fix(payments): lock supplier payment batch inserts to the RPC and log the raw error behind create_failed (#2282)
* fix(payments): lock supplier payment batch inserts to the RPC and log the raw error behind create_failed Two residuals from PR #1989 (atomic create_supplier_payment_batch RPC). Root cause 1: the original table migration (20260810160748) left member INSERT policies on supplier_payment_batches and supplier_payment_batch_items. The RPC is SECURITY DEFINER and never consulted them, so their only effect was to let any company member insert straight through PostgREST (browser devtools, a raw JWT call) and skip the RPC's invoice locking, in-transaction active-batch recheck and header/items totals consistency. The single write path existed in code only, not in the database. Fix 1: new migration 20260904121000 drops "insert own-company supplier_payment_batches" and "insert own-company supplier_payment_batch_items". SELECT policies on both tables and the UPDATE policy on batches (the cancel route) are untouched. No application code inserts into either table. Root cause 2: createSupplierPaymentBatch discarded the RPC error object and returned a bare create_failed, so the tenant guard (42501), a constraint violation inside the SECURITY DEFINER body and a PostgREST schema-cache miss after a deploy (PGRST202) were indistinguishable from each other and from an empty payload or an unmapped refusal code. Fix 2: log the raw error (code, message, details, hint) plus companyId, batchId and item count through lib/logger before each of the three create_failed returns. The client-facing result is unchanged; debtor_snapshot and the item rows (IBAN, payee data) are never logged. Tests: pg-real asserts the exact remaining policy set, that a member's and the owner's direct INSERT into either table is refused by RLS (42501), and that the same member still creates through the RPC and cancels through UPDATE. Unit tests assert the logger receives the raw error fields and that create_failed is still returned. Fixes #2060 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * docs(decisions): carry the ten-issue batch decision lines in one PR Append the decision lines for PRs #2272 through #2282 here so the other nine PRs in the batch do not touch DECISIONS.md and stay mergeable in any order (the union merge driver is ignored by GitHub). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * fix(payments): redact and bound raw RPC error text before logging Addresses the Superagent P2 on PR #2282 (lib/payments/batch-service.ts): message, details and hint from Postgres/PostgREST were logged verbatim, and Postgres quotes the entire failing row in details on CHECK and NOT NULL violations ("Failing row contains (..., SE45..., Anna Andersson, ...)"), so payee and account data could reach the log line. Excluding debtor_snapshot and the item rows did not cover the error text itself. Fix: a call-site helper, boundedRedactedText, runs each of the three text fields through lib/observability/redact.ts redactString (SE IBANs, personnummer, emails, API keys), drops any "Failing row contains (...)" payload whole (no pattern catches a payee name), and bounds the result to 500 chars, redaction before bounding so a cut IBAN cannot leave a digit fragment behind. The SQLSTATE code stays verbatim; the client-facing create_failed result is unchanged. Test: rejected RPC error carrying an IBAN in message, the full failing row (IBAN, payee name, account) in details and an oversized hint with the IBAN straddling the bound; asserts the serialized log context contains none of them, the row payload is replaced, and the hint is <= 500 chars ending in [TRUNCATED]. DECISIONS.md line for #2060 updated accordingly. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * fix(payments): drop the dotAll regex flag, tsconfig targets ES2017 The failing-row pattern used the `s` flag, which TypeScript rejects below es2018 (TS1501) and broke Build (zero extensions). `[\s\S]*` matches across newlines on every target. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * fix(payments): log code and message only for a failed batch RPC Reworks the logging half of #2060 from first principles. The diagnostic value of a failed create_supplier_payment_batch call lies in the SQLSTATE code and the message: the RPC's own RAISE text, "violates check constraint <name>", "duplicate key value violates unique constraint <name>". details is exactly where Postgres puts row data ("Failing row contains (...)", "Key (...)=(...)") and hint adds nothing operational, so neither is logged at all. That removes the payee/account exposure Superagent flagged on #2282 without the bespoke redact-and-bound helper, its regex and the TS-target workaround it needed: boundedRedactedText, FAILING_ROW_PATTERN, RPC_ERROR_TEXT_MAX and TRUNCATED are deleted, and the redact import goes with them. The logger's own redaction stays as the safety net for message. Client-facing result unchanged (create_failed). Test: an RPC error carrying an IBAN and a payee name in details and hint; the serialized log context contains neither field in any shape, and rpcError is exactly { code, message }. Exact-match and PGRST202 tests updated to the two-field shape. DECISIONS.md line for #2060 rewritten. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * docs(decisions): record the first-principles rework of the ten-issue batch Replace the decision lines for #2263, #2250, #2256 and #2211 with the reworked shapes, add the shared customer-share definition for #2248, and note the CLAUDE.md principle (#2283) that drove the rework. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u * docs(decisions): note the fiscal-year selection cap on #2280 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_015qgLgdt4mLmha1ZLFMwq1u --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
This commit is contained in:
Jakob Wennberg
co-authored by
Claude Fable 5.1
Jakob Wennberg
Claude Fable 5.1
Jakob Wennberg
parent
68fee7dbe7
commit
db289e3bdc
@@ -1,4 +1,22 @@
|
||||
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
||||
|
||||
// #2060: the diagnostic behind create_failed is a log line, so the logger is
|
||||
// the assertion surface. The REAL logger module is kept and only `error` is
|
||||
// swapped (same shape as lib/reconciliation/__tests__/bank-reconciliation.test.ts):
|
||||
// a file-global stub would throw from any module in this file's graph that
|
||||
// calls a level the stub omitted.
|
||||
const { logError } = vi.hoisted(() => ({ logError: vi.fn() }))
|
||||
vi.mock('@/lib/logger', async (importOriginal) => {
|
||||
const actual = await importOriginal<typeof import('@/lib/logger')>()
|
||||
return {
|
||||
...actual,
|
||||
createLogger: (module: string, base?: Parameters<typeof actual.createLogger>[1]) => ({
|
||||
...actual.createLogger(module, base),
|
||||
error: logError,
|
||||
}),
|
||||
}
|
||||
})
|
||||
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import { eventBus } from '@/lib/events'
|
||||
import { createQueuedMockSupabase } from '@/tests/helpers'
|
||||
@@ -11,6 +29,7 @@ import type { SupplierPaymentBatch, SupplierPaymentBatchItem } from '@/types'
|
||||
|
||||
const COMPANY_ID = 'c0000000-0000-0000-0000-000000000001'
|
||||
const USER_ID = 'u0000000-0000-0000-0000-000000000001'
|
||||
const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/
|
||||
|
||||
const companyRow = { name: 'Testbolaget AB', org_number: '556677-8899' }
|
||||
const settingsRow = {
|
||||
@@ -322,14 +341,106 @@ describe('createSupplierPaymentBatch', () => {
|
||||
})
|
||||
})
|
||||
|
||||
it('maps an RPC error (constraint violation, guard) to create_failed', async () => {
|
||||
it('maps an RPC error (constraint violation, guard) to create_failed and logs the raw error', async () => {
|
||||
const mock = createQueuedMockSupabase()
|
||||
const rpcError = {
|
||||
code: '23514',
|
||||
message:
|
||||
'new row for relation "supplier_payment_batch_items" violates check constraint "supplier_payment_batch_items_payee_fields_match"',
|
||||
details: 'Failing row contains (...).',
|
||||
hint: null,
|
||||
}
|
||||
mock.enqueueMany([
|
||||
{ data: companyRow },
|
||||
{ data: settingsRow },
|
||||
{ data: [invoiceRow()] },
|
||||
{ data: [] },
|
||||
{ error: { message: 'payee_fields_match', code: '23514' } },
|
||||
{ error: rpcError },
|
||||
])
|
||||
|
||||
const result = await createSupplierPaymentBatch(
|
||||
mock.supabase as unknown as SupabaseClient,
|
||||
COMPANY_ID,
|
||||
USER_ID,
|
||||
{ format: 'pain001', items: [{ supplier_invoice_id: 'inv-1' }] },
|
||||
)
|
||||
|
||||
// The client contract is unchanged: a generic create_failed, nothing else.
|
||||
expect(result).toEqual({ ok: false, code: 'create_failed' })
|
||||
|
||||
// The diagnosis lives in the log (#2060): SQLSTATE and message only, keyed
|
||||
// by company, batch and item count. Exact match on purpose: details and
|
||||
// hint (where Postgres quotes row data), the debtor snapshot and the item
|
||||
// rows must never ride along.
|
||||
expect(logError).toHaveBeenCalledTimes(1)
|
||||
expect(logError).toHaveBeenCalledWith('create_supplier_payment_batch RPC failed', {
|
||||
companyId: COMPANY_ID,
|
||||
batchId: expect.stringMatching(UUID_RE),
|
||||
itemCount: 1,
|
||||
rpcError: { code: '23514', message: rpcError.message },
|
||||
})
|
||||
const [, ctx] = logError.mock.calls[0] as [string, Record<string, unknown>]
|
||||
expect(ctx.batchId).toBe((mock.supabase.rpc.mock.calls[0][1] as { p_batch_id: string }).p_batch_id)
|
||||
})
|
||||
|
||||
it('never logs details or hint: an IBAN and a payee name there cannot reach the log, code and message do', async () => {
|
||||
const mock = createQueuedMockSupabase()
|
||||
const IBAN = 'SE4550000000058398257466'
|
||||
const rpcError = {
|
||||
code: '23514',
|
||||
message:
|
||||
'new row for relation "supplier_payment_batch_items" violates check constraint "supplier_payment_batch_items_payee_fields_match"',
|
||||
// Where Postgres quotes the entire failing row (payee name, account).
|
||||
details:
|
||||
'Failing row contains (b0000000-0000-0000-0000-000000000001, c0000000-0000-0000-0000-000000000001, ' +
|
||||
`737.50, 2099-08-15, bank_account, null, null, 5000, ${IBAN}, Anna Andersson, invoice_number, CD3014794407).`,
|
||||
hint: `Check the payee fields for Anna Andersson (${IBAN}).`,
|
||||
}
|
||||
mock.enqueueMany([
|
||||
{ data: companyRow },
|
||||
{ data: settingsRow },
|
||||
{ data: [invoiceRow()] },
|
||||
{ data: [] },
|
||||
{ error: rpcError },
|
||||
])
|
||||
|
||||
const result = await createSupplierPaymentBatch(
|
||||
mock.supabase as unknown as SupabaseClient,
|
||||
COMPANY_ID,
|
||||
USER_ID,
|
||||
{ format: 'pain001', items: [{ supplier_invoice_id: 'inv-1' }] },
|
||||
)
|
||||
expect(result).toEqual({ ok: false, code: 'create_failed' })
|
||||
|
||||
expect(logError).toHaveBeenCalledTimes(1)
|
||||
const [, ctx] = logError.mock.calls[0] as [string, Record<string, unknown>]
|
||||
// Nothing from details or hint, in any shape, anywhere in the context.
|
||||
const serialized = JSON.stringify(ctx)
|
||||
expect(serialized).not.toContain(IBAN)
|
||||
expect(serialized).not.toContain('Anna Andersson')
|
||||
expect(serialized).not.toContain('Failing row')
|
||||
expect(serialized).not.toContain(rpcError.hint)
|
||||
expect(ctx).not.toHaveProperty(['rpcError', 'details'])
|
||||
expect(ctx).not.toHaveProperty(['rpcError', 'hint'])
|
||||
// Only the two fields with diagnostic value, verbatim.
|
||||
expect(ctx.rpcError).toEqual({ code: '23514', message: rpcError.message })
|
||||
})
|
||||
|
||||
it('logs a PostgREST schema-cache miss (PGRST202) the same way, still as create_failed', async () => {
|
||||
const mock = createQueuedMockSupabase()
|
||||
const rpcError = {
|
||||
code: 'PGRST202',
|
||||
message:
|
||||
'Could not find the function public.create_supplier_payment_batch(p_batch_id, ...) in the schema cache',
|
||||
details: 'Searched for the function public.create_supplier_payment_batch with parameters ...',
|
||||
hint: 'Perhaps you meant to call the function public.create_supplier_payment_batch without parameters',
|
||||
}
|
||||
mock.enqueueMany([
|
||||
{ data: companyRow },
|
||||
{ data: settingsRow },
|
||||
{ data: [invoiceRow()] },
|
||||
{ data: [] },
|
||||
{ error: rpcError },
|
||||
])
|
||||
|
||||
const result = await createSupplierPaymentBatch(
|
||||
@@ -340,6 +451,14 @@ describe('createSupplierPaymentBatch', () => {
|
||||
)
|
||||
|
||||
expect(result).toEqual({ ok: false, code: 'create_failed' })
|
||||
expect(logError).toHaveBeenCalledWith(
|
||||
'create_supplier_payment_batch RPC failed',
|
||||
expect.objectContaining({
|
||||
companyId: COMPANY_ID,
|
||||
itemCount: 1,
|
||||
rpcError: { code: 'PGRST202', message: rpcError.message },
|
||||
}),
|
||||
)
|
||||
})
|
||||
|
||||
it('maps an unknown RPC refusal code and an empty RPC payload to create_failed', async () => {
|
||||
@@ -365,6 +484,19 @@ describe('createSupplierPaymentBatch', () => {
|
||||
input,
|
||||
)
|
||||
expect(unknown).toEqual({ ok: false, code: 'create_failed' })
|
||||
// An unmapped refusal code is logged with the code itself, so a code added
|
||||
// in SQL without a client mapping cannot vanish behind create_failed.
|
||||
expect(logError).toHaveBeenCalledTimes(1)
|
||||
expect(logError).toHaveBeenLastCalledWith(
|
||||
'create_supplier_payment_batch RPC refused with an unmapped code',
|
||||
{
|
||||
companyId: COMPANY_ID,
|
||||
batchId: expect.stringMatching(UUID_RE),
|
||||
itemCount: 1,
|
||||
rpcCode: 'something_new',
|
||||
rpcDetails: undefined,
|
||||
},
|
||||
)
|
||||
|
||||
const empty = await createSupplierPaymentBatch(
|
||||
mock.supabase as unknown as SupabaseClient,
|
||||
@@ -373,6 +505,44 @@ describe('createSupplierPaymentBatch', () => {
|
||||
input,
|
||||
)
|
||||
expect(empty).toEqual({ ok: false, code: 'create_failed' })
|
||||
expect(logError).toHaveBeenCalledTimes(2)
|
||||
expect(logError).toHaveBeenLastCalledWith(
|
||||
'create_supplier_payment_batch RPC returned no payload',
|
||||
{ companyId: COMPANY_ID, batchId: expect.stringMatching(UUID_RE), itemCount: 1 },
|
||||
)
|
||||
})
|
||||
|
||||
it('does not log when the RPC succeeds or refuses with a mapped code', async () => {
|
||||
const mock = createQueuedMockSupabase()
|
||||
mock.enqueueMany([
|
||||
{ data: companyRow },
|
||||
{ data: settingsRow },
|
||||
{ data: [invoiceRow()] },
|
||||
{ data: [] },
|
||||
{ data: { ok: true, batch: batchRow() } },
|
||||
{ data: companyRow },
|
||||
{ data: settingsRow },
|
||||
{ data: [invoiceRow()] },
|
||||
{ data: [] },
|
||||
{ data: { ok: false, code: 'already_batched', details: [{ id: 'inv-1', batch_id: 'b' }] } },
|
||||
])
|
||||
const input = { format: 'pain001' as const, items: [{ supplier_invoice_id: 'inv-1' }] }
|
||||
|
||||
const created = await createSupplierPaymentBatch(
|
||||
mock.supabase as unknown as SupabaseClient,
|
||||
COMPANY_ID,
|
||||
USER_ID,
|
||||
input,
|
||||
)
|
||||
expect(created.ok).toBe(true)
|
||||
const refused = await createSupplierPaymentBatch(
|
||||
mock.supabase as unknown as SupabaseClient,
|
||||
COMPANY_ID,
|
||||
USER_ID,
|
||||
input,
|
||||
)
|
||||
expect(refused).toMatchObject({ ok: false, code: 'already_batched' })
|
||||
expect(logError).not.toHaveBeenCalled()
|
||||
})
|
||||
|
||||
it('rejects the whole batch when any invoice is ineligible', async () => {
|
||||
|
||||
@@ -20,6 +20,7 @@
|
||||
*/
|
||||
|
||||
import type { SupabaseClient } from '@supabase/supabase-js'
|
||||
import { createLogger } from '@/lib/logger'
|
||||
import { getBranding } from '@/lib/branding/service'
|
||||
import { getSwedishLocalDate } from '@/lib/bookkeeping/engine'
|
||||
import { ORE_TOLERANCE, roundOre, sumOre } from '@/lib/money'
|
||||
@@ -39,6 +40,8 @@ import { formatPayeeLabel, type SupplierPayeeSource } from './supplier-payee'
|
||||
import { generateSupplierPain001, type SupplierPain001Payment } from './pain001-supplier'
|
||||
import type { SupplierPaymentBatch, SupplierPaymentBatchItem } from '@/types'
|
||||
|
||||
const log = createLogger('payments/batch-service')
|
||||
|
||||
type InvoiceRow = BatchInvoiceFacts & {
|
||||
supplier: (SupplierPayeeSource & { id: string; name: string; city: string | null }) | null
|
||||
}
|
||||
@@ -363,10 +366,36 @@ export async function createSupplierPaymentBatch(
|
||||
p_confirm_already_batched: input.confirm_already_batched ?? false,
|
||||
p_user_id: userId,
|
||||
})
|
||||
if (error) return { ok: false, code: 'create_failed' }
|
||||
// The client only ever sees create_failed. What tells the RPC's tenant
|
||||
// guard (42501), a constraint violation inside the SECURITY DEFINER body
|
||||
// and a PostgREST schema-cache miss right after a deploy (PGRST202) apart
|
||||
// is the SQLSTATE plus the message (the RPC's own RAISE text, "violates
|
||||
// check constraint <name>", "duplicate key value violates unique
|
||||
// constraint <name>"), so those two go to the log (#2060). `details` is
|
||||
// where Postgres quotes row data ("Failing row contains (...)",
|
||||
// "Key (...)=(...)") and `hint` adds nothing operational: neither is
|
||||
// logged, so payee and account data cannot reach a log line through them.
|
||||
// debtor_snapshot and the item rows are not logged either; companyId,
|
||||
// batchId and the item count make the line greppable.
|
||||
if (error) {
|
||||
log.error('create_supplier_payment_batch RPC failed', {
|
||||
companyId,
|
||||
batchId,
|
||||
itemCount: itemRows.length,
|
||||
rpcError: { code: error.code, message: error.message },
|
||||
})
|
||||
return { ok: false, code: 'create_failed' }
|
||||
}
|
||||
|
||||
const result = data as CreateBatchRpcResult | null
|
||||
if (!result) return { ok: false, code: 'create_failed' }
|
||||
if (!result) {
|
||||
log.error('create_supplier_payment_batch RPC returned no payload', {
|
||||
companyId,
|
||||
batchId,
|
||||
itemCount: itemRows.length,
|
||||
})
|
||||
return { ok: false, code: 'create_failed' }
|
||||
}
|
||||
if (!result.ok) {
|
||||
switch (result.code) {
|
||||
case 'already_batched':
|
||||
@@ -388,6 +417,16 @@ export async function createSupplierPaymentBatch(
|
||||
details: result.details as Array<{ id: string; reason: string }>,
|
||||
}
|
||||
default:
|
||||
// An RPC refusal code with no client mapping (a code added in SQL
|
||||
// without this switch learning it, or the RPC's own payload-shape
|
||||
// refusals) must stay visible rather than vanish behind create_failed.
|
||||
log.error('create_supplier_payment_batch RPC refused with an unmapped code', {
|
||||
companyId,
|
||||
batchId,
|
||||
itemCount: itemRows.length,
|
||||
rpcCode: result.code,
|
||||
rpcDetails: result.details,
|
||||
})
|
||||
return { ok: false, code: 'create_failed' }
|
||||
}
|
||||
}
|
||||
|
||||
Reference in New Issue
Block a user