feat(import/export): article import + register export (xlsx/csv) (#750)

* feat(import/export): article import + register export (xlsx/csv) Add CSV/Excel import for the article register (artiklar), mirroring the existing customer/supplier import pipeline, plus Excel + CSV export for articles, customers and suppliers. Import (lib/import/articles + app/api/import/articles): - Column auto-detection tuned to Fortnox/Visma/Bokio export headers, Swedish-decimal price parsing, VAT snapped to {0,6,12,25}, type/unit normalization. - Dedup by article number then name; 23505 soft-skip; auto-number backfill; revenue-account override kept only when active, otherwise dropped with a warning (never mutates the chart of accounts). - New "Artiklar" flow in the /import hub. Export (app/api/export/* + lib/export/register-export): - Read-only xlsx (default) / csv (?format=csv, UTF-8 BOM) downloads. - Headers chosen so files round-trip back through the importer. - "Exportera" menu added to the articles, customers and suppliers pages. Refs #746. Direct Fortnox/Visma API article fetch tracked in #749. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(import/export): address PR review — lint ratchet + export hardening - xlsx-export: keep `SheetSpec<any>` on the eslint-disabled line (fixes the core-only lint ratchet regression: no-explicit-any 16 -> 15) and define UTF8_BOM as an explicit `` escape instead of a raw BOM character. - export routes (articles/customers/suppliers): move the data queries inside the try/catch, add `Cache-Control: no-store`, and emit a `register exported` audit log line (entity, format, rowCount). - articles parse route: validate `column_overrides` against a Zod schema before trusting it to drive the parser. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(import): drop öre-round pattern on article column-detector confidence The confidence score is a 0-1 heuristic, not money, and is only compared against the 0.8 skip-mapping threshold. Removing the Math.round(x*100)/100 form clears the core-only antipattern ratchet (naive-ore-round 660 -> 659). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(import): flag adjusted VAT rows in the article import edit step Surface VAT snapping/defaulting per row, not just as a file-level warning: the parser sets `vat_rate_adjusted`, the edit step highlights those rows' VAT selector and shows a count banner, and confirming a rate clears the flag. Addresses the Swedish-compliance review note that silent snapping could otherwise store a wrong VAT rate at scale. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-17 14:38:44 +02:00
parent 7aa37fd3b8
commit 2d6ddeafc5
28 changed files with 2614 additions and 85 deletions
@@ -0,0 +1,182 @@
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import {
+  createMockRequest,
+  parseJsonResponse,
+  createQueuedMockSupabase,
+} from '@/tests/helpers'
+
+const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
+
+vi.mock('@/lib/supabase/server', () => ({
+  createClient: () => Promise.resolve(mockSupabase),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const mockEmit = vi.fn().mockResolvedValue(undefined)
+vi.mock('@/lib/events', () => ({ eventBus: { emit: (...a: unknown[]) => mockEmit(...a) } }))
+
+const mockFetchAllRows = vi.fn()
+vi.mock('@/lib/supabase/fetch-all', () => ({
+  fetchAllRows: (...a: unknown[]) => mockFetchAllRows(...a),
+}))
+
+const mockEnsureArticleNumber = vi.fn().mockResolvedValue('AUTO-1')
+vi.mock('@/lib/articles/ensure-article-number', () => ({
+  ensureArticleNumber: (...a: unknown[]) => mockEnsureArticleNumber(...a),
+}))
+
+const mockCheckRevenueAccount = vi.fn().mockResolvedValue('ok')
+vi.mock('@/lib/articles/validate-revenue-account', () => ({
+  checkRevenueAccount: (...a: unknown[]) => mockCheckRevenueAccount(...a),
+}))
+
+import { POST } from '../execute/route'
+
+const mockUser = { id: 'user-1', email: 'test@test.se' }
+
+function row(overrides: Record<string, unknown> = {}) {
+  return {
+    row_index: 2,
+    name: 'Konsulttimme',
+    name_en: null,
+    article_number: null,
+    type: 'tjanst',
+    unit: 'tim',
+    price_excl_vat: 950,
+    vat_rate: 25,
+    revenue_account: null,
+    cost_price: null,
+    ean: null,
+    housework_type: null,
+    notes: null,
+    ...overrides,
+  }
+}
+
+function makeRequest(body: unknown) {
+  return createMockRequest('/api/import/articles/execute', { method: 'POST', body })
+}
+
+describe('POST /api/import/articles/execute', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    reset()
+    mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
+    mockFetchAllRows.mockResolvedValue([])
+    mockCheckRevenueAccount.mockResolvedValue('ok')
+    mockEnsureArticleNumber.mockResolvedValue('AUTO-1')
+  })
+
+  it('returns 401 for unauthenticated requests', async () => {
+    mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
+    const res = await POST(makeRequest({ rows: [row()], update_duplicates: false }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(401)
+  })
+
+  it('returns 400 for an empty rows array', async () => {
+    const res = await POST(makeRequest({ rows: [], update_duplicates: false }))
+    const { status } = await parseJsonResponse(res)
+    expect(status).toBe(400)
+  })
+
+  it('creates new articles and emits article.created', async () => {
+    enqueue({ data: { id: 'a1', name: 'Konsulttimme', article_number: null } })
+    enqueue({ data: { id: 'a2', name: 'Skruv', article_number: 'A-200' } })
+
+    const res = await POST(makeRequest({
+      rows: [row(), row({ row_index: 3, name: 'Skruv', article_number: 'A-200', type: 'vara' })],
+      update_duplicates: false,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.created).toBe(2)
+    expect(body.data.failed).toBe(0)
+    expect(mockEmit).toHaveBeenCalledTimes(2)
+    // The numberless row gets auto-numbered; the one with A-200 does not.
+    expect(mockEnsureArticleNumber).toHaveBeenCalledTimes(1)
+  })
+
+  it('skips a duplicate matched by article number when update_duplicates is false', async () => {
+    mockFetchAllRows.mockResolvedValue([{ id: 'x', name: 'Existing', article_number: 'A-1' }])
+
+    const res = await POST(makeRequest({
+      rows: [row({ article_number: 'A-1' })],
+      update_duplicates: false,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.skipped).toBe(1)
+    expect(body.data.created).toBe(0)
+  })
+
+  it('updates a duplicate matched by article number when update_duplicates is true', async () => {
+    mockFetchAllRows.mockResolvedValue([{ id: 'x', name: 'Old', article_number: 'A-1' }])
+    enqueue({ data: { id: 'x', name: 'New name', article_number: 'A-1' } })
+
+    const res = await POST(makeRequest({
+      rows: [row({ article_number: 'A-1', name: 'New name' })],
+      update_duplicates: true,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.updated).toBe(1)
+    expect(body.data.created).toBe(0)
+  })
+
+  it('matches a duplicate by name (case-insensitive)', async () => {
+    mockFetchAllRows.mockResolvedValue([{ id: 'x', name: 'Konsulttimme', article_number: null }])
+
+    const res = await POST(makeRequest({
+      rows: [row({ name: 'KONSULTTIMME' })],
+      update_duplicates: false,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.skipped).toBe(1)
+  })
+
+  it('treats a 23505 unique violation as a soft skip', async () => {
+    enqueue({ data: null, error: { code: '23505', message: 'duplicate key' } })
+
+    const res = await POST(makeRequest({
+      rows: [row({ article_number: 'A-DUP' })],
+      update_duplicates: false,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.skipped).toBe(1)
+    expect(body.data.failed).toBe(0)
+  })
+
+  it('drops an inactive/unknown revenue account and records a warning', async () => {
+    mockCheckRevenueAccount.mockResolvedValue('activatable')
+    enqueue({ data: { id: 'a1', name: 'Konsulttimme', article_number: 'A-1' } })
+
+    const res = await POST(makeRequest({
+      rows: [row({ article_number: 'A-1', revenue_account: '3999' })],
+      update_duplicates: false,
+    }))
+    const { status, body } = await parseJsonResponse(res)
+
+    expect(status).toBe(200)
+    expect(body.data.created).toBe(1)
+    expect(body.data.warnings.length).toBeGreaterThan(0)
+    expect(body.data.warnings[0]).toContain('3999')
+  })
+})