Bug/open banking flow (#854)

* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects We never sent auth_method to Enable Banking, so it fell back to the ASPSP's visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate* PSUs the redirect flow does not support Mobile BankID, so authorization failed right after the user approved in the BankID app. Mobile BankID at Handelsbanken is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses when requested explicitly. Resolve the bank's preferred auth method before /auth: query the ASPSP's auth_methods and pick the DECOUPLED (Mobile BankID) method when present, otherwise leave auth_method unset so banks that already work are untouched. The method name is read dynamically per psu_type, so it is robust across sandbox/production naming. - api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods field name (was available_auth_methods, never populated), add getPreferredAuthMethod(), thread optional authMethod through startAuthorization - index: resolve authMethod in /connect and pass it on both fresh + reconnect - tests: cover method selection and request-body shaping Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(invoice-inbox): clean up bulk-selection toolbar UI Redesign the selection toolbar shown when inbox items are checked: one solid primary "Bokför valda" button with outlined secondary actions ("Fråga assistenten", "Ta bort") and a plain selection count. Removes the redundant "Avmarkera" button (users uncheck the still-visible box), fixes label clipping, and gives the toolbar more breathing room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(entitlements): bypass paywall in local development Add isPaywallBypassed() so all gated capabilities are testable locally without a subscription. Fires only on NODE_ENV=development (npm run dev) or an explicit DISABLE_PAYWALL=true escape hatch — production builds run under NODE_ENV=production and the entitlement suite runs under 'test', so both keep exercising the real gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement categorize core for bank transaction categorization - Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations. - Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing. - Implemented fiscal period validation and duplicate booking detection. - Enhanced logging and error handling for transaction categorization. feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata - Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken. - Outputs metadata for business and personal PSU types, including default authentication methods. fix(migrations): increase statement timeout for SIE bulk delete operations - Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports. feat(migrations): add bulk book inbox items to pending operations - Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`. - Supports bulk booking of matched inbox items against bank transactions. test(pg): add tests for replace_period_opening_balance_link RPC - Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow. - Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries. * fix(sie-export): update journal entries and lines handling in SIE export tests * fix(migrations): resolve version collision on 20260629160000 The SIE bulk-delete statement_timeout migration shared version 20260629160000 with journal_entries_list_series_filter (merged from main via #798/#823), causing a schema_migrations_pkey duplicate key error on apply. Rename the branch's migration to 20260629160100. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(compliance): resolve compliance-swarm + review findings - opening-balance/correct: compensating rollback for the non-atomic storno+rebook so a mid-sequence failure never leaves two posted OB entries (ASVS V2.3); durable audit event on every failure path (V16); reference the original verifikationsnummer in the corrected entry per BFL 5 kap 5§; document that requireWrite already enforces write-role + membership (V8.2.1 was a false positive) - reports sources routes: validate the cursor date component as ISO (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2), applied to both the VAT-declaration and trial-balance routes - AgentSessionList: await the rename PATCH, revert the optimistic title and toast on failure (ASVS V4.5) - bank booking: exclude same-batch siblings from the booking-time duplicate guard so bulk-booking distinct same-(date,amount) transactions no longer false-positives; pre-existing duplicate detection is preserved - BulkBookInboxDialog: drop the unsafe currency-based reverse_charge default, add an omvänd skattskyldighet advisory, and type VAT options to the backend VatTreatment union - OpeningBalanceRowEditor: hold onChange in a ref (synced in effect, not during render) so an unstable callback can't cause a render loop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 18:13:00 +02:00
parent 2da9c71eb3
commit f63d3e3100
83 changed files with 6769 additions and 1360 deletions
@@ -122,6 +122,31 @@ describe('tic-client', () => {
      expect(calledUrl).toContain('q%3D5560360793')
    })

+    // Enskild firma: Lens only resolves the 12-digit (century-prefixed) form,
+    // so a 10-digit personnummer must be expanded before the query. Björn's
+    // 860224-5618 → born 1986 → prefix 19.
+    it('expands a 10-digit personnummer to the 12-digit form before querying', async () => {
+      const mockFetch = vi.mocked(fetch)
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({ found: 0, hits: [] })))
+
+      await searchCompanyByOrgNumber('860224-5618')
+
+      const calledUrl = mockFetch.mock.calls[0][0] as string
+      expect(calledUrl).toContain('q%3D198602245618')
+    })
+
+    // An organisationsnummer (3rd digit >= 2) must NOT be century-prefixed —
+    // Lens resolves an AB from its bare 10-digit number.
+    it('does not expand an organisationsnummer', async () => {
+      const mockFetch = vi.mocked(fetch)
+      mockFetch.mockResolvedValue(new Response(JSON.stringify({ found: 0, hits: [] })))
+
+      await searchCompanyByOrgNumber('5595719864')
+
+      const calledUrl = mockFetch.mock.calls[0][0] as string
+      expect(calledUrl).toContain('q%3D5595719864')
+    })
+
    it('returns null when no hits', async () => {
      vi.mocked(fetch).mockResolvedValue(
        new Response(JSON.stringify({ found: 0, hits: [], facet_counts: [] }))
@@ -130,6 +155,75 @@ describe('tic-client', () => {
      const result = await searchCompanyByOrgNumber('000000-0000')
      expect(result).toBeNull()
    })
+
+    // TIC v2 is a Typesense fuzzy search: an unindexed number (e.g. an
+    // enskild firma's personnummer that Bolagsverket never registered as a
+    // company) comes back as the closest lookalike — a different, unrelated
+    // entity. We must reject it rather than return a stranger's company.
+    it('rejects a fuzzy near-miss whose registrationNumber differs from the query', async () => {
+      const lookalike = {
+        companyId: 3610062,
+        registrationNumber: '8024245618', // digit-shuffle of the requested number
+        names: [{ nameOrIdentifier: 'A FOUNDATION', companyNamingType: 'name' }],
+        legalEntityType: 'Annan stiftelse',
+        registrationDate: 0,
+        isCeased: false,
+      }
+      vi.mocked(fetch).mockResolvedValue(
+        new Response(JSON.stringify({ found: 1, hits: [{ document: lookalike }], facet_counts: [] }))
+      )
+
+      const result = await searchCompanyByOrgNumber('8602245618')
+      expect(result).toBeNull()
+    })
+
+    // Lens stores an enskild firma under a 16-digit registration number that
+    // embeds the 10-digit personnummer. Containment must be accepted, or every
+    // correctly-resolved sole trader would be wrongly rejected.
+    it('accepts a 16-digit enskild-firma number that embeds the requested personnummer', async () => {
+      const soleTrader = {
+        companyId: 6704455,
+        registrationNumber: '2002011732750001', // contains 0201173275
+        names: [{ nameOrIdentifier: 'Sole Trader', companyNamingType: 'name' }],
+        legalEntityType: 'Enskild näringsidkare',
+        registrationDate: 0,
+        isCeased: false,
+      }
+      vi.mocked(fetch).mockResolvedValue(
+        new Response(JSON.stringify({ found: 1, hits: [{ document: soleTrader }], facet_counts: [] }))
+      )
+
+      const result = await searchCompanyByOrgNumber('0201173275')
+      expect(result).toEqual(soleTrader)
+    })
+
+    // A real match may not always rank first; accept it wherever it appears.
+    it('accepts an exact match even when it is not the top-ranked hit', async () => {
+      const nearMiss = {
+        companyId: 1,
+        registrationNumber: '5560360799',
+        names: [{ nameOrIdentifier: 'Near Miss AB', companyNamingType: 'name' }],
+        legalEntityType: 'AB',
+        registrationDate: 0,
+        isCeased: false,
+      }
+      const exact = {
+        companyId: 2,
+        registrationNumber: '5560360793',
+        names: [{ nameOrIdentifier: 'Exact AB', companyNamingType: 'name' }],
+        legalEntityType: 'AB',
+        registrationDate: 0,
+        isCeased: false,
+      }
+      vi.mocked(fetch).mockResolvedValue(
+        new Response(
+          JSON.stringify({ found: 2, hits: [{ document: nearMiss }, { document: exact }], facet_counts: [] })
+        )
+      )
+
+      const result = await searchCompanyByOrgNumber('556036-0793')
+      expect(result).toEqual(exact)
+    })
  })

  describe('getBankAccounts', () => {
@@ -121,20 +121,81 @@ export async function ticApiFetch<T>(endpoint: string): Promise<T | null> {
  }
 }

-/** Search for a company by org number. Returns the first matching document or null. */
+/**
+ * Expand a 10-digit personnummer to the 12-digit (century-prefixed) form that
+ * Lens requires to resolve an enskild firma. Lens stores a sole trader under a
+ * 16-digit registration number derived from the 12-digit personnummer; the bare
+ * 10-digit form only ever fuzzy-matches, which is how a personnummer once
+ * resolved to an unrelated foundation.
+ *
+ * Detection is unambiguous: a Swedish organisationsnummer always has a 3rd digit
+ * >= 2, whereas a personnummer's 3rd+4th digits are the birth month (01-12). So
+ * a 10-digit number whose 3rd digit is 0/1 and whose month reads 01-12 is a
+ * personnummer and gets the century prefix; AB / förening / handelsbolag numbers
+ * pass through untouched. Century (19 vs 20) uses the same heuristic as
+ * `formatRedovisare`: a two-digit year greater than the current one is 1900s.
+ */
+function toLensQueryNumber(cleaned: string): string {
+  if (!/^\d{10}$/.test(cleaned)) return cleaned
+  const month = parseInt(cleaned.substring(2, 4), 10)
+  const isPersonnummer = cleaned[2] <= '1' && month >= 1 && month <= 12
+  if (!isPersonnummer) return cleaned
+  const yearDigits = parseInt(cleaned.substring(0, 2), 10)
+  const currentTwoDigitYear = new Date().getFullYear() % 100
+  const prefix = yearDigits > currentTwoDigitYear ? '19' : '20'
+  return `${prefix}${cleaned}`
+}
+
+/**
+ * Search for a company by org number. Returns the matching document or null.
+ *
+ * TIC v2 is a Typesense index and `query_by=registrationNumber` is a
+ * typo-tolerant full-text search: it returns ranked *near-misses*, not only
+ * exact hits. An identifier that isn't in the index therefore comes back as
+ * the closest lookalike number — a completely unrelated entity (this is how
+ * an enskild firma's personnummer once resolved to a random foundation).
+ *
+ * We validate the returned `registrationNumber` against the requested number
+ * before accepting a hit. The check is *containment*, not strict equality,
+ * because Lens stores an enskild firma under a 16-digit registration number
+ * that embeds the 10-digit personnummer (e.g. request `0201173275` →
+ * Lens `2002011732750001`). Requiring exact equality would wrongly reject
+ * every correctly-resolved sole trader. A genuine mismatch (Björn's case)
+ * has neither number containing the other, so it is still discarded and the
+ * caller sees a clean "not found" instead of a stranger's company.
+ *
+ * The upstream request is intentionally unchanged — the fuzzy `q=` call is
+ * what every working lookup already uses; we only tighten which hit we accept.
+ */
 export async function searchCompanyByOrgNumber(
  orgNumber: string
 ): Promise<TICCompanyDocument | null> {
  const cleaned = orgNumber.replace(/[\s-]/g, '')
  const data = await ticApiFetch<TICCompanyResponse>(
-    `/search-public/companies?q=${cleaned}&query_by=registrationNumber`
+    `/search-public/companies?q=${toLensQueryNumber(cleaned)}&query_by=registrationNumber`
  )

-  if (!data || data.found === 0 || !data.hits?.[0]) {
+  if (!data || data.found === 0 || !data.hits?.length) {
    return null
  }

-  return data.hits[0].document
+  // A real match either equals the requested number or embeds it (16-digit
+  // enskild-firma number containing the 10-digit personnummer). Guard the
+  // containment branch with a length floor so a short/garbage query can't
+  // coincidentally substring-match an unrelated number — all real Swedish
+  // identifiers are >= 10 digits.
+  const numbersRelated = (returned: string): boolean => {
+    if (returned === cleaned) return true
+    if (cleaned.length < 10 || returned.length < 10) return false
+    return returned.includes(cleaned) || cleaned.includes(returned)
+  }
+
+  const match = data.hits.find((hit) => {
+    const returned = hit.document?.registrationNumber?.replace(/[\s-]/g, '') ?? ''
+    return returned.length > 0 && numbersRelated(returned)
+  })
+
+  return match?.document ?? null
 }

 /**