Bug/vat selection warning (#583)

* refactor: update VAT handling logic for non-registered sellers and improve related comments

* chore: gate automated email flows behind 503 responses

Disables user-facing access to invoice payment reminders and salary
payslip email sending. Underlying lib code (reminder-processor,
PDF templates, notification_settings) is preserved for easy re-enable.

- Invoice reminders cron route returns 503; settings UI section removed.
- Payslip send route returns 503; original implementation kept as
  _sendPayslipsImpl for future re-enable.
- Push notifications were already extension-disabled, no change needed.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* chore: remove Recapt feedback widget

Strips the third-party Recapt SDK and its floating feedback bubble from
the app. The in-app contact form keeps working via the existing email
channel (/api/support/contact). Drops the Recapt entries from the CSP
and the subprocessor list in the privacy policy.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: reject meaningless rättelser in correctEntry

Guard against zero-economic-effect corrections in the storno engine:
- Reject when proposed lines net to zero on every account (e.g. 1930
  debit 100 / 1930 credit 100), which would erase the original posting
  without representing any affärshändelse (BFL 5 kap. 5 §).
- Reject when proposed lines are an exact multiset match of the original
  entry — a rättelse must actually change something.

New MeaninglessCorrectionError wired through bookkeepingErrorResponse
(HTTP 400) and the Swedish error translator.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: add date-range picker to resultat- and balansrapport

Adds optional from/to date filtering to the four operational financial
reports (resultatrapport, balansrapport, income-statement, balance-sheet)
so users can view a month, quarter, or custom range inside a fiscal year
without leaving the report. Defaults to YTD; "Hela året" preserves the
prior full-period behaviour (URL-identical, cache-stable).

- trial-balance engine accepts optional fromDate/toDate, rolling prior
  in-period activity into IB and clamping period activity to the window
- 12 API routes accept and validate from_date/to_date query params
- ReportDateRange chip picker persists preset per company, only renders
  on the four relevant tabs
- FiscalYearSelector now emits the period object so the range picker
  has bounds without an extra fetch
- PDF/XLSX filenames reflect the chosen range
- Resultatrapport drops the prior-year column when narrowed (full-year
  vs partial-year would mislead)
- 11 new tests (engine + parser); all existing report tests pass

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat: add support for marking journal entries as "no document required"

- Introduced a new sidecar table `journal_entry_no_doc_required` to track entries that do not require separate documentation (e.g., bank fees, interest).
- Implemented API routes for creating and deleting exemptions, including validation and authorization checks.
- Added a toggle component in the UI to allow users to mark entries as exempt, with an optional reason.
- Updated relevant tests to cover the new functionality, including RLS checks and cascading deletes.
- Enhanced existing schemas and types to accommodate the new `vat_amount` field for supplier invoice items.

* fix: address PR review findings on no-doc-required + VAT changes

- pg-real cascade test wraps DELETE in gnubok.allow_delete='true' txn so the
  immutability trigger bypass fires (mirrors delete_last_voucher RPC).
- Clamp supplier-invoice item vat_amount to <= line_total * vat_rate via Zod
  refinement (with 1-öre rounding tolerance) so the manual override can't
  inflate the 2641 debit beyond the statutory ceiling.
- groupVatByRate falls back to line_total * rate when stored vat_amount is 0
  with a positive rate, so legacy/import paths leaving the column at its
  NOT NULL DEFAULT 0 don't silently understate ruta 48.
- ReportDateRange todayIso() and preset endpoints use local date components
  instead of toISOString() (UTC) — fixes the midnight-to-02:00 off-by-one
  that truncated a day from YTD / this-month / this-quarter for Swedish
  users.
- NoDocRequiredToggle restores the previous reason on failed POST/DELETE so
  the rolled-back toggle state stays consistent with the rendered reason.
- Document the company-scoped (not user-scoped) DELETE authorization policy
  on the no-document-required route.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
2026-05-28 01:56:09 +02:00
committed by GitHub
co-authored by Claude Opus 4.7
parent 627109b5bd
commit a9b43ebeb7
73 changed files with 2552 additions and 714 deletions
@@ -0,0 +1,157 @@
import { describe, it, expect, vi, beforeEach } from 'vitest'
import {
createMockRequest,
parseJsonResponse,
createMockRouteParams,
createQueuedMockSupabase,
} from '@/tests/helpers'
const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
vi.mock('@/lib/supabase/server', () => ({
createClient: () => Promise.resolve(mockSupabase),
}))
vi.mock('@/lib/company/context', () => ({
requireCompanyId: vi.fn().mockResolvedValue('company-1'),
getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
}))
const mockRequireWrite = vi.fn().mockResolvedValue({ ok: true })
vi.mock('@/lib/auth/require-write', () => ({
requireWritePermission: (...args: unknown[]) => mockRequireWrite(...args),
}))
import { POST, DELETE } from '../route'
const mockUser = { id: 'user-1', email: 'test@test.se' }
describe('POST /api/bookkeeping/journal-entries/[id]/no-document-required', () => {
beforeEach(() => {
vi.clearAllMocks()
reset()
mockRequireWrite.mockResolvedValue({ ok: true })
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
})
it('returns 401 when not authenticated', async () => {
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: { reason: 'Bankavgift' } }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(401)
expect(body).toEqual({ error: 'Unauthorized' })
})
it('returns 403 when the user only has read access', async () => {
mockRequireWrite.mockResolvedValue({
ok: false,
response: new Response(JSON.stringify({ error: 'forbidden' }), {
status: 403,
headers: { 'content-type': 'application/json' },
}),
})
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: {} }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
expect(response.status).toBe(403)
})
it('returns 404 when the entry does not belong to the active company', async () => {
enqueue({ data: null, error: null }) // journal_entries lookup misses
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: { reason: 'Bankavgift' } }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(404)
expect(body).toEqual({ error: 'Verifikationen hittades inte.' })
})
it('rejects a reason longer than 200 chars (Zod validation)', async () => {
const longReason = 'a'.repeat(201)
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: { reason: longReason } }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
expect(response.status).toBe(400)
})
it('upserts the exemption and returns exempted: true', async () => {
enqueue({ data: { id: 'entry-1' }, error: null }) // entry lookup
enqueue({ data: null, error: null }) // upsert
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: { reason: 'Bankavgift' } }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(200)
expect(body).toEqual({ data: { exempted: true } })
})
it('accepts an empty body (no reason)', async () => {
enqueue({ data: { id: 'entry-1' }, error: null })
enqueue({ data: null, error: null })
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'POST', body: {} }
)
const response = await POST(request, createMockRouteParams({ id: 'entry-1' }))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(200)
expect(body).toEqual({ data: { exempted: true } })
})
})
describe('DELETE /api/bookkeeping/journal-entries/[id]/no-document-required', () => {
beforeEach(() => {
vi.clearAllMocks()
reset()
mockRequireWrite.mockResolvedValue({ ok: true })
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
})
it('returns 401 when not authenticated', async () => {
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'DELETE' }
)
const response = await DELETE(request, createMockRouteParams({ id: 'entry-1' }))
expect(response.status).toBe(401)
})
it('returns exempted: false on successful delete', async () => {
enqueue({ data: null, error: null }) // delete
const request = createMockRequest(
'/api/bookkeeping/journal-entries/entry-1/no-document-required',
{ method: 'DELETE' }
)
const response = await DELETE(request, createMockRouteParams({ id: 'entry-1' }))
const { status, body } = await parseJsonResponse(response)
expect(status).toBe(200)
expect(body).toEqual({ data: { exempted: false } })
})
})
@@ -0,0 +1,95 @@
import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { requireCompanyId } from '@/lib/company/context'
import { requireWritePermission } from '@/lib/auth/require-write'
import { z } from 'zod'
import { validateBody } from '@/lib/api/validate'
const SetNoDocSchema = z.object({
reason: z.string().trim().max(200).nullable().optional(),
})
export async function POST(
request: Request,
{ params }: { params: Promise<{ id: string }> }
) {
const { id } = await params
const supabase = await createClient()
const { data: { user } } = await supabase.auth.getUser()
if (!user) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
}
const writeCheck = await requireWritePermission(supabase, user.id)
if (!writeCheck.ok) return writeCheck.response
const companyId = await requireCompanyId(supabase, user.id)
const result = await validateBody(request, SetNoDocSchema)
if (!result.success) return result.response
const { data: entry, error: entryError } = await supabase
.from('journal_entries')
.select('id')
.eq('id', id)
.eq('company_id', companyId)
.maybeSingle()
if (entryError || !entry) {
return NextResponse.json({ error: 'Verifikationen hittades inte.' }, { status: 404 })
}
const { error } = await supabase
.from('journal_entry_no_doc_required')
.upsert(
{
journal_entry_id: id,
company_id: companyId,
user_id: user.id,
reason: result.data.reason ?? null,
},
{ onConflict: 'journal_entry_id' }
)
if (error) {
return NextResponse.json({ error: error.message }, { status: 400 })
}
return NextResponse.json({ data: { exempted: true } })
}
export async function DELETE(
_request: Request,
{ params }: { params: Promise<{ id: string }> }
) {
const { id } = await params
const supabase = await createClient()
const { data: { user } } = await supabase.auth.getUser()
if (!user) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
}
const writeCheck = await requireWritePermission(supabase, user.id)
if (!writeCheck.ok) return writeCheck.response
const companyId = await requireCompanyId(supabase, user.id)
// Authorization is company-scoped, not user-scoped: any non-viewer member
// of the active company may revoke any exemption in that company. The flag
// is a shared bookkeeping artefact (same model as booking_template_library,
// mapping_rules, etc.) — exemptions are reviewed as a team. The audit_log
// trigger captures the DELETE with actor_id so accountability is preserved.
const { error } = await supabase
.from('journal_entry_no_doc_required')
.delete()
.eq('journal_entry_id', id)
.eq('company_id', companyId)
if (error) {
return NextResponse.json({ error: error.message }, { status: 400 })
}
return NextResponse.json({ data: { exempted: false } })
}
@@ -0,0 +1,32 @@
import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { requireCompanyId } from '@/lib/company/context'
import { fetchAllRows } from '@/lib/supabase/fetch-all'
/**
* Returns the set of journal_entry IDs in the active company that the user has
* flagged as "no underlag required". The client uses this set to:
* - exclude exempted entries from the "Saknade underlag" filter
* - show a muted "no doc needed" indicator instead of the warning triangle
*/
export async function GET() {
const supabase = await createClient()
const { data: { user } } = await supabase.auth.getUser()
if (!user) {
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
}
const companyId = await requireCompanyId(supabase, user.id)
const rows = await fetchAllRows<{ journal_entry_id: string; reason: string | null }>(
({ from, to }) =>
supabase
.from('journal_entry_no_doc_required')
.select('journal_entry_id, reason')
.eq('company_id', companyId)
.range(from, to)
)
return NextResponse.json({ data: rows })
}
-7
View File
@@ -188,9 +188,6 @@ describe('POST /api/invoices (create invoice)', () => {
// Fetch customer
enqueue({ data: customer, error: null })
// Fetch company_settings.vat_registered — feeds the helpers so the
// allowed-rates set is correct for non-VAT-registered sellers.
enqueue({ data: { vat_registered: true }, error: null })
// Insert invoice (number is null on insert; allocated immediately after items)
enqueue({ data: createdInvoice, error: null })
// Insert items
@@ -241,8 +238,6 @@ describe('POST /api/invoices (create invoice)', () => {
])
enqueue({ data: customer, error: null })
// Fetch company_settings.vat_registered
enqueue({ data: { vat_registered: true }, error: null })
enqueue({ data: createdInvoice, error: null })
// Items insertion fails
enqueue({ data: null, error: { message: 'Items insert failed' } })
@@ -285,8 +280,6 @@ describe('POST /api/invoices (create invoice)', () => {
])
enqueue({ data: customer, error: null })
// Fetch company_settings.vat_registered
enqueue({ data: { vat_registered: true }, error: null })
enqueue({ data: createdInvoice, error: null })
// Items insertion succeeds
enqueue({ data: null, error: null })
+6 -9
View File
@@ -98,14 +98,11 @@ export async function POST(request: Request) {
return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
}
// Match the creation API: a non-VAT-registered seller may not charge VAT
// (ML 1 kap. 1§). Coerce instead of rejecting so the preview always renders
// — the form may still be carrying a stale 25% selection while the user
// hasn't yet noticed the rate picker locked itself. Default `true` mirrors
// the API and getVatRules' own default — a NULL column must not silently
// strip VAT from a preview the seller is about to send.
const vatRegistered = (company as CompanySettings).vat_registered ?? true
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated, vatRegistered)
// VAT rules are customer-type-driven; the seller's registration status no
// longer constrains the preview. A non-momsregistrerad seller who chose a
// non-zero rate sees the rate they picked rendered — the form surfaces the
// ML 16 kap. 23 § warning at submit time.
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
const docType: InvoiceDocumentType = document_type || 'invoice'
const isDeliveryNote = docType === 'delivery_note'
@@ -113,7 +110,7 @@ export async function POST(request: Request) {
// Build items with line totals and per-item VAT
const invoiceItems: InvoiceItem[] = items.map((item: { description: string; quantity: number; unit: string; unit_price: number; vat_rate?: number }, index: number) => {
const lineTotal = Math.round(item.quantity * item.unit_price * 100) / 100
const rate = vatRegistered ? (item.vat_rate ?? vatRules.rate) : 0
const rate = item.vat_rate ?? vatRules.rate
return {
id: `preview-${index}`,
invoice_id: 'preview',
+2 -35
View File
@@ -1,42 +1,9 @@
import { NextResponse } from 'next/server'
import { processOverdueReminders } from '@/lib/invoices/reminder-processor'
import { getEmailService } from '@/lib/email/service'
import { withCronContext } from '@/lib/api/with-cron-context'
import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
/**
* GET/POST /api/invoices/reminders/cron — daily 08:00 UTC.
* Sends overdue invoice reminders. POST exists so the dashboard can
* trigger a run manually.
*/
export const GET = withCronContext('cron.invoice_reminders', async (_request, ctx) => {
if (!getEmailService().isConfigured()) {
ctx.log.error('email service not configured; skipping reminder run')
return errorResponseFromCode('INVOICE_SEND_EMAIL_NOT_CONFIGURED', ctx.log, {
requestId: ctx.requestId,
})
}
const result = await processOverdueReminders()
ctx.log.info('reminder cron summary', {
processed: result.processed,
sent: result.sent,
failed: result.failed,
})
return NextResponse.json({
success: true,
processed: result.processed,
sent: result.sent,
failed: result.failed,
results: result.results.map((r) => ({
invoiceNumber: r.invoiceNumber,
reminderLevel: r.reminderLevel,
success: r.success,
error: r.error,
})),
})
ctx.log.info('invoice reminders feature is disabled; skipping run')
return NextResponse.json({ disabled: true }, { status: 503 })
})
export const POST = GET
+2 -16
View File
@@ -119,22 +119,8 @@ export const POST = withRouteContext(
})
}
// A non-VAT-registered seller may not charge output VAT (ML 1 kap. 1§).
// We pull vat_registered from company_settings and feed it into the rule
// helpers so the allowed-rates set collapses to {0} and any non-zero rate
// submitted from the client fails INVOICE_CREATE_VAT_RULE_VIOLATION below.
// Default to true when the settings row is absent or the column is NULL
// — matches the prior implicit behavior (getVatRules' own default) so a
// missing settings row never silently blocks legitimate VAT invoices.
const { data: companySettings } = await supabase
.from('company_settings')
.select('vat_registered')
.eq('company_id', companyId!)
.single()
const vatRegistered = companySettings?.vat_registered ?? true
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated, vatRegistered)
const availableRates = getAvailableVatRates(customer.customer_type, customer.vat_number_validated, vatRegistered)
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
const availableRates = getAvailableVatRates(customer.customer_type, customer.vat_number_validated)
const allowedRates = new Set(availableRates.map((r) => r.rate))
const subtotal = invoiceInput.items.reduce((sum, item) => sum + item.quantity * item.unit_price, 0)
+12 -3
View File
@@ -4,6 +4,7 @@ import { renderToBuffer } from '@react-pdf/renderer'
import { generateBalanceSheet } from '@/lib/reports/balance-sheet'
import { FinancialStatementPDF } from '@/lib/reports/financial-statement-pdf-template'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import type { CompanySettings } from '@/types'
export async function GET(request: Request) {
@@ -49,9 +50,17 @@ export async function GET(request: Request) {
)
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
const range = parsedRange.range
const effectiveStart = range.fromDate ?? period.period_start
const effectiveEnd = range.toDate ?? period.period_end
try {
const report = await generateBalanceSheet(supabase, companyId, periodId)
report.period = { start: period.period_start, end: period.period_end }
const report = await generateBalanceSheet(supabase, companyId, periodId, range)
report.period = { start: effectiveStart, end: effectiveEnd }
const totalAssets = report.total_assets
const totalEquityLiab = report.total_equity_liabilities
@@ -98,7 +107,7 @@ export async function GET(request: Request) {
// "-utkast" suffix keeps the draft status visible even after the file
// leaves the browser — complements the in-document ÅRL 2:7 disclaimer.
const filename = `balansrakning-${report.period.start}-utkast.pdf`
const filename = `balansrakning-${report.period.start}--${report.period.end}-utkast.pdf`
return new Response(new Uint8Array(pdfBuffer), {
headers: {
+13 -3
View File
@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
import { generateBalanceSheet } from '@/lib/reports/balance-sheet'
import { withRouteContext } from '@/lib/api/with-route-context'
import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
import { parseReportDateRange } from '@/lib/reports/date-range'
export const GET = withRouteContext(
'report.balance_sheet',
@@ -24,13 +25,22 @@ export const GET = withRouteContext(
.eq('company_id', companyId)
.single()
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const result = await generateBalanceSheet(supabase, companyId!, periodId)
const result = await generateBalanceSheet(supabase, companyId!, periodId, range)
if (period) {
result.period = {
start: period.period_start,
end: period.period_end,
start: range.fromDate ?? period.period_start,
end: range.toDate ?? period.period_end,
}
}
+10 -2
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateBalanceSheet } from '@/lib/reports/balance-sheet'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import {
reportToWorkbook,
textColumn,
@@ -52,8 +53,15 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'Räkenskapsperioden kunde inte läsas.' }, { status: 400 })
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
const range = parsedRange.range
const effectiveEnd = range.toDate ?? period.period_end
try {
const report = await generateBalanceSheet(supabase, companyId, periodId)
const report = await generateBalanceSheet(supabase, companyId, periodId, range)
// Flatten nested sections into a single tabular view, mirroring how the
// PDF lays them out: each section's rows followed by a subtotal line, with
@@ -137,7 +145,7 @@ export async function GET(request: Request) {
},
])
const filename = xlsxFilename('balansrakning', companyRow?.company_name ?? '', period.period_end)
const filename = xlsxFilename('balansrakning', companyRow?.company_name ?? '', effectiveEnd)
return new NextResponse(new Uint8Array(buffer), {
headers: {
'Content-Type': 'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
+8 -2
View File
@@ -4,6 +4,7 @@ import { renderToBuffer } from '@react-pdf/renderer'
import { generateBalansrapport } from '@/lib/reports/balansrapport'
import { BalansrapportPDF } from '@/lib/reports/operational-report-pdf-template'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import type { CompanySettings } from '@/types'
export async function GET(request: Request) {
@@ -47,8 +48,13 @@ export async function GET(request: Request) {
)
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
try {
const report = await generateBalansrapport(supabase, companyId, periodId)
const report = await generateBalansrapport(supabase, companyId, periodId, parsedRange.range)
const pdfBuffer = await renderToBuffer(
BalansrapportPDF({
@@ -62,7 +68,7 @@ export async function GET(request: Request) {
// report PDF route in this repo (resultatrapport, balance-sheet,
// income-statement). A balansrapport is a snapshot at period end, but
// consistent filenames let users sort and script-rename predictably.
const filename = `balansrapport-${report.period.start}.pdf`
const filename = `balansrapport-${report.period.start}--${report.period.end}.pdf`
return new Response(new Uint8Array(pdfBuffer), {
headers: {
+18 -1
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateBalansrapport } from '@/lib/reports/balansrapport'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
export async function GET(request: Request) {
const supabase = await createClient()
@@ -20,8 +21,24 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
}
const { data: period } = await supabase
.from('fiscal_periods')
.select('period_start, period_end')
.eq('id', periodId)
.eq('company_id', companyId)
.single()
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const result = await generateBalansrapport(supabase, companyId, periodId)
const result = await generateBalansrapport(supabase, companyId, periodId, range)
return NextResponse.json({ data: result })
} catch (err) {
return NextResponse.json(
+24 -6
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateBalansrapport } from '@/lib/reports/balansrapport'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import {
reportToWorkbook,
textColumn,
@@ -35,14 +36,31 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
}
const { data: companyRow } = await supabase
.from('company_settings')
.select('company_name')
.eq('company_id', companyId)
.single()
const [{ data: companyRow }, { data: period }] = await Promise.all([
supabase
.from('company_settings')
.select('company_name')
.eq('company_id', companyId)
.single(),
supabase
.from('fiscal_periods')
.select('period_start, period_end')
.eq('id', periodId)
.eq('company_id', companyId)
.single(),
])
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const report = await generateBalansrapport(supabase, companyId, periodId)
const report = await generateBalansrapport(supabase, companyId, periodId, range)
const rows: FlatRow[] = []
for (const g of report.groups) {
+12 -3
View File
@@ -4,6 +4,7 @@ import { renderToBuffer } from '@react-pdf/renderer'
import { generateIncomeStatement } from '@/lib/reports/income-statement'
import { FinancialStatementPDF, type FinancialStatementGroup, type FinancialStatementSection, type FinancialStatementSummaryRow } from '@/lib/reports/financial-statement-pdf-template'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import type { CompanySettings } from '@/types'
// K2/K3 uppställningsform (ÅRL bilaga 2, kostnadsslagsindelad) splits class 8
@@ -71,9 +72,17 @@ export async function GET(request: Request) {
)
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
const range = parsedRange.range
const effectiveStart = range.fromDate ?? period.period_start
const effectiveEnd = range.toDate ?? period.period_end
try {
const report = await generateIncomeStatement(supabase, companyId, periodId)
report.period = { start: period.period_start, end: period.period_end }
const report = await generateIncomeStatement(supabase, companyId, periodId, range)
report.period = { start: effectiveStart, end: effectiveEnd }
const operatingResult = Math.round((report.total_revenue - report.total_expenses) * 100) / 100
@@ -198,7 +207,7 @@ export async function GET(request: Request) {
// "-utkast" suffix keeps the draft status visible even after the file
// leaves the browser — complements the in-document ÅRL 2:7 disclaimer.
const filename = `resultatrakning-${report.period.start}-utkast.pdf`
const filename = `resultatrakning-${report.period.start}--${report.period.end}-utkast.pdf`
return new Response(new Uint8Array(pdfBuffer), {
headers: {
+13 -3
View File
@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
import { generateIncomeStatement } from '@/lib/reports/income-statement'
import { withRouteContext } from '@/lib/api/with-route-context'
import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
import { parseReportDateRange } from '@/lib/reports/date-range'
export const GET = withRouteContext(
'report.income_statement',
@@ -24,13 +25,22 @@ export const GET = withRouteContext(
.eq('company_id', companyId)
.single()
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const result = await generateIncomeStatement(supabase, companyId!, periodId)
const result = await generateIncomeStatement(supabase, companyId!, periodId, range)
if (period) {
result.period = {
start: period.period_start,
end: period.period_end,
start: range.fromDate ?? period.period_start,
end: range.toDate ?? period.period_end,
}
}
+10 -2
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateIncomeStatement } from '@/lib/reports/income-statement'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import {
reportToWorkbook,
textColumn,
@@ -84,8 +85,15 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'Räkenskapsperioden kunde inte läsas.' }, { status: 400 })
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
const range = parsedRange.range
const effectiveEnd = range.toDate ?? period.period_end
try {
const report = await generateIncomeStatement(supabase, companyId, periodId)
const report = await generateIncomeStatement(supabase, companyId, periodId, range)
const revenueRows = flatten(
report.revenue_sections,
@@ -139,7 +147,7 @@ export async function GET(request: Request) {
const filename = xlsxFilename(
'resultatrakning',
companyRow?.company_name ?? '',
period.period_end,
effectiveEnd,
)
return new NextResponse(new Uint8Array(buffer), {
headers: {
+8 -2
View File
@@ -4,6 +4,7 @@ import { renderToBuffer } from '@react-pdf/renderer'
import { generateResultatrapport } from '@/lib/reports/resultatrapport'
import { ResultatrapportPDF } from '@/lib/reports/operational-report-pdf-template'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import type { CompanySettings } from '@/types'
export async function GET(request: Request) {
@@ -49,8 +50,13 @@ export async function GET(request: Request) {
)
}
const parsedRange = parseReportDateRange(searchParams, period)
if (!parsedRange.ok) {
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
}
try {
const report = await generateResultatrapport(supabase, companyId, periodId)
const report = await generateResultatrapport(supabase, companyId, periodId, parsedRange.range)
const pdfBuffer = await renderToBuffer(
ResultatrapportPDF({
@@ -60,7 +66,7 @@ export async function GET(request: Request) {
})
)
const filename = `resultatrapport-${report.period.start}.pdf`
const filename = `resultatrapport-${report.period.start}--${report.period.end}.pdf`
return new Response(new Uint8Array(pdfBuffer), {
headers: {
+18 -1
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateResultatrapport } from '@/lib/reports/resultatrapport'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
export async function GET(request: Request) {
const supabase = await createClient()
@@ -20,8 +21,24 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
}
const { data: period } = await supabase
.from('fiscal_periods')
.select('period_start, period_end')
.eq('id', periodId)
.eq('company_id', companyId)
.single()
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const result = await generateResultatrapport(supabase, companyId, periodId)
const result = await generateResultatrapport(supabase, companyId, periodId, range)
return NextResponse.json({ data: result })
} catch (err) {
return NextResponse.json(
+24 -6
View File
@@ -2,6 +2,7 @@ import { createClient } from '@/lib/supabase/server'
import { NextResponse } from 'next/server'
import { generateResultatrapport } from '@/lib/reports/resultatrapport'
import { requireCompanyId } from '@/lib/company/context'
import { parseReportDateRange } from '@/lib/reports/date-range'
import {
reportToWorkbook,
textColumn,
@@ -34,14 +35,31 @@ export async function GET(request: Request) {
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
}
const { data: companyRow } = await supabase
.from('company_settings')
.select('company_name')
.eq('company_id', companyId)
.single()
const [{ data: companyRow }, { data: period }] = await Promise.all([
supabase
.from('company_settings')
.select('company_name')
.eq('company_id', companyId)
.single(),
supabase
.from('fiscal_periods')
.select('period_start, period_end')
.eq('id', periodId)
.eq('company_id', companyId)
.single(),
])
let range: { fromDate?: string; toDate?: string } = {}
if (period) {
const parsed = parseReportDateRange(searchParams, period)
if (!parsed.ok) {
return NextResponse.json({ error: parsed.error }, { status: 400 })
}
range = parsed.range
}
try {
const report = await generateResultatrapport(supabase, companyId, periodId)
const report = await generateResultatrapport(supabase, companyId, periodId, range)
const rows: FlatRow[] = []
for (const g of report.groups) {
@@ -18,7 +18,17 @@ ensureInitialized()
* Per BFL 7 kap: Delivery confirmation retained as part of audit trail.
*/
export async function POST(
request: Request,
_request: Request,
{ params }: { params: Promise<{ id: string }> }
) {
await params
return NextResponse.json({ error: 'Funktionen är inaktiverad' }, { status: 503 })
}
// Implementation preserved but unreachable — feature disabled at the export above.
// To re-enable, replace the POST export above with this function body.
async function _sendPayslipsImpl(
_request: Request,
{ params }: { params: Promise<{ id: string }> }
) {
const { id } = await params
@@ -560,6 +560,94 @@ describe('POST /api/supplier-invoices', () => {
expect(call[5]).toBe('enskild_firma')
})
it('persists manual vat_amount override on items and forwards it to the engine', async () => {
// Bilförmån-fallet: leverantören tar 25% moms men endast 50% är
// avdragsgill. Användaren skriver 1 250 kr i momsrutan i stället för
// den beräknade 2 500 kr.
const supplier = makeSupplier({ id: VALID_UUID })
const createdInvoice = makeSupplierInvoice({ id: 'si-1' })
enqueue({ data: supplier, error: null })
enqueue({ data: 7 })
enqueue({ data: createdInvoice, error: null })
enqueue({ data: null, error: null })
enqueue({ data: { accounting_method: 'accrual' }, error: null })
mockCreateSupplierInvoiceRegistrationEntry.mockResolvedValue({ id: 'je-1' })
enqueue({ data: null, error: null })
const request = createMockRequest('/api/supplier-invoices', {
method: 'POST',
body: {
supplier_id: VALID_UUID,
supplier_invoice_number: 'LEAS-001',
invoice_date: '2024-06-01',
due_date: '2024-07-01',
items: [
{
description: 'Leasing personbil',
amount: 10000,
account_number: '5615',
vat_rate: 0.25,
vat_amount: 1250,
},
],
},
})
const response = await POST(request)
const { status } = await parseJsonResponse(response)
expect(status).toBe(200)
expect(mockCreateSupplierInvoiceRegistrationEntry).toHaveBeenCalled()
const items = mockCreateSupplierInvoiceRegistrationEntry.mock.calls[0][4] as Array<{
vat_amount: number
vat_rate: number
line_total: number
}>
expect(items).toHaveLength(1)
expect(items[0].vat_amount).toBe(1250)
expect(items[0].vat_rate).toBe(0.25)
expect(items[0].line_total).toBe(10000)
})
it('falls back to line_total × rate when vat_amount is omitted', async () => {
const supplier = makeSupplier({ id: VALID_UUID })
const createdInvoice = makeSupplierInvoice({ id: 'si-1' })
enqueue({ data: supplier, error: null })
enqueue({ data: 8 })
enqueue({ data: createdInvoice, error: null })
enqueue({ data: null, error: null })
enqueue({ data: { accounting_method: 'accrual' }, error: null })
mockCreateSupplierInvoiceRegistrationEntry.mockResolvedValue({ id: 'je-1' })
enqueue({ data: null, error: null })
const request = createMockRequest('/api/supplier-invoices', {
method: 'POST',
body: {
supplier_id: VALID_UUID,
supplier_invoice_number: 'LF-001',
invoice_date: '2024-06-01',
due_date: '2024-07-01',
items: [
{
description: 'Material',
amount: 10000,
account_number: '4010',
vat_rate: 0.25,
},
],
},
})
const response = await POST(request)
const { status } = await parseJsonResponse(response)
expect(status).toBe(200)
const items = mockCreateSupplierInvoiceRegistrationEntry.mock.calls[0][4] as Array<{
vat_amount: number
}>
expect(items[0].vat_amount).toBe(2500)
})
it('rejects paid_with_private_funds combined with reverse_charge', async () => {
const request = createMockRequest('/api/supplier-invoices', {
method: 'POST',
+6 -1
View File
@@ -115,7 +115,12 @@ export const POST = withRouteContext(
const lineTotal = item.amount != null
? Math.round(item.amount * 100) / 100
: Math.round((item.quantity ?? 1) * (item.unit_price ?? 0) * 100) / 100
const vatAmount = Math.round(lineTotal * vatRate * 100) / 100
// Honor a manual VAT override (partial-deduction cases, foreign-currency
// rounding, supplier-side POS rounding). Falls back to line_total × rate
// when the caller didn't supply one.
const vatAmount = item.vat_amount != null
? Math.round(item.vat_amount * 100) / 100
: Math.round(lineTotal * vatRate * 100) / 100
return {
sort_order: index,
description: item.description,