* fix: surface active TIC companies + block duplicate org numbers
Three fixes from live-prod testing:
1. Enrichment filter hid the user's directorships. Now accepts both
Completed and PartiallyCompleted status from TIC (tenants without
CompanyRoles enabled still get SPAR) and the /select-company role
filter no longer requires companyStatus === 'Aktivt' — real TIC
payloads have been observed with different values, and positionEnd
alone is the authoritative "currently a director" signal. Added
PII-free diagnostic logs so the next shape-mismatch is debuggable
from Vercel logs without a round trip.
2. Manual wizard silently allowed duplicate org numbers. Added:
- findExistingCompanyByOrgNumber helper in actions.ts (service role,
bypasses RLS to see cross-tenant rows)
- Server-side guard in createCompanyFromOnboarding — returns
'org_number_exists' before the create RPC so we don't leave ghost
companies
- New /api/company/check-org-number endpoint for debounced client
checks
- Warning + disabled submit in Step2CompanyDetails
- Friendly error toasts in WelcomeOnboarding + BankIdCompanyPicker
- Mirror cleaned org_number onto companies.org_number on creation so
future duplicate checks and lookups are reliable
3. /onboarding ignored ?org_number= when the picker routed there as a
fallback. Now reads searchParams and pre-fills settings; also fixed
a latent bug where Step1's entity-type change wiped the pre-fill on
*first* selection (it should only reset on a genuine change).
Tests: duplicate-org guard (with formatted-input normalization),
check-org-number route (auth + 400 + exists true/false +
normalization).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: address PR review feedback on duplicate-org guard
Greptile P1 findings + swedish-compliance feedback:
- findExistingCompanyByOrgNumber now throws on Supabase error instead
of silently returning null. Previously a DB outage or RLS
misconfiguration would bypass the entire duplicate guard and allow
duplicates through.
- createCompanyFromOnboarding catches the throw and returns a
user-facing error ("Kunde inte verifiera organisationsnummer"),
failing closed instead of open.
- companies.update({ org_number }) error is now checked and triggers a
rollback. Silent failure would leave the company without an
org_number, breaking all future duplicate checks for that entity.
- New normalizeOrgNumber helper validates 10- or 12-digit input,
strips the century prefix for 12-digit personnummer form, and
rejects anything else. Malformed input would have corrupted SIE4
(#ORGNR) and SRU (INFO.SRU) exports downstream.
- /select-company now uses loose `== null` for positionEnd — TIC has
been observed returning `undefined` for open-ended positions, which
strict `=== null` would silently filter out. Documented the two
downstream isCeased guards so future maintainers don't remove one
without the other.
- createCompanyFromTicRole refuses to provision when lookup.isCeased
(BFL 2 kap — bokföringsskyldighet ends at avregistrering).
BankIdCompanyPicker surfaces this client-side too.
- WelcomeOnboarding + BankIdCompanyPicker recognise new error codes:
org_number_invalid, company_ceased.
Tests: +4 cases covering malformed input rejection, fail-closed
behaviour on DB error, 12-digit personnummer normalization, and the
ceased-company refusal path. Full suite: 2306 passing.
Out of scope for this PR (follow-up):
- Partial unique index on companies(org_number) WHERE archived_at IS
NULL. Closes the race-condition window but needs a migration plus
any existing-duplicate cleanup — too risky for this hotfix.
- Rate limiting on /api/company/check-org-number. Endpoint is
auth-gated so not an immediate concern.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: add Luhn validation and extract org-number normalization
Third round of PR review feedback (swedish-compliance):
- Add Luhn-10 check-digit validation to normalizeOrgNumber. Rejects
structurally invalid org_numbers (wrong check digit) at the boundary
instead of letting them propagate into SIE4 #ORGNR and SRU INFO.SRU,
where Skatteverket and receiving accounting systems would reject
them later anyway. Reuses the existing luhnValidate helper from
lib/bankgiro/luhn.ts (Bankgirot 10-modulen — same algorithm applies
to both Bolagsverket org numbers and Swedish personnummer).
- Extract normalizeOrgNumber into lib/company-lookup/normalize-org-number.ts
so the server action and /api/company/check-org-number use the same
rule. Previously the API route only stripped hyphens/spaces, so a
12-digit input would miss a stored 10-digit duplicate and mislead the
client debounce check ("not a duplicate" → submit → server rejects).
- /api/company/check-org-number now returns exists=false for
Luhn-invalid input rather than querying the DB. The submit-time
server action surfaces org_number_invalid, which is the right place
for the error.
Test coverage: dedicated normalize-org-number.test.ts (10 cases
covering both-lengths, Luhn, whitespace tolerance, garbage). Updated
existing tests to use Luhn-valid numbers (real Volvo 5560125790,
synthetic personnummer 8001011231). New failing-Luhn test in
actions.test.ts. New 12-digit-normalization and
luhn-invalid-returns-false tests in route.test.ts.
Full suite: 2315 passing.
Not fixed (out of scope for this hotfix):
- 10↔12 digit round-trip fragility for personnummer born 2000+. This
is a codebase-wide architectural choice (see lib/skatteverket/format.ts
which uses a two-digit-year heuristic to choose 19/20 at export).
Migrating to 12-digit storage is a separate refactor.
- Server-side re-fetch of TIC /lookup for isCeased. The trust boundary
here is user-to-their-own-onboarding, not adversarial; doubling TIC
API cost isn't proportionate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
330 lines
12 KiB
TypeScript
330 lines
12 KiB
TypeScript
'use client'
|
|
|
|
import { useState, useEffect, useRef } from 'react'
|
|
import { useForm } from 'react-hook-form'
|
|
import { zodResolver } from '@hookform/resolvers/zod'
|
|
import { z } from 'zod'
|
|
import { Card, CardContent, CardDescription, CardHeader, CardTitle } from '@/components/ui/card'
|
|
import { Button } from '@/components/ui/button'
|
|
import { Input } from '@/components/ui/input'
|
|
import { Label } from '@/components/ui/label'
|
|
import { Loader2, ArrowRight, ArrowLeft, CheckCircle2, AlertTriangle } from 'lucide-react'
|
|
import type { EntityType } from '@/types'
|
|
import type { CompanyLookupResult } from '@/lib/company-lookup/types'
|
|
|
|
const schema = z.object({
|
|
company_name: z.string().min(1, 'Företagsnamn krävs'),
|
|
org_number: z.string()
|
|
.min(1, 'Organisationsnummer krävs')
|
|
.regex(/^\d{6,8}[-\s]?\d{4}$/, 'Ogiltigt format. Ange XXXXXX-XXXX'),
|
|
address_line1: z.string().optional(),
|
|
postal_code: z.string().optional(),
|
|
city: z.string().optional(),
|
|
})
|
|
|
|
type FormData = z.infer<typeof schema>
|
|
|
|
const ORG_NUMBER_REGEX = /^\d{6,8}[-\s]?\d{4}$/
|
|
|
|
interface Step2Props {
|
|
initialData: Partial<FormData>
|
|
entityType?: EntityType
|
|
ticEnabled?: boolean
|
|
onTicLookup?: (result: CompanyLookupResult | null) => void
|
|
onNext: (data: FormData) => void
|
|
onBack: () => void
|
|
isSaving: boolean
|
|
orgNumberLocked?: boolean
|
|
}
|
|
|
|
export default function Step2CompanyDetails({
|
|
initialData,
|
|
entityType,
|
|
ticEnabled,
|
|
onTicLookup,
|
|
onNext,
|
|
onBack,
|
|
isSaving,
|
|
orgNumberLocked,
|
|
}: Step2Props) {
|
|
const {
|
|
register,
|
|
handleSubmit,
|
|
watch,
|
|
setValue,
|
|
formState: { errors },
|
|
} = useForm<FormData>({
|
|
resolver: zodResolver(schema),
|
|
mode: 'onTouched',
|
|
defaultValues: {
|
|
company_name: initialData.company_name || '',
|
|
org_number: initialData.org_number || '',
|
|
address_line1: initialData.address_line1 || '',
|
|
postal_code: initialData.postal_code || '',
|
|
city: initialData.city || '',
|
|
},
|
|
})
|
|
|
|
const [isLooking, setIsLooking] = useState(false)
|
|
const [lookupError, setLookupError] = useState<string | null>(null)
|
|
const [lookupDone, setLookupDone] = useState<CompanyLookupResult | null>(null)
|
|
const [orgNumberExists, setOrgNumberExists] = useState(false)
|
|
const abortRef = useRef<AbortController | null>(null)
|
|
const dupAbortRef = useRef<AbortController | null>(null)
|
|
|
|
const orgNumber = watch('org_number')
|
|
|
|
// Debounced duplicate check against gnubok's own companies table. Runs in
|
|
// parallel with the TIC lookup — they don't conflict. On match, the submit
|
|
// button is disabled; the server action would also reject ('org_number_exists')
|
|
// but blocking client-side avoids a wasted roundtrip.
|
|
useEffect(() => {
|
|
if (!orgNumber || !ORG_NUMBER_REGEX.test(orgNumber)) {
|
|
setOrgNumberExists(false)
|
|
return
|
|
}
|
|
const timer = setTimeout(() => {
|
|
dupAbortRef.current?.abort()
|
|
const controller = new AbortController()
|
|
dupAbortRef.current = controller
|
|
fetch(`/api/company/check-org-number?org_number=${encodeURIComponent(orgNumber)}`, {
|
|
signal: controller.signal,
|
|
})
|
|
.then(async (res) => {
|
|
if (controller.signal.aborted || !res.ok) return
|
|
const { data } = await res.json()
|
|
setOrgNumberExists(!!data?.exists)
|
|
})
|
|
.catch(() => {
|
|
// Network failure is non-fatal — the server action will re-check.
|
|
})
|
|
}, 500)
|
|
return () => {
|
|
clearTimeout(timer)
|
|
dupAbortRef.current?.abort()
|
|
}
|
|
}, [orgNumber])
|
|
|
|
useEffect(() => {
|
|
if (!ticEnabled || !orgNumber || !ORG_NUMBER_REGEX.test(orgNumber)) {
|
|
return
|
|
}
|
|
|
|
setLookupError(null)
|
|
setLookupDone(null)
|
|
|
|
const timer = setTimeout(() => {
|
|
// Abort any in-flight request
|
|
abortRef.current?.abort()
|
|
const controller = new AbortController()
|
|
abortRef.current = controller
|
|
|
|
setIsLooking(true)
|
|
|
|
fetch(`/api/extensions/ext/tic/lookup?org_number=${encodeURIComponent(orgNumber)}`, {
|
|
signal: controller.signal,
|
|
})
|
|
.then(async (res) => {
|
|
if (controller.signal.aborted) return
|
|
|
|
if (res.status === 403) {
|
|
// Extension disabled — silently ignore
|
|
return
|
|
}
|
|
if (res.status === 404) {
|
|
setLookupError('Inget företag hittades med det organisationsnumret.')
|
|
onTicLookup?.(null)
|
|
return
|
|
}
|
|
if (!res.ok) {
|
|
setLookupError('Kunde inte hämta företagsuppgifter. Du kan fylla i manuellt.')
|
|
onTicLookup?.(null)
|
|
return
|
|
}
|
|
|
|
const { data } = (await res.json()) as { data: CompanyLookupResult }
|
|
|
|
// Guard: only apply if org_number still matches (user may have changed it)
|
|
if (controller.signal.aborted) return
|
|
|
|
setLookupDone(data)
|
|
onTicLookup?.(data)
|
|
|
|
// Auto-fill from TIC — overwrite since user just entered a new org number
|
|
if (data.companyName) setValue('company_name', data.companyName)
|
|
if (data.address?.street) setValue('address_line1', data.address.street)
|
|
if (data.address?.postalCode) setValue('postal_code', data.address.postalCode)
|
|
if (data.address?.city) setValue('city', data.address.city)
|
|
})
|
|
.catch((err) => {
|
|
if ((err as Error).name === 'AbortError') return
|
|
setLookupError('Kunde inte hämta företagsuppgifter. Du kan fylla i manuellt.')
|
|
onTicLookup?.(null)
|
|
})
|
|
.finally(() => {
|
|
if (!controller.signal.aborted) setIsLooking(false)
|
|
})
|
|
}, 500)
|
|
|
|
return () => {
|
|
clearTimeout(timer)
|
|
abortRef.current?.abort()
|
|
}
|
|
// eslint-disable-next-line react-hooks/exhaustive-deps
|
|
}, [ticEnabled, orgNumber])
|
|
|
|
const isAB = entityType === 'aktiebolag'
|
|
|
|
return (
|
|
<div className="space-y-6">
|
|
<Card>
|
|
<CardHeader>
|
|
<CardTitle>Grunduppgifter</CardTitle>
|
|
<CardDescription>
|
|
{ticEnabled
|
|
? 'Ange organisationsnummer så hämtas övriga uppgifter automatiskt.'
|
|
: isAB
|
|
? 'Ange bolagets registrerade namn och organisationsnummer.'
|
|
: 'Ange namn på din verksamhet.'}
|
|
</CardDescription>
|
|
</CardHeader>
|
|
<CardContent>
|
|
<form onSubmit={handleSubmit(onNext, (errs) => {
|
|
const fields = Object.keys(errs).join(', ')
|
|
console.error('[onboarding] step 2 validation failed:', fields, errs)
|
|
fetch('/api/log', { method: 'POST', headers: { 'Content-Type': 'application/json' }, body: JSON.stringify({ message: 'step 2 validation failed', extra: { fields } }) }).catch(() => {})
|
|
})} className="space-y-4">
|
|
<div className="space-y-2">
|
|
<Label htmlFor="org_number">
|
|
Organisationsnummer *
|
|
</Label>
|
|
<Input
|
|
id="org_number"
|
|
placeholder={isAB ? 'XXXXXX-XXXX' : 'ÅÅMMDD-XXXX (ditt personnummer vid EF)'}
|
|
{...register('org_number')}
|
|
readOnly={orgNumberLocked}
|
|
className={orgNumberLocked ? 'bg-muted cursor-not-allowed' : undefined}
|
|
/>
|
|
{errors.org_number && (
|
|
<p className="text-sm text-destructive">{errors.org_number.message}</p>
|
|
)}
|
|
<p className="text-xs text-muted-foreground">
|
|
{isAB
|
|
? 'Obligatoriskt för aktiebolag'
|
|
: 'Vid enskild firma är orgnummer samma som ditt personnummer'}
|
|
</p>
|
|
{ticEnabled && isLooking && (
|
|
<div className="flex items-center gap-2 text-sm text-muted-foreground">
|
|
<Loader2 className="h-3.5 w-3.5 animate-spin" />
|
|
Hämtar företagsuppgifter...
|
|
</div>
|
|
)}
|
|
{ticEnabled && lookupDone && !lookupDone.isCeased && (
|
|
<div className="flex items-center gap-2 text-sm text-primary">
|
|
<CheckCircle2 className="h-3.5 w-3.5" />
|
|
{lookupDone.companyName}
|
|
</div>
|
|
)}
|
|
{ticEnabled && lookupDone?.isCeased && (
|
|
<div className="flex items-center gap-2 text-sm text-destructive">
|
|
<AlertTriangle className="h-3.5 w-3.5" />
|
|
{lookupDone.companyName} — företaget är avregistrerat
|
|
</div>
|
|
)}
|
|
{ticEnabled && lookupError && (
|
|
<p className="text-xs text-muted-foreground">{lookupError}</p>
|
|
)}
|
|
{orgNumberExists && (
|
|
<div className="flex items-start gap-2 text-sm text-destructive">
|
|
<AlertTriangle className="h-3.5 w-3.5 mt-0.5 flex-shrink-0" />
|
|
<span>
|
|
Det här företaget finns redan i gnubok. Be en befintlig administratör att bjuda in dig.
|
|
</span>
|
|
</div>
|
|
)}
|
|
</div>
|
|
|
|
<div className="space-y-2">
|
|
<Label htmlFor="company_name">
|
|
{isAB ? 'Företagsnamn' : 'Verksamhetsnamn (Eller ditt namn vid EF)'} *
|
|
</Label>
|
|
<Input
|
|
id="company_name"
|
|
placeholder={isAB ? 'AB Företaget' : 'Alices Konsultverksamhet'}
|
|
{...register('company_name')}
|
|
/>
|
|
{errors.company_name && (
|
|
<p className="text-sm text-destructive">{errors.company_name.message}</p>
|
|
)}
|
|
</div>
|
|
|
|
<div className="pt-4 border-t">
|
|
<h3 className="font-medium mb-4">Adress (för fakturor)</h3>
|
|
|
|
<div className="space-y-4">
|
|
<div className="space-y-2">
|
|
<Label htmlFor="address_line1">Gatuadress</Label>
|
|
<Input
|
|
id="address_line1"
|
|
placeholder="Storgatan 1"
|
|
{...register('address_line1')}
|
|
/>
|
|
</div>
|
|
|
|
<div className="grid grid-cols-1 sm:grid-cols-2 gap-4">
|
|
<div className="space-y-2">
|
|
<Label htmlFor="postal_code">Postnummer</Label>
|
|
<Input
|
|
id="postal_code"
|
|
placeholder="123 45"
|
|
{...register('postal_code')}
|
|
/>
|
|
</div>
|
|
<div className="space-y-2">
|
|
<Label htmlFor="city">Ort</Label>
|
|
<Input
|
|
id="city"
|
|
placeholder="Stockholm"
|
|
{...register('city')}
|
|
/>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
|
|
<div className="flex flex-col-reverse sm:flex-row sm:justify-between gap-3 pt-4">
|
|
<Button
|
|
type="button"
|
|
variant="ghost"
|
|
onClick={onBack}
|
|
disabled={isSaving}
|
|
className="w-full sm:w-auto"
|
|
>
|
|
<ArrowLeft className="mr-2 h-4 w-4" />
|
|
Tillbaka
|
|
</Button>
|
|
<Button
|
|
type="submit"
|
|
disabled={isSaving || orgNumberExists}
|
|
className="w-full sm:w-auto"
|
|
>
|
|
{isSaving ? (
|
|
<>
|
|
<Loader2 className="mr-2 h-4 w-4 animate-spin" />
|
|
Sparar...
|
|
</>
|
|
) : (
|
|
<>
|
|
Fortsätt
|
|
<ArrowRight className="ml-2 h-4 w-4" />
|
|
</>
|
|
)}
|
|
</Button>
|
|
</div>
|
|
</form>
|
|
</CardContent>
|
|
</Card>
|
|
</div>
|
|
)
|
|
}
|