* fix(dashboard): exclude credit notes from unpaid invoices widget Credit notes (status='sent', negative total) were summed into the "Att få betalt" widget, producing confusing negative totals like "2 st, -38 625 kr". Filter them out via credited_invoice_id IS NULL, matching the existing pattern in reminder-processor and the AR ledger. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(documents): harden PDF preview and upload validation - JournalEntryAttachments: switch inline PDF preview from <iframe> to <object type="application/pdf">. Mirrors the AttachmentPreviewSheet fix from #572 — Chrome's frame pipeline intermittently surfaced "Det här innehållet har blockerats" on iframes even with permissive CSP. <object> invokes the PDF plugin directly. crbug.com/271452. - /api/documents/:id/inline: resolve Content-Type via file extension when mime_type is null or application/octet-stream. Legacy uploads landed with empty File.type from some drag sources; combined with the new X-Content-Type-Options: nosniff header on this route, Chrome refused to render valid PDFs. Extension fallback covers every legacy row without a DB backfill. - /api/documents POST: surface DB-trigger period-lock errors as a 400 DOC_UPLOAD_PERIOD_LOCKED with a Swedish reason. Previously every catch was bucketed into DOC_UPLOAD_STORAGE_FAILED (500 / "Filen kunde inte sparas") which hid the real cause from users attaching to verifikationer in closed/locked fiscal periods. - document-service: add validateDocumentMagicBytes() that inspects the first bytes for valid PDF/PNG/JPEG/WebP headers (PDF tolerates a leading UTF-8 BOM). Wired into uploadDocument() and createNewVersion() so every upload path is protected — UI, MCP, and future email/webhook ingestion. Defends against agents that send a base64-encoded text placeholder instead of real binary bytes via the gnubok_upload_document MCP tool, which produced tiny (15-561 byte) "PDFs" that failed to render in Chrome and in external viewers. Tests use a minimal valid PDF buffer (%PDF-1.4 … %%EOF). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(arsredovisning): emit ÅRL-required notes and FTE-weighted medelantal Five compliance gaps fixed in the K2 and K3 noter builders: - Anläggningstillgångar roll-forward per ÅRL 5:8 § — per-category IB anskaffningsvärde, tillkommande, avgående, UB and accumulated avskrivningar movement (was only emitting avskrivningstider). - Långfristiga skulder förfallande efter mer än fem år per ÅRL 5:13 §. - Ställda säkerheter and Eventualförpliktelser as separate notes per ÅRL 5:14-15 § (K2 previously combined them). - Koncernförhållanden per BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8. Replaces medelantal anställda — the old query filtered employees by an is_active column that doesn't exist, so the note never emitted. Now uses an FTE-weighted day-based average per ÅRL 5:20 §. Six disclosure fields persist on arsredovisning_narratives as per-period overrides; the UI extends the existing förvaltningsberättelse editor with a "Lagstadgade upplysningar" subsection sharing the same Spara button — no new pages, no settings changes. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(invoices): respect vat_registered=false and hide personnummer for B2C - PDF address block no longer prints org_number for individual customers (GDPR data minimization; ML 17 kap 24§ requires name + address only). - Wire company_settings.vat_registered through the rule helpers, invoice creation API, preview-pdf API, and the new-invoice form so a non-VAT- registered seller cannot charge VAT (ML 1 kap. 1§). The PDF suppresses the empty "Moms 0%" row and shows a dedicated "Företaget är inte momsregistrerat" notice instead of the ML 3 kap. exempt notice. - Engine unchanged: 'exempt' treatment already routes to 3004/3100 and skips VAT lines. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(settings): remove approval rules from sidebar and routes * fix(invoices): ensure vat_registered defaults to true for invoice previews and API --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
118 lines
4.6 KiB
TypeScript
118 lines
4.6 KiB
TypeScript
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
|
|
export interface NarrativeOverrides {
|
|
description: string | null
|
|
important_events: string | null
|
|
resultatdisposition: string | null
|
|
/** ISO date of the AGM (årsstämma) where the årsredovisning was adopted.
|
|
* Populates the fastställelseintyg date blank — without it the PDF
|
|
* cannot be filed at Bolagsverket without manual pen-and-ink edit. */
|
|
agm_date: string | null
|
|
/** ÅRL 5:13 § — andel av långfristiga skulder som förfaller senare än
|
|
* fem år efter balansdagen. Null/0 → "Inga skulder förfaller efter mer
|
|
* än fem år." rendered in the note. */
|
|
long_term_debt_over_five_years: number | null
|
|
/** ÅRL 5:14 § — ställda säkerheter (panter, företagsinteckningar). Null
|
|
* → "Inga." */
|
|
securities_pledged: string | null
|
|
/** ÅRL 5:15 § — eventualförpliktelser (borgensåtaganden, garantier).
|
|
* Null → "Inga." */
|
|
contingent_liabilities: string | null
|
|
/** BFNAR 2016:10 kap. 19 / BFNAR 2012:1 kap. 8 — moderföretagets namn.
|
|
* Note is emitted only when this is set; org_number and city are
|
|
* optional follow-up details. */
|
|
parent_company_name: string | null
|
|
parent_company_org_number: string | null
|
|
parent_company_city: string | null
|
|
}
|
|
|
|
/**
|
|
* Shape returned from getNarrative / upsertNarrative. user_id and
|
|
* created_at are deliberately excluded from the API projection (see
|
|
* NARRATIVE_API_COLUMNS below).
|
|
*/
|
|
export interface NarrativeRow {
|
|
id: string
|
|
company_id: string
|
|
fiscal_period_id: string
|
|
description: string | null
|
|
important_events: string | null
|
|
resultatdisposition: string | null
|
|
agm_date: string | null
|
|
long_term_debt_over_five_years: number | null
|
|
securities_pledged: string | null
|
|
contingent_liabilities: string | null
|
|
parent_company_name: string | null
|
|
parent_company_org_number: string | null
|
|
parent_company_city: string | null
|
|
updated_at: string
|
|
}
|
|
|
|
const TABLE = 'arsredovisning_narratives'
|
|
|
|
// Explicit projection — keeps user_id and other internal audit fields out
|
|
// of API responses. GDPR Art.25.2 / ISO A.8.3 data-minimization: callers
|
|
// only need the narrative content + last-updated timestamp.
|
|
const NARRATIVE_API_COLUMNS =
|
|
'id, company_id, fiscal_period_id, description, important_events, resultatdisposition, agm_date, long_term_debt_over_five_years, securities_pledged, contingent_liabilities, parent_company_name, parent_company_org_number, parent_company_city, updated_at'
|
|
|
|
/**
|
|
* Load persisted narrative overrides for a fiscal period. Returns null when
|
|
* the user hasn't customised anything yet — caller then falls back to the
|
|
* auto-generated boilerplate in buildArsredovisningData.
|
|
*/
|
|
export async function getNarrative(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
fiscalPeriodId: string,
|
|
): Promise<NarrativeRow | null> {
|
|
const { data, error } = await supabase
|
|
.from(TABLE)
|
|
.select(NARRATIVE_API_COLUMNS)
|
|
.eq('company_id', companyId)
|
|
.eq('fiscal_period_id', fiscalPeriodId)
|
|
.maybeSingle()
|
|
if (error) throw new Error(`Failed to load narrative: ${error.message}`)
|
|
return (data as NarrativeRow | null) ?? null
|
|
}
|
|
|
|
/**
|
|
* Upsert narrative overrides for a fiscal period. Composite UNIQUE constraint
|
|
* (company_id, fiscal_period_id) — see migration
|
|
* 20260517160000_narrative_agm_date_and_composite_unique.sql — makes the
|
|
* onConflict path resolve to an UPDATE within the same tenant, so repeated
|
|
* saves cleanly replace prior content instead of stacking rows.
|
|
*/
|
|
export async function upsertNarrative(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
userId: string,
|
|
fiscalPeriodId: string,
|
|
input: Partial<NarrativeOverrides>,
|
|
): Promise<NarrativeRow> {
|
|
const payload = {
|
|
user_id: userId,
|
|
company_id: companyId,
|
|
fiscal_period_id: fiscalPeriodId,
|
|
description: input.description ?? null,
|
|
important_events: input.important_events ?? null,
|
|
resultatdisposition: input.resultatdisposition ?? null,
|
|
agm_date: input.agm_date ?? null,
|
|
long_term_debt_over_five_years: input.long_term_debt_over_five_years ?? null,
|
|
securities_pledged: input.securities_pledged ?? null,
|
|
contingent_liabilities: input.contingent_liabilities ?? null,
|
|
parent_company_name: input.parent_company_name ?? null,
|
|
parent_company_org_number: input.parent_company_org_number ?? null,
|
|
parent_company_city: input.parent_company_city ?? null,
|
|
}
|
|
const { data, error } = await supabase
|
|
.from(TABLE)
|
|
.upsert(payload, { onConflict: 'company_id,fiscal_period_id' })
|
|
.select(NARRATIVE_API_COLUMNS)
|
|
.single()
|
|
if (error || !data) {
|
|
throw new Error(`Failed to save narrative: ${error?.message ?? 'unknown'}`)
|
|
}
|
|
return data as NarrativeRow
|
|
}
|