* fix(invoices): embed company logo as PNG so it renders on invoice PDFs (#772) @react-pdf/renderer's <Image> only decodes JPG/PNG, but the logo upload route and the `logos` bucket also accept SVG and WebP. For an SVG/WebP logo @react-pdf silently swallows the decode error (console.warn inside a try/catch in its fetchImage step), so the invoice renders with NO logo and nothing surfaces — "Logotyp kommer inte med på fakturor". Fix: prepareInvoicePdfRender now fetches the stored logo and re-encodes it to a PNG data URL via sharp (SVGs rasterized at higher density), handing the template a company whose logo_url is that data URL. Renders regardless of upload format and removes the render-time dependency on a remote fetch inside @react-pdf. Falls back to the original URL unchanged on any failure (network, unreadable image, sharp unavailable), so behaviour is never worse than before. Result is cached per logo URL (5-min TTL, bounded to 50) since the logo is re-rendered on every invoice — twice per send and once per invoice in recurring/batch loops. prepareInvoicePdfRender becomes async and returns the resolved { branding, company }; all 8 call sites updated (6 routes, recurring-schedule-service, pending-operations/commit) to await it and pass the resolved company. Layered cleanly on top of the Swish-QR feature already on main — both coexist at every call site. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(invoices): bound and dedupe the logo fetch (review hardening) Review (PR Agent security): resolveLogoDataUrl fetched logo_url with no timeout or size limit. Add a 5s AbortSignal.timeout and a 5 MB cap (checked on the declared content-length and the read body) so a slow/oversized logo host can't hang or balloon an invoice render. SSRF itself isn't reachable today — logo_url is only ever set to a Supabase logos-bucket URL by the upload route — so an origin allowlist is intentionally skipped (would break self-hosted storage). Also coalesce concurrent renders of the same logo (preflight+final on a send, and recurring/batch loops) onto one in-flight fetch+encode instead of N. New test covers the size-cap fallback; existing SVG test now asserts the timeout signal. 9/9 pass. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
481 lines
16 KiB
TypeScript
481 lines
16 KiB
TypeScript
/**
|
|
* Recurring invoice schedule service.
|
|
*
|
|
* Two public functions:
|
|
* - executeRecurringSchedule: spawn one invoice from a schedule, optionally
|
|
* sending it. Used by the daily cron and by a manual "run now" admin
|
|
* action.
|
|
* - computeNextRunDate: pure date helper. Given today + day_of_month, return
|
|
* the next date the schedule should run. Day-of-month values >28 are
|
|
* clamped to the last day of shorter months; the schedule keeps its
|
|
* original day_of_month so it jumps back in months that have it.
|
|
*/
|
|
|
|
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import { eventBus } from '@/lib/events'
|
|
import { getVatRules, getAvailableVatRates } from '@/lib/invoices/vat-rules'
|
|
import { fetchExchangeRate, convertToSEK } from '@/lib/currency/riksbanken'
|
|
import { ensureInvoiceNumber } from '@/lib/invoices/ensure-invoice-number'
|
|
import { createInvoiceJournalEntry } from '@/lib/bookkeeping/invoice-entries'
|
|
import { renderToBuffer } from '@react-pdf/renderer'
|
|
import { InvoicePDF } from '@/lib/invoices/pdf-template'
|
|
import { prepareInvoicePdfRender, buildSwishQrDataUrl } from '@/lib/invoices/pdf-render-helpers'
|
|
import { getEmailService } from '@/lib/email/service'
|
|
import {
|
|
generateInvoiceEmailHtml,
|
|
generateInvoiceEmailText,
|
|
generateInvoiceEmailSubject,
|
|
} from '@/lib/email/invoice-templates'
|
|
import { uploadDocument } from '@/lib/core/documents/document-service'
|
|
import { createLogger } from '@/lib/logger'
|
|
import type {
|
|
Invoice,
|
|
InvoiceItem,
|
|
Customer,
|
|
CompanySettings,
|
|
RecurringInvoiceSchedule,
|
|
RecurringInvoiceScheduleItem,
|
|
} from '@/types'
|
|
|
|
const log = createLogger('invoices/recurring-schedule-service')
|
|
|
|
export interface ExecuteResult {
|
|
invoiceId: string
|
|
invoiceNumber: string | null
|
|
autoSent: boolean
|
|
warning: string | null
|
|
}
|
|
|
|
/**
|
|
* Last day of the month for the given year/month (1-indexed month).
|
|
* Used to clamp day_of_month values >28 in shorter months.
|
|
*/
|
|
function lastDayOfMonth(year: number, monthIndex0: number): number {
|
|
// Day 0 of next month = last day of this month.
|
|
return new Date(Date.UTC(year, monthIndex0 + 1, 0)).getUTCDate()
|
|
}
|
|
|
|
/**
|
|
* Compute the next run date for a schedule given a reference date and the
|
|
* stored day_of_month. The reference is always interpreted in UTC to avoid
|
|
* timezone surprises around the day boundary in Vercel cron.
|
|
*
|
|
* Rules:
|
|
* - If reference is the same as a valid day_of_month occurrence, returns
|
|
* NEXT month's occurrence (callers compute the FIRST run via
|
|
* computeInitialRunDate).
|
|
* - Day 29-31 in shorter months clamps to that month's last day.
|
|
* - The schedule's stored day_of_month is unchanged — caller passes it in.
|
|
*/
|
|
export function computeNextRunDate(reference: Date, dayOfMonth: number): string {
|
|
if (dayOfMonth < 1 || dayOfMonth > 31) {
|
|
throw new Error(`invalid day_of_month: ${dayOfMonth}`)
|
|
}
|
|
const refY = reference.getUTCFullYear()
|
|
const refM = reference.getUTCMonth()
|
|
// Advance to the next month.
|
|
const nextM = refM + 1
|
|
const nextYear = refY + Math.floor(nextM / 12)
|
|
const nextMonth = ((nextM % 12) + 12) % 12
|
|
const clamped = Math.min(dayOfMonth, lastDayOfMonth(nextYear, nextMonth))
|
|
const yyyy = nextYear.toString().padStart(4, '0')
|
|
const mm = (nextMonth + 1).toString().padStart(2, '0')
|
|
const dd = clamped.toString().padStart(2, '0')
|
|
return `${yyyy}-${mm}-${dd}`
|
|
}
|
|
|
|
/**
|
|
* Compute the initial next_run_date when a schedule is created.
|
|
* - If start_date is given, use it.
|
|
* - Else, if today's day-of-month <= schedule day_of_month (clamped to this
|
|
* month's last day), pick this month's occurrence.
|
|
* - Otherwise pick next month's occurrence.
|
|
*/
|
|
export function computeInitialRunDate(
|
|
today: Date,
|
|
dayOfMonth: number,
|
|
startDate?: string,
|
|
): string {
|
|
if (startDate) return startDate
|
|
if (dayOfMonth < 1 || dayOfMonth > 31) {
|
|
throw new Error(`invalid day_of_month: ${dayOfMonth}`)
|
|
}
|
|
const y = today.getUTCFullYear()
|
|
const m = today.getUTCMonth()
|
|
const todayDay = today.getUTCDate()
|
|
const thisMonthDay = Math.min(dayOfMonth, lastDayOfMonth(y, m))
|
|
if (todayDay <= thisMonthDay) {
|
|
const yyyy = y.toString().padStart(4, '0')
|
|
const mm = (m + 1).toString().padStart(2, '0')
|
|
const dd = thisMonthDay.toString().padStart(2, '0')
|
|
return `${yyyy}-${mm}-${dd}`
|
|
}
|
|
return computeNextRunDate(today, dayOfMonth)
|
|
}
|
|
|
|
/**
|
|
* Spawn one invoice from a schedule. Always creates the invoice; auto_send
|
|
* additionally renders + emails + flips status + creates JE + archives PDF.
|
|
*
|
|
* Idempotency: caller must check schedule.last_run_at >= today before calling
|
|
* to prevent double-spawn on cron retries within the same UTC day.
|
|
*/
|
|
export async function executeRecurringSchedule(
|
|
supabase: SupabaseClient,
|
|
schedule: RecurringInvoiceSchedule & { items: RecurringInvoiceScheduleItem[] },
|
|
today: Date = new Date(),
|
|
): Promise<ExecuteResult> {
|
|
const opLog = log.child({ scheduleId: schedule.id, companyId: schedule.company_id })
|
|
|
|
// 1. Load customer to resolve VAT rules.
|
|
const { data: customer, error: customerErr } = await supabase
|
|
.from('customers')
|
|
.select('*')
|
|
.eq('id', schedule.customer_id)
|
|
.eq('company_id', schedule.company_id)
|
|
.single<Customer>()
|
|
|
|
if (customerErr || !customer) {
|
|
throw new Error(`customer not found for schedule ${schedule.id}`)
|
|
}
|
|
|
|
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
|
|
const availableRates = getAvailableVatRates(customer.customer_type, customer.vat_number_validated)
|
|
const allowedRates = new Set(availableRates.map((r) => r.rate))
|
|
|
|
// 2. Compute amounts (mirrors POST /api/invoices).
|
|
const items = (schedule.items || []).slice().sort((a, b) => a.sort_order - b.sort_order)
|
|
if (items.length === 0) {
|
|
throw new Error(`schedule ${schedule.id} has no items`)
|
|
}
|
|
|
|
const subtotal = items.reduce((sum, it) => sum + it.quantity * it.unit_price, 0)
|
|
let vatAmount = 0
|
|
for (const item of items) {
|
|
const itemRate = item.vat_rate != null ? item.vat_rate : vatRules.rate
|
|
if (!allowedRates.has(itemRate)) {
|
|
throw new Error(
|
|
`VAT rate ${itemRate}% not allowed for customer type ${customer.customer_type}`,
|
|
)
|
|
}
|
|
const lineTotal = item.quantity * item.unit_price
|
|
vatAmount += Math.round((lineTotal * itemRate) / 100 * 100) / 100
|
|
}
|
|
const total = subtotal + vatAmount
|
|
|
|
const uniqueRates = new Set(items.map((it) => (it.vat_rate != null ? it.vat_rate : vatRules.rate)))
|
|
const isMixedRate = uniqueRates.size > 1
|
|
|
|
// 3. Dates: invoice_date = today (UTC), due_date = +payment_terms_days.
|
|
const yyyy = today.getUTCFullYear().toString().padStart(4, '0')
|
|
const mm = (today.getUTCMonth() + 1).toString().padStart(2, '0')
|
|
const dd = today.getUTCDate().toString().padStart(2, '0')
|
|
const invoiceDate = `${yyyy}-${mm}-${dd}`
|
|
const due = new Date(Date.UTC(today.getUTCFullYear(), today.getUTCMonth(), today.getUTCDate()))
|
|
due.setUTCDate(due.getUTCDate() + schedule.payment_terms_days)
|
|
const dueDate = due.toISOString().slice(0, 10)
|
|
|
|
// 4. Foreign currency: fetch exchange rate.
|
|
let exchangeRate: number | null = null
|
|
let exchangeRateDate: string | null = null
|
|
let subtotalSek: number | null = null
|
|
let vatAmountSek: number | null = null
|
|
let totalSek: number | null = null
|
|
if (schedule.currency !== 'SEK') {
|
|
const rateData = await fetchExchangeRate(schedule.currency)
|
|
if (rateData) {
|
|
exchangeRate = rateData.rate
|
|
exchangeRateDate = rateData.date
|
|
subtotalSek = convertToSEK(subtotal, exchangeRate)
|
|
vatAmountSek = convertToSEK(vatAmount, exchangeRate)
|
|
totalSek = convertToSEK(total, exchangeRate)
|
|
}
|
|
}
|
|
|
|
// 5. Insert invoice header.
|
|
const { data: invoice, error: invoiceError } = await supabase
|
|
.from('invoices')
|
|
.insert({
|
|
user_id: schedule.user_id,
|
|
company_id: schedule.company_id,
|
|
customer_id: schedule.customer_id,
|
|
invoice_number: null,
|
|
invoice_date: invoiceDate,
|
|
due_date: dueDate,
|
|
delivery_date: null,
|
|
currency: schedule.currency,
|
|
exchange_rate: exchangeRate,
|
|
exchange_rate_date: exchangeRateDate,
|
|
subtotal,
|
|
subtotal_sek: subtotalSek,
|
|
vat_amount: vatAmount,
|
|
vat_amount_sek: vatAmountSek,
|
|
total,
|
|
total_sek: totalSek,
|
|
remaining_amount: total,
|
|
vat_treatment: vatRules.treatment,
|
|
vat_rate: isMixedRate ? null : (uniqueRates.values().next().value ?? vatRules.rate),
|
|
moms_ruta: vatRules.momsRuta,
|
|
reverse_charge_text: vatRules.reverseChargeText || null,
|
|
your_reference: schedule.your_reference,
|
|
our_reference: schedule.our_reference,
|
|
notes: schedule.notes,
|
|
document_type: 'invoice',
|
|
})
|
|
.select()
|
|
.single()
|
|
|
|
if (invoiceError || !invoice) {
|
|
throw new Error(`failed to insert invoice from schedule: ${invoiceError?.message ?? 'unknown'}`)
|
|
}
|
|
|
|
// 6. Insert items.
|
|
// NOTE (artikelregister Phase 2): recurring schedule template items have no
|
|
// article_id / revenue_account columns (see recurring_invoice_schedule_items),
|
|
// so generated invoices fall back to the VAT-treatment-derived revenue account.
|
|
// Wiring per-article overrides into recurring invoices needs a schema change
|
|
// and is deliberately out of the artikelregister MVP scope.
|
|
const itemRows = items.map((item, index) => {
|
|
const itemRate = item.vat_rate != null ? item.vat_rate : vatRules.rate
|
|
const lineTotal = item.quantity * item.unit_price
|
|
const itemVat = Math.round((lineTotal * itemRate) / 100 * 100) / 100
|
|
return {
|
|
invoice_id: invoice.id,
|
|
sort_order: index,
|
|
description: item.description,
|
|
quantity: item.quantity,
|
|
unit: item.unit,
|
|
unit_price: item.unit_price,
|
|
line_total: lineTotal,
|
|
vat_rate: itemRate,
|
|
vat_amount: itemVat,
|
|
}
|
|
})
|
|
const { error: itemsError } = await supabase.from('invoice_items').insert(itemRows)
|
|
if (itemsError) {
|
|
// Hard-delete is safe here only because step 5 inserted invoice_number: null
|
|
// — no F-series slot has been consumed yet (step 7 calls ensureInvoiceNumber).
|
|
// Once a number is assigned, the soft-cancel path in step 7 must be used to
|
|
// preserve the sequence per BFL 5 kap 6§ / ML 17 kap 24§.
|
|
await supabase.from('invoices').delete().eq('id', invoice.id)
|
|
throw new Error(`failed to insert invoice items: ${itemsError.message}`)
|
|
}
|
|
|
|
// 7. Allocate F-series number.
|
|
try {
|
|
await ensureInvoiceNumber(supabase, schedule.company_id, invoice as Invoice)
|
|
} catch (err) {
|
|
// Soft-cancel to preserve the F-series sequence (ML 17 kap 24§).
|
|
await supabase
|
|
.from('invoices')
|
|
.update({ status: 'cancelled' })
|
|
.eq('id', invoice.id)
|
|
.eq('company_id', schedule.company_id)
|
|
.eq('status', 'draft')
|
|
throw new Error(
|
|
`failed to assign invoice number: ${err instanceof Error ? err.message : String(err)}`,
|
|
)
|
|
}
|
|
|
|
// 8. Re-fetch with relations so downstream PDF/email/event have full data.
|
|
const { data: completeInvoice } = await supabase
|
|
.from('invoices')
|
|
.select('*, customer:customers(*), items:invoice_items(*)')
|
|
.eq('id', invoice.id)
|
|
.single()
|
|
|
|
if (!completeInvoice) {
|
|
throw new Error('failed to reload created invoice')
|
|
}
|
|
|
|
// Always emit invoice.created so existing consumers (event_log, etc.) see it.
|
|
await eventBus.emit({
|
|
type: 'invoice.created',
|
|
payload: {
|
|
invoice: completeInvoice as Invoice,
|
|
companyId: schedule.company_id,
|
|
userId: schedule.user_id,
|
|
},
|
|
})
|
|
|
|
let autoSent = false
|
|
let warning: string | null = null
|
|
|
|
// 9. Auto-send path. If anything below fails, we keep the invoice (now a
|
|
// numbered draft) and surface a Swedish warning on the schedule — the
|
|
// user can manually send from /invoices/[id].
|
|
if (schedule.auto_send) {
|
|
try {
|
|
autoSent = await sendInvoiceFromSchedule(
|
|
supabase,
|
|
schedule.company_id,
|
|
schedule.user_id,
|
|
completeInvoice as Invoice & { customer: Customer; items: InvoiceItem[] },
|
|
)
|
|
if (!autoSent) {
|
|
warning = 'Auto-utskick misslyckades — fakturan finns som utkast och kan skickas manuellt.'
|
|
}
|
|
} catch (err) {
|
|
opLog.error('auto-send failed for recurring schedule', err as Error, {
|
|
invoiceId: invoice.id,
|
|
})
|
|
warning = `Auto-utskick misslyckades: ${err instanceof Error ? err.message : 'okänt fel'}`
|
|
}
|
|
}
|
|
|
|
await eventBus.emit({
|
|
type: 'recurring_invoice.executed',
|
|
payload: {
|
|
scheduleId: schedule.id,
|
|
invoice: completeInvoice as Invoice,
|
|
autoSent,
|
|
warning,
|
|
companyId: schedule.company_id,
|
|
userId: schedule.user_id,
|
|
},
|
|
})
|
|
|
|
return {
|
|
invoiceId: invoice.id,
|
|
invoiceNumber: (completeInvoice as Invoice).invoice_number,
|
|
autoSent,
|
|
warning,
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Render PDF + send email + flip status + create JE + archive PDF.
|
|
* Mirrors /api/invoices/[id]/send/route.ts but inline so we don't depend on
|
|
* the route's auth chain. Returns true if email was sent successfully.
|
|
*/
|
|
async function sendInvoiceFromSchedule(
|
|
supabase: SupabaseClient,
|
|
companyId: string,
|
|
userId: string,
|
|
invoice: Invoice & { customer: Customer; items: InvoiceItem[] },
|
|
): Promise<boolean> {
|
|
const emailService = getEmailService()
|
|
if (!emailService.isConfigured()) {
|
|
log.warn('email service not configured; recurring schedule cannot auto-send', {
|
|
invoiceId: invoice.id,
|
|
})
|
|
return false
|
|
}
|
|
if (!invoice.customer.email) {
|
|
log.warn('customer has no email; recurring schedule cannot auto-send', {
|
|
invoiceId: invoice.id,
|
|
customerId: invoice.customer.id,
|
|
})
|
|
return false
|
|
}
|
|
|
|
const { data: company } = await supabase
|
|
.from('company_settings')
|
|
.select('*')
|
|
.eq('company_id', companyId)
|
|
.single<CompanySettings>()
|
|
|
|
if (!company) {
|
|
throw new Error('company settings missing — cannot send invoice')
|
|
}
|
|
|
|
const items = (invoice.items || []).slice().sort((a, b) => a.sort_order - b.sort_order)
|
|
|
|
// Render PDF with status overridden to 'sent' so the customer doesn't
|
|
// receive a "UTKAST" stamp.
|
|
const renderableInvoice = { ...invoice, status: 'sent' as const }
|
|
const { branding, company: renderCompany } = await prepareInvoicePdfRender(company)
|
|
const swishQrDataUrl = await buildSwishQrDataUrl(company, renderableInvoice)
|
|
const pdfBuffer = await renderToBuffer(
|
|
InvoicePDF({
|
|
invoice: renderableInvoice,
|
|
customer: invoice.customer,
|
|
items,
|
|
company: renderCompany,
|
|
branding,
|
|
swishQrDataUrl,
|
|
}),
|
|
)
|
|
|
|
const emailData = { invoice, customer: invoice.customer, company }
|
|
const filename = `faktura-${invoice.invoice_number}.pdf`
|
|
const ccAddress = company.email || undefined
|
|
|
|
const result = await emailService.sendEmail({
|
|
to: invoice.customer.email,
|
|
cc: ccAddress,
|
|
subject: generateInvoiceEmailSubject(emailData),
|
|
html: generateInvoiceEmailHtml(emailData),
|
|
text: generateInvoiceEmailText(emailData),
|
|
replyTo: company.email || undefined,
|
|
fromName: company.company_name ?? undefined,
|
|
attachments: [
|
|
{ filename, content: pdfBuffer, contentType: 'application/pdf' },
|
|
],
|
|
})
|
|
|
|
if (!result.success) {
|
|
log.error(
|
|
'email provider failed in recurring schedule auto-send',
|
|
new Error(result.error || 'unknown'),
|
|
{ invoiceId: invoice.id },
|
|
)
|
|
return false
|
|
}
|
|
|
|
// Email delivered — flip status, create JE, archive PDF. Treat downstream
|
|
// failures as warnings (don't unsend the email).
|
|
await supabase
|
|
.from('invoices')
|
|
.update({ status: 'sent' })
|
|
.eq('id', invoice.id)
|
|
.eq('company_id', companyId)
|
|
|
|
const accountingMethod = (company as { accounting_method?: string }).accounting_method
|
|
let journalEntryId: string | undefined
|
|
if (!accountingMethod || accountingMethod === 'accrual') {
|
|
try {
|
|
const journalEntry = await createInvoiceJournalEntry(
|
|
supabase,
|
|
companyId,
|
|
userId,
|
|
invoice,
|
|
company.entity_type,
|
|
)
|
|
if (journalEntry) {
|
|
journalEntryId = journalEntry.id
|
|
await supabase
|
|
.from('invoices')
|
|
.update({ journal_entry_id: journalEntry.id })
|
|
.eq('id', invoice.id)
|
|
}
|
|
} catch (err) {
|
|
log.error('failed to create journal entry for recurring invoice', err as Error, {
|
|
invoiceId: invoice.id,
|
|
})
|
|
}
|
|
}
|
|
|
|
try {
|
|
const pdfArrayBuffer = new Uint8Array(pdfBuffer).buffer as ArrayBuffer
|
|
await uploadDocument(
|
|
supabase,
|
|
userId,
|
|
companyId,
|
|
{ name: filename, buffer: pdfArrayBuffer, type: 'application/pdf' },
|
|
{ upload_source: 'system', journal_entry_id: journalEntryId },
|
|
)
|
|
} catch (err) {
|
|
log.error('failed to archive recurring invoice PDF', err as Error, {
|
|
invoiceId: invoice.id,
|
|
})
|
|
}
|
|
|
|
await eventBus.emit({
|
|
type: 'invoice.sent',
|
|
payload: { invoice, companyId, userId },
|
|
})
|
|
|
|
return true
|
|
}
|