fix(import): SIE bulk-delete on service client + provider/reporting/b… (#724)

* fix(import): SIE bulk-delete on service client + provider/reporting/banking fixes Rebuilt branch onto main as a single commit. - import: run SIE bulk-delete RPCs on the service client to escape the 8s statement_timeout; undo_sie_import now takes an explicit actor (p_user_id) so its owner/admin gate works when auth.uid() is NULL on the service client (migration 20260624120000) + pg-real regression test - providers: distinguish missing Fortnox license from expired connection; provider_consent_tokens PK regression test - reports: include unmapped BAS expense groups in the income statement - enable-banking: reconnect closed/expired bank sessions in place - bookkeeping: surface linked invoices as underlag on the verifikat view - scripts: track BL cleanup/diagnostic tooling; data files (*.csv) are git-ignored and consentId is now a required arg with no silent default Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(import): add Cache-Control header to journal entry references response --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-14 23:40:26 +02:00
parent db8983ba9e
commit 43925bc2d3
37 changed files with 2456 additions and 1152 deletions
@@ -0,0 +1,63 @@
+import { describe, it, expect } from 'vitest'
+import { randomUUID } from 'node:crypto'
+import { getPool } from '@/tests/pg/setup'
+import { seedCompany } from '@/tests/pg/fixtures'
+
+// Regression guard for a destructive bug: resolveConsent()'s optimistic
+// concurrency guard ran `UPDATE provider_consent_tokens … .select('id')`, but
+// this table's PRIMARY KEY is `consent_id` and it has NO `id` column. Postgres
+// rejected the whole statement ("column provider_consent_tokens.id does not
+// exist"), which surfaced as updateError AFTER the provider had already rotated
+// the refresh token — permanently breaking the consent.
+//
+// Unit mocks can't catch this (they replay queued data regardless of the
+// selected columns), so we assert the real query shapes against real Postgres.
+
+async function seedConsentWithToken(): Promise<{ consentId: string; expiresAt: string }> {
+  const { companyId } = await seedCompany()
+  const consentId = randomUUID()
+  const expiresAt = '2020-01-01T00:00:00.000Z'
+
+  await getPool().query(
+    `INSERT INTO provider_consents (id, company_id, name, status, provider)
+     VALUES ($1, $2, $3, 1, 'fortnox')`,
+    [consentId, companyId, `pg-real-${consentId}`],
+  )
+  await getPool().query(
+    `INSERT INTO provider_consent_tokens
+       (consent_id, provider, access_token, refresh_token, token_expires_at)
+     VALUES ($1, 'fortnox', 'old-access', 'old-refresh', $2)`,
+    [consentId, expiresAt],
+  )
+  return { consentId, expiresAt }
+}
+
+describe('provider_consent_tokens guarded update (pg-real)', () => {
+  it('the rotation UPDATE … RETURNING consent_id is valid and matches the row', async () => {
+    const { consentId, expiresAt } = await seedConsentWithToken()
+
+    // This mirrors resolveConsent()'s guarded update exactly. `consent_id` is
+    // the PK; selecting it must succeed and return the matched row.
+    const { rows } = await getPool().query(
+      `UPDATE provider_consent_tokens
+          SET access_token = $1, refresh_token = $2, token_expires_at = $3
+        WHERE consent_id = $4 AND token_expires_at = $5
+        RETURNING consent_id`,
+      ['new-access', 'new-refresh', '2030-01-01T00:00:00.000Z', consentId, expiresAt],
+    )
+
+    expect(rows).toHaveLength(1)
+    expect(rows[0].consent_id).toBe(consentId)
+  })
+
+  it('there is no `id` column to select (proves why the old query broke)', async () => {
+    const { consentId } = await seedConsentWithToken()
+
+    await expect(
+      getPool().query(
+        `SELECT id FROM provider_consent_tokens WHERE consent_id = $1`,
+        [consentId],
+      ),
+    ).rejects.toThrow(/column .*id.* does not exist/i)
+  })
+})
@@ -9,9 +9,15 @@ vi.mock('@/lib/providers/briox/oauth', () => ({
  refreshBrioxToken: vi.fn(),
 }));

+vi.mock('@/lib/providers/fortnox/oauth', () => ({
+  refreshFortnoxToken: vi.fn(),
+}));
+
 import { createServiceClient } from '@/lib/supabase/server';
 import { refreshBrioxToken } from '@/lib/providers/briox/oauth';
+import { refreshFortnoxToken } from '@/lib/providers/fortnox/oauth';
 import { resolveConsent } from '../resolve-consent';
+import { ProviderCallError } from '../with-provider-call';

 const consentRow = { id: 'c1', company_id: 'co1', provider: 'briox', status: 1 };

@@ -52,7 +58,7 @@ describe('resolveConsent — Briox token refresh concurrency', () => {
  it('persists the rotated pair when the guarded update wins the race', async () => {
    mock.enqueue({ data: [consentRow] }); // consent lookup
    mock.enqueue({ data: [expiredTokens] }); // expired token row
-    mock.enqueue({ data: [{ id: 't1' }] }); // guarded update matched 1 row
+    mock.enqueue({ data: [{ consent_id: 'c1' }] }); // guarded update matched 1 row (PK is consent_id, not id)

    const result = await resolveConsent('co1', 'c1');

@@ -98,4 +104,63 @@ describe('resolveConsent — Briox token refresh concurrency', () => {
      message: expect.stringContaining('re-enter the credentials'),
    });
  });
+
+  it('rethrows a dead refresh token as PROVIDER_AUTH_EXPIRED so callers prompt reconnect', async () => {
+    mock.enqueue({ data: [consentRow] }); // consent lookup
+    mock.enqueue({ data: [expiredTokens] }); // expired token row
+
+    // Mirrors Fortnox's `400 invalid_grant`: the raw helper throws a plain
+    // Error whose status lives only in the message string. resolveConsent must
+    // still classify it as an expired connection, not let it fall through to a
+    // generic 500 at the route.
+    vi.mocked(refreshBrioxToken).mockRejectedValueOnce(
+      new Error('Briox token refresh failed: 400 {"error":"invalid_grant"}'),
+    );
+
+    const err = await resolveConsent('co1', 'c1').catch((e) => e);
+
+    expect(err).toBeInstanceOf(ProviderCallError);
+    expect(err.code).toBe('PROVIDER_AUTH_EXPIRED');
+    expect(err.provider).toBe('briox');
+  });
+
+  it('maps Fortnox error_missing_license to PROVIDER_LICENSE_MISSING (not a revivable reconnect)', async () => {
+    const fortnoxConsent = { id: 'c2', company_id: 'co1', provider: 'fortnox', status: 1 };
+    mock.enqueue({ data: [fortnoxConsent] }); // consent lookup
+    mock.enqueue({ data: [expiredTokens] }); // expired token row
+
+    // Fortnox answers the token endpoint with error_missing_license when the
+    // customer's integration license has lapsed. Re-auth can't revive it — the
+    // license must be re-ordered first — so it gets its own code rather than the
+    // generic "reconnect" PROVIDER_AUTH_EXPIRED.
+    vi.mocked(refreshFortnoxToken).mockRejectedValueOnce(
+      new Error(
+        'Fortnox token refresh failed: 401 {"error":"error_missing_license","error_description":"The client credentials are invalid"}',
+      ),
+    );
+
+    const err = await resolveConsent('co1', 'c2').catch((e) => e);
+
+    expect(err).toBeInstanceOf(ProviderCallError);
+    expect(err.code).toBe('PROVIDER_LICENSE_MISSING');
+    expect(err.provider).toBe('fortnox');
+  });
+
+  it('keeps a Fortnox invalid_grant as PROVIDER_AUTH_EXPIRED (revivable by reconnect)', async () => {
+    const fortnoxConsent = { id: 'c2', company_id: 'co1', provider: 'fortnox', status: 1 };
+    mock.enqueue({ data: [fortnoxConsent] }); // consent lookup
+    mock.enqueue({ data: [expiredTokens] }); // expired token row
+
+    // A plain expired/revoked grant IS revivable by reconnecting — it must not
+    // be mis-mapped to the license code.
+    vi.mocked(refreshFortnoxToken).mockRejectedValueOnce(
+      new Error('Fortnox token refresh failed: 400 {"error":"invalid_grant"}'),
+    );
+
+    const err = await resolveConsent('co1', 'c2').catch((e) => e);
+
+    expect(err).toBeInstanceOf(ProviderCallError);
+    expect(err.code).toBe('PROVIDER_AUTH_EXPIRED');
+    expect(err.provider).toBe('fortnox');
+  });
 });
@@ -5,6 +5,7 @@ import { refreshFortnoxToken } from './fortnox/oauth';
 import { refreshVismaToken } from './visma/oauth';
 import { refreshBrioxToken } from './briox/oauth';
 import { refreshBjornLundenToken } from './bjornlunden/oauth';
+import { ProviderCallError, isMissingLicenseError } from './with-provider-call';
 import { createLogger } from '@/lib/logger';

 const log = createLogger('providers/resolve-consent');
@@ -98,15 +99,48 @@ export async function resolveConsent(companyId: string, consentId: string): Prom

    let refreshed: TokenResponse;

-    if (consent.provider === 'fortnox') {
-      refreshed = await refreshFortnoxToken(getOAuthConfig('fortnox'), tokens.refresh_token as string);
-    } else if (consent.provider === 'briox') {
-      // Briox /tokenrefresh wants the (expired) access token alongside the
-      // refresh token; no app-level config involved. Both tokens rotate —
-      // the new refresh_token is persisted below.
-      refreshed = await refreshBrioxToken(tokens.refresh_token as string, tokens.access_token as string);
-    } else {
-      refreshed = await refreshVismaToken(getOAuthConfig(consent.provider as string), tokens.refresh_token as string);
+    // A failed refresh is categorically an expired/revoked connection: the
+    // providers rotate refresh tokens and a dead one (e.g. Fortnox `400
+    // invalid_grant`) can never be replayed — retrying is pointless. Surface it
+    // as PROVIDER_AUTH_EXPIRED so callers (preview/sie-data/migrate) report
+    // "reconnect" (401) instead of a generic 500 that invites a useless retry.
+    // The raw helpers throw plain Errors with the status only in the message
+    // string, so classifyProviderError can't see it downstream — we map here,
+    // at the boundary that knows this is a refresh.
+    try {
+      if (consent.provider === 'fortnox') {
+        refreshed = await refreshFortnoxToken(getOAuthConfig('fortnox'), tokens.refresh_token as string);
+      } else if (consent.provider === 'briox') {
+        // Briox /tokenrefresh wants the (expired) access token alongside the
+        // refresh token; no app-level config involved. Both tokens rotate —
+        // the new refresh_token is persisted below.
+        refreshed = await refreshBrioxToken(tokens.refresh_token as string, tokens.access_token as string);
+      } else {
+        refreshed = await refreshVismaToken(getOAuthConfig(consent.provider as string), tokens.refresh_token as string);
+      }
+    } catch (err) {
+      const reason = err instanceof Error ? err.message : String(err);
+      // A missing/inactive integration license (Fortnox `error_missing_license`)
+      // is NOT a revivable token: re-authorizing loops until the customer
+      // re-orders the license. Surface it as its own code so the caller shows
+      // "activate the license, then reconnect" instead of a bare reconnect.
+      const code = isMissingLicenseError(reason)
+        ? 'PROVIDER_LICENSE_MISSING'
+        : 'PROVIDER_AUTH_EXPIRED';
+      log.error(
+        `Failed to refresh ${consent.provider} token for consent ${consentId} — ` +
+        (code === 'PROVIDER_LICENSE_MISSING'
+          ? 'the integration license is missing/inactive'
+          : 'the connection must be re-authorized'),
+        { reason },
+      );
+      throw new ProviderCallError(
+        code,
+        consent.provider as string,
+        code === 'PROVIDER_LICENSE_MISSING'
+          ? `${consent.provider} integration license missing/inactive; the customer must re-order it before reconnecting`
+          : `Token refresh failed for ${consent.provider}; the connection must be re-authorized`,
+      );
    }

    const newExpiresAt = new Date(Date.now() + refreshed.expires_in * 1000).toISOString();
@@ -126,7 +160,12 @@ export async function resolveConsent(companyId: string, consentId: string): Prom
      })
      .eq('consent_id', consentId)
      .eq('token_expires_at', tokens.token_expires_at as string)
-      .select('id');
+      // consent_id is the table's PRIMARY KEY — there is no `id` column.
+      // Selecting `id` here makes Postgres reject the whole statement
+      // ("column provider_consent_tokens.id does not exist"), which surfaces as
+      // updateError and is misreported as "rotated tokens could not be saved"
+      // AFTER the provider already rotated — permanently breaking the consent.
+      .select('consent_id');

    if (updateError) {
      // The provider has ALREADY rotated the tokens but we failed to persist
@@ -13,6 +13,7 @@ import { createLogger, type Logger } from '@/lib/logger'

 export type ProviderCallErrorCode =
  | 'PROVIDER_AUTH_EXPIRED'
+  | 'PROVIDER_LICENSE_MISSING'
  | 'PROVIDER_RATE_LIMITED'
  | 'PROVIDER_UNREACHABLE'
  | 'PROVIDER_UPSTREAM_ERROR'
@@ -206,3 +207,28 @@ export function classifyProviderError(error: unknown): ProviderCallErrorCode | n

  return null
 }
+
+/**
+ * True when a provider token/OAuth failure means the integration license is
+ * missing or inactive — NOT an ordinary expired/revoked grant.
+ *
+ * Fortnox answers its token endpoint with `error_missing_license` when the
+ * customer's Fortnox account no longer carries the integration license. The
+ * stored refresh token cannot be revived by re-authorizing: re-auth loops until
+ * the customer re-orders the "Fortnox Integration" add-on. Distinguishing this
+ * from a plain dead token lets callers say "activate the license, then
+ * reconnect" instead of a bare "reconnect" that just fails again.
+ *
+ * Matches on the raw provider message string because the underlying refresh
+ * helpers bake the body into the Error message; deliberately does NOT match
+ * `invalid_grant` (that IS a revivable reconnect → PROVIDER_AUTH_EXPIRED).
+ */
+export function isMissingLicenseError(message: string): boolean {
+  const haystack = message.toLowerCase()
+  return (
+    haystack.includes('error_missing_license') ||
+    haystack.includes('missing_license') ||
+    haystack.includes('missing license') ||
+    haystack.includes('not have enough licenses')
+  )
+}