fix(suppliers): one 10-digit org number key for matching and storage (#2405)

* fix(suppliers): one 10-digit org number key for matching and storage Why the problem occurred: the supplier register was written in three spellings (the form asks for XXXXXX-XXXX, the v1 API and the MCP tool stored whatever the caller sent, the AI extractor emits bare digits) while matchSupplierByIdentity compared raw strings with .eq(). The canonical rule existed three times (normalizeOrgNumber, the MCP fuzzy pass's orgNumberKey, the extractor's toOrg10) and nowhere on the path that decides a match, so every AI-extracted invoice from a hyphen-registered supplier missed the strongest key and fell to exact-name matching. Prod holds 1738 hyphenated rows against 493 bare ones. What was removed or simplified: orgNumberKey (digits only, 10 kept, last 10 of 12, no Luhn) moves into lib/invariants/org-number.ts and replaces the two other copies. The matcher scans the company's suppliers with an org_number and compares keys, the same shape as its vat_number branch, so rows written before the backfill (and self-hosted instances that never run it) match too. CreateSupplierSchema, UpdateSupplierSchema and the staged create_supplier schema store the key; the form renders it through formatOrgNumberDisplay. A backfill migration strips the formatting from existing rows, skipping migration-reset source companies. Why this and not the proposed one: the issue's third layer (CHECK plus a unique index) would fail to create on prod, which holds 94 duplicate (company_id, key) groups across 18 companies, one of them 124 rows under a single placeholder-looking number; that needs a merge decision first and is filed as #2404. Rejecting anything that is not 10 or 12 digits on write was also dropped: 68 prod rows carry foreign registration numbers (DK, DE, NL, FI, GB, IE, US, CZ, IT) in org_number, so Swedish-shaped input is canonicalised and anything else is stored as typed. Luhn stays lenient on suppliers because two rows with the same mistyped number are one supplier and parties is Luhn-strict at promotion already. Fixes #2391 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yCehdxm8yUubGAmoDFZag * fix(suppliers): key only Swedish-shaped org numbers, search and dedup through the key Skeptic pass on the previous commit. Three refutations, all confirmed: 1. orgNumberKey took the last 10 of any 12 digits and stripped letters. A VAT number typed into the org field (SE556012579001, orgnr + 01) keyed to 6012579001, another company's identity, on every write path and in the backfill; 26 prod rows hold exactly that shape (prefixes 55/52/87). A Belgian BE0123456789 lost its country letters the same way. The key now strips only hyphens and spaces and unprefixes 12 digits only behind 16/18/19/20; everything else is null, stored and compared as typed. The migration carries the same rule. 2. The supplier list search, the v1 ?search= filter and the list column all used the raw stored value, so a user searching 556677-88 after the backfill found nothing. Both searches now compare without separators and the column renders XXXXXX-XXXX. 3. Storage was not canonical on every path: the CSV import and the provider migration orchestrator wrote as typed and keyed their re-sync dedup by the raw value, so a Fortnox re-sync sending 556677-8899 would have duplicated the now-bare row. Both write and key through orgNumberKey. Also: the matcher scans live suppliers only, so a register holding an archived hyphenated row next to its live replacement resolves to the live one instead of whichever id sorts first. Refs #2391 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yCehdxm8yUubGAmoDFZag * fix(suppliers): review pass: foreign numbers survive display and dedup, stub key canonical CodeRabbit findings on PR #2405, all verified against the code: - The supplier list rendered through formatOrgNumber, which strips letters and would show BE0123456789 as 012345-6789; it now uses formatOrgNumberDisplay, which leaves anything not Swedish-shaped alone. - The CSV import dedup fell back to digits-only, so BE0123456789 and FR0123456789 collided; the fallback is now the value as typed, in both the parse preview and the execute route. - The provider migration's supplier-invoice stub map was keyed by the raw provider value while the stored row was canonical, so 556677-8899 and 5566778899 on two invoices produced two stubs; the key goes through orgMapKey like the other maps. - v1 response examples show the stored 10-digit form; the request example keeps the hyphenated input. Refs #2391 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yCehdxm8yUubGAmoDFZag * docs(api-skill): regenerate suppliers reference for the canonical org_number example Refs #2391 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013yCehdxm8yUubGAmoDFZag --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-08 10:59:20 +02:00
parent eea410c42b
commit 2303f75a7b
23 changed files with 586 additions and 82 deletions
@@ -10,6 +10,7 @@ import { fetchExchangeRate } from '@/lib/currency/riksbanken'
 import { encryptCustomerPersonalNumber } from '@/lib/customers/protect-personal-number'
 import { normalizeVatRateToFraction } from '@/lib/vat/vat-rate-unit'
 import { normalizeCountryCode } from '@/lib/vat/country-codes'
+import { orgNumberKey } from '@/lib/invariants/org-number'
 import { sumLineVat, lineVatFromPercent } from '@/lib/providers/amounts'
 import type { Currency, CustomerType, ExchangeRate, SupplierType, VatTreatment } from '@/types'
 import type {
@@ -61,6 +62,11 @@ function getOrgNumber(party: PartyDto): string | null {
  return party.legalEntity?.companyId || null
 }

+function canonicalSupplierOrgNumber(value: string | null): string | null {
+  if (!value) return null
+  return orgNumberKey(value) ?? value
+}
+
 const EU_COUNTRIES = ['AT', 'BE', 'BG', 'CY', 'CZ', 'DE', 'DK', 'EE', 'EL', 'ES', 'FI', 'FR', 'GR', 'HR', 'HU', 'IE', 'IT', 'LT', 'LU', 'LV', 'MT', 'NL', 'PL', 'PT', 'RO', 'SI', 'SK']

 /**
@@ -633,7 +639,9 @@ export function mapSupplier(dto: SupplierDto, userId: string, companyId: string)
    email: dto.party.contact?.email || null,
    phone: dto.party.contact?.telephone || null,
    ...addr,
-    org_number: getOrgNumber(dto.party),
+    // suppliers.org_number holds the 10-digit key (#2391); a provider sends
+    // its own spelling ('556677-8899').
+    org_number: canonicalSupplierOrgNumber(getOrgNumber(dto.party)),
    vat_number: dto.vatNumber || null,
    bankgiro: dto.bankGiro || null,
    plusgiro: dto.plusGiro || null,
@@ -29,6 +29,7 @@ import { getProviderResourceForbiddenMessage } from '@/lib/errors/get-error-mess
 import type { CustomerDto, SupplierDto, SalesInvoiceDto, SupplierInvoiceDto, PartyDto } from '@/lib/providers/dto'
 import { resolveConsent } from '@/lib/providers/resolve-consent'
 import { normalizeVatNumber, isValidSwedishVatNumber } from '@/lib/vat/vat-number'
+import { orgNumberKey } from '@/lib/invariants/org-number'
 import {
  fetchCompanyInfoDirect,
  fetchCustomersDirect,
@@ -194,6 +195,14 @@ function getOrgNumberFromParty(party: PartyDto): string | null {
  )
 }

+/**
+ * Dedup key for supplier org numbers: the register stores the 10-digit key
+ * (#2391) while a provider sends whatever spelling it holds ('556677-8899'),
+ * so the map is keyed by orgNumberKey on both sides; a value that is not a
+ * Swedish org number keys by itself, as before.
+ */
+const orgMapKey = (value: string): string => orgNumberKey(value) ?? value
+
 /**
 * Log a foreign-currency document that was imported WITHOUT a SEK conversion.
 *
@@ -484,7 +493,7 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
              .range(from, to)
        )
        for (const row of existingSuppliers) {
-          if (row.org_number) orgNumberToSupplierId.set(row.org_number, row.id)
+          if (row.org_number) orgNumberToSupplierId.set(orgMapKey(row.org_number), row.id)
          if (row.name) nameToSupplierId.set(row.name, row.id)
        }

@@ -509,7 +518,7 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
          // (e.g. PostNord, IKANO BANK) aren't duplicated on every re-sync.
          const orgNumber = getOrgNumberFromParty(supplier.party)
          const existingSupplierId = orgNumber
-            ? orgNumberToSupplierId.get(orgNumber)
+            ? orgNumberToSupplierId.get(orgMapKey(orgNumber))
            : supplier.party.name
              ? nameToSupplierId.get(supplier.party.name)
              : undefined
@@ -520,7 +529,9 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
            continue
          }

-          const pendingKey = (orgNumber ?? `name:${supplier.party.name?.toLowerCase() ?? ''}`).trim()
+          const pendingKey = (
+            orgNumber ? orgMapKey(orgNumber) : `name:${supplier.party.name?.toLowerCase() ?? ''}`
+          ).trim()
          if (pendingSupplierKeys.has(pendingKey)) {
            skipReasons.duplicate = (skipReasons.duplicate ?? 0) + 1
            skipped++
@@ -552,7 +563,7 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
            const providerId = batch[i].dto.id
            const newId = insertedRow.id as string
            supplierIdMap.set(providerId, newId)
-            if (insertedRow.org_number) orgNumberToSupplierId.set(insertedRow.org_number as string, newId)
+            if (insertedRow.org_number) orgNumberToSupplierId.set(orgMapKey(insertedRow.org_number as string), newId)
            if (insertedRow.name) nameToSupplierId.set(insertedRow.name as string, newId)
            imported++
          }
@@ -891,8 +902,8 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
          const supplierOrgNumber = getOrgNumberFromParty(inv.supplier)
          let supplierId: string | null = null

-          if (supplierOrgNumber && orgNumberToSupplierId.has(supplierOrgNumber)) {
-            supplierId = orgNumberToSupplierId.get(supplierOrgNumber)!
+          if (supplierOrgNumber && orgNumberToSupplierId.has(orgMapKey(supplierOrgNumber))) {
+            supplierId = orgNumberToSupplierId.get(orgMapKey(supplierOrgNumber))!
          } else if (nameToSupplierId.has(inv.supplier.name)) {
            supplierId = nameToSupplierId.get(inv.supplier.name)!
          }
@@ -909,7 +920,9 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
          }

          // Need to create a minimal supplier: dedupe the same way as customers.
-          const key = (supplierOrgNumber ?? `name:${inv.supplier.name.toLowerCase()}`).trim()
+          const key = (
+            supplierOrgNumber ? orgMapKey(supplierOrgNumber) : `name:${inv.supplier.name.toLowerCase()}`
+          ).trim()
          let stub = stubByKey.get(key)
          if (!stub) {
            const supplierType = inferTypeFromParty(inv.supplier)
@@ -923,7 +936,7 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
              country:
                inv.supplier.postalAddress?.countryCode ||
                (supplierType === 'swedish_business' ? 'SE' : null),
-              org_number: supplierOrgNumber,
+              org_number: supplierOrgNumber ? orgMapKey(supplierOrgNumber) : supplierOrgNumber,
            }
            stub = { key, row: minimalSupplier, waitingInvoiceIndices: [] }
            stubByKey.set(key, stub)
@@ -957,7 +970,7 @@ export async function executeMigration(options: MigrationOptions): Promise<Migra
                continue
              }
              const newId = insertedRow.id as string
-              if (insertedRow.org_number) orgNumberToSupplierId.set(insertedRow.org_number as string, newId)
+              if (insertedRow.org_number) orgNumberToSupplierId.set(orgMapKey(insertedRow.org_number as string), newId)
              if (insertedRow.name) nameToSupplierId.set(insertedRow.name as string, newId)
              for (const idx of batch[i].waitingInvoiceIndices) {
                resolved[idx] = { ...resolved[idx], supplierId: newId }
@@ -17,6 +17,7 @@ import { z } from 'zod'
 import type { SupabaseClient } from '@supabase/supabase-js'
 import type { InvoiceExtractionResult } from '@/types'
 import { getAiService, readAiConfig, extractJsonObject } from '@/lib/ai'
+import { orgNumberKey } from '@/lib/invariants/org-number'
 import type { AiDocumentInput, AiImageMediaType, ExtractionSkipReason } from '@/lib/ai'
 import { createLogger } from '@/lib/logger'

@@ -232,21 +233,15 @@ export function promoteSingleProminentAmount(
  }
 }

-/** Digits only; the comparable core of an org/VAT number. */
+/** Digits only; the comparable core of a VAT number. */
 const digitsOf = (value: string | null | undefined): string => (value ?? '').replace(/\D/g, '')

 /**
 * Canonical 10-digit form of a Swedish organisation number, or '' when the
- * input is not one. The 12-digit century-prefixed forms denote the same
- * identity: "16" for organisations, "19"/"20" for personnummer-form numbers
- * (enskild firma stores the owner's personnummer as org number). Junk that is
- * not 10 digits after trimming never matches anything.
+ * input is not one: the same key the supplier matcher compares through
+ * (lib/invariants/org-number.ts). Junk never matches anything.
 */
-function toOrg10(digits: string): string {
-  const trimmed =
-    digits.length === 12 && /^(16|19|20)/.test(digits) ? digits.slice(2) : digits
-  return trimmed.length === 10 ? trimmed : ''
-}
+const toOrg10 = (value: string | null | undefined): string => orgNumberKey(value) ?? ''

 /**
 * Never present the receiving company as its own supplier.
@@ -266,8 +261,8 @@ export function stripOwnCompanyAsSupplier(
  own: OwnCompanyIdentity | undefined
 ): InvoiceExtractionResult {
  if (!own) return data
-  const ownOrg10 = toOrg10(digitsOf(own.orgNumber))
-  const extractedOrg10 = toOrg10(digitsOf(data.supplier.orgNumber))
+  const ownOrg10 = toOrg10(own.orgNumber)
+  const extractedOrg10 = toOrg10(data.supplier.orgNumber)
  const extractedVat = digitsOf(data.supplier.vatNumber)
  const orgHit = ownOrg10 !== '' && extractedOrg10 !== '' && extractedOrg10 === ownOrg10
  const vatHit = ownOrg10 !== '' && extractedVat === `${ownOrg10}01`
@@ -73,22 +73,34 @@ function makeMock(opts: {
  const supplierByNameResult = { data: opts.supplierByName ?? null, error: null }
  const insertResult = { data: opts.pendingInsert ?? { id: 'op-1' }, error: null }

-  // suppliers lookups distinguish by query method: org_number → .eq() chain ending in maybeSingle()
-  // name → .ilike() chain ending in maybeSingle().
-  // We stub by tracking the most recent .eq vs .ilike call. Simpler: return
-  // org-result first, name-result second (the tool falls through).
-  let supplierLookupCall = 0
+  // suppliers lookups distinguish by query method: the org_number and
+  // vat_number scans and the candidate search are awaited list queries
+  // (served by supplierList); the exact org_number lookup for a non-Swedish
+  // value is an .eq() chain ending in maybeSingle() and the name lookup an
+  // .ilike() chain ending in maybeSingle(). The last filter method decides
+  // which single-row result maybeSingle() serves.
+  let lastFilter: 'eq' | 'ilike' = 'eq'
  const supplierChain = (): unknown =>
    new Proxy(
      {},
      {
        get(_t, prop) {
-          if (prop === 'maybeSingle') {
-            return () => {
-              supplierLookupCall++
-              return Promise.resolve(supplierLookupCall === 1 ? supplierByOrgResult : supplierByNameResult)
+          if (prop === 'eq') {
+            return (column: string) => {
+              if (column !== 'company_id') lastFilter = 'eq'
+              return supplierChain()
            }
          }
+          if (prop === 'ilike') {
+            return () => {
+              lastFilter = 'ilike'
+              return supplierChain()
+            }
+          }
+          if (prop === 'maybeSingle') {
+            return () =>
+              Promise.resolve(lastFilter === 'ilike' ? supplierByNameResult : supplierByOrgResult)
+          }
          if (prop === 'single') {
            return () =>
              Promise.resolve(
@@ -99,7 +111,7 @@ function makeMock(opts: {
          }
          if (prop === 'then') {
            return (resolve: (v: unknown) => void) =>
-              resolve(opts.supplierList ? { data: opts.supplierList, error: null } : supplierByOrgResult)
+              resolve({ data: opts.supplierList ?? [], error: null })
          }
          return () => supplierChain()
        },
@@ -297,7 +309,9 @@ describe('gnubok_create_supplier_invoice_from_inbox: execute', () => {
        created_supplier_invoice_id: null,
        document_id: 'doc-2',
      },
-      supplierByOrg: { id: 'supplier-org-lookup' },
+      // The register holds the form's hyphenated spelling; the extracted
+      // value is bare digits (#2391).
+      supplierList: [{ id: 'supplier-org-lookup', name: 'Acme AB', org_number: '556677-8899' }],
    })
    const tool = tools.find((t) => t.name === 'gnubok_create_supplier_invoice_from_inbox')!
    const result = (await tool.execute(
@@ -10,6 +10,7 @@
 * fuzzy scores never auto-resolve.
 */

+import { orgNumberKey } from '@/lib/invariants/org-number'
 import { vatNumbersMatch } from '@/lib/suppliers/match-supplier'

 export type SupplierRow = {
@@ -58,23 +59,10 @@ export function normalizeSupplierName(raw: string): string {
  return s
 }

-function digitsOnly(s: string): string {
-  return s.replace(/\D/g, '')
-}
-
-/**
- * Canonical 10-digit key for a Swedish org number. Orgnr is exactly 10
- * significant digits; enskild firma uses the owner's personnummer, which
- * appears in both 10-digit (YYMMDDXXXX) and 12-digit (YYYYMMDDXXXX) forms:
- * the last 10 digits are the same identifier. Anything else is not a Swedish
- * org number and must not fuzzy-match.
- */
-export function orgNumberKey(raw: string): string | null {
-  const d = digitsOnly(raw)
-  if (d.length === 10) return d
-  if (d.length === 12) return d.slice(-10)
-  return null
-}
+// The key moved to lib/invariants/org-number.ts (#2391) so the exact matcher,
+// the write schemas and this fuzzy pass share one rule; re-exported for the
+// existing importers.
+export { orgNumberKey }

 /**
 * Similarity in [0, 1]. Exact normalized match = 1; containment