fix(scoping): Skatteverket per företag + nåbara startkort + företags-scopade val (#1610)

* fix(scoping): skatteverket per company + true pristine gates + scoped dismissals Skatteverket connections become per (user, company): the token table carried BOTH UNIQUE(user_id) and UNIQUE(company_id) (two stacked half migrations), so one connection leaked "connected" onto every company the user belongs to, sync ran the token against the wrong orgnr (behorighet 403), and reconnecting from another company silently moved the row and went dark on the first company's crons. Token reads/writes are now scoped by company through the whole chain (token-store, api-client refresh coalescing, skvRequest and its 21 call sites, resolve-auth, crons, MCP), /skattekonto/saldo answers 401 NOT_CONNECTED for companies without their own row (which is what the page's startkort keys on), and the dashboard connect-nudge counts only the active company's row. Bookkeeping's pristine start card now keys on all-years emptiness via a count probe instead of "no active filters": the default fiscal-year selection counted as a filter, which made the card unreachable on brand-new companies (it showed "inga traffar" instead). Two browser-global localStorage keys become company-scoped with legacy fallbacks: the inbox onboarding dismissal (dismissing on one company hid the card everywhere) and the periodisering auto-detect toggle. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(scoping): dedupe cron work per (user, company) + guard the ledger probe CodeRabbit findings on #1610: the skattekonto sync cron still deduped token rows by user_id alone, which would drop every company but one for multi-company operators (the exact scenario the PR fixes); and the all-years ledger probe could leave a stale false behind on a failed refetch, letting the pristine card render unconfirmed. The probe now resets to unknown in flight and carries the fetch generation guard. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-14 08:21:57 +02:00
parent 4e14182a00
commit 18c20e68e6
28 changed files with 317 additions and 145 deletions
@@ -0,0 +1,47 @@
+import { describe, expect, it } from 'vitest'
+import { seedCompany } from '@/tests/pg/fixtures'
+import { getPool } from '@/tests/pg/setup'
+
+/**
+ * pg-real coverage for 20260814060000_skatteverket_tokens_per_company.sql.
+ *
+ * Skatteverket connections are per (user, company). The table used to carry
+ * BOTH UNIQUE(user_id) and UNIQUE(company_id) (two stacked half-migrations),
+ * which made it impossible for a multi-company operator to hold a connection
+ * for more than one of their companies: the root cause of the cross-company
+ * "connected" leak on the Skattekonto page. This suite locks in the composite
+ * key so neither single-column constraint can quietly come back.
+ */
+
+async function insertTokenRow(userId: string, companyId: string): Promise<void> {
+  await getPool().query(
+    `INSERT INTO public.skatteverket_tokens
+       (user_id, company_id, access_token, refresh_token, expires_at)
+     VALUES ($1, $2, 'enc-access', 'enc-refresh', now() + interval '1 hour')`,
+    [userId, companyId],
+  )
+}
+
+describe('skatteverket_tokens per-company uniqueness', () => {
+  it('allows the same user to hold one connection per company', async () => {
+    const a = await seedCompany()
+    // Second company owned by the same user: insert the membershipless
+    // company row directly; the constraint only concerns (user_id, company_id).
+    const b = await seedCompany()
+
+    await expect(insertTokenRow(a.userId, a.companyId)).resolves.not.toThrow()
+    // Different user, different company: must not collide with a's row
+    // (UNIQUE(user_id) would have rejected a second row for the same user;
+    // UNIQUE(company_id) would have rejected a second row for the company).
+    await expect(insertTokenRow(a.userId, b.companyId)).resolves.not.toThrow()
+    await expect(insertTokenRow(b.userId, a.companyId)).resolves.not.toThrow()
+  })
+
+  it('rejects a second row for the same (user, company) pair', async () => {
+    const { userId, companyId } = await seedCompany()
+    await insertTokenRow(userId, companyId)
+    await expect(insertTokenRow(userId, companyId)).rejects.toThrow(
+      /skatteverket_tokens_user_id_company_id_key/,
+    )
+  })
+})