Bug/vat selection warning (#583)

* refactor: update VAT handling logic for non-registered sellers and improve related comments * chore: gate automated email flows behind 503 responses Disables user-facing access to invoice payment reminders and salary payslip email sending. Underlying lib code (reminder-processor, PDF templates, notification_settings) is preserved for easy re-enable. - Invoice reminders cron route returns 503; settings UI section removed. - Payslip send route returns 503; original implementation kept as _sendPayslipsImpl for future re-enable. - Push notifications were already extension-disabled, no change needed. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * chore: remove Recapt feedback widget Strips the third-party Recapt SDK and its floating feedback bubble from the app. The in-app contact form keeps working via the existing email channel (/api/support/contact). Drops the Recapt entries from the CSP and the subprocessor list in the privacy policy. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: reject meaningless rättelser in correctEntry Guard against zero-economic-effect corrections in the storno engine: - Reject when proposed lines net to zero on every account (e.g. 1930 debit 100 / 1930 credit 100), which would erase the original posting without representing any affärshändelse (BFL 5 kap. 5 §). - Reject when proposed lines are an exact multiset match of the original entry — a rättelse must actually change something. New MeaninglessCorrectionError wired through bookkeepingErrorResponse (HTTP 400) and the Swedish error translator. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: add date-range picker to resultat- and balansrapport Adds optional from/to date filtering to the four operational financial reports (resultatrapport, balansrapport, income-statement, balance-sheet) so users can view a month, quarter, or custom range inside a fiscal year without leaving the report. Defaults to YTD; "Hela året" preserves the prior full-period behaviour (URL-identical, cache-stable). - trial-balance engine accepts optional fromDate/toDate, rolling prior in-period activity into IB and clamping period activity to the window - 12 API routes accept and validate from_date/to_date query params - ReportDateRange chip picker persists preset per company, only renders on the four relevant tabs - FiscalYearSelector now emits the period object so the range picker has bounds without an extra fetch - PDF/XLSX filenames reflect the chosen range - Resultatrapport drops the prior-year column when narrowed (full-year vs partial-year would mislead) - 11 new tests (engine + parser); all existing report tests pass Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat: add support for marking journal entries as "no document required" - Introduced a new sidecar table `journal_entry_no_doc_required` to track entries that do not require separate documentation (e.g., bank fees, interest). - Implemented API routes for creating and deleting exemptions, including validation and authorization checks. - Added a toggle component in the UI to allow users to mark entries as exempt, with an optional reason. - Updated relevant tests to cover the new functionality, including RLS checks and cascading deletes. - Enhanced existing schemas and types to accommodate the new `vat_amount` field for supplier invoice items. * fix: address PR review findings on no-doc-required + VAT changes - pg-real cascade test wraps DELETE in gnubok.allow_delete='true' txn so the immutability trigger bypass fires (mirrors delete_last_voucher RPC). - Clamp supplier-invoice item vat_amount to <= line_total * vat_rate via Zod refinement (with 1-öre rounding tolerance) so the manual override can't inflate the 2641 debit beyond the statutory ceiling. - groupVatByRate falls back to line_total * rate when stored vat_amount is 0 with a positive rate, so legacy/import paths leaving the column at its NOT NULL DEFAULT 0 don't silently understate ruta 48. - ReportDateRange todayIso() and preset endpoints use local date components instead of toISOString() (UTC) — fixes the midnight-to-02:00 off-by-one that truncated a day from YTD / this-month / this-quarter for Swedish users. - NoDocRequiredToggle restores the previous reason on failed POST/DELETE so the rolled-back toggle state stays consistent with the rendered reason. - Document the company-scoped (not user-scoped) DELETE authorization policy on the no-document-required route. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-28 01:56:09 +02:00
parent 627109b5bd
commit a9b43ebeb7
73 changed files with 2552 additions and 714 deletions
@@ -0,0 +1,131 @@
+import { randomUUID } from 'node:crypto'
+import { describe, expect, it } from 'vitest'
+import {
+  seedCompany,
+  insertCompanyMember,
+  insertAuthUser,
+  insertDraftJournalEntry,
+} from '@/tests/pg/fixtures'
+import { getPool, withUserContext } from '@/tests/pg/setup'
+
+/**
+ * Covers migration 20260527170000_journal_entry_no_doc_required:
+ *   - Sidecar table accepts inserts via PostgREST (user context)
+ *   - RLS isolates exemptions across companies
+ *   - FK cascade removes the exemption when the parent journal_entry is deleted
+ *   - reason length is capped at 200 chars
+ *   - PRIMARY KEY on journal_entry_id prevents duplicate exemptions
+ */
+
+async function insertExemption(client: {
+  query: (sql: string, params: unknown[]) => Promise<unknown>
+}, params: {
+  journalEntryId: string
+  companyId: string
+  userId: string
+  reason?: string | null
+}) {
+  await client.query(
+    `INSERT INTO public.journal_entry_no_doc_required
+       (journal_entry_id, company_id, user_id, reason)
+     VALUES ($1, $2, $3, $4)`,
+    [params.journalEntryId, params.companyId, params.userId, params.reason ?? null],
+  )
+}
+
+describe('journal_entry_no_doc_required.pg', () => {
+  it('inserts and reads back an exemption row', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+    const entryId = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+
+    await insertExemption(getPool(), {
+      journalEntryId: entryId,
+      companyId,
+      userId,
+      reason: 'Bankavgift',
+    })
+
+    const res = await getPool().query<{ reason: string | null }>(
+      `SELECT reason FROM public.journal_entry_no_doc_required WHERE journal_entry_id = $1`,
+      [entryId],
+    )
+    expect(res.rows).toHaveLength(1)
+    expect(res.rows[0]!.reason).toBe('Bankavgift')
+  })
+
+  it('PK on journal_entry_id blocks duplicate exemptions', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+    const entryId = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+
+    await insertExemption(getPool(), { journalEntryId: entryId, companyId, userId })
+    await expect(
+      insertExemption(getPool(), { journalEntryId: entryId, companyId, userId }),
+    ).rejects.toThrow(/duplicate key|already exists/)
+  })
+
+  it('caps reason at 200 chars', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+    const entryId = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+
+    const longReason = 'x'.repeat(201)
+    await expect(
+      insertExemption(getPool(), {
+        journalEntryId: entryId,
+        companyId,
+        userId,
+        reason: longReason,
+      }),
+    ).rejects.toThrow(/check constraint|violates check/i)
+  })
+
+  it('cascades on delete when the journal_entry is removed', async () => {
+    const { userId, companyId, fiscalPeriodId } = await seedCompany()
+    const entryId = await insertDraftJournalEntry({ userId, companyId, fiscalPeriodId })
+
+    await insertExemption(getPool(), { journalEntryId: entryId, companyId, userId })
+
+    // enforce_journal_entry_immutability blocks DELETE unconditionally; the
+    // delete_last_voucher RPC sets gnubok.allow_delete='true' before deleting.
+    // Mirror that here so the cascade can fire.
+    const client = await getPool().connect()
+    try {
+      await client.query('BEGIN')
+      await client.query(`SELECT set_config('gnubok.allow_delete', 'true', true)`)
+      await client.query(`DELETE FROM public.journal_entries WHERE id = $1`, [entryId])
+      await client.query('COMMIT')
+    } catch (err) {
+      await client.query('ROLLBACK').catch(() => {})
+      throw err
+    } finally {
+      client.release()
+    }
+
+    const res = await getPool().query<{ count: string }>(
+      `SELECT COUNT(*)::text as count FROM public.journal_entry_no_doc_required
+       WHERE journal_entry_id = $1`,
+      [entryId],
+    )
+    expect(res.rows[0]!.count).toBe('0')
+  })
+
+  it('RLS hides exemptions from users in other companies', async () => {
+    // Company A — owner u1, with one exempted entry
+    const { userId: u1, companyId: c1, fiscalPeriodId: fp1 } = await seedCompany()
+    const entryA = await insertDraftJournalEntry({ userId: u1, companyId: c1, fiscalPeriodId: fp1 })
+    await insertExemption(getPool(), { journalEntryId: entryA, companyId: c1, userId: u1 })
+
+    // Company B — owner u2, no overlap with c1
+    const u2 = await insertAuthUser()
+    const { companyId: c2 } = await seedCompany()
+    await insertCompanyMember({ companyId: c2, userId: u2, role: 'owner' })
+
+    // u2 must not see u1's exemption row
+    const visible = await withUserContext(u2, async (client) => {
+      const r = await client.query<{ journal_entry_id: string }>(
+        `SELECT journal_entry_id FROM public.journal_entry_no_doc_required`,
+      )
+      return r.rows
+    })
+    expect(visible.some((r) => r.journal_entry_id === entryA)).toBe(false)
+  })
+})