fix(migration): resumable underlag import without inline extraction + same-origin MCP storage URLs (#1783)

* fix(migration): resumable underlag import without inline extraction, same-origin MCP storage URLs

The Fortnox underlag import ran every file's AI extraction inline inside
one request and hit the hosted 300 s function limit after ~17 of 113 files
(twice on 2026-08-21); the UI showed the generic "underlagen kunde inte
importeras" although the files it did reach were linked. The import now
works in time-budgeted slices with a stable cursor (the UI loops until the
server reports the end and shows "x av y") and opts out of extraction
(extractionOwner 'none', stamped skipped:opted_out): every file is linked
to its posted verifikat on arrival, so the booking is already known.

MCP signed Storage URLs (upload_url, signed_url, download_url) are served
through a same-origin proxy, /api/storage/[...path], because Claude
Desktop's sandbox only reaches the MCP host and blocked the PUT to
<project>.supabase.co. The signed token stays the only credential; the
proxy forwards only signed documents-bucket paths to our own Storage host
and is a no-op rewrite when NEXT_PUBLIC_APP_URL is unset.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

* fix(mcp): keep the storage-proxy note out of the size-capped tool descriptions

The per-tool 280-char cap and the tools/list payload ceiling both tripped on
the two sentences added to gnubok_create_document_upload and
gnubok_get_document_content; the why now lives in a code comment.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

* fix(review): id cursor, stall = error, capped upload body, encoded dot segments

Review follow-ups on #1783:
- the import cursor is the last handled provider attachment id, not an
  index, so a file Fortnox adds or removes mid-sweep shifts nothing
- a partial answer whose cursor does not advance (or the round guard) is
  reported as ARCIM_DOCUMENT_IMPORT_STALLED instead of "complete"; the
  slices already landed stay reported and the retry button resumes
- the storage proxy reads the PUT body as a capped stream instead of
  buffering an unbounded payload before measuring it
- object paths are rejected when any segment decodes to "." or ".." (or
  holds a separator), and the URL fetch() would actually request is
  re-checked against the allowlist after normalisation
- download_url description no longer claims a direct Storage URL

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm

---------

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

lib/core/documents/__tests__/storage-proxy.test.ts

@@ -0,0 +1,190 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  readBodyWithCap,
+  resolveUpstreamStorageUrl,
+  toSameOriginStorageUrl,
+} from '../storage-proxy'
+
+const SUPABASE = 'https://pwxtzglxptnnvjrpixpg.supabase.co'
+const APP = 'https://app.accounted.se'
+const UPLOAD_URL = `${SUPABASE}/storage/v1/object/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`
+const DOWNLOAD_URL = `${SUPABASE}/storage/v1/object/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`
+
+beforeEach(() => {
+  vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', SUPABASE)
+  vi.stubEnv('NEXT_PUBLIC_APP_URL', APP)
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('toSameOriginStorageUrl', () => {
+  it('moves a signed upload URL onto the app origin, keeping path encoding and the token', () => {
+    expect(toSameOriginStorageUrl(UPLOAD_URL)).toBe(
+      `${APP}/api/storage/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`,
+    )
+  })
+
+  it('moves a signed download URL onto the app origin with every query parameter', () => {
+    expect(toSameOriginStorageUrl(DOWNLOAD_URL)).toBe(
+      `${APP}/api/storage/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`,
+    )
+  })
+
+  it('tolerates a trailing slash on the app URL', () => {
+    expect(toSameOriginStorageUrl(DOWNLOAD_URL, `${APP}/`)).toMatch(
+      new RegExp(`^${APP}/api/storage/sign/`),
+    )
+  })
+
+  it('leaves the URL alone when the app has no public URL (self-host without NEXT_PUBLIC_APP_URL)', () => {
+    vi.stubEnv('NEXT_PUBLIC_APP_URL', '')
+    expect(toSameOriginStorageUrl(UPLOAD_URL)).toBe(UPLOAD_URL)
+    expect(toSameOriginStorageUrl(UPLOAD_URL, undefined)).toBe(UPLOAD_URL)
+  })
+
+  it('leaves URLs on other hosts, other buckets, unsigned paths and token-less links alone', () => {
+    expect(toSameOriginStorageUrl('https://storage.example/upload?token=signed')).toBe(
+      'https://storage.example/upload?token=signed',
+    )
+    const otherBucket = `${SUPABASE}/storage/v1/object/sign/avatars/a.png?token=t`
+    expect(toSameOriginStorageUrl(otherBucket)).toBe(otherBucket)
+    const publicObject = `${SUPABASE}/storage/v1/object/public/documents/a.pdf`
+    expect(toSameOriginStorageUrl(publicObject)).toBe(publicObject)
+    const noToken = `${SUPABASE}/storage/v1/object/sign/documents/a.pdf`
+    expect(toSameOriginStorageUrl(noToken)).toBe(noToken)
+    expect(toSameOriginStorageUrl('not a url')).toBe('not a url')
+  })
+})
+
+describe('resolveUpstreamStorageUrl', () => {
+  it('rebuilds the upstream signed URL for upload and download paths', () => {
+    expect(
+      resolveUpstreamStorageUrl(
+        'upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf',
+        new URLSearchParams('token=eyJ.sig'),
+      ),
+    ).toEqual({
+      ok: true,
+      url: `${SUPABASE}/storage/v1/object/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`,
+    })
+    expect(
+      resolveUpstreamStorageUrl(
+        'sign/documents/co-1/user-1/kvitto.pdf',
+        new URLSearchParams('token=eyJ.sig&download='),
+      ),
+    ).toEqual({
+      ok: true,
+      url: `${SUPABASE}/storage/v1/object/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`,
+    })
+  })
+
+  it('fails closed on anything that is not a signed documents-bucket object path', () => {
+    const token = new URLSearchParams('token=t')
+    expect(resolveUpstreamStorageUrl('public/documents/a.pdf', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/avatars/a.png', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/documents/', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/documents/../bucket/x', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('list/documents', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+  })
+
+  it('rejects dot segments in every spelling the URL parser would normalise away', () => {
+    const token = new URLSearchParams('token=t')
+    for (const evil of [
+      'sign/documents/%2e%2e/avatars/x',
+      'sign/documents/.%2e/avatars/x',
+      'sign/documents/%2e./avatars/x',
+      'sign/documents/%2E%2E/avatars/x',
+      'sign/documents/a/../../avatars/x',
+      'sign/documents/./x',
+      'sign/documents/a//x',
+      'sign/documents/a%5c..%5cavatars/x',
+      'sign/documents/a\\..\\avatars/x',
+      'sign/documents/a%2f..%2favatars/x',
+      'sign/documents/%zz/x',
+      'upload/sign/documents/%2e%2e/avatars/x',
+    ]) {
+      expect(resolveUpstreamStorageUrl(evil, token), evil).toEqual({
+        ok: false,
+        reason: 'unsupported_path',
+      })
+    }
+  })
+
+  it('still accepts real keys with spaces, non-ASCII and dots inside names', () => {
+    const token = new URLSearchParams('token=t')
+    const resolved = resolveUpstreamStorageUrl(
+      'sign/documents/co-1/user-1/faktura%20maj%20%C3%A5r.2026.pdf',
+      token,
+    )
+    expect(resolved.ok).toBe(true)
+  })
+
+  it('requires the signed token', () => {
+    expect(resolveUpstreamStorageUrl('sign/documents/a.pdf', new URLSearchParams())).toEqual({
+      ok: false,
+      reason: 'missing_token',
+    })
+  })
+
+  it('reports an unconfigured Storage host instead of guessing', () => {
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '')
+    expect(
+      resolveUpstreamStorageUrl('sign/documents/a.pdf', new URLSearchParams('token=t')),
+    ).toEqual({ ok: false, reason: 'storage_unconfigured' })
+  })
+})
+
+describe('readBodyWithCap', () => {
+  function stream(chunks: Uint8Array[]): ReadableStream<Uint8Array> {
+    return new ReadableStream({
+      start(controller) {
+        for (const chunk of chunks) controller.enqueue(chunk)
+        controller.close()
+      },
+    })
+  }
+
+  it('concatenates a body under the cap', async () => {
+    const out = await readBodyWithCap(
+      stream([new TextEncoder().encode('%PDF'), new TextEncoder().encode('-1.4')]),
+      100,
+    )
+    expect(out && new TextDecoder().decode(out)).toBe('%PDF-1.4')
+  })
+
+  it('returns null as soon as the running total passes the cap, without draining the rest', async () => {
+    let pulled = 0
+    const endless = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        pulled++
+        controller.enqueue(new Uint8Array(1024))
+      },
+    })
+
+    const out = await readBodyWithCap(endless, 4096)
+
+    expect(out).toBeNull()
+    expect(pulled).toBeLessThan(10)
+  })
+
+  it('treats a missing body as empty', async () => {
+    expect((await readBodyWithCap(null, 10))?.byteLength).toBe(0)
+  })
+})

lib/core/documents/document-service.ts

@@ -1,6 +1,7 @@
 import type { SupabaseClient } from '@supabase/supabase-js'
 import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
 import { eventBus } from '@/lib/events'
+import type { DocumentExtractionOwner } from '@/lib/events/types'
 import type { DocumentAttachment, DocumentUploadSource } from '@/types'
 
 /**
@@ -504,7 +505,7 @@ export async function completePendingDocumentUpload(
   fileName: string,
   mimeType: string,
   now: number = Date.now(),
-  options: { extractionOwner?: 'invoice-inbox' } = {}
+  options: { extractionOwner?: DocumentExtractionOwner } = {}
 ): Promise<CompletedPendingDocumentUpload> {
   const serviceClient = createServiceClientNoCookies()
   const storage = serviceClient.storage.from(DOCUMENTS_BUCKET)
@@ -656,9 +657,10 @@ export async function uploadDocument(
      * Who runs AI extraction on this document. The invoice inbox extracts
      * the documents it ingests itself (and mirrors the result onto the
      * document row), so it declares ownership here and the
-     * document-extraction extension yields. Default: the extension extracts.
+     * document-extraction extension yields. 'none' opts out entirely (the
+     * caller already knows the booking). Default: the extension extracts.
      */
-    extractionOwner?: 'invoice-inbox'
+    extractionOwner?: DocumentExtractionOwner
   } = {}
 ): Promise<DocumentAttachment & { deduplicated?: boolean }> {
   await ensureDocumentsBucket()

lib/core/documents/storage-proxy.ts

@@ -0,0 +1,177 @@
+/**
+ * Same-origin proxy for Supabase Storage signed URLs.
+ *
+ * Agent sandboxes (Claude Desktop's code execution, some MCP clients) only
+ * allow network egress to the host the MCP server lives on. Our signed
+ * Storage URLs point at <project>.supabase.co, so a model-free upload or a
+ * document download from such a sandbox was refused before it left the box
+ * (user report 2026-08-21). These helpers rewrite a signed URL onto this
+ * app's own origin (`/api/storage/...`) and resolve it back to the upstream
+ * Storage URL inside the proxy route.
+ *
+ * The signed token travels unchanged and is the only credential on both
+ * sides: the proxy grants nothing the public Storage host did not already
+ * grant, and it refuses every path that is not a signed object path on the
+ * documents bucket. Without NEXT_PUBLIC_APP_URL (a self-host that never set
+ * it) the rewrite is a no-op rather than a broken localhost link.
+ */
+
+export const STORAGE_PROXY_ROUTE = '/api/storage'
+
+/** Upstream prefix under the Storage API that every signed object URL shares. */
+const UPSTREAM_OBJECT_PREFIX = '/storage/v1/object/'
+
+/**
+ * Only token-authenticated object paths on the documents bucket: signed
+ * downloads (`sign/documents/...`) and signed uploads
+ * (`upload/sign/documents/...`). Anything else (public objects, bucket
+ * admin, other buckets) is not this proxy's business.
+ */
+const ALLOWED_OBJECT_PATH_RE = /^(sign|upload\/sign)\/documents\/[^/]+/
+
+export type StorageProxyResolution =
+  | { ok: true; url: string }
+  | { ok: false; reason: 'unsupported_path' | 'missing_token' | 'storage_unconfigured' }
+
+/**
+ * True when every segment of the (still percent-encoded) object path is a
+ * plain name: no empty segment, no `.`/`..` in raw or percent-encoded form
+ * (`%2e%2e`, `.%2e`, `%2e.`: the WHATWG URL parser normalises those away,
+ * which would let `sign/documents/%2e%2e/other/x` leave the documents
+ * bucket), no backslash (a path separator for https URLs), no malformed
+ * escapes.
+ */
+function hasOnlyPlainSegments(objectPath: string): boolean {
+  for (const segment of objectPath.split('/')) {
+    if (segment === '') return false
+    let decoded: string
+    try {
+      decoded = decodeURIComponent(segment)
+    } catch {
+      return false
+    }
+    if (decoded === '.' || decoded === '..') return false
+    if (decoded.includes('\\') || decoded.includes('/')) return false
+  }
+  return true
+}
+
+function trimTrailingSlash(value: string): string {
+  return value.replace(/\/+$/, '')
+}
+
+function upstreamStorageOrigin(): string | null {
+  const raw = process.env.NEXT_PUBLIC_SUPABASE_URL?.trim()
+  if (!raw) return null
+  try {
+    return new URL(raw).origin
+  } catch {
+    return null
+  }
+}
+
+/**
+ * Rewrite a Supabase signed Storage URL onto this app's origin. Returns the
+ * input unchanged when it is not a signed documents-bucket URL on our Storage
+ * host, or when the app has no public URL configured.
+ */
+export function toSameOriginStorageUrl(
+  signedUrl: string,
+  appBaseUrl: string | undefined = process.env.NEXT_PUBLIC_APP_URL,
+): string {
+  const base = appBaseUrl?.trim()
+  const upstream = upstreamStorageOrigin()
+  if (!base || !upstream) return signedUrl
+
+  let url: URL
+  try {
+    url = new URL(signedUrl)
+  } catch {
+    return signedUrl
+  }
+  if (url.origin !== upstream) return signedUrl
+  if (!url.pathname.startsWith(UPSTREAM_OBJECT_PREFIX)) return signedUrl
+
+  // Keep the pathname exactly as Storage encoded it: object keys may hold
+  // spaces and non-ASCII, and the token was signed over the real key.
+  const objectPath = url.pathname.slice(UPSTREAM_OBJECT_PREFIX.length)
+  if (!ALLOWED_OBJECT_PATH_RE.test(objectPath)) return signedUrl
+  if (!url.searchParams.has('token')) return signedUrl
+
+  return `${trimTrailingSlash(base)}${STORAGE_PROXY_ROUTE}/${objectPath}${url.search}`
+}
+
+/**
+ * Resolve the proxied path (everything after `/api/storage/`, still
+ * percent-encoded as received) plus its query back to the upstream Storage
+ * URL. Fails closed on anything outside the signed documents-bucket paths.
+ */
+export function resolveUpstreamStorageUrl(
+  objectPath: string,
+  search: URLSearchParams,
+): StorageProxyResolution {
+  const upstream = upstreamStorageOrigin()
+  if (!upstream) return { ok: false, reason: 'storage_unconfigured' }
+  if (!ALLOWED_OBJECT_PATH_RE.test(objectPath) || !hasOnlyPlainSegments(objectPath)) {
+    return { ok: false, reason: 'unsupported_path' }
+  }
+  if (!search.get('token')) return { ok: false, reason: 'missing_token' }
+
+  const query = search.toString()
+  const url = `${upstream}${UPSTREAM_OBJECT_PREFIX}${objectPath}${query ? `?${query}` : ''}`
+  // Belt and braces: whatever fetch() will actually request, after URL
+  // normalisation, must still sit inside the allowlist.
+  let normalisedPath: string
+  try {
+    normalisedPath = new URL(url).pathname
+  } catch {
+    return { ok: false, reason: 'unsupported_path' }
+  }
+  if (
+    !normalisedPath.startsWith(UPSTREAM_OBJECT_PREFIX) ||
+    !ALLOWED_OBJECT_PATH_RE.test(normalisedPath.slice(UPSTREAM_OBJECT_PREFIX.length))
+  ) {
+    return { ok: false, reason: 'unsupported_path' }
+  }
+
+  return { ok: true, url }
+}
+
+/**
+ * Read a request body into memory, aborting as soon as it exceeds `maxBytes`
+ * instead of buffering an unbounded payload first and measuring afterwards
+ * (the proxy is unauthenticated until Storage checks the token, so a
+ * self-host without a platform body limit must not be forced to hold an
+ * arbitrary upload in RAM). Returns null when the cap is exceeded.
+ */
+export async function readBodyWithCap(
+  body: ReadableStream<Uint8Array> | null,
+  maxBytes: number,
+): Promise<ArrayBuffer | null> {
+  if (!body) return new ArrayBuffer(0)
+  const reader = body.getReader()
+  const chunks: Uint8Array[] = []
+  let total = 0
+  try {
+    for (;;) {
+      const { done, value } = await reader.read()
+      if (done) break
+      if (!value) continue
+      total += value.byteLength
+      if (total > maxBytes) {
+        await reader.cancel()
+        return null
+      }
+      chunks.push(value)
+    }
+  } finally {
+    reader.releaseLock()
+  }
+  const out = new Uint8Array(total)
+  let offset = 0
+  for (const chunk of chunks) {
+    out.set(chunk, offset)
+    offset += chunk.byteLength
+  }
+  return out.buffer
+}

lib/errors/structured-errors.ts

@@ -2076,6 +2076,33 @@ const PROVIDER_MIGRATION: Record<string, StructuredErrorEntry> = {
     message_sv: 'Kunde inte importera underlag från leverantören.',
     message_en: 'Failed to import documents from provider.',
   },
+  // Same-origin storage proxy (/api/storage): signed Storage URLs served
+  // from the app's own host for agent sandboxes that only reach the MCP host.
+  STORAGE_PROXY_UNSUPPORTED_PATH: {
+    httpStatus: 404,
+    message_sv: 'Sökvägen stöds inte av lagringsproxyn.',
+    message_en: 'The storage proxy does not serve this path.',
+  },
+  STORAGE_PROXY_TOKEN_REQUIRED: {
+    httpStatus: 400,
+    message_sv: 'Länken saknar sin signerade token.',
+    message_en: 'The link is missing its signed token.',
+  },
+  STORAGE_PROXY_BODY_TOO_LARGE: {
+    httpStatus: 413,
+    message_sv: 'Filen är för stor för att laddas upp via länken.',
+    message_en: 'The file is too large to upload through this link.',
+  },
+  STORAGE_PROXY_UNCONFIGURED: {
+    httpStatus: 503,
+    message_sv: 'Lagringen är inte konfigurerad på den här servern.',
+    message_en: 'Storage is not configured on this server.',
+  },
+  STORAGE_PROXY_UPSTREAM_UNAVAILABLE: {
+    httpStatus: 502,
+    message_sv: 'Lagringen svarade inte.',
+    message_en: 'Storage did not respond.',
+  },
   PROVIDER_DOCUMENT_SCOPES_REQUIRED: {
     httpStatus: 403,
     message_sv:

lib/events/types.ts

@@ -18,6 +18,14 @@ import type {
 // Core Event Types: discriminated union of all system events
 // ============================================================
 
+/**
+ * Who runs AI extraction on an uploaded document.
+ * - 'invoice-inbox': the inbox extracts and mirrors the result itself.
+ * - 'none': nobody should; the caller already holds the booking.
+ * Unset: the document-extraction extension extracts (default).
+ */
+export type DocumentExtractionOwner = 'invoice-inbox' | 'none'
+
 export type CoreEvent =
   // Bookkeeping
   | { type: 'journal_entry.drafted'; payload: { entry: JournalEntry; userId: string; companyId: string } }
@@ -29,7 +37,11 @@ export type CoreEvent =
   // extractionOwner: set by the invoice inbox on documents it extracts itself,
   // so the document-extraction extension yields instead of racing it (the
   // inbox row does not exist yet when this event fires inside uploadDocument).
-  | { type: 'document.uploaded'; payload: { document: DocumentAttachment; userId: string; companyId: string; extractionOwner?: 'invoice-inbox' } }
+  // 'none' is an explicit opt-out: the uploader already knows the booking
+  // (provider underlag import links each file to its posted verifikat), so
+  // running a paid model over it would buy nothing. The extension stamps the
+  // row as skipped instead of extracting.
+  | { type: 'document.uploaded'; payload: { document: DocumentAttachment; userId: string; companyId: string; extractionOwner?: DocumentExtractionOwner } }
   | { type: 'document.accessed'; payload: { document: { id: string; file_name: string }; userId: string; companyId: string } }
   | { type: 'document.deleted'; payload: { document: { id: string; file_name: string }; userId: string; companyId: string } }
   // Invoicing