feat(invoicing): artikelregister (product/article catalog) with per-article revenue account (#703)

* feat(invoicing): artikelregister (product/article catalog) with per-article revenue account Add a lean, non-inventory article catalog (artikelregister) so users can define reusable invoice-line presets (name, unit, price excl VAT, VAT rate) with an optional per-article BAS class-3 revenue-account override. - DB: articles table (RLS via user_company_ids(), audit + updated_at triggers, unique-per-company article_number), generate_article_number RPC (atomic + idempotent), company_settings counter, nullable invoice_items.revenue_account + article_id, pending_operations CHECK expansion. - Engine: generatePerRateLines groups revenue by (vat_rate, account) — byte-identical with no override, balance-safe when split (last account absorbs the rounding remainder), reverse_charge/export still force 3308/3305. - API: /api/articles CRUD (soft-deactivate); override validated against chart_of_accounts (active class-3) and frozen onto invoice lines at create. - Propagation: override carried through send/mark-sent/credit/convert/cash and the staged commit paths (recurring deferred — documented inline). - MCP: gnubok_list/create/update_article (staged, scoped, risk-tiered). - UI: articles register (list/detail/form) + nav + bilingual i18n + invoice-line article picker & "Spara som artikel" quick-create. - Tests: engine regression, route, and pg-real (RPC/RLS/triggers). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): strip ILIKE _ wildcard from gnubok_list_articles search Underscore is a single-character ILIKE wildcard; stripping it (alongside the existing %,()\* set) keeps a stray char in the article search from matching every row. Read-only + RLS-scoped, so no security impact — addresses PR #703 reviewer + compliance-swarm CC6.3 notes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09 21:05:37 +02:00
parent 07ecb98389
commit c0b006fcc1
32 changed files with 3047 additions and 16 deletions
@@ -0,0 +1,73 @@
+/**
+ * Tests for GET/PATCH/DELETE /api/articles/[id] (artikelregister).
+ *
+ * DELETE soft-deactivates (active = false) rather than hard-deleting, so the
+ * article and its number survive for history. PATCH is a sparse update.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createQueuedMockSupabase, createMockRequest, createMockRouteParams, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const requireWriteMock = vi.fn()
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: (...args: unknown[]) => requireWriteMock(...args),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { GET, PATCH, DELETE } from '../[id]/route'
+
+describe('GET/PATCH/DELETE /api/articles/[id]', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    reset()
+    requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+    requireWriteMock.mockResolvedValue({ ok: true })
+  })
+
+  it('GET returns 404 when the article is not found', async () => {
+    enqueue({ data: null, error: { code: 'PGRST116', message: 'not found' } })
+
+    const response = await GET(createMockRequest('/api/articles/a1'), createMockRouteParams({ id: 'a1' }))
+    const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+    expect(status).toBe(404)
+    expect(body.error.code).toBe('ARTICLE_NOT_FOUND')
+  })
+
+  it('PATCH updates a field and returns the row', async () => {
+    enqueue({ data: { id: 'a1', name: 'Konsulttimme', price_excl_vat: 1500 } })
+
+    const request = createMockRequest('/api/articles/a1', {
+      method: 'PATCH',
+      body: { price_excl_vat: 1500 },
+    })
+
+    const response = await PATCH(request, createMockRouteParams({ id: 'a1' }))
+    const { status, body } = await parseJsonResponse<{ data: { price_excl_vat: number } }>(response)
+
+    expect(status).toBe(200)
+    expect(body.data.price_excl_vat).toBe(1500)
+  })
+
+  it('DELETE soft-deactivates and returns success', async () => {
+    enqueue({ data: { id: 'a1', active: false } })
+
+    const response = await DELETE(createMockRequest('/api/articles/a1', { method: 'DELETE' }), createMockRouteParams({ id: 'a1' }))
+    const { status, body } = await parseJsonResponse<{ success: boolean }>(response)
+
+    expect(status).toBe(200)
+    expect(body.success).toBe(true)
+  })
+})
@@ -0,0 +1,97 @@
+/**
+ * Tests for GET/POST /api/articles (artikelregister).
+ *
+ * Exercises the route through the real withRouteContext wrapper, mocking only
+ * its auth/company/write dependencies and injecting a queued Supabase mock via
+ * requireAuth. Covers: list, validation (400), revenue-account guard (400),
+ * and the happy-path create with auto-numbering.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { createQueuedMockSupabase, createMockRequest, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const requireWriteMock = vi.fn()
+vi.mock('@/lib/auth/require-write', () => ({
+  requireWritePermission: (...args: unknown[]) => requireWriteMock(...args),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { GET, POST } from '../route'
+
+describe('GET/POST /api/articles', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+    reset()
+    requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+    requireWriteMock.mockResolvedValue({ ok: true })
+  })
+
+  it('GET lists the company articles', async () => {
+    enqueue({ data: [{ id: 'a1', name: 'Konsulttimme' }, { id: 'a2', name: 'Licens' }] })
+
+    const response = await GET(createMockRequest('/api/articles'), { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ data: unknown[] }>(response)
+
+    expect(status).toBe(200)
+    expect(body.data).toHaveLength(2)
+  })
+
+  it('POST rejects an invalid body (missing name) with 400', async () => {
+    const request = createMockRequest('/api/articles', {
+      method: 'POST',
+      body: { price_excl_vat: 100 },
+    })
+
+    const response = await POST(request, { params: Promise.resolve({}) })
+    const { status } = await parseJsonResponse(response)
+
+    expect(status).toBe(400)
+  })
+
+  it('POST rejects a revenue_account that is not an active class-3 account', async () => {
+    // chart_of_accounts lookup returns no row → override is invalid.
+    enqueue({ data: null })
+
+    const request = createMockRequest('/api/articles', {
+      method: 'POST',
+      body: { name: 'Frakt', price_excl_vat: 100, revenue_account: '3999' },
+    })
+
+    const response = await POST(request, { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+    expect(status).toBe(400)
+    expect(body.error.code).toBe('ARTICLE_REVENUE_ACCOUNT_INVALID')
+  })
+
+  it('POST creates an article and auto-assigns a number', async () => {
+    // 1st DB hit: insert ... returning the row (article_number still null).
+    enqueue({ data: { id: 'a1', name: 'Konsulttimme', article_number: null, type: 'tjanst', vat_rate: 25 } })
+    // 2nd DB hit: generate_article_number RPC returns the assigned number.
+    enqueue({ data: '7' })
+
+    const request = createMockRequest('/api/articles', {
+      method: 'POST',
+      body: { name: 'Konsulttimme', price_excl_vat: 1200, vat_rate: 25 },
+    })
+
+    const response = await POST(request, { params: Promise.resolve({}) })
+    const { status, body } = await parseJsonResponse<{ data: { id: string; article_number: string } }>(response)
+
+    expect(status).toBe(200)
+    expect(body.data.id).toBe('a1')
+    expect(body.data.article_number).toBe('7')
+  })
+})