Bug/open banking flow (#854)
* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects We never sent auth_method to Enable Banking, so it fell back to the ASPSP's visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate* PSUs the redirect flow does not support Mobile BankID, so authorization failed right after the user approved in the BankID app. Mobile BankID at Handelsbanken is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses when requested explicitly. Resolve the bank's preferred auth method before /auth: query the ASPSP's auth_methods and pick the DECOUPLED (Mobile BankID) method when present, otherwise leave auth_method unset so banks that already work are untouched. The method name is read dynamically per psu_type, so it is robust across sandbox/production naming. - api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods field name (was available_auth_methods, never populated), add getPreferredAuthMethod(), thread optional authMethod through startAuthorization - index: resolve authMethod in /connect and pass it on both fresh + reconnect - tests: cover method selection and request-body shaping Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(invoice-inbox): clean up bulk-selection toolbar UI Redesign the selection toolbar shown when inbox items are checked: one solid primary "Bokför valda" button with outlined secondary actions ("Fråga assistenten", "Ta bort") and a plain selection count. Removes the redundant "Avmarkera" button (users uncheck the still-visible box), fixes label clipping, and gives the toolbar more breathing room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(entitlements): bypass paywall in local development Add isPaywallBypassed() so all gated capabilities are testable locally without a subscription. Fires only on NODE_ENV=development (npm run dev) or an explicit DISABLE_PAYWALL=true escape hatch — production builds run under NODE_ENV=production and the entitlement suite runs under 'test', so both keep exercising the real gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement categorize core for bank transaction categorization - Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations. - Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing. - Implemented fiscal period validation and duplicate booking detection. - Enhanced logging and error handling for transaction categorization. feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata - Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken. - Outputs metadata for business and personal PSU types, including default authentication methods. fix(migrations): increase statement timeout for SIE bulk delete operations - Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports. feat(migrations): add bulk book inbox items to pending operations - Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`. - Supports bulk booking of matched inbox items against bank transactions. test(pg): add tests for replace_period_opening_balance_link RPC - Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow. - Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries. * fix(sie-export): update journal entries and lines handling in SIE export tests * fix(migrations): resolve version collision on 20260629160000 The SIE bulk-delete statement_timeout migration shared version 20260629160000 with journal_entries_list_series_filter (merged from main via #798/#823), causing a schema_migrations_pkey duplicate key error on apply. Rename the branch's migration to 20260629160100. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(compliance): resolve compliance-swarm + review findings - opening-balance/correct: compensating rollback for the non-atomic storno+rebook so a mid-sequence failure never leaves two posted OB entries (ASVS V2.3); durable audit event on every failure path (V16); reference the original verifikationsnummer in the corrected entry per BFL 5 kap 5§; document that requireWrite already enforces write-role + membership (V8.2.1 was a false positive) - reports sources routes: validate the cursor date component as ISO (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2), applied to both the VAT-declaration and trial-balance routes - AgentSessionList: await the rename PATCH, revert the optimistic title and toast on failure (ASVS V4.5) - bank booking: exclude same-batch siblings from the booking-time duplicate guard so bulk-booking distinct same-(date,amount) transactions no longer false-positives; pre-existing duplicate detection is preserved - BulkBookInboxDialog: drop the unsafe currency-based reverse_charge default, add an omvänd skattskyldighet advisory, and type VAT options to the backend VatTreatment union - OpeningBalanceRowEditor: hold onChange in a ref (synced in effect, not during render) so an unstable callback can't cause a render loop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2da9c71eb3
commit
f63d3e3100
@@ -18,6 +18,8 @@ import {
|
||||
isSessionExpiredResponse,
|
||||
SessionExpiredError,
|
||||
getAllTransactionsWithRaw,
|
||||
getPreferredAuthMethod,
|
||||
startAuthorization,
|
||||
} from '../lib/api-client'
|
||||
import { enableBankingExtension } from '../index'
|
||||
import { syncAccountTransactions } from '../lib/sync'
|
||||
@@ -369,3 +371,86 @@ describe('POST /connect (enable-banking) — psu_type persistence', () => {
|
||||
expect(insertSpy.mock.calls[0][0]).toMatchObject({ psu_type: 'personal' })
|
||||
})
|
||||
})
|
||||
|
||||
describe('auth_method selection (Handelsbanken Mobile BankID)', () => {
|
||||
afterEach(() => {
|
||||
vi.unstubAllGlobals()
|
||||
})
|
||||
|
||||
function stubAspsps(aspsps: unknown[]) {
|
||||
vi.stubGlobal(
|
||||
'fetch',
|
||||
vi.fn(async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
statusText: 'OK',
|
||||
json: async () => ({ aspsps }),
|
||||
text: async () => '',
|
||||
}))
|
||||
)
|
||||
}
|
||||
|
||||
it('picks the DECOUPLED (Mobile BankID) method when the bank exposes one', async () => {
|
||||
// Handelsbanken's real shape: BankID is decoupled + hidden, Redirect is the
|
||||
// visible default. We must pin BankID or corporate PSUs fail after BankID.
|
||||
stubAspsps([
|
||||
{
|
||||
name: 'Handelsbanken',
|
||||
country: 'SE',
|
||||
bic: 'HANDSESS',
|
||||
auth_methods: [
|
||||
{ name: 'BANKID', approach: 'DECOUPLED', hidden_method: true, title: 'Bank ID' },
|
||||
{ name: 'REDIRECT', approach: 'REDIRECT', hidden_method: false, title: 'Redirect' },
|
||||
],
|
||||
},
|
||||
])
|
||||
|
||||
expect(await getPreferredAuthMethod('Handelsbanken', 'SE', 'business')).toBe('BANKID')
|
||||
})
|
||||
|
||||
it('returns undefined (ASPSP default) when the bank has no decoupled method', async () => {
|
||||
stubAspsps([
|
||||
{ name: 'Nordea', country: 'SE', auth_methods: [{ name: 'REDIRECT', approach: 'REDIRECT' }] },
|
||||
])
|
||||
|
||||
expect(await getPreferredAuthMethod('Nordea', 'SE', 'personal')).toBeUndefined()
|
||||
})
|
||||
|
||||
it('returns undefined when the bank is not found in the ASPSP list', async () => {
|
||||
stubAspsps([])
|
||||
expect(await getPreferredAuthMethod('Handelsbanken', 'SE', 'business')).toBeUndefined()
|
||||
})
|
||||
|
||||
it('startAuthorization sends auth_method in the request body when provided', async () => {
|
||||
const fetchMock = vi.fn(async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
statusText: 'OK',
|
||||
json: async () => ({ url: 'https://bank.example/auth', authorization_id: 'auth-1' }),
|
||||
text: async () => '',
|
||||
}))
|
||||
vi.stubGlobal('fetch', fetchMock)
|
||||
|
||||
await startAuthorization('Handelsbanken', 'SE', 'https://app/cb', 'state-1', 'business', 'BANKID')
|
||||
|
||||
const body = JSON.parse((fetchMock.mock.calls[0][1] as { body: string }).body)
|
||||
expect(body.auth_method).toBe('BANKID')
|
||||
expect(body.psu_type).toBe('business')
|
||||
})
|
||||
|
||||
it('startAuthorization omits auth_method when none is provided', async () => {
|
||||
const fetchMock = vi.fn(async () => ({
|
||||
ok: true,
|
||||
status: 200,
|
||||
statusText: 'OK',
|
||||
json: async () => ({ url: 'https://bank.example/auth', authorization_id: 'auth-1' }),
|
||||
text: async () => '',
|
||||
}))
|
||||
vi.stubGlobal('fetch', fetchMock)
|
||||
|
||||
await startAuthorization('Nordea', 'SE', 'https://app/cb', 'state-1', 'personal')
|
||||
|
||||
const body = JSON.parse((fetchMock.mock.calls[0][1] as { body: string }).body)
|
||||
expect('auth_method' in body).toBe(false)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -3,6 +3,7 @@ import { NextResponse } from 'next/server'
|
||||
import {
|
||||
startAuthorization,
|
||||
getASPSPs,
|
||||
getPreferredAuthMethod,
|
||||
deleteSession,
|
||||
isSandboxMode,
|
||||
SessionExpiredError,
|
||||
@@ -178,11 +179,24 @@ export const enableBankingExtension: Extension = {
|
||||
}
|
||||
}
|
||||
|
||||
// Resolve the bank's preferred auth method. Handelsbanken (and some
|
||||
// other Swedish banks) expose Mobile BankID only as a hidden DECOUPLED
|
||||
// method; without this, Enable Banking defaults to the REDIRECT method,
|
||||
// which for Handelsbanken *corporate* PSUs cannot complete with Mobile
|
||||
// BankID — the user approves in the app and then hits an error. Returns
|
||||
// undefined for banks with no decoupled method, leaving them untouched.
|
||||
const authMethod = await getPreferredAuthMethod(
|
||||
resolvedAspspName,
|
||||
resolvedAspspCountry,
|
||||
psuType
|
||||
)
|
||||
|
||||
log.info('[enable-banking] Starting bank connection', {
|
||||
user_id: user.id,
|
||||
bank: resolvedAspspName,
|
||||
country: resolvedAspspCountry,
|
||||
psu_type: psuType,
|
||||
auth_method: authMethod ?? '(aspsp default)',
|
||||
reconnect: isReconnect,
|
||||
})
|
||||
|
||||
@@ -293,7 +307,8 @@ export const enableBankingExtension: Extension = {
|
||||
resolvedAspspCountry,
|
||||
redirectUrl,
|
||||
oauthState,
|
||||
psuType
|
||||
psuType,
|
||||
authMethod
|
||||
)
|
||||
|
||||
// Record the bank's authorization_id for audit/traceability. The
|
||||
@@ -325,7 +340,8 @@ export const enableBankingExtension: Extension = {
|
||||
resolvedAspspCountry,
|
||||
redirectUrl,
|
||||
oauthState,
|
||||
psuType
|
||||
psuType,
|
||||
authMethod
|
||||
)
|
||||
|
||||
const { data: connection, error } = await supabase
|
||||
|
||||
@@ -31,12 +31,19 @@ export interface ASPSP {
|
||||
bic?: string
|
||||
beta?: boolean
|
||||
max_consent_validity?: number
|
||||
available_auth_methods?: AuthMethod[]
|
||||
// Enable Banking returns this field as `auth_methods` on the ASPSP object.
|
||||
auth_methods?: AuthMethod[]
|
||||
}
|
||||
|
||||
export interface AuthMethod {
|
||||
name: string
|
||||
title?: string
|
||||
// How the SCA is performed. Mobile BankID at several Swedish banks is a
|
||||
// DECOUPLED method; the visible default is often a REDIRECT method.
|
||||
approach?: 'REDIRECT' | 'DECOUPLED' | 'EMBEDDED'
|
||||
// When true, Enable Banking only uses this method if it is requested
|
||||
// explicitly via auth_method (it is not the implicit default).
|
||||
hidden_method?: boolean
|
||||
psu_types?: ('personal' | 'business')[]
|
||||
}
|
||||
|
||||
@@ -333,6 +340,40 @@ export async function getASPSPs(country: string = 'SE', psuType?: 'personal' | '
|
||||
return data.aspsps || []
|
||||
}
|
||||
|
||||
/**
|
||||
* Resolve the auth_method we should request for a given bank, or undefined to
|
||||
* let Enable Banking use the ASPSP's visible default.
|
||||
*
|
||||
* Why: several Swedish ASPSPs (notably Handelsbanken) expose Mobile BankID only
|
||||
* as a DECOUPLED method flagged hidden_method=true. When we send no auth_method,
|
||||
* Enable Banking falls back to the visible REDIRECT method — which for
|
||||
* Handelsbanken *corporate* PSUs does not support Mobile BankID, so the consent
|
||||
* fails right after the user approves in the BankID app ("fel efter BankID").
|
||||
* Pinning the decoupled (Mobile BankID) method makes the flow work for both
|
||||
* business and personal PSUs. We return undefined when the bank exposes no
|
||||
* decoupled method or the lookup fails, so banks that already work are untouched.
|
||||
*/
|
||||
export async function getPreferredAuthMethod(
|
||||
aspspName: string,
|
||||
country: string,
|
||||
psuType: 'personal' | 'business'
|
||||
): Promise<string | undefined> {
|
||||
try {
|
||||
const aspsps = await getASPSPs(country, psuType)
|
||||
const aspsp = aspsps.find((a) => a.name === aspspName)
|
||||
const decoupled = aspsp?.auth_methods?.find((m) => m.approach === 'DECOUPLED')
|
||||
return decoupled?.name
|
||||
} catch (error) {
|
||||
console.error('[enable-banking] getPreferredAuthMethod failed; using ASPSP default', {
|
||||
aspspName,
|
||||
country,
|
||||
psuType,
|
||||
error: error instanceof Error ? error.message : String(error),
|
||||
})
|
||||
return undefined
|
||||
}
|
||||
}
|
||||
|
||||
/**
|
||||
* Get list of supported banks (legacy format for backward compatibility)
|
||||
*/
|
||||
@@ -367,19 +408,30 @@ export async function getSupportedBanks(): Promise<Bank[]> {
|
||||
* @param redirectUrl - URL to redirect user after bank authorization
|
||||
* @param state - State parameter returned in callback (e.g., user ID)
|
||||
* @param psuType - Type of user: 'personal' or 'business'
|
||||
* @param authMethod - Optional Enable Banking auth_method name. When omitted,
|
||||
* Enable Banking uses the ASPSP's visible default method. See
|
||||
* getPreferredAuthMethod for why we pin Mobile BankID at some banks.
|
||||
*/
|
||||
export async function startAuthorization(
|
||||
aspspName: string,
|
||||
aspspCountry: string,
|
||||
redirectUrl: string,
|
||||
state: string,
|
||||
psuType: 'personal' | 'business' = 'personal'
|
||||
psuType: 'personal' | 'business' = 'personal',
|
||||
authMethod?: string
|
||||
): Promise<AuthResponse> {
|
||||
// Calculate consent validity (90 days)
|
||||
const validUntil = new Date()
|
||||
validUntil.setDate(validUntil.getDate() + 90)
|
||||
|
||||
const requestBody = {
|
||||
const requestBody: {
|
||||
access: { valid_until: string }
|
||||
aspsp: { name: string; country: string }
|
||||
state: string
|
||||
redirect_url: string
|
||||
psu_type: 'personal' | 'business'
|
||||
auth_method?: string
|
||||
} = {
|
||||
access: {
|
||||
valid_until: validUntil.toISOString()
|
||||
},
|
||||
@@ -391,6 +443,9 @@ export async function startAuthorization(
|
||||
redirect_url: redirectUrl,
|
||||
psu_type: psuType
|
||||
}
|
||||
if (authMethod) {
|
||||
requestBody.auth_method = authMethod
|
||||
}
|
||||
|
||||
const response = await authenticatedFetch('/auth', {
|
||||
method: 'POST',
|
||||
|
||||
@@ -24,7 +24,8 @@ import { createJournalEntry } from '@/lib/bookkeeping/engine'
|
||||
import { bookkeepingErrorResponse } from '@/lib/bookkeeping/errors'
|
||||
import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
|
||||
import { linkToJournalEntry } from '@/lib/core/documents/document-service'
|
||||
import { CreateSupplierInvoiceSchema, BookInboxItemDirectlySchema } from '@/lib/api/schemas'
|
||||
import { CreateSupplierInvoiceSchema, BookInboxItemDirectlySchema, BulkBookInboxSchema } from '@/lib/api/schemas'
|
||||
import { bulkBookMatchedInboxItems } from '@/lib/transactions/categorize-core'
|
||||
import { appendProcessingHistory } from '@/lib/processing-history/append'
|
||||
import { checkInboxUploadRateLimit } from '@/lib/rate-limits/inbox'
|
||||
import { simpleParser } from 'mailparser'
|
||||
@@ -2140,6 +2141,49 @@ export const invoiceInboxExtension: Extension = {
|
||||
})
|
||||
},
|
||||
},
|
||||
|
||||
// ── Bulk-book selected inbox items (Modell B) ─────────────
|
||||
// "Bokför valda" in the Underlag selection bar. Each selected item is
|
||||
// booked against its matched bank transaction (which already carries the
|
||||
// SEK amount) using one shared category + VAT treatment — individual
|
||||
// verifikat, not a samlingsverifikation. Unmatched / already-booked /
|
||||
// supplier-invoice-linked items are skipped, not errored, so the batch is
|
||||
// resilient. Reuses the same categorize core as the single-item agent flow,
|
||||
// so reverse-charge moms on foreign services is handled correctly.
|
||||
{
|
||||
method: 'POST',
|
||||
path: '/items/bulk-book',
|
||||
handler: async (request: Request, ctx?: ExtensionContext) => {
|
||||
if (!ctx) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
||||
|
||||
let body: z.infer<typeof BulkBookInboxSchema>
|
||||
try {
|
||||
const json = await request.json()
|
||||
body = BulkBookInboxSchema.parse(json)
|
||||
} catch (err) {
|
||||
return NextResponse.json(
|
||||
{ error: err instanceof Error ? err.message : 'Invalid request body' },
|
||||
{ status: 400 }
|
||||
)
|
||||
}
|
||||
|
||||
const { booked, skipped } = await bulkBookMatchedInboxItems(
|
||||
ctx.supabase,
|
||||
ctx.userId,
|
||||
ctx.companyId,
|
||||
body,
|
||||
)
|
||||
|
||||
return NextResponse.json({
|
||||
data: {
|
||||
booked_count: booked.length,
|
||||
skipped_count: skipped.length,
|
||||
booked,
|
||||
skipped,
|
||||
},
|
||||
})
|
||||
},
|
||||
},
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
@@ -59,9 +59,14 @@ describe('tools/list payload size guard', () => {
|
||||
// which have a pre-flight; gnubok_get_agent_briefing also gained a `company`
|
||||
// identity block in its outputSchema. This is wire data the agent depends
|
||||
// on, not trimmable prose — hence a bump rather than a description trim.
|
||||
// * 38K → 40K as the catalog grew from 92 to 103 tools (gnubok_link_document_
|
||||
// to_voucher #804, gnubok_bulk_book_inbox_items, the categorize-core additions,
|
||||
// plus per-line supplier-invoice overrides). Each new tool carries its
|
||||
// inputSchema + staging _meta; the growth is genuine wire data, not prose,
|
||||
// so descriptions are already at their trimmed floor (~180–220 chars).
|
||||
// Long-term answer to growth is leaning harder on gnubok_search_tools — if this
|
||||
// fires again, prefer trimming descriptions or making a tool opt-in via search
|
||||
// before bumping further.
|
||||
expect(approxTokens).toBeLessThan(38_000)
|
||||
expect(approxTokens).toBeLessThan(40_000)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -5415,6 +5415,126 @@ export const tools: McpTool[] = [
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
name: 'gnubok_bulk_book_inbox_items',
|
||||
title: 'Bulk-Book Underlag',
|
||||
description: 'Bulk-book N selected Underlag (Dokumentinkorgen) against their matched bank transactions with one shared category + VAT treatment. Set reverse_charge for foreign SaaS. Unmatched/booked items are skipped. Stages one approval.',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
additionalProperties: false,
|
||||
properties: {
|
||||
item_ids: {
|
||||
type: 'array',
|
||||
minItems: 1,
|
||||
maxItems: 200,
|
||||
items: { type: 'string' },
|
||||
description: "Inbox item UUIDs to book — the user's selection in the Underlag view.",
|
||||
},
|
||||
category: { type: 'string', description: 'Shared transaction category applied to every item', enum: [...VALID_CATEGORIES] },
|
||||
vat_treatment: { type: 'string', description: 'Shared VAT treatment. Set reverse_charge for foreign services (omvänd skattskyldighet) where the seller did NOT charge VAT — typical for USD/EUR SaaS subscriptions like Cursor/Anysphere. Defaults to standard_25.', enum: [...VALID_VAT_TREATMENTS] },
|
||||
vat_amount: { type: 'number', exclusiveMinimum: 0, description: "The underlag's exact moms override; only valid with a rate-based vat_treatment. Rarely needed in bulk — all items share one value." },
|
||||
notes: { type: 'string', description: 'Audit-trail note appended to every verifikation. Keep under 200 chars.' },
|
||||
allow_duplicate: { type: 'boolean', description: 'Override the per-item duplicate-booking guard (default false). Set true only after the user confirms these bank lines are genuinely separate events.' },
|
||||
},
|
||||
required: ['item_ids', 'category'],
|
||||
},
|
||||
outputSchema: STAGED_OPERATION_SCHEMA,
|
||||
annotations: {
|
||||
readOnlyHint: false,
|
||||
destructiveHint: false,
|
||||
idempotentHint: false,
|
||||
openWorldHint: false,
|
||||
},
|
||||
async execute(args, companyId, userId, supabase, actor) {
|
||||
const itemIds = args.item_ids as string[]
|
||||
if (!Array.isArray(itemIds) || itemIds.length === 0) throw new Error('item_ids is required (non-empty)')
|
||||
const vatAmount = typeof args.vat_amount === 'number' && Number.isFinite(args.vat_amount)
|
||||
? args.vat_amount
|
||||
: undefined
|
||||
const notes = typeof args.notes === 'string' && args.notes.trim().length > 0
|
||||
? args.notes.trim()
|
||||
: undefined
|
||||
|
||||
// Pre-flight: classify the selection so the preview (and the agent) sees
|
||||
// the real shape before staging. Tenant isolation via company_id.
|
||||
const { data: items, error } = await supabase
|
||||
.from('invoice_inbox_items')
|
||||
.select('id, matched_transaction_id, created_journal_entry_id, created_supplier_invoice_id')
|
||||
.in('id', itemIds)
|
||||
.eq('company_id', companyId)
|
||||
if (error) throw new Error(`Kunde inte läsa underlagen: ${error.message}`)
|
||||
|
||||
const found = new Set((items ?? []).map((it) => it.id as string))
|
||||
const resolved = (items ?? []).filter((it) => it.created_journal_entry_id || it.created_supplier_invoice_id)
|
||||
const bookable = (items ?? []).filter(
|
||||
(it) => it.matched_transaction_id && !it.created_journal_entry_id && !it.created_supplier_invoice_id,
|
||||
)
|
||||
const notMatched = (items ?? []).filter(
|
||||
(it) => !it.matched_transaction_id && !it.created_journal_entry_id && !it.created_supplier_invoice_id,
|
||||
).length
|
||||
const alreadyBooked = resolved.length
|
||||
const notFound = itemIds.filter((id) => !found.has(id)).length
|
||||
|
||||
if (bookable.length === 0) {
|
||||
throw new Error(
|
||||
`Inga av de ${itemIds.length} valda underlagen kan bokföras: ${notMatched} saknar matchad banktransaktion, ` +
|
||||
`${alreadyBooked} är redan bokförda, ${notFound} hittades inte. Matcha underlagen mot en banktransaktion först ` +
|
||||
`(gnubok_match_transaction_to_invoice eller "Matcha mot transaktion" i Dokumentinkorgen).`,
|
||||
)
|
||||
}
|
||||
|
||||
// Resolve matched-tx dates/amounts for the period envelope + an aggregate
|
||||
// total. preview_data carries only aggregate counts + sum — no per-item
|
||||
// PII (GDPR Art.25), same rationale as gnubok_bulk_book_transactions.
|
||||
const txIds = bookable.map((it) => it.matched_transaction_id as string)
|
||||
const { data: txs } = await supabase
|
||||
.from('transactions')
|
||||
.select('id, date, amount, currency, amount_sek, exchange_rate')
|
||||
.in('id', txIds)
|
||||
.eq('company_id', companyId)
|
||||
const txDates = (txs ?? []).map((t) => t.date as string).filter(Boolean).sort()
|
||||
const earliestDate = txDates[0]
|
||||
const totalSek = (txs ?? []).reduce((s, t) => {
|
||||
const cur = String(t.currency ?? 'SEK').toUpperCase()
|
||||
const sek = cur === 'SEK'
|
||||
? Math.abs(Number(t.amount))
|
||||
: Math.abs(Number(t.amount_sek ?? Number(t.amount) * Number(t.exchange_rate ?? 1)))
|
||||
return s + (Number.isFinite(sek) ? sek : 0)
|
||||
}, 0)
|
||||
|
||||
return stagePendingOperation(supabase, companyId, userId, 'bulk_book_inbox_items',
|
||||
`Bulkbokför ${bookable.length} underlag`,
|
||||
{
|
||||
// Stage only the bookable items — the executor re-checks each and
|
||||
// skips any that changed state between staging and approval.
|
||||
item_ids: bookable.map((it) => it.id as string),
|
||||
category: args.category,
|
||||
vat_treatment: args.vat_treatment ?? null,
|
||||
vat_amount: vatAmount ?? null,
|
||||
notes: notes ?? null,
|
||||
allow_duplicate: args.allow_duplicate === true,
|
||||
},
|
||||
{
|
||||
item_count: itemIds.length,
|
||||
bookable_count: bookable.length,
|
||||
will_skip_count: notMatched + alreadyBooked + notFound,
|
||||
not_matched: notMatched,
|
||||
already_booked: alreadyBooked,
|
||||
not_found: notFound,
|
||||
total_sek: Math.round(totalSek * 100) / 100,
|
||||
category: args.category,
|
||||
vat_treatment: args.vat_treatment ?? null,
|
||||
},
|
||||
actor,
|
||||
{
|
||||
description: 'After approval each underlag is booked against its matched transaction. Verify with gnubok_list_inbox_items or gnubok_query_journal.',
|
||||
tool: 'gnubok_list_inbox_items',
|
||||
},
|
||||
earliestDate ? { dateForPeriodCheck: earliestDate } : {},
|
||||
)
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
name: 'gnubok_find_voucher_candidates_for_invoice',
|
||||
title: 'Find Voucher Candidates (Invoice)',
|
||||
|
||||
@@ -122,6 +122,31 @@ describe('tic-client', () => {
|
||||
expect(calledUrl).toContain('q%3D5560360793')
|
||||
})
|
||||
|
||||
// Enskild firma: Lens only resolves the 12-digit (century-prefixed) form,
|
||||
// so a 10-digit personnummer must be expanded before the query. Björn's
|
||||
// 860224-5618 → born 1986 → prefix 19.
|
||||
it('expands a 10-digit personnummer to the 12-digit form before querying', async () => {
|
||||
const mockFetch = vi.mocked(fetch)
|
||||
mockFetch.mockResolvedValue(new Response(JSON.stringify({ found: 0, hits: [] })))
|
||||
|
||||
await searchCompanyByOrgNumber('860224-5618')
|
||||
|
||||
const calledUrl = mockFetch.mock.calls[0][0] as string
|
||||
expect(calledUrl).toContain('q%3D198602245618')
|
||||
})
|
||||
|
||||
// An organisationsnummer (3rd digit >= 2) must NOT be century-prefixed —
|
||||
// Lens resolves an AB from its bare 10-digit number.
|
||||
it('does not expand an organisationsnummer', async () => {
|
||||
const mockFetch = vi.mocked(fetch)
|
||||
mockFetch.mockResolvedValue(new Response(JSON.stringify({ found: 0, hits: [] })))
|
||||
|
||||
await searchCompanyByOrgNumber('5595719864')
|
||||
|
||||
const calledUrl = mockFetch.mock.calls[0][0] as string
|
||||
expect(calledUrl).toContain('q%3D5595719864')
|
||||
})
|
||||
|
||||
it('returns null when no hits', async () => {
|
||||
vi.mocked(fetch).mockResolvedValue(
|
||||
new Response(JSON.stringify({ found: 0, hits: [], facet_counts: [] }))
|
||||
@@ -130,6 +155,75 @@ describe('tic-client', () => {
|
||||
const result = await searchCompanyByOrgNumber('000000-0000')
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
|
||||
// TIC v2 is a Typesense fuzzy search: an unindexed number (e.g. an
|
||||
// enskild firma's personnummer that Bolagsverket never registered as a
|
||||
// company) comes back as the closest lookalike — a different, unrelated
|
||||
// entity. We must reject it rather than return a stranger's company.
|
||||
it('rejects a fuzzy near-miss whose registrationNumber differs from the query', async () => {
|
||||
const lookalike = {
|
||||
companyId: 3610062,
|
||||
registrationNumber: '8024245618', // digit-shuffle of the requested number
|
||||
names: [{ nameOrIdentifier: 'A FOUNDATION', companyNamingType: 'name' }],
|
||||
legalEntityType: 'Annan stiftelse',
|
||||
registrationDate: 0,
|
||||
isCeased: false,
|
||||
}
|
||||
vi.mocked(fetch).mockResolvedValue(
|
||||
new Response(JSON.stringify({ found: 1, hits: [{ document: lookalike }], facet_counts: [] }))
|
||||
)
|
||||
|
||||
const result = await searchCompanyByOrgNumber('8602245618')
|
||||
expect(result).toBeNull()
|
||||
})
|
||||
|
||||
// Lens stores an enskild firma under a 16-digit registration number that
|
||||
// embeds the 10-digit personnummer. Containment must be accepted, or every
|
||||
// correctly-resolved sole trader would be wrongly rejected.
|
||||
it('accepts a 16-digit enskild-firma number that embeds the requested personnummer', async () => {
|
||||
const soleTrader = {
|
||||
companyId: 6704455,
|
||||
registrationNumber: '2002011732750001', // contains 0201173275
|
||||
names: [{ nameOrIdentifier: 'Sole Trader', companyNamingType: 'name' }],
|
||||
legalEntityType: 'Enskild näringsidkare',
|
||||
registrationDate: 0,
|
||||
isCeased: false,
|
||||
}
|
||||
vi.mocked(fetch).mockResolvedValue(
|
||||
new Response(JSON.stringify({ found: 1, hits: [{ document: soleTrader }], facet_counts: [] }))
|
||||
)
|
||||
|
||||
const result = await searchCompanyByOrgNumber('0201173275')
|
||||
expect(result).toEqual(soleTrader)
|
||||
})
|
||||
|
||||
// A real match may not always rank first; accept it wherever it appears.
|
||||
it('accepts an exact match even when it is not the top-ranked hit', async () => {
|
||||
const nearMiss = {
|
||||
companyId: 1,
|
||||
registrationNumber: '5560360799',
|
||||
names: [{ nameOrIdentifier: 'Near Miss AB', companyNamingType: 'name' }],
|
||||
legalEntityType: 'AB',
|
||||
registrationDate: 0,
|
||||
isCeased: false,
|
||||
}
|
||||
const exact = {
|
||||
companyId: 2,
|
||||
registrationNumber: '5560360793',
|
||||
names: [{ nameOrIdentifier: 'Exact AB', companyNamingType: 'name' }],
|
||||
legalEntityType: 'AB',
|
||||
registrationDate: 0,
|
||||
isCeased: false,
|
||||
}
|
||||
vi.mocked(fetch).mockResolvedValue(
|
||||
new Response(
|
||||
JSON.stringify({ found: 2, hits: [{ document: nearMiss }, { document: exact }], facet_counts: [] })
|
||||
)
|
||||
)
|
||||
|
||||
const result = await searchCompanyByOrgNumber('556036-0793')
|
||||
expect(result).toEqual(exact)
|
||||
})
|
||||
})
|
||||
|
||||
describe('getBankAccounts', () => {
|
||||
|
||||
@@ -121,20 +121,81 @@ export async function ticApiFetch<T>(endpoint: string): Promise<T | null> {
|
||||
}
|
||||
}
|
||||
|
||||
/** Search for a company by org number. Returns the first matching document or null. */
|
||||
/**
|
||||
* Expand a 10-digit personnummer to the 12-digit (century-prefixed) form that
|
||||
* Lens requires to resolve an enskild firma. Lens stores a sole trader under a
|
||||
* 16-digit registration number derived from the 12-digit personnummer; the bare
|
||||
* 10-digit form only ever fuzzy-matches, which is how a personnummer once
|
||||
* resolved to an unrelated foundation.
|
||||
*
|
||||
* Detection is unambiguous: a Swedish organisationsnummer always has a 3rd digit
|
||||
* >= 2, whereas a personnummer's 3rd+4th digits are the birth month (01-12). So
|
||||
* a 10-digit number whose 3rd digit is 0/1 and whose month reads 01-12 is a
|
||||
* personnummer and gets the century prefix; AB / förening / handelsbolag numbers
|
||||
* pass through untouched. Century (19 vs 20) uses the same heuristic as
|
||||
* `formatRedovisare`: a two-digit year greater than the current one is 1900s.
|
||||
*/
|
||||
function toLensQueryNumber(cleaned: string): string {
|
||||
if (!/^\d{10}$/.test(cleaned)) return cleaned
|
||||
const month = parseInt(cleaned.substring(2, 4), 10)
|
||||
const isPersonnummer = cleaned[2] <= '1' && month >= 1 && month <= 12
|
||||
if (!isPersonnummer) return cleaned
|
||||
const yearDigits = parseInt(cleaned.substring(0, 2), 10)
|
||||
const currentTwoDigitYear = new Date().getFullYear() % 100
|
||||
const prefix = yearDigits > currentTwoDigitYear ? '19' : '20'
|
||||
return `${prefix}${cleaned}`
|
||||
}
|
||||
|
||||
/**
|
||||
* Search for a company by org number. Returns the matching document or null.
|
||||
*
|
||||
* TIC v2 is a Typesense index and `query_by=registrationNumber` is a
|
||||
* typo-tolerant full-text search: it returns ranked *near-misses*, not only
|
||||
* exact hits. An identifier that isn't in the index therefore comes back as
|
||||
* the closest lookalike number — a completely unrelated entity (this is how
|
||||
* an enskild firma's personnummer once resolved to a random foundation).
|
||||
*
|
||||
* We validate the returned `registrationNumber` against the requested number
|
||||
* before accepting a hit. The check is *containment*, not strict equality,
|
||||
* because Lens stores an enskild firma under a 16-digit registration number
|
||||
* that embeds the 10-digit personnummer (e.g. request `0201173275` →
|
||||
* Lens `2002011732750001`). Requiring exact equality would wrongly reject
|
||||
* every correctly-resolved sole trader. A genuine mismatch (Björn's case)
|
||||
* has neither number containing the other, so it is still discarded and the
|
||||
* caller sees a clean "not found" instead of a stranger's company.
|
||||
*
|
||||
* The upstream request is intentionally unchanged — the fuzzy `q=` call is
|
||||
* what every working lookup already uses; we only tighten which hit we accept.
|
||||
*/
|
||||
export async function searchCompanyByOrgNumber(
|
||||
orgNumber: string
|
||||
): Promise<TICCompanyDocument | null> {
|
||||
const cleaned = orgNumber.replace(/[\s-]/g, '')
|
||||
const data = await ticApiFetch<TICCompanyResponse>(
|
||||
`/search-public/companies?q=${cleaned}&query_by=registrationNumber`
|
||||
`/search-public/companies?q=${toLensQueryNumber(cleaned)}&query_by=registrationNumber`
|
||||
)
|
||||
|
||||
if (!data || data.found === 0 || !data.hits?.[0]) {
|
||||
if (!data || data.found === 0 || !data.hits?.length) {
|
||||
return null
|
||||
}
|
||||
|
||||
return data.hits[0].document
|
||||
// A real match either equals the requested number or embeds it (16-digit
|
||||
// enskild-firma number containing the 10-digit personnummer). Guard the
|
||||
// containment branch with a length floor so a short/garbage query can't
|
||||
// coincidentally substring-match an unrelated number — all real Swedish
|
||||
// identifiers are >= 10 digits.
|
||||
const numbersRelated = (returned: string): boolean => {
|
||||
if (returned === cleaned) return true
|
||||
if (cleaned.length < 10 || returned.length < 10) return false
|
||||
return returned.includes(cleaned) || cleaned.includes(returned)
|
||||
}
|
||||
|
||||
const match = data.hits.find((hit) => {
|
||||
const returned = hit.document?.registrationNumber?.replace(/[\s-]/g, '') ?? ''
|
||||
return returned.length > 0 && numbersRelated(returned)
|
||||
})
|
||||
|
||||
return match?.document ?? null
|
||||
}
|
||||
|
||||
/**
|
||||
|
||||
Reference in New Issue
Block a user