fix(settings): validate share-capital pair before saving (#1137) (#1160)

* fix(settings): validate share-capital pair before saving (#1137)

Entering aktiekapital without antal aktier (or vice versa) died on the DB
pair constraint company_settings_share_capital_pair as a raw 500 with the
generic 'Vardet uppfyller inte de tillatna kraven' toast. The pair rule
(ARL 5 kap 14 $: the aktiekapital note needs both values) now surfaces as
a clear 400 in the PUT route, checked against effective body-or-stored
values so partial API updates are covered too. The form additionally marks
each field required when its sibling is filled, so the browser blocks a
one-sided submit before the request is sent.

Fixes #1137

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs: decision-log entry for share-capital pair validation placement

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* docs(settings): correct the share-capital note citation to ÅRL 5 kap 34 §

5 kap 14 § is ställda säkerheter; the antal aktier/kvotvärde note is 5 kap 34 §
(flagged by the Swedish compliance review bot, verified against the
swedish-financial-reporting skill).

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

* test(settings): assert the pair message on the one-sided-clear rejection

CodeRabbit review on #1160. Its second suggestion (assert the update
payload on the partial-update test) is skipped: createQueuedMockSupabase
proxies away builder args, so payloads are not recordable, same as every
other test in this suite.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Fable 5 <noreply@anthropic.com>

app/api/settings/__tests__/route.test.ts

@@ -145,6 +145,71 @@ describe('PUT /api/settings', () => {
     }
   })
 
+  it('rejects aktiekapital without antal aktier with a clear message (issue #1137)', async () => {
+    enqueue({
+      data: {
+        entity_type: 'aktiebolag',
+        onboarding_complete: true,
+        aktiekapital: null,
+        antal_aktier: null,
+      },
+    })
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { aktiekapital: 25000, antal_aktier: null },
+    }), { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(response)
+
+    expect(status).toBe(400)
+    expect(body.error).toContain('antal aktier')
+    // The guard fired before the update: only the oldSettings fetch ran.
+    expect(supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('rejects clearing only one half of a stored share-capital pair', async () => {
+    enqueue({
+      data: {
+        entity_type: 'aktiebolag',
+        onboarding_complete: true,
+        aktiekapital: 25000,
+        antal_aktier: 500,
+      },
+    })
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { antal_aktier: null },
+    }), { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ error: string }>(response)
+
+    expect(status).toBe(400)
+    expect(body.error).toContain('antal aktier')
+    expect(supabase.from).toHaveBeenCalledTimes(1)
+  })
+
+  it('allows updating one half when the other half is already stored', async () => {
+    enqueueMany([
+      {
+        data: {
+          entity_type: 'aktiebolag',
+          onboarding_complete: true,
+          aktiekapital: 25000,
+          antal_aktier: 500,
+        },
+      },
+      { data: { id: 's1', aktiekapital: 50000, antal_aktier: 500 } },
+      { data: null, count: 5 },
+    ])
+
+    const response = await PUT(createMockRequest('/api/settings', {
+      method: 'PUT',
+      body: { aktiekapital: 50000 },
+    }), { params: Promise.resolve({}) })
+
+    expect((await parseJsonResponse(response)).status).toBe(200)
+  })
+
   it('updates invoice email recipients and payment accounts', async () => {
     const updates = {
       invoice_email_cc_addresses: ['info@example.com', 'owner@example.com'],

app/api/settings/route.ts

@@ -48,7 +48,7 @@ export const PUT = withRouteContext(
     // Fetch current settings to check for tax-relevant changes
     const { data: oldSettings } = await supabase
       .from('company_settings')
-      .select(`${DEADLINE_SETTINGS_SELECT}, vat_number, onboarding_complete, salary_vacation_year_basis, reminder_days_level_1, reminder_days_level_2, reminder_days_level_3`)
+      .select(`${DEADLINE_SETTINGS_SELECT}, vat_number, onboarding_complete, salary_vacation_year_basis, reminder_days_level_1, reminder_days_level_2, reminder_days_level_3, aktiekapital, antal_aktier`)
       .eq('company_id', companyId)
       .single()
 
@@ -118,6 +118,22 @@ export const PUT = withRouteContext(
       )
     }
 
+    // Share capital is all-or-nothing: the antal aktier/kvotvärde note (ÅRL 5 kap 34 §)
+    // needs both the registered amount and the share count, and the DB pair
+    // constraint enforces it. Validate against the effective (body-or-stored)
+    // values so the user gets a clear message instead of a raw constraint 500.
+    if (body.aktiekapital !== undefined || body.antal_aktier !== undefined) {
+      const old = oldSettings as { aktiekapital?: number | null; antal_aktier?: number | null } | null
+      const effectiveAktiekapital = body.aktiekapital !== undefined ? body.aktiekapital : old?.aktiekapital ?? null
+      const effectiveAntalAktier = body.antal_aktier !== undefined ? body.antal_aktier : old?.antal_aktier ?? null
+      if ((effectiveAktiekapital === null) !== (effectiveAntalAktier === null)) {
+        return NextResponse.json(
+          { error: 'Aktiekapital och antal aktier måste anges tillsammans. Fyll i båda fälten eller lämna båda tomma.' },
+          { status: 400 },
+        )
+      }
+    }
+
     // Vacation year basis (payroll gap-closure 3.1): changing the boundary
     // while OPEN vacation-ledger rows exist would orphan them (rows are keyed
     // by vacation_year_start). Close the current year first.