Fix/dependabot cus feedback (#946)
* feat(bookkeeping): per-account default VAT, oresavrundning momsfri Add a per-account "Standard moms" setting to the chart of accounts and use it to auto-fill the moms on a leverantorsfaktura-rad when that konto is picked. Oresavrundning (3740) ships as "Ingen moms", so a rounding line no longer inherits the 25 % rad-default and skews the moms. - chart_of_accounts.default_vat_rate (0/0.06/0.12/0.25, CHECK-constrained) - BEFORE INSERT trigger ships 3740 momsfri on every insert path; backfills existing 3740 rows - kontoplan editor: dead free-text momskod replaced with a Standard moms select - supplier-invoice rad auto-fills the rate from the konto default Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(supplier-invoices): configurable start number for the ankomstnummer series Add a company_settings.next_arrival_number start floor so a company can continue its leverantorsfaktura numbering from a previous system (e.g. Fortnox) instead of restarting the ankomstnummer at 1. get_next_arrival_number now floors the series via GREATEST(MAX(arrival_number)+1, next_arrival_number), so the floor can never move the series backwards or collide with the (company_id, arrival_number) unique index. The RPC is hardened while rewritten: SET search_path to empty, schema-qualified refs, and an auth.uid() membership check matching generate_invoice_number. Includes the settings UI field, sv/en strings, migration, and pg-real coverage. The CompanySettings type and Zod schema field for this feature landed earlier in 1bf3b641 (swept into the per-account VAT commit). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(dependabot): reduce open pull requests limit and group updates for better management --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
b1f85bc33e
commit
bacc5914af
@@ -0,0 +1,54 @@
|
||||
-- Per-account default VAT rate ("Standard moms") on the chart of accounts.
|
||||
--
|
||||
-- Lets a company decide, once per konto, which moms-sats a booking line should
|
||||
-- default to when that konto is picked. The motivating case is oresavrundning
|
||||
-- (konto 3740, Ores- och kronutjamning): a rounding line must never carry moms,
|
||||
-- but the leverantorsfaktura-editor defaulted every rad to 25 %, so the moms and
|
||||
-- the rounding came out wrong. NULL keeps today's behaviour (no auto-fill);
|
||||
-- 0 = ingen moms. Stored as a decimal fraction to match how the app carries VAT
|
||||
-- rates everywhere else (0 / 0.06 / 0.12 / 0.25).
|
||||
|
||||
ALTER TABLE public.chart_of_accounts
|
||||
ADD COLUMN IF NOT EXISTS default_vat_rate numeric;
|
||||
|
||||
-- Constrain to the sats the app understands; NULL stays allowed (no default).
|
||||
ALTER TABLE public.chart_of_accounts
|
||||
DROP CONSTRAINT IF EXISTS chart_of_accounts_default_vat_rate_check;
|
||||
ALTER TABLE public.chart_of_accounts
|
||||
ADD CONSTRAINT chart_of_accounts_default_vat_rate_check
|
||||
CHECK (default_vat_rate IS NULL OR default_vat_rate IN (0, 0.06, 0.12, 0.25));
|
||||
|
||||
COMMENT ON COLUMN public.chart_of_accounts.default_vat_rate IS
|
||||
'Per-account default VAT rate for booking lines (0/0.06/0.12/0.25). NULL = no default. Oresavrundning (3740) ships as 0 (momsfri).';
|
||||
|
||||
-- Existing companies: mark oresavrundning (3740) as momsfri so it stops
|
||||
-- inheriting phantom moms. Only touches rows without an explicit value.
|
||||
UPDATE public.chart_of_accounts
|
||||
SET default_vat_rate = 0
|
||||
WHERE account_number = '3740' AND default_vat_rate IS NULL;
|
||||
|
||||
-- New / imported / on-demand 3740 rows: ship momsfri too, whatever the insert
|
||||
-- path (company seed, SIE import, on-demand backfill, manual add). The chart
|
||||
-- seed function does not write a VAT column and 3740 is added on demand, so a
|
||||
-- BEFORE INSERT default is the one place that covers every path. Fires only
|
||||
-- when the caller left the rate unset, so an explicit choice always wins.
|
||||
CREATE OR REPLACE FUNCTION public.set_known_momsfri_default_vat_rate()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
SET search_path = public
|
||||
AS $$
|
||||
BEGIN
|
||||
IF NEW.default_vat_rate IS NULL AND NEW.account_number = '3740' THEN
|
||||
NEW.default_vat_rate := 0;
|
||||
END IF;
|
||||
RETURN NEW;
|
||||
END;
|
||||
$$;
|
||||
|
||||
DROP TRIGGER IF EXISTS trg_chart_of_accounts_momsfri_default ON public.chart_of_accounts;
|
||||
CREATE TRIGGER trg_chart_of_accounts_momsfri_default
|
||||
BEFORE INSERT ON public.chart_of_accounts
|
||||
FOR EACH ROW
|
||||
EXECUTE FUNCTION public.set_known_momsfri_default_vat_rate();
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
@@ -0,0 +1,67 @@
|
||||
-- Configurable starting number for the supplier-invoice series (ankomstnummer).
|
||||
--
|
||||
-- Mirrors next_invoice_number for customer invoices: lets a company continue
|
||||
-- its leverantorsfaktura numbering from a previous system (e.g. Fortnox) when
|
||||
-- migrating to Accounted, instead of always restarting the ankomstnummer at 1.
|
||||
--
|
||||
-- Design: a start FLOOR, not a consumed counter. get_next_arrival_number keeps
|
||||
-- its self-healing COALESCE(MAX(arrival_number),0)+1 behavior and floors the
|
||||
-- result at next_arrival_number via GREATEST. Consequences:
|
||||
-- * Existing companies default to 1, so MAX+1 is unchanged.
|
||||
-- * Before the first invoice, the series starts at the configured value.
|
||||
-- * Once real invoices pass the floor, MAX+1 dominates: the floor can never
|
||||
-- move the series backwards or collide with the
|
||||
-- (company_id, arrival_number) unique index.
|
||||
--
|
||||
-- The function is also hardened while rewritten (it was SECURITY DEFINER with a
|
||||
-- mutable search_path, flagged by the DB linter): SET search_path = '', all
|
||||
-- references schema-qualified, plus an inline membership check mirroring
|
||||
-- generate_invoice_number. NULL auth.uid() (service role / API-key / cron paths
|
||||
-- that call this RPC) is trusted through.
|
||||
|
||||
ALTER TABLE public.company_settings
|
||||
ADD COLUMN IF NOT EXISTS next_arrival_number integer NOT NULL DEFAULT 1;
|
||||
|
||||
ALTER TABLE public.company_settings
|
||||
DROP CONSTRAINT IF EXISTS company_settings_next_arrival_number_positive;
|
||||
ALTER TABLE public.company_settings
|
||||
ADD CONSTRAINT company_settings_next_arrival_number_positive
|
||||
CHECK (next_arrival_number >= 1);
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.get_next_arrival_number(p_company_id uuid)
|
||||
RETURNS integer
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = ''
|
||||
AS $function$
|
||||
DECLARE
|
||||
v_floor integer;
|
||||
v_next integer;
|
||||
BEGIN
|
||||
-- Defense-in-depth: refuse to operate on companies the caller is not a
|
||||
-- member of. NULL auth.uid() (service role / API-key / cron) is trusted
|
||||
-- through, matching generate_invoice_number.
|
||||
IF auth.uid() IS NOT NULL AND NOT EXISTS (
|
||||
SELECT 1 FROM public.company_members
|
||||
WHERE user_id = auth.uid() AND company_id = p_company_id
|
||||
) THEN
|
||||
RAISE EXCEPTION 'unauthorized: caller is not a member of company %', p_company_id
|
||||
USING ERRCODE = '42501';
|
||||
END IF;
|
||||
|
||||
-- Configured start floor (defaults to 1 for every company; NULL only if the
|
||||
-- settings row is missing, in which case COALESCE keeps the old behavior).
|
||||
SELECT COALESCE(next_arrival_number, 1) INTO v_floor
|
||||
FROM public.company_settings
|
||||
WHERE company_id = p_company_id;
|
||||
|
||||
SELECT GREATEST(COALESCE(MAX(arrival_number), 0) + 1, COALESCE(v_floor, 1))
|
||||
INTO v_next
|
||||
FROM public.supplier_invoices
|
||||
WHERE company_id = p_company_id;
|
||||
|
||||
RETURN v_next;
|
||||
END;
|
||||
$function$;
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
@@ -0,0 +1,108 @@
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import { seedCompany } from '@/tests/pg/fixtures'
|
||||
import { getPool } from '@/tests/pg/setup'
|
||||
|
||||
/**
|
||||
* Locks in the behaviour of chart_of_accounts.default_vat_rate
|
||||
* (migration 20260709120000):
|
||||
*
|
||||
* - a CHECK constraint keeps the rate to the sats the app understands
|
||||
* (0 / 0.06 / 0.12 / 0.25) or NULL;
|
||||
* - a BEFORE INSERT trigger ships öresavrundning (3740) as momsfri (0) on
|
||||
* every insert path (company seed, SIE import, on-demand backfill, manual
|
||||
* add), so a rounding line never inherits phantom moms;
|
||||
* - the trigger only fills an unset rate, so an explicit choice always wins;
|
||||
* - other accounts keep NULL (today's behaviour: no auto-fill).
|
||||
*/
|
||||
|
||||
async function insertAccount(
|
||||
companyId: string,
|
||||
userId: string,
|
||||
account: {
|
||||
number: string
|
||||
name: string
|
||||
type: string
|
||||
balance?: 'debit' | 'credit'
|
||||
rate?: number | null
|
||||
},
|
||||
): Promise<number | null> {
|
||||
const res = await getPool().query<{ default_vat_rate: string | null }>(
|
||||
`INSERT INTO public.chart_of_accounts
|
||||
(user_id, company_id, account_number, account_name, account_class,
|
||||
account_group, account_type, normal_balance, plan_type,
|
||||
is_system_account, default_vat_rate)
|
||||
VALUES ($1, $2, $3, $4, $5, $6, $7, $8, 'full_bas', false, $9)
|
||||
RETURNING default_vat_rate`,
|
||||
[
|
||||
userId,
|
||||
companyId,
|
||||
account.number,
|
||||
account.name,
|
||||
Number(account.number[0]),
|
||||
account.number.slice(0, 2),
|
||||
account.type,
|
||||
account.balance ?? 'debit',
|
||||
account.rate ?? null,
|
||||
],
|
||||
)
|
||||
const raw = res.rows[0].default_vat_rate
|
||||
return raw === null ? null : Number(raw)
|
||||
}
|
||||
|
||||
describe('chart_of_accounts.default_vat_rate', () => {
|
||||
it('ships öresavrundning (3740) as momsfri (0) when the rate is unset', async () => {
|
||||
const { companyId, userId } = await seedCompany()
|
||||
const rate = await insertAccount(companyId, userId, {
|
||||
number: '3740',
|
||||
name: 'Öres- och kronutjämning',
|
||||
type: 'revenue',
|
||||
})
|
||||
expect(rate).toBe(0)
|
||||
})
|
||||
|
||||
it('keeps an explicit rate on 3740 (trigger only fills an unset rate)', async () => {
|
||||
const { companyId, userId } = await seedCompany()
|
||||
const rate = await insertAccount(companyId, userId, {
|
||||
number: '3740',
|
||||
name: 'Öres- och kronutjämning',
|
||||
type: 'revenue',
|
||||
rate: 0.25,
|
||||
})
|
||||
expect(rate).toBe(0.25)
|
||||
})
|
||||
|
||||
it('leaves other accounts with no default (NULL)', async () => {
|
||||
const { companyId, userId } = await seedCompany()
|
||||
const rate = await insertAccount(companyId, userId, {
|
||||
number: '5010',
|
||||
name: 'Lokalhyra',
|
||||
type: 'expense',
|
||||
})
|
||||
expect(rate).toBeNull()
|
||||
})
|
||||
|
||||
it('accepts every allowed sats', async () => {
|
||||
const { companyId, userId } = await seedCompany()
|
||||
for (const [i, r] of [0, 0.06, 0.12, 0.25].entries()) {
|
||||
const rate = await insertAccount(companyId, userId, {
|
||||
number: `60${i}0`,
|
||||
name: `Konto ${i}`,
|
||||
type: 'expense',
|
||||
rate: r,
|
||||
})
|
||||
expect(rate).toBe(r)
|
||||
}
|
||||
})
|
||||
|
||||
it('rejects a rate outside the allowed set (CHECK constraint)', async () => {
|
||||
const { companyId, userId } = await seedCompany()
|
||||
await expect(
|
||||
insertAccount(companyId, userId, {
|
||||
number: '5020',
|
||||
name: 'Felaktig sats',
|
||||
type: 'expense',
|
||||
rate: 0.2,
|
||||
}),
|
||||
).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user