ expect(counters.minute).toBe(1)
+ expect(counters.day).toBe(1)
+ })
+
+ it('increments to the cap on the boundary call, then rejects the next one', async () => {
+ const { companyId } = await seedCompany()
+ const MINUTE_MAX = 3
+
+ // Three successful calls take us to count=3 (exactly at the cap).
+ for (let i = 0; i < MINUTE_MAX; i++) {
+ const r = await callQuota(companyId, MINUTE_MAX, 1000)
+ expect(r.ok).toBe(true)
+ }
+ expect((await getCounters(companyId)).minute).toBe(MINUTE_MAX)
+
+ // The 4th call exceeds the cap.
+ const denied = await callQuota(companyId, MINUTE_MAX, 1000)
+ expect(denied.ok).toBe(false)
+ expect(denied.scope).toBe('minute')
+ expect(denied.retry_after_sec).toBe(60)
+
+ // Critical: the rejected call must NOT have permanently consumed budget.
+ // Counter stays at MINUTE_MAX after the rollback inside the RPC.
+ expect((await getCounters(companyId)).minute).toBe(MINUTE_MAX)
+ })
+
+ it('rejects with scope=day when the minute cap is generous but the day cap is hit', async () => {
+ const { companyId } = await seedCompany()
+ const DAY_MAX = 2
+
+ for (let i = 0; i < DAY_MAX; i++) {
+ const r = await callQuota(companyId, 1000, DAY_MAX)
+ expect(r.ok).toBe(true)
+ }
+ const after = await getCounters(companyId)
+ expect(after.minute).toBe(DAY_MAX)
+ expect(after.day).toBe(DAY_MAX)
+
+ const denied = await callQuota(companyId, 1000, DAY_MAX)
+ expect(denied.ok).toBe(false)
+ expect(denied.scope).toBe('day')
+ expect(denied.retry_after_sec).toBe(3600)
+
+ // Both counters must roll back: the day cap was checked AFTER the minute
+ // counter was incremented for this call, so both increments are undone.
+ const final = await getCounters(companyId)
+ expect(final.minute).toBe(DAY_MAX)
+ expect(final.day).toBe(DAY_MAX)
+ })
+
+ it('isolates counters per company', async () => {
+ const { companyId: companyA } = await seedCompany()
+ const { companyId: companyB } = await seedCompany()
+
+ await callQuota(companyA, 30, 500)
+ await callQuota(companyA, 30, 500)
+ await callQuota(companyB, 30, 500)
+
+ const a = await getCounters(companyA)
+ const b = await getCounters(companyB)
+ expect(a.minute).toBe(2)
+ expect(b.minute).toBe(1)
+ })
+
+ it('updated_at trigger fires on counter updates', async () => {
+ const { companyId } = await seedCompany()
+
+ await callQuota(companyId, 30, 500)
+ const first = await getPool().query<{ updated_at: Date }>(
+ `SELECT updated_at FROM public.inbox_rate_counters
+ WHERE company_id = $1 AND window_kind = 'minute'`,
+ [companyId],
+ )
+
+ // Trigger an UPDATE path (second call hits ON CONFLICT DO UPDATE).
+ // Sleep so the timestamp delta is observable.
+ await new Promise((r) => setTimeout(r, 10))
+ await callQuota(companyId, 30, 500)
+
+ const second = await getPool().query<{ updated_at: Date }>(
+ `SELECT updated_at FROM public.inbox_rate_counters
+ WHERE company_id = $1 AND window_kind = 'minute'`,
+ [companyId],
+ )
+
+ expect(second.rows[0]!.updated_at.getTime()).toBeGreaterThan(
+ first.rows[0]!.updated_at.getTime(),
+ )
+ })
+})
diff --git a/types/index.ts b/types/index.ts
index 9318f4fe..d1f75c31 100644
--- a/types/index.ts
+++ b/types/index.ts
@@ -2456,6 +2456,13 @@ export interface KPIReport {
periodComplete: boolean // whether selected period is closed/complete
months: { label: string; income: number; expenses: number; net: number }[]
period: { start: string; end: string }
+ expenseComposition: {
+ class4: number
+ class5: number
+ class6: number
+ class7: number
+ }
+ topSuppliers: { supplier_id: string; supplier_name: string; total: number }[]
}
export interface KPIPreferences {