fix(supplier-invoices): duplicate-payment guard matches abbreviated bank text and shares one detector with the customer side (#2299) (#2345)

* fix(supplier-invoices): duplicate-payment guard matches abbreviated bank text and shares one detector with the customer side

The mark-paid guard probed merchant_name for the FULL supplier name, so the
row that paid Hi3G Access AB (bank text "HI3G", merchant_name empty) never
matched and the payment was booked twice (#2299).

- counterpartyNeedle(): first distinctive token of the name (alnum, legal
  forms dropped, >= 2 chars so initialisms like SJ and 3M survive), probed on
  merchant_name OR description in one .or() per currency sweep; the alnum
  shape is what makes the DSL interpolation safe.
- findDuplicatePaymentCandidatesForSupplierInvoice() beside the customer
  detector; both share the sweep and the scorer. The dashboard route's inline
  copy is deleted; the v1 supplier mark-paid door gets the guard it lacked.
- New match_reason already_booked (row already carries a verifikat, booked
  straight from the bank side): ranked first, carries journal_entry_id, and
  the dialogs, MCP path and pending-operation commit word the remedy as a
  rattelse rather than "link it".
- Customer side gets the same token prefilter and classification.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SaJfqNi4VmsG8FMKq99G6

* test(invoices): align customer mark-paid queued mocks with the one-probe duplicate guard

The customer detector now issues one .or() counterparty probe per currency
sweep instead of two ILIKE queries, so every queued answer after the guard
was consumed one step early: the aggregate-sweep [] became company_settings,
the settings row hit the entry builder, and two tests saw 500 / the wrong
voucher id. Each guard block now enqueues one probe plus the aggregate sweep;
the 409 tests drop the second-probe entry that is no longer read.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SaJfqNi4VmsG8FMKq99G6

* fix(invoices): one logic expression per duplicate-payment sweep, never two or= params

The sweep chain carried two .or() calls (currency clause, then name probe).
postgrest-js appends a query parameter per call, so the client sent or=
twice, and whether PostgREST ANDs a repeated key was never proven in this
repo; had it kept one, the currency predicate would be gone and foreign rows
banded against a kronor figure.

counterpartySweepLogic() now nests both groups under one and() inside a
single top-level or(): and(or(<currency>),or(merchant_name.ilike.*x*,
description.ilike.*x*)). The sweep issues exactly one .or() per currency.

Proof at three levels: unit tests pin the helper's string; a fake-fetch test
runs the real postgrest-js builder and asserts exactly one or= search param
per request; a tool-pg test seeds right-currency+hit, wrong-currency+hit
(with an amount_sek that would pass every JS check) and right-currency+miss
rows against a real PostgREST and asserts, for both detectors and both
sweeps, that only the first comes back, from PostgREST's own response.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_019SaJfqNi4VmsG8FMKq99G6

* fix(invoices): name storno as the already_booked remedy, never "makulera"

A posted verifikat is never deleted; it is corrected by a storno entry
(BFL 5 kap 5 §). The already_booked remedy text in the error catalogue, the
MCP and pending-operation messages and both UI descriptions now say so:
"vänd en av verifikationerna med storno och koppla underlaget till den som
blir kvar" / "reverse one of the two vouchers with a storno entry and attach
the underlag to the remaining one".

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
2026-09-06 18:53:34 +02:00
committed by GitHub
co-authored by Claude Fable 5.1 Jakob Wennberg
parent 82d25b7dee
commit 272d19b287
20 changed files with 1561 additions and 385 deletions
@@ -161,9 +161,8 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
// Fetch invoice
enqueue({ data: invoice, error: null })
// Duplicate-payment guard: merchant_name ILIKE, no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: description ILIKE, no candidates
// Duplicate-payment guard: ONE counterparty probe (merchant_name OR
// description in a single .or(), issue #2299), no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: aggregate sweep (larger unbooked kronor rows), none
enqueue({ data: [], error: null })
@@ -234,8 +233,7 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
// Fetch invoice
enqueue({ data: invoice, error: null })
// Duplicate-payment guard: two ILIKE probes, no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: one counterparty probe, no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: aggregate sweep (larger unbooked kronor rows), none
enqueue({ data: [], error: null })
@@ -266,9 +264,8 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
})
enqueue({ data: invoice, error: null })
// Duplicate-payment guard: merchant_name ILIKE, no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: description ILIKE, no candidates
// Duplicate-payment guard: ONE counterparty probe (merchant_name OR
// description in a single .or(), issue #2299), no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: aggregate sweep (larger unbooked kronor rows), none
enqueue({ data: [], error: null })
@@ -426,7 +423,7 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
})
enqueue({ data: invoice, error: null })
// Duplicate-payment guard: merchant_name ILIKE returns the match
// Duplicate-payment guard: the single counterparty probe returns the match
enqueue({
data: [
{
@@ -440,8 +437,6 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
],
error: null,
})
// description ILIKE, no additional match (dedup keeps merchant_name result)
enqueue({ data: [], error: null })
const request = createMockRequest('/api/invoices/inv-1/mark-paid', { method: 'POST' })
const response = await POST(request, createMockRouteParams({ id: 'inv-1' }))
@@ -803,8 +798,6 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
],
error: null,
})
// description ILIKE, no additional match
enqueue({ data: [], error: null })
const request = createMockRequest('/api/invoices/inv-1/mark-paid', { method: 'POST' })
const response = await POST(request, createMockRouteParams({ id: 'inv-1' }))
@@ -851,8 +844,6 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
],
error: null,
})
// description ILIKE, no additional matches
enqueue({ data: [], error: null })
const request = createMockRequest('/api/invoices/inv-1/mark-paid', { method: 'POST' })
const response = await POST(request, createMockRouteParams({ id: 'inv-1' }))
@@ -877,9 +868,8 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
})
enqueue({ data: invoice, error: null })
// Duplicate-payment guard: merchant_name ILIKE, no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: description ILIKE, no candidates
// Duplicate-payment guard: ONE counterparty probe (merchant_name OR
// description in a single .or(), issue #2299), no candidates
enqueue({ data: [], error: null })
// Duplicate-payment guard: aggregate sweep (larger unbooked kronor rows), none
enqueue({ data: [], error: null })
@@ -994,8 +984,9 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
})
enqueue({ data: invoice, error: null })
// merchant_name ILIKE probe: the bank row is in kronor, because the
// candidate lookup scans transactions.amount, which is SEK.
// EUR currency sweep (one counterparty probe per currency, issue #2299):
// the queued stub ignores filters, so the kronor row lands here and is
// kept by the per-row re-check as a SEK magnitude of the EUR payment.
enqueue({
data: [
{
@@ -1009,7 +1000,7 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
],
error: null,
})
// description ILIKE probe: no additional match.
// SEK currency sweep: no additional match.
enqueue({ data: [], error: null })
const request = createMockRequest('/api/invoices/inv-1/mark-paid', {
@@ -1159,8 +1150,7 @@ describe('POST /api/invoices/[id]/mark-paid', () => {
})
enqueue({ data: invoice, error: null })
enqueue({ data: [], error: null }) // duplicate guard: merchant_name
enqueue({ data: [], error: null }) // duplicate guard: description
enqueue({ data: [], error: null }) // duplicate guard: one counterparty probe
enqueue({ data: [], error: null }) // duplicate guard: aggregate sweep
enqueue({ data: { accounting_method: 'cash', entity_type: 'enskild_firma' }, error: null })
enqueue({ data: { id: 'ip-1' }, error: null }) // invoice_payments insert