Add/stripe skv (#1004)

* fix(salary): align pain.001 salary file with the Swedish domestic bank dialect Verified against the Swedish Common Interpretation of ISO 20022 (Bankforeningen, Common Payment Types in Sweden, Appendix 1 Example 4: Salaries) and Nordea Corporate Access pain.001 examples v2.6 (2026-06-22), and XSD-validated against the official pain.001.001.03 schema: - drop SvcLvl SEPA (SEPA credit transfers are EUR-only; omitting SvcLvl gets the domestic NURG default) - drop RmtInf (not allowed for SALA salary payments; the beneficiary statement text comes from the Dataclearing LON code) - address employees domestically: clearing as CdtrAgt ClrSysMmbId SESBA, account WITHOUT clearing as CdtrAcct Othr with SchmeNm BBAN - share the clearing/account split (Swedbank 5-digit shift, Nordea personkonto prefix dedup) between the LB and pain.001 generators via splitDomesticBankAccount, fixing pain.001 duplicating the personkonto clearing - clamp MsgId/PmtInfId/InstrId/EndToEndId to Max35Text with the per-tx counter surviving truncation; carry the org number on Dbtr - return 400 from the pain001 route on an invalid clearing instead of emitting a broken file Also includes two unrelated decision-log lines from the parallel revisor-review session (DECISIONS.md is a shared append-only log). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(nav): surface the year-end chain in the sidebar Add Periodiseringar, Arsredovisning (aktiebolag only) and Inkomstdeklaration (INK2 for AB, NE-bilaga for EF) to the Skatt & bokslut group, in workflow order. Entity gating via a new entityOnly flag on NavItem; isActive carve-outs extended so exactly one row lights up for the new routes. Driven by an external revisor review that concluded these features did not exist because none of them were reachable from the nav. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(stripe): Stripe Connect integration behind config gate Connect OAuth per company (only the acct_ id is stored), automatic single-use Payment Links on invoice send, deterministic payment settlement against 1686 (BAS moved acquirer receivables 1580 -> 1686), payout booking with reverse-charge fees (6570 + 4535/4598 + 2645/2614), and a 15-minute sync cron. Non-deterministic events land as needs_review, never guessed at. Fully dark without STRIPE_CONNECT_CLIENT_ID: connect returns 503, the send hook and cron no-op, and the settings page shows 'Kommer snart' (hosted) until the Connect platform is verified. Self-hosted keeps the honest not-configured message. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(deadlines): add shared completeTaxDeadline and fix dead AGI deadline auto-complete generate-declaration.ts has updated non-existent columns (type/period/ status) since inception, so the arbetsgivardeklaration deadline was never auto-completed. Replace with a shared helper targeting the real schema (tax_deadline_type/tax_period/is_completed), also used by the kvittens crons and moms handlers in the follow-up commit. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(rot-rut): import Skatteverket beslutsfil and record decisions on payout requests Parse the beslutsfil JSON from Skatteverkets rot/rut e-tjanst and record godkant belopp on the matching begaran: matched by stored skv_referensnummer first, then exact name among active undecided requests; arenden by fakturanummer then personnummer, exactly-one or the beslut errors (all-or-nothing). Never auto-settles: recording the beslut and booking the payout are separate acts. Exposed as an API route and the gnubok_import_rot_rut_beslut MCP tool. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(skatteverket): system auth for background reads, one-click VAT submit, kvittens notifications Hybrid auth program: system CCG (org certificate) for background reads while personal BankID stays for interactive submissions, since SKV per-flow refresh tokens live 65 min and crons structurally cannot run on them. All system-auth code sits behind SKATTEVERKET_SYSTEM_AUTH_MODE (default off) with a stub transport until the Expisoft cert and CCG avtal land; auth resolution is centralized in resolve-auth.ts. Also in this change: - One-click VAT submit chaining kontrollera -> utkast -> las server-side with a stage discriminator; step-by-step buttons demoted to the overflow menu. - Kvittens crons (AGI + new VAT schedule) with email-only notifications, deduped in notification_log under the new skv_kvittens type. - Ombud grant probe + verification UI in the connect panel, and a dashboard promo card for unconnected companies. - skatteverket_company_connections table with pg-real coverage. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(salary): auto-settle AGI tax payment from skattekonto and surface SKV reconnect on the tax card The "Skatt att betala" card only cleared via the manual mark-paid button on the run detail page; the promised automatic flip from the Skattekonto sync was never implemented, so paid periods stayed red. - settleAgiTaxPayments: during every skattekonto sync, a booked "Arbetsgivardeklaration YYYYMM" debit row settles the matching agi_declarations.tax_paid_at, but only when the amount equals the declared total to the ore and the account is not in deficit (deterministic; drift or deficit falls back to manual). - Salary overview card: reconnect hint when the SKV token needs re-consent (link to /settings/tax, silent when the extension is off), plus an inline "Markera som betald" button reusing the existing endpoint and salary_payments strings. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * Add cloud backup scheduling and alerting features - Implement unit tests for scheduling logic in `schedule.test.ts`, covering various scenarios for determining if a backup schedule is due. - Create a new module `backup-alert.ts` to handle failure alerts for cloud backup auto-sync, including email notifications for reauthentication and repeated failures. - Introduce `schedule.ts` to manage scheduling logic, including handling local time zones and converting between local and UTC hours. - Add CSV report generation functions in `archive-csv.ts` for trial balance, income statement, balance sheet, and general ledger, ensuring compatibility with Swedish Excel formats. - Create a README generator for the archive structure in `archive-readme.ts`, providing clear documentation for users accessing backup files. - Implement tests for CSV report generation in `archive-csv.test.ts`, ensuring correct formatting and content. - Establish a full-archive coverage contract test in `full-archive-coverage.pg.test.ts` to ensure all company-scoped tables are properly classified for backup. * fix(stripe): correct invoice clearing reference and improve type safety in sync logic * fix(invoices): narrow accountingMethod before resolveInvoicePaymentSourceType settleInvoicePayment takes accountingMethod as a raw settings string, but resolveInvoicePaymentSourceType requires the 'accrual' | 'cash' union. Normalize at the call site (anything but 'cash' books as accrual), matching the existing useCashEntry semantics. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix: address CodeRabbit review findings and nitpicks on PR #1004 Review findings: - backup settings redirect: always force view=export over incoming params - AGI/VAT kvittens crons: isolate best-effort post-submit calls, check the signed-state persist error, guard recovery calls in catch blocks so one company cannot abort the rest; surface grant_revoked in the run summary - kvittens notifications: atomic claim-first dedup with a partial unique index; map non-uuid reference keys to deterministic uuids - grant probe: record the actual 2xx status; mTLS transport: handle response-stream errors - stripe: amount-aware idempotency keys for payment links; emit stripe.disconnected on upstream revocations - ROT/RUT beslut import: mutate in-memory request state after apply, move item + header writes into an atomic apply_rot_rut_beslut RPC, add rot_rut_payout to JournalEntrySourceTypeSchema - migrations: use NOT VALID + VALIDATE CONSTRAINT for CHECK constraints on journal_entries, notification_log and rot_rut_payout_requests - cloud backup: hour_utc-only schedule updates clear stale hour_local Nitpicks: - stripe sync: enforce the cron time budget inside per-connection event processing with idempotent cursor progress; maybeSingle for settings; honest partial-customer DTO shared with the settlement boundary - shared applyPaymentLinkToInvoice helper for both invoice send routes, v1 docblock documents step 6b and PAYMENT_LINK_FAILED - settings panel: drop redundant decodeURIComponent - cloud backup: document worst-case archive memory headroom Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-07-12 19:14:12 +02:00
parent ee3c33c7a4
commit 98d0c7f2d0
136 changed files with 15312 additions and 1133 deletions
@@ -1,5 +1,5 @@
 /* eslint-disable @typescript-eslint/no-explicit-any */
-import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { describe, it, expect, vi, beforeEach, afterEach } from 'vitest'

 vi.mock('@supabase/supabase-js', () => ({
  createClient: vi.fn(),
@@ -12,6 +12,15 @@ vi.mock('@/extensions/general/cloud-backup/lib/sync', () => ({
  saveExtensionData: vi.fn().mockResolvedValue(undefined),
 }))

+vi.mock('@/extensions/general/cloud-backup/lib/backup-alert', async (importOriginal) => {
+  const actual =
+    await importOriginal<typeof import('@/extensions/general/cloud-backup/lib/backup-alert')>()
+  return {
+    ...actual,
+    sendBackupFailureAlert: vi.fn().mockResolvedValue({ sent: true }),
+  }
+})
+
 vi.mock('@/lib/auth/cron', () => ({
  verifyCronSecret: vi.fn().mockReturnValue(null),
 }))
@@ -22,13 +31,18 @@ import {
  performSync,
  saveExtensionData,
 } from '@/extensions/general/cloud-backup/lib/sync'
+import { sendBackupFailureAlert } from '@/extensions/general/cloud-backup/lib/backup-alert'
 import { verifyCronSecret } from '@/lib/auth/cron'

 const mockCreateClient = vi.mocked(createClient)
 const mockPerformSync = vi.mocked(performSync)
 const mockSaveExtensionData = vi.mocked(saveExtensionData)
+const mockSendBackupFailureAlert = vi.mocked(sendBackupFailureAlert)
 const mockVerifyCronSecret = vi.mocked(verifyCronSecret)

+// All tests run at a frozen 2026-07-12 12:30 UTC.
+const NOW = new Date('2026-07-12T12:30:00.000Z')
+
 function makeRequest() {
  return new Request('http://localhost/api/extensions/cloud-backup/auto-sync/cron', {
    headers: { authorization: 'Bearer test-secret' },
@@ -75,13 +89,49 @@ function makeSupabaseStub(
  return { from } as any
 }

+function scheduleRow(overrides: Record<string, unknown> = {}) {
+  return {
+    company_id: 'c-1',
+    user_id: 'u-1',
+    value: {
+      enabled: true,
+      hour_utc: 12,
+      last_auto_sync_at: null,
+      last_auto_sync_status: null,
+      last_auto_sync_error: null,
+      ...overrides,
+    },
+  }
+}
+
+function okSyncResult() {
+  return {
+    ok: true as const,
+    lastSync: {
+      at: '2026-07-12T12:30:00Z',
+      folder_id: 'folder-1',
+      files: [],
+      total_size_bytes: 1000,
+    },
+    webViewLink: 'https://drive.google.com/drive/folders/folder-1',
+    uploadedCount: 1,
+    skippedCount: 0,
+  }
+}
+
 describe('cloud-backup auto-sync cron', () => {
  beforeEach(() => {
    vi.clearAllMocks()
+    vi.useFakeTimers({ now: NOW })
    process.env.NEXT_PUBLIC_SUPABASE_URL = 'https://test.supabase.co'
    process.env.SUPABASE_SERVICE_ROLE_KEY = 'service-key'
    process.env.NEXT_PUBLIC_APP_URL = 'https://app.test'
    mockVerifyCronSecret.mockReturnValue(null)
+    mockSendBackupFailureAlert.mockResolvedValue({ sent: true })
+  })
+
+  afterEach(() => {
+    vi.useRealTimers()
  })

  it('returns 401 when cron auth fails', async () => {
@@ -95,13 +145,43 @@ describe('cloud-backup auto-sync cron', () => {
  })

  it('skips schedules that are disabled', async () => {
+    mockCreateClient.mockReturnValueOnce(
+      makeSupabaseStub([scheduleRow({ enabled: false })])
+    )
+
+    const res = await GET(makeRequest())
+    const body = await res.json()
+
+    expect(body.processed).toBe(0)
+    expect(mockPerformSync).not.toHaveBeenCalled()
+  })
+
+  it('skips schedules whose slot is later today', async () => {
+    mockCreateClient.mockReturnValueOnce(makeSupabaseStub([scheduleRow({ hour_utc: 13 })]))
+
+    const res = await GET(makeRequest())
+    const body = await res.json()
+
+    expect(body.processed).toBe(0)
+    expect(mockPerformSync).not.toHaveBeenCalled()
+  })
+
+  it('catches up companies whose earlier slot was missed', async () => {
+    // 03:00 slot, never synced: still due at 12:30 (e.g. after a time-budget overrun).
+    mockCreateClient.mockReturnValueOnce(makeSupabaseStub([scheduleRow({ hour_utc: 3 })]))
+    mockPerformSync.mockResolvedValueOnce(okSyncResult())
+
+    const res = await GET(makeRequest())
+    const body = await res.json()
+
+    expect(body.successes).toBe(1)
+    expect(mockPerformSync).toHaveBeenCalledTimes(1)
+  })
+
+  it('skips schedules that already ran since today\'s slot', async () => {
    mockCreateClient.mockReturnValueOnce(
      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: { enabled: false, hour_utc: new Date().getUTCHours() },
-        },
+        scheduleRow({ hour_utc: 3, last_auto_sync_at: '2026-07-12T03:05:00.000Z' }),
      ])
    )

@@ -112,73 +192,25 @@ describe('cloud-backup auto-sync cron', () => {
    expect(mockPerformSync).not.toHaveBeenCalled()
  })

-  it('skips schedules whose hour does not match the current UTC hour', async () => {
-    const offHour = (new Date().getUTCHours() + 5) % 24
+  it('runs again when the last attempt was yesterday', async () => {
    mockCreateClient.mockReturnValueOnce(
      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: { enabled: true, hour_utc: offHour },
-        },
+        scheduleRow({ hour_utc: 12, last_auto_sync_at: '2026-07-11T12:05:00.000Z' }),
      ])
    )
+    mockPerformSync.mockResolvedValueOnce(okSyncResult())

    const res = await GET(makeRequest())
    const body = await res.json()

-    expect(body.processed).toBe(0)
-    expect(mockPerformSync).not.toHaveBeenCalled()
+    expect(body.successes).toBe(1)
  })

-  it('skips schedules whose last_auto_sync_at is less than 20h ago', async () => {
-    const recent = new Date(Date.now() - 3 * 60 * 60 * 1000).toISOString()
+  it('runs sync with document fallback and persists success state', async () => {
    mockCreateClient.mockReturnValueOnce(
-      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: {
-            enabled: true,
-            hour_utc: new Date().getUTCHours(),
-            last_auto_sync_at: recent,
-          },
-        },
-      ])
+      makeSupabaseStub([scheduleRow({ consecutive_failures: 2 })])
    )
-
-    const res = await GET(makeRequest())
-    const body = await res.json()
-
-    expect(body.processed).toBe(0)
-    expect(mockPerformSync).not.toHaveBeenCalled()
-  })
-
-  it('runs sync and persists success for qualifying schedules', async () => {
-    mockCreateClient.mockReturnValueOnce(
-      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: {
-            enabled: true,
-            hour_utc: new Date().getUTCHours(),
-            last_auto_sync_at: null,
-          },
-        },
-      ])
-    )
-    mockPerformSync.mockResolvedValueOnce({
-      ok: true,
-      lastSync: {
-        at: '2026-04-20T03:00:00Z',
-        file_id: 'f-1',
-        file_name: 'arkiv.zip',
-        file_size_bytes: 1000,
-        folder_id: 'folder-1',
-      },
-      webViewLink: 'https://drive.google.com/file/d/f-1/view',
-    })
+    mockPerformSync.mockResolvedValueOnce(okSyncResult())

    const res = await GET(makeRequest())
    const body = await res.json()
@@ -188,92 +220,162 @@ describe('cloud-backup auto-sync cron', () => {
        companyId: 'c-1',
        userId: 'u-1',
        includeDocuments: true,
+        allowDocumentFallback: true,
      })
    )
    expect(body.successes).toBe(1)
-    expect(body.errors).toBe(0)

-    // Persisted the success state on the schedule
    const [, , , key, value] = mockSaveExtensionData.mock.calls[0]
    expect(key).toBe('google_drive_schedule')
    expect((value as any).last_auto_sync_status).toBe('success')
    expect((value as any).last_auto_sync_error).toBeNull()
+    // Success resets the failure counter.
+    expect((value as any).consecutive_failures).toBe(0)
+    expect(mockSendBackupFailureAlert).not.toHaveBeenCalled()
  })

-  it('records error status when performSync returns ok=false', async () => {
-    mockCreateClient.mockReturnValueOnce(
-      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: {
-            enabled: true,
-            hour_utc: new Date().getUTCHours(),
-            last_auto_sync_at: null,
-          },
-        },
-      ])
-    )
+  it('increments the failure counter without alerting below the threshold', async () => {
+    mockCreateClient.mockReturnValueOnce(makeSupabaseStub([scheduleRow()]))
    mockPerformSync.mockResolvedValueOnce({
      ok: false,
-      reason: 'archive_too_large',
-      message: 'Archive exceeds size limit',
-      size_bytes: 100 * 1024 * 1024,
-      size_limit_bytes: 80 * 1024 * 1024,
+      reason: 'upload_failed',
+      message: 'Drive upload failed: 500',
    })

    const res = await GET(makeRequest())
    const body = await res.json()

-    expect(body.successes).toBe(0)
    expect(body.errors).toBe(1)
    const [, , , , value] = mockSaveExtensionData.mock.calls[0]
    expect((value as any).last_auto_sync_status).toBe('error')
-    expect((value as any).last_auto_sync_error).toBe('Archive exceeds size limit')
+    expect((value as any).consecutive_failures).toBe(1)
+    expect(mockSendBackupFailureAlert).not.toHaveBeenCalled()
  })

-  it('catches thrown errors and records them against the schedule', async () => {
+  it('alerts when the consecutive failure threshold is reached', async () => {
+    mockCreateClient.mockReturnValueOnce(
+      makeSupabaseStub([scheduleRow({ consecutive_failures: 2 })])
+    )
+    mockPerformSync.mockResolvedValueOnce({
+      ok: false,
+      reason: 'upload_failed',
+      message: 'Drive upload failed: 500',
+    })
+
+    await GET(makeRequest())
+
+    expect(mockSendBackupFailureAlert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({
+        companyId: 'c-1',
+        kind: 'repeated_failures',
+        consecutiveFailures: 3,
+        errorMessage: 'Drive upload failed: 500',
+      })
+    )
+    const [, , , , value] = mockSaveExtensionData.mock.calls[0]
+    expect((value as any).consecutive_failures).toBe(3)
+    expect((value as any).last_alert_at).toEqual(expect.any(String))
+  })
+
+  it('throttles repeat alerts via last_alert_at', async () => {
+    const recentAlert = new Date(NOW.getTime() - 24 * 60 * 60 * 1000).toISOString()
    mockCreateClient.mockReturnValueOnce(
      makeSupabaseStub([
-        {
-          company_id: 'c-1',
-          user_id: 'u-1',
-          value: {
-            enabled: true,
-            hour_utc: new Date().getUTCHours(),
-            last_auto_sync_at: null,
-          },
-        },
+        scheduleRow({ consecutive_failures: 5, last_alert_at: recentAlert }),
      ])
    )
+    mockPerformSync.mockResolvedValueOnce({
+      ok: false,
+      reason: 'upload_failed',
+      message: 'still failing',
+    })
+
+    await GET(makeRequest())
+
+    expect(mockSendBackupFailureAlert).not.toHaveBeenCalled()
+    const [, , , , value] = mockSaveExtensionData.mock.calls[0]
+    expect((value as any).last_alert_at).toBe(recentAlert)
+  })
+
+  it('alerts immediately when the token dies during the sync', async () => {
+    mockCreateClient.mockReturnValueOnce(makeSupabaseStub([scheduleRow()]))
+    mockPerformSync.mockResolvedValueOnce({
+      ok: false,
+      reason: 'needs_reauth',
+      message: 'Google Drive authorization expired; reconnect required',
+    })
+
+    await GET(makeRequest())
+
+    expect(mockSendBackupFailureAlert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'needs_reauth' })
+    )
+  })
+
+  it('catches thrown errors, counts them and records them against the schedule', async () => {
+    mockCreateClient.mockReturnValueOnce(
+      makeSupabaseStub([scheduleRow({ consecutive_failures: 2 })])
+    )
    mockPerformSync.mockRejectedValueOnce(new Error('Drive quota exceeded'))

    const res = await GET(makeRequest())
    const body = await res.json()

    expect(body.errors).toBe(1)
+    expect(mockSendBackupFailureAlert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'repeated_failures', consecutiveFailures: 3 })
+    )
    const [, , , , value] = mockSaveExtensionData.mock.calls[0]
    expect((value as any).last_auto_sync_status).toBe('error')
    expect((value as any).last_auto_sync_error).toContain('Drive quota exceeded')
+    expect((value as any).consecutive_failures).toBe(3)
  })

-  it('skips connections flagged needs_reauth without syncing or touching the schedule', async () => {
+  it('skips pre-flagged needs_reauth connections and alerts once per incident', async () => {
    mockCreateClient.mockReturnValueOnce(
-      makeSupabaseStub(
-        [
+      makeSupabaseStub([scheduleRow()], {
+        connectionRows: [
          {
            company_id: 'c-1',
-            user_id: 'u-1',
-            value: {
-              enabled: true,
-              hour_utc: new Date().getUTCHours(),
-              last_auto_sync_at: null,
-            },
+            value: { status: 'needs_reauth', needs_reauth_at: '2026-07-10T03:00:00.000Z' },
          },
        ],
+      })
+    )
+
+    const res = await GET(makeRequest())
+    const body = await res.json()
+
+    expect(mockPerformSync).not.toHaveBeenCalled()
+    expect(body.skipped).toBe(1)
+    expect(body.results).toEqual([
+      { companyId: 'c-1', status: 'skipped', error: 'needs_reauth' },
+    ])
+    // The incident had not been alerted yet: one alert, persisted on the schedule.
+    expect(mockSendBackupFailureAlert).toHaveBeenCalledWith(
+      expect.anything(),
+      expect.objectContaining({ kind: 'needs_reauth' })
+    )
+    expect(mockSaveExtensionData).toHaveBeenCalledTimes(1)
+    const [, , , , value] = mockSaveExtensionData.mock.calls[0]
+    expect((value as any).last_alert_at).toEqual(expect.any(String))
+    // last_auto_sync_* stays untouched: it keeps showing the original failure.
+    expect((value as any).last_auto_sync_at).toBeNull()
+  })
+
+  it('does not re-alert an already alerted needs_reauth incident', async () => {
+    mockCreateClient.mockReturnValueOnce(
+      makeSupabaseStub(
+        [scheduleRow({ last_alert_at: '2026-07-10T04:00:00.000Z' })],
        {
          connectionRows: [
-            { company_id: 'c-1', value: { status: 'needs_reauth' } },
+            {
+              company_id: 'c-1',
+              value: { status: 'needs_reauth', needs_reauth_at: '2026-07-10T03:00:00.000Z' },
+            },
          ],
        }
      )
@@ -282,58 +384,30 @@ describe('cloud-backup auto-sync cron', () => {
    const res = await GET(makeRequest())
    const body = await res.json()

-    expect(mockPerformSync).not.toHaveBeenCalled()
-    expect(mockSaveExtensionData).not.toHaveBeenCalled()
    expect(body.skipped).toBe(1)
-    expect(body.successes).toBe(0)
-    expect(body.errors).toBe(0)
-    expect(body.results).toEqual([
-      { companyId: 'c-1', status: 'skipped', error: 'needs_reauth' },
-    ])
+    expect(mockSendBackupFailureAlert).not.toHaveBeenCalled()
+    expect(mockSaveExtensionData).not.toHaveBeenCalled()
  })

  it('only skips the flagged company when others are due', async () => {
    mockCreateClient.mockReturnValueOnce(
      makeSupabaseStub(
        [
-          {
-            company_id: 'c-dead',
-            user_id: 'u-1',
-            value: {
-              enabled: true,
-              hour_utc: new Date().getUTCHours(),
-              last_auto_sync_at: null,
-            },
-          },
-          {
-            company_id: 'c-live',
-            user_id: 'u-2',
-            value: {
-              enabled: true,
-              hour_utc: new Date().getUTCHours(),
-              last_auto_sync_at: null,
-            },
-          },
+          { ...scheduleRow(), company_id: 'c-dead' },
+          { ...scheduleRow(), company_id: 'c-live', user_id: 'u-2' },
        ],
        {
          connectionRows: [
-            { company_id: 'c-dead', value: { status: 'needs_reauth' } },
+            {
+              company_id: 'c-dead',
+              value: { status: 'needs_reauth', needs_reauth_at: '2026-07-10T03:00:00.000Z' },
+            },
            { company_id: 'c-live', value: { status: 'active' } },
          ],
        }
      )
    )
-    mockPerformSync.mockResolvedValueOnce({
-      ok: true,
-      lastSync: {
-        at: '2026-07-10T03:00:00Z',
-        file_id: 'f-1',
-        file_name: 'arkiv.zip',
-        file_size_bytes: 1000,
-        folder_id: 'folder-1',
-      },
-      webViewLink: 'https://drive.google.com/file/d/f-1/view',
-    })
+    mockPerformSync.mockResolvedValueOnce(okSyncResult())

    const res = await GET(makeRequest())
    const body = await res.json()
@@ -348,20 +422,9 @@ describe('cloud-backup auto-sync cron', () => {

  it('fails open and attempts the sync when the connection lookup errors', async () => {
    mockCreateClient.mockReturnValueOnce(
-      makeSupabaseStub(
-        [
-          {
-            company_id: 'c-1',
-            user_id: 'u-1',
-            value: {
-              enabled: true,
-              hour_utc: new Date().getUTCHours(),
-              last_auto_sync_at: null,
-            },
-          },
-        ],
-        { connectionError: { message: 'connection query failed' } }
-      )
+      makeSupabaseStub([scheduleRow()], {
+        connectionError: { message: 'connection query failed' },
+      })
    )
    mockPerformSync.mockResolvedValueOnce({
      ok: false,
@@ -8,6 +8,12 @@ import {
  SCHEDULE_KEY,
  saveExtensionData,
 } from '@/extensions/general/cloud-backup/lib/sync'
+import { isScheduleDue } from '@/extensions/general/cloud-backup/lib/schedule'
+import {
+  sendBackupFailureAlert,
+  shouldSendBackupAlert,
+  type BackupAlertKind,
+} from '@/extensions/general/cloud-backup/lib/backup-alert'
 import type {
  GoogleDriveConnection,
  GoogleDriveSchedule,
@@ -16,10 +22,15 @@ import type {
 /**
 * GET /api/extensions/cloud-backup/auto-sync/cron
 *
- * Runs hourly. Finds all companies with `google_drive_schedule.enabled = true`
- * whose `hour_utc` matches the current UTC hour, and whose `last_auto_sync_at`
- * is either unset or more than 20 hours old. Triggers a full Drive backup for
- * each qualifying company via the shared `performSync()` helper.
+ * Runs hourly. Finds all companies whose auto-sync is due (daily slot has
+ * passed and no attempt has run since it: see `isScheduleDue`) and triggers a
+ * full Drive backup for each via the shared `performSync()` helper. Companies
+ * left over when a run hits its time budget stay due and are picked up by the
+ * next hourly run instead of losing the day.
+ *
+ * Failures increment `consecutive_failures` on the schedule; alert emails go
+ * out on dead tokens (once per incident) and repeated failures (threshold in
+ * `backup-alert.ts`), throttled per company.
 *
 * Uses the service role client: no user session, no RLS. Each row in
 * `extension_data` carries its own `user_id` (the user who configured the
@@ -37,7 +48,7 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
  }

  const supabase = createClient(supabaseUrl, supabaseServiceKey)
-  const currentHourUtc = new Date().getUTCHours()
+  const now = new Date()
  const origin = process.env.NEXT_PUBLIC_APP_URL || 'http://localhost:3000'

  const { data: rows, error } = await supabase
@@ -58,16 +69,9 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
    return NextResponse.json({ message: 'No schedules configured', processed: 0 })
  }

-  const candidates = rows.filter((r) => {
-    const schedule = r.value as GoogleDriveSchedule | null
-    if (!schedule || !schedule.enabled) return false
-    if (schedule.hour_utc !== currentHourUtc) return false
-    if (schedule.last_auto_sync_at) {
-      const ageMs = Date.now() - new Date(schedule.last_auto_sync_at).getTime()
-      if (ageMs < 20 * 60 * 60 * 1000) return false
-    }
-    return true
-  })
+  const candidates = rows.filter((r) =>
+    isScheduleDue(r.value as GoogleDriveSchedule | null, now)
+  )

  if (candidates.length === 0) {
    return NextResponse.json({
@@ -98,13 +102,11 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
    })
  }

-  const needsReauthCompanyIds = new Set(
-    (connectionRows ?? [])
-      .filter(
-        (r) => (r.value as GoogleDriveConnection | null)?.status === 'needs_reauth'
-      )
-      .map((r) => r.company_id as string)
-  )
+  const connectionByCompany = new Map<string, GoogleDriveConnection>()
+  for (const r of connectionRows ?? []) {
+    const value = r.value as GoogleDriveConnection | null
+    if (value) connectionByCompany.set(r.company_id as string, value)
+  }

  const startTime = Date.now()
  const TIME_BUDGET_MS = 250_000 // 4m10s: leaves 50s margin below Vercel's 300s Pro limit
@@ -115,6 +117,40 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
    error?: string
  }[] = []

+  /**
+   * Send a failure alert if warranted and return the new last_alert_at.
+   * Best-effort: alert failures are logged inside sendBackupFailureAlert.
+   */
+  const maybeAlert = async (params: {
+    companyId: string
+    userId: string
+    kind: BackupAlertKind
+    consecutiveFailures: number
+    errorMessage: string | null
+    lastAlertAt: string | null | undefined
+  }): Promise<string | null> => {
+    const prior = params.lastAlertAt ?? null
+    if (
+      !shouldSendBackupAlert({
+        kind: params.kind,
+        consecutiveFailures: params.consecutiveFailures,
+        lastAlertAt: prior,
+        now: new Date(),
+      })
+    ) {
+      return prior
+    }
+    const sent = await sendBackupFailureAlert(supabase, {
+      companyId: params.companyId,
+      userId: params.userId,
+      kind: params.kind,
+      consecutiveFailures: params.consecutiveFailures,
+      errorMessage: params.errorMessage,
+      origin,
+    })
+    return sent.sent ? new Date().toISOString() : prior
+  }
+
  for (const row of candidates) {
    if (Date.now() - startTime > TIME_BUDGET_MS) {
      ctx.log.info('time budget reached', {
@@ -128,9 +164,35 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
    const userId = row.user_id as string
    const schedule = row.value as GoogleDriveSchedule

-    if (needsReauthCompanyIds.has(companyId)) {
+    const connection = connectionByCompany.get(companyId)
+    if (connection?.status === 'needs_reauth') {
      // Do not touch last_auto_sync_* here: the schedule keeps showing the
-      // failure from the night the dead token was detected.
+      // failure from the night the dead token was detected. But make sure the
+      // incident has been alerted once: a token can go dead via a manual sync
+      // (which never emails) and would otherwise stay silent forever.
+      const alertedSinceIncident =
+        schedule.last_alert_at &&
+        connection.needs_reauth_at &&
+        new Date(schedule.last_alert_at).getTime() >=
+          new Date(connection.needs_reauth_at).getTime()
+      if (!alertedSinceIncident) {
+        const lastAlertAt = await maybeAlert({
+          companyId,
+          userId,
+          kind: 'needs_reauth',
+          consecutiveFailures: schedule.consecutive_failures ?? 0,
+          errorMessage: null,
+          lastAlertAt: schedule.last_alert_at,
+        })
+        if (lastAlertAt !== (schedule.last_alert_at ?? null)) {
+          await saveExtensionData(supabase, companyId, userId, SCHEDULE_KEY, {
+            ...schedule,
+            last_alert_at: lastAlertAt,
+          }).catch((persistErr) => {
+            ctx.log.error('failed to persist alert state', persistErr as Error, { companyId })
+          })
+        }
+      }
      results.push({ companyId, status: 'skipped', error: 'needs_reauth' })
      continue
    }
@@ -142,13 +204,31 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
        userId,
        origin,
        includeDocuments: true,
+        allowDocumentFallback: true,
      })

+      const consecutiveFailures = syncResult.ok
+        ? 0
+        : (schedule.consecutive_failures ?? 0) + 1
+      let lastAlertAt = schedule.last_alert_at ?? null
+      if (!syncResult.ok) {
+        lastAlertAt = await maybeAlert({
+          companyId,
+          userId,
+          kind: syncResult.reason === 'needs_reauth' ? 'needs_reauth' : 'repeated_failures',
+          consecutiveFailures,
+          errorMessage: syncResult.message,
+          lastAlertAt,
+        })
+      }
+
      const updated: GoogleDriveSchedule = {
        ...schedule,
        last_auto_sync_at: new Date().toISOString(),
        last_auto_sync_status: syncResult.ok ? 'success' : 'error',
        last_auto_sync_error: syncResult.ok ? null : syncResult.message,
+        consecutive_failures: consecutiveFailures,
+        last_alert_at: lastAlertAt,
      }
      await saveExtensionData(supabase, companyId, userId, SCHEDULE_KEY, updated)

@@ -163,11 +243,23 @@ export const GET = withCronContext('cron.cloud_backup_auto_sync', async (_reques
        companyId,
      })

+      const consecutiveFailures = (schedule.consecutive_failures ?? 0) + 1
+      const lastAlertAt = await maybeAlert({
+        companyId,
+        userId,
+        kind: 'repeated_failures',
+        consecutiveFailures,
+        errorMessage: message.slice(0, 200),
+        lastAlertAt: schedule.last_alert_at,
+      })
+
      const updated: GoogleDriveSchedule = {
        ...schedule,
        last_auto_sync_at: new Date().toISOString(),
        last_auto_sync_status: 'error',
        last_auto_sync_error: message.slice(0, 200),
+        consecutive_failures: consecutiveFailures,
+        last_alert_at: lastAlertAt,
      }
      await saveExtensionData(supabase, companyId, userId, SCHEDULE_KEY, updated).catch(
        (persistErr) => {