Copy voucher, MRU booking templates, and PDF export for reports (#303)

* feat: copy voucher, MRU booking templates, and PDF export for reports - Add "Kopiera verifikat" action on the journal-entry detail page that prefills a new draft with the source entry's lines, description, and notes. Date defaults to today so locked-period posts can't happen by accident; source_type resets to manual. - Track per-company MRU for booking_template_library rows via a new booking_template_usage table (fire-and-forget touch endpoint hooked into both pickers) and sort the list most-recently-used first for the active company. - Generate downloadable PDFs for balansräkning and resultaträkning using the existing @react-pdf/renderer toolchain. Adds a reusable parameterized template and two API routes, with download buttons on the matching report views. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: address PR review feedback on copy-voucher + report PDFs Compliance review (Swedish accounting): - Balance-sheet PDF now refuses to render when tillgångar ≠ eget kapital och skulder; the stale "Differens" summary row is gone. The on-screen view still surfaces the existing "Balanserar ej" warning so users can diagnose the imbalance before downloading. ÅRL 3 kap / K2 / K3 require exact balance. - Both PDF routes now 400 when the requested fiscal period cannot be resolved — identifiable period is part of räkenskapsinformation under BFL 7 kap. - Income-statement PDF adds the mandatory "Resultat efter finansiella poster" subtotal when financial items are present, per K2/K3 uppställningsform (ÅRL bilaga 2). - Copy-voucher flow now shows a clear banner ("Kopia av verifikat X — nytt, fristående verifikat skapas") so users cannot mistake the copy for a rättelse/storno. Code review (Greptile): - New migration adds updated_at column + trigger to booking_template_usage (project convention; applied to the Supabase project). - Replace localeCompare on ISO timestamps with plain relational comparison to avoid any locale-dependent ordering. - UUID-format validation on the copy_from query param before it goes into the fetch URL. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: second round of Swedish compliance fixes on report PDFs - Balance-sheet PDF imbalance check now compares rounded-to-whole-kronor totals (SFL 22:1 convention). The previous 0.5-öre tolerance could reject a legitimate balance sheet when accumulated floating-point noise across hundreds of ledger lines exceeded the threshold. The on-screen view still surfaces the öre-precise "Balanserar ej" badge for diagnostic visibility. - Both PDFs now carry a prominent "Arbetsutkast — ej undertecknat" notice per ÅRL 2 kap 7 §. Prevents a downloaded PDF from being mistaken for or filed as an approved årsredovisning. - Income-statement PDF now follows K2/K3 uppställningsform (ÅRL bilaga 2) by splitting class 8 into three blocks with named subtotals: Finansiella poster (80–84), Bokslutsdispositioner (88), Skatter (89). The summary now always shows a "Skatt på årets resultat" row so the reader can verify the tax calculation, and adds "Resultat efter finansiella poster" / "Bokslutsdispositioner" subtotals when each block is present. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: harden report PDFs against out-of-band filing + future BAS growth - Append "-utkast" to downloaded PDF filenames. The filename survives the PDF's disclaimer context — a file named balansrakning-2026-01-01.pdf in a Downloads folder or forwarded attachment is ambiguous, whereas balansrakning-2026-01-01-utkast.pdf makes the draft status legible even without opening the document. - Add a catch-all "Övriga finansiella poster" bucket in the income-statement PDF for any class-8 section whose account prefix isn't one of the known K2/K3 blocks (80–84 / 88 / 89). Counted in the "Resultat efter finansiella poster" subtotal so arithmetic stays consistent. Future-proofs the PDF against a generator change that starts emitting 85–87 sections. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-21 22:28:41 +02:00
parent 24107338fa
commit 4cd0a55761
13 changed files with 1177 additions and 16 deletions
@@ -7,7 +7,7 @@ import { Card, CardContent, CardHeader, CardTitle } from '@/components/ui/card'
 import { Button } from '@/components/ui/button'
 import { AccountNumber } from '@/components/ui/account-number'
 import { Textarea } from '@/components/ui/textarea'
-import { Loader2, ArrowLeft, Paperclip, AlertTriangle, Lock, MessageSquare, Pencil, Check, X } from 'lucide-react'
+import { Loader2, ArrowLeft, Paperclip, AlertTriangle, Lock, MessageSquare, Pencil, Check, X, Copy } from 'lucide-react'
 import { useCanWrite } from '@/lib/hooks/use-can-write'
 import JournalEntryAttachments from '@/components/bookkeeping/JournalEntryAttachments'
 import JournalEntryStatusBadge, { sourceTypeLabels } from '@/components/bookkeeping/JournalEntryStatusBadge'
@@ -205,6 +205,17 @@ export default function JournalEntryDetailPage({ params }: { params: Promise<{ i
                Skapa ändringsverifikation
              </Button>
            )}
+            <Button
+              variant="outline"
+              size="sm"
+              className="w-full sm:w-auto"
+              onClick={() => router.push(`/bookkeeping?copy_from=${entry.id}`)}
+              disabled={!canWrite}
+              title={!canWrite ? 'Du har endast läsbehörighet i detta företag' : undefined}
+            >
+              {!canWrite ? <Lock className="mr-2 h-4 w-4" /> : <Copy className="mr-2 h-4 w-4" />}
+              Kopiera verifikat
+            </Button>
          </div>
        )}
      </div>
@@ -1,19 +1,94 @@
 'use client'

-import { useState } from 'react'
+import { useState, useEffect } from 'react'
 import Link from 'next/link'
 import { Tabs, TabsList, TabsTrigger, TabsContent } from '@/components/ui/tabs'
 import { Button } from '@/components/ui/button'
 import JournalEntryList from '@/components/bookkeeping/JournalEntryList'
-import JournalEntryForm from '@/components/bookkeeping/JournalEntryForm'
+import JournalEntryForm, { type FormLine } from '@/components/bookkeeping/JournalEntryForm'
 import ChartOfAccountsManager from '@/components/bookkeeping/ChartOfAccountsManager'
 import { FiscalYearSelector } from '@/components/common/FiscalYearSelector'
-import { Lock } from 'lucide-react'
+import { useToast } from '@/components/ui/use-toast'
+import { Lock, Loader2, Copy } from 'lucide-react'
+import type { JournalEntry, JournalEntryLine } from '@/types'
+
+interface CopyPrefill {
+  sourceId: string
+  sourceVoucherLabel: string
+  lines: FormLine[]
+  description: string
+  notes: string
+}
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
+
+function readCopyFromParam(): string | null {
+  if (typeof window === 'undefined') return null
+  const raw = new URLSearchParams(window.location.search).get('copy_from')
+  if (!raw) return null
+  // Guard against path-traversal or other malformed input in the fetch URL.
+  return UUID_RE.test(raw) ? raw : null
+}

 export default function BookkeepingPage() {
+  const { toast } = useToast()
  const [refreshKey, setRefreshKey] = useState(0)
-  const [activeTab, setActiveTab] = useState('journal')
+  const [copyFromId] = useState<string | null>(readCopyFromParam)
+  const [activeTab, setActiveTab] = useState(() =>
+    copyFromId ? 'new-entry' : 'journal',
+  )
  const [periodId, setPeriodId] = useState<string | null>(null)
+  const [copyPrefill, setCopyPrefill] = useState<CopyPrefill | null>(null)
+  const [isLoadingCopy, setIsLoadingCopy] = useState<boolean>(() => copyFromId !== null)
+
+  useEffect(() => {
+    if (!copyFromId) return
+
+    fetch(`/api/bookkeeping/journal-entries/${copyFromId}`)
+      .then((res) => res.json())
+      .then(({ data, error }: { data?: JournalEntry; error?: string }) => {
+        if (error || !data) {
+          toast({
+            title: 'Kunde inte kopiera verifikat',
+            description: error || 'Källverifikatet hittades inte.',
+            variant: 'destructive',
+          })
+          return
+        }
+        const sourceLines = ((data.lines || []) as JournalEntryLine[])
+          .slice()
+          .sort((a, b) => a.sort_order - b.sort_order)
+        const lines: FormLine[] = sourceLines.map((l) => {
+          const debit = Number(l.debit_amount) || 0
+          const credit = Number(l.credit_amount) || 0
+          return {
+            account_number: l.account_number,
+            debit_amount: debit > 0 ? debit.toFixed(2) : '',
+            credit_amount: credit > 0 ? credit.toFixed(2) : '',
+            line_description: l.line_description || '',
+          }
+        })
+        setCopyPrefill({
+          sourceId: copyFromId,
+          sourceVoucherLabel: `${data.voucher_series ?? ''}${data.voucher_number ?? ''}`,
+          lines,
+          description: data.description || '',
+          notes: data.notes || '',
+        })
+      })
+      .catch(() => {
+        toast({
+          title: 'Kunde inte kopiera verifikat',
+          description: 'Källverifikatet kunde inte hämtas.',
+          variant: 'destructive',
+        })
+      })
+      .finally(() => {
+        setIsLoadingCopy(false)
+        // Clean the URL so a page refresh doesn't re-trigger the copy prefill.
+        window.history.replaceState({}, '', '/bookkeeping')
+      })
+  }, [copyFromId, toast])

  return (
    <div className="space-y-6">
@@ -48,7 +123,40 @@ export default function BookkeepingPage() {
        </TabsContent>

        <TabsContent value="new-entry">
-          <JournalEntryForm onCreated={() => setRefreshKey((k) => k + 1)} />
+          {isLoadingCopy ? (
+            <div className="flex items-center gap-2 py-12 justify-center text-muted-foreground">
+              <Loader2 className="h-4 w-4 animate-spin" />
+              <span className="text-sm">Laddar källverifikat...</span>
+            </div>
+          ) : (
+            <>
+              {copyPrefill && (
+                <div className="mb-4 flex items-start gap-3 rounded-lg border border-border bg-muted/30 p-3 text-sm">
+                  <Copy className="h-4 w-4 mt-0.5 shrink-0 text-muted-foreground" />
+                  <div className="flex-1">
+                    <p className="font-medium">
+                      Kopia av verifikat {copyPrefill.sourceVoucherLabel || '(okänt nummer)'}
+                    </p>
+                    <p className="text-muted-foreground mt-0.5">
+                      Ett nytt, fristående verifikat skapas med egen verifikationsserie och nummer.
+                      Detta är <strong>inte</strong> en rättelse eller storno av originalet — använd
+                      &quot;Skapa ändringsverifikation&quot; om du vill korrigera källverifikatet.
+                    </p>
+                  </div>
+                </div>
+              )}
+              <JournalEntryForm
+                key={copyPrefill?.sourceId ?? 'fresh'}
+                onCreated={() => {
+                  setRefreshKey((k) => k + 1)
+                  setCopyPrefill(null)
+                }}
+                initialLines={copyPrefill?.lines}
+                initialDescription={copyPrefill?.description}
+                initialNotes={copyPrefill?.notes}
+              />
+            </>
+          )}
        </TabsContent>

        <TabsContent value="accounts">
@@ -617,6 +617,17 @@ function IncomeStatementView({ periodId, onNavigateToAccount }: { periodId: stri

  return (
    <div className="space-y-4">
+      <div className="flex justify-end">
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={() => window.open(`/api/reports/income-statement/pdf?period_id=${periodId}`, '_blank')}
+        >
+          <Download className="h-4 w-4 mr-2" />
+          Ladda ner PDF
+        </Button>
+      </div>
+
      {!monthlyLoading && monthlyData.length > 0 && (
        <IncomeExpenseChart months={monthlyData} />
      )}
@@ -751,6 +762,17 @@ function BalanceSheetView({ periodId, onNavigateToAccount }: { periodId: string;

  return (
    <div className="space-y-4">
+      <div className="flex justify-end">
+        <Button
+          variant="outline"
+          size="sm"
+          onClick={() => window.open(`/api/reports/balance-sheet/pdf?period_id=${periodId}`, '_blank')}
+        >
+          <Download className="h-4 w-4 mr-2" />
+          Ladda ner PDF
+        </Button>
+      </div>
+
      {/* Assets */}
      <Card>
        <CardHeader>
@@ -0,0 +1,115 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { renderToBuffer } from '@react-pdf/renderer'
+import { generateBalanceSheet } from '@/lib/reports/balance-sheet'
+import { FinancialStatementPDF } from '@/lib/reports/financial-statement-pdf-template'
+import { requireCompanyId } from '@/lib/company/context'
+import type { CompanySettings } from '@/types'
+
+export async function GET(request: Request) {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const companyId = await requireCompanyId(supabase, user.id)
+
+  const { searchParams } = new URL(request.url)
+  const periodId = searchParams.get('period_id')
+
+  if (!periodId) {
+    return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
+  }
+
+  const [{ data: period }, { data: companyRow }] = await Promise.all([
+    supabase
+      .from('fiscal_periods')
+      .select('period_start, period_end')
+      .eq('id', periodId)
+      .eq('company_id', companyId)
+      .single(),
+    supabase
+      .from('company_settings')
+      .select('*')
+      .eq('company_id', companyId)
+      .single(),
+  ])
+
+  if (!companyRow) {
+    return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
+  }
+  // An identifiable period is part of räkenskapsinformation (BFL 7 kap). Refuse
+  // to render a PDF that can't be archived with the period it refers to.
+  if (!period) {
+    return NextResponse.json(
+      { error: 'Räkenskapsperioden kunde inte läsas. Välj en befintlig period innan du genererar PDF.' },
+      { status: 400 }
+    )
+  }
+
+  try {
+    const report = await generateBalanceSheet(supabase, companyId, periodId)
+    report.period = { start: period.period_start, end: period.period_end }
+
+    const totalAssets = report.total_assets
+    const totalEquityLiab = report.total_equity_liabilities
+
+    // ÅRL 3 kap / K2 / K3 require balansräkningen to balance. Compare rounded
+    // to whole kronor — matches SFL 22:1's truncation convention for statutory
+    // reports and is immune to floating-point accumulation across hundreds of
+    // ledger lines (öresavrundning noise under half a krona is never a real
+    // accounting error). The on-screen view still surfaces a "Balanserar ej"
+    // warning at öre precision so users can diagnose smaller discrepancies.
+    const diffInKronor = Math.abs(Math.round(totalAssets) - Math.round(totalEquityLiab))
+    if (diffInKronor >= 1) {
+      return NextResponse.json(
+        {
+          error:
+            'Balansräkningen balanserar inte (tillgångar ≠ eget kapital och skulder). Åtgärda differensen innan du genererar PDF.',
+        },
+        { status: 400 }
+      )
+    }
+
+    const pdfBuffer = await renderToBuffer(
+      FinancialStatementPDF({
+        title: 'Balansräkning',
+        groups: [
+          {
+            heading: 'Tillgångar',
+            sections: report.asset_sections,
+            totalLabel: 'Summa tillgångar',
+            total: totalAssets,
+          },
+          {
+            heading: 'Eget kapital och skulder',
+            sections: report.equity_liability_sections,
+            totalLabel: 'Summa eget kapital och skulder',
+            total: totalEquityLiab,
+          },
+        ],
+        period: report.period,
+        company: companyRow as CompanySettings,
+        generatedAt: new Date().toISOString(),
+      })
+    )
+
+    // "-utkast" suffix keeps the draft status visible even after the file
+    // leaves the browser — complements the in-document ÅRL 2:7 disclaimer.
+    const filename = `balansrakning-${report.period.start}-utkast.pdf`
+
+    return new Response(new Uint8Array(pdfBuffer), {
+      headers: {
+        'Content-Type': 'application/pdf',
+        'Content-Disposition': `attachment; filename="${filename}"`,
+      },
+    })
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Kunde inte generera balansräkning' },
+      { status: 500 }
+    )
+  }
+}
@@ -0,0 +1,215 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { renderToBuffer } from '@react-pdf/renderer'
+import { generateIncomeStatement } from '@/lib/reports/income-statement'
+import { FinancialStatementPDF, type FinancialStatementGroup, type FinancialStatementSection, type FinancialStatementSummaryRow } from '@/lib/reports/financial-statement-pdf-template'
+import { requireCompanyId } from '@/lib/company/context'
+import type { CompanySettings } from '@/types'
+
+// K2/K3 uppställningsform (ÅRL bilaga 2, kostnadsslagsindelad) splits class 8
+// into three named blocks with subtotals:
+//   80–84 → Finansiella poster (followed by "Resultat efter finansiella poster")
+//   88   → Bokslutsdispositioner
+//   89   → Skatt på årets resultat
+// The generator lumps these together under financial_sections, so we split
+// here by the first row's account prefix.
+const FINANSIELLA_POSTER_PREFIXES = ['80', '81', '82', '83', '84']
+const BOKSLUTSDISPOSITIONER_PREFIXES = ['88']
+const SKATT_PREFIXES = ['89']
+const KNOWN_CLASS_8_PREFIXES = [
+  ...FINANSIELLA_POSTER_PREFIXES,
+  ...BOKSLUTSDISPOSITIONER_PREFIXES,
+  ...SKATT_PREFIXES,
+]
+
+function sectionPrefix(section: FinancialStatementSection, prefixes: string[]): boolean {
+  if (section.rows.length === 0) return false
+  const acc = section.rows[0].account_number
+  return prefixes.some((p) => acc.startsWith(p))
+}
+
+export async function GET(request: Request) {
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+
+  if (!user) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  const companyId = await requireCompanyId(supabase, user.id)
+
+  const { searchParams } = new URL(request.url)
+  const periodId = searchParams.get('period_id')
+
+  if (!periodId) {
+    return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
+  }
+
+  const [{ data: period }, { data: companyRow }] = await Promise.all([
+    supabase
+      .from('fiscal_periods')
+      .select('period_start, period_end')
+      .eq('id', periodId)
+      .eq('company_id', companyId)
+      .single(),
+    supabase
+      .from('company_settings')
+      .select('*')
+      .eq('company_id', companyId)
+      .single(),
+  ])
+
+  if (!companyRow) {
+    return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
+  }
+  // An identifiable period is part of räkenskapsinformation (BFL 7 kap). Refuse
+  // to render a PDF that can't be archived with the period it refers to.
+  if (!period) {
+    return NextResponse.json(
+      { error: 'Räkenskapsperioden kunde inte läsas. Välj en befintlig period innan du genererar PDF.' },
+      { status: 400 }
+    )
+  }
+
+  try {
+    const report = await generateIncomeStatement(supabase, companyId, periodId)
+    report.period = { start: period.period_start, end: period.period_end }
+
+    const operatingResult = Math.round((report.total_revenue - report.total_expenses) * 100) / 100
+
+    // Split class 8 into its three K2/K3 blocks plus a catch-all for any
+    // prefix the generator emits but we haven't explicitly mapped. If a future
+    // generator change adds sections for 85/86/87 or similar, this keeps them
+    // visible and arithmetically accounted for rather than silently dropped.
+    const finansiellaPosterSections = report.financial_sections.filter((s) =>
+      sectionPrefix(s, FINANSIELLA_POSTER_PREFIXES),
+    )
+    const bokslutsdispositionerSections = report.financial_sections.filter((s) =>
+      sectionPrefix(s, BOKSLUTSDISPOSITIONER_PREFIXES),
+    )
+    const skattSections = report.financial_sections.filter((s) =>
+      sectionPrefix(s, SKATT_PREFIXES),
+    )
+    const ovrigaFinansiellaPosterSections = report.financial_sections.filter(
+      (s) => !sectionPrefix(s, KNOWN_CLASS_8_PREFIXES),
+    )
+
+    const totalFinansiellaPoster = Math.round(
+      finansiellaPosterSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
+    ) / 100
+    const totalBokslutsdispositioner = Math.round(
+      bokslutsdispositionerSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
+    ) / 100
+    const totalSkatt = Math.round(
+      skattSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
+    ) / 100
+    const totalOvrigaFinansiellaPoster = Math.round(
+      ovrigaFinansiellaPosterSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
+    ) / 100
+    // Catch-all is treated as part of "finansiella poster" for the subtotal —
+    // 85-87 accounts in BAS are financial-adjacent (not tax, not bokslut).
+    const resultatEfterFinansiellaPoster = Math.round(
+      (operatingResult + totalFinansiellaPoster + totalOvrigaFinansiellaPoster) * 100,
+    ) / 100
+
+    const groups: FinancialStatementGroup[] = [
+      {
+        heading: 'Rörelseintäkter',
+        sections: report.revenue_sections,
+        totalLabel: 'Summa rörelseintäkter',
+        total: report.total_revenue,
+      },
+      {
+        heading: 'Rörelsekostnader',
+        sections: report.expense_sections,
+        totalLabel: 'Summa rörelsekostnader',
+        total: report.total_expenses,
+        negate: true,
+      },
+    ]
+
+    if (finansiellaPosterSections.length > 0) {
+      groups.push({
+        heading: 'Finansiella poster',
+        sections: finansiellaPosterSections,
+        totalLabel: 'Summa finansiella poster',
+        total: totalFinansiellaPoster,
+      })
+    }
+    if (ovrigaFinansiellaPosterSections.length > 0) {
+      groups.push({
+        heading: 'Övriga finansiella poster',
+        sections: ovrigaFinansiellaPosterSections,
+        totalLabel: 'Summa övriga finansiella poster',
+        total: totalOvrigaFinansiellaPoster,
+      })
+    }
+    if (bokslutsdispositionerSections.length > 0) {
+      groups.push({
+        heading: 'Bokslutsdispositioner',
+        sections: bokslutsdispositionerSections,
+        totalLabel: 'Summa bokslutsdispositioner',
+        total: totalBokslutsdispositioner,
+      })
+    }
+    if (skattSections.length > 0) {
+      groups.push({
+        heading: 'Skatter',
+        sections: skattSections,
+        totalLabel: 'Summa skatter',
+        total: totalSkatt,
+      })
+    }
+
+    // K2/K3 uppställningsform (ÅRL bilaga 2) summary structure:
+    //   Rörelseresultat
+    //   Resultat efter finansiella poster (only if finansiella poster present)
+    //   Bokslutsdispositioner (only if present)
+    //   Skatt på årets resultat (always, so the reader can verify the tax calc)
+    //   Årets resultat
+    const summary: FinancialStatementSummaryRow[] = [
+      { label: 'Rörelseresultat', amount: operatingResult },
+    ]
+    if (
+      finansiellaPosterSections.length > 0 ||
+      ovrigaFinansiellaPosterSections.length > 0
+    ) {
+      summary.push({
+        label: 'Resultat efter finansiella poster',
+        amount: resultatEfterFinansiellaPoster,
+      })
+    }
+    if (bokslutsdispositionerSections.length > 0) {
+      summary.push({ label: 'Bokslutsdispositioner', amount: totalBokslutsdispositioner })
+    }
+    summary.push({ label: 'Skatt på årets resultat', amount: totalSkatt })
+    summary.push({ label: 'Årets resultat', amount: report.net_result, emphasis: true })
+
+    const pdfBuffer = await renderToBuffer(
+      FinancialStatementPDF({
+        title: 'Resultaträkning',
+        groups,
+        summary,
+        period: report.period,
+        company: companyRow as CompanySettings,
+        generatedAt: new Date().toISOString(),
+      })
+    )
+
+    // "-utkast" suffix keeps the draft status visible even after the file
+    // leaves the browser — complements the in-document ÅRL 2:7 disclaimer.
+    const filename = `resultatrakning-${report.period.start}-utkast.pdf`
+
+    return new Response(new Uint8Array(pdfBuffer), {
+      headers: {
+        'Content-Type': 'application/pdf',
+        'Content-Disposition': `attachment; filename="${filename}"`,
+      },
+    })
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Kunde inte generera resultaträkning' },
+      { status: 500 }
+    )
+  }
+}
@@ -0,0 +1,41 @@
+import { createClient } from '@/lib/supabase/server'
+import { NextResponse } from 'next/server'
+import { requireCompanyId } from '@/lib/company/context'
+
+/**
+ * POST /api/settings/booking-templates/[id]/touch
+ *
+ * Record that this template was applied by the current company. Upserts the
+ * (template_id, company_id) row in booking_template_usage, refreshing
+ * last_used_at. Used by the template pickers to drive MRU ordering.
+ *
+ * Fire-and-forget from the client — errors are non-fatal.
+ */
+export async function POST(
+  _request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id } = await params
+  const supabase = await createClient()
+  const { data: { user } } = await supabase.auth.getUser()
+  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+
+  const companyId = await requireCompanyId(supabase, user.id)
+
+  const { error } = await supabase
+    .from('booking_template_usage')
+    .upsert(
+      {
+        template_id: id,
+        company_id: companyId,
+        last_used_at: new Date().toISOString(),
+      },
+      { onConflict: 'template_id,company_id' },
+    )
+
+  if (error) {
+    return NextResponse.json({ error: error.message }, { status: 500 })
+  }
+
+  return NextResponse.json({ data: { success: true } })
+}
@@ -31,24 +31,67 @@ const CreateBookingTemplateSchema = z.object({
 * GET /api/settings/booking-templates
 * Returns all templates visible to the current user:
 * system + company + team templates.
+ *
+ * Ordering: most recently used (per current company) first, then by category
+ * and name for never-used templates. Usage is tracked in
+ * booking_template_usage via POST /[id]/touch.
 */
 export async function GET() {
  const supabase = await createClient()
  const { data: { user } } = await supabase.auth.getUser()
  if (!user) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })

+  const companyId = await requireCompanyId(supabase, user.id)
+
  // RLS handles scoping (system OR company OR team)
-  const { data, error } = await supabase
-    .from('booking_template_library')
-    .select('*')
-    .eq('is_active', true)
-    .order('is_system', { ascending: false })
-    .order('category')
-    .order('name')
+  const [templatesRes, usageRes] = await Promise.all([
+    supabase
+      .from('booking_template_library')
+      .select('*')
+      .eq('is_active', true)
+      .order('category')
+      .order('name'),
+    supabase
+      .from('booking_template_usage')
+      .select('template_id, last_used_at')
+      .eq('company_id', companyId),
+  ])

-  if (error) return NextResponse.json({ error: error.message }, { status: 500 })
+  if (templatesRes.error) {
+    return NextResponse.json({ error: templatesRes.error.message }, { status: 500 })
+  }
+  // usage lookup failing is non-fatal — we just fall back to default ordering
+  const usageByTemplate = new Map<string, string>()
+  if (!usageRes.error && usageRes.data) {
+    for (const row of usageRes.data) {
+      usageByTemplate.set(row.template_id, row.last_used_at)
+    }
+  }

-  return NextResponse.json({ data })
+  const templates = templatesRes.data ?? []
+  const decorated = templates.map((t) => ({
+    ...t,
+    last_used_at: usageByTemplate.get(t.id) ?? null,
+  }))
+
+  // Stable-sort: templates with last_used_at come first (most-recent first).
+  // Templates without usage keep their category/name order from the query.
+  // ISO 8601 timestamps are fixed-width ASCII — plain relational comparison
+  // is correct and avoids any locale-dependent behaviour from localeCompare.
+  decorated.sort((a, b) => {
+    const aUsed = a.last_used_at
+    const bUsed = b.last_used_at
+    if (aUsed && bUsed) {
+      if (bUsed > aUsed) return -1
+      if (bUsed < aUsed) return 1
+      return 0
+    }
+    if (aUsed) return -1
+    if (bUsed) return 1
+    return 0
+  })
+
+  return NextResponse.json({ data: decorated })
 }

 /**