feat: implement viewer role permissions for bank transaction imports and connections (#234)

lib/transactions/__tests__/ingest.test.ts

@@ -701,6 +701,64 @@ describe('ingestTransactions', () => {
     expect(result.errors).toBe(0)
   })
 
+  // -----------------------------------------------------------------------
+  // rawInsertOnly: skips reconciliation, matching, and auto-categorization
+  // -----------------------------------------------------------------------
+  it('skips reconciliation, matching, and categorization when rawInsertOnly is set', async () => {
+    const { supabase, enqueue } = createQueueMockSupabase()
+    const raw = makeRaw({ amount: 5000, description: 'Payment received' })
+    const inserted = makeTransaction({
+      id: 'tx-raw',
+      amount: 5000,
+      external_id: raw.external_id,
+    })
+
+    // Booked transaction map query
+    enqueue({ data: [], error: null })
+    // Unbooked bank-synced transaction map query
+    enqueue({ data: [], error: null })
+    // No supplier invoices fetch (skipped by rawInsertOnly)
+    // Batch external_id dedup query (no matches)
+    enqueue({ data: [], error: null })
+    // Insert returns the new transaction
+    enqueue({ data: inserted, error: null })
+
+    const result = await ingestTransactions(
+      supabase as never, COMPANY_ID, USER_ID, [raw],
+      { rawInsertOnly: true }
+    )
+
+    expect(result.imported).toBe(1)
+    expect(result.reconciled).toBe(0)
+    expect(result.auto_categorized).toBe(0)
+    expect(result.auto_matched_invoices).toBe(0)
+    // Should NOT have attempted any post-insert operations
+    expect(mockFetchUnlinkedGLLines).not.toHaveBeenCalled()
+    expect(mockTryReconcileTransaction).not.toHaveBeenCalled()
+    expect(mockGetBestInvoiceMatch).not.toHaveBeenCalled()
+    expect(mockEvaluateMappingRules).not.toHaveBeenCalled()
+  })
+
+  it('still deduplicates when rawInsertOnly is set', async () => {
+    const { supabase, enqueue } = createQueueMockSupabase()
+    const raw = makeRaw({ external_id: 'ext-dup-raw' })
+
+    // Booked transaction map query
+    enqueue({ data: [], error: null })
+    // Unbooked bank-synced transaction map query
+    enqueue({ data: [], error: null })
+    // Batch external_id dedup query — already exists
+    enqueue({ data: [{ external_id: 'ext-dup-raw' }], error: null })
+
+    const result = await ingestTransactions(
+      supabase as never, COMPANY_ID, USER_ID, [raw],
+      { rawInsertOnly: true }
+    )
+
+    expect(result.duplicates).toBe(1)
+    expect(result.imported).toBe(0)
+  })
+
   // -----------------------------------------------------------------------
   // Content-based dedup: cross-source duplicate detection
   // -----------------------------------------------------------------------

lib/transactions/ingest.ts

@@ -119,8 +119,14 @@ export async function ingestTransactions(
   // by incoming enable_banking rows to avoid blocking unrelated CSV imports.
   const existingMaps = await buildExistingTransactionMaps(supabase, companyId, rawTransactions)
 
-  // Pre-fetch unlinked GL lines for reconciliation (non-critical)
+  // When rawInsertOnly is set (viewer imports), skip pre-fetching GL lines,
+  // supplier invoices, and exchange rates — they are not used.
   let glLinePool: UnlinkedGLLine[] = []
+  let unpaidSupplierInvoices: SupplierInvoice[] = []
+  let exchangeRates = new Map<Currency, ExchangeRate>()
+
+  if (!options?.rawInsertOnly) {
+  // Pre-fetch unlinked GL lines for reconciliation (non-critical)
   try {
     glLinePool = await fetchUnlinkedGLLines(supabase, companyId, undefined, undefined, options?.settlementAccount)
   } catch {
@@ -128,7 +134,6 @@ export async function ingestTransactions(
   }
 
   // Pre-fetch unpaid supplier invoices for expense matching (non-critical)
-  let unpaidSupplierInvoices: SupplierInvoice[] = []
   try {
     const { data } = await supabase
       .from('supplier_invoices')
@@ -141,20 +146,22 @@ export async function ingestTransactions(
   } catch {
     // Non-critical — supplier invoice matching will be skipped
   }
+  }
 
   // Pre-fetch exchange rates for non-SEK currencies (non-critical)
-  let exchangeRates = new Map<Currency, ExchangeRate>()
-  try {
-    const uniqueCurrencies = [...new Set(
-      rawTransactions
-        .map(t => t.currency)
-        .filter((c): c is Currency => c != null && c !== 'SEK')
-    )]
-    if (uniqueCurrencies.length > 0) {
-      exchangeRates = await fetchMultipleRates(uniqueCurrencies)
+  if (!options?.rawInsertOnly) {
+    try {
+      const uniqueCurrencies = [...new Set(
+        rawTransactions
+          .map(t => t.currency)
+          .filter((c): c is Currency => c != null && c !== 'SEK')
+      )]
+      if (uniqueCurrencies.length > 0) {
+        exchangeRates = await fetchMultipleRates(uniqueCurrencies)
+      }
+    } catch {
+      // Non-critical — amount_sek fields will stay null
     }
-  } catch {
-    // Non-critical — amount_sek fields will stay null
   }
 
   // Pre-fetch existing external_ids in batches for dedup (avoids N+1 queries)
@@ -244,6 +251,9 @@ export async function ingestTransactions(
     result.imported++
     result.transaction_ids.push(newTransaction.id)
 
+    // rawInsertOnly: skip reconciliation, invoice matching, and auto-categorization
+    if (options?.rawInsertOnly) continue
+
     // 2.5. Try reconciliation against pre-fetched unlinked GL lines
     if (glLinePool.length > 0) {
       try {