Add/transaction deletion (#695)

* feat(salary): add remove-employee button to draft salary runs The DELETE /api/salary/runs/{id}/employees/{employeeId} endpoint already existed (draft-only, cascades to the employee's line items) but had no UI trigger, so a mistakenly added employee could only be cleared by deleting the whole draft. Add a trash-icon action column to the "Anställda" table, gated on draft status + write permission to match the endpoint's guard, with a confirm prompt and success/error toast. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(settings): prevent horizontal overflow on mobile The company settings invite form was a non-wrapping fixed-width flex row that overflowed narrow viewports, forcing the full-screen settings modal to scroll on the x-axis. Stack the form vertically on mobile (sm:flex-row at and above the sm breakpoint) and add the missing min-w-0 guard to the modal content pane. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(bookkeeping): move journal entry filters into a filter dialog The ledger toolbar showed every filter inline (fiscal year, sort, series, date range, missing-documents toggle), which felt cluttered. Keep only the search field visible and move the rest into a "Filtrera" dialog with an active-filter count badge. - JournalEntryList now owns the fiscal-year scope, restored from the same localStorage key FiscalYearSelector writes, so the page no longer renders the selector separately. - Filters apply live and the dialog stays open; "Rensa alla filter" clears them. - Export STORAGE_KEY_PREFIX / ALL_YEARS_VALUE from FiscalYearSelector so the list reuses the persisted selection without duplicating the key. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement imported transaction guard for deletion - Added a guard to prevent deletion of transactions that are imported via bank sync or file uploads. - Introduced `isImportedTransaction` utility to determine if a transaction is user-created or imported. - Updated DELETE endpoint to return a 409 status for attempts to delete imported transactions. - Enhanced transaction history and inbox components to reflect the new deletion rules. - Added tests for transaction origin determination and deletion behavior. - Updated UI components to include a confirmation dialog for clearing journal entry forms. - Localized new strings for clearing form functionality in English and Swedish. * feat(transactions): enhance transaction deletion guard and improve fiscal year visibility --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-08 15:25:27 +02:00
parent 679b154ad2
commit 64991eb3c9
21 changed files with 1223 additions and 348 deletions
@@ -0,0 +1,53 @@
+import { describe, it, expect } from 'vitest'
+import { escapeLikePattern, normalizeOcrReference } from '../duplicate-payment-guard'
+
+describe('escapeLikePattern', () => {
+  // These cases lock in that a user-supplied needle reaches an ILIKE pattern with
+  // its LIKE metacharacters neutralised — each of `%`, `_`, `\` must match only
+  // itself and never expand as a wildcard (compliance A.8.28 / ASVS V1.2.5).
+  it('escapes a literal percent so it matches only itself', () => {
+    expect(escapeLikePattern('50% rabatt')).toBe('50\\% rabatt')
+  })
+
+  it('escapes a literal underscore so it is not a single-char wildcard', () => {
+    expect(escapeLikePattern('konto_1930')).toBe('konto\\_1930')
+  })
+
+  it('escapes a literal backslash so it does not consume the next char', () => {
+    expect(escapeLikePattern('a\\b')).toBe('a\\\\b')
+  })
+
+  it('escapes backslash, percent and underscore together without double-escaping', () => {
+    // Backslash is escaped FIRST, so the escapes added for % and _ are not
+    // themselves re-escaped. Each special char maps to exactly "\\" + itself.
+    expect(escapeLikePattern('a\\b%c_d')).toBe('a\\\\b\\%c\\_d')
+  })
+
+  it('leaves ordinary text untouched', () => {
+    expect(escapeLikePattern('Faktura 2026-0042')).toBe('Faktura 2026-0042')
+  })
+
+  it('caps the needle at 200 characters to bound DB work on oversized input', () => {
+    const escaped = escapeLikePattern('a'.repeat(250))
+    expect(escaped).toBe('a'.repeat(200))
+    expect(escaped.length).toBe(200)
+  })
+
+  it('truncates BEFORE escaping, so the source length is the bound', () => {
+    // 250 percent signs → truncated to 200 source chars, each escaped to "\%".
+    expect(escapeLikePattern('%'.repeat(250))).toBe('\\%'.repeat(200))
+  })
+})
+
+describe('normalizeOcrReference', () => {
+  it('keeps only digits regardless of separators', () => {
+    expect(normalizeOcrReference('2026-0042')).toBe('20260042')
+    expect(normalizeOcrReference('2026 / 0042')).toBe('20260042')
+  })
+
+  it('returns an empty string for nullish or empty input', () => {
+    expect(normalizeOcrReference(null)).toBe('')
+    expect(normalizeOcrReference(undefined)).toBe('')
+    expect(normalizeOcrReference('')).toBe('')
+  })
+})
@@ -0,0 +1,52 @@
+import { describe, it, expect } from 'vitest'
+import { isImportedTransaction } from '@/lib/transactions/origin'
+
+describe('isImportedTransaction', () => {
+  describe('imported (ignore-only, never deletable)', () => {
+    it('treats a row with a live bank connection as imported', () => {
+      expect(isImportedTransaction({ bank_connection_id: 'bc-1', import_source: null })).toBe(true)
+    })
+
+    it('treats a row with a bank connection as imported even if import_source looks in-app', () => {
+      // The bank link wins — a PSD2 row is imported regardless of the source tag.
+      expect(isImportedTransaction({ bank_connection_id: 'bc-1', import_source: 'manual' })).toBe(true)
+    })
+
+    it('treats Enable Banking sync rows as imported', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: 'enable_banking' })).toBe(true)
+    })
+
+    it('treats CAMT053 bank-file imports as imported', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: 'camt053' })).toBe(true)
+    })
+
+    it.each(['csv_nordea', 'csv_lunar', 'csv_seb'])(
+      'treats CSV bank-file import %s as imported',
+      (source) => {
+        expect(isImportedTransaction({ bank_connection_id: null, import_source: source })).toBe(true)
+      },
+    )
+
+    it('treats an unknown future import source as imported (safe default)', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: 'some_new_feed' })).toBe(true)
+    })
+  })
+
+  describe('user-created (deletable when unbooked)', () => {
+    it('treats a null source with no bank link as user-created (manual add)', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: null })).toBe(false)
+    })
+
+    it('treats create-from-document (manual) as user-created', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: 'manual' })).toBe(false)
+    })
+
+    it('treats MCP/agent-created rows as user-created', () => {
+      expect(isImportedTransaction({ bank_connection_id: null, import_source: 'mcp' })).toBe(false)
+    })
+
+    it('tolerates omitted (undefined) origin fields', () => {
+      expect(isImportedTransaction({})).toBe(false)
+    })
+  })
+})
@@ -0,0 +1,61 @@
+/**
+ * Transaction origin helpers — distinguish rows the user created INSIDE the app
+ * from rows that were fetched/imported from an external feed (bank sync or a
+ * bank-file upload).
+ *
+ * Why this matters
+ * ----------------
+ * An imported row is an external system's record of money that actually moved.
+ * The user may *ignore* it (`is_ignored`) to take it off the to-book /
+ * reconciliation lists, but must never be able to *delete* it: deleting would
+ * silently drop a real bank line, and the next sync (or a re-import of the same
+ * file) would either bring it back as a "new" row or, worse, leave the books
+ * out of step with the bank. Only hand-entered rows are the user's to remove.
+ *
+ * The two import paths that populate `transactions` from outside the app:
+ *   - Enable Banking (PSD2) live sync → sets `bank_connection_id`
+ *     (and `import_source = 'enable_banking'`). See
+ *     `extensions/general/enable-banking/lib/sync.ts`.
+ *   - Bank-file import (CSV / CAMT053) → sets `import_source` to `'camt053'` or
+ *     `'csv_<format>'` (no live connection). See
+ *     `app/api/import/bank-file/execute/route.ts`.
+ *
+ * Everything else is user-created and therefore deletable (subject to the
+ * separate "booked rows are immutable" rule):
+ *   - manual add via POST /api/transactions      → `import_source = null`
+ *   - create-from-document                        → `import_source = 'manual'`
+ *   - MCP / agent create                          → `import_source = 'mcp'`
+ *
+ * Safe-by-default: this is an ALLOWLIST of known user-created sources. Any other
+ * `import_source` tag — including an import feed added in the future — is
+ * treated as imported (ignore-only), so a new feed can never accidentally
+ * become user-deletable before someone consciously adds it here.
+ */
+
+/** Minimal shape — the two columns that record where a transaction came from. */
+export type TransactionOrigin = {
+  bank_connection_id?: string | null
+  import_source?: string | null
+}
+
+/**
+ * `import_source` values produced by in-app creation flows. A `null` source
+ * (with no bank connection) is also user-created — that's the plain manual-add
+ * path. Anything NOT in this set is considered an external import feed.
+ */
+const USER_CREATED_IMPORT_SOURCES: ReadonlySet<string> = new Set(['manual', 'mcp'])
+
+/**
+ * True when the transaction was fetched via bank sync or uploaded via a
+ * bank-file import — i.e. NOT created by the user inside the app. Such rows are
+ * ignore-only and can never be deleted (booked or not).
+ */
+export function isImportedTransaction(tx: TransactionOrigin): boolean {
+  // A live bank connection is the unambiguous PSD2 marker (Enable Banking).
+  if (tx.bank_connection_id) return true
+  const src = tx.import_source
+  // No source and no bank link → a hand-entered row.
+  if (src == null) return false
+  // Known in-app sources are user-created; everything else is an import feed.
+  return !USER_CREATED_IMPORT_SOURCES.has(src)
+}