chore: MCP intent-tools, BankID enrichment table, multi-tenant fixes (#402)
* chore: MCP intent-tools, BankID enrichment table, multi-tenant fixes MCP server gains six intent-shaped tools that collapse multi-call agent flows into one: vat_close_check, query_journal, auto_match_period, create_supplier_invoice_from_inbox, audit_package, year_end_readiness. Tools wired into TOOL_SCOPE_MAP and OPERATION_RISK_TIERS as appropriate (create_supplier_invoice_from_inbox at medium tier — reversible until approve, but stages a leverantörsskuld). BankID enrichment now persists to a dedicated bankid_enrichment table keyed by user_id. extension_data has been company-scoped (NOT NULL company_id) since the multi-tenant refactor, so every BankID signup has silently been failing the enrichment upsert. Select-company picker reads from the new table. delete_last_voucher (BFNAR 2013:2) needs to clear document_attachments.journal_entry_id before deleting the entry, but the new document immutability trigger blocks that UPDATE. Added the same gnubok.allow_delete transaction-scoped bypass pattern used by the journal-entry/line/retention triggers. pg-real tests cover the happy path, the unauthorized direct UPDATE, and the swap-to-different-entry attempt under the bypass flag. fiscal_periods.no_overlapping_fiscal_periods exclusion was scoped to user_id from before multi-tenant — rebound to company_id so the same user can have overlapping fiscal years across companies they own/are member of. Also adds scripts/seed-demo-account.ts for end-to-end demo seeding (two companies, full FY2025, active FY2026 with mixed state). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(pr-402): address review feedback Migrations - Drop 20260506140000_document_journal_entry_immutability_delete_bypass.sql: redundant with 20260506140000_document_journal_entry_immutability_bypass.sql that landed on main while this branch was open. Both share the same gnubok.allow_delete pattern; main's version is what the DB actually has. - Rename 20260506150000_bankid_enrichment_table.sql → 20260506160000_bankid_enrichment_table.sql to clear the timestamp clash with 20260506150000_protect_document_journal_link.sql on main (Supabase branch preview was failing on schema_migrations PK collision). Tests - Drop the swap-under-flag test from delete-last-voucher.pg.test.ts: main's bypass returns NEW unconditionally when gnubok.allow_delete='true', so the swap is permitted. Drop the duplicate happy-path test (already covered by 'clears journal_entry_id on attached documents and deletes the voucher'). Keep the unauthorized-direct-UPDATE test. - Add bankid-enrichment.pg.test.ts covering the SELECT RLS policy: user reads own row, cannot read another user's row, INSERT denied for authenticated. gnubok_query_journal - amount_min/amount_max is applied post-fetch (PostgREST can't OR abs(debit) and abs(credit) cleanly), but PostgREST's count is computed pre-filter. Reporting that as total_lines mislead agents into paginating a tail that was already filtered out. When the amount filter is applied, anchor total_lines and truncated to the filtered set and surface db_matched_pre_amount_filter + amount_filter_applied_post_fetch separately. - Escape `_` in the free-text LIKE filter so a search for "2_441" doesn't match "2X441". VAT close check - Reverse-charge blocker no longer fires on ruta 30 (seller-side domestic omvänd skattskyldighet) — the seller books no VAT, the buyer does, so missing ruta 48 is expected. Now scoped to ruta 31/32 (EU acquisition) where the buyer must book both calculated output (2615) and matching ingående moms (2645). - High-value receipt threshold no longer reads journal_entries.total_amount (column doesn't exist; check silently never fired). Sums debits across the entry's lines, which equals the gross for ordinary purchase entries — comparing a gross figure against the BFL/ML 4 000 SEK threshold per ML 17 kap 26–28 §. seed-demo-account.ts - Require an explicit email argument; refuse to run with the previously hardcoded fallback that would silently target a real user. Ensure email is non-undefined for downstream typing. - Type the supabase fiscal_periods insert result locally so tsc no longer reports 'fp implicitly any' from the loose untyped client. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(test): adjust fiscal-period-start-day pg test for per-company overlap The pg-real failure on PR #402 was a latent bug surfaced by this branch's fiscal_periods exclusion constraint flip from user_id to company_id (migration 20260506140100). The test was inserting periods that overlapped seedCompany's default 2026-01-01..2026-12-31 period; the previous constraint slipped past it because the test's INSERT didn't set user_id (NULL escapes the WITH = match), so two same-company overlapping periods silently coexisted. Now that the constraint correctly fires per company, pick years that don't overlap with the seeded 2026 period. The trigger's behavior under test (allow mid-month start when no earlier period exists, allow back-dated SIE imports, reject mid-month start when an earlier period exists) is unchanged. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(vat-close-check): correct reverse-charge/import blocker rutor Rutor 30/31/32 are the buyer's calculated utgående moms on reverse- charge purchases (domestic byggtjänster/electronics → 2614 → ruta 30; EU goods → 2624 → ruta 31; EU services → 2634 → ruta 32). The buyer must also book matching ingående moms (2647 inhemskt / 2645 utlandet → ruta 48). The previous fix removed ruta 30 on the basis that it was seller-side; that's incorrect — domestic-RC sellers book no VAT at all (they report only beskattningsunderlag on ruta 41), so 2614 only sees buyer-side entries. Restore ruta 30. Also extend the check to import rutor 60/61/62 (non-EU import VAT declared via momsdeklaration since 2015 — 2615/2625/2635). Same mechanic: importer books output VAT on these rutor and deducts the input side via ruta 48. SaaS-from-AWS / OpenAI / Vercel companies hit this path; without including 60/61/62 the blocker would silently miss their misbookings. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(mcp): expose ruta 60/61/62 (import VAT) on the local VatReportResult The vat-close-check fix referenced vatReport.rutor.ruta60/61/62 but the MCP server's local VatReportResult type only carries ruta 05-49. Build broke on tsc. Extend the MCP server's slim VAT report to also project import VAT — 2615 → ruta 60 (25%), 2625 → ruta 61 (12%), 2635 → ruta 62 (6%) — and fold those into ruta 49 (att betala/återfå). Mirrors the BAS-to-Ruta mapping in lib/reports/vat-declaration.ts. Output schema and required list updated accordingly. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
ce3af4d17e
commit
4131db2894
@@ -209,7 +209,7 @@ describe('POST /bankid/complete', () => {
|
||||
})
|
||||
|
||||
describe('enrichment — SPAR + CompanyRoles', () => {
|
||||
it('requests both SPAR and CompanyRoles, fetches data, and persists only companyRoles (no PII) to extension_data', async () => {
|
||||
it('requests both SPAR and CompanyRoles, fetches data, and persists only companyRoles (no PII) to bankid_enrichment', async () => {
|
||||
vi.mocked(collectBankIdResult).mockResolvedValue(makeSession())
|
||||
vi.mocked(requestEnrichment).mockResolvedValueOnce({
|
||||
enrichmentId: 'enr-1',
|
||||
@@ -257,14 +257,14 @@ describe('POST /bankid/complete', () => {
|
||||
{ error: null }, // bankid_identities insert OK
|
||||
])
|
||||
|
||||
// Intercept the extension_data upsert so we can assert the persisted shape
|
||||
// Intercept the bankid_enrichment upsert so we can assert the persisted shape
|
||||
// contains no SPAR / personnummer / name. Other tables fall through to the
|
||||
// queued chain.
|
||||
const upsertSpy = vi.fn().mockResolvedValue({ error: null })
|
||||
const origFrom = client.from as unknown as ReturnType<typeof vi.fn>
|
||||
const queuedFrom = origFrom.getMockImplementation() as (table: string) => unknown
|
||||
origFrom.mockImplementation((table: string) => {
|
||||
if (table === 'extension_data') {
|
||||
if (table === 'bankid_enrichment') {
|
||||
return { upsert: upsertSpy }
|
||||
}
|
||||
return queuedFrom(table)
|
||||
@@ -286,21 +286,19 @@ describe('POST /bankid/complete', () => {
|
||||
)
|
||||
expect(vi.mocked(fetchEnrichmentData)).toHaveBeenCalledWith('/api/v1/enrichment/data/abc')
|
||||
|
||||
// Persisted blob must contain companyRoles + enrichedAtUtc only.
|
||||
// Persisted row must contain company_roles + enriched_at_utc only.
|
||||
// SPAR (personnummer / name / address / birth date) must NOT be stored,
|
||||
// even when TIC returns it — those fields live in bankid_identities (encrypted).
|
||||
expect(upsertSpy).toHaveBeenCalledTimes(1)
|
||||
const [persistedRow] = upsertSpy.mock.calls[0] as [
|
||||
{ key: string; value: Record<string, unknown> },
|
||||
]
|
||||
expect(persistedRow.key).toBe('bankid_enrichment')
|
||||
expect(persistedRow.value).toEqual({
|
||||
companyRoles: expect.any(Array),
|
||||
enrichedAtUtc: '2026-05-06T11:30:00Z',
|
||||
const [persistedRow] = upsertSpy.mock.calls[0] as [Record<string, unknown>]
|
||||
expect(persistedRow).toEqual({
|
||||
user_id: expect.any(String),
|
||||
company_roles: expect.any(Array),
|
||||
enriched_at_utc: '2026-05-06T11:30:00Z',
|
||||
})
|
||||
expect(persistedRow.value).not.toHaveProperty('spar')
|
||||
expect(persistedRow.value).not.toHaveProperty('personalNumber')
|
||||
expect(persistedRow.value).not.toHaveProperty('name')
|
||||
expect(persistedRow).not.toHaveProperty('spar')
|
||||
expect(persistedRow).not.toHaveProperty('personalNumber')
|
||||
expect(persistedRow).not.toHaveProperty('name')
|
||||
})
|
||||
})
|
||||
|
||||
|
||||
@@ -0,0 +1,72 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { getPool, withUserContext } from '@/tests/pg/setup'
|
||||
import { insertAuthUser } from '@/tests/pg/fixtures'
|
||||
|
||||
// RLS coverage for `bankid_enrichment` (migration 20260506160000). The table
|
||||
// holds CompanyRoles fetched via TIC right after BankID auth and is keyed by
|
||||
// user_id. Reads must be scoped to auth.uid(); writes are service-role only
|
||||
// (no INSERT/UPDATE policy → RLS denies for authenticated).
|
||||
|
||||
async function seedEnrichment(userId: string, roles: unknown[]): Promise<void> {
|
||||
await getPool().query(
|
||||
`INSERT INTO public.bankid_enrichment (user_id, company_roles, enriched_at_utc)
|
||||
VALUES ($1, $2::jsonb, now())`,
|
||||
[userId, JSON.stringify(roles)],
|
||||
)
|
||||
}
|
||||
|
||||
describe('bankid_enrichment RLS', () => {
|
||||
it("lets a user read their own enrichment row", async () => {
|
||||
const userA = await insertAuthUser()
|
||||
await seedEnrichment(userA, [{ orgNumber: '5560000001', position: 'VD' }])
|
||||
|
||||
await withUserContext(userA, async (client) => {
|
||||
const { rows } = await client.query<{ user_id: string }>(
|
||||
'SELECT user_id FROM public.bankid_enrichment WHERE user_id = $1',
|
||||
[userA],
|
||||
)
|
||||
expect(rows).toHaveLength(1)
|
||||
expect(rows[0]!.user_id).toBe(userA)
|
||||
})
|
||||
})
|
||||
|
||||
it("hides another user's enrichment row", async () => {
|
||||
const userA = await insertAuthUser()
|
||||
const userB = await insertAuthUser()
|
||||
await seedEnrichment(userA, [{ orgNumber: '5560000001' }])
|
||||
await seedEnrichment(userB, [{ orgNumber: '5560000002' }])
|
||||
|
||||
// Querying as userA must not see userB's row even with an explicit filter.
|
||||
await withUserContext(userA, async (client) => {
|
||||
const { rows } = await client.query(
|
||||
'SELECT user_id FROM public.bankid_enrichment WHERE user_id = $1',
|
||||
[userB],
|
||||
)
|
||||
expect(rows).toHaveLength(0)
|
||||
|
||||
// Unfiltered SELECT must return only userA's row.
|
||||
const all = await client.query<{ user_id: string }>(
|
||||
'SELECT user_id FROM public.bankid_enrichment',
|
||||
)
|
||||
const seen = new Set(all.rows.map((r) => r.user_id))
|
||||
expect(seen.has(userA)).toBe(true)
|
||||
expect(seen.has(userB)).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
it('denies INSERT from authenticated role (service-role only)', async () => {
|
||||
const userA = await insertAuthUser()
|
||||
|
||||
// The migration grants only SELECT to authenticated; writes go through
|
||||
// the service role inside the TIC extension's BankID complete handler.
|
||||
await withUserContext(userA, async (client) => {
|
||||
await expect(
|
||||
client.query(
|
||||
`INSERT INTO public.bankid_enrichment (user_id, company_roles)
|
||||
VALUES ($1, '[]'::jsonb)`,
|
||||
[userA],
|
||||
),
|
||||
).rejects.toThrow(/row-level security/i)
|
||||
})
|
||||
})
|
||||
})
|
||||
@@ -31,16 +31,21 @@ const log = createLogger('tic/bankid')
|
||||
|
||||
/**
|
||||
* Request SPAR + CompanyRoles enrichment for a completed BankID session and
|
||||
* cache the CompanyRoles slice in `extension_data` for the
|
||||
* cache the CompanyRoles slice in `bankid_enrichment` for the
|
||||
* /select-company picker.
|
||||
*
|
||||
* Stored in `bankid_enrichment` (user-keyed) rather than `extension_data`
|
||||
* because enrichment runs before the user has a company; `extension_data`
|
||||
* has been company-scoped (NOT NULL company_id) since the multi-tenant
|
||||
* refactor.
|
||||
*
|
||||
* SPAR (personnummer, address, name, birth date) is requested so TIC will
|
||||
* complete the enrichment, but is intentionally NOT persisted: personnummer
|
||||
* is already hashed + encrypted in `bankid_identities`, names live there too,
|
||||
* and no UI currently consumes the address. Storing the SPAR blob in
|
||||
* `extension_data.value` (a plain JSON column) would expose national-ID-level
|
||||
* PII to anyone with read access. If/when address pre-fill is built, encrypt
|
||||
* the relevant fields the same way `encryptPersonalNumber` does for pnr.
|
||||
* and no UI currently consumes the address. Storing the SPAR blob alongside
|
||||
* company roles would expose national-ID-level PII. If/when address pre-fill
|
||||
* is built, encrypt the relevant fields the same way `encryptPersonalNumber`
|
||||
* does for pnr.
|
||||
*
|
||||
* Non-blocking: any failure is logged and swallowed — BankID auth must still
|
||||
* succeed even if enrichment is down.
|
||||
@@ -125,19 +130,26 @@ async function fetchAndStoreEnrichment(
|
||||
|
||||
// Persist only what consumers actually read. See block comment on
|
||||
// fetchAndStoreEnrichment for why SPAR + personnummer + name are excluded.
|
||||
const persistedValue = {
|
||||
companyRoles: enrichmentData.companyRoles ?? [],
|
||||
enrichedAtUtc: enrichmentData.enrichedAtUtc,
|
||||
}
|
||||
|
||||
await supabase
|
||||
.from('extension_data')
|
||||
const { error: upsertError } = await supabase
|
||||
.from('bankid_enrichment')
|
||||
.upsert({
|
||||
user_id: userId,
|
||||
extension_id: 'tic',
|
||||
key: 'bankid_enrichment',
|
||||
value: persistedValue,
|
||||
}, { onConflict: 'user_id,extension_id,key' })
|
||||
company_roles: enrichmentData.companyRoles ?? [],
|
||||
enriched_at_utc: enrichmentData.enrichedAtUtc ?? null,
|
||||
}, { onConflict: 'user_id' })
|
||||
|
||||
if (upsertError) {
|
||||
log.warn('enrichment upsert failed (non-blocking)', {
|
||||
message: upsertError.message,
|
||||
code: upsertError.code,
|
||||
details: upsertError.details,
|
||||
hint: upsertError.hint,
|
||||
})
|
||||
} else {
|
||||
log.info('enrichment persisted to bankid_enrichment', {
|
||||
roleCount: enrichmentData.companyRoles?.length ?? 0,
|
||||
})
|
||||
}
|
||||
} catch (enrichError) {
|
||||
log.warn('enrichment failed (non-blocking)', enrichError)
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user