Fix/invoice delivery and payment accounts (#1116)

* fix: reconcile annual reports with final closing entries * test: cover annual report depreciation and VAT balances * Merge remote-tracking branch 'origin/main' into fix/usr-fdbck-ch * fix: show exact invoice delivery details * fix: use currency account in invoice emails * fix: address invoice delivery review feedback * fix: harden invoice delivery and payment accounts * test: assert RLS-denied zero-row updates * fix: close remaining invoice compliance gaps * fix: harden invoice archive authorization * fix: close invoice delivery review findings * fix: verify delivery finalization results * fix: cap combined invoice email recipients * fix: close final invoice compliance findings * fix: prevent stale payment account saves * test: prove invoice delivery isolation * fix: close invoice privacy review findings * test: normalize delivery retention dates
2026-07-23 09:54:02 +02:00
parent 321e684523
commit 466e55a015
83 changed files with 6619 additions and 671 deletions
@@ -6,7 +6,12 @@
 */
 import { describe, it, expect, vi, beforeEach } from 'vitest'
 import { eventBus } from '@/lib/events/bus'
-import { createQueuedMockSupabase, makeInvoice, makeFiscalPeriod } from '@/tests/helpers'
+import {
+  createQueuedMockSupabase,
+  makeCustomer,
+  makeInvoice,
+  makeFiscalPeriod,
+} from '@/tests/helpers'
 import type { PendingOperation } from '@/types'

 vi.mock('@/lib/core/bookkeeping/period-service', async () => {
@@ -54,10 +59,27 @@ vi.mock('@/lib/transactions/categorize-core', async () => {
  }
 })

+vi.mock('@/lib/entitlements/has-capability', async (importOriginal) => {
+  const actual = await importOriginal<typeof import('@/lib/entitlements/has-capability')>()
+  return { ...actual, hasCapability: vi.fn().mockResolvedValue(true) }
+})
+
+vi.mock('@/lib/email/service', () => ({
+  getEmailService: () => ({
+    isConfigured: () => true,
+    sendEmail: vi.fn(),
+  }),
+}))
+
+vi.mock('@/lib/invoices/ensure-invoice-number', () => ({
+  ensureInvoiceNumber: vi.fn(),
+}))
+
 const mockRecordManualInvoiceDelivery = vi.fn().mockResolvedValue({ id: 'delivery-1' })
+const mockReserveInvoiceDelivery = vi.fn().mockResolvedValue('delivery-1')
 vi.mock('@/lib/invoices/invoice-deliveries', () => ({
  recordManualInvoiceDelivery: (...args: unknown[]) => mockRecordManualInvoiceDelivery(...args),
-  reserveInvoiceDelivery: vi.fn().mockResolvedValue('delivery-1'),
+  reserveInvoiceDelivery: (...args: unknown[]) => mockReserveInvoiceDelivery(...args),
  sendTrackedInvoiceEmail: vi.fn(),
 }))

@@ -68,6 +90,7 @@ import { executeSIEImport } from '@/lib/import/sie-import'
 import { commitAnnualPostings } from '@/lib/bokslut/assets/depreciation-engine'
 import { createCreditNoteJournalEntry } from '@/lib/bookkeeping/invoice-entries'
 import { categorizeMatchedTransaction } from '@/lib/transactions/categorize-core'
+import { ensureInvoiceNumber } from '@/lib/invoices/ensure-invoice-number'

 function makePendingOp(overrides: Partial<PendingOperation>): PendingOperation {
  return {
@@ -193,8 +216,11 @@ describe('commitPendingOperation: credit-note issuance guard', () => {
      }),
      error: null,
    })
+    enqueue({
+      data: { accounting_method: 'cash', entity_type: 'enskild_firma', bankgiro: '123-4567' },
+      error: null,
+    })
    enqueue({ data: null, error: null }) // status update
-    enqueue({ data: { accounting_method: 'cash', entity_type: 'enskild_firma' }, error: null })
    enqueue({ data: null, error: null }) // dispatcher update

    const op = makePendingOp({
@@ -217,6 +243,134 @@ describe('commitPendingOperation: credit-note issuance guard', () => {
      invoiceId: 'invoice-1',
    })
  })
+
+  it.each(['SEK', 'EUR'] as const)(
+    'rejects a %s invoice without a payment account before number allocation',
+    async (currency) => {
+    const { supabase, enqueue } = createQueuedMockSupabase()
+    enqueue({ data: { id: 'op-1' }, error: null }) // CAS claim
+    enqueue({
+      data: makeInvoice({
+        id: 'invoice-1',
+        status: 'draft',
+        invoice_number: null,
+        credited_invoice_id: null,
+        currency,
+      }),
+      error: null,
+    })
+    enqueue({ data: { invoice_payment_accounts: {} }, error: null })
+    enqueue({ data: null, error: null }) // dispatcher rejected update
+
+    const op = makePendingOp({
+      operation_type: 'mark_invoice_sent',
+      params: { invoice_id: 'invoice-1' },
+    })
+
+    const result = await commitPendingOperation(
+      supabase as never,
+      'user-1',
+      'company-1',
+      op,
+    )
+
+    expect(result.status).toBe('failed')
+    expect(result.http_status).toBe(400)
+    expect(ensureInvoiceNumber).not.toHaveBeenCalled()
+    expect(mockRecordManualInvoiceDelivery).not.toHaveBeenCalled()
+    },
+  )
+})
+
+describe('commitPendingOperation: invoice send payment account guard', () => {
+  it.each(['SEK', 'EUR'] as const)(
+    'rejects a %s invoice before delivery reservation and number allocation',
+    async (currency) => {
+    const { supabase, enqueue } = createQueuedMockSupabase()
+    enqueue({ data: { id: 'op-1' }, error: null }) // CAS claim
+    enqueue({
+      data: makeInvoice({
+        id: 'invoice-1',
+        status: 'draft',
+        invoice_number: null,
+        currency,
+        customer: makeCustomer({ id: 'customer-1', email: 'customer@example.test' }),
+        items: [],
+      }),
+      error: null,
+    })
+    enqueue({
+      data: {
+        company_name: 'Test AB',
+        invoice_payment_accounts: {},
+      },
+      error: null,
+    })
+    enqueue({ data: null, error: null }) // dispatcher's rejected update
+
+    const op = makePendingOp({
+      operation_type: 'send_invoice',
+      params: { invoice_id: 'invoice-1' },
+    })
+
+    const result = await commitPendingOperation(
+      supabase as never,
+      'user-1',
+      'company-1',
+      op,
+    )
+
+    expect(result.status).toBe('failed')
+    expect(result.http_status).toBe(400)
+    expect(ensureInvoiceNumber).not.toHaveBeenCalled()
+    expect(supabase.from).not.toHaveBeenCalledWith('invoice_deliveries')
+    },
+  )
+})
+
+describe('commitPendingOperation: invoice send recipient limit', () => {
+  it('rejects an oversized configured recipient set before reservation and allocation', async () => {
+    const { supabase, enqueue } = createQueuedMockSupabase()
+    enqueue({ data: { id: 'op-1' }, error: null }) // CAS claim
+    enqueue({
+      data: makeInvoice({
+        id: 'invoice-1',
+        status: 'draft',
+        invoice_number: null,
+        customer: makeCustomer({ id: 'customer-1', email: 'customer@example.test' }),
+        items: [],
+      }),
+      error: null,
+    })
+    enqueue({
+      data: {
+        company_name: 'Test AB',
+        bankgiro: '123-4567',
+        invoice_email_cc_addresses: Array.from(
+          { length: 20 },
+          (_, index) => `fixed-${index}@example.test`,
+        ),
+        invoice_email_bcc_addresses: [],
+      },
+      error: null,
+    })
+    enqueue({ data: null, error: null }) // dispatcher's rejected update
+
+    const result = await commitPendingOperation(
+      supabase as never,
+      'user-1',
+      'company-1',
+      makePendingOp({
+        operation_type: 'send_invoice',
+        params: { invoice_id: 'invoice-1' },
+      }),
+    )
+
+    expect(result.status).toBe('failed')
+    expect(result.http_status).toBe(400)
+    expect(mockReserveInvoiceDelivery).not.toHaveBeenCalled()
+    expect(ensureInvoiceNumber).not.toHaveBeenCalled()
+  })
 })

 // ─── post_annual_depreciation ───────────────────────────────────────
@@ -73,6 +73,15 @@ import { linkToJournalEntry } from '@/lib/core/documents/document-service'
 import { renderToBuffer } from '@react-pdf/renderer'
 import { InvoicePDF } from '@/lib/invoices/pdf-template'
 import { prepareInvoicePdfRender, buildSwishQrDataUrl } from '@/lib/invoices/pdf-render-helpers'
+import {
+  hasRequiredInvoicePaymentAccount,
+  invoiceRequiresPaymentAccount,
+} from '@/lib/invoices/payment-accounts'
+import {
+  exceedsInvoiceEmailRecipientLimit,
+  invoiceEmailRecipientCount,
+  resolveInvoiceEmailRecipients,
+} from '@/lib/invoices/email-recipients'
 import { ensureInvoiceNumber } from '@/lib/invoices/ensure-invoice-number'
 import { invoicePdfFilename } from '@/lib/invoices/pdf-filename'
 import {
@@ -1496,13 +1505,38 @@ async function commitSendInvoice(
  }

  const customer = invoice.customer as Customer
-  if (!customer.email) return { error: 'Customer has no email address', status: 400 }
+  if (!customer.email?.trim()) return { error: 'Customer has no email address', status: 400 }

  const { data: company, error: companyError } = await supabase
    .from('company_settings').select('*').eq('company_id', companyId).single()

  if (companyError || !company) return { error: 'Company settings missing', status: 500 }

+  const paymentAccountRequired = invoiceRequiresPaymentAccount(invoice as Invoice)
+  if (!hasRequiredInvoicePaymentAccount(company as CompanySettings, invoice as Invoice)) {
+    return {
+      error:
+        getErrorEntry('INVOICE_SEND_PAYMENT_ACCOUNT_MISSING')?.message_sv
+        ?? 'Betalningskonto saknas för fakturans valuta.',
+      status: 400,
+    }
+  }
+
+  const recipients = resolveInvoiceEmailRecipients({
+    to: customer.email,
+    configuredCc: company.invoice_email_cc_addresses,
+    configuredBcc: company.invoice_email_bcc_addresses,
+    legacyCc: company.email || userEmail,
+  })
+  if (exceedsInvoiceEmailRecipientLimit(recipients)) {
+    return {
+      error:
+        getErrorEntry('INVOICE_SEND_TOO_MANY_RECIPIENTS')?.message_sv
+        ?? `Ett fakturautskick får inte ha ${invoiceEmailRecipientCount(recipients)} mottagare.`,
+      status: 400,
+    }
+  }
+
  const items = (invoice.items as InvoiceItem[]).sort(
    (a: InvoiceItem, b: InvoiceItem) => a.sort_order - b.sort_order
  )
@@ -1523,7 +1557,11 @@ async function commitSendInvoice(
  const isFreshAllocation = !invoice.invoice_number
  if (isFreshAllocation) {
    try {
-      const preflight = await prepareInvoicePdfRender(company as CompanySettings)
+      const preflight = await prepareInvoicePdfRender(
+        company as CompanySettings,
+        (invoice as Invoice).currency,
+        { paymentAccountRequired },
+      )
      await renderToBuffer(
        InvoicePDF({
          invoice: { ...(invoice as Invoice), invoice_number: 'F-PREVIEW' },
@@ -1578,8 +1616,10 @@ async function commitSendInvoice(
  const renderableInvoice = { ...(invoice as Invoice), status: 'sent' as const }
  const { branding, company: renderCompany } = await prepareInvoicePdfRender(
    company as CompanySettings,
+    renderableInvoice.currency,
+    { paymentAccountRequired },
  )
-  const swishQrDataUrl = await buildSwishQrDataUrl(company as CompanySettings, renderableInvoice)
+  const swishQrDataUrl = await buildSwishQrDataUrl(renderCompany, renderableInvoice)
  const pdfBuffer = await renderToBuffer(
    InvoicePDF({
      invoice: renderableInvoice,
@@ -1603,7 +1643,6 @@ async function commitSendInvoice(
    isCreditNote,
  })

-  const ccAddress = company.email || userEmail
  const emailData = { invoice: renderableInvoice, customer, company: company as CompanySettings }
  const subject = generateInvoiceEmailSubject(emailData)
  const html = generateInvoiceEmailHtml(emailData)
@@ -1617,8 +1656,9 @@ async function commitSendInvoice(
      userId,
      invoiceId,
      deliveryId,
-      to: customer.email,
-      cc: ccAddress,
+      to: recipients.to,
+      cc: recipients.cc,
+      bcc: recipients.bcc,
      subject,
      html,
      text,
@@ -1708,6 +1748,23 @@ async function commitMarkInvoiceSent(
  }
  if (invoice.status !== 'draft') return { error: 'Only draft invoices can be marked as sent', status: 409 }

+  const { data: settings, error: settingsError } = await supabase
+    .from('company_settings')
+    .select('accounting_method, entity_type, invoice_payment_accounts, bank_name, clearing_number, account_number, bankgiro, plusgiro, swish, iban, bic')
+    .eq('company_id', companyId)
+    .single()
+
+  if (settingsError || !settings) return { error: 'Company settings missing', status: 500 }
+
+  if (!hasRequiredInvoicePaymentAccount(settings as CompanySettings, invoice as Invoice)) {
+    return {
+      error:
+        getErrorEntry('INVOICE_SEND_PAYMENT_ACCOUNT_MISSING')?.message_sv
+        ?? 'Betalningskonto saknas för fakturans valuta.',
+      status: 400,
+    }
+  }
+
  try {
    await ensureInvoiceNumber(supabase, companyId, invoice as Invoice)
  } catch (err) {
@@ -1731,9 +1788,6 @@ async function commitMarkInvoiceSent(
    deliveryHistoryWarning = 'Fakturan markerades som skickad men utskickshistoriken kunde inte sparas.'
  }

-  const { data: settings } = await supabase
-    .from('company_settings').select('accounting_method, entity_type').eq('company_id', companyId).single()
-
  const isRealInvoice = !invoice.document_type || invoice.document_type === 'invoice'
  let journalEntryId: string | null = null