fix(migration): resumable underlag import without inline extraction + same-origin MCP storage URLs (#1783)

* fix(migration): resumable underlag import without inline extraction, same-origin MCP storage URLs The Fortnox underlag import ran every file's AI extraction inline inside one request and hit the hosted 300 s function limit after ~17 of 113 files (twice on 2026-08-21); the UI showed the generic "underlagen kunde inte importeras" although the files it did reach were linked. The import now works in time-budgeted slices with a stable cursor (the UI loops until the server reports the end and shows "x av y") and opts out of extraction (extractionOwner 'none', stamped skipped:opted_out): every file is linked to its posted verifikat on arrival, so the booking is already known. MCP signed Storage URLs (upload_url, signed_url, download_url) are served through a same-origin proxy, /api/storage/[...path], because Claude Desktop's sandbox only reaches the MCP host and blocked the PUT to <project>.supabase.co. The signed token stays the only credential; the proxy forwards only signed documents-bucket paths to our own Storage host and is a no-op rewrite when NEXT_PUBLIC_APP_URL is unset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm * fix(mcp): keep the storage-proxy note out of the size-capped tool descriptions The per-tool 280-char cap and the tools/list payload ceiling both tripped on the two sentences added to gnubok_create_document_upload and gnubok_get_document_content; the why now lives in a code comment. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm * fix(review): id cursor, stall = error, capped upload body, encoded dot segments Review follow-ups on #1783: - the import cursor is the last handled provider attachment id, not an index, so a file Fortnox adds or removes mid-sweep shifts nothing - a partial answer whose cursor does not advance (or the round guard) is reported as ARCIM_DOCUMENT_IMPORT_STALLED instead of "complete"; the slices already landed stay reported and the retry button resumes - the storage proxy reads the PUT body as a capped stream instead of buffering an unbounded payload before measuring it - object paths are rejected when any segment decodes to "." or ".." (or holds a separator), and the URL fetch() would actually request is re-checked against the allowlist after normalisation - download_url description no longer claims a direct Storage URL Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013YoZ8iboyTj221axW6Gdtm --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-08-21 15:28:37 +02:00
parent 0531576807
commit 524d9978f1
21 changed files with 1326 additions and 20 deletions
@@ -0,0 +1,190 @@
+import { afterEach, beforeEach, describe, expect, it, vi } from 'vitest'
+import {
+  readBodyWithCap,
+  resolveUpstreamStorageUrl,
+  toSameOriginStorageUrl,
+} from '../storage-proxy'
+
+const SUPABASE = 'https://pwxtzglxptnnvjrpixpg.supabase.co'
+const APP = 'https://app.accounted.se'
+const UPLOAD_URL = `${SUPABASE}/storage/v1/object/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`
+const DOWNLOAD_URL = `${SUPABASE}/storage/v1/object/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`
+
+beforeEach(() => {
+  vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', SUPABASE)
+  vi.stubEnv('NEXT_PUBLIC_APP_URL', APP)
+})
+
+afterEach(() => {
+  vi.unstubAllEnvs()
+})
+
+describe('toSameOriginStorageUrl', () => {
+  it('moves a signed upload URL onto the app origin, keeping path encoding and the token', () => {
+    expect(toSameOriginStorageUrl(UPLOAD_URL)).toBe(
+      `${APP}/api/storage/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`,
+    )
+  })
+
+  it('moves a signed download URL onto the app origin with every query parameter', () => {
+    expect(toSameOriginStorageUrl(DOWNLOAD_URL)).toBe(
+      `${APP}/api/storage/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`,
+    )
+  })
+
+  it('tolerates a trailing slash on the app URL', () => {
+    expect(toSameOriginStorageUrl(DOWNLOAD_URL, `${APP}/`)).toMatch(
+      new RegExp(`^${APP}/api/storage/sign/`),
+    )
+  })
+
+  it('leaves the URL alone when the app has no public URL (self-host without NEXT_PUBLIC_APP_URL)', () => {
+    vi.stubEnv('NEXT_PUBLIC_APP_URL', '')
+    expect(toSameOriginStorageUrl(UPLOAD_URL)).toBe(UPLOAD_URL)
+    expect(toSameOriginStorageUrl(UPLOAD_URL, undefined)).toBe(UPLOAD_URL)
+  })
+
+  it('leaves URLs on other hosts, other buckets, unsigned paths and token-less links alone', () => {
+    expect(toSameOriginStorageUrl('https://storage.example/upload?token=signed')).toBe(
+      'https://storage.example/upload?token=signed',
+    )
+    const otherBucket = `${SUPABASE}/storage/v1/object/sign/avatars/a.png?token=t`
+    expect(toSameOriginStorageUrl(otherBucket)).toBe(otherBucket)
+    const publicObject = `${SUPABASE}/storage/v1/object/public/documents/a.pdf`
+    expect(toSameOriginStorageUrl(publicObject)).toBe(publicObject)
+    const noToken = `${SUPABASE}/storage/v1/object/sign/documents/a.pdf`
+    expect(toSameOriginStorageUrl(noToken)).toBe(noToken)
+    expect(toSameOriginStorageUrl('not a url')).toBe('not a url')
+  })
+})
+
+describe('resolveUpstreamStorageUrl', () => {
+  it('rebuilds the upstream signed URL for upload and download paths', () => {
+    expect(
+      resolveUpstreamStorageUrl(
+        'upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf',
+        new URLSearchParams('token=eyJ.sig'),
+      ),
+    ).toEqual({
+      ok: true,
+      url: `${SUPABASE}/storage/v1/object/upload/sign/documents/co-1/user-1/pending/up-1/faktura%20maj.pdf?token=eyJ.sig`,
+    })
+    expect(
+      resolveUpstreamStorageUrl(
+        'sign/documents/co-1/user-1/kvitto.pdf',
+        new URLSearchParams('token=eyJ.sig&download='),
+      ),
+    ).toEqual({
+      ok: true,
+      url: `${SUPABASE}/storage/v1/object/sign/documents/co-1/user-1/kvitto.pdf?token=eyJ.sig&download=`,
+    })
+  })
+
+  it('fails closed on anything that is not a signed documents-bucket object path', () => {
+    const token = new URLSearchParams('token=t')
+    expect(resolveUpstreamStorageUrl('public/documents/a.pdf', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/avatars/a.png', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/documents/', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('sign/documents/../bucket/x', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+    expect(resolveUpstreamStorageUrl('list/documents', token)).toEqual({
+      ok: false,
+      reason: 'unsupported_path',
+    })
+  })
+
+  it('rejects dot segments in every spelling the URL parser would normalise away', () => {
+    const token = new URLSearchParams('token=t')
+    for (const evil of [
+      'sign/documents/%2e%2e/avatars/x',
+      'sign/documents/.%2e/avatars/x',
+      'sign/documents/%2e./avatars/x',
+      'sign/documents/%2E%2E/avatars/x',
+      'sign/documents/a/../../avatars/x',
+      'sign/documents/./x',
+      'sign/documents/a//x',
+      'sign/documents/a%5c..%5cavatars/x',
+      'sign/documents/a\\..\\avatars/x',
+      'sign/documents/a%2f..%2favatars/x',
+      'sign/documents/%zz/x',
+      'upload/sign/documents/%2e%2e/avatars/x',
+    ]) {
+      expect(resolveUpstreamStorageUrl(evil, token), evil).toEqual({
+        ok: false,
+        reason: 'unsupported_path',
+      })
+    }
+  })
+
+  it('still accepts real keys with spaces, non-ASCII and dots inside names', () => {
+    const token = new URLSearchParams('token=t')
+    const resolved = resolveUpstreamStorageUrl(
+      'sign/documents/co-1/user-1/faktura%20maj%20%C3%A5r.2026.pdf',
+      token,
+    )
+    expect(resolved.ok).toBe(true)
+  })
+
+  it('requires the signed token', () => {
+    expect(resolveUpstreamStorageUrl('sign/documents/a.pdf', new URLSearchParams())).toEqual({
+      ok: false,
+      reason: 'missing_token',
+    })
+  })
+
+  it('reports an unconfigured Storage host instead of guessing', () => {
+    vi.stubEnv('NEXT_PUBLIC_SUPABASE_URL', '')
+    expect(
+      resolveUpstreamStorageUrl('sign/documents/a.pdf', new URLSearchParams('token=t')),
+    ).toEqual({ ok: false, reason: 'storage_unconfigured' })
+  })
+})
+
+describe('readBodyWithCap', () => {
+  function stream(chunks: Uint8Array[]): ReadableStream<Uint8Array> {
+    return new ReadableStream({
+      start(controller) {
+        for (const chunk of chunks) controller.enqueue(chunk)
+        controller.close()
+      },
+    })
+  }
+
+  it('concatenates a body under the cap', async () => {
+    const out = await readBodyWithCap(
+      stream([new TextEncoder().encode('%PDF'), new TextEncoder().encode('-1.4')]),
+      100,
+    )
+    expect(out && new TextDecoder().decode(out)).toBe('%PDF-1.4')
+  })
+
+  it('returns null as soon as the running total passes the cap, without draining the rest', async () => {
+    let pulled = 0
+    const endless = new ReadableStream<Uint8Array>({
+      pull(controller) {
+        pulled++
+        controller.enqueue(new Uint8Array(1024))
+      },
+    })
+
+    const out = await readBodyWithCap(endless, 4096)
+
+    expect(out).toBeNull()
+    expect(pulled).toBeLessThan(10)
+  })
+
+  it('treats a missing body as empty', async () => {
+    expect((await readBodyWithCap(null, 10))?.byteLength).toBe(0)
+  })
+})