fix(invoices): scope-check article ids in buildInvoiceWriteData so every invoice write refuses a foreign company's article (part of #2059) (#2339)

Part of #2059 (Part 2, the hardening bug).

The FK on invoice_items.article_id proves the article exists, not that it
belongs to the writing company: FK validation ignores RLS, and the v1 routes
run on the service-role client with no RLS at all. Only the two MCP commit
executors checked tenancy; the cookie POST/PATCH, v1 POST/PATCH, webshop and
sales-order writers passed items[].article_id straight through the builder.

Move the check to the one point every writer converges on: buildInvoiceWriteData
collects the distinct article ids from product lines, runs one select scoped
on company_id, and refuses with the new INVOICE_CREATE_ARTICLE_INVALID (400,
Swedish message via the structured-error registry) on any miss. The MCP
executor checks stay as the tamper gate for staged rows.

Tests: builder unit cases (miss refused with details, dedupe + happy path,
no article ids means no query, DB error surfaces as dbError), cookie PATCH
and v1 POST refusal cases, and the existing v1 persist + MCP update tests now
answer the builder's scoped select.


Claude-Session: https://claude.ai/code/session_019SaJfqNi4VmsG8FMKq99G6

Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>

lib/errors/structured-errors.ts

@@ -888,6 +888,11 @@ const INVOICE: Record<string, StructuredErrorEntry> = {
     message_sv: 'Ett angivet bokföringskonto finns inte eller är inte ett aktivt balans- eller intäktskonto (klass 1-3).',
     message_en: 'A supplied posting account does not exist or is not an active balance-sheet or revenue account (class 1-3).',
   },
+  INVOICE_CREATE_ARTICLE_INVALID: {
+    httpStatus: 400,
+    message_sv: 'En angiven artikel finns inte i företaget.',
+    message_en: 'A supplied article does not exist in this company.',
+  },
   INVOICE_CREATE_POSTING_ACCOUNT_VAT_CONFLICT: {
     httpStatus: 400,
     message_sv: 'Ett balanskonto (klass 1-2) kan bara användas på rader utan moms. Använd ett intäktskonto (3xxx) för momspliktiga rader.',

lib/invoices/__tests__/build-invoice-write.test.ts

@@ -597,3 +597,85 @@ describe('buildInvoiceWriteData kundkort fallback customer-type gate', () => {
     expect(result.items[0]).toMatchObject({ sales_order_item_id: null })
   })
 })
+
+describe('buildInvoiceWriteData article company scope (issue #2059)', () => {
+  const ARTICLE_A = 'a1000000-0000-4000-8000-000000000001'
+  const ARTICLE_B = 'a1000000-0000-4000-8000-000000000002'
+  const FOREIGN_ARTICLE = 'a1000000-0000-4000-8000-0000000000ff'
+  const customer = makeCustomer({ customer_type: 'swedish_business' })
+
+  it('refuses an article id the company-scoped select cannot see', async () => {
+    const { supabase, enqueue, findCall } = createQueuedMockSupabase()
+    enqueue({ data: { vat_registered: true }, error: null }) // company_settings
+    enqueue({ data: [], error: null }) // articles: no company-scoped hit
+
+    const result = await call(enqueue, supabase as unknown as SupabaseClient, customer, {
+      ...baseHeader,
+      items: [
+        { description: 'Konsult', quantity: 1, unit: 'tim', unit_price: 1000, vat_rate: 25, article_id: FOREIGN_ARTICLE },
+      ],
+    })
+
+    expect(result.ok).toBe(false)
+    if (result.ok || !('code' in result)) return
+    expect(result.code).toBe('INVOICE_CREATE_ARTICLE_INVALID')
+    expect(result.details).toEqual({ invalidArticleIds: [FOREIGN_ARTICLE] })
+    // The select is scoped on company_id: the FK alone only proves existence.
+    expect(findCall('articles', 'eq')).toEqual(['company_id', 'company-1'])
+    expect(findCall('articles', 'in')).toEqual(['id', [FOREIGN_ARTICLE]])
+  })
+
+  it('accepts company-owned articles, deduping repeated ids into one select', async () => {
+    const { supabase, enqueue, findCall } = createQueuedMockSupabase()
+    enqueue({ data: { vat_registered: true }, error: null }) // company_settings
+    enqueue({ data: [{ id: ARTICLE_A }, { id: ARTICLE_B }], error: null }) // articles
+
+    const result = await call(enqueue, supabase as unknown as SupabaseClient, customer, {
+      ...baseHeader,
+      items: [
+        { description: 'Rad 1', quantity: 1, unit: 'st', unit_price: 100, vat_rate: 25, article_id: ARTICLE_A },
+        { description: 'Rad 2', quantity: 2, unit: 'st', unit_price: 100, vat_rate: 25, article_id: ARTICLE_A },
+        { description: 'Rad 3', quantity: 1, unit: 'st', unit_price: 100, vat_rate: 25, article_id: ARTICLE_B },
+      ],
+    })
+
+    expect(result.ok).toBe(true)
+    if (!result.ok) return
+    expect(result.items.map((i) => i.article_id)).toEqual([ARTICLE_A, ARTICLE_A, ARTICLE_B])
+    expect(findCall('articles', 'in')).toEqual(['id', [ARTICLE_A, ARTICLE_B]])
+  })
+
+  it('never queries articles when no product line carries an article id', async () => {
+    const { supabase, enqueue } = createQueuedMockSupabase()
+    enqueue({ data: { vat_registered: true }, error: null }) // company_settings
+
+    const result = await call(enqueue, supabase as unknown as SupabaseClient, customer, {
+      ...baseHeader,
+      items: [
+        { description: 'Konsult', quantity: 1, unit: 'tim', unit_price: 1000, vat_rate: 25 },
+        // A text row never persists an article, so an id on it must not be checked.
+        { line_type: 'text', description: 'Fri text', quantity: 0, unit: '', unit_price: 0, article_id: FOREIGN_ARTICLE },
+      ],
+    })
+
+    expect(result.ok).toBe(true)
+    expect(supabase.from).not.toHaveBeenCalledWith('articles')
+  })
+
+  it('surfaces a DB error on the article lookup as dbError, not as a refusal', async () => {
+    const { supabase, enqueue } = createQueuedMockSupabase()
+    enqueue({ data: { vat_registered: true }, error: null }) // company_settings
+    enqueue({ data: null, error: { message: 'connection reset' } }) // articles
+
+    const result = await call(enqueue, supabase as unknown as SupabaseClient, customer, {
+      ...baseHeader,
+      items: [
+        { description: 'Konsult', quantity: 1, unit: 'tim', unit_price: 1000, vat_rate: 25, article_id: ARTICLE_A },
+      ],
+    })
+
+    expect(result.ok).toBe(false)
+    if (result.ok) return
+    expect('dbError' in result).toBe(true)
+  })
+})

lib/invoices/build-invoice-write.ts

@@ -318,6 +318,40 @@ export async function buildInvoiceWriteData(params: {
     }
   }
 
+  // Article linkage is a tenancy invariant: the FK on invoice_items.article_id
+  // proves the article EXISTS, not that it belongs to THIS company. FK
+  // validation is internal to Postgres and ignores RLS, and the v1 routes run
+  // on the service-role client with no RLS at all, so a body carrying another
+  // company's article UUID would otherwise persist a cross-tenant reference.
+  // Every invoice write path converges here (cookie POST/PATCH, v1 POST/PATCH,
+  // webshop, sales-order conversion, MCP update), so one scoped select covers
+  // them all. The MCP executors keep their own pre-check as the tamper gate
+  // for staged rows. Text rows never persist an article (mapped to null below).
+  const articleIds = Array.from(
+    new Set(
+      items
+        .filter((item) => item.line_type !== 'text')
+        .map((item) => item.article_id)
+        .filter((a): a is string => !!a),
+    ),
+  )
+  if (articleIds.length > 0) {
+    const { data: articleRows, error: articlesError } = await supabase
+      .from('articles')
+      .select('id')
+      .eq('company_id', companyId)
+      .in('id', articleIds)
+
+    if (articlesError) {
+      return { ok: false, dbError: articlesError }
+    }
+    const foundArticleIds = new Set((articleRows ?? []).map((a) => a.id))
+    const invalidArticleIds = articleIds.filter((a) => !foundArticleIds.has(a))
+    if (invalidArticleIds.length > 0) {
+      return { ok: false, code: 'INVOICE_CREATE_ARTICLE_INVALID', details: { invalidArticleIds } }
+    }
+  }
+
   // ROT/RUT-avdrag: validate prerequisites and compute the per-item +
   // invoice-level deduction. Computed server-side (never trusted from the
   // client) so a tampered request can't expand the 1513 receivable. Skipped

lib/pending-operations/__tests__/update-invoice-executor.test.ts

@@ -260,6 +260,7 @@ describe('commitPendingOperation: update_invoice', () => {
     enqueue({ data: [{ id: ARTICLE_ID }] }) // articles: company-scope gate
     enqueue({ data: { vat_registered: true } }) // company_settings (builder VAT gate)
     enqueue({ data: [{ account_number: '3041' }] }) // chart_of_accounts: override account
+    enqueue({ data: [{ id: ARTICLE_ID }] }) // articles: builder company-scope check (#2059)
     enqueue({ data: [{ id: INVOICE_ID }] }) // invoices update (draft-guarded)
     enqueue({ data: [] }) // invoice_items snapshot (replaceInvoiceItems)
     enqueue({ data: null }) // invoice_items delete