feat(invoices): allow BAS class 1-3 posting-account overrides and complete the aktiekapital note (#1121)

- invoice/article posting-account overrides accept active class 1-3 accounts;
  class 1-2 (balance-sheet) accounts are rejected on VAT-bearing lines so the
  ruta 05 tax base always books to a 3xxx account
- shared posting-account regex across server schemas, pending-operation
  re-validation, and client forms
- share-capital settings (aktiekapital/antal_aktier) feed the annual-report
  note; kvotvarde derived per ABL 1 kap 6 $; all-or-nothing pair constraint
- signed per-rate VAT breakdown on credit-note PDFs; U+2212 to ASCII hyphen

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
2026-07-23 12:16:00 +02:00
committed by GitHub
co-authored by Claude Fable 5
parent b0044bfe98
commit 43f7ccab9e
27 changed files with 440 additions and 109 deletions
+4 -5
View File
@@ -475,7 +475,7 @@ async function commitCreateArticle(
if (validated.revenue_account) {
const ok = await isValidRevenueAccount(supabase, companyId, validated.revenue_account)
if (!ok) return { error: 'Revenue account is not an active class-3 account', status: 400 }
if (!ok) return { error: 'Posting account is not an active class 1-3 account', status: 400 }
}
const { data, error } = await supabase
@@ -533,7 +533,7 @@ async function commitUpdateArticle(
if (validated.revenue_account) {
const ok = await isValidRevenueAccount(supabase, companyId, validated.revenue_account)
if (!ok) return { error: 'Revenue account is not an active class-3 account', status: 400 }
if (!ok) return { error: 'Posting account is not an active class 1-3 account', status: 400 }
}
const { article_id, ...rest } = validated
@@ -1076,14 +1076,14 @@ async function commitCreateInvoice(
vatAmount += Math.round(lineTotal * itemRate / 100 * 100) / 100
}
// Validate any per-line revenue-account override (defense in depth: the field
// Validate any per-line posting-account override (defense in depth: the legacy field
// is frozen onto invoice_items and flows to generatePerRateLines()).
const overrideAccounts = Array.from(
new Set(billableItems.map((i) => i.revenue_account).filter((a): a is string => !!a)),
)
for (const acct of overrideAccounts) {
if (!(await isValidRevenueAccount(supabase, companyId, acct))) {
return { error: `Försäljningskonto ${acct} är inte ett aktivt intäktskonto (klass 3)`, status: 400 }
return { error: `Bokföringskonto ${acct} är inte ett aktivt balans- eller intäktskonto (klass 1-3)`, status: 400 }
}
}
@@ -4977,4 +4977,3 @@ async function commitPendingOperationInner(
data: result.data,
}
}
+5 -4
View File
@@ -1,13 +1,14 @@
import { z } from 'zod'
import { INVOICE_POSTING_ACCOUNT_REGEX } from '@/lib/invoices/posting-account'
// Commit-boundary re-validation for staged article operations. A staged
// pending_operations row is re-parsed here before it touches the articles table
// so a tampered row cannot inject unexpected fields or malformed data
// (defense in depth, ASVS V4.5): mirrors lib/pending-operations/schemas/create-supplier.ts.
const revenueAccount = z
const invoicePostingAccount = z
.string()
.regex(/^3\d{3}$/, 'Revenue account must be a 4-digit BAS class-3 account (3xxx)')
.regex(INVOICE_POSTING_ACCOUNT_REGEX, 'Posting account must be a 4-digit BAS class 1-3 account')
const vatRatePercent = z.union([z.literal(0), z.literal(6), z.literal(12), z.literal(25)])
@@ -26,7 +27,7 @@ export const CreateArticleParamsSchema = z.object({
unit: optString(32),
price_excl_vat: z.number().nonnegative(),
vat_rate: vatRatePercent.default(25),
revenue_account: revenueAccount.nullable().optional(),
revenue_account: invoicePostingAccount.nullable().optional(),
cost_price: z.number().nonnegative().nullable().optional(),
ean: optString(32),
housework_type: optString(64),
@@ -42,7 +43,7 @@ export const UpdateArticleParamsSchema = z.object({
unit: optString(32),
price_excl_vat: z.number().nonnegative().optional(),
vat_rate: vatRatePercent.optional(),
revenue_account: revenueAccount.nullable().optional(),
revenue_account: invoicePostingAccount.nullable().optional(),
cost_price: z.number().nonnegative().nullable().optional(),
ean: optString(32),
housework_type: optString(64),