feat: implement viewer role permissions for bank transaction imports and connections (#234)

lib/auth/__tests__/require-write.test.ts

@@ -5,7 +5,7 @@ vi.mock('@/lib/company/context', () => ({
   getActiveCompanyId: vi.fn(),
 }))
 
-import { requireWritePermission } from '../require-write'
+import { requireWritePermission, getCompanyRole } from '../require-write'
 import { getActiveCompanyId } from '@/lib/company/context'
 
 describe('requireWritePermission', () => {
@@ -79,3 +79,60 @@ describe('requireWritePermission', () => {
     }
   })
 })
+
+describe('getCompanyRole', () => {
+  beforeEach(() => {
+    vi.clearAllMocks()
+  })
+
+  it('returns role and companyId for owner', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'owner' } })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.role).toBe('owner')
+      expect(result.companyId).toBe('company-1')
+    }
+  })
+
+  it('returns role for viewer (does not block)', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: { role: 'viewer' } })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(true)
+    if (result.ok) {
+      expect(result.role).toBe('viewer')
+      expect(result.companyId).toBe('company-1')
+    }
+  })
+
+  it('returns 403 when user has no membership', async () => {
+    const { supabase, mockResult } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue('company-1')
+    mockResult({ data: null })
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+    }
+  })
+
+  it('returns 403 when there is no active company', async () => {
+    const { supabase } = createMockSupabase()
+    vi.mocked(getActiveCompanyId).mockResolvedValue(null)
+
+    const result = await getCompanyRole(supabase, 'user-1')
+    expect(result.ok).toBe(false)
+    if (!result.ok) {
+      expect(result.response.status).toBe(403)
+      const body = await result.response.json()
+      expect(body.error).toContain('aktivt företag')
+    }
+  })
+})

lib/auth/require-write.ts

@@ -1,6 +1,7 @@
 import { NextResponse } from 'next/server'
 import type { SupabaseClient } from '@supabase/supabase-js'
 import { getActiveCompanyId } from '@/lib/company/context'
+import type { CompanyRole } from '@/types'
 
 /**
  * Write-permission guard for API routes.
@@ -61,3 +62,54 @@ export async function requireWritePermission(
 
   return { ok: true }
 }
+
+/**
+ * Resolves the caller's role in the active company without blocking viewers.
+ *
+ * Unlike `requireWritePermission()` (which returns 403 for viewers), this
+ * returns the actual role so the caller can make conditional decisions —
+ * e.g. allowing viewers to import raw bank transactions but nothing else.
+ *
+ * Use `requireWritePermission()` for routes that are fully off-limits to
+ * viewers. Use `getCompanyRole()` only when the route needs viewer-
+ * conditional behavior.
+ */
+export type CompanyRoleResult =
+  | { ok: true; role: CompanyRole; companyId: string }
+  | { ok: false; response: NextResponse }
+
+export async function getCompanyRole(
+  supabase: SupabaseClient,
+  userId: string,
+): Promise<CompanyRoleResult> {
+  const companyId = await getActiveCompanyId(supabase, userId)
+
+  if (!companyId) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: 'Inget aktivt företag.' },
+        { status: 403 },
+      ),
+    }
+  }
+
+  const { data: membership } = await supabase
+    .from('company_members')
+    .select('role')
+    .eq('company_id', companyId)
+    .eq('user_id', userId)
+    .maybeSingle()
+
+  if (!membership) {
+    return {
+      ok: false,
+      response: NextResponse.json(
+        { error: 'Du har ingen roll i detta företag.' },
+        { status: 403 },
+      ),
+    }
+  }
+
+  return { ok: true, role: membership.role as CompanyRole, companyId }
+}