feat(bank-sync): close the F2 report: gap backfill, consent and paused chip states, agent-triggered sync (#2165)
* fix(bank-sync): cron backfills the gap since the last successful sync The daily incremental sync always asked the bank for the last 7 days. Any pause longer than that (a lapsed subscription paid again, a consent renewed after expiry, an outage) silently lost the days in between: the connection came back, looked healthy, and the missing transactions never arrived. The lookback now widens to cover the gap since last_synced_at plus one day of overlap, capped at the 90-day PSD2 limit, and a gap of a month or more asks for strategy=longest like the manual sync route does. Dedup via external_id makes the overlap harmless. First syncs keep their 90-day path. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * feat(bank-sync): chip warns seven days before a bank consent expires The transactions-page chip only reacted once a connection was already dead (expired/error) or had gone stale. A consent that is about to end looked healthy until the morning it stopped syncing. New "expiring" state when a live connection's consent_expires is within seven days, the same threshold as the consent-expiry email in the sync cron. Precedence: attention, expiring, stale, healthy. getChipState moves to lib/transactions/bank-sync-chip-state.ts so the precedence is unit-tested; the component keeps the rendering only. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * feat(bank-sync): chip says paused when the subscription lapsed The daily cron filters connections by the bank_sync capability, so a company whose trial or subscription ended keeps status=active rows with a frozen last_synced_at. The chip read that as "stale, check the connection", which sends the user to re-authorise a connection that is perfectly alive. 56 of 191 active connections on prod were in this state on 2026-09-01. New "paused" state, ranked above everything else, when the company lacks bank_sync: hosted points at billing, self-host at the connector key, the same split BankSyncNowButton already makes. getChipState takes an options object so the clock stays out of render (react-hooks/purity). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * feat(api): agent-triggerable bank sync in v1 and MCP Closes the first wish in the F2 report: an integration could read bank data but never refresh it. New POST /api/v1/companies/{id}/bank-connections/ {connectionId}/sync and MCP gnubok_sync_bank, both on a shared runner (extensions/general/enable-banking/lib/trigger-sync.ts). Cost is bounded structurally, not by policy: the window is never caller-controlled (the cron's gap-aware 7 to 90 day lookback), a connection synced within 15 minutes answers BANK_SYNC_COOLDOWN with next_allowed_at (429 + Retry-After on v1; synced=false in-band on MCP so the agent reads on instead of retrying), and a failing connection is throttled per process by attempt time. A dead session is flipped to expired with a remediation that hands the user the connect link: no API call revives a consent. Gated on bank_sync like gnubok_connect_bank; scope transactions:write. Registry, scope map, load-routes, spec snapshot and the generated accounted-api skill updated; five BANK_SYNC_* / BANK_SESSION_EXPIRED codes added to the structured-error registry. The web Synka-nu route is left as is (see DECISIONS.md). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * test(bank-sync): use the options object in the remaining chip-state calls Four multi-line calls still passed the clock positionally after getChipState moved to an options object; tsc flagged them (vitest did not, the extra argument was ignored at runtime). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * fix(api): address skeptic findings on the agent-triggered bank sync Three refutations from the pre-publish skeptic pass: 1. Core imported the extension. The v1 sync route pulled the runner straight from @/extensions, which the core-build gate rejects and which left a live bank endpoint on zero-extension builds. The route now resolves it through the registry's services channel against a contract in lib/bank-sync/trigger-sync-contract.ts (same pattern as the Skatteverket read service) and answers EXTENSION_DISABLED when the extension is absent. 2. The idempotency cache stored the handler-level 429. A same-key retry after Retry-After, which is the documented retry, replayed the stale cooldown as a 400 for the cache's 24-hour TTL. withApiV1 no longer caches 429 responses; regression test added. The endpoint's pitfall no longer claims Idempotency-Key is mandatory (it was never enforced). 3. Two cron tests read the clock twice and failed whenever a millisecond passed between the reads. They now pin the clock with fake timers. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS * fix(bank-sync): durable cooldown lease and review wording Resolves the PR #2165 review findings in one pass. Superagent P1: the attempt throttle was a process-local Map, so two agent calls on different serverless instances (or a retry after a cold start on a failing connection) could each bill an Enable Banking call, contradicting the one-sync-per-15-minutes promise. New bank_connections.sync_lease_until (migration 20260902150000), claimed with one conditional UPDATE before the bank is called; Postgres row locking makes exactly one claimer win, the rest answer BANK_SYNC_COOLDOWN. The lease stays for the full window on success and failure. Tests cover the claim order, a failed attempt seen from a second instance, a lost race, and an expired lease. CodeRabbit: the =1 plural branch now reads "in 1 day" / "om 1 dag" (daysUntilConsentExpiry rounds a partial day up, so "tomorrow" could be today); the cooldown pitfall on the v1 endpoint, the MCP description and the in-band cooldown instruction now say a cooldown can follow a failed attempt and tell the agent to compare last_synced_at before deciding. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub * fix(bank-sync): lease claim as a literal filter for the schema guard CI's no-phantom-columns guard counts runtime-built query expressions and its ceiling is exact; the templated `.or('sync_lease_until.is.null,...')` claim added one. The column now defaults to epoch (NOT NULL), so "never claimed" is just "expired long ago" and the atomic claim is a single literal `.lte('sync_lease_until', now)` the guard can check. Migration is unshipped (same PR), so it is edited in place. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub * fix(bank-sync): runner verifies company membership before the lease Superagent (round 3): the MCP path reached the shared runner without a membership check of its own. Both callers do enforce it upstream (withApiV1's company resolution and resolveMcpCompanyContext in the MCP dispatcher), but the runner writes transactions and bills a bank call, so it now checks company_members itself, before the cooldown and the lease claim, and answers NOT_FOUND for a non-member. The viewer check that was buried inside the sync block moves up with it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
723a0f537b
commit
b68c082ef5
@@ -1,6 +1,6 @@
|
||||
// Vitest Snapshot v1, https://vitest.dev/guide/snapshot.html
|
||||
|
||||
exports[`v1 spec snapshot > matches the recorded endpoint count > endpoint-count 1`] = `144`;
|
||||
exports[`v1 spec snapshot > matches the recorded endpoint count > endpoint-count 1`] = `145`;
|
||||
|
||||
exports[`v1 spec snapshot > matches the recorded endpoint key set > endpoint-keys 1`] = `
|
||||
[
|
||||
@@ -87,6 +87,7 @@ exports[`v1 spec snapshot > matches the recorded endpoint key set > endpoint-key
|
||||
"PATCH /api/v1/companies/:companyId/suppliers/:id",
|
||||
"PATCH /api/v1/companies/:companyId/webhooks/:id",
|
||||
"POST /api/v1/companies",
|
||||
"POST /api/v1/companies/:companyId/bank-connections/:connectionId/sync",
|
||||
"POST /api/v1/companies/:companyId/customers",
|
||||
"POST /api/v1/companies/:companyId/customers/bulk-create",
|
||||
"POST /api/v1/companies/:companyId/dimensions/:id/values",
|
||||
|
||||
@@ -65,6 +65,7 @@ import {
|
||||
} from '@/lib/api/idempotency'
|
||||
import { withApiV1 } from '../with-api-v1'
|
||||
import { dryRunPreview } from '../dry-run'
|
||||
import { v1ErrorResponseFromCode } from '../errors'
|
||||
import { created } from '../response'
|
||||
import { registerEndpoint } from '../registry'
|
||||
|
||||
@@ -340,6 +341,39 @@ describe('withApiV1: idempotent replay of real commits (must not regress)', () =
|
||||
expect(committed).toEqual(['inv-1'])
|
||||
})
|
||||
|
||||
// A handler-level 429 (e.g. bank-connections.sync's cooldown) says "not
|
||||
// now". Caching it would replay the throttle under the same key until the
|
||||
// cache TTL, long after the cooldown itself has passed, and as a 400.
|
||||
it('never caches a 429 so a same-key retry after Retry-After runs the handler', async () => {
|
||||
let calls = 0
|
||||
const route = withApiV1<{ params: Promise<{ companyId: string }> }>(
|
||||
'invoices.create',
|
||||
async (_request, ctx) => {
|
||||
calls += 1
|
||||
if (calls === 1) {
|
||||
return v1ErrorResponseFromCode('RATE_LIMITED', ctx.log, {
|
||||
requestId: ctx.requestId,
|
||||
retryAfterSeconds: 1,
|
||||
})
|
||||
}
|
||||
return created({ id: 'inv-after-cooldown' }, { requestId: ctx.requestId })
|
||||
},
|
||||
{ requireScope: 'invoices:write' },
|
||||
)
|
||||
|
||||
const first = await route(postInvoice({ key: 'key-7' }), companyParams(COMPANY_ID))
|
||||
expect(first.status).toBe(429)
|
||||
expect(mockStoreIdempotency).not.toHaveBeenCalled()
|
||||
|
||||
const second = await route(postInvoice({ key: 'key-7' }), companyParams(COMPANY_ID))
|
||||
expect(second.status).toBe(201)
|
||||
// The real commit is cached as before; only the throttle was not.
|
||||
expect(mockStoreIdempotency).toHaveBeenCalledTimes(1)
|
||||
expect(second.headers.get('Idempotent-Replayed')).toBeNull()
|
||||
expect((await second.json()).data.id).toBe('inv-after-cooldown')
|
||||
expect(calls).toBe(2)
|
||||
})
|
||||
|
||||
it('still rejects the same key carrying a different body', async () => {
|
||||
const { route, committed } = makeInvoiceRoute()
|
||||
|
||||
|
||||
@@ -76,6 +76,7 @@ import '@/app/api/v1/companies/[companyId]/cash-accounts/route'
|
||||
// F2: PSD2 bank-connection health (last_synced_at, consent_expires) so
|
||||
// integrations can detect stale bank data instead of trusting it blindly.
|
||||
import '@/app/api/v1/companies/[companyId]/bank-connections/route'
|
||||
import '@/app/api/v1/companies/[companyId]/bank-connections/[connectionId]/sync/route'
|
||||
|
||||
// Phase 4 PR-1: AP world: suppliers + supplier-invoices verticals.
|
||||
import '@/app/api/v1/companies/[companyId]/suppliers/route'
|
||||
|
||||
@@ -608,7 +608,19 @@ export function withApiV1<P extends DynamicParams = { params: Promise<Record<str
|
||||
// happen, and caching it under a real Idempotency-Key is exactly how
|
||||
// the documented "preview, then commit with the same key" flow used
|
||||
// to lose the commit. A simulation has nothing worth replaying.
|
||||
if (idempotencyKey && isMutation && companyId && !dryRun && response.status < 500) {
|
||||
//
|
||||
// Never cache a 429 either: a throttle says "not now", and replaying
|
||||
// it under the same key would turn a 15-minute cooldown into the
|
||||
// cache's 24-hour TTL (the documented retry is "same request after
|
||||
// Retry-After", which is exactly a same-key retry).
|
||||
if (
|
||||
idempotencyKey &&
|
||||
isMutation &&
|
||||
companyId &&
|
||||
!dryRun &&
|
||||
response.status < 500 &&
|
||||
response.status !== 429
|
||||
) {
|
||||
try {
|
||||
const body = await response.clone().json().catch(() => ({}))
|
||||
const reqHash = buildRequestHash({
|
||||
|
||||
@@ -209,6 +209,7 @@ export const TOOL_SCOPE_MAP: Record<string, ApiKeyScope> = {
|
||||
gnubok_create_company: 'companies:write',
|
||||
gnubok_lookup_company: 'companies:read',
|
||||
gnubok_connect_bank: 'companies:read',
|
||||
gnubok_sync_bank: 'transactions:write',
|
||||
gnubok_connect_skatteverket: 'companies:read',
|
||||
gnubok_connect_migration: 'companies:read',
|
||||
gnubok_get_company_settings: 'companies:read',
|
||||
|
||||
@@ -152,6 +152,9 @@ export const V1_ENDPOINT_SCOPES: Record<string, ApiKeyScope> = {
|
||||
// consent_expires). companies:read, mirroring the MCP gnubok_connect_bank
|
||||
// mapping: connection metadata, no transaction data.
|
||||
'GET /api/v1/companies/:companyId/bank-connections': 'companies:read',
|
||||
// Triggering a sync writes transactions: transactions:write, like the
|
||||
// MCP gnubok_sync_bank twin.
|
||||
'POST /api/v1/companies/:companyId/bank-connections/:connectionId/sync': 'transactions:write',
|
||||
// Reconciliation (legacy bank-only routes; kept as aliases of the
|
||||
// account-keyed routes below, with their original scopes)
|
||||
'POST /api/v1/companies/:companyId/reconciliation/bank/run': 'transactions:write',
|
||||
|
||||
@@ -0,0 +1,68 @@
|
||||
/**
|
||||
* Core <-> Enable Banking extension boundary for the agent-triggered sync.
|
||||
*
|
||||
* `lib/` and `app/api/v1/` cannot import from `@/extensions/` (CI guard,
|
||||
* core-build.yml), so the v1 REST endpoint
|
||||
* POST /companies/{id}/bank-connections/{connectionId}/sync reaches the
|
||||
* runner only through the registry-resolved `services` channel: same
|
||||
* pattern as lib/skatteverket/declaration-status.ts. This module holds the
|
||||
* SHARED shapes so the extension (which may import core freely) and the v1
|
||||
* route agree on the contract without core ever importing the extension.
|
||||
*/
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
|
||||
/** A connection synced more recently than this answers with a cooldown. */
|
||||
export const SYNC_COOLDOWN_MS = 15 * 60 * 1000
|
||||
|
||||
export interface TriggerSyncLogger {
|
||||
info: (message: string, meta?: Record<string, unknown>) => void
|
||||
warn: (message: string, meta?: Record<string, unknown>) => void
|
||||
error: (message: string, meta?: Record<string, unknown>) => void
|
||||
}
|
||||
|
||||
export interface TriggerSyncInput {
|
||||
companyId: string
|
||||
userId: string
|
||||
connectionId: string
|
||||
log: TriggerSyncLogger
|
||||
/** Clock override for tests. */
|
||||
now?: number
|
||||
}
|
||||
|
||||
export type TriggerSyncFailureCode =
|
||||
| 'NOT_FOUND'
|
||||
| 'BANK_SYNC_NOT_ACTIVE'
|
||||
| 'BANK_SYNC_NO_ACCOUNTS'
|
||||
| 'BANK_SYNC_COOLDOWN'
|
||||
| 'BANK_SESSION_EXPIRED'
|
||||
| 'BANK_SYNC_FAILED'
|
||||
|
||||
export type TriggerSyncResult =
|
||||
| {
|
||||
ok: true
|
||||
connection_id: string
|
||||
bank: string | null
|
||||
imported: number
|
||||
duplicates: number
|
||||
from_date: string
|
||||
to_date: string
|
||||
last_synced_at: string
|
||||
}
|
||||
| {
|
||||
ok: false
|
||||
code: TriggerSyncFailureCode
|
||||
connection_id: string
|
||||
status?: string
|
||||
/** ISO timestamp after which a sync is accepted again (cooldown only). */
|
||||
next_allowed_at?: string
|
||||
/** Seconds until next_allowed_at (cooldown only). */
|
||||
retry_after_seconds?: number
|
||||
}
|
||||
|
||||
/** Services the enable-banking extension registers for core callers. */
|
||||
export interface EnableBankingServices {
|
||||
triggerConnectionSync: (
|
||||
supabase: SupabaseClient,
|
||||
input: TriggerSyncInput,
|
||||
) => Promise<TriggerSyncResult>
|
||||
}
|
||||
@@ -29,6 +29,8 @@ const DISPATCH_ONLY_MCP_TOOLS = new Set<string>([
|
||||
// Onboarding connect-link tools: read status + hand out a browser link; no commit counterpart.
|
||||
'gnubok_connect_bank',
|
||||
'gnubok_connect_skatteverket',
|
||||
// Agent-triggered PSD2 sync: inline Enable Banking call, no staged operation.
|
||||
'gnubok_sync_bank',
|
||||
])
|
||||
|
||||
describe('MCP_TOOL_CAPABILITY_MAP', () => {
|
||||
@@ -38,6 +40,7 @@ describe('MCP_TOOL_CAPABILITY_MAP', () => {
|
||||
gnubok_vat_declaration_submit: CAPABILITY.skatteverket,
|
||||
gnubok_agi_submit: CAPABILITY.skatteverket,
|
||||
gnubok_connect_bank: CAPABILITY.bank_sync,
|
||||
gnubok_sync_bank: CAPABILITY.bank_sync,
|
||||
gnubok_connect_skatteverket: CAPABILITY.skatteverket,
|
||||
// Dispatch-only AI tools: inline Bedrock OCR, no staged operation. The
|
||||
// signed-URL pair is gated at create AND complete so a free-tier key can
|
||||
|
||||
@@ -122,9 +122,9 @@ export function isConnectorCapability(key: CapabilityKey): boolean {
|
||||
* The document upload tools invoke AI (Bedrock document OCR via
|
||||
* extractInvoiceFields), so they are gated on CAPABILITY.ai: the same paywall
|
||||
* the HTTP inbox upload/attach/retry paths enforce. Without these entries a
|
||||
* free-tier API key could trigger paid AI extraction. bank_sync gates only
|
||||
* gnubok_connect_bank (the onboarding connect link); the sync itself is
|
||||
* cron/HTTP only.
|
||||
* free-tier API key could trigger paid AI extraction. bank_sync gates
|
||||
* gnubok_connect_bank (the onboarding connect link) and gnubok_sync_bank
|
||||
* (the agent-triggered PSD2 sync, a paid Enable Banking call per account).
|
||||
*/
|
||||
export const MCP_TOOL_CAPABILITY_MAP: Readonly<Partial<Record<string, CapabilityKey>>> = {
|
||||
gnubok_send_invoice: CAPABILITY.email_send,
|
||||
@@ -132,6 +132,8 @@ export const MCP_TOOL_CAPABILITY_MAP: Readonly<Partial<Record<string, Capability
|
||||
gnubok_agi_submit: CAPABILITY.skatteverket,
|
||||
// Onboarding connect-link tools (issue #1814): gated like the links' targets.
|
||||
gnubok_connect_bank: CAPABILITY.bank_sync,
|
||||
// Agent-triggered PSD2 sync: a paid Enable Banking call per account.
|
||||
gnubok_sync_bank: CAPABILITY.bank_sync,
|
||||
gnubok_connect_skatteverket: CAPABILITY.skatteverket,
|
||||
// AI document OCR (Bedrock): the inbox's paid extraction, reachable via MCP.
|
||||
gnubok_create_document_upload: CAPABILITY.ai,
|
||||
|
||||
@@ -1989,6 +1989,48 @@ const BANK_FILE: Record<string, StructuredErrorEntry> = {
|
||||
},
|
||||
}
|
||||
|
||||
/**
|
||||
* Agent-triggered PSD2 sync (v1 bank-connections sync + MCP gnubok_sync_bank).
|
||||
* Emitted by extensions/general/enable-banking/lib/trigger-sync.ts.
|
||||
*/
|
||||
const BANK_SYNC: Record<string, StructuredErrorEntry> = {
|
||||
BANK_SYNC_NOT_ACTIVE: {
|
||||
httpStatus: 409,
|
||||
message_sv: 'Bankanslutningen är inte aktiv och kan inte synkas. Förnya den med BankID i webbläsaren.',
|
||||
message_en: 'The bank connection is not active and cannot be synced. It needs BankID re-authorisation in a browser.',
|
||||
remediation: {
|
||||
description: 'Give the user the connect_url from gnubok_connect_bank (or GET /bank-connections); only they can re-authorise with BankID.',
|
||||
tool: 'gnubok_connect_bank',
|
||||
},
|
||||
},
|
||||
BANK_SYNC_NO_ACCOUNTS: {
|
||||
httpStatus: 409,
|
||||
message_sv: 'Inga konton är valda för synkning. Aktivera minst ett konto under Inställningar, Bank.',
|
||||
message_en: 'No accounts are selected for syncing. The user must enable at least one under Settings, Bank.',
|
||||
},
|
||||
BANK_SYNC_COOLDOWN: {
|
||||
httpStatus: 429,
|
||||
message_sv: 'Anslutningen synkades nyligen. Vänta tills next_allowed_at innan du synkar igen.',
|
||||
message_en: 'This connection was synced recently. Wait until next_allowed_at before syncing again; the data you have is already fresh.',
|
||||
retryable: true,
|
||||
},
|
||||
BANK_SESSION_EXPIRED: {
|
||||
httpStatus: 409,
|
||||
message_sv: 'Bankanslutningen har löpt ut. Förnya anslutningen med BankID för att fortsätta synka.',
|
||||
message_en: 'The bank session has expired. The connection is now marked expired; only the user can renew it with BankID in a browser.',
|
||||
remediation: {
|
||||
description: 'Give the user the connect_url from gnubok_connect_bank (or GET /bank-connections). Do not retry: no API call can revive a dead consent.',
|
||||
tool: 'gnubok_connect_bank',
|
||||
},
|
||||
},
|
||||
BANK_SYNC_FAILED: {
|
||||
httpStatus: 502,
|
||||
message_sv: 'Banksynkningen misslyckades. Försök igen om en stund, eller förnya anslutningen om felet kvarstår.',
|
||||
message_en: 'The bank sync failed upstream. Retry after the cooldown; if it keeps failing the user should renew the connection.',
|
||||
retryable: true,
|
||||
},
|
||||
}
|
||||
|
||||
const SKATTEKONTO_FILE: Record<string, StructuredErrorEntry> = {
|
||||
SKATTEKONTO_FILE_NO_FILE: {
|
||||
httpStatus: 400,
|
||||
@@ -4172,6 +4214,7 @@ const REGISTRY: Record<string, StructuredErrorEntry> = {
|
||||
...TAX_DECL,
|
||||
...SIE_IMPORT,
|
||||
...BANK_FILE,
|
||||
...BANK_SYNC,
|
||||
...SKATTEKONTO_FILE,
|
||||
...OPENING_BALANCE_IMPORT,
|
||||
...REGISTER_IMPORT,
|
||||
|
||||
@@ -0,0 +1,126 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { daysUntilConsentExpiry, getChipState } from '../bank-sync-chip-state'
|
||||
|
||||
const NOW = Date.parse('2026-09-02T08:00:00Z')
|
||||
const HOUR_MS = 60 * 60 * 1000
|
||||
const DAY_MS = 24 * HOUR_MS
|
||||
const at = (msFromNow: number) => new Date(NOW + msFromNow).toISOString()
|
||||
|
||||
function row(overrides: Partial<Parameters<typeof getChipState>[0][number]> = {}) {
|
||||
return {
|
||||
id: 'conn-1',
|
||||
status: 'active',
|
||||
last_synced_at: at(-2 * HOUR_MS),
|
||||
consent_expires: at(60 * DAY_MS),
|
||||
...overrides,
|
||||
}
|
||||
}
|
||||
|
||||
describe('daysUntilConsentExpiry', () => {
|
||||
it('rounds a partial day up so "1 day left" never reads as 0', () => {
|
||||
expect(daysUntilConsentExpiry(at(0.4 * DAY_MS), NOW)).toBe(1)
|
||||
expect(daysUntilConsentExpiry(at(6.5 * DAY_MS), NOW)).toBe(7)
|
||||
})
|
||||
|
||||
it('floors at zero once the consent has passed', () => {
|
||||
expect(daysUntilConsentExpiry(at(-3 * DAY_MS), NOW)).toBe(0)
|
||||
})
|
||||
|
||||
it('is null without a usable timestamp', () => {
|
||||
expect(daysUntilConsentExpiry(null, NOW)).toBeNull()
|
||||
expect(daysUntilConsentExpiry(undefined, NOW)).toBeNull()
|
||||
expect(daysUntilConsentExpiry('nope', NOW)).toBeNull()
|
||||
})
|
||||
})
|
||||
|
||||
describe('getChipState', () => {
|
||||
it('is hidden without connections', () => {
|
||||
expect(getChipState([], { now: NOW })).toEqual({ kind: 'none' })
|
||||
})
|
||||
|
||||
it('reads healthy for a recent sync with a distant consent', () => {
|
||||
expect(getChipState([row()], { now: NOW })).toEqual({ kind: 'healthy', mostRecent: at(-2 * HOUR_MS) })
|
||||
})
|
||||
|
||||
it('warns when a live consent ends within seven days', () => {
|
||||
expect(getChipState([row({ consent_expires: at(7 * DAY_MS) })], { now: NOW })).toEqual({
|
||||
kind: 'expiring',
|
||||
daysLeft: 7,
|
||||
count: 1,
|
||||
})
|
||||
})
|
||||
|
||||
it('stays quiet at eight days', () => {
|
||||
expect(getChipState([row({ consent_expires: at(8 * DAY_MS) })], { now: NOW }).kind).toBe('healthy')
|
||||
})
|
||||
|
||||
it('reports the soonest expiry and how many are affected', () => {
|
||||
const state = getChipState(
|
||||
[
|
||||
row({ id: 'a', consent_expires: at(5 * DAY_MS) }),
|
||||
row({ id: 'b', consent_expires: at(2 * DAY_MS) }),
|
||||
row({ id: 'c', consent_expires: at(30 * DAY_MS) }),
|
||||
],
|
||||
{ now: NOW },
|
||||
)
|
||||
expect(state).toEqual({ kind: 'expiring', daysLeft: 2, count: 2 })
|
||||
})
|
||||
|
||||
it('ranks a dead connection above an expiring one', () => {
|
||||
const state = getChipState(
|
||||
[
|
||||
row({ id: 'a', status: 'expired' }),
|
||||
row({ id: 'b', consent_expires: at(1 * DAY_MS) }),
|
||||
],
|
||||
{ now: NOW },
|
||||
)
|
||||
expect(state).toEqual({ kind: 'attention', count: 1 })
|
||||
})
|
||||
|
||||
it('ranks expiring above stale: the deadline matters more than the age', () => {
|
||||
const state = getChipState(
|
||||
[row({ last_synced_at: at(-3 * DAY_MS), consent_expires: at(3 * DAY_MS) })],
|
||||
{ now: NOW },
|
||||
)
|
||||
expect(state.kind).toBe('expiring')
|
||||
})
|
||||
|
||||
it('ignores the consent on rows that are not live yet', () => {
|
||||
const state = getChipState(
|
||||
[row({ status: 'pending_selection', consent_expires: at(1 * DAY_MS), last_synced_at: null })],
|
||||
{ now: NOW },
|
||||
)
|
||||
expect(state).toEqual({ kind: 'healthy', mostRecent: null })
|
||||
})
|
||||
|
||||
it('reads stale after 36 hours without a sync', () => {
|
||||
expect(getChipState([row({ last_synced_at: at(-37 * HOUR_MS) })], { now: NOW })).toEqual({
|
||||
kind: 'stale',
|
||||
mostRecent: at(-37 * HOUR_MS),
|
||||
})
|
||||
})
|
||||
|
||||
it('reads paused when the company lacks the bank_sync entitlement', () => {
|
||||
// 56 of 191 active connections on prod sat in this state on 2026-09-01:
|
||||
// the cron skips them, so they are neither dead nor merely stale.
|
||||
const state = getChipState([row({ last_synced_at: at(-20 * DAY_MS) })], {
|
||||
now: NOW,
|
||||
hasBankSync: false,
|
||||
})
|
||||
expect(state).toEqual({ kind: 'paused' })
|
||||
})
|
||||
|
||||
it('ranks paused above a dead connection: renewing without a subscription changes nothing', () => {
|
||||
const state = getChipState([row({ status: 'expired' })], { now: NOW, hasBankSync: false })
|
||||
expect(state).toEqual({ kind: 'paused' })
|
||||
})
|
||||
|
||||
it('stays hidden without connections even when unentitled', () => {
|
||||
expect(getChipState([], { now: NOW, hasBankSync: false })).toEqual({ kind: 'none' })
|
||||
})
|
||||
|
||||
it('tolerates rows without the consent column', () => {
|
||||
const state = getChipState([{ id: 'x', status: 'active', last_synced_at: at(-HOUR_MS) }], { now: NOW })
|
||||
expect(state.kind).toBe('healthy')
|
||||
})
|
||||
})
|
||||
@@ -0,0 +1,95 @@
|
||||
/**
|
||||
* State machine for the bank sync status chip on the transactions page.
|
||||
*
|
||||
* Pure module (no React, no fetch) so the precedence between the states is
|
||||
* unit-testable. Precedence, highest first:
|
||||
*
|
||||
* paused the company has no bank_sync entitlement: the cron skips it,
|
||||
* so nothing below applies until the subscription is back
|
||||
* attention a connection is expired or errored: only BankID fixes it
|
||||
* expiring a live consent ends within CONSENT_WARNING_DAYS: renew in time
|
||||
* stale nothing synced for STALE_THRESHOLD_MS: check the connection
|
||||
* healthy synced recently
|
||||
*
|
||||
* The expiring threshold matches the 7-day consent-expiry email in the sync
|
||||
* cron, so the chip and the mail warn on the same day.
|
||||
*/
|
||||
|
||||
export interface ConnectionRow {
|
||||
id: string
|
||||
status: string | null
|
||||
last_synced_at: string | null
|
||||
consent_expires?: string | null
|
||||
}
|
||||
|
||||
export const STALE_THRESHOLD_MS = 36 * 60 * 60 * 1000
|
||||
export const CONSENT_WARNING_DAYS = 7
|
||||
|
||||
const DAY_MS = 24 * 60 * 60 * 1000
|
||||
|
||||
export type ChipState =
|
||||
| { kind: 'none' }
|
||||
| { kind: 'paused' }
|
||||
| { kind: 'attention'; count: number }
|
||||
| { kind: 'expiring'; daysLeft: number; count: number }
|
||||
| { kind: 'stale'; mostRecent: string }
|
||||
| { kind: 'healthy'; mostRecent: string | null }
|
||||
|
||||
/** Whole days until the consent ends, floored at 0; null when unknown. */
|
||||
export function daysUntilConsentExpiry(
|
||||
consentExpires: string | null | undefined,
|
||||
now: number,
|
||||
): number | null {
|
||||
if (!consentExpires) return null
|
||||
const expiresAt = new Date(consentExpires).getTime()
|
||||
if (!Number.isFinite(expiresAt)) return null
|
||||
return Math.max(0, Math.ceil((expiresAt - now) / DAY_MS))
|
||||
}
|
||||
|
||||
export interface ChipStateOptions {
|
||||
/** Clock override for tests; defaults to Date.now() at call time. */
|
||||
now?: number
|
||||
/**
|
||||
* Whether the company holds the bank_sync capability. Without it the daily
|
||||
* cron skips every connection, so rows keep status=active with a frozen
|
||||
* last_synced_at and would otherwise read as a mysterious "stale".
|
||||
*/
|
||||
hasBankSync?: boolean
|
||||
}
|
||||
|
||||
export function getChipState(
|
||||
rows: ConnectionRow[],
|
||||
{ now = Date.now(), hasBankSync = true }: ChipStateOptions = {},
|
||||
): ChipState {
|
||||
if (rows.length === 0) return { kind: 'none' }
|
||||
if (!hasBankSync) return { kind: 'paused' }
|
||||
|
||||
const needsAttention = rows.filter(
|
||||
(r) => r.status === 'expired' || r.status === 'error',
|
||||
)
|
||||
if (needsAttention.length > 0) {
|
||||
return { kind: 'attention', count: needsAttention.length }
|
||||
}
|
||||
|
||||
// Only live connections can be "about to expire": a pending row has no
|
||||
// consent yet, and expired ones were caught above.
|
||||
const expiring = rows
|
||||
.filter((r) => r.status === 'active')
|
||||
.map((r) => daysUntilConsentExpiry(r.consent_expires, now))
|
||||
.filter((d): d is number => d !== null && d <= CONSENT_WARNING_DAYS)
|
||||
if (expiring.length > 0) {
|
||||
return { kind: 'expiring', daysLeft: Math.min(...expiring), count: expiring.length }
|
||||
}
|
||||
|
||||
const mostRecent = rows
|
||||
.map((r) => r.last_synced_at)
|
||||
.filter((s): s is string => Boolean(s))
|
||||
.sort()
|
||||
.pop()
|
||||
|
||||
if (mostRecent && now - new Date(mostRecent).getTime() > STALE_THRESHOLD_MS) {
|
||||
return { kind: 'stale', mostRecent }
|
||||
}
|
||||
|
||||
return { kind: 'healthy', mostRecent: mostRecent ?? null }
|
||||
}
|
||||
Reference in New Issue
Block a user