Files
accounted/lib/bokslut/assets/__tests__/dispose-vat.test.ts
T
MattssonandClaude Opus 4.7 32d9978f1b Fix/chrome pdf preview csp (#572)
* feat: add option to exclude year-end closing entries in SIE export and related reports

* delete docs

* fix: allow Chrome's PDF viewer in verifikat document preview

The /api/documents/:id/inline route shipped with
`object-src 'none'` in its CSP, which blocked Chrome's built-in PDF
viewer (it renders inline PDFs via an internal <embed>). Users on
Chrome saw "Det här innehållet har blockerats" when expanding a PDF
attachment in the bookkeeping view; Firefox (PDF.js) and Edge (own
viewer) were unaffected, and JPGs worked because <img> isn't subject
to object-src.

Drops the CSP for this route to the minimum needed for embeddability:
`frame-ancestors 'self'`. X-Content-Type-Options: nosniff plus the
fixed Content-Type from the handler already block MIME confusion;
X-Frame-Options: SAMEORIGIN + frame-ancestors still block clickjacking.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* feat(auth): add webmail deep link to email confirmation screens

Mirrors Stripe's signup UX: after asking the user to verify their email,
detect their webmail provider from the domain and show a button that
opens the inbox in a new tab. Gmail gets a from:<sender> search
pre-populated; Outlook/Yahoo/iCloud/Proton open the inbox directly.
Unknown / custom domains fall back to the existing copy.

Sender address is configurable via NEXT_PUBLIC_BRANDING_AUTH_EMAIL_FROM
(default noreply@gnubok.se) so white-label installs can match their
Supabase Auth SMTP config.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(auth): unblock first-time password set for BankID users with MFA

Supabase rejects updateUser({password}) and mfa.unenroll with "AAL2 session
is required" whenever a TOTP factor is enrolled. BankID magic-link logins
produce AAL1, and middleware skips MFA enforcement for bankid_linked users,
so they had no path to AAL2 — leaving them unable to set a backup password
or disable MFA without going through the email-recovery escape hatch.

- /api/account/password: branch on app_metadata.has_password. First-time set
  writes via service.auth.admin.updateUserById (no existing credential to
  protect, AAL2 guard does not apply). Change-password keeps the user-session
  updateUser so AAL2 still fires for credential rotation.
- /mfa/verify: accept a safeReturnTo query param and route there after
  successful verify, so step-up flows can land back where they came from.
- SecuritySettings: detect the AAL2 error from both change-password and
  mfa.unenroll and redirect through /mfa/verify?returnTo=/settings/account
  instead of toasting a dead-end error.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* Add tests and rounding utility for öre precision in bokslut calculations

- Implemented `roundOre` function for rounding SEK amounts to two decimal places, ensuring consistent monetary calculations.
- Introduced `ORE_TOLERANCE` constant for comparing rounded amounts, facilitating invariant checks in financial entries.
- Created comprehensive tests for `roundOre`, covering typical cases, edge cases, and idempotency.
- Added year-end invariants tests to verify database-level guarantees for closing entries, ensuring they balance to the öre and reject discrepancies.
- Developed end-to-end tests for the dispositions chain, validating the correctness of calculations across various scenarios.

* fix: update PDF rendering to remove Swish QR code generation and set default to disable Swish visibility

* fix: enhance security by rejecting data URIs in safeReturnTo function tests

* fix: improve rounding logic in roundOre function and add customer_type migration

* fix: add customer_type column to customers and enforce CHECK constraint

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-05-26 22:29:41 +02:00

437 lines
16 KiB
TypeScript
Raw Blame History

This file contains ambiguous Unicode characters
This file contains Unicode characters that might be confused with other characters. If you think that this is intentional, you can safely ignore this warning. Use the Escape button to reveal them.
import { describe, it, expect, vi } from 'vitest'
import { disposeAsset } from '../asset-service'
import type { Asset } from '@/types'
vi.mock('@/lib/bookkeeping/engine', () => ({
createJournalEntry: vi.fn().mockResolvedValue({
id: 'entry-1',
voucher_series: 'A',
voucher_number: 1,
}),
}))
function makeAsset(overrides: Partial<Asset> = {}): Asset {
return {
id: 'asset-1',
user_id: 'u',
company_id: 'co',
name: 'Test',
category: 'equipment',
acquisition_date: '2023-01-01',
acquisition_cost: 100_000,
salvage_value: 0,
useful_life_months: 60,
depreciation_method: 'linear',
bas_asset_account: '1220',
bas_accumulated_account: '1229',
bas_expense_account: '7832',
restvarde_target: null,
disposed_at: null,
disposed_proceeds: null,
disposed_proceeds_vat: 0,
disposed_vat_treatment: null,
jamkning_amount: 0,
jamkning_remaining_months: null,
jamkning_total_months: null,
jamkning_original_input_vat: null,
k3_components: null,
notes: null,
created_at: '2023-01-01T00:00:00Z',
updated_at: '2023-01-01T00:00:00Z',
...overrides,
}
}
interface CapturedLine {
account_number: string
debit_amount: number
credit_amount: number
line_description?: string
}
function makeSupabaseForDispose(asset: Asset, schedules: Array<{ planned_depreciation: number }>) {
const builders = {
getBuilder: {
select: vi.fn().mockReturnThis(),
eq: vi.fn().mockReturnThis(),
maybeSingle: vi.fn().mockResolvedValue({ data: asset, error: null }),
},
schedulesBuilder: (() => {
const b: Record<string, unknown> = {
select: vi.fn(),
eq: vi.fn(),
not: vi.fn(),
then: undefined,
}
;(b.select as ReturnType<typeof vi.fn>).mockReturnValue(b)
;(b.eq as ReturnType<typeof vi.fn>).mockReturnValue(b)
;(b.not as ReturnType<typeof vi.fn>).mockReturnValue(b)
b.then = (resolve: (v: { data: unknown; error: unknown }) => void) =>
resolve({ data: schedules, error: null })
return b as {
select: ReturnType<typeof vi.fn>
eq: ReturnType<typeof vi.fn>
not: ReturnType<typeof vi.fn>
}
})(),
updateBuilder: {
update: vi.fn().mockReturnThis(),
eq: vi.fn().mockReturnThis(),
select: vi.fn().mockReturnThis(),
single: vi.fn().mockResolvedValue({
data: { ...asset, disposed_at: '2026-05-26' },
error: null,
}),
},
}
let calls = 0
const supabase = {
from: vi.fn((table: string) => {
calls++
if (table === 'depreciation_schedules') return builders.schedulesBuilder
return calls === 1 ? builders.getBuilder : builders.updateBuilder
}),
}
return { supabase, builders } as const
}
async function captureLines(asset: Asset, schedules: Array<{ planned_depreciation: number }>, input: Parameters<typeof disposeAsset>[4]): Promise<{ lines: CapturedLine[]; updateArgs: Record<string, unknown> }> {
const { createJournalEntry } = await import('@/lib/bookkeeping/engine')
vi.mocked(createJournalEntry).mockClear()
const { supabase, builders } = makeSupabaseForDispose(asset, schedules)
await disposeAsset(
supabase as unknown as Parameters<typeof disposeAsset>[0],
'co',
'u',
'asset-1',
input,
)
const call = vi.mocked(createJournalEntry).mock.calls[0]
const lines = (call![3] as { lines: CapturedLine[] }).lines
const updateArgs = (builders.updateBuilder.update.mock.calls[0]?.[0] ?? {}) as Record<string, unknown>
return { lines, updateArgs }
}
function sumDebit(lines: CapturedLine[]): number {
return Math.round(lines.reduce((s, l) => s + l.debit_amount, 0) * 100) / 100
}
function sumCredit(lines: CapturedLine[]): number {
return Math.round(lines.reduce((s, l) => s + l.credit_amount, 0) * 100) / 100
}
describe('disposeAsset — VAT on proceeds', () => {
it('standard_25 sale appends a 2611 credit and balances', async () => {
// Acquisition 100 000, accumulated 40 000 → NBV 60 000.
// Gross proceeds 100 000 → net 80 000 → vat 20 000 → gain 20 000.
const asset = makeAsset({ category: 'equipment' })
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 100_000,
proceeds_vat: 20_000,
vat_treatment: 'standard_25',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number === '2611')?.credit_amount).toBe(20_000)
// Gain on NET proceeds, not gross: 80 000 net − 60 000 NBV = 20 000 gain
expect(lines.find((l) => l.account_number === '3973')?.credit_amount).toBe(20_000)
// No loss line on a gain scenario
expect(lines.find((l) => l.account_number === '7973')).toBeUndefined()
// Bank debit = gross
expect(lines.find((l) => l.account_number === '1930')?.debit_amount).toBe(100_000)
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('reduced_12 sale uses BAS 2621', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 100_000,
proceeds_vat: 100_000 - 100_000 / 1.12,
vat_treatment: 'reduced_12',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number === '2621')).toBeDefined()
expect(lines.find((l) => l.account_number === '2611')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('reduced_6 sale uses BAS 2631', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 100_000,
proceeds_vat: 100_000 - 100_000 / 1.06,
vat_treatment: 'reduced_6',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number === '2631')).toBeDefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('reverse_charge sale posts NO VAT line', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 80_000,
proceeds_vat: 0,
vat_treatment: 'reverse_charge',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number.startsWith('261'))).toBeUndefined()
// The full proceeds counts as net (no VAT taken out) → gain = 80 000 − 60 000 = 20 000
expect(lines.find((l) => l.account_number === '3973')?.credit_amount).toBe(20_000)
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('export sale posts NO VAT line', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 80_000,
proceeds_vat: 0,
vat_treatment: 'export',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number.startsWith('26'))).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('throws when proceeds_vat > 0 but no vat_treatment is supplied', async () => {
const { createJournalEntry } = await import('@/lib/bookkeeping/engine')
vi.mocked(createJournalEntry).mockClear()
const { supabase } = makeSupabaseForDispose(makeAsset(), [{ planned_depreciation: 40_000 }])
await expect(
disposeAsset(supabase as unknown as Parameters<typeof disposeAsset>[0], 'co', 'u', 'asset-1', {
disposed_at: '2026-05-26',
disposed_proceeds: 100_000,
proceeds_vat: 20_000,
fiscal_period_id: 'fp',
}),
).rejects.toThrow(/vat_treatment/)
})
it('throws when reverse_charge is selected but proceeds_vat > 0', async () => {
const { createJournalEntry } = await import('@/lib/bookkeeping/engine')
vi.mocked(createJournalEntry).mockClear()
const { supabase } = makeSupabaseForDispose(makeAsset(), [{ planned_depreciation: 40_000 }])
await expect(
disposeAsset(supabase as unknown as Parameters<typeof disposeAsset>[0], 'co', 'u', 'asset-1', {
disposed_at: '2026-05-26',
disposed_proceeds: 80_000,
proceeds_vat: 5_000,
vat_treatment: 'reverse_charge',
fiscal_period_id: 'fp',
}),
).rejects.toThrow(/reverse_charge/)
})
it('zero-VAT sale (no fields passed) still posts a balanced entry', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-05-26',
disposed_proceeds: 50_000,
fiscal_period_id: 'fp',
},
)
// No VAT line
expect(lines.find((l) => l.account_number.startsWith('26'))).toBeUndefined()
// Loss on 50 000 − 60 000 = -10 000 → 7973 debit
expect(lines.find((l) => l.account_number === '7973')?.debit_amount).toBe(10_000)
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
})
describe('disposeAsset — jämkning (input VAT correction)', () => {
it('credits 2641 and debits 6991 for the jämkning amount', async () => {
const asset = makeAsset({ category: 'equipment' })
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-01-01',
disposed_proceeds: 60_000,
fiscal_period_id: 'fp',
// 5-year asset sold after 3 years; 24 months remain × 20 000 VAT × 24/60 = 8 000
jamkning_amount: 8_000,
jamkning_remaining_months: 24,
jamkning_total_months: 60,
jamkning_original_input_vat: 20_000,
},
)
// 2641 credit (reverses prior input VAT deduction)
expect(lines.find((l) => l.account_number === '2641')?.credit_amount).toBe(8_000)
// Jämkning is a VAT correction (ML 8a kap), not a disposal loss — it must
// route to 6991 "Övriga externa kostnader, avdragsgilla", NOT to 78xx.
expect(lines.find((l) => l.account_number === '6991')?.debit_amount).toBe(8_000)
// No 78xx line — proceeds 60 000 = NBV 60 000 means no gain/loss, and the
// jämkning explicitly does not contaminate the disposal-loss accounts.
expect(lines.find((l) => l.account_number === '7973')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('combined VAT + jämkning + gain stays balanced', async () => {
const asset = makeAsset({ category: 'equipment' })
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-01-01',
disposed_proceeds: 100_000, // gross
proceeds_vat: 20_000, // 25%
vat_treatment: 'standard_25',
fiscal_period_id: 'fp',
jamkning_amount: 8_000,
jamkning_remaining_months: 24,
jamkning_total_months: 60,
jamkning_original_input_vat: 20_000,
},
)
expect(lines.find((l) => l.account_number === '2611')?.credit_amount).toBe(20_000)
expect(lines.find((l) => l.account_number === '2641')?.credit_amount).toBe(8_000)
// Gain 20 000 on net proceeds → 3973 credit; jämkning 8 000 → 6991 debit
// (NOT 7973 — see ML 8a kap, jämkning is a VAT correction not a loss).
expect(lines.find((l) => l.account_number === '3973')?.credit_amount).toBe(20_000)
expect(lines.find((l) => l.account_number === '6991')?.debit_amount).toBe(8_000)
expect(lines.find((l) => l.account_number === '7973')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('zero jämkning amount produces no extra lines', async () => {
const asset = makeAsset()
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-01-01',
disposed_proceeds: 60_000,
fiscal_period_id: 'fp',
jamkning_amount: 0,
},
)
expect(lines.find((l) => l.account_number === '2641')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('routes jämkning to 6991 even for building category (never to 78xx)', async () => {
const asset = makeAsset({
category: 'building',
bas_asset_account: '1110',
bas_accumulated_account: '1119',
bas_expense_account: '7821',
acquisition_cost: 2_000_000,
})
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 200_000 }],
{
disposed_at: '2026-01-01',
disposed_proceeds: 1_800_000,
fiscal_period_id: 'fp',
// 10-year fastighet, 60 months remaining out of 120, original 200 000 → 100 000
jamkning_amount: 100_000,
jamkning_remaining_months: 60,
jamkning_total_months: 120,
jamkning_original_input_vat: 200_000,
},
)
// Jämkning goes to 6991 regardless of asset category — it's a VAT
// correction per ML 8a kap, NOT a förlust vid avyttring (78xx).
expect(lines.find((l) => l.account_number === '6991')?.debit_amount).toBe(100_000)
// The disposal itself is at a loss (NBV 1.8M = proceeds 1.8M? Let's check:
// acq 2.0M − ack 0.2M = NBV 1.8M, proceeds 1.8M → no gain/loss line). The
// only debit-side cost line is the 6991 jämkning entry.
expect(lines.find((l) => l.account_number === '7971')).toBeUndefined()
expect(lines.find((l) => l.account_number === '7973')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('persists jämkning + VAT audit metadata on the asset row', async () => {
const asset = makeAsset()
const { updateArgs } = await captureLines(
asset,
[{ planned_depreciation: 40_000 }],
{
disposed_at: '2026-01-01',
disposed_proceeds: 100_000,
proceeds_vat: 20_000,
vat_treatment: 'standard_25',
fiscal_period_id: 'fp',
jamkning_amount: 8_000,
jamkning_remaining_months: 24,
jamkning_total_months: 60,
jamkning_original_input_vat: 20_000,
},
)
expect(updateArgs.disposed_proceeds).toBe(100_000)
expect(updateArgs.disposed_proceeds_vat).toBe(20_000)
expect(updateArgs.disposed_vat_treatment).toBe('standard_25')
expect(updateArgs.jamkning_amount).toBe(8_000)
expect(updateArgs.jamkning_remaining_months).toBe(24)
expect(updateArgs.jamkning_total_months).toBe(60)
expect(updateArgs.jamkning_original_input_vat).toBe(20_000)
})
})
describe('disposeAsset — gain vs loss with VAT', () => {
it('gain scenario: net proceeds > NBV → 3973 credit', async () => {
const asset = makeAsset({ category: 'equipment' })
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 50_000 }],
{
disposed_at: '2026-05-26',
// NBV = 50 000, net proceeds = 80 000 → gain 30 000
disposed_proceeds: 100_000,
proceeds_vat: 20_000,
vat_treatment: 'standard_25',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number === '3973')?.credit_amount).toBe(30_000)
expect(lines.find((l) => l.account_number === '7973')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
it('loss scenario: net proceeds < NBV → 7973 debit', async () => {
const asset = makeAsset({ category: 'equipment' })
const { lines } = await captureLines(
asset,
[{ planned_depreciation: 20_000 }],
{
disposed_at: '2026-05-26',
// NBV = 80 000, net proceeds = 40 000 → loss 40 000
disposed_proceeds: 50_000,
proceeds_vat: 10_000,
vat_treatment: 'standard_25',
fiscal_period_id: 'fp',
},
)
expect(lines.find((l) => l.account_number === '7973')?.debit_amount).toBe(40_000)
expect(lines.find((l) => l.account_number === '3973')).toBeUndefined()
expect(sumDebit(lines)).toBe(sumCredit(lines))
})
})