feat(invoices): named payee accounts and per-invoice choice of bank account (#2233)
* fix(enable-banking): read BBAN from AccountIdentification.other and store it on the account Enable Banking has no top-level `bban` key on AccountIdentification: a Swedish BBAN (clearing + account number) arrives as `other.identification` with `other.scheme_name = 'BBAN'`, or in `all_account_ids`. The client typed `bban?: string` and read `.bban`, so the value was always undefined: no connected account ever carried its clearing + account number, and domestic counterparty accounts on transactions were dropped. Type the identifiers per the OpenAPI spec, add extractBban() and pickAccountIdentifier(), read counterparty identifiers through the scheme list (IBAN, then BBAN/BGNR/PGNR, then anything), and store `bban` on StoredAccount from the OAuth callback. The external_id dedup scope stays IBAN-then-uid and is untouched. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * feat(invoices): named payee accounts on cash_accounts with a default per currency A company had exactly one set of payment instructions per invoice currency (company_settings.invoice_payment_accounts), picked by currency alone. A second SEK bank account, or a second bankgiro number, had nowhere to live. cash_accounts is already the per-company bank-account entity. Migration 20260903150000 adds the payee fields (bankgiro, plusgiro, clearing + account number, BBAN, BIC, Swish, foreign routing) plus invoice_payee, a small invoice_payee_defaults table (one default account per currency; one account may be the default for several currencies, a SEK account with an IBAN is the usual EUR payee), and a SECURITY DEFINER mirror that rewrites the legacy map and the SEK bank columns from the default accounts. Every existing reader (PDF, email, reminders, v1, MCP) keeps working; the three writers that only touched legacy columns (PUT /api/settings, v1 settings, MCP update_company_settings) now write through to the default account, so what an agent sets is what the PDF prints. Peppol PaymentMeans is built from the resolver instead of the raw legacy column. bg_pg is dropped (never read or written; NULL on every prod and staging row). Backfill lands only on existing cash accounts (primary, IBAN match, or the only enabled account in the currency). Entries with no target stay in the map as the resolver fallback and get an attach action in settings. New: POST /api/cash-accounts (manual bank account on the next free 19xx), PATCH /api/cash-accounts/[id] payee fields (owner/admin), GET/PUT /api/cash-accounts/payee-defaults. Settings page rewritten as an account list with per-currency defaults. Behandlingshistorik and the full archive cover the new table and columns. Verified on staging: migration applied (11 defaults landed), mirror trigger observed rewriting company_settings from a payee edit. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * feat(invoices): choose which bank account an invoice is paid to, frozen at issue Migration 20260903160000 adds invoices.payment_cash_account_id (FK to cash_accounts, SET NULL) and invoices.payment_details, the payee fields frozen when the account is chosen and refreshed at issue. Resolver: resolveInvoicePaymentAccount / companyWithInvoicePaymentAccount / assertInvoicePaymentAccountForRender take an optional override, and hasRequiredInvoicePaymentAccount reads it from the invoice row, so every surface (PDF, Swish QR, email, reminders, payment confirmation, Peppol, recurring, staged MCP send) prints the frozen payee when one exists and the company default per currency otherwise. Invoices that never chose an account behave exactly as before. Issue paths (mark-sent, send, v1 send, v1 mark-sent, Peppol send, recurring, MCP send and mark-sent) refresh the snapshot from the account as it is at issue; a chosen account that is disabled, un-flagged or unusable for the currency blocks with INVOICE_SEND_PAYMENT_ACCOUNT_INVALID. Writers: dashboard POST/PATCH, v1 create/update and MCP create_invoice accept payment_cash_account_id and validate it against the company's payee accounts (INVOICE_PAYEE_ACCOUNT_INVALID). Credit notes inherit the original's payee; copies carry the choice; preview-pdf renders the chosen account. The editor shows "Betalas till" under the currency when the company has two or more usable payee accounts for that currency. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * feat(invoices): book manual payments on the invoice's chosen bank account Manual mark-paid (dashboard, v1, MCP gnubok_mark_invoice_as_paid) and the booking dialog's proposed lines debited 1930 regardless of which bank account the invoice asked to be paid to. They now resolve the chosen payee account's ledger account (resolveInvoiceSettlementAccount) and fall back to 1930 only when no account was chosen or the row is gone. Bank-transaction matching keeps debiting the account the money landed on and does not filter by the chosen account; between equal-confidence candidates it prefers the invoice that asked to be paid to the landing account. Scores are untouched, so nothing new auto-matches. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * chore(invoices): keep the payload-size and phantom-column ceilings after the payee work Shorten the new gnubok_create_invoice argument description (tools/list payload was 29 bytes over the 60 kB budget), inline the cash-account payee UPDATE/INSERT payloads and the settings select strings as literals so the phantom-column scanner can read their columns, and reuse ACCOUNT_NUMBER_RE instead of a hand-rolled copy. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * fix(invoices): harden the payee model after review (admin-only payee columns, separate payee IBAN, company-scoped FK) Review findings from CodeRabbit, Superagent, the Swedish accounting review and three skeptic passes, resolved in one batch: Schema (both migrations are unshipped and edited in place): - cash_accounts.payee_iban: the printed IBAN is its own column. iban stays the bank identity written by every sync and used to re-pair on reconnect, so a sync can no longer rewrite an invoice instruction or resurrect a cleared IBAN. The backfill copies each currency entry verbatim onto the target account (IBAN match first, then primary), so every invoice keeps printing exactly what it printed before; the bank IBAN is never pushed onto invoices that did not carry one. - Payee columns are owner/admin-only at the database (BEFORE trigger, service role exempt): cash_accounts is member-writable for bank sync, and the SECURITY DEFINER mirror would otherwise have let a member rewrite where customers pay. - Revoking an account as payee or disabling it drops its defaults; deleting a default drops that currency from the map and clears the legacy SEK columns (an admin saying "nothing to print" must not keep printing a closed account). The mirror leaves the legacy SEK columns alone when the map has no SEK entry, so legacy-only companies are never wiped by a mirror run for another currency. - Audit and mirror triggers fire on the same column set; anon and authenticated can no longer execute the trigger-only definer functions. - invoices.payment_cash_account_id is a composite same-company FK with SET NULL scoped to the account column. Code: - Only 19xx bank accounts can be payee: PATCH, the defaults PUT (which now also requires enabled, payee-flagged and usable for the currency), resolveInvoicePayeeChoice, and the mark-paid settlement resolver (which also refuses disabled rows and logs every fallback to 1930). - createManualBankAccount excludes every ledger slot any row already holds (findFreeLedgerAccount treats a manual holder as free; this path inserts). - The legacy settings writers (PUT /api/settings, v1, MCP) write through to the account BEFORE updating company_settings and fail the request on error; the account is written before it is adopted as default so the mirror never sees an empty payee. - snapshotInvoicePayee: dry runs no longer persist; a failed snapshot write blocks issue (INVOICE_PAYEE_SNAPSHOT_FAILED). v1 mark-sent/mark-paid projections carry the payee columns; v1 create validates the payee before the dry-run return and echoes it in the preview. - pickAccountIdentifier: supplementary IBAN wins over a primary BBAN, and non-account schemes (card PANs) are never persisted. - Editor shows the payee select for a single usable account with no default; the booking dialog waits for cash accounts before proposing lines; a failed default write no longer hides a created account. - Behandlingshistorik names the account on created/deleted defaults. - Regenerated skills/accounted-api; MCP argument description trimmed under the tools/list payload ceiling. Declined: clearing legacy columns via a forward migration (the mirror now does it on delete); Swedish review's "show the debit account in the mark-paid UI" (the booking dialog already proposes and lets the user edit the debit line); manual ledger collision (UNIQUE exists, and the create path now rejects it with a clear error); Peppol aligning to the PDF value for companies whose legacy column had drifted from the map (the PDF is the customer-facing document; both now agree). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * fix(invoices): read NEW.invoice_payee only on the cash_accounts branch of the mirror trigger trg_mirror_invoice_payee_defaults fires for both tables; plpgsql resolves record fields per expression, so the combined condition failed with "record new has no field invoice_payee" whenever a default row changed, which took down every pg-real case on the payee tables. The revoke/disable check now sits inside its own TG_TABLE_NAME branch. The MCP settings executor test mocks the payee write-through like the settings route test already does. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * fix(invoices): keep member disables from revoking payee defaults, gate payee on 1920-1999, fit the MCP payload Cycle 3 of /resolve-pr on #2233. Superagent P1: the SECURITY DEFINER mirror trigger deleted an admin's invoice_payee_defaults rows whenever cash_accounts.enabled flipped to false, and enabled is member-writable (the bank picker's "Synkas ej"), so a member could undo an admin's payee decision. The trigger now drops defaults only on the admin-only invoice_payee true -> false revoke; the mirror trigger's WHEN no longer lists enabled. Disabled accounts stay out of the pick lists and the send gate already refuses an invoice that chose one. Applied to staging as the same function + trigger definition and probed inside a rolled-back block: disable keeps the default and the mirrored bankgiro, revoke clears both. pg-real: the admin-guard test ran three expectations inside one withUserContext transaction; the first raise aborted it and the next statement failed with "current transaction is aborted". One transaction per expectation now, and the member case also flips enabled to prove the column stays member-level. Swedish review: payee eligibility was /^19\d\d$/, which admits 1910 Kassa and the 1911-1919 tills. A customer pays to a giro or bank account, so isBankCashAccount, CreateCashAccountSchema.ledger_account and the PATCH route now require BAS 1920-1999; tests cover 1910 and 1919. Unit tests (3/4): the tools/list payload guard read 60 025, then 60 014 tokens after main merged #2166 and #2163 alongside this branch. The ceiling is not bumped and no read on this surface is a demotion candidate, so gnubok_create_invoice drops payment_cash_account_id; agent-created invoices print the per-currency default and v1 REST plus the editor keep the field. Recorded in DECISIONS.md. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * chore(migrations): move invoices_payment_cash_account to 20260903183000 after colliding with main's KPI migration origin/main merged 20260903160000_kpi_monthly_include_reversed_originals while this branch held the same version; identical versions abort the Supabase apply. Staging's schema_migrations row was moved to the new version with the file. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01UaZTY21HVN57hJoPXKSLjV * fix(invoices): gate invoice_payee on BAS 1920-1999 at the database, and unblock the typecheck ratchet Cycle 4 of /resolve-pr on #2233, on Emil's go. Swedish review: the 1920-1999 payee rule lived only in the routes. The cash_accounts_payee_admin_only trigger now also refuses invoice_payee on any other ledger (INVOICE_PAYEE_ACCOUNT_INVALID, 23514), whoever writes it, and the backfill only targets giro/bank rows, so a company whose single enabled cash_accounts row is a Stripe clearing account keeps its legacy bankgiro in company_settings instead of landing it on 1686. pg test covers insert and update on 1686 and 1910; the function was applied to staging and probed. Typecheck ratchet: main is red from two merges that landed with failing Checks, and every branch that syncs it inherits the errors. - #2242 added POST(req) calls to the fiscal-periods route test without the route params argument withRouteContext handlers take (25 errors in the file, baseline 23). All 25 calls now pass createMockRouteParams({}). - #2247 made SyncResult.requestedFromDate and historyNarrowed required; the 13 mockedSync results in the enable-banking accounts-route test lacked them. They now carry a fixed date and historyNarrowed: false. Both files' tests pass unchanged in behaviour. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> * chore(migrations): move invoices_payment_cash_account to 20260903193000 after colliding with main's party_promotion origin/main merged 20260903183000_party_promotion while this branch held the same version. Staging's schema_migrations row must follow (pending: the Supabase MCP was disconnected at the time of this commit). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Fable 5.1
Claude Fable 5.1
parent
88a5d78594
commit
d670fe6663
@@ -0,0 +1,484 @@
|
||||
-- Named invoice payee accounts.
|
||||
--
|
||||
-- Until now a company had exactly one set of payment instructions per invoice
|
||||
-- currency (company_settings.invoice_payment_accounts, keyed SEK/EUR/...), and
|
||||
-- the invoice picked them by currency alone. A company with two SEK bank
|
||||
-- accounts, or two bankgiro numbers, had nowhere to put the second one.
|
||||
--
|
||||
-- cash_accounts is already the per-company bank-account entity (name, IBAN,
|
||||
-- currency, ledger account, primary flag). This migration makes it the single
|
||||
-- source for what a customer pays to:
|
||||
--
|
||||
-- 1. Payee columns on cash_accounts (bankgiro, plusgiro, clearing + account,
|
||||
-- payee IBAN, BIC, Swish, foreign routing) plus invoice_payee: "may be
|
||||
-- printed on an invoice". The payee IBAN is its own column: cash_accounts.iban
|
||||
-- is the bank's identity of the account (written by every PSD2 sync and
|
||||
-- used to re-pair accounts on reconnect), while payee_iban is what the
|
||||
-- company chooses to print; a sync must never rewrite an invoice
|
||||
-- instruction, and a cleared payee IBAN must stay cleared.
|
||||
-- bg_pg (one text for both giro kinds) was never read or written anywhere
|
||||
-- and is dropped; verified NULL on every prod and staging row 2026-09-03.
|
||||
-- 2. invoice_payee_defaults: which cash account an invoice in a given
|
||||
-- currency prints when the invoice itself does not choose. One account
|
||||
-- may be the default for several currencies: a SEK account with an IBAN
|
||||
-- is the normal EUR payee, so "default for EUR must be an EUR account"
|
||||
-- would be wrong.
|
||||
-- 3. A mirror: whenever a default account or its payee fields change, the
|
||||
-- old company_settings.invoice_payment_accounts map and the legacy SEK
|
||||
-- columns are rewritten from it. Every existing reader (PDF, email,
|
||||
-- reminders, Peppol, v1 settings, MCP) keeps working unchanged, and the
|
||||
-- three writers that only touched the legacy columns can no longer
|
||||
-- drift from what the PDF prints.
|
||||
-- 4. Payee columns are admin-only at the database, not just in the routes:
|
||||
-- cash_accounts writes are member-level (bank sync touches them), but
|
||||
-- where customers are told to pay was admin-only before this migration
|
||||
-- (company_settings RLS) and must stay so. Revoking an account as payee
|
||||
-- (invoice_payee = false, admin-only) drops its defaults. Disabling an
|
||||
-- account (enabled = false, member-level: the bank picker's "Synkas ej")
|
||||
-- does not: a member must not be able to undo an admin's payee choice;
|
||||
-- the pick lists exclude disabled accounts and the send gate refuses an
|
||||
-- invoice that chose one.
|
||||
-- 5. Backfill from today's map onto existing cash accounts, copying each
|
||||
-- currency entry verbatim (the map entry wins over anything the account
|
||||
-- knew, including the IBAN): every invoice keeps printing exactly what
|
||||
-- it printed before. No rows are created: an entry with no matching
|
||||
-- account stays in the map as the fallback the resolver already honours.
|
||||
--
|
||||
-- The mirror runs SECURITY DEFINER because company_settings updates are
|
||||
-- admin-gated by RLS. The admin guard in (4) is what makes that safe: only an
|
||||
-- admin (or the service role) can change what the mirror derives from.
|
||||
|
||||
-- ============================================================
|
||||
-- 1. Payee columns
|
||||
-- ============================================================
|
||||
|
||||
ALTER TABLE public.cash_accounts
|
||||
ADD COLUMN IF NOT EXISTS bank_name text,
|
||||
ADD COLUMN IF NOT EXISTS clearing_number text,
|
||||
ADD COLUMN IF NOT EXISTS account_number text,
|
||||
-- Raw BBAN as the ASPSP sent it (Swedish: clearing + account, no separator).
|
||||
ADD COLUMN IF NOT EXISTS bban text,
|
||||
ADD COLUMN IF NOT EXISTS bankgiro text,
|
||||
ADD COLUMN IF NOT EXISTS plusgiro text,
|
||||
ADD COLUMN IF NOT EXISTS swish text,
|
||||
ADD COLUMN IF NOT EXISTS payee_iban text,
|
||||
ADD COLUMN IF NOT EXISTS bic text,
|
||||
ADD COLUMN IF NOT EXISTS bank_code text,
|
||||
ADD COLUMN IF NOT EXISTS foreign_account_number text,
|
||||
ADD COLUMN IF NOT EXISTS invoice_payee boolean NOT NULL DEFAULT false;
|
||||
|
||||
ALTER TABLE public.cash_accounts DROP COLUMN IF EXISTS bg_pg;
|
||||
|
||||
COMMENT ON COLUMN public.cash_accounts.invoice_payee IS
|
||||
'True when this account may be printed as the payee on customer invoices. Payee columns are owner/admin-only (trigger cash_accounts_payee_admin_only).';
|
||||
COMMENT ON COLUMN public.cash_accounts.bban IS
|
||||
'Raw BBAN from the bank connection (Swedish: clearing number followed by account number). Prefill only; clearing_number/account_number are what prints.';
|
||||
COMMENT ON COLUMN public.cash_accounts.payee_iban IS
|
||||
'IBAN printed on customer invoices. Separate from iban (the bank identity written by sync) so a sync never rewrites an invoice instruction.';
|
||||
|
||||
-- (id, company_id) target so child tables can prove same-company membership
|
||||
-- with one composite FK (same pattern as parties in 20260902160000).
|
||||
ALTER TABLE public.cash_accounts
|
||||
ADD CONSTRAINT cash_accounts_id_company_unique UNIQUE (id, company_id);
|
||||
|
||||
-- ============================================================
|
||||
-- 2. Per-currency defaults
|
||||
-- ============================================================
|
||||
|
||||
CREATE TABLE public.invoice_payee_defaults (
|
||||
id uuid PRIMARY KEY DEFAULT gen_random_uuid(),
|
||||
company_id uuid NOT NULL REFERENCES public.companies(id) ON DELETE CASCADE,
|
||||
currency text NOT NULL CHECK (currency IN ('SEK', 'EUR', 'USD', 'GBP', 'NOK', 'DKK')),
|
||||
cash_account_id uuid NOT NULL,
|
||||
created_at timestamptz NOT NULL DEFAULT now(),
|
||||
updated_at timestamptz NOT NULL DEFAULT now(),
|
||||
UNIQUE (company_id, currency),
|
||||
CONSTRAINT invoice_payee_defaults_same_company
|
||||
FOREIGN KEY (cash_account_id, company_id)
|
||||
REFERENCES public.cash_accounts(id, company_id) ON DELETE CASCADE
|
||||
);
|
||||
|
||||
CREATE INDEX idx_invoice_payee_defaults_cash_account
|
||||
ON public.invoice_payee_defaults (cash_account_id);
|
||||
|
||||
ALTER TABLE public.invoice_payee_defaults ENABLE ROW LEVEL SECURITY;
|
||||
|
||||
CREATE POLICY "invoice_payee_defaults_select" ON public.invoice_payee_defaults
|
||||
FOR SELECT USING (company_id IN (SELECT public.user_company_ids()));
|
||||
CREATE POLICY "invoice_payee_defaults_insert" ON public.invoice_payee_defaults
|
||||
FOR INSERT WITH CHECK (public.user_is_company_admin(company_id));
|
||||
CREATE POLICY "invoice_payee_defaults_update" ON public.invoice_payee_defaults
|
||||
FOR UPDATE
|
||||
USING (public.user_is_company_admin(company_id))
|
||||
WITH CHECK (public.user_is_company_admin(company_id));
|
||||
CREATE POLICY "invoice_payee_defaults_delete" ON public.invoice_payee_defaults
|
||||
FOR DELETE USING (public.user_is_company_admin(company_id));
|
||||
|
||||
CREATE TRIGGER invoice_payee_defaults_updated_at
|
||||
BEFORE UPDATE ON public.invoice_payee_defaults
|
||||
FOR EACH ROW EXECUTE FUNCTION public.update_updated_at_column();
|
||||
|
||||
-- Behandlingshistorik: which account customer invoices pay to is a
|
||||
-- behandlingsregel (BFNAR 2013:2 p. 9.16), same as the voucher-series
|
||||
-- override on cash_accounts (20260902124513).
|
||||
CREATE TRIGGER audit_invoice_payee_defaults
|
||||
AFTER INSERT OR UPDATE OR DELETE ON public.invoice_payee_defaults
|
||||
FOR EACH ROW EXECUTE FUNCTION public.write_audit_log();
|
||||
|
||||
-- The payee columns, in one place: the audit trigger, the mirror trigger
|
||||
-- and the admin guard below all fire on exactly this set.
|
||||
CREATE OR REPLACE FUNCTION public.cash_account_payee_changed(old_row public.cash_accounts, new_row public.cash_accounts)
|
||||
RETURNS boolean
|
||||
LANGUAGE sql
|
||||
IMMUTABLE
|
||||
SET search_path = ''
|
||||
AS $$
|
||||
SELECT old_row.bank_name IS DISTINCT FROM new_row.bank_name
|
||||
OR old_row.clearing_number IS DISTINCT FROM new_row.clearing_number
|
||||
OR old_row.account_number IS DISTINCT FROM new_row.account_number
|
||||
OR old_row.bankgiro IS DISTINCT FROM new_row.bankgiro
|
||||
OR old_row.plusgiro IS DISTINCT FROM new_row.plusgiro
|
||||
OR old_row.swish IS DISTINCT FROM new_row.swish
|
||||
OR old_row.payee_iban IS DISTINCT FROM new_row.payee_iban
|
||||
OR old_row.bic IS DISTINCT FROM new_row.bic
|
||||
OR old_row.bank_code IS DISTINCT FROM new_row.bank_code
|
||||
OR old_row.foreign_account_number IS DISTINCT FROM new_row.foreign_account_number
|
||||
OR old_row.invoice_payee IS DISTINCT FROM new_row.invoice_payee
|
||||
$$;
|
||||
|
||||
DROP TRIGGER IF EXISTS audit_cash_accounts_invoice_payee ON public.cash_accounts;
|
||||
CREATE TRIGGER audit_cash_accounts_invoice_payee
|
||||
AFTER UPDATE ON public.cash_accounts
|
||||
FOR EACH ROW
|
||||
WHEN (
|
||||
OLD.bank_name IS DISTINCT FROM NEW.bank_name
|
||||
OR OLD.clearing_number IS DISTINCT FROM NEW.clearing_number
|
||||
OR OLD.account_number IS DISTINCT FROM NEW.account_number
|
||||
OR OLD.bankgiro IS DISTINCT FROM NEW.bankgiro
|
||||
OR OLD.plusgiro IS DISTINCT FROM NEW.plusgiro
|
||||
OR OLD.swish IS DISTINCT FROM NEW.swish
|
||||
OR OLD.payee_iban IS DISTINCT FROM NEW.payee_iban
|
||||
OR OLD.bic IS DISTINCT FROM NEW.bic
|
||||
OR OLD.bank_code IS DISTINCT FROM NEW.bank_code
|
||||
OR OLD.foreign_account_number IS DISTINCT FROM NEW.foreign_account_number
|
||||
OR OLD.invoice_payee IS DISTINCT FROM NEW.invoice_payee
|
||||
)
|
||||
EXECUTE FUNCTION public.write_audit_log();
|
||||
|
||||
-- ============================================================
|
||||
-- 3. Admin-only payee columns
|
||||
-- ============================================================
|
||||
|
||||
-- Where customers are told to pay was owner/admin-only before this migration
|
||||
-- (company_settings RLS, 20260422120000). cash_accounts is member-writable
|
||||
-- because bank sync runs on the member's session, so the payee columns need
|
||||
-- their own gate. The service role and migrations (auth.uid() IS NULL) pass;
|
||||
-- a session that is not owner/admin of the company is refused.
|
||||
CREATE OR REPLACE FUNCTION public.cash_accounts_payee_admin_only()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
SET search_path = ''
|
||||
AS $$
|
||||
DECLARE
|
||||
v_touches boolean;
|
||||
BEGIN
|
||||
IF TG_OP = 'INSERT' THEN
|
||||
v_touches := NEW.invoice_payee
|
||||
OR COALESCE(NEW.bank_name, NEW.clearing_number, NEW.account_number, NEW.bankgiro,
|
||||
NEW.plusgiro, NEW.swish, NEW.payee_iban, NEW.bic, NEW.bank_code,
|
||||
NEW.foreign_account_number) IS NOT NULL;
|
||||
ELSE
|
||||
v_touches := public.cash_account_payee_changed(OLD, NEW);
|
||||
END IF;
|
||||
IF v_touches AND auth.uid() IS NOT NULL AND NOT public.user_is_company_admin(NEW.company_id) THEN
|
||||
RAISE EXCEPTION 'INVOICE_PAYEE_ADMIN_ONLY: only owner or admin may change where customer invoices are paid'
|
||||
USING ERRCODE = '42501';
|
||||
END IF;
|
||||
-- A customer pays to a giro or bank account (BAS 1920-1999). A PSP clearing
|
||||
-- row (1584, 1680, 1686) or a till (1910-1919) can never be printed as
|
||||
-- payee, whoever writes it: the routes check this too, this is the floor.
|
||||
IF NEW.invoice_payee AND NEW.ledger_account !~ '^19[2-9]\d$' THEN
|
||||
RAISE EXCEPTION 'INVOICE_PAYEE_ACCOUNT_INVALID: only a giro or bank account (BAS 1920-1999) can be printed as payee, not %', NEW.ledger_account
|
||||
USING ERRCODE = '23514';
|
||||
END IF;
|
||||
RETURN NEW;
|
||||
END;
|
||||
$$;
|
||||
|
||||
REVOKE EXECUTE ON FUNCTION public.cash_accounts_payee_admin_only() FROM PUBLIC, anon, authenticated;
|
||||
|
||||
DROP TRIGGER IF EXISTS cash_accounts_payee_admin_only ON public.cash_accounts;
|
||||
CREATE TRIGGER cash_accounts_payee_admin_only
|
||||
BEFORE INSERT OR UPDATE ON public.cash_accounts
|
||||
FOR EACH ROW EXECUTE FUNCTION public.cash_accounts_payee_admin_only();
|
||||
|
||||
-- ============================================================
|
||||
-- 4. Mirror into company_settings
|
||||
-- ============================================================
|
||||
|
||||
-- The payee fields of one cash account in the exact shape
|
||||
-- company_settings.invoice_payment_accounts stores per currency
|
||||
-- (InvoicePaymentAccount in types/index.ts). Null fields are stripped, same
|
||||
-- as the 20260722191000 backfill did.
|
||||
CREATE OR REPLACE FUNCTION public.cash_account_payee_json(p_cash_account_id uuid)
|
||||
RETURNS jsonb
|
||||
LANGUAGE sql
|
||||
STABLE
|
||||
SET search_path = ''
|
||||
AS $$
|
||||
SELECT jsonb_strip_nulls(jsonb_build_object(
|
||||
'bank_name', NULLIF(btrim(ca.bank_name), ''),
|
||||
'clearing_number', NULLIF(btrim(ca.clearing_number), ''),
|
||||
'account_number', NULLIF(btrim(ca.account_number), ''),
|
||||
'bankgiro', NULLIF(btrim(ca.bankgiro), ''),
|
||||
'plusgiro', NULLIF(btrim(ca.plusgiro), ''),
|
||||
'swish', NULLIF(btrim(ca.swish), ''),
|
||||
'iban', NULLIF(upper(regexp_replace(ca.payee_iban, '\s', '', 'g')), ''),
|
||||
'bic', NULLIF(upper(regexp_replace(ca.bic, '\s', '', 'g')), ''),
|
||||
'bank_code', NULLIF(regexp_replace(ca.bank_code, '\s', '', 'g'), ''),
|
||||
'foreign_account_number', NULLIF(regexp_replace(ca.foreign_account_number, '\s', '', 'g'), '')
|
||||
))
|
||||
FROM public.cash_accounts ca
|
||||
WHERE ca.id = p_cash_account_id;
|
||||
$$;
|
||||
|
||||
-- Rewrite the company's invoice_payment_accounts map and legacy SEK columns
|
||||
-- from its invoice_payee_defaults.
|
||||
-- * A currency with a default row is overwritten from the account.
|
||||
-- * A currency whose default was just removed (p_drop_currency) loses its
|
||||
-- key: an admin who clears the default means "nothing to print", and
|
||||
-- the send gate then asks for an account instead of printing a closed one.
|
||||
-- * Any other currency keeps whatever the map held: entries that never
|
||||
-- landed on an account stay as the resolver's fallback.
|
||||
-- * The legacy SEK columns are written only when the map carries a SEK
|
||||
-- entry (or SEK was just dropped). A company whose only SEK instruction
|
||||
-- is the legacy columns must not have them nulled by a mirror run that
|
||||
-- concerns another currency.
|
||||
CREATE OR REPLACE FUNCTION public.mirror_invoice_payee_defaults(p_company_id uuid, p_drop_currency text DEFAULT NULL)
|
||||
RETURNS void
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = ''
|
||||
AS $$
|
||||
DECLARE
|
||||
v_map jsonb;
|
||||
v_sek jsonb;
|
||||
v_write_legacy boolean;
|
||||
BEGIN
|
||||
SELECT COALESCE(cs.invoice_payment_accounts, '{}'::jsonb)
|
||||
INTO v_map
|
||||
FROM public.company_settings cs
|
||||
WHERE cs.company_id = p_company_id;
|
||||
IF NOT FOUND THEN
|
||||
RETURN;
|
||||
END IF;
|
||||
|
||||
IF p_drop_currency IS NOT NULL THEN
|
||||
v_map := v_map - p_drop_currency;
|
||||
END IF;
|
||||
|
||||
SELECT COALESCE(v_map || jsonb_object_agg(d.currency, public.cash_account_payee_json(d.cash_account_id)), v_map)
|
||||
INTO v_map
|
||||
FROM public.invoice_payee_defaults d
|
||||
WHERE d.company_id = p_company_id;
|
||||
|
||||
v_write_legacy := (v_map ? 'SEK') OR p_drop_currency = 'SEK';
|
||||
v_sek := v_map -> 'SEK';
|
||||
|
||||
UPDATE public.company_settings cs
|
||||
SET invoice_payment_accounts = v_map,
|
||||
bank_name = CASE WHEN v_write_legacy THEN v_sek ->> 'bank_name' ELSE cs.bank_name END,
|
||||
clearing_number = CASE WHEN v_write_legacy THEN v_sek ->> 'clearing_number' ELSE cs.clearing_number END,
|
||||
account_number = CASE WHEN v_write_legacy THEN v_sek ->> 'account_number' ELSE cs.account_number END,
|
||||
bankgiro = CASE WHEN v_write_legacy THEN v_sek ->> 'bankgiro' ELSE cs.bankgiro END,
|
||||
plusgiro = CASE WHEN v_write_legacy THEN v_sek ->> 'plusgiro' ELSE cs.plusgiro END,
|
||||
swish = CASE WHEN v_write_legacy THEN v_sek ->> 'swish' ELSE cs.swish END,
|
||||
iban = CASE WHEN v_write_legacy THEN v_sek ->> 'iban' ELSE cs.iban END,
|
||||
bic = CASE WHEN v_write_legacy THEN v_sek ->> 'bic' ELSE cs.bic END
|
||||
WHERE cs.company_id = p_company_id
|
||||
AND (
|
||||
cs.invoice_payment_accounts IS DISTINCT FROM v_map
|
||||
OR (v_write_legacy AND (
|
||||
cs.bank_name IS DISTINCT FROM (v_sek ->> 'bank_name')
|
||||
OR cs.clearing_number IS DISTINCT FROM (v_sek ->> 'clearing_number')
|
||||
OR cs.account_number IS DISTINCT FROM (v_sek ->> 'account_number')
|
||||
OR cs.bankgiro IS DISTINCT FROM (v_sek ->> 'bankgiro')
|
||||
OR cs.plusgiro IS DISTINCT FROM (v_sek ->> 'plusgiro')
|
||||
OR cs.swish IS DISTINCT FROM (v_sek ->> 'swish')
|
||||
OR cs.iban IS DISTINCT FROM (v_sek ->> 'iban')
|
||||
OR cs.bic IS DISTINCT FROM (v_sek ->> 'bic')
|
||||
))
|
||||
);
|
||||
END;
|
||||
$$;
|
||||
|
||||
-- Trigger-only writers: nothing in a session may call them (the anon key
|
||||
-- would otherwise get an unauthenticated cross-tenant rewrite of
|
||||
-- company_settings). PUBLIC included: anon is a member of PUBLIC.
|
||||
REVOKE EXECUTE ON FUNCTION public.mirror_invoice_payee_defaults(uuid, text) FROM PUBLIC, anon, authenticated;
|
||||
|
||||
CREATE OR REPLACE FUNCTION public.trg_mirror_invoice_payee_defaults()
|
||||
RETURNS trigger
|
||||
LANGUAGE plpgsql
|
||||
SECURITY DEFINER
|
||||
SET search_path = ''
|
||||
AS $$
|
||||
BEGIN
|
||||
-- An account revoked as payee stops being a default (the defaults DELETE
|
||||
-- trigger then drops that currency from the map). invoice_payee is
|
||||
-- admin-only (cash_accounts_payee_admin_only), so this cannot be reached
|
||||
-- by a member; enabled is member-level and deliberately does not revoke.
|
||||
-- The field read sits in its own branch: plpgsql resolves NEW.<field> per
|
||||
-- expression, and this function also fires for invoice_payee_defaults
|
||||
-- rows, which have no invoice_payee column.
|
||||
IF TG_TABLE_NAME = 'cash_accounts' THEN
|
||||
IF TG_OP = 'UPDATE' AND NEW.invoice_payee = false AND OLD.invoice_payee = true THEN
|
||||
DELETE FROM public.invoice_payee_defaults WHERE cash_account_id = NEW.id;
|
||||
END IF;
|
||||
END IF;
|
||||
IF TG_TABLE_NAME = 'invoice_payee_defaults' THEN
|
||||
IF TG_OP = 'DELETE' THEN
|
||||
PERFORM public.mirror_invoice_payee_defaults(OLD.company_id, OLD.currency);
|
||||
ELSIF TG_OP = 'UPDATE' AND OLD.currency IS DISTINCT FROM NEW.currency THEN
|
||||
PERFORM public.mirror_invoice_payee_defaults(NEW.company_id, OLD.currency);
|
||||
ELSE
|
||||
PERFORM public.mirror_invoice_payee_defaults(NEW.company_id);
|
||||
END IF;
|
||||
ELSE
|
||||
PERFORM public.mirror_invoice_payee_defaults(NEW.company_id);
|
||||
END IF;
|
||||
RETURN NULL;
|
||||
END;
|
||||
$$;
|
||||
|
||||
REVOKE EXECUTE ON FUNCTION public.trg_mirror_invoice_payee_defaults() FROM PUBLIC, anon, authenticated;
|
||||
|
||||
CREATE TRIGGER mirror_invoice_payee_defaults_on_defaults
|
||||
AFTER INSERT OR UPDATE OR DELETE ON public.invoice_payee_defaults
|
||||
FOR EACH ROW EXECUTE FUNCTION public.trg_mirror_invoice_payee_defaults();
|
||||
|
||||
-- Payee-field edits or a revoke on an account that is a default for some
|
||||
-- currency must reach the mirror too. Bank sync churn (balances, names, the
|
||||
-- enabled flag, the bank identity iban) never fires this.
|
||||
CREATE TRIGGER mirror_invoice_payee_defaults_on_cash_account
|
||||
AFTER UPDATE ON public.cash_accounts
|
||||
FOR EACH ROW
|
||||
WHEN (
|
||||
OLD.bank_name IS DISTINCT FROM NEW.bank_name
|
||||
OR OLD.clearing_number IS DISTINCT FROM NEW.clearing_number
|
||||
OR OLD.account_number IS DISTINCT FROM NEW.account_number
|
||||
OR OLD.bankgiro IS DISTINCT FROM NEW.bankgiro
|
||||
OR OLD.plusgiro IS DISTINCT FROM NEW.plusgiro
|
||||
OR OLD.swish IS DISTINCT FROM NEW.swish
|
||||
OR OLD.payee_iban IS DISTINCT FROM NEW.payee_iban
|
||||
OR OLD.bic IS DISTINCT FROM NEW.bic
|
||||
OR OLD.bank_code IS DISTINCT FROM NEW.bank_code
|
||||
OR OLD.foreign_account_number IS DISTINCT FROM NEW.foreign_account_number
|
||||
OR OLD.invoice_payee IS DISTINCT FROM NEW.invoice_payee
|
||||
)
|
||||
EXECUTE FUNCTION public.trg_mirror_invoice_payee_defaults();
|
||||
|
||||
-- ============================================================
|
||||
-- 5. Backfill from today's map (no row creation)
|
||||
-- ============================================================
|
||||
|
||||
-- One row per (company, currency) that has payment instructions today: the
|
||||
-- map entry, or for SEK the legacy columns when the map has no SEK key.
|
||||
CREATE TEMP TABLE payee_backfill_entries AS
|
||||
SELECT cs.company_id, k.key AS currency, k.value AS payee
|
||||
FROM public.company_settings cs
|
||||
CROSS JOIN LATERAL jsonb_each(cs.invoice_payment_accounts) k
|
||||
WHERE cs.invoice_payment_accounts <> '{}'::jsonb
|
||||
UNION ALL
|
||||
SELECT cs.company_id, 'SEK',
|
||||
jsonb_strip_nulls(jsonb_build_object(
|
||||
'bank_name', NULLIF(btrim(cs.bank_name), ''),
|
||||
'clearing_number', NULLIF(btrim(cs.clearing_number), ''),
|
||||
'account_number', NULLIF(btrim(cs.account_number), ''),
|
||||
'bankgiro', NULLIF(btrim(cs.bankgiro), ''),
|
||||
'plusgiro', NULLIF(btrim(cs.plusgiro), ''),
|
||||
'swish', NULLIF(btrim(cs.swish), ''),
|
||||
'iban', NULLIF(btrim(cs.iban), ''),
|
||||
'bic', NULLIF(btrim(cs.bic), '')
|
||||
))
|
||||
FROM public.company_settings cs
|
||||
WHERE NOT (COALESCE(cs.invoice_payment_accounts, '{}'::jsonb) ? 'SEK')
|
||||
AND COALESCE(
|
||||
NULLIF(btrim(cs.bank_name), ''), NULLIF(btrim(cs.clearing_number), ''),
|
||||
NULLIF(btrim(cs.account_number), ''), NULLIF(btrim(cs.bankgiro), ''),
|
||||
NULLIF(btrim(cs.plusgiro), ''), NULLIF(btrim(cs.swish), ''),
|
||||
NULLIF(btrim(cs.iban), ''), NULLIF(btrim(cs.bic), '')
|
||||
) IS NOT NULL;
|
||||
|
||||
-- Target account per entry, among giro/bank rows (BAS 1920-1999) only: the
|
||||
-- account whose bank IBAN equals the entry's IBAN, else the primary in that
|
||||
-- currency, else the only enabled account in that currency. Ambiguous or
|
||||
-- absent: no target, the entry stays in the map.
|
||||
CREATE TEMP TABLE payee_backfill_targets AS
|
||||
SELECT e.company_id, e.currency, e.payee,
|
||||
COALESCE(
|
||||
(SELECT ca.id FROM public.cash_accounts ca
|
||||
WHERE ca.company_id = e.company_id AND ca.enabled AND ca.currency = e.currency
|
||||
AND ca.ledger_account ~ '^19[2-9]\d$'
|
||||
AND e.payee ->> 'iban' IS NOT NULL
|
||||
AND upper(regexp_replace(ca.iban, '\s', '', 'g')) = upper(regexp_replace(e.payee ->> 'iban', '\s', '', 'g'))
|
||||
ORDER BY ca.created_at, ca.id
|
||||
LIMIT 1),
|
||||
(SELECT ca.id FROM public.cash_accounts ca
|
||||
WHERE ca.company_id = e.company_id AND ca.enabled AND ca.currency = e.currency AND ca.is_primary
|
||||
AND ca.ledger_account ~ '^19[2-9]\d$'
|
||||
LIMIT 1),
|
||||
(SELECT (array_agg(ca.id))[1] FROM public.cash_accounts ca
|
||||
WHERE ca.company_id = e.company_id AND ca.enabled AND ca.currency = e.currency
|
||||
AND ca.ledger_account ~ '^19[2-9]\d$'
|
||||
HAVING count(*) = 1)
|
||||
) AS cash_account_id
|
||||
FROM payee_backfill_entries e;
|
||||
|
||||
-- The entry is copied verbatim onto the account's payee columns: what the
|
||||
-- company printed yesterday is what it prints tomorrow. The bank identity
|
||||
-- column iban is left alone; the printed IBAN lives in payee_iban.
|
||||
UPDATE public.cash_accounts ca
|
||||
SET bank_name = t.payee ->> 'bank_name',
|
||||
clearing_number = t.payee ->> 'clearing_number',
|
||||
account_number = t.payee ->> 'account_number',
|
||||
bankgiro = t.payee ->> 'bankgiro',
|
||||
plusgiro = t.payee ->> 'plusgiro',
|
||||
swish = t.payee ->> 'swish',
|
||||
payee_iban = t.payee ->> 'iban',
|
||||
bic = t.payee ->> 'bic',
|
||||
bank_code = t.payee ->> 'bank_code',
|
||||
foreign_account_number = t.payee ->> 'foreign_account_number',
|
||||
invoice_payee = true
|
||||
FROM payee_backfill_targets t
|
||||
WHERE t.cash_account_id = ca.id
|
||||
-- One account may be the target for several currencies; the SEK entry
|
||||
-- (the legacy instruction set) wins when they disagree.
|
||||
AND t.currency = (
|
||||
SELECT t2.currency FROM payee_backfill_targets t2
|
||||
WHERE t2.cash_account_id = t.cash_account_id
|
||||
ORDER BY (t2.currency = 'SEK') DESC, t2.currency
|
||||
LIMIT 1
|
||||
);
|
||||
|
||||
INSERT INTO public.invoice_payee_defaults (company_id, currency, cash_account_id)
|
||||
SELECT t.company_id, t.currency, t.cash_account_id
|
||||
FROM payee_backfill_targets t
|
||||
WHERE t.cash_account_id IS NOT NULL
|
||||
ON CONFLICT (company_id, currency) DO NOTHING;
|
||||
|
||||
DO $$
|
||||
DECLARE
|
||||
v_total integer;
|
||||
v_landed integer;
|
||||
BEGIN
|
||||
SELECT count(*), count(cash_account_id) INTO v_total, v_landed FROM payee_backfill_targets;
|
||||
RAISE NOTICE 'invoice payee backfill: % of % currency entries landed on a cash account; the rest stay in company_settings.invoice_payment_accounts as fallback',
|
||||
v_landed, v_total;
|
||||
END;
|
||||
$$;
|
||||
|
||||
DROP TABLE payee_backfill_targets;
|
||||
DROP TABLE payee_backfill_entries;
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
@@ -0,0 +1,39 @@
|
||||
-- Per-invoice payee: which of the company's bank accounts this invoice tells
|
||||
-- the customer to pay to.
|
||||
--
|
||||
-- payment_cash_account_id: the account chosen on the invoice (NULL = the
|
||||
-- company's default for the invoice currency, invoice_payee_defaults).
|
||||
-- ON DELETE SET NULL: the snapshot below is what an issued invoice prints,
|
||||
-- so losing the reference never changes a sent document.
|
||||
-- payment_details: the payee fields as they were when the invoice was
|
||||
-- written and last refreshed at issue (send / mark-sent / Peppol). Same
|
||||
-- shape as company_settings.invoice_payment_accounts entries. Issued
|
||||
-- invoices render from this column; a later edit of the account changes
|
||||
-- new invoices only. NULL on invoices that never chose an account: they
|
||||
-- keep resolving the default per currency as before.
|
||||
|
||||
ALTER TABLE public.invoices
|
||||
ADD COLUMN IF NOT EXISTS payment_cash_account_id uuid,
|
||||
ADD COLUMN IF NOT EXISTS payment_details jsonb
|
||||
CHECK (payment_details IS NULL OR jsonb_typeof(payment_details) = 'object');
|
||||
|
||||
-- Same-company proof in the constraint itself (the composite target
|
||||
-- cash_accounts(id, company_id) exists since 20260903150000): a direct
|
||||
-- PostgREST write cannot attach another tenant's account. SET NULL is scoped
|
||||
-- to the account column (PG15 column list); company_id must never be nulled.
|
||||
ALTER TABLE public.invoices
|
||||
ADD CONSTRAINT invoices_payment_cash_account_same_company
|
||||
FOREIGN KEY (payment_cash_account_id, company_id)
|
||||
REFERENCES public.cash_accounts(id, company_id)
|
||||
ON DELETE SET NULL (payment_cash_account_id);
|
||||
|
||||
CREATE INDEX IF NOT EXISTS idx_invoices_payment_cash_account
|
||||
ON public.invoices (company_id, payment_cash_account_id)
|
||||
WHERE payment_cash_account_id IS NOT NULL;
|
||||
|
||||
COMMENT ON COLUMN public.invoices.payment_cash_account_id IS
|
||||
'Bank account (cash_accounts) this invoice asks the customer to pay to. NULL = the per-currency default. Editable while draft only.';
|
||||
COMMENT ON COLUMN public.invoices.payment_details IS
|
||||
'Payee fields frozen for this invoice (bankgiro, plusgiro, clearing/account, IBAN, BIC, Swish, ...). Written when an account is chosen and refreshed at issue; issued invoices print from here.';
|
||||
|
||||
NOTIFY pgrst, 'reload schema';
|
||||
Reference in New Issue
Block a user