feat: add INK2 declaration, full archive export, AI consent gate, fix VAT declaration rutor

- Fix VAT declaration ruta mappings to match SKV 4700 form correctly (ruta 05 = total taxable sales, ruta 10/11/12 = output VAT per rate) - Add INK2 declaration report for aktiebolag with SRU export - Add full archive ZIP export for 7-year retention compliance - Add AI consent gate requiring user approval before AI extension API calls - Add DPA and privacy policy public pages - Add audit trail API routes - Update VAT registration threshold from 80k to 120k kr in onboarding - Update CLAUDE.md documentation Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>
2026-03-05 14:20:47 +01:00
parent 50bf7b3b0f
commit 29240738fa
32 changed files with 3496 additions and 97 deletions
@@ -0,0 +1,119 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createMockSupabase } from '@/tests/helpers'
+import {
+  hasAiConsent,
+  grantAiConsent,
+  revokeAiConsent,
+  isAiExtension,
+  CURRENT_CONSENT_VERSION,
+} from '../ai-consent'
+
+describe('ai-consent', () => {
+  let supabase: ReturnType<typeof createMockSupabase>['supabase']
+  let mockResult: ReturnType<typeof createMockSupabase>['mockResult']
+
+  beforeEach(() => {
+    vi.clearAllMocks()
+    const mock = createMockSupabase()
+    supabase = mock.supabase
+    mockResult = mock.mockResult
+  })
+
+  describe('isAiExtension', () => {
+    it('returns true for AI extensions', () => {
+      expect(isAiExtension('receipt-ocr')).toBe(true)
+      expect(isAiExtension('ai-categorization')).toBe(true)
+      expect(isAiExtension('ai-chat')).toBe(true)
+    })
+
+    it('returns false for non-AI extensions', () => {
+      expect(isAiExtension('enable-banking')).toBe(false)
+      expect(isAiExtension('email')).toBe(false)
+      expect(isAiExtension('calendar')).toBe(false)
+    })
+  })
+
+  describe('hasAiConsent', () => {
+    it('returns true for non-AI extensions without checking DB', async () => {
+      const result = await hasAiConsent(supabase as any, 'user-1', 'enable-banking')
+      expect(result).toBe(true)
+      expect(supabase.from).not.toHaveBeenCalled()
+    })
+
+    it('returns false when no consent record exists', async () => {
+      mockResult({ data: null })
+      const result = await hasAiConsent(supabase as any, 'user-1', 'receipt-ocr')
+      expect(result).toBe(false)
+    })
+
+    it('returns true after consent is granted with current version', async () => {
+      mockResult({
+        data: {
+          value: {
+            consented: true,
+            version: CURRENT_CONSENT_VERSION,
+            granted_at: '2024-01-01T00:00:00Z',
+          },
+        },
+      })
+      const result = await hasAiConsent(supabase as any, 'user-1', 'receipt-ocr')
+      expect(result).toBe(true)
+    })
+
+    it('returns false after consent is revoked', async () => {
+      mockResult({
+        data: {
+          value: {
+            consented: false,
+            version: CURRENT_CONSENT_VERSION,
+            revoked_at: '2024-01-02T00:00:00Z',
+          },
+        },
+      })
+      const result = await hasAiConsent(supabase as any, 'user-1', 'receipt-ocr')
+      expect(result).toBe(false)
+    })
+
+    it('returns false for outdated consent version', async () => {
+      mockResult({
+        data: {
+          value: {
+            consented: true,
+            version: CURRENT_CONSENT_VERSION - 1,
+            granted_at: '2024-01-01T00:00:00Z',
+          },
+        },
+      })
+      const result = await hasAiConsent(supabase as any, 'user-1', 'receipt-ocr')
+      expect(result).toBe(false)
+    })
+  })
+
+  describe('grantAiConsent', () => {
+    it('upserts consent record to extension_data', async () => {
+      mockResult({ data: null, error: null })
+      await grantAiConsent(supabase as any, 'user-1', 'receipt-ocr')
+
+      expect(supabase.from).toHaveBeenCalledWith('extension_data')
+    })
+
+    it('does nothing for non-AI extensions', async () => {
+      await grantAiConsent(supabase as any, 'user-1', 'enable-banking')
+      expect(supabase.from).not.toHaveBeenCalled()
+    })
+  })
+
+  describe('revokeAiConsent', () => {
+    it('upserts revoked consent to extension_data', async () => {
+      mockResult({ data: null, error: null })
+      await revokeAiConsent(supabase as any, 'user-1', 'ai-chat')
+
+      expect(supabase.from).toHaveBeenCalledWith('extension_data')
+    })
+
+    it('does nothing for non-AI extensions', async () => {
+      await revokeAiConsent(supabase as any, 'user-1', 'email')
+      expect(supabase.from).not.toHaveBeenCalled()
+    })
+  })
+})
@@ -0,0 +1,130 @@
+import type { SupabaseClient } from '@supabase/supabase-js'
+
+/**
+ * AI Consent Service
+ *
+ * Manages per-extension consent for AI features that send user data to
+ * third-party AI providers. Required before any AI extension API call.
+ *
+ * Uses the existing `extension_data` table (migration 020) with key='ai_consent'.
+ *
+ * Version bump policy:
+ * - BUMP version when: New sub-processor added, new data type sent to existing
+ *   provider, changed processing purpose.
+ * - DO NOT bump when: Bug fix, model upgrade within same provider
+ *   (e.g. Haiku 4.5 -> Haiku 5), performance improvements.
+ * - When version bumps, existing consents become invalid and users must re-consent.
+ */
+
+export const CURRENT_CONSENT_VERSION = 1
+
+export const AI_EXTENSIONS = ['receipt-ocr', 'ai-categorization', 'ai-chat'] as const
+
+export type AiExtensionId = (typeof AI_EXTENSIONS)[number]
+
+export function isAiExtension(extensionId: string): extensionId is AiExtensionId {
+  return (AI_EXTENSIONS as readonly string[]).includes(extensionId)
+}
+
+export const AI_DATA_DISCLOSURES: Record<AiExtensionId, {
+  provider: string
+  dataTypes: string[]
+  purpose: string
+}> = {
+  'receipt-ocr': {
+    provider: 'Anthropic',
+    dataTypes: ['Kvittobilder', 'Extraherad text fran kvitton'],
+    purpose: 'Automatisk avlasning och kategorisering av kvitton',
+  },
+  'ai-categorization': {
+    provider: 'Anthropic, OpenAI',
+    dataTypes: ['Transaktionsbeskrivningar', 'Belopp', 'Bokformallar'],
+    purpose: 'Automatisk kategorisering av banktransaktioner',
+  },
+  'ai-chat': {
+    provider: 'Anthropic, OpenAI',
+    dataTypes: ['Chattmeddelanden', 'Bokforingsdata som refereras i chatten'],
+    purpose: 'AI-assistent for bokforingsfragor',
+  },
+}
+
+/**
+ * Check if user has valid AI consent for the given extension.
+ * Returns true for non-AI extensions (no consent needed).
+ */
+export async function hasAiConsent(
+  supabase: SupabaseClient,
+  userId: string,
+  extensionId: string
+): Promise<boolean> {
+  if (!isAiExtension(extensionId)) {
+    return true
+  }
+
+  const { data } = await supabase
+    .from('extension_data')
+    .select('value')
+    .eq('user_id', userId)
+    .eq('extension_id', extensionId)
+    .eq('key', 'ai_consent')
+    .single()
+
+  if (!data?.value) return false
+
+  const consent = data.value as { consented: boolean; version: number }
+  return consent.consented === true && consent.version >= CURRENT_CONSENT_VERSION
+}
+
+/**
+ * Grant AI consent for an extension.
+ */
+export async function grantAiConsent(
+  supabase: SupabaseClient,
+  userId: string,
+  extensionId: string
+): Promise<void> {
+  if (!isAiExtension(extensionId)) return
+
+  await supabase
+    .from('extension_data')
+    .upsert(
+      {
+        user_id: userId,
+        extension_id: extensionId,
+        key: 'ai_consent',
+        value: {
+          consented: true,
+          version: CURRENT_CONSENT_VERSION,
+          granted_at: new Date().toISOString(),
+        },
+      },
+      { onConflict: 'user_id,extension_id,key' }
+    )
+}
+
+/**
+ * Revoke AI consent for an extension.
+ */
+export async function revokeAiConsent(
+  supabase: SupabaseClient,
+  userId: string,
+  extensionId: string
+): Promise<void> {
+  if (!isAiExtension(extensionId)) return
+
+  await supabase
+    .from('extension_data')
+    .upsert(
+      {
+        user_id: userId,
+        extension_id: extensionId,
+        key: 'ai_consent',
+        value: {
+          consented: false,
+          version: CURRENT_CONSENT_VERSION,
+          revoked_at: new Date().toISOString(),
+        },
+      },
+      { onConflict: 'user_id,extension_id,key' }
+    )
+}