fix(skatteverket): request the AGI kvittens scope and stop misdiagnosing the 403 (#1596)

* fix(skatteverket): request the AGI kvittens scope, not just the inlamning one

AGI is backed by two SKV APIs and each needs its own scope, but DEFAULT_SCOPES
only carried `agd`. That covers arbetsgivardeklaration/inlamning (POST underlag,
kontrollresultat, spara, skapaGranskningsunderlag), so a filing submits and
signs perfectly. The kvittens read lives on hanteraredovisningsperiod, which
requires `agdredovisningperiod`, so the flow died on its very last step with
403 {"error": "The required scopes are not authorized"}.

Confirmed against production: the same APIGW client id and secret reach the
bearer check on both APIs (401 "Token has been revoked" from each with a bogus
token), proving both subscriptions exist and the gateway contract was never the
problem, and SKV's application registration lists `agd`, `agdredovisningperiod`
and `momsdeklaration` as three separate scopes.

The body is identical to the APIGW subscription gap of #973, which is why
api-client's classification cannot distinguish the two from the string alone;
that split still needs the gateway-side check, so it is left as is.

Note the spelling `agdredovisningperiod`: no genitive s, exactly as SKV
registers it. Pinned with a scope-set regression test, since this is the third
time a scope has gone missing (#431 removed `ska` the same way) and the damage
is always invisible until a real filing fails.

The AGIPanel missing-scope banner now checks both scopes. It only looked for
`agd`, so the token shape that actually hurts, one that gets all the way
through signing before failing, produced no warning at all.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(skatteverket): stop blaming the APIGW subscription for a missing token scope

`{"error": "The required scopes are not authorized"}` has two causes and the
gateway never says which: our APIGW client has no subscription for the API
(#973), or the token lacks the scope that API requires. The message named only
the first, so a real production filing spent its debugging time in
Utvecklarportalen while the actual fix was a scope the code never requested.

The message now names both knobs, and says WHICH service refused. That last
part is what was really missing: the sibling inlamning API kept working
throughout, so "Skatteverket denied the call" pointed at nothing. Ruling the
two apart still needs the out-of-band test (call the API with a deliberately
invalid bearer and the same Client_Id: a subscription gap fails at the gateway
with this body, a scope gap reaches the bearer check and answers 401), which is
now documented at the predicate instead of living in someone's memory.

Classification is deliberately unchanged. ACCESS_DENIED stays out of
RECONSENT_ERROR_CODES: the scope case does need a reconnect, but only after the
scope exists, so an automatic reconsent would rebuild the self-perpetuating
banner of #1155.

This reverses one specific decision from #1250, which removed the
SKATTEVERKET_SYSTEM_SCOPES mention on the reasoning that the gateway rather
than the scope list had refused. That reasoning assumed the body could tell
them apart. It cannot. The test asserting the omission is inverted, with the
reason recorded.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

* fix(salary): make the AGI kvittens-scope notice dismissible

The two AGI scopes get different treatments in AGIPanel: a token
without agd keeps the hard reconnect nudge, but a token missing only
agdredovisningperiod gets its own softer, dismissible notice. Every
existing hosted token lacks the new scope, and until Skatteverket's
application registration carries it a reconnect mints the same grant
again (SKV silently drops unregistered scope names), so a hard
reconnect demand would be the #1010 un-clearable banner, with each
futile attempt costing a BankID round-trip. Dismissal persists per
granted scope string: a futile reconnect stays quiet, a widened grant
re-evaluates from scratch.

Also asserts the shared prenumeration/scope message and the refused
API path on the 401 contract test, matching the 403 test (review nit).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Emil <emilmattsson14@gmail.com>

* fix(salary): point the kvittens-scope notice at Skatteverket's own e-service

The compliance review flagged that dismissing the notice could leave a
filer without a software-side path to the receipt. Retrieval never
depended on the notice (the kvittens cron retries server-side and the
period's status row stays unconfirmed until a kvittens lands), but the
copy now also names the fallback that always works: verifying the
receipt in Skatteverket's Arbetsgivardeklaration e-service.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Signed-off-by: Emil <emilmattsson14@gmail.com>

* fix(salary): use the ladder radius on the kvittens notice

The radius ladder guard landed on main after this notice was written;
rounded-md is dead vocabulary, bordered boxes are rounded-lg.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* fix(salary): scope the kvittens-notice dismissal to the employer

The localStorage key carried only the granted scope string, so on a
shared browser one company's dismissal hid the notice for every other
company with an identical grant. Skatteverket tokens are per company,
so the key now includes arbetsgivare alongside the scope string; the
same-grant reconnect behavior per company is unchanged.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Signed-off-by: Emil <emilmattsson14@gmail.com>
Co-authored-by: Claude Opus 5 <noreply@anthropic.com>
Co-authored-by: Emil <emilmattsson14@gmail.com>

components/salary/AGIPanel.tsx

@@ -165,6 +165,36 @@ export function AGIPanel(props: AGIPanelProps) {
   // /authorize call overwrites the stored oauth_state + PKCE verifier, so a
   // parallel flow guarantees a CSRF failure for whichever tab finishes last.
   const [connecting, setConnecting] = useState(false)
+  // Dismissal for the kvittens-scope notice, keyed by employer plus the exact
+  // granted scope string. The employer keeps dismissals from leaking across
+  // companies on a shared browser (tokens are per company, so each company's
+  // grant is its own question); the scope string means a reconnect that comes
+  // back with the same grant (the scope not yet registered on Skatteverket's
+  // application) keeps the dismissal, so the notice cannot become an
+  // un-clearable reconnect loop (#1010), while a new grant re-evaluates from
+  // scratch.
+  const [kvittensNoticeDismissed, setKvittensNoticeDismissed] = useState(false)
+  const grantedScopeString = typeof status?.scope === 'string' ? status.scope : null
+  const kvittensNoticeKey = grantedScopeString
+    ? `agi-kvittens-scope-notice:${arbetsgivare}:${grantedScopeString}`
+    : null
+  useEffect(() => {
+    if (!kvittensNoticeKey) return
+    try {
+      setKvittensNoticeDismissed(localStorage.getItem(kvittensNoticeKey) === 'dismissed')
+    } catch {
+      setKvittensNoticeDismissed(false)
+    }
+  }, [kvittensNoticeKey])
+  const dismissKvittensNotice = useCallback(() => {
+    setKvittensNoticeDismissed(true)
+    if (!kvittensNoticeKey) return
+    try {
+      localStorage.setItem(kvittensNoticeKey, 'dismissed')
+    } catch {
+      // Best effort: the state update alone hides it for this mount.
+    }
+  }, [kvittensNoticeKey])
 
   // "2026-06" for user-facing copy; the period prop is compact YYYYMM.
   const prettyPeriod = `${period.slice(0, 4)}-${period.slice(4)}`
@@ -884,12 +914,21 @@ export function AGIPanel(props: AGIPanelProps) {
     )
   }
 
-  // Tokens issued before the agd scope was added to DEFAULT_SCOPES will
-  // 403 with invalid_scope at submission time: surface that proactively
-  // so the user reconnects before hitting the deadline rather than at it.
-  const missingAgdScope =
-    typeof status?.scope === 'string' &&
-    !status.scope.split(/\s+/).filter(Boolean).includes('agd')
+  // Tokens issued before an AGI scope was added to DEFAULT_SCOPES will 403 at
+  // submission time: surface that proactively so the user reconnects before
+  // hitting the deadline rather than at it. The two scopes back different
+  // steps and get different treatments: `agd` (inlämning) fails already at
+  // submit, is proven grantable, and keeps the hard reconnect nudge. A token
+  // missing only `agdredovisningperiod` (hantera) sails through submit and
+  // signing and dies on "Hämta kvittens", but until Skatteverket's application
+  // registration carries that scope a reconnect mints the same grant again
+  // (SKV silently drops unregistered scope names), so its notice must be
+  // dismissible rather than a demand no reconnect can clear (#1010).
+  const grantedScopes =
+    typeof status?.scope === 'string' ? status.scope.split(/\s+/).filter(Boolean) : null
+  const missingAgdScope = grantedScopes !== null && !grantedScopes.includes('agd')
+  const missingKvittensScope =
+    grantedScopes !== null && !missingAgdScope && !grantedScopes.includes('agdredovisningperiod')
 
   // Recovery states expose the advanced actions on their own: the stale-draft
   // and error-report guidance below reference them by name.
@@ -991,10 +1030,12 @@ export function AGIPanel(props: AGIPanelProps) {
           </div>
         )}
 
-        {/* Missing-scope banner: proactive nudge before the user hits a
-            403 invalid_scope at submission time. The agd scope was added
-            after some users had already connected, so their stored token
-            grants moms/skattekonto but not AGI. */}
+        {/* Missing-scope nudges: proactive, before the user hits a 403
+            invalid_scope. The agd scope was added after some users had
+            already connected, so their stored token grants moms/skattekonto
+            but not AGI: that one stays a hard nudge. The kvittens scope only
+            breaks the final receipt fetch and may not be grantable yet, so
+            its notice is softer and dismissible. */}
         {missingAgdScope && !readOnly && (
           <div className="rounded-lg border border-border bg-muted/30 p-3">
             <p className="text-sm font-medium">
@@ -1011,6 +1052,31 @@ export function AGIPanel(props: AGIPanelProps) {
             </a>
           </div>
         )}
+        {missingKvittensScope && !kvittensNoticeDismissed && !readOnly && (
+          <div className="rounded-lg border border-border bg-muted/30 p-3">
+            <p className="text-sm font-medium">
+              {t('kvittens_scope_title')}
+            </p>
+            <p className="mt-1 text-xs text-muted-foreground">
+              {t('kvittens_scope_description')}
+            </p>
+            <div className="mt-2 flex items-center gap-4">
+              <a
+                href="/settings/tax"
+                className="inline-flex items-center gap-1 text-sm font-medium hover:underline"
+              >
+                {t('open_settings')} <ExternalLink className="h-3.5 w-3.5" />
+              </a>
+              <button
+                type="button"
+                onClick={dismissKvittensNotice}
+                className="text-sm text-muted-foreground hover:underline"
+              >
+                {t('kvittens_scope_dismiss')}
+              </button>
+            </div>
+          </div>
+        )}
 
         {/* Status summary */}
         <div className="space-y-1.5 text-sm">