feat(invoicing): artikelregister (product/article catalog) with per-article revenue account (#703)

* feat(invoicing): artikelregister (product/article catalog) with per-article revenue account Add a lean, non-inventory article catalog (artikelregister) so users can define reusable invoice-line presets (name, unit, price excl VAT, VAT rate) with an optional per-article BAS class-3 revenue-account override. - DB: articles table (RLS via user_company_ids(), audit + updated_at triggers, unique-per-company article_number), generate_article_number RPC (atomic + idempotent), company_settings counter, nullable invoice_items.revenue_account + article_id, pending_operations CHECK expansion. - Engine: generatePerRateLines groups revenue by (vat_rate, account) — byte-identical with no override, balance-safe when split (last account absorbs the rounding remainder), reverse_charge/export still force 3308/3305. - API: /api/articles CRUD (soft-deactivate); override validated against chart_of_accounts (active class-3) and frozen onto invoice lines at create. - Propagation: override carried through send/mark-sent/credit/convert/cash and the staged commit paths (recurring deferred — documented inline). - MCP: gnubok_list/create/update_article (staged, scoped, risk-tiered). - UI: articles register (list/detail/form) + nav + bilingual i18n + invoice-line article picker & "Spara som artikel" quick-create. - Tests: engine regression, route, and pg-real (RPC/RLS/triggers). Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(mcp): strip ILIKE _ wildcard from gnubok_list_articles search Underscore is a single-character ILIKE wildcard; stripping it (alongside the existing %,()\* set) keeps a stray char in the article search from matching every row. Read-only + RLS-scoped, so no security impact — addresses PR #703 reviewer + compliance-swarm CC6.3 notes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-09 21:05:37 +02:00
parent 07ecb98389
commit c0b006fcc1
32 changed files with 3047 additions and 16 deletions
@@ -0,0 +1,113 @@
+import { NextResponse } from 'next/server'
+import { eventBus } from '@/lib/events'
+import { ensureInitialized } from '@/lib/init'
+import { validateBody } from '@/lib/api/validate'
+import { CreateArticleSchema } from '@/lib/api/schemas'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { ensureArticleNumber } from '@/lib/articles/ensure-article-number'
+import { isValidRevenueAccount } from '@/lib/articles/validate-revenue-account'
+import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
+import type { Article } from '@/types'
+
+ensureInitialized()
+
+// GET /api/articles — list the active company's articles. `?include_inactive=1`
+// returns soft-deactivated ones too (the register page can show an archive view).
+export const GET = withRouteContext(
+  'article.list',
+  async (request, ctx) => {
+    const { supabase, companyId, log, requestId } = ctx
+
+    const includeInactive = new URL(request.url).searchParams.get('include_inactive') === '1'
+
+    let query = supabase
+      .from('articles')
+      .select('*')
+      .eq('company_id', companyId)
+    if (!includeInactive) query = query.eq('active', true)
+
+    const { data, error } = await query.order('name', { ascending: true })
+
+    if (error) {
+      log.error('article list failed', error)
+      return errorResponse(error, log, { requestId })
+    }
+
+    return NextResponse.json({ data })
+  },
+)
+
+export const POST = withRouteContext(
+  'article.create',
+  async (request, ctx) => {
+    const { user, supabase, companyId, log, requestId } = ctx
+
+    const result = await validateBody(request, CreateArticleSchema, {
+      log,
+      operation: 'article.create',
+    })
+    if (!result.success) return result.response
+    const body = result.data
+
+    // Guard the optional revenue-account override against the chart of accounts.
+    if (body.revenue_account) {
+      const ok = await isValidRevenueAccount(supabase, companyId!, body.revenue_account)
+      if (!ok) {
+        return errorResponseFromCode('ARTICLE_REVENUE_ACCOUNT_INVALID', log, { requestId })
+      }
+    }
+
+    const { data, error } = await supabase
+      .from('articles')
+      .insert({
+        user_id: user.id,
+        company_id: companyId,
+        name: body.name,
+        name_en: body.name_en ?? null,
+        type: body.type ?? 'tjanst',
+        unit: body.unit ?? 'st',
+        price_excl_vat: body.price_excl_vat,
+        vat_rate: body.vat_rate ?? 25,
+        revenue_account: body.revenue_account ?? null,
+        cost_price: body.cost_price ?? null,
+        ean: body.ean ?? null,
+        housework_type: body.housework_type ?? null,
+        notes: body.notes ?? null,
+        article_number: body.article_number ?? null,
+      })
+      .select()
+      .single()
+
+    if (error) {
+      if (error.code === '23505') {
+        return errorResponseFromCode('ARTICLE_DUPLICATE_NUMBER', log, {
+          requestId,
+          details: { articleNumber: body.article_number },
+        })
+      }
+      log.error('article insert failed', error)
+      return errorResponseFromCode('ARTICLE_CREATE_FAILED', log, {
+        requestId,
+        details: { reason: error.message },
+      })
+    }
+
+    // Auto-number when the caller didn't supply one. Non-fatal: an unnumbered
+    // article is still usable and can be numbered later.
+    if (!data.article_number) {
+      try {
+        data.article_number = await ensureArticleNumber(supabase, companyId!, data.id)
+      } catch (err) {
+        log.warn('article number assignment failed', err as Error, { articleId: data.id })
+      }
+    }
+
+    await eventBus.emit({
+      type: 'article.created',
+      payload: { article: data as Article, companyId: companyId!, userId: user.id },
+    })
+
+    return NextResponse.json({ data })
+  },
+  { requireWrite: true },
+)