Bug/UI wrong display (#573)
* fix(dashboard): exclude credit notes from unpaid invoices widget Credit notes (status='sent', negative total) were summed into the "Att få betalt" widget, producing confusing negative totals like "2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL, matching the existing pattern in reminder-processor and the AR ledger. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(documents): harden PDF preview and upload validation - JournalEntryAttachments: switch inline PDF preview from <iframe> to <object type="application/pdf">. Mirrors the AttachmentPreviewSheet fix from #572 — Chrome's frame pipeline intermittently surfaced "Det här innehållet har blockerats" on iframes even with permissive CSP. <object> invokes the PDF plugin directly. crbug.com/271452. - /api/documents/:id/inline: resolve Content-Type via file extension when mime_type is null or application/octet-stream. Legacy uploads landed with empty File.type from some drag sources; combined with the new X-Content-Type-Options: nosniff header on this route, Chrome refused to render valid PDFs. Extension fallback covers every legacy row without a DB backfill. - /api/documents POST: surface DB-trigger period-lock errors as a 400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 / "Filen kunde inte sparas") which hid the real cause from users attaching to verifikationer in closed/locked fiscal periods. - document-service: add validateDocumentMagicBytes() that inspects the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates a leading UTF-8 BOM). Wired into uploadDocument() and createNewVersion() so every upload path is protected — UI, MCP, and future email/webhook ingestion. Defends against agents that send a base64-encoded text placeholder instead of real binary bytes via the gnubok_upload_document MCP tool, which produced tiny (15-561 byte) "PDFs" that failed to render in Chrome and in external viewers. Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal Five compliance gaps fixed in the K2 and K3 noter builders: - Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB anskaffningsvärde, tillkommande, avgående, UB and accumulated avskrivningar movement (was only emitting avskrivningstider). - Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §. - Ställda säkerheter and Eventualförpliktelser as separate notes per ÅRL 5:14-15 § (K2 previously combined them). - Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8. Replaces medelantal anställda — the old query filtered employees by an is_active column that doesn't exist, so the note never emitted. Now uses an FTE-weighted day-based average per ÅRL 5:20 §. Six disclosure fields persist on arsredovisning_narratives as per-period overrides; the UI extends the existing förvaltningsberättelse editor with a "Lagstadgade upplysningar" subsection sharing the same Spara button — no new pages, no settings changes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(invoices): respect vat_registered=false and hide personnummer for B2C - PDF address block no longer prints org_number for individual customers (GDPR data minimization; ML 17 kap 24§ requires name + address only). - Wire company_settings.vat_registered through the rule helpers, invoice creation API, preview-pdf API, and the new-invoice form so a non-VAT- registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses the empty "Moms 0%" row and shows a dedicated "Företaget är inte momsregistrerat" notice instead of the ML 3 kap. exempt notice. - Engine unchanged: 'exempt' treatment already routes to 3004/3100 and skips VAT lines. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings): remove approval rules from sidebar and routes * fix(invoices): ensure vat_registered defaults to true for invoice previews and API --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.7
Claude Opus 4.7
parent
32d9978f1b
commit
a2a556d837
@@ -8,12 +8,28 @@ import {
|
||||
upsertNarrative,
|
||||
} from '@/lib/bokslut/arsredovisning/narrative-service'
|
||||
|
||||
// Strip non-printable control characters that would corrupt PDF output or
|
||||
// mislead a human reader of the årsredovisning. Whitelist printable ASCII
|
||||
// + every byte ≥ 0x20 (covers Latin-1 + UTF-8 multi-byte sequences) while
|
||||
// allowing tab/LF/CR for legitimate line breaks.
|
||||
const stripControlChars = (s: string): string =>
|
||||
s.replace(/[\x00-\x08\x0B\x0C\x0E-\x1F\x7F]/g, '')
|
||||
|
||||
const sanitizedText = (max: number) =>
|
||||
z
|
||||
.string()
|
||||
.max(max)
|
||||
.transform(stripControlChars)
|
||||
|
||||
const PostSchema = z.object({
|
||||
// Match the DB CHECK lengths exactly so a payload that would fail at the
|
||||
// storage layer instead returns a clean 400 here.
|
||||
description: z.string().max(4000).nullable().optional(),
|
||||
important_events: z.string().max(4000).nullable().optional(),
|
||||
resultatdisposition: z.string().max(2000).nullable().optional(),
|
||||
// storage layer instead returns a clean 400 here. Free-text fields are
|
||||
// rendered verbatim into the årsredovisning PDF, so we strip ASCII
|
||||
// control bytes (NUL, ESC, etc.) at the schema layer — otherwise a
|
||||
// tampered payload could corrupt PDF output or hide content from auditors.
|
||||
description: sanitizedText(4000).nullable().optional(),
|
||||
important_events: sanitizedText(4000).nullable().optional(),
|
||||
resultatdisposition: sanitizedText(2000).nullable().optional(),
|
||||
// ISO YYYY-MM-DD per the DATE column; null clears it. Validate as a
|
||||
// real calendar date (not just regex) so '2024-13-99' returns 400 from
|
||||
// the API instead of bubbling up as a Postgres 500.
|
||||
@@ -29,6 +45,36 @@ const PostSchema = z.object({
|
||||
)
|
||||
.nullable()
|
||||
.optional(),
|
||||
// Disclosure fields per ÅRL 5:13-15 § + BFNAR koncernförhållanden. All
|
||||
// optional; null clears the override and the builder falls back to
|
||||
// boilerplate ("Inga." / "Inga skulder förfaller efter mer än fem år.").
|
||||
// Cap at 1 trillion SEK — well above any realistic Swedish company's
|
||||
// long-term debt (Volvo Group ~500 G SEK), prevents overflow in PDF
|
||||
// formatting and downstream numeric handling.
|
||||
long_term_debt_over_five_years: z
|
||||
.number()
|
||||
.min(0)
|
||||
.max(1_000_000_000_000)
|
||||
.nullable()
|
||||
.optional(),
|
||||
securities_pledged: sanitizedText(4000).nullable().optional(),
|
||||
contingent_liabilities: sanitizedText(4000).nullable().optional(),
|
||||
parent_company_name: sanitizedText(200).nullable().optional(),
|
||||
// Swedish organisationsnummer NNNNNN-NNNN. Third digit ≥ 2 distinguishes
|
||||
// legal-entity org numbers from personnummer (whose third digit forms part
|
||||
// of a month, 0-1). ÅRL 5:13–15 disclosure is about parent legal entities,
|
||||
// so personnummer-shaped values are out of scope and a GDPR Art.5(1)(c)
|
||||
// data-minimisation concern if persisted. Empty string clears the override.
|
||||
parent_company_org_number: z
|
||||
.union([
|
||||
z.literal(''),
|
||||
z.string().regex(/^\d{2}[2-9]\d{3}-\d{4}$/, {
|
||||
message: 'Ogiltigt organisationsnummer (NNNNNN-NNNN, ej personnummer)',
|
||||
}),
|
||||
])
|
||||
.nullable()
|
||||
.optional(),
|
||||
parent_company_city: sanitizedText(100).nullable().optional(),
|
||||
})
|
||||
|
||||
export const GET = withRouteContext(
|
||||
|
||||
@@ -17,6 +17,30 @@ import { createServiceClient } from '@/lib/supabase/server'
|
||||
* (RLS + explicit company_id filter) before the service-role client
|
||||
* fetches the file from the non-public `documents` bucket.
|
||||
*/
|
||||
|
||||
const EXTENSION_MIME_MAP: Record<string, string> = {
|
||||
pdf: 'application/pdf',
|
||||
jpg: 'image/jpeg',
|
||||
jpeg: 'image/jpeg',
|
||||
png: 'image/png',
|
||||
webp: 'image/webp',
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the response Content-Type. Some legacy uploads landed with
|
||||
* `mime_type = null` or `application/octet-stream` (browsers sometimes
|
||||
* report empty File.type for files dragged from certain sources). Combined
|
||||
* with the new `X-Content-Type-Options: nosniff` header on this route,
|
||||
* that broke Chrome's PDF viewer for older rows — the plugin would load
|
||||
* via <object type="application/pdf"> but refuse to parse a response
|
||||
* served as octet-stream. Falling back to the file extension covers every
|
||||
* legacy row without a DB backfill.
|
||||
*/
|
||||
function resolveContentType(fileName: string, dbMimeType: string | null): string {
|
||||
if (dbMimeType && dbMimeType !== 'application/octet-stream') return dbMimeType
|
||||
const ext = fileName.toLowerCase().split('.').pop() ?? ''
|
||||
return EXTENSION_MIME_MAP[ext] ?? dbMimeType ?? 'application/octet-stream'
|
||||
}
|
||||
export async function GET(
|
||||
_request: Request,
|
||||
{ params }: { params: Promise<{ id: string }> }
|
||||
@@ -68,9 +92,14 @@ export async function GET(
|
||||
return new NextResponse(blob, {
|
||||
status: 200,
|
||||
headers: {
|
||||
'Content-Type': doc.mime_type ?? 'application/octet-stream',
|
||||
'Content-Type': resolveContentType(doc.file_name, doc.mime_type),
|
||||
'Content-Disposition': `inline; filename="${safeFileName}"`,
|
||||
'Cache-Control': 'private, max-age=300',
|
||||
// Block MIME sniffing — Content-Type is derived from DB metadata
|
||||
// (with extension fallback for legacy rows), never from response
|
||||
// content. Without nosniff a tampered file_name extension could
|
||||
// serve a stored document under an attacker-chosen MIME type.
|
||||
'X-Content-Type-Options': 'nosniff',
|
||||
},
|
||||
})
|
||||
}
|
||||
|
||||
@@ -62,10 +62,19 @@ export const POST = withRouteContext(
|
||||
|
||||
return NextResponse.json({ data: document })
|
||||
} catch (err) {
|
||||
const message = err instanceof Error ? err.message : 'unknown'
|
||||
// DB trigger rejects inserts whose journal_entry_id points at an entry
|
||||
// in a closed/locked period. Surface as 400 with the real reason.
|
||||
if (/locked\/closed fiscal period|Bokföringen är låst/i.test(message)) {
|
||||
return errorResponseFromCode('DOC_UPLOAD_PERIOD_LOCKED', opLog, {
|
||||
requestId,
|
||||
details: { reason: message },
|
||||
})
|
||||
}
|
||||
opLog.error('document upload failed', err as Error)
|
||||
return errorResponseFromCode('DOC_UPLOAD_STORAGE_FAILED', opLog, {
|
||||
requestId,
|
||||
details: { reason: err instanceof Error ? err.message : 'unknown' },
|
||||
details: { reason: message },
|
||||
})
|
||||
}
|
||||
},
|
||||
|
||||
@@ -188,6 +188,9 @@ describe('POST /api/invoices (create invoice)', () => {
|
||||
|
||||
// Fetch customer
|
||||
enqueue({ data: customer, error: null })
|
||||
// Fetch company_settings.vat_registered — feeds the helpers so the
|
||||
// allowed-rates set is correct for non-VAT-registered sellers.
|
||||
enqueue({ data: { vat_registered: true }, error: null })
|
||||
// Insert invoice (number is null on insert; allocated immediately after items)
|
||||
enqueue({ data: createdInvoice, error: null })
|
||||
// Insert items
|
||||
@@ -238,6 +241,8 @@ describe('POST /api/invoices (create invoice)', () => {
|
||||
])
|
||||
|
||||
enqueue({ data: customer, error: null })
|
||||
// Fetch company_settings.vat_registered
|
||||
enqueue({ data: { vat_registered: true }, error: null })
|
||||
enqueue({ data: createdInvoice, error: null })
|
||||
// Items insertion fails
|
||||
enqueue({ data: null, error: { message: 'Items insert failed' } })
|
||||
@@ -280,6 +285,8 @@ describe('POST /api/invoices (create invoice)', () => {
|
||||
])
|
||||
|
||||
enqueue({ data: customer, error: null })
|
||||
// Fetch company_settings.vat_registered
|
||||
enqueue({ data: { vat_registered: true }, error: null })
|
||||
enqueue({ data: createdInvoice, error: null })
|
||||
// Items insertion succeeds
|
||||
enqueue({ data: null, error: null })
|
||||
|
||||
@@ -98,7 +98,14 @@ export async function POST(request: Request) {
|
||||
return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
|
||||
}
|
||||
|
||||
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
|
||||
// Match the creation API: a non-VAT-registered seller may not charge VAT
|
||||
// (ML 1 kap. 1§). Coerce instead of rejecting so the preview always renders
|
||||
// — the form may still be carrying a stale 25% selection while the user
|
||||
// hasn't yet noticed the rate picker locked itself. Default `true` mirrors
|
||||
// the API and getVatRules' own default — a NULL column must not silently
|
||||
// strip VAT from a preview the seller is about to send.
|
||||
const vatRegistered = (company as CompanySettings).vat_registered ?? true
|
||||
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated, vatRegistered)
|
||||
|
||||
const docType: InvoiceDocumentType = document_type || 'invoice'
|
||||
const isDeliveryNote = docType === 'delivery_note'
|
||||
@@ -106,7 +113,7 @@ export async function POST(request: Request) {
|
||||
// Build items with line totals and per-item VAT
|
||||
const invoiceItems: InvoiceItem[] = items.map((item: { description: string; quantity: number; unit: string; unit_price: number; vat_rate?: number }, index: number) => {
|
||||
const lineTotal = Math.round(item.quantity * item.unit_price * 100) / 100
|
||||
const rate = item.vat_rate ?? vatRules.rate
|
||||
const rate = vatRegistered ? (item.vat_rate ?? vatRules.rate) : 0
|
||||
return {
|
||||
id: `preview-${index}`,
|
||||
invoice_id: 'preview',
|
||||
|
||||
@@ -119,8 +119,22 @@ export const POST = withRouteContext(
|
||||
})
|
||||
}
|
||||
|
||||
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
|
||||
const availableRates = getAvailableVatRates(customer.customer_type, customer.vat_number_validated)
|
||||
// A non-VAT-registered seller may not charge output VAT (ML 1 kap. 1§).
|
||||
// We pull vat_registered from company_settings and feed it into the rule
|
||||
// helpers so the allowed-rates set collapses to {0} and any non-zero rate
|
||||
// submitted from the client fails INVOICE_CREATE_VAT_RULE_VIOLATION below.
|
||||
// Default to true when the settings row is absent or the column is NULL
|
||||
// — matches the prior implicit behavior (getVatRules' own default) so a
|
||||
// missing settings row never silently blocks legitimate VAT invoices.
|
||||
const { data: companySettings } = await supabase
|
||||
.from('company_settings')
|
||||
.select('vat_registered')
|
||||
.eq('company_id', companyId!)
|
||||
.single()
|
||||
const vatRegistered = companySettings?.vat_registered ?? true
|
||||
|
||||
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated, vatRegistered)
|
||||
const availableRates = getAvailableVatRates(customer.customer_type, customer.vat_number_validated, vatRegistered)
|
||||
const allowedRates = new Set(availableRates.map((r) => r.rate))
|
||||
|
||||
const subtotal = invoiceInput.items.reduce((sum, item) => sum + item.quantity * item.unit_price, 0)
|
||||
|
||||
Reference in New Issue
Block a user