Bug/open banking flow (#854)
* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects We never sent auth_method to Enable Banking, so it fell back to the ASPSP's visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate* PSUs the redirect flow does not support Mobile BankID, so authorization failed right after the user approved in the BankID app. Mobile BankID at Handelsbanken is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses when requested explicitly. Resolve the bank's preferred auth method before /auth: query the ASPSP's auth_methods and pick the DECOUPLED (Mobile BankID) method when present, otherwise leave auth_method unset so banks that already work are untouched. The method name is read dynamically per psu_type, so it is robust across sandbox/production naming. - api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods field name (was available_auth_methods, never populated), add getPreferredAuthMethod(), thread optional authMethod through startAuthorization - index: resolve authMethod in /connect and pass it on both fresh + reconnect - tests: cover method selection and request-body shaping Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(invoice-inbox): clean up bulk-selection toolbar UI Redesign the selection toolbar shown when inbox items are checked: one solid primary "Bokför valda" button with outlined secondary actions ("Fråga assistenten", "Ta bort") and a plain selection count. Removes the redundant "Avmarkera" button (users uncheck the still-visible box), fixes label clipping, and gives the toolbar more breathing room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(entitlements): bypass paywall in local development Add isPaywallBypassed() so all gated capabilities are testable locally without a subscription. Fires only on NODE_ENV=development (npm run dev) or an explicit DISABLE_PAYWALL=true escape hatch — production builds run under NODE_ENV=production and the entitlement suite runs under 'test', so both keep exercising the real gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement categorize core for bank transaction categorization - Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations. - Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing. - Implemented fiscal period validation and duplicate booking detection. - Enhanced logging and error handling for transaction categorization. feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata - Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken. - Outputs metadata for business and personal PSU types, including default authentication methods. fix(migrations): increase statement timeout for SIE bulk delete operations - Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports. feat(migrations): add bulk book inbox items to pending operations - Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`. - Supports bulk booking of matched inbox items against bank transactions. test(pg): add tests for replace_period_opening_balance_link RPC - Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow. - Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries. * fix(sie-export): update journal entries and lines handling in SIE export tests * fix(migrations): resolve version collision on 20260629160000 The SIE bulk-delete statement_timeout migration shared version 20260629160000 with journal_entries_list_series_filter (merged from main via #798/#823), causing a schema_migrations_pkey duplicate key error on apply. Rename the branch's migration to 20260629160100. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(compliance): resolve compliance-swarm + review findings - opening-balance/correct: compensating rollback for the non-atomic storno+rebook so a mid-sequence failure never leaves two posted OB entries (ASVS V2.3); durable audit event on every failure path (V16); reference the original verifikationsnummer in the corrected entry per BFL 5 kap 5§; document that requireWrite already enforces write-role + membership (V8.2.1 was a false positive) - reports sources routes: validate the cursor date component as ISO (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2), applied to both the VAT-declaration and trial-balance routes - AgentSessionList: await the rename PATCH, revert the optimistic title and toast on failure (ASVS V4.5) - bank booking: exclude same-batch siblings from the booking-time duplicate guard so bulk-booking distinct same-(date,amount) transactions no longer false-positives; pre-existing duplicate detection is preserved - BulkBookInboxDialog: drop the unsafe currency-based reverse_charge default, add an omvänd skattskyldighet advisory, and type VAT options to the backend VatTreatment union - OpeningBalanceRowEditor: hold onChange in a ref (synced in effect, not during render) so an unstable callback can't cause a render loop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2da9c71eb3
commit
f63d3e3100
@@ -59,9 +59,14 @@ describe('tools/list payload size guard', () => {
|
||||
// which have a pre-flight; gnubok_get_agent_briefing also gained a `company`
|
||||
// identity block in its outputSchema. This is wire data the agent depends
|
||||
// on, not trimmable prose — hence a bump rather than a description trim.
|
||||
// * 38K → 40K as the catalog grew from 92 to 103 tools (gnubok_link_document_
|
||||
// to_voucher #804, gnubok_bulk_book_inbox_items, the categorize-core additions,
|
||||
// plus per-line supplier-invoice overrides). Each new tool carries its
|
||||
// inputSchema + staging _meta; the growth is genuine wire data, not prose,
|
||||
// so descriptions are already at their trimmed floor (~180–220 chars).
|
||||
// Long-term answer to growth is leaning harder on gnubok_search_tools — if this
|
||||
// fires again, prefer trimming descriptions or making a tool opt-in via search
|
||||
// before bumping further.
|
||||
expect(approxTokens).toBeLessThan(38_000)
|
||||
expect(approxTokens).toBeLessThan(40_000)
|
||||
})
|
||||
})
|
||||
|
||||
@@ -5415,6 +5415,126 @@ export const tools: McpTool[] = [
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
name: 'gnubok_bulk_book_inbox_items',
|
||||
title: 'Bulk-Book Underlag',
|
||||
description: 'Bulk-book N selected Underlag (Dokumentinkorgen) against their matched bank transactions with one shared category + VAT treatment. Set reverse_charge for foreign SaaS. Unmatched/booked items are skipped. Stages one approval.',
|
||||
inputSchema: {
|
||||
type: 'object',
|
||||
additionalProperties: false,
|
||||
properties: {
|
||||
item_ids: {
|
||||
type: 'array',
|
||||
minItems: 1,
|
||||
maxItems: 200,
|
||||
items: { type: 'string' },
|
||||
description: "Inbox item UUIDs to book — the user's selection in the Underlag view.",
|
||||
},
|
||||
category: { type: 'string', description: 'Shared transaction category applied to every item', enum: [...VALID_CATEGORIES] },
|
||||
vat_treatment: { type: 'string', description: 'Shared VAT treatment. Set reverse_charge for foreign services (omvänd skattskyldighet) where the seller did NOT charge VAT — typical for USD/EUR SaaS subscriptions like Cursor/Anysphere. Defaults to standard_25.', enum: [...VALID_VAT_TREATMENTS] },
|
||||
vat_amount: { type: 'number', exclusiveMinimum: 0, description: "The underlag's exact moms override; only valid with a rate-based vat_treatment. Rarely needed in bulk — all items share one value." },
|
||||
notes: { type: 'string', description: 'Audit-trail note appended to every verifikation. Keep under 200 chars.' },
|
||||
allow_duplicate: { type: 'boolean', description: 'Override the per-item duplicate-booking guard (default false). Set true only after the user confirms these bank lines are genuinely separate events.' },
|
||||
},
|
||||
required: ['item_ids', 'category'],
|
||||
},
|
||||
outputSchema: STAGED_OPERATION_SCHEMA,
|
||||
annotations: {
|
||||
readOnlyHint: false,
|
||||
destructiveHint: false,
|
||||
idempotentHint: false,
|
||||
openWorldHint: false,
|
||||
},
|
||||
async execute(args, companyId, userId, supabase, actor) {
|
||||
const itemIds = args.item_ids as string[]
|
||||
if (!Array.isArray(itemIds) || itemIds.length === 0) throw new Error('item_ids is required (non-empty)')
|
||||
const vatAmount = typeof args.vat_amount === 'number' && Number.isFinite(args.vat_amount)
|
||||
? args.vat_amount
|
||||
: undefined
|
||||
const notes = typeof args.notes === 'string' && args.notes.trim().length > 0
|
||||
? args.notes.trim()
|
||||
: undefined
|
||||
|
||||
// Pre-flight: classify the selection so the preview (and the agent) sees
|
||||
// the real shape before staging. Tenant isolation via company_id.
|
||||
const { data: items, error } = await supabase
|
||||
.from('invoice_inbox_items')
|
||||
.select('id, matched_transaction_id, created_journal_entry_id, created_supplier_invoice_id')
|
||||
.in('id', itemIds)
|
||||
.eq('company_id', companyId)
|
||||
if (error) throw new Error(`Kunde inte läsa underlagen: ${error.message}`)
|
||||
|
||||
const found = new Set((items ?? []).map((it) => it.id as string))
|
||||
const resolved = (items ?? []).filter((it) => it.created_journal_entry_id || it.created_supplier_invoice_id)
|
||||
const bookable = (items ?? []).filter(
|
||||
(it) => it.matched_transaction_id && !it.created_journal_entry_id && !it.created_supplier_invoice_id,
|
||||
)
|
||||
const notMatched = (items ?? []).filter(
|
||||
(it) => !it.matched_transaction_id && !it.created_journal_entry_id && !it.created_supplier_invoice_id,
|
||||
).length
|
||||
const alreadyBooked = resolved.length
|
||||
const notFound = itemIds.filter((id) => !found.has(id)).length
|
||||
|
||||
if (bookable.length === 0) {
|
||||
throw new Error(
|
||||
`Inga av de ${itemIds.length} valda underlagen kan bokföras: ${notMatched} saknar matchad banktransaktion, ` +
|
||||
`${alreadyBooked} är redan bokförda, ${notFound} hittades inte. Matcha underlagen mot en banktransaktion först ` +
|
||||
`(gnubok_match_transaction_to_invoice eller "Matcha mot transaktion" i Dokumentinkorgen).`,
|
||||
)
|
||||
}
|
||||
|
||||
// Resolve matched-tx dates/amounts for the period envelope + an aggregate
|
||||
// total. preview_data carries only aggregate counts + sum — no per-item
|
||||
// PII (GDPR Art.25), same rationale as gnubok_bulk_book_transactions.
|
||||
const txIds = bookable.map((it) => it.matched_transaction_id as string)
|
||||
const { data: txs } = await supabase
|
||||
.from('transactions')
|
||||
.select('id, date, amount, currency, amount_sek, exchange_rate')
|
||||
.in('id', txIds)
|
||||
.eq('company_id', companyId)
|
||||
const txDates = (txs ?? []).map((t) => t.date as string).filter(Boolean).sort()
|
||||
const earliestDate = txDates[0]
|
||||
const totalSek = (txs ?? []).reduce((s, t) => {
|
||||
const cur = String(t.currency ?? 'SEK').toUpperCase()
|
||||
const sek = cur === 'SEK'
|
||||
? Math.abs(Number(t.amount))
|
||||
: Math.abs(Number(t.amount_sek ?? Number(t.amount) * Number(t.exchange_rate ?? 1)))
|
||||
return s + (Number.isFinite(sek) ? sek : 0)
|
||||
}, 0)
|
||||
|
||||
return stagePendingOperation(supabase, companyId, userId, 'bulk_book_inbox_items',
|
||||
`Bulkbokför ${bookable.length} underlag`,
|
||||
{
|
||||
// Stage only the bookable items — the executor re-checks each and
|
||||
// skips any that changed state between staging and approval.
|
||||
item_ids: bookable.map((it) => it.id as string),
|
||||
category: args.category,
|
||||
vat_treatment: args.vat_treatment ?? null,
|
||||
vat_amount: vatAmount ?? null,
|
||||
notes: notes ?? null,
|
||||
allow_duplicate: args.allow_duplicate === true,
|
||||
},
|
||||
{
|
||||
item_count: itemIds.length,
|
||||
bookable_count: bookable.length,
|
||||
will_skip_count: notMatched + alreadyBooked + notFound,
|
||||
not_matched: notMatched,
|
||||
already_booked: alreadyBooked,
|
||||
not_found: notFound,
|
||||
total_sek: Math.round(totalSek * 100) / 100,
|
||||
category: args.category,
|
||||
vat_treatment: args.vat_treatment ?? null,
|
||||
},
|
||||
actor,
|
||||
{
|
||||
description: 'After approval each underlag is booked against its matched transaction. Verify with gnubok_list_inbox_items or gnubok_query_journal.',
|
||||
tool: 'gnubok_list_inbox_items',
|
||||
},
|
||||
earliestDate ? { dateForPeriodCheck: earliestDate } : {},
|
||||
)
|
||||
},
|
||||
},
|
||||
|
||||
{
|
||||
name: 'gnubok_find_voucher_candidates_for_invoice',
|
||||
title: 'Find Voucher Candidates (Invoice)',
|
||||
|
||||
Reference in New Issue
Block a user