Bug/UI wrong display (#573)

* fix(dashboard): exclude credit notes from unpaid invoices widget Credit notes (status='sent', negative total) were summed into the "Att få betalt" widget, producing confusing negative totals like "2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL, matching the existing pattern in reminder-processor and the AR ledger. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(documents): harden PDF preview and upload validation - JournalEntryAttachments: switch inline PDF preview from <iframe> to <object type="application/pdf">. Mirrors the AttachmentPreviewSheet fix from #572 — Chrome's frame pipeline intermittently surfaced "Det här innehållet har blockerats" on iframes even with permissive CSP. <object> invokes the PDF plugin directly. crbug.com/271452. - /api/documents/:id/inline: resolve Content-Type via file extension when mime_type is null or application/octet-stream. Legacy uploads landed with empty File.type from some drag sources; combined with the new X-Content-Type-Options: nosniff header on this route, Chrome refused to render valid PDFs. Extension fallback covers every legacy row without a DB backfill. - /api/documents POST: surface DB-trigger period-lock errors as a 400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 / "Filen kunde inte sparas") which hid the real cause from users attaching to verifikationer in closed/locked fiscal periods. - document-service: add validateDocumentMagicBytes() that inspects the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates a leading UTF-8 BOM). Wired into uploadDocument() and createNewVersion() so every upload path is protected — UI, MCP, and future email/webhook ingestion. Defends against agents that send a base64-encoded text placeholder instead of real binary bytes via the gnubok_upload_document MCP tool, which produced tiny (15-561 byte) "PDFs" that failed to render in Chrome and in external viewers. Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal Five compliance gaps fixed in the K2 and K3 noter builders: - Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB anskaffningsvärde, tillkommande, avgående, UB and accumulated avskrivningar movement (was only emitting avskrivningstider). - Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §. - Ställda säkerheter and Eventualförpliktelser as separate notes per ÅRL 5:14-15 § (K2 previously combined them). - Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8. Replaces medelantal anställda — the old query filtered employees by an is_active column that doesn't exist, so the note never emitted. Now uses an FTE-weighted day-based average per ÅRL 5:20 §. Six disclosure fields persist on arsredovisning_narratives as per-period overrides; the UI extends the existing förvaltningsberättelse editor with a "Lagstadgade upplysningar" subsection sharing the same Spara button — no new pages, no settings changes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(invoices): respect vat_registered=false and hide personnummer for B2C - PDF address block no longer prints org_number for individual customers (GDPR data minimization; ML 17 kap 24§ requires name + address only). - Wire company_settings.vat_registered through the rule helpers, invoice creation API, preview-pdf API, and the new-invoice form so a non-VAT- registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses the empty "Moms 0%" row and shows a dedicated "Företaget är inte momsregistrerat" notice instead of the ML 3 kap. exempt notice. - Engine unchanged: 'exempt' treatment already routes to 3004/3100 and skips VAT lines. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings): remove approval rules from sidebar and routes * fix(invoices): ensure vat_registered defaults to true for invoice previews and API --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-27 11:01:53 +02:00
parent 32d9978f1b
commit a2a556d837
29 changed files with 1475 additions and 73 deletions
@@ -49,6 +49,11 @@ vi.mock('@/lib/auth/api-keys', () => ({

 import { uploadDocument, createNewVersion, verifyIntegrity, _resetBucketVerified } from '../document-service'

+// A minimal valid PDF byte sequence (header + EOF) — passes magic-byte check.
+function pdfBuffer(payload = 'test'): ArrayBuffer {
+  return new TextEncoder().encode(`%PDF-1.4\n${payload}\n%%EOF\n`).buffer as ArrayBuffer
+}
+
 beforeEach(() => {
  vi.clearAllMocks()
  eventBus.clear()
@@ -73,10 +78,9 @@ describe('uploadDocument', () => {
    eventBus.on('document.uploaded', handler)

    const supabase = makeClient()
-    const buffer = new TextEncoder().encode('test content').buffer
    const result = await uploadDocument(supabase as never, 'user-1', 'company-1', {
      name: 'test.pdf',
-      buffer: buffer as ArrayBuffer,
+      buffer: pdfBuffer('test content'),
      type: 'application/pdf',
    })

@@ -114,10 +118,9 @@ describe('createNewVersion', () => {
    ]

    const supabase = makeClient()
-    const buffer = new TextEncoder().encode('new content').buffer
    const result = await createNewVersion(supabase as never, 'user-1', 'doc-1', {
      name: 'test-v2.pdf',
-      buffer: buffer as ArrayBuffer,
+      buffer: pdfBuffer('new content'),
      type: 'application/pdf',
    })

@@ -57,6 +57,55 @@ export function validateDocumentFile(file: { size: number; type?: string }): str
  return null
 }

+/**
+ * Inspect the first bytes of a buffer to identify the actual file format.
+ * Defends against callers (typically MCP agents) that base64-encode a text
+ * placeholder or summary instead of the real binary file — those uploads
+ * succeed at the storage layer but the bytes are unreadable as a PDF/image.
+ */
+function detectFileMagic(bytes: Uint8Array): string | null {
+  if (bytes.length < 4) return null
+  // PDF: %PDF-  (allow a leading UTF-8 BOM as some tools prepend one)
+  const offset = bytes[0] === 0xEF && bytes[1] === 0xBB && bytes[2] === 0xBF ? 3 : 0
+  if (
+    bytes.length >= offset + 5 &&
+    bytes[offset] === 0x25 &&
+    bytes[offset + 1] === 0x50 &&
+    bytes[offset + 2] === 0x44 &&
+    bytes[offset + 3] === 0x46 &&
+    bytes[offset + 4] === 0x2D
+  ) return 'application/pdf'
+  // PNG: 89 50 4E 47
+  if (bytes[0] === 0x89 && bytes[1] === 0x50 && bytes[2] === 0x4E && bytes[3] === 0x47) return 'image/png'
+  // JPEG: FF D8 FF
+  if (bytes[0] === 0xFF && bytes[1] === 0xD8 && bytes[2] === 0xFF) return 'image/jpeg'
+  // WebP: RIFF<4-byte size>WEBP
+  if (
+    bytes.length >= 12 &&
+    bytes[0] === 0x52 && bytes[1] === 0x49 && bytes[2] === 0x46 && bytes[3] === 0x46 &&
+    bytes[8] === 0x57 && bytes[9] === 0x45 && bytes[10] === 0x42 && bytes[11] === 0x50
+  ) return 'image/webp'
+  return null
+}
+
+/**
+ * Verify the buffer actually contains a file of the declared type.
+ * Returns an error string or null if valid. HEIC has many ftyp brands so
+ * we skip the check for now — the UI path doesn't allow HEIC anyway, only
+ * the MCP upload tool does, and corrupted HEIC has not been observed.
+ */
+export function validateDocumentMagicBytes(buffer: ArrayBuffer, declaredMimeType: string): string | null {
+  if (declaredMimeType === 'image/heic') return null
+  const detected = detectFileMagic(new Uint8Array(buffer))
+  if (!detected) {
+    return `Filinnehållet kunde inte verifieras som ${declaredMimeType}. Filen verkar vara skadad eller inte en riktig binärfil — vid uppladdning via API, kontrollera att file_content_base64 är base64-kodade råbytes, inte en textrepresentation.`
+  }
+  if (detected !== declaredMimeType) {
+    return `Filinnehållet matchar inte den angivna filtypen (förväntade ${declaredMimeType}, hittade ${detected}).`
+  }
+  return null
+}
+
 let bucketVerified = false

 /** @internal Reset bucket verification flag — for testing only */
@@ -113,6 +162,12 @@ export async function uploadDocument(
 ): Promise<DocumentAttachment> {
  await ensureDocumentsBucket()

+  // Reject corrupt uploads at the boundary — see validateDocumentMagicBytes.
+  if (file.type) {
+    const magicError = validateDocumentMagicBytes(file.buffer, file.type)
+    if (magicError) throw new Error(magicError)
+  }
+
  // Compute SHA-256 hash
  const sha256Hash = await computeSHA256(file.buffer)

@@ -186,6 +241,11 @@ export async function createNewVersion(
 ): Promise<DocumentAttachment> {
  await ensureDocumentsBucket()

+  if (file.type) {
+    const magicError = validateDocumentMagicBytes(file.buffer, file.type)
+    if (magicError) throw new Error(magicError)
+  }
+
  // Compute SHA-256 hash
  const sha256Hash = await computeSHA256(file.buffer)