fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed (#1888)
* fix(skatteverket): skattekonto-OCR is 13 digits, and the AGI panel stops guessing that you have not signed Two reports from the same salary run (Fabian, Specific AI Sweden AB). 1. The payment file carried an OCR Skatteverket does not accept. generateSkattekontoOcr built the reference from the TEN-digit org number plus a Luhn check digit (11 digits). Skatteverket's reference is the TWELVE-digit identity plus a check digit: an organisationsnummer carries the "16" prefix, a personnummer its century. For 559547-0021 we emitted 55954700211 where Skatteverket prints 1655954700217. The twelve-digit form is the same "redovisare" identity the AGI and moms APIs take, so it now goes through the shared toRedovisare12 converter instead of a second local rule: the payment file and the declaration it pays must not disagree about who the taxpayer is. That needs the entity type, which the route now reads alongside org_number. The route also prefers saldo.ocrNummer from the cached skattekonto snapshot over the derived value. It is Skatteverket's own answer for the account we actually sync, it covers identities the converter has no rule for (samordningsnummer, GD-nummer), and it covers the companies whose companies.org_number has drifted from company_settings.org_number. 2. AGI status stayed on "väntar på BankID-signatur i Mina Sidor" after the user had signed. Reading the kvittens needs a live Skatteverket session, and the personal token lives ~65 minutes, so by the time anyone signs in Mina Sidor the 2-hourly kvittens cron finds a dead token and skips quietly. The panel kept asserting a state it could no longer observe. It now says so instead, and the reconnect action already on the panel is the fix: runPostConnectRefresh reconciles pending declarations on a fresh consent. sessionExpiredStatus also counts the needs_reconsent health flag, which a cron can set while the access token is still inside its hour; without it the panel reported a dead connection as healthy. Background reconciliation without a reconnect needs the läsombud grant, which is a registration decision and not part of this change. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(skatteverket): say why the entity_type collapse in the payment-file route is total companies.entity_type is NOT NULL with CHECK IN ('enskild_firma', 'aktiebolag'), so the ternary cannot silently mis-tag an enskild firma as a legal entity and give a personnummer the "16" prefix. Two review bots read it as an unguarded default; write down the constraint that makes it safe instead of leaving the next reader to re-derive it. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> * docs(decisions): record why the cached skattekonto OCR needs no freshness gate Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Opus 5
Jakob Wennberg
Claude Opus 5
Jakob Wennberg
parent
cbfb2201ff
commit
d80103a2f5
@@ -1,32 +1,115 @@
|
||||
import { describe, it, expect } from 'vitest'
|
||||
import { generateSkattekontoOcr, SKATTEKONTO_BANKGIRO } from '../skattekonto-ocr'
|
||||
import { describe, it, expect, vi } from 'vitest'
|
||||
import {
|
||||
generateSkattekontoOcr,
|
||||
resolveSkattekontoOcr,
|
||||
SKATTEKONTO_BANKGIRO,
|
||||
} from '../skattekonto-ocr'
|
||||
import { luhnValidate } from '@/lib/bankgiro/luhn'
|
||||
|
||||
describe('generateSkattekontoOcr', () => {
|
||||
it('produces 11-digit OCR with valid Luhn check digit for AB org-number', () => {
|
||||
const ocr = generateSkattekontoOcr('556012-3456')
|
||||
expect(ocr).toHaveLength(11)
|
||||
expect(ocr.startsWith('5560123456')).toBe(true)
|
||||
// Ground truth from Skatteverket for org 559547-0021: the reference their
|
||||
// e-service prints is the twelve-digit form plus a check digit, not the
|
||||
// ten-digit one (which is what we used to emit, and banks/SKV rejected).
|
||||
it('produces the 13-digit OCR Skatteverket prints for an AB', () => {
|
||||
expect(generateSkattekontoOcr('559547-0021', 'aktiebolag')).toBe('1655954700217')
|
||||
})
|
||||
|
||||
it('prefixes an organisationsnummer with 16 and appends a Luhn check digit', () => {
|
||||
const ocr = generateSkattekontoOcr('556012-3456', 'aktiebolag')
|
||||
expect(ocr).toHaveLength(13)
|
||||
expect(ocr.startsWith('165560123456')).toBe(true)
|
||||
expect(luhnValidate(ocr)).toBe(true)
|
||||
})
|
||||
|
||||
it('accepts org-number without dash', () => {
|
||||
expect(generateSkattekontoOcr('5560123456')).toBe(generateSkattekontoOcr('556012-3456'))
|
||||
it('accepts org-number without dash and with spaces', () => {
|
||||
const canonical = generateSkattekontoOcr('556012-3456', 'aktiebolag')
|
||||
expect(generateSkattekontoOcr('5560123456', 'aktiebolag')).toBe(canonical)
|
||||
expect(generateSkattekontoOcr('556012 3456', 'aktiebolag')).toBe(canonical)
|
||||
})
|
||||
|
||||
it('accepts 12-digit personnummer by stripping century prefix', () => {
|
||||
const ocr12 = generateSkattekontoOcr('198802251234')
|
||||
const ocr10 = generateSkattekontoOcr('880225-1234')
|
||||
expect(ocr12).toBe(ocr10)
|
||||
it('keeps the century for an enskild firma personnummer', () => {
|
||||
const ocr = generateSkattekontoOcr('19880225-1234', 'enskild_firma')
|
||||
expect(ocr).toHaveLength(13)
|
||||
expect(ocr.startsWith('198802251234')).toBe(true)
|
||||
expect(luhnValidate(ocr)).toBe(true)
|
||||
})
|
||||
|
||||
it('derives the century for a 10-digit personnummer', () => {
|
||||
expect(generateSkattekontoOcr('880225-1234', 'enskild_firma')).toBe(
|
||||
generateSkattekontoOcr('198802251234', 'enskild_firma'),
|
||||
)
|
||||
})
|
||||
|
||||
it('does not give an enskild firma the organisationsnummer prefix', () => {
|
||||
const ef = generateSkattekontoOcr('880225-1234', 'enskild_firma')
|
||||
const ab = generateSkattekontoOcr('880225-1234', 'aktiebolag')
|
||||
expect(ef.startsWith('16')).toBe(false)
|
||||
expect(ab.startsWith('16')).toBe(true)
|
||||
expect(ef).not.toBe(ab)
|
||||
})
|
||||
|
||||
it('rejects malformed numbers', () => {
|
||||
expect(() => generateSkattekontoOcr('123')).toThrow(/Ogiltigt/)
|
||||
expect(() => generateSkattekontoOcr('')).toThrow(/Ogiltigt/)
|
||||
expect(() => generateSkattekontoOcr('abcdefghij')).toThrow(/Ogiltigt/)
|
||||
expect(() => generateSkattekontoOcr('123', 'aktiebolag')).toThrow(/Ogiltigt/)
|
||||
expect(() => generateSkattekontoOcr('', 'aktiebolag')).toThrow(/Ogiltigt/)
|
||||
expect(() => generateSkattekontoOcr('abcdefghij', 'aktiebolag')).toThrow(/Ogiltigt/)
|
||||
})
|
||||
|
||||
it('exports correct Bankgiro for Skattekontot', () => {
|
||||
expect(SKATTEKONTO_BANKGIRO).toBe('5050-1055')
|
||||
})
|
||||
})
|
||||
|
||||
describe('resolveSkattekontoOcr', () => {
|
||||
function snapshotClient(value: unknown, error: unknown = null) {
|
||||
const maybeSingle = vi.fn().mockResolvedValue({ data: value === undefined ? null : { value }, error })
|
||||
const eq = vi.fn()
|
||||
const builder = { select: vi.fn(() => builder), eq, maybeSingle }
|
||||
eq.mockImplementation(() => builder)
|
||||
return {
|
||||
client: { from: vi.fn(() => builder) } as never,
|
||||
from: builder,
|
||||
}
|
||||
}
|
||||
|
||||
it('prefers the OCR Skatteverket reported on the skattekonto saldo', async () => {
|
||||
const { client } = snapshotClient({ saldo: { ocrNummer: '1948040320946' }, fetchedAt: 1 })
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '556012-3456', 'aktiebolag'),
|
||||
).resolves.toBe('1948040320946')
|
||||
})
|
||||
|
||||
it('strips separators from the reported OCR', async () => {
|
||||
const { client } = snapshotClient({ saldo: { ocrNummer: '16 5595470021 7' } })
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '556012-3456', 'aktiebolag'),
|
||||
).resolves.toBe('1655954700217')
|
||||
})
|
||||
|
||||
it('falls back to the computed OCR when no snapshot is cached', async () => {
|
||||
const { client } = snapshotClient(undefined)
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '559547-0021', 'aktiebolag'),
|
||||
).resolves.toBe('1655954700217')
|
||||
})
|
||||
|
||||
it('falls back when the cached OCR fails its Luhn check', async () => {
|
||||
const { client } = snapshotClient({ saldo: { ocrNummer: '1655954700216' } })
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '559547-0021', 'aktiebolag'),
|
||||
).resolves.toBe('1655954700217')
|
||||
})
|
||||
|
||||
it('falls back when the cached OCR is longer than Bankgirot accepts', async () => {
|
||||
const { client } = snapshotClient({ saldo: { ocrNummer: '1'.repeat(26) } })
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '559547-0021', 'aktiebolag'),
|
||||
).resolves.toBe('1655954700217')
|
||||
})
|
||||
|
||||
it('falls back when the snapshot read errors', async () => {
|
||||
const { client } = snapshotClient(undefined, { message: 'boom' })
|
||||
await expect(
|
||||
resolveSkattekontoOcr(client, 'company-1', '559547-0021', 'aktiebolag'),
|
||||
).resolves.toBe('1655954700217')
|
||||
})
|
||||
})
|
||||
|
||||
@@ -6,48 +6,103 @@
|
||||
* Skattekonto receives the credit; Skatteverket applies it to the most recent
|
||||
* declared liability.
|
||||
*
|
||||
* Format (per Skatteverket "OCR-nummer för inbetalning till skattekontot"):
|
||||
* - 10-digit organisationsnummer (AB) or 10-digit personnummer (EF)
|
||||
* stripped of dashes/spaces
|
||||
* Format (per Skatteverket "Referensnummer (OCR) för inbetalning till
|
||||
* skattekonto"):
|
||||
* - The person-, samordnings- or organisationsnummer in its TWELVE-digit
|
||||
* form: an organisationsnummer carries the "16" prefix (5595470021 →
|
||||
* 165595470021), a personnummer its century (880225-1234 → 198802251234)
|
||||
* - Followed by a single Luhn check digit
|
||||
* - Total: 11 digits
|
||||
* - Total: 13 digits
|
||||
*
|
||||
* Examples:
|
||||
* 556012-3456 → "5560123456" + check digit "6" = "55601234566"
|
||||
* 880225-1234 → "8802251234" + check digit → 11 digits
|
||||
* Example: 559547-0021 → "165595470021" + check digit "7" = "1655954700217"
|
||||
*
|
||||
* Reference: https://www.skatteverket.se/foretag/skatterochavdrag/skattekonto/betalainochavskattekonto/sabetalardupaskattekontot.4.18e1b10334ebe8bc80004499.html
|
||||
* The twelve-digit form is the same "redovisare" identity the AGI and moms
|
||||
* APIs take, so it is built with the shared `toRedovisare12` converter rather
|
||||
* than a second local rule: the payment reference and the declaration it pays
|
||||
* must never disagree about who the taxpayer is.
|
||||
*
|
||||
* Reference: https://www.skatteverket.se/privat/etjansterochblanketter/allaetjanster/tjanster/ocrberakning
|
||||
*/
|
||||
|
||||
import { luhnCheckDigit } from '@/lib/bankgiro/luhn'
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import { luhnCheckDigit, luhnValidate } from '@/lib/bankgiro/luhn'
|
||||
import { toRedovisare12 } from '@/lib/invariants/org-number'
|
||||
|
||||
/** Bankgiro number for all payments to Skattekontot. */
|
||||
export const SKATTEKONTO_BANKGIRO = '5050-1055'
|
||||
|
||||
/**
|
||||
* Generate the standard Skattekontot OCR reference for a company.
|
||||
* The skattekonto extension caches Skatteverket's own saldo response here
|
||||
* (same shape the reconciliation engine reads). Core reads the row directly
|
||||
* rather than importing the extension: core must never import `@/extensions/*`.
|
||||
*/
|
||||
const SKATTEVERKET_EXTENSION_ID = 'skatteverket'
|
||||
const BALANCE_SNAPSHOT_KEY = 'skattekonto_balance_snapshot'
|
||||
|
||||
/**
|
||||
* Compute the Skattekontot OCR reference for a company.
|
||||
*
|
||||
* Accepts org_number/personnummer in any common Swedish format
|
||||
* ("556012-3456", "5560123456", "19880225-1234", "198802251234").
|
||||
* ("556012-3456", "5560123456", "19880225-1234", "198802251234"); a value
|
||||
* already in twelve-digit form passes through the century step untouched.
|
||||
*
|
||||
* For 12-digit personnummer (with century prefix), the leading century digits
|
||||
* are stripped: Skatteverket's Skattekonto-OCR uses the 10-digit form.
|
||||
* @throws when the input is not 10 or 12 digits after separators are stripped.
|
||||
*/
|
||||
export function generateSkattekontoOcr(orgOrPersonnummer: string): string {
|
||||
const digits = orgOrPersonnummer.replace(/\D/g, '')
|
||||
export function generateSkattekontoOcr(
|
||||
orgOrPersonnummer: string,
|
||||
entityType: 'enskild_firma' | 'aktiebolag',
|
||||
): string {
|
||||
const redovisare = toRedovisare12(orgOrPersonnummer, entityType)
|
||||
return redovisare + luhnCheckDigit(redovisare).toString()
|
||||
}
|
||||
|
||||
let base: string
|
||||
if (digits.length === 10) {
|
||||
base = digits
|
||||
} else if (digits.length === 12) {
|
||||
// Strip century prefix (1900s = "19", 2000s = "20")
|
||||
base = digits.slice(2)
|
||||
} else {
|
||||
throw new Error(
|
||||
`Ogiltigt org/personnummer för Skattekonto-OCR: "${orgOrPersonnummer}" (förväntat 10 eller 12 siffror)`
|
||||
)
|
||||
}
|
||||
/**
|
||||
* The OCR to print on a payment file, preferring the one Skatteverket itself
|
||||
* reported over the one we derive.
|
||||
*
|
||||
* `saldo.ocrNummer` comes straight out of the skattekonto API and is the
|
||||
* authoritative reference for the account we actually sync, which the derived
|
||||
* value can only approximate: it also covers identities our converter has no
|
||||
* rule for (samordningsnummer, GD-nummer) and companies whose stored
|
||||
* org_number has drifted from the skattekonto they are connected to.
|
||||
*
|
||||
* Falls back to {@link generateSkattekontoOcr} when no snapshot exists (the
|
||||
* Skatteverket extension is off or never synced) or the cached value fails a
|
||||
* Luhn check.
|
||||
*/
|
||||
export async function resolveSkattekontoOcr(
|
||||
supabase: SupabaseClient,
|
||||
companyId: string,
|
||||
orgOrPersonnummer: string,
|
||||
entityType: 'enskild_firma' | 'aktiebolag',
|
||||
): Promise<string> {
|
||||
const reported = await readReportedOcr(supabase, companyId)
|
||||
return reported ?? generateSkattekontoOcr(orgOrPersonnummer, entityType)
|
||||
}
|
||||
|
||||
const checkDigit = luhnCheckDigit(base)
|
||||
return base + checkDigit.toString()
|
||||
async function readReportedOcr(
|
||||
supabase: SupabaseClient,
|
||||
companyId: string,
|
||||
): Promise<string | null> {
|
||||
const { data, error } = await supabase
|
||||
.from('extension_data')
|
||||
.select('value')
|
||||
.eq('company_id', companyId)
|
||||
.eq('extension_id', SKATTEVERKET_EXTENSION_ID)
|
||||
.eq('key', BALANCE_SNAPSHOT_KEY)
|
||||
.maybeSingle()
|
||||
|
||||
if (error || !data?.value) return null
|
||||
|
||||
const value = data.value as { saldo?: { ocrNummer?: unknown } }
|
||||
const raw = value.saldo?.ocrNummer
|
||||
if (typeof raw !== 'string') return null
|
||||
|
||||
// Bankgirot accepts 2-25 digit OCR references; anything else in the cache is
|
||||
// not something we can put on a payment file, so fall back to the computed
|
||||
// value rather than shipping it.
|
||||
const digits = raw.replace(/\D/g, '')
|
||||
if (digits.length < 2 || digits.length > 25) return null
|
||||
|
||||
return luhnValidate(digits) ? digits : null
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user