Files
accounted/lib/bokslut/arsredovisning/narrative-service.ts
T
MattssonandClaude Opus 4.7 a2a556d837 Bug/UI wrong display (#573)
* fix(dashboard): exclude credit notes from unpaid invoices widget

Credit notes (status='sent', negative total) were summed into the
"Att få betalt" widget, producing confusing negative totals like
"2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL,
matching the existing pattern in reminder-processor and the AR ledger.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(documents): harden PDF preview and upload validation

- JournalEntryAttachments: switch inline PDF preview from <iframe> to
  <object type="application/pdf">. Mirrors the AttachmentPreviewSheet
  fix from #572 — Chrome's frame pipeline intermittently surfaced
  "Det här innehållet har blockerats" on iframes even with permissive
  CSP. <object> invokes the PDF plugin directly. crbug.com/271452.

- /api/documents/:id/inline: resolve Content-Type via file extension
  when mime_type is null or application/octet-stream. Legacy uploads
  landed with empty File.type from some drag sources; combined with
  the new X-Content-Type-Options: nosniff header on this route,
  Chrome refused to render valid PDFs. Extension fallback covers
  every legacy row without a DB backfill.

- /api/documents POST: surface DB-trigger period-lock errors as a
  400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously
  every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 /
  "Filen kunde inte sparas") which hid the real cause from users
  attaching to verifikationer in closed/locked fiscal periods.

- document-service: add validateDocumentMagicBytes() that inspects
  the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates
  a leading UTF-8 BOM). Wired into uploadDocument() and
  createNewVersion() so every upload path is protected — UI, MCP,
  and future email/webhook ingestion. Defends against agents that
  send a base64-encoded text placeholder instead of real binary
  bytes via the gnubok_upload_document MCP tool, which produced
  tiny (15-561 byte) "PDFs" that failed to render in Chrome and
  in external viewers.

Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal

Five compliance gaps fixed in the K2 and K3 noter builders:

- Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB
  anskaffningsvärde, tillkommande, avgående, UB and accumulated
  avskrivningar movement (was only emitting avskrivningstider).
- Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §.
- Ställda säkerheter and Eventualförpliktelser as separate notes per
  ÅRL 5:14-15 § (K2 previously combined them).
- Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8.

Replaces medelantal anställda — the old query filtered employees by an
is_active column that doesn't exist, so the note never emitted. Now
uses an FTE-weighted day-based average per ÅRL 5:20 §.

Six disclosure fields persist on arsredovisning_narratives as per-period
overrides; the UI extends the existing förvaltningsberättelse editor
with a "Lagstadgade upplysningar" subsection sharing the same Spara
button — no new pages, no settings changes.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(invoices): respect vat_registered=false and hide personnummer for B2C

- PDF address block no longer prints org_number for individual customers
  (GDPR data minimization; ML 17 kap 24§ requires name + address only).
- Wire company_settings.vat_registered through the rule helpers, invoice
  creation API, preview-pdf API, and the new-invoice form so a non-VAT-
  registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses
  the empty "Moms 0%" row and shows a dedicated "Företaget är inte
  momsregistrerat" notice instead of the ML 3 kap. exempt notice.
- Engine unchanged: 'exempt' treatment already routes to 3004/3100 and
  skips VAT lines.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(settings): remove approval rules from sidebar and routes

* fix(invoices): ensure vat_registered defaults to true for invoice previews and API

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-27 11:01:53 +02:00

118 lines
4.6 KiB
TypeScript

import type { SupabaseClient } from '@supabase/supabase-js'
export interface NarrativeOverrides {
description: string | null
important_events: string | null
resultatdisposition: string | null
/** ISO date of the AGM (årsstämma) where the årsredovisning was adopted.
* Populates the fastställelseintyg date blank — without it the PDF
* cannot be filed at Bolagsverket without manual pen-and-ink edit. */
agm_date: string | null
/** ÅRL 5:13 § — andel av långfristiga skulder som förfaller senare än
* fem år efter balansdagen. Null/0 → "Inga skulder förfaller efter mer
* än fem år." rendered in the note. */
long_term_debt_over_five_years: number | null
/** ÅRL 5:14 § — ställda säkerheter (panter, företagsinteckningar). Null
* → "Inga." */
securities_pledged: string | null
/** ÅRL 5:15 § — eventualförpliktelser (borgensåtaganden, garantier).
* Null → "Inga." */
contingent_liabilities: string | null
/** BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8 — moderföretagets namn.
* Note is emitted only when this is set; org_number and city are
* optional follow-up details. */
parent_company_name: string | null
parent_company_org_number: string | null
parent_company_city: string | null
}
/**
* Shape returned from getNarrative / upsertNarrative. user_id and
* created_at are deliberately excluded from the API projection (see
* NARRATIVE_API_COLUMNS below).
*/
export interface NarrativeRow {
id: string
company_id: string
fiscal_period_id: string
description: string | null
important_events: string | null
resultatdisposition: string | null
agm_date: string | null
long_term_debt_over_five_years: number | null
securities_pledged: string | null
contingent_liabilities: string | null
parent_company_name: string | null
parent_company_org_number: string | null
parent_company_city: string | null
updated_at: string
}
const TABLE = 'arsredovisning_narratives'
// Explicit projection — keeps user_id and other internal audit fields out
// of API responses. GDPR Art.25.2 / ISO A.8.3 data-minimization: callers
// only need the narrative content + last-updated timestamp.
const NARRATIVE_API_COLUMNS =
'id, company_id, fiscal_period_id, description, important_events, resultatdisposition, agm_date, long_term_debt_over_five_years, securities_pledged, contingent_liabilities, parent_company_name, parent_company_org_number, parent_company_city, updated_at'
/**
* Load persisted narrative overrides for a fiscal period. Returns null when
* the user hasn't customised anything yet — caller then falls back to the
* auto-generated boilerplate in buildArsredovisningData.
*/
export async function getNarrative(
supabase: SupabaseClient,
companyId: string,
fiscalPeriodId: string,
): Promise<NarrativeRow | null> {
const { data, error } = await supabase
.from(TABLE)
.select(NARRATIVE_API_COLUMNS)
.eq('company_id', companyId)
.eq('fiscal_period_id', fiscalPeriodId)
.maybeSingle()
if (error) throw new Error(`Failed to load narrative: ${error.message}`)
return (data as NarrativeRow | null) ?? null
}
/**
* Upsert narrative overrides for a fiscal period. Composite UNIQUE constraint
* (company_id, fiscal_period_id) — see migration
* 20260517160000_narrative_agm_date_and_composite_unique.sql — makes the
* onConflict path resolve to an UPDATE within the same tenant, so repeated
* saves cleanly replace prior content instead of stacking rows.
*/
export async function upsertNarrative(
supabase: SupabaseClient,
companyId: string,
userId: string,
fiscalPeriodId: string,
input: Partial<NarrativeOverrides>,
): Promise<NarrativeRow> {
const payload = {
user_id: userId,
company_id: companyId,
fiscal_period_id: fiscalPeriodId,
description: input.description ?? null,
important_events: input.important_events ?? null,
resultatdisposition: input.resultatdisposition ?? null,
agm_date: input.agm_date ?? null,
long_term_debt_over_five_years: input.long_term_debt_over_five_years ?? null,
securities_pledged: input.securities_pledged ?? null,
contingent_liabilities: input.contingent_liabilities ?? null,
parent_company_name: input.parent_company_name ?? null,
parent_company_org_number: input.parent_company_org_number ?? null,
parent_company_city: input.parent_company_city ?? null,
}
const { data, error } = await supabase
.from(TABLE)
.upsert(payload, { onConflict: 'company_id,fiscal_period_id' })
.select(NARRATIVE_API_COLUMNS)
.single()
if (error || !data) {
throw new Error(`Failed to save narrative: ${error?.message ?? 'unknown'}`)
}
return data as NarrativeRow
}