Mattsson
e11f70b347
* refactor: optimize page loading and data fetching * fix: resolve recurring production runtime errors * feat: add MCP company and customer updates * fix: handle year-end tax adjustments * feat: harden annual report compliance * fix: expand invoice logo and font support * fix: sanitize API route error responses * fix: sanitize user-facing error messages * feat: persist onboarding and tax assessment notices * fix: reduce cloud backup audit churn * feat: refine invoice editor layout * fix: show saved tax adjustments in INK2 * fix: complete annual report API mappings * docs: record operational safeguards and decisions * fix: harden annual report review findings * fix: adjust column span for description based on VAT registration * New css class name
63 lines
2.5 KiB
TypeScript
63 lines
2.5 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { requireAuth } from '@/lib/auth/require-auth'
|
|
import { normalizeOrgNumber } from '@/lib/company-lookup/normalize-org-number'
|
|
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
|
|
|
/**
|
|
* GET /api/company/check-org-number?org_number=XXXXXXXXXX
|
|
*
|
|
* Returns `{ data: { exists: boolean, companies: { id, name }[] } }` for the
|
|
* companies the CURRENT USER already has with the given organisation number:
|
|
* scoped to their own account only.
|
|
*
|
|
* Org-number reuse across the platform is intentionally allowed (see
|
|
* lib/company/actions.ts), so this is a soft, account-scoped warning, NOT a
|
|
* uniqueness gate. It uses the normal authenticated client on purpose: the
|
|
* `companies` SELECT RLS policy limits results to companies the caller is a
|
|
* member of (id IN user_company_ids()), so it can never reveal another user's
|
|
* companies and can't be used to enumerate org numbers platform-wide.
|
|
*
|
|
* Normalizes input with the same rule as the create action so a 12-digit form
|
|
* still matches a stored 10-digit canonical. Returns no matches for malformed
|
|
* input: the create action rejects that separately as `org_number_invalid`.
|
|
*/
|
|
export async function GET(request: Request) {
|
|
// requireAuth() (not a raw getUser()) so MFA AAL2 is enforced on hosted before
|
|
// we run the account-scoped lookup. The returned client carries the caller's
|
|
// RLS context, which is what scopes the companies SELECT below.
|
|
const { supabase, error: authError } = await requireAuth()
|
|
if (authError) return authError
|
|
|
|
const url = new URL(request.url)
|
|
const raw = url.searchParams.get('org_number') ?? ''
|
|
if (!raw) {
|
|
return NextResponse.json({ error: 'org_number is required' }, { status: 400 })
|
|
}
|
|
|
|
const canonical = normalizeOrgNumber(raw)
|
|
if (!canonical) {
|
|
// Malformed input is not a duplicate of anything by definition.
|
|
return NextResponse.json({ data: { exists: false, companies: [] } })
|
|
}
|
|
|
|
// RLS scopes this SELECT to the caller's own memberships (companies_select:
|
|
// id IN user_company_ids()), so the result is inherently account-scoped.
|
|
const { data, error } = await supabase
|
|
.from('companies')
|
|
.select('id, name')
|
|
.eq('org_number', canonical)
|
|
.is('archived_at', null)
|
|
|
|
if (error) {
|
|
return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
|
|
}
|
|
|
|
const companies = (data ?? []).map((c: { id: string; name: string }) => ({
|
|
id: c.id,
|
|
name: c.name,
|
|
}))
|
|
return NextResponse.json({
|
|
data: { exists: companies.length > 0, companies },
|
|
})
|
|
}
|