Bug/open banking flow (#854)
* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects We never sent auth_method to Enable Banking, so it fell back to the ASPSP's visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate* PSUs the redirect flow does not support Mobile BankID, so authorization failed right after the user approved in the BankID app. Mobile BankID at Handelsbanken is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses when requested explicitly. Resolve the bank's preferred auth method before /auth: query the ASPSP's auth_methods and pick the DECOUPLED (Mobile BankID) method when present, otherwise leave auth_method unset so banks that already work are untouched. The method name is read dynamically per psu_type, so it is robust across sandbox/production naming. - api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods field name (was available_auth_methods, never populated), add getPreferredAuthMethod(), thread optional authMethod through startAuthorization - index: resolve authMethod in /connect and pass it on both fresh + reconnect - tests: cover method selection and request-body shaping Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(invoice-inbox): clean up bulk-selection toolbar UI Redesign the selection toolbar shown when inbox items are checked: one solid primary "Bokför valda" button with outlined secondary actions ("Fråga assistenten", "Ta bort") and a plain selection count. Removes the redundant "Avmarkera" button (users uncheck the still-visible box), fixes label clipping, and gives the toolbar more breathing room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(entitlements): bypass paywall in local development Add isPaywallBypassed() so all gated capabilities are testable locally without a subscription. Fires only on NODE_ENV=development (npm run dev) or an explicit DISABLE_PAYWALL=true escape hatch — production builds run under NODE_ENV=production and the entitlement suite runs under 'test', so both keep exercising the real gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement categorize core for bank transaction categorization - Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations. - Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing. - Implemented fiscal period validation and duplicate booking detection. - Enhanced logging and error handling for transaction categorization. feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata - Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken. - Outputs metadata for business and personal PSU types, including default authentication methods. fix(migrations): increase statement timeout for SIE bulk delete operations - Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports. feat(migrations): add bulk book inbox items to pending operations - Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`. - Supports bulk booking of matched inbox items against bank transactions. test(pg): add tests for replace_period_opening_balance_link RPC - Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow. - Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries. * fix(sie-export): update journal entries and lines handling in SIE export tests * fix(migrations): resolve version collision on 20260629160000 The SIE bulk-delete statement_timeout migration shared version 20260629160000 with journal_entries_list_series_filter (merged from main via #798/#823), causing a schema_migrations_pkey duplicate key error on apply. Rename the branch's migration to 20260629160100. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(compliance): resolve compliance-swarm + review findings - opening-balance/correct: compensating rollback for the non-atomic storno+rebook so a mid-sequence failure never leaves two posted OB entries (ASVS V2.3); durable audit event on every failure path (V16); reference the original verifikationsnummer in the corrected entry per BFL 5 kap 5§; document that requireWrite already enforces write-role + membership (V8.2.1 was a false positive) - reports sources routes: validate the cursor date component as ISO (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2), applied to both the VAT-declaration and trial-balance routes - AgentSessionList: await the rename PATCH, revert the optimistic title and toast on failure (ASVS V4.5) - bank booking: exclude same-batch siblings from the booking-time duplicate guard so bulk-booking distinct same-(date,amount) transactions no longer false-positives; pre-existing duplicate detection is preserved - BulkBookInboxDialog: drop the unsafe currency-based reverse_charge default, add an omvänd skattskyldighet advisory, and type VAT options to the backend VatTreatment union - OpeningBalanceRowEditor: hold onChange in a ref (synced in effect, not during render) so an unstable callback can't cause a render loop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
2da9c71eb3
commit
f63d3e3100
@@ -0,0 +1,138 @@
|
||||
import { randomUUID } from 'node:crypto'
|
||||
import { describe, expect, it } from 'vitest'
|
||||
import {
|
||||
insertAuthUser,
|
||||
insertCompany,
|
||||
insertCompanyMember,
|
||||
insertFiscalPeriod,
|
||||
} from '@/tests/pg/fixtures'
|
||||
import { getPool, withUserContext } from '@/tests/pg/setup'
|
||||
|
||||
/**
|
||||
* Covers replace_period_opening_balance_link (20260528120200), the RPC the
|
||||
* opening-balance correction flow (app/api/import/opening-balance/correct) uses
|
||||
* to repoint fiscal_periods.opening_balance_entry_id from the stornoed IB to the
|
||||
* corrected one.
|
||||
*
|
||||
* The critical property: enforce_opening_balance_immutability blocks any direct
|
||||
* UPDATE that changes opening_balance_entry_id while opening_balances_set is
|
||||
* true. The RPC's two-step (flip the flag off, change the FK, flip it on) must
|
||||
* therefore be the sanctioned path — a plain UPDATE must still be rejected.
|
||||
*/
|
||||
|
||||
async function insertPostedOpeningBalance(params: {
|
||||
userId: string
|
||||
companyId: string
|
||||
fiscalPeriodId: string
|
||||
voucherNumber: number
|
||||
lines?: Array<{ account: string; debit: number; credit: number }>
|
||||
}): Promise<string> {
|
||||
const id = randomUUID()
|
||||
await getPool().query(
|
||||
`INSERT INTO public.journal_entries
|
||||
(id, user_id, company_id, fiscal_period_id, voucher_number, voucher_series,
|
||||
entry_date, description, source_type, status)
|
||||
VALUES ($1, $2, $3, $4, $5, 'A', '2026-01-01', 'Ingående balanser', 'opening_balance', 'draft')`,
|
||||
[id, params.userId, params.companyId, params.fiscalPeriodId, params.voucherNumber],
|
||||
)
|
||||
const lines = params.lines ?? [
|
||||
{ account: '1930', debit: 5000, credit: 0 },
|
||||
{ account: '2099', debit: 0, credit: 5000 },
|
||||
]
|
||||
for (const l of lines) {
|
||||
await getPool().query(
|
||||
`INSERT INTO public.journal_entry_lines
|
||||
(journal_entry_id, account_number, debit_amount, credit_amount)
|
||||
VALUES ($1, $2, $3, $4)`,
|
||||
[id, l.account, l.debit, l.credit],
|
||||
)
|
||||
}
|
||||
await getPool().query(`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1`, [id])
|
||||
return id
|
||||
}
|
||||
|
||||
async function linkOpeningBalance(companyId: string, periodId: string, entryId: string) {
|
||||
// First-time link: OLD.opening_balances_set is false, so the immutability
|
||||
// trigger permits setting the FK + flag together.
|
||||
await getPool().query(
|
||||
`UPDATE public.fiscal_periods
|
||||
SET opening_balance_entry_id = $3, opening_balances_set = true
|
||||
WHERE id = $2 AND company_id = $1`,
|
||||
[companyId, periodId, entryId],
|
||||
)
|
||||
}
|
||||
|
||||
async function seed() {
|
||||
const userId = await insertAuthUser()
|
||||
const companyId = await insertCompany({ createdBy: userId })
|
||||
await insertCompanyMember({ companyId, userId, role: 'owner' })
|
||||
const fiscalPeriodId = await insertFiscalPeriod({ userId, companyId })
|
||||
return { userId, companyId, fiscalPeriodId }
|
||||
}
|
||||
|
||||
describe('replace_period_opening_balance_link RPC', () => {
|
||||
it('repoints the period to a new posted IB entry while opening_balances_set is true', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seed()
|
||||
const oldEntry = await insertPostedOpeningBalance({ userId, companyId, fiscalPeriodId, voucherNumber: 1 })
|
||||
await linkOpeningBalance(companyId, fiscalPeriodId, oldEntry)
|
||||
const newEntry = await insertPostedOpeningBalance({ userId, companyId, fiscalPeriodId, voucherNumber: 2 })
|
||||
|
||||
await withUserContext(userId, async (client) => {
|
||||
await client.query(`SELECT replace_period_opening_balance_link($1, $2, $3)`, [
|
||||
companyId,
|
||||
fiscalPeriodId,
|
||||
newEntry,
|
||||
])
|
||||
|
||||
const after = await client.query<{ opening_balance_entry_id: string; opening_balances_set: boolean }>(
|
||||
`SELECT opening_balance_entry_id, opening_balances_set
|
||||
FROM public.fiscal_periods WHERE id = $1`,
|
||||
[fiscalPeriodId],
|
||||
)
|
||||
expect(after.rows[0]!.opening_balance_entry_id).toBe(newEntry)
|
||||
expect(after.rows[0]!.opening_balances_set).toBe(true)
|
||||
})
|
||||
})
|
||||
|
||||
it('still blocks a plain UPDATE of the link while set=true (trigger intact)', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seed()
|
||||
const oldEntry = await insertPostedOpeningBalance({ userId, companyId, fiscalPeriodId, voucherNumber: 1 })
|
||||
await linkOpeningBalance(companyId, fiscalPeriodId, oldEntry)
|
||||
const newEntry = await insertPostedOpeningBalance({ userId, companyId, fiscalPeriodId, voucherNumber: 2 })
|
||||
|
||||
await withUserContext(userId, async (client) => {
|
||||
await expect(
|
||||
client.query(
|
||||
`UPDATE public.fiscal_periods SET opening_balance_entry_id = $2 WHERE id = $1`,
|
||||
[fiscalPeriodId, newEntry],
|
||||
),
|
||||
).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
|
||||
it('rejects a non-posted replacement entry', async () => {
|
||||
const { userId, companyId, fiscalPeriodId } = await seed()
|
||||
const oldEntry = await insertPostedOpeningBalance({ userId, companyId, fiscalPeriodId, voucherNumber: 1 })
|
||||
await linkOpeningBalance(companyId, fiscalPeriodId, oldEntry)
|
||||
|
||||
// Draft (non-posted) candidate entry.
|
||||
const draftId = randomUUID()
|
||||
await getPool().query(
|
||||
`INSERT INTO public.journal_entries
|
||||
(id, user_id, company_id, fiscal_period_id, voucher_number, voucher_series,
|
||||
entry_date, description, source_type, status)
|
||||
VALUES ($1, $2, $3, $4, 3, 'A', '2026-01-01', 'Draft IB', 'opening_balance', 'draft')`,
|
||||
[draftId, userId, companyId, fiscalPeriodId],
|
||||
)
|
||||
|
||||
await withUserContext(userId, async (client) => {
|
||||
await expect(
|
||||
client.query(`SELECT replace_period_opening_balance_link($1, $2, $3)`, [
|
||||
companyId,
|
||||
fiscalPeriodId,
|
||||
draftId,
|
||||
]),
|
||||
).rejects.toThrow()
|
||||
})
|
||||
})
|
||||
})
|
||||
Reference in New Issue
Block a user