Bug/invalid imports (#1146)
* feat: add Accounted MCP namespace * fix(bookkeeping): stop flagging verifikat whose underlag lives on a referenced supplier invoice The missing-underlag surfaces only accepted a document directly linked to the entry, so payment verifikat for supplier invoices (doc on the registration entry per design) and entries whose doc was pinned to the bank transaction before matching were falsely flagged; opening the entry showed the referenced doc and cleared the warning client-side, and it came back on reload. - verifikat_without_documents + transactions_without_documents now treat an entry as covered when a supplier invoice referencing it (registration or payment FK, or a supplier_invoice_payments row) carries a document anchored to a journal entry (BFL 5 kap 7 paragraf hänvisning till underlag; anchoring required because the WORM deletion guards key on document_attachments.journal_entry_id) - match-supplier-invoice routes (dashboard + v1) propagate the transaction's pinned document onto the payment verifikat, mirroring the categorize route; migration backfills rows already written (open unlocked periods, company-guarded, never steals a linked doc) - /api/documents/counts, the transactions-page badges, the bulk "Inget underlag krävs" count and the push-notification scheduler share the same reference-aware predicate, so every surface agrees with the RPC - counts route validates journal_entry_ids as UUIDs (they are interpolated into a PostgREST or-filter) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(transactions): align table columns flush with page edges Collapse the checkbox gutter column to zero width and hang the hover-revealed checkbox/expand chevron in the page margins, drop the outer padding so DATUM sits flush left and STATUS flush right, and tuck the overflow-menu dots under the middle of the STATUS header. Applied to both the inbox and history tables so they stay identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(arsredovisning): tie anlaggningstillgangar note to booked depreciation The ARL 5:8 roll-forward note recomputed depreciation from its own day-based linear formula (365.25/12 month length, non-inclusive day count, linear only), drifting ~20 kr per year per asset from the ledger-driven resultat- and balansrakning and misstating non-linear methods entirely. Note figures now come from posted depreciation_schedules rows (the same source disposeAsset reverses), falling back to the engine's computeAnnualDepreciation when nothing is posted; pre-onboarding opening balances iterate prior years through the engine. Adds a note-vs-trial-balance tie-out warning (accounts 1000-1299, over 1 kr) surfaced before download. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(stripe): move connect and sync surface from settings to import page Stripe's transaction feed is a continuous import source in the same category as the PSD2 bank connection, so its connect/sync surface now lives on the import page as a source card (mode=stripe), gated "kommer snart" on hosted like before; self-hosted keeps the full panel. - Import page: Stripe card after Koppla bank, renders the existing StripeSettingsPanel via the settings-panel registry - OAuth callback and panel cleanup return to /import?mode=stripe - Settings > Betalningar retired: nav item removed, route redirects, PaymentsSettingsContent deleted, legacy ?tab=payments mapped - New import.stripe_* strings in sv+en; dead settings_nav.payments removed Crons and sync logic unchanged; payment-link settings stay in the invoicing section. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(underlag): paginate missing-underlag cron and harden doc-surface queries Resolve PR review findings on bug/invalid-imports: - notification-scheduler: fetchAllRows on all 5 global reads; past 1000 rows the capped reads produced false "saknade underlag" notifications - bulk-missing: LOOKUP_CHUNK 300->150 so the twice-embedded .or() id list stays under the PostgREST URL limit - bulk-missing + transactions page: UUID-guard the .or()-interpolated id lists, matching documents/counts - match-supplier-invoice (dashboard + v1): log documentId/journalEntryId on the non-fatal doc-link warning - well-known/oauth-protected-resource: document the tool_namespace allow-list - messages/en: reword stripe_description - DECISIONS.md: record the asset ibAck tie-out and Tailwind !important calls Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): convert registrationDate from Unix seconds to millisecond epoch in lookup and profile tests --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
51ca574ca4
commit
53e343ee92
@@ -67,6 +67,8 @@ describe('POST /api/bookkeeping/no-doc-required/bulk-missing', () => {
|
||||
it('dry_run counts only entries that are missing AND not exempt', async () => {
|
||||
enqueue({ data: [{ id: 'a' }, { id: 'b' }, { id: 'c' }], error: null }) // candidates
|
||||
enqueue({ data: [{ journal_entry_id: 'a' }], error: null }) // a has a document
|
||||
enqueue({ data: [], error: null }) // no SI references with docs
|
||||
enqueue({ data: [], error: null }) // no SI payment-row references
|
||||
enqueue({ data: [{ journal_entry_id: 'b' }], error: null }) // b already exempt
|
||||
const res = await POST(makeReq({ dry_run: true }))
|
||||
const { status, body } = await parseJsonResponse<{ data: { count: number } }>(res)
|
||||
@@ -74,9 +76,49 @@ describe('POST /api/bookkeeping/no-doc-required/bulk-missing', () => {
|
||||
expect(body.data.count).toBe(1) // only c
|
||||
})
|
||||
|
||||
it('dry_run excludes entries covered by a supplier-invoice reference with an anchored doc', async () => {
|
||||
// a: covered via supplier_invoices.registration_journal_entry_id
|
||||
// b: covered via a supplier_invoice_payments row whose SI has an anchored doc
|
||||
// c: genuinely missing
|
||||
// d: SI reference exists but its doc is UNANCHORED (deletable) → still missing
|
||||
enqueue({ data: [{ id: 'a' }, { id: 'b' }, { id: 'c' }, { id: 'd' }], error: null }) // candidates
|
||||
enqueue({ data: [], error: null }) // no direct documents
|
||||
enqueue({
|
||||
data: [
|
||||
{
|
||||
registration_journal_entry_id: 'a',
|
||||
payment_journal_entry_id: null,
|
||||
document: { journal_entry_id: 'a' },
|
||||
},
|
||||
{
|
||||
registration_journal_entry_id: 'd',
|
||||
payment_journal_entry_id: null,
|
||||
document: { journal_entry_id: null },
|
||||
},
|
||||
],
|
||||
error: null,
|
||||
})
|
||||
enqueue({
|
||||
data: [
|
||||
{
|
||||
journal_entry_id: 'b',
|
||||
supplier_invoice: { document_id: 'doc-1', document: { journal_entry_id: 'x' } },
|
||||
},
|
||||
],
|
||||
error: null,
|
||||
})
|
||||
enqueue({ data: [], error: null }) // no exemptions
|
||||
const res = await POST(makeReq({ dry_run: true }))
|
||||
const { status, body } = await parseJsonResponse<{ data: { count: number } }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(body.data.count).toBe(2) // c and d
|
||||
})
|
||||
|
||||
it('marks the missing entries and returns the count', async () => {
|
||||
enqueue({ data: [{ id: 'a' }, { id: 'b' }, { id: 'c' }], error: null }) // candidates
|
||||
enqueue({ data: [], error: null }) // no documents
|
||||
enqueue({ data: [], error: null }) // no SI references with docs
|
||||
enqueue({ data: [], error: null }) // no SI payment-row references
|
||||
enqueue({ data: [{ journal_entry_id: 'a' }], error: null }) // a already exempt
|
||||
enqueue({ error: null }) // helper upsert
|
||||
const res = await POST(makeReq({ period_id: null, reason: 'Importerad' }))
|
||||
|
||||
@@ -25,6 +25,12 @@ const isoDate = z.string().refine(
|
||||
{ message: 'Ogiltigt datum (förväntat YYYY-MM-DD)' },
|
||||
)
|
||||
|
||||
// Journal-entry ids are interpolated into the supplier-invoice .or() filter
|
||||
// string below, so they must be UUIDs. They originate from journal_entries.id
|
||||
// (DB-sourced, never request input), but this guard keeps the injection-safety
|
||||
// contract identical to /api/documents/counts.
|
||||
const uuidSchema = z.string().uuid()
|
||||
|
||||
const BulkMissingSchema = z.object({
|
||||
period_id: z.string().uuid().nullable().optional(),
|
||||
// Single uppercase verifikationsserie (A-Z); the list sends null for "all".
|
||||
@@ -90,16 +96,45 @@ export const POST = withRouteContext(
|
||||
const candidateIds = candidates.map((e) => e.id)
|
||||
const withDoc = new Set<string>()
|
||||
const exempt = new Set<string>()
|
||||
const LOOKUP_CHUNK = 300
|
||||
// 150 keeps the embedded id lists well under PostgREST's URL-length limit:
|
||||
// the supplier-invoice .or() below repeats the chunk twice (registration +
|
||||
// payment FK), so a larger chunk would risk truncating the GET filter.
|
||||
const LOOKUP_CHUNK = 150
|
||||
for (let i = 0; i < candidateIds.length; i += LOOKUP_CHUNK) {
|
||||
const chunk = candidateIds.slice(i, i + LOOKUP_CHUNK)
|
||||
const [docRes, exemptRes] = await Promise.all([
|
||||
// Only UUIDs reach the interpolated .or() string (the .in() array filters
|
||||
// are already injection-safe); mirrors the guard in documents/counts.
|
||||
const chunkInList = `(${chunk.filter((id) => uuidSchema.safeParse(id).success).join(',')})`
|
||||
const [docRes, siRefRes, sipRefRes, exemptRes] = await Promise.all([
|
||||
supabase
|
||||
.from('document_attachments')
|
||||
.select('journal_entry_id')
|
||||
.eq('company_id', companyId)
|
||||
.eq('is_current_version', true)
|
||||
.in('journal_entry_id', chunk),
|
||||
// BFL 5 kap 7 § hänvisning: an entry referenced by a supplier invoice
|
||||
// whose source document is retained AND anchored to a journal entry
|
||||
// is NOT missing underlag (only anchored docs sit behind the WORM
|
||||
// deletion guards). Mirrors the verifikat_without_documents RPC;
|
||||
// without this the bulk action would waive entries the warning no
|
||||
// longer counts.
|
||||
supabase
|
||||
.from('supplier_invoices')
|
||||
.select(
|
||||
'registration_journal_entry_id, payment_journal_entry_id, document:document_attachments(journal_entry_id)',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.not('document_id', 'is', null)
|
||||
.or(
|
||||
`registration_journal_entry_id.in.${chunkInList},payment_journal_entry_id.in.${chunkInList}`,
|
||||
),
|
||||
supabase
|
||||
.from('supplier_invoice_payments')
|
||||
.select(
|
||||
'journal_entry_id, supplier_invoice:supplier_invoices(document_id, document:document_attachments(journal_entry_id))',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.in('journal_entry_id', chunk),
|
||||
supabase
|
||||
.from('journal_entry_no_doc_required')
|
||||
.select('journal_entry_id')
|
||||
@@ -109,12 +144,38 @@ export const POST = withRouteContext(
|
||||
if (docRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(docRes.error) }, { status: 400 })
|
||||
}
|
||||
if (siRefRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(siRefRes.error) }, { status: 400 })
|
||||
}
|
||||
if (sipRefRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(sipRefRes.error) }, { status: 400 })
|
||||
}
|
||||
if (exemptRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(exemptRes.error) }, { status: 400 })
|
||||
}
|
||||
for (const r of (docRes.data ?? []) as { journal_entry_id: string }[]) {
|
||||
withDoc.add(r.journal_entry_id)
|
||||
}
|
||||
for (const r of (siRefRes.data ?? []) as unknown as {
|
||||
registration_journal_entry_id: string | null
|
||||
payment_journal_entry_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
}[]) {
|
||||
if (!r.document?.journal_entry_id) continue // unanchored: not underlag
|
||||
if (r.registration_journal_entry_id) withDoc.add(r.registration_journal_entry_id)
|
||||
if (r.payment_journal_entry_id) withDoc.add(r.payment_journal_entry_id)
|
||||
}
|
||||
for (const r of (sipRefRes.data ?? []) as unknown as {
|
||||
journal_entry_id: string | null
|
||||
supplier_invoice: {
|
||||
document_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
} | null
|
||||
}[]) {
|
||||
if (r.journal_entry_id && r.supplier_invoice?.document?.journal_entry_id) {
|
||||
withDoc.add(r.journal_entry_id)
|
||||
}
|
||||
}
|
||||
for (const r of (exemptRes.data ?? []) as { journal_entry_id: string }[]) {
|
||||
exempt.add(r.journal_entry_id)
|
||||
}
|
||||
|
||||
@@ -0,0 +1,193 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
import { parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
|
||||
import { NextResponse } from 'next/server'
|
||||
|
||||
const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
|
||||
|
||||
vi.mock('@/lib/auth/require-auth', () => ({ requireAuth: vi.fn() }))
|
||||
vi.mock('@/lib/company/context', () => ({ getActiveCompanyId: vi.fn() }))
|
||||
|
||||
import { GET } from '../route'
|
||||
import { requireAuth } from '@/lib/auth/require-auth'
|
||||
import { getActiveCompanyId } from '@/lib/company/context'
|
||||
|
||||
const mockUser = { id: 'user-1', email: 't@t.se' }
|
||||
|
||||
const JE_A = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
|
||||
const JE_B = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
|
||||
const JE_C = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
|
||||
|
||||
function makeReq(ids: string[]) {
|
||||
return new Request(
|
||||
`http://localhost/api/documents/counts?journal_entry_ids=${ids.join(',')}`,
|
||||
)
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
reset()
|
||||
;(requireAuth as ReturnType<typeof vi.fn>).mockResolvedValue({
|
||||
user: mockUser,
|
||||
supabase: mockSupabase,
|
||||
})
|
||||
;(getActiveCompanyId as ReturnType<typeof vi.fn>).mockResolvedValue('company-1')
|
||||
})
|
||||
|
||||
// Queue order mirrors the route's Promise.all: direct docs, supplier_invoices
|
||||
// references, supplier_invoice_payments references. The `document` embed
|
||||
// carries the anchor state (journal_entry_id) of the SI's retained doc.
|
||||
function enqueueAll(opts: {
|
||||
direct?: Array<{ id: string; journal_entry_id: string }>
|
||||
si?: Array<{
|
||||
document_id: string
|
||||
registration_journal_entry_id: string | null
|
||||
payment_journal_entry_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
}>
|
||||
sip?: Array<{
|
||||
journal_entry_id: string
|
||||
supplier_invoice: {
|
||||
document_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
} | null
|
||||
}>
|
||||
}) {
|
||||
enqueue({ data: opts.direct ?? [], error: null })
|
||||
enqueue({ data: opts.si ?? [], error: null })
|
||||
enqueue({ data: opts.sip ?? [], error: null })
|
||||
}
|
||||
|
||||
describe('GET /api/documents/counts', () => {
|
||||
it('returns 401 when not authenticated', async () => {
|
||||
;(requireAuth as ReturnType<typeof vi.fn>).mockResolvedValue({
|
||||
error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
expect((await parseJsonResponse(res)).status).toBe(401)
|
||||
})
|
||||
|
||||
it('returns 400 without journal_entry_ids', async () => {
|
||||
const res = await GET(new Request('http://localhost/api/documents/counts'))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('returns 400 for more than 50 ids', async () => {
|
||||
const ids = Array.from({ length: 51 }, (_, i) => `id-${i}`)
|
||||
const res = await GET(makeReq(ids))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('returns 400 for non-UUID ids (they are interpolated into a PostgREST or-filter)', async () => {
|
||||
const res = await GET(makeReq([JE_A, 'registration_journal_entry_id.in.(x)']))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('counts direct attachments per entry', async () => {
|
||||
enqueueAll({
|
||||
direct: [
|
||||
{ id: 'doc-1', journal_entry_id: JE_A },
|
||||
{ id: 'doc-2', journal_entry_id: JE_A },
|
||||
{ id: 'doc-3', journal_entry_id: JE_B },
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B, JE_C]))
|
||||
const { status, body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(body.data).toEqual({ [JE_A]: 2, [JE_B]: 1 })
|
||||
})
|
||||
|
||||
it('counts a supplier invoice doc for both referenced entries (registration + payment)', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: JE_B,
|
||||
document: { journal_entry_id: JE_A },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1, [JE_B]: 1 })
|
||||
})
|
||||
|
||||
it('ignores an UNANCHORED supplier invoice doc (outside the WORM deletion guards)', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: JE_B,
|
||||
document: { journal_entry_id: null },
|
||||
},
|
||||
],
|
||||
sip: [
|
||||
{
|
||||
journal_entry_id: JE_C,
|
||||
supplier_invoice: { document_id: 'doc-si', document: { journal_entry_id: null } },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B, JE_C]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({})
|
||||
})
|
||||
|
||||
it('counts a partial-payment reference via supplier_invoice_payments', async () => {
|
||||
enqueueAll({
|
||||
sip: [
|
||||
{
|
||||
journal_entry_id: JE_A,
|
||||
supplier_invoice: { document_id: 'doc-si', document: { journal_entry_id: JE_B } },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
})
|
||||
|
||||
it('deduplicates a doc that is both directly linked and referenced', async () => {
|
||||
enqueueAll({
|
||||
direct: [{ id: 'doc-si', journal_entry_id: JE_A }],
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: null,
|
||||
document: { journal_entry_id: JE_A },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
})
|
||||
|
||||
it('never returns entries the caller did not ask about', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
// The SI's other FK points at an entry outside the request.
|
||||
registration_journal_entry_id: JE_C,
|
||||
payment_journal_entry_id: JE_A,
|
||||
document: { journal_entry_id: JE_C },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
expect(body.data[JE_C]).toBeUndefined()
|
||||
})
|
||||
|
||||
it('returns 500 when a lookup fails', async () => {
|
||||
enqueue({ data: null, error: { message: 'boom' } })
|
||||
enqueue({ data: [], error: null })
|
||||
enqueue({ data: [], error: null })
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
expect((await parseJsonResponse(res)).status).toBe(500)
|
||||
})
|
||||
})
|
||||
@@ -1,11 +1,28 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { z } from 'zod'
|
||||
import { withRouteContext } from '@/lib/api/with-route-context'
|
||||
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
||||
|
||||
const uuidSchema = z.string().uuid()
|
||||
|
||||
/**
|
||||
* GET /api/documents/counts?journal_entry_ids=id1,id2,...
|
||||
* Returns attachment counts per journal entry ID.
|
||||
* Max 50 IDs per request.
|
||||
* Returns underlag counts per journal entry ID.
|
||||
* Max 50 IDs per request; every ID must be a UUID (the ids are interpolated
|
||||
* into a PostgREST .or() filter string, so validation doubles as injection
|
||||
* protection).
|
||||
*
|
||||
* Counts BOTH direct attachments (document_attachments.journal_entry_id) and
|
||||
* documents retained on a supplier invoice that references the entry
|
||||
* (registration/payment FK or a supplier_invoice_payments row). BFL 5 kap 7 §
|
||||
* accepts underlag via hänvisning, and the expanded-row view
|
||||
* (JournalEntryAttachments) already lists referenced docs: counting only
|
||||
* direct links here made the list warning disagree with the opened row.
|
||||
* A referenced doc counts only when ANCHORED to a journal entry
|
||||
* (journal_entry_id set): unanchored docs sit outside the WORM deletion
|
||||
* guards, so they must not silence the missing-underlag warning (mirrors the
|
||||
* verifikat_without_documents RPC). Documents are deduplicated per entry so a
|
||||
* doc that is both directly linked and referenced counts once.
|
||||
*/
|
||||
export const GET = withRouteContext('document.counts', async (request, ctx) => {
|
||||
const { supabase, companyId } = ctx
|
||||
@@ -27,23 +44,93 @@ export const GET = withRouteContext('document.counts', async (request, ctx) => {
|
||||
return NextResponse.json({ error: 'Maximum 50 IDs per request' }, { status: 400 })
|
||||
}
|
||||
|
||||
const { data, error } = await supabase
|
||||
.from('document_attachments')
|
||||
.select('journal_entry_id')
|
||||
.eq('company_id', companyId)
|
||||
.eq('is_current_version', true)
|
||||
.in('journal_entry_id', ids)
|
||||
|
||||
if (error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
|
||||
if (ids.some((id) => !uuidSchema.safeParse(id).success)) {
|
||||
return NextResponse.json(
|
||||
{ error: 'journal_entry_ids must be UUIDs' },
|
||||
{ status: 400 },
|
||||
)
|
||||
}
|
||||
|
||||
// Group and count by journal_entry_id
|
||||
const counts: Record<string, number> = {}
|
||||
for (const row of data || []) {
|
||||
if (row.journal_entry_id) {
|
||||
counts[row.journal_entry_id] = (counts[row.journal_entry_id] || 0) + 1
|
||||
const inList = `(${ids.join(',')})`
|
||||
const [directRes, siRes, sipRes] = await Promise.all([
|
||||
supabase
|
||||
.from('document_attachments')
|
||||
.select('id, journal_entry_id')
|
||||
.eq('company_id', companyId)
|
||||
.eq('is_current_version', true)
|
||||
.in('journal_entry_id', ids),
|
||||
supabase
|
||||
.from('supplier_invoices')
|
||||
.select(
|
||||
'document_id, registration_journal_entry_id, payment_journal_entry_id, document:document_attachments(journal_entry_id)',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.not('document_id', 'is', null)
|
||||
.or(
|
||||
`registration_journal_entry_id.in.${inList},payment_journal_entry_id.in.${inList}`,
|
||||
),
|
||||
supabase
|
||||
.from('supplier_invoice_payments')
|
||||
.select(
|
||||
'journal_entry_id, supplier_invoice:supplier_invoices(document_id, document:document_attachments(journal_entry_id))',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.in('journal_entry_id', ids),
|
||||
])
|
||||
|
||||
if (directRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(directRes.error) }, { status: 500 })
|
||||
}
|
||||
if (siRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(siRes.error) }, { status: 500 })
|
||||
}
|
||||
if (sipRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(sipRes.error) }, { status: 500 })
|
||||
}
|
||||
|
||||
// Distinct doc ids per entry: a supplier invoice's document referenced from
|
||||
// both FK paths, or already directly linked, must not double count.
|
||||
const docsByEntry = new Map<string, Set<string>>()
|
||||
const add = (journalEntryId: string | null | undefined, documentId: string | null | undefined) => {
|
||||
if (!journalEntryId || !documentId) return
|
||||
let set = docsByEntry.get(journalEntryId)
|
||||
if (!set) {
|
||||
set = new Set<string>()
|
||||
docsByEntry.set(journalEntryId, set)
|
||||
}
|
||||
set.add(documentId)
|
||||
}
|
||||
|
||||
for (const row of (directRes.data ?? []) as { id: string; journal_entry_id: string | null }[]) {
|
||||
add(row.journal_entry_id, row.id)
|
||||
}
|
||||
for (const row of (siRes.data ?? []) as unknown as {
|
||||
document_id: string | null
|
||||
registration_journal_entry_id: string | null
|
||||
payment_journal_entry_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
}[]) {
|
||||
if (!row.document?.journal_entry_id) continue // unanchored: not underlag
|
||||
add(row.registration_journal_entry_id, row.document_id)
|
||||
add(row.payment_journal_entry_id, row.document_id)
|
||||
}
|
||||
for (const row of (sipRes.data ?? []) as unknown as {
|
||||
journal_entry_id: string | null
|
||||
supplier_invoice: {
|
||||
document_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
} | null
|
||||
}[]) {
|
||||
if (!row.supplier_invoice?.document?.journal_entry_id) continue // unanchored
|
||||
add(row.journal_entry_id, row.supplier_invoice.document_id)
|
||||
}
|
||||
|
||||
// Referenced entries outside the requested set (an SI FK can point at an
|
||||
// entry the caller didn't ask about) must not leak into the response.
|
||||
const requested = new Set(ids)
|
||||
const counts: Record<string, number> = {}
|
||||
for (const [journalEntryId, docIds] of docsByEntry) {
|
||||
if (requested.has(journalEntryId)) counts[journalEntryId] = docIds.size
|
||||
}
|
||||
|
||||
return NextResponse.json({ data: counts })
|
||||
|
||||
@@ -29,7 +29,9 @@ export async function GET(request: Request) {
|
||||
const errorDescription = searchParams.get('error_description')
|
||||
|
||||
const baseUrl = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'
|
||||
const settingsUrl = `${baseUrl}/settings/payments`
|
||||
// The Stripe surface lives on the import page (?mode=stripe opens the panel
|
||||
// directly); appended params below must use '&' since the base has a query.
|
||||
const returnUrl = `${baseUrl}/import?mode=stripe`
|
||||
|
||||
if (error) {
|
||||
const errorMessage = errorDescription || error
|
||||
@@ -55,12 +57,12 @@ export async function GET(request: Request) {
|
||||
}
|
||||
|
||||
return NextResponse.redirect(
|
||||
`${settingsUrl}?stripe_error=${encodeURIComponent(errorMessage)}`,
|
||||
`${returnUrl}&stripe_error=${encodeURIComponent(errorMessage)}`,
|
||||
)
|
||||
}
|
||||
|
||||
if (!code || !state) {
|
||||
return NextResponse.redirect(`${settingsUrl}?stripe_error=missing_parameters`)
|
||||
return NextResponse.redirect(`${returnUrl}&stripe_error=missing_parameters`)
|
||||
}
|
||||
|
||||
const supabase = await createServiceClient()
|
||||
@@ -84,7 +86,7 @@ export async function GET(request: Request) {
|
||||
hasCode: !!code,
|
||||
})
|
||||
return NextResponse.redirect(
|
||||
`${settingsUrl}?stripe_error=${encodeURIComponent('invalid_state')}`,
|
||||
`${returnUrl}&stripe_error=${encodeURIComponent('invalid_state')}`,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -99,7 +101,7 @@ export async function GET(request: Request) {
|
||||
code: replayError.code,
|
||||
})
|
||||
return NextResponse.redirect(
|
||||
`${settingsUrl}?stripe_error=${encodeURIComponent('invalid_state')}`,
|
||||
`${returnUrl}&stripe_error=${encodeURIComponent('invalid_state')}`,
|
||||
)
|
||||
}
|
||||
|
||||
@@ -143,7 +145,7 @@ export async function GET(request: Request) {
|
||||
})
|
||||
.eq('id', pendingConnection.id)
|
||||
return NextResponse.redirect(
|
||||
`${settingsUrl}?stripe_error=${encodeURIComponent(
|
||||
`${returnUrl}&stripe_error=${encodeURIComponent(
|
||||
isConflict ? 'account_already_connected' : 'activation_failed',
|
||||
)}`,
|
||||
)
|
||||
@@ -168,7 +170,7 @@ export async function GET(request: Request) {
|
||||
})
|
||||
}
|
||||
|
||||
return NextResponse.redirect(`${settingsUrl}?stripe_connected=true`)
|
||||
return NextResponse.redirect(`${returnUrl}&stripe_connected=true`)
|
||||
} catch (error) {
|
||||
console.error('[stripe] Callback error', {
|
||||
message: error instanceof Error ? error.message : String(error),
|
||||
@@ -191,7 +193,7 @@ export async function GET(request: Request) {
|
||||
}
|
||||
|
||||
return NextResponse.redirect(
|
||||
`${settingsUrl}?stripe_error=${encodeURIComponent('connection_failed')}`,
|
||||
`${returnUrl}&stripe_error=${encodeURIComponent('connection_failed')}`,
|
||||
)
|
||||
}
|
||||
}
|
||||
|
||||
@@ -90,6 +90,7 @@ function enqueueHappyPath(opts: {
|
||||
currency: string
|
||||
amount_sek?: number | null
|
||||
cash_account_id?: string | null
|
||||
document_id?: string | null
|
||||
}
|
||||
invoice: {
|
||||
currency: string
|
||||
@@ -113,6 +114,7 @@ function enqueueHappyPath(opts: {
|
||||
amount_sek: opts.transaction.amount_sek ?? null,
|
||||
supplier_invoice_id: null,
|
||||
cash_account_id: opts.transaction.cash_account_id ?? null,
|
||||
document_id: opts.transaction.document_id ?? null,
|
||||
date: '2026-05-12',
|
||||
},
|
||||
error: null,
|
||||
@@ -630,6 +632,53 @@ describe('POST /api/transactions/[id]/match-supplier-invoice: cash method + FX',
|
||||
})
|
||||
})
|
||||
|
||||
describe('POST /api/transactions/[id]/match-supplier-invoice: transaction document propagation', () => {
|
||||
const DOC_UUID = '33333333-3333-4333-8333-333333333333'
|
||||
|
||||
it('links a pinned transaction document to the payment JE after the match', async () => {
|
||||
enqueueHappyPath({
|
||||
transaction: { amount: -1000, currency: 'SEK', document_id: DOC_UUID },
|
||||
invoice: { currency: 'SEK', remaining_amount: 1000 },
|
||||
})
|
||||
// 8. document_attachments update (the propagation)
|
||||
enqueue({ data: null, error: null })
|
||||
|
||||
const res = await POST(makeReq(), createMockRouteParams({ id: TX_UUID }))
|
||||
expect(res.status).toBe(200)
|
||||
const tables = mockSupabase.from.mock.calls.map((c) => c[0])
|
||||
expect(tables).toContain('document_attachments')
|
||||
})
|
||||
|
||||
it('does not touch document_attachments when the transaction has no pinned doc', async () => {
|
||||
enqueueHappyPath({
|
||||
transaction: { amount: -1000, currency: 'SEK' },
|
||||
invoice: { currency: 'SEK', remaining_amount: 1000 },
|
||||
})
|
||||
const res = await POST(makeReq(), createMockRouteParams({ id: TX_UUID }))
|
||||
expect(res.status).toBe(200)
|
||||
const tables = mockSupabase.from.mock.calls.map((c) => c[0])
|
||||
expect(tables).not.toContain('document_attachments')
|
||||
})
|
||||
|
||||
it('propagation failure is non-fatal: the committed match still returns 200', async () => {
|
||||
enqueueHappyPath({
|
||||
transaction: { amount: -1000, currency: 'SEK', document_id: DOC_UUID },
|
||||
invoice: { currency: 'SEK', remaining_amount: 1000 },
|
||||
})
|
||||
// Propagation update errors (e.g. period locked between commit and link).
|
||||
enqueue({ data: null, error: { message: 'BFL period lock' } })
|
||||
|
||||
const res = await POST(makeReq(), createMockRouteParams({ id: TX_UUID }))
|
||||
const { status, body } = await parseJsonResponse<{ success: boolean }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(body.success).toBe(true)
|
||||
expect(mockLoggerWarn).toHaveBeenCalledWith(
|
||||
expect.stringContaining('failed to link transaction document'),
|
||||
expect.anything(),
|
||||
)
|
||||
})
|
||||
})
|
||||
|
||||
describe('POST /api/transactions/[id]/match-supplier-invoice: payment JE failure aborts', () => {
|
||||
// Regression: the route used to catch a JE-creation failure and proceed: // marking the invoice paid with NO payment voucher. That half-state is
|
||||
// unrecoverable (mark-paid rejects 'paid', match rejects linked txs), so a
|
||||
|
||||
@@ -399,6 +399,32 @@ export const POST = withRouteContext(
|
||||
return errorResponseFromCode('MATCH_SI_LINK_TX_FAILED', txLog, { requestId })
|
||||
}
|
||||
|
||||
// Propagate a document pinned to the transaction (via /attach-document or
|
||||
// MCP) onto the payment verifikat, mirroring the categorize route (BFL
|
||||
// 5 kap 6 §: the verifikation must reference its underlag). Guarded to
|
||||
// unlinked current-version docs only: a doc already serving another
|
||||
// verifikat (e.g. the supplier invoice's own document on the registration
|
||||
// entry) must not move. Non-fatal: the match is already committed.
|
||||
if (transaction.document_id) {
|
||||
const { error: docLinkError } = await supabase
|
||||
.from('document_attachments')
|
||||
.update({ journal_entry_id: journalEntryId })
|
||||
.eq('id', transaction.document_id)
|
||||
.eq('company_id', companyId)
|
||||
.is('journal_entry_id', null)
|
||||
.eq('is_current_version', true)
|
||||
if (docLinkError) {
|
||||
// Structured fields so the half-linked state (doc retained but not
|
||||
// anchored to the payment JE) can be reconstructed without an audit
|
||||
// trail dig.
|
||||
txLog.warn('failed to link transaction document to payment JE (non-critical)', {
|
||||
error: docLinkError,
|
||||
documentId: transaction.document_id,
|
||||
journalEntryId,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
logMatchEvent(supabase, user.id, transactionId, 'matched', {
|
||||
supplierInvoiceId: supplier_invoice_id,
|
||||
matchConfidence: 1.0,
|
||||
|
||||
@@ -452,6 +452,31 @@ export const POST = withApiV1<{ params: Promise<{ companyId: string; id: string
|
||||
})
|
||||
}
|
||||
|
||||
// Propagate a document pinned to the transaction onto the payment
|
||||
// verifikat, mirroring the dashboard route (BFL 5 kap 6 §). Guarded to
|
||||
// unlinked current-version docs only: a doc already serving another
|
||||
// verifikat (e.g. the supplier invoice's own document on the registration
|
||||
// entry) must not move. Non-fatal: the match is already committed.
|
||||
if (transaction.document_id) {
|
||||
const { error: docLinkErr } = await ctx.supabase
|
||||
.from('document_attachments')
|
||||
.update({ journal_entry_id: journalEntryId })
|
||||
.eq('id', transaction.document_id)
|
||||
.eq('company_id', ctx.companyId!)
|
||||
.is('journal_entry_id', null)
|
||||
.eq('is_current_version', true)
|
||||
if (docLinkErr) {
|
||||
// Structured fields so the half-linked state (doc retained but not
|
||||
// anchored to the payment JE) can be reconstructed without an audit
|
||||
// trail dig.
|
||||
txLog.warn('failed to link transaction document to payment JE (non-critical)', {
|
||||
error: docLinkErr,
|
||||
documentId: transaction.document_id,
|
||||
journalEntryId,
|
||||
})
|
||||
}
|
||||
}
|
||||
|
||||
logMatchEvent(ctx.supabase, ctx.userId, txId, 'matched', {
|
||||
supplierInvoiceId: supplier_invoice_id,
|
||||
matchConfidence: 1.0,
|
||||
|
||||
Reference in New Issue
Block a user