Skv/e2e overview (#515)

* feat(agi): refactor AGI XML generation and data handling - Remove deprecated AGI field codes from field-codes.ts. - Update generate-declaration.ts to include new employee fields and handle absence data with stable specification numbers. - Enhance XML generation in xml-generator.ts to support new flags for housing benefits and adjusted benefits. - Introduce new database migrations to support: - `removed_from_agi` flag for tombstoning individuppgifter. - `benefits_adjusted` flag for tracking adjustments to benefits. - `franvaro_specifikationsnummer` for stable absence event identification. - `housing_benefit_type` to differentiate between housing benefit types. * feat: Implement strict validation for AGI employee data and introduce pre-flight validation schemas - Added Zod schemas for validating employee data in AGI declarations to ensure all required fields are present and correctly typed, preventing silent errors during processing. - Introduced AGI pre-flight validation schemas for Skatteverket endpoints to validate individual and head unit submissions before sending to the API. - Created a new audit log table for tracking all outbound calls to Skatteverket, ensuring compliance and traceability for AGI and moms submissions. - Implemented advisory locks in the database to manage concurrent updates to absence specification numbers, enhancing data integrity. - Added compliance documentation for GDPR processing activities related to AGI and moms submissions, detailing data handling and retention policies. * feat: Extend DELETE RLS policy to protect 'declined' signatures in årsredovisning * fix: Update date handling in salary absence migrations to use immutable year-month key * fix: Update SELECT policy in skatteverket_api_audit_log to use IN clause for company_id * feat: Add skatteverket_api_audit_log and salary_absence_franvaro_audit tables with RLS policies and immutable triggers
2026-05-17 23:52:49 +02:00
parent f829c96d8b
commit a652dcae1a
15 changed files with 1497 additions and 201 deletions
@@ -0,0 +1,127 @@
+# Record of Processing Activities (GDPR Art. 30)
+#
+# Each entry documents one processing activity. Field shape follows EDPB
+# Guidelines 9/2022 §3 (controller-side RoPA): purposes, lawful basis,
+# data subject + data category, recipients, transfer mechanism, retention,
+# security measures. Add an entry whenever a new flow ships that touches
+# personal data — onboarding, integrations, support, or regulator filings.
+
+processing_activities:
+
+  - id: agi.submit
+    name: AGI inlämning till Skatteverket
+    purpose: >-
+      Lämna in lagstadgad arbetsgivardeklaration på individnivå (AGI) till
+      Skatteverket varje månad (Skatteförfarandelagen 26 kap.). Innefattar
+      huvuduppgift (HU) och individuppgifter (IU) per anställd.
+    lawful_basis: art_6_1_c   # legal obligation
+    special_category_basis: null
+    controller: gnubok-tenant
+    processor: anthropic-na   # software supplier; Skatteverket is recipient, not processor
+    data_subjects:
+      - employee
+    data_categories:
+      - user.government_id          # personnummer
+      - user.name
+      - user.financial.employment   # gross salary, tax withheld, benefits
+      - user.financial.tax          # avgifter, sjuklönekostnad
+    recipients:
+      - name: Skatteverket
+        country: SE
+        role: legal_recipient
+    international_transfers:
+      applicable: false
+      mechanism: null
+      note: >-
+        Sweden-to-Sweden processor-to-public-authority flow. Adequacy decision
+        not applicable; no third-country transfer.
+    retention:
+      duration: 7y
+      basis: bfl_7_kap   # BFL 7 kap. — räkenskapsinformation
+      stored_in:
+        - agi_declarations.xml_content
+        - agi_declarations.individuppgifter
+        - skatteverket_api_audit_log
+    security_measures:
+      - encryption_at_rest_supabase
+      - rls_company_scoped
+      - tls_1_3_to_skatteverket
+      - bankid_signing_required_for_filing
+      - immutable_audit_log
+      - personnummer_at_rest_encryption
+
+  - id: agi.kontrollera.preflight
+    name: AGI pre-flight kontrollera (HU/IU)
+    purpose: >-
+      Skicka enskild HU eller IU som JSON till Skatteverkets kontrollera-
+      ändpunkt (v1.7 §7/§8) för dry-run-validering av felmeddelanden och
+      STOPP-/AVVISANDE-status innan ett fullständigt underlag laddas upp.
+      Skatteverket lagrar inget från denna kontroll; svaret driver vår UI
+      som låter användaren rätta felaktigheter i lönekörningen lokalt.
+    lawful_basis: art_6_1_c   # legal obligation (ancillary to AGI filing)
+    special_category_basis: null
+    controller: gnubok-tenant
+    processor: anthropic-na
+    data_subjects:
+      - employee
+    data_categories:
+      - user.government_id          # personnummer (BetalningsmottagarId)
+      - user.financial.employment   # gross salary, tax withheld, benefits
+    recipients:
+      - name: Skatteverket
+        country: SE
+        role: legal_recipient
+    international_transfers:
+      applicable: false
+      mechanism: null
+      note: Sweden-to-Sweden flow; no third-country transfer.
+    retention:
+      # Skatteverket retains nothing for kontrollera calls. Our outbound
+      # audit row in skatteverket_api_audit_log records who-called-what-when
+      # but NOT the payload body, minimising at-rest footprint.
+      duration: 7y
+      basis: bfl_7_kap
+      stored_in:
+        - skatteverket_api_audit_log
+    security_measures:
+      - strict_zod_allow_list_input_validation
+      - request_size_cap_64kb
+      - rbac_company_member_role_check
+      - rls_company_scoped
+      - tls_1_3_to_skatteverket
+      - immutable_audit_log
+      - no_payload_body_persisted
+
+  - id: moms.declaration
+    name: Momsdeklaration till Skatteverket
+    purpose: >-
+      Lämna in lagstadgad momsdeklaration (utkast, lås och signering) till
+      Skatteverkets momsdeklaration-API (Mervärdesskattelagen 17 kap. 24 §).
+    lawful_basis: art_6_1_c
+    special_category_basis: null
+    controller: gnubok-tenant
+    processor: anthropic-na
+    data_subjects:
+      - business_owner
+    data_categories:
+      - user.government_id          # orgnummer (juridiska personer) eller pnr
+      - user.financial.tax          # rutor 05–62
+    recipients:
+      - name: Skatteverket
+        country: SE
+        role: legal_recipient
+    international_transfers:
+      applicable: false
+      mechanism: null
+      note: Sweden-to-Sweden flow; no third-country transfer.
+    retention:
+      duration: 7y
+      basis: bfl_7_kap
+      stored_in:
+        - extension_data (utkast metadata)
+        - skatteverket_api_audit_log
+    security_measures:
+      - rls_company_scoped
+      - tls_1_3_to_skatteverket
+      - bankid_signing_required_for_filing
+      - immutable_audit_log