MattssonandClaude Opus 5
edfdbe2d2a
* fix(auth): move the BankID flow into a signed, single-use, confirm-on-resume cookie
A user's BankID signup identified successfully four times and created no
account. His screenshots show four tabs, one on the finished "Verifierad med
BankID, ange e-post" step, and the tab he was looking at showing the idle
button. Prod agreed: no bankid_identities row, no auth.users row.
On iOS outside plain Safari the BankID return URL is handed to the OS, which
opens a NEW tab. The session lived in per-tab sessionStorage, so that tab
started empty and rendered the start button while the completed flow sat
stranded. Login hid it (self-finishing, cookie-backed session); signup waits
for a human to type an e-mail into the stranded tab, so it dies there.
The session id is no longer handed to the browser. It lives in a signed
__Host- HttpOnly cookie set at /start; /poll, /complete, /link and /cancel
read it. Cookies are shared by every tab of the origin, which is what the
handoff needed. The id had to leave the client because it is an
unauthenticated bearer credential: /poll was skipAuth and returned
user.personalNumber, and /complete with mode 'login' returns a tokenHash that
verifyOtp turns into a session, MFA skipped for bankid_linked accounts.
A completed identification must never be consumed by whoever merely opens the
page. A shared cookie plus a shared machine means the tab that finds a
completed flow cannot prove the person at it is the one who made it, and no
client-side token can prove otherwise: nothing survives an iOS same-tab reload
yet dies on reopen-closed-tab / session restore / tab duplication. So a resume
is never automatic. The mount probe routes any found live flow to a confirm
card ("Fortsätt bara om det var du") that reveals no name, and only that click
polls and consumes. Auto-consume happens only inside the live component
instance that called startSession (desktop QR; the pre-navigation mobile
launch), which by construction is the originator. Cost: one tap after
returning from the BankID app on iOS, exactly where the reported bug lives;
desktop and Android never hit the resume path.
The rest is defence the four review rounds proved load-bearing:
- __Host- with Path=/ and unconditional Secure, so a script cannot plant the
same name at a longer path; readBankIdFlow fails closed on duplicates and on
a malformed percent-escape.
- Single-use is a unique index (bankid_consumed_sessions), claimed before
generateLink, not a Set-Cookie. Fail-closed on any non-23505 error, so the
migration MUST be applied before the code.
- A link flow requires auth at /start and pins userId; /link rejects a flow
owned by anyone else, before any TIC call. mode is pinned and /poll rejects a
body mode that does not match, so a login session cannot finish through the
signup panel. /poll withholds the holder name from a probe. The 900s
verified-step window is capped by MAX_TOTAL_LIFE from a signed startedAt.
/poll never clears the cookie (an untargeted Set-Cookie would delete a newer
flow); only /cancel and terminal /complete + /link exits clear. Avbryt holds
a 'cancelling' state until /cancel resolves so a new /start cannot race the
clear. Session id is logged only as an 8-char prefix.
The launch is untouched: iOS keeps its return URL, Android keeps redirect=null
(#194 closed that path deliberately).
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* fix(auth): bind BankID actions to the resumed flow
* docs: record BankID staging migration drift
* fix(auth): address BankID PR review
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
1598 lines
70 KiB
TypeScript
1598 lines
70 KiB
TypeScript
import type { Extension } from '@/lib/extensions/types'
|
|
import { NextResponse } from 'next/server'
|
|
import {
|
|
searchCompanyByOrgNumber,
|
|
getBankAccounts,
|
|
getIndustryCodes,
|
|
getEmails,
|
|
getPhones,
|
|
getCompanyPurpose,
|
|
getCompanyDocuments,
|
|
getFiscalYears,
|
|
getPayrolls,
|
|
getSignatory,
|
|
getRepresentatives,
|
|
getCompanyStatus,
|
|
getBeneficialOwners,
|
|
} from './lib/tic-client'
|
|
import {
|
|
startBankIdAuth,
|
|
pollBankIdSession,
|
|
collectBankIdResult,
|
|
cancelBankIdSession,
|
|
requestEnrichment,
|
|
fetchEnrichmentData,
|
|
} from './lib/bankid-client'
|
|
import { TICAPIError } from './lib/tic-types'
|
|
import type { TICCompanyProfile, TICFinancialReportSummary } from './lib/tic-types'
|
|
import {
|
|
BANKID_FLOW_ID_HEADER,
|
|
FLOW_VERIFIED_WINDOW_SECONDS,
|
|
FLOW_WINDOW_SECONDS,
|
|
clearBankIdFlowCookies,
|
|
isBankIdFlowMode,
|
|
readBankIdFlow,
|
|
setBankIdFlowCookies,
|
|
} from './lib/bankid-flow-cookie'
|
|
import type { CompanyLookupResult } from '@/lib/company-lookup/types'
|
|
import { hashPersonalNumber, encryptPersonalNumberForStorage } from '@/lib/auth/bankid'
|
|
import { requireAuth } from '@/lib/auth/require-auth'
|
|
import { createServiceClient } from '@/lib/supabase/server'
|
|
import { createLogger } from '@/lib/logger'
|
|
import type { SupabaseClient } from '@supabase/supabase-js'
|
|
import crypto from 'crypto'
|
|
|
|
const log = createLogger('tic/bankid')
|
|
|
|
/**
|
|
* Claim a BankID session, atomically and exactly once.
|
|
*
|
|
* The flow lives in a cookie now, so every tab of the browser shares one
|
|
* session and two of them can observe `status: complete` in the same poll tick.
|
|
* Both would call generateLink(), and the second magic link invalidates the
|
|
* first, so the tab the user is actually looking at may be the one that fails.
|
|
* Expiring the cookie on the way out does not prevent it: a Set-Cookie only
|
|
* applies once a response reaches the browser, and two requests that already
|
|
* carried the cookie both pass. The primary key is the only genuinely atomic
|
|
* thing available (serverless has no shared memory), so the loser of the race
|
|
* gets 23505 and stops before minting anything.
|
|
*
|
|
* Returns false when the session was already spent.
|
|
*/
|
|
async function consumeBankIdSession(
|
|
supabase: SupabaseClient,
|
|
sessionId: string
|
|
): Promise<boolean> {
|
|
const { error } = await supabase
|
|
.from('bankid_consumed_sessions')
|
|
.insert({ session_id: sessionId })
|
|
|
|
if (!error) return true
|
|
// 23505 unique_violation: another request got here first.
|
|
if (error.code === '23505') return false
|
|
|
|
// Anything else (table missing, connection lost) must fail closed: minting a
|
|
// second magic link is worse than making the user authenticate again.
|
|
log.error('could not claim bankid session; refusing to complete', {
|
|
code: error.code,
|
|
message: error.message,
|
|
})
|
|
return false
|
|
}
|
|
|
|
/**
|
|
* Request SPAR + CompanyRoles enrichment for a completed BankID session and
|
|
* cache the CompanyRoles slice in `bankid_enrichment` for the
|
|
* /select-company picker.
|
|
*
|
|
* Stored in `bankid_enrichment` (user-keyed) rather than `extension_data`
|
|
* because enrichment runs before the user has a company; `extension_data`
|
|
* has been company-scoped (NOT NULL company_id) since the multi-tenant
|
|
* refactor.
|
|
*
|
|
* SPAR (personnummer, address, name, birth date) is requested so TIC will
|
|
* complete the enrichment, but is intentionally NOT persisted: personnummer
|
|
* is already hashed + encrypted in `bankid_identities`, names live there too,
|
|
* and no UI currently consumes the address. Storing the SPAR blob alongside
|
|
* company roles would expose national-ID-level PII. If/when address pre-fill
|
|
* is built, encrypt the relevant fields the same way `encryptPersonalNumber`
|
|
* does for pnr.
|
|
*
|
|
* Non-blocking: any failure is logged and swallowed: BankID auth must still
|
|
* succeed even if enrichment is down.
|
|
*/
|
|
async function fetchAndStoreEnrichment(
|
|
sessionId: string,
|
|
userId: string,
|
|
supabase: SupabaseClient,
|
|
): Promise<void> {
|
|
try {
|
|
// Both 'SPAR' and 'CompanyRoles' are enabled on our TIC tenant as of
|
|
// 2026-05-06 (TIC ticket re. enrichment). Verify with:
|
|
// curl -H "X-Api-Key: $KEY" https://id.tic.io/api/v1/enrichment/types
|
|
//
|
|
// If a requested type is disabled on the tenant, TIC rejects the WHOLE
|
|
// enrichment with body field `error: 'Session not completed'` (HTTP 200,
|
|
// not a real HTTP error). The message is misleading: it does NOT mean
|
|
// the BankID session is incomplete. The hint mapping below catches it.
|
|
const enrichment = await requestEnrichment(sessionId, ['SPAR', 'CompanyRoles'])
|
|
log.info('enrichment request returned', {
|
|
status: enrichment.status,
|
|
requestedTypes: enrichment.requestedTypes,
|
|
completedTypes: enrichment.completedTypes,
|
|
hasSecureUrl: !!enrichment.secureUrl,
|
|
})
|
|
|
|
// Case-insensitive status comparison: TIC has been observed returning
|
|
// lowercase values ('completed', 'failed') in addition to the docs' canonical
|
|
// capitalized form. Accept both fully and partially completed runs.
|
|
const statusLower = String(enrichment.status ?? '').toLowerCase()
|
|
const isCompleted = statusLower === 'completed' || statusLower === 'partiallycompleted'
|
|
const usable = isCompleted && enrichment.secureUrl
|
|
if (!usable) {
|
|
// Log the full response shape (sans secureUrl, time-limited token)
|
|
// so we can diagnose why a real-user enrichment comes back non-usable.
|
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
|
const { secureUrl: _omit, ...responseDiagnostic } = enrichment
|
|
|
|
// Interpret common failure shapes into actionable hints so developers
|
|
// don't have to re-trace this every time. TIC returns these as body
|
|
// fields with HTTP 200, not as errors: see TIC_AUTH.md §enrichment.
|
|
const errField = (enrichment as { error?: string }).error ?? ''
|
|
let hint: string | undefined
|
|
if (errField === 'Session not completed') {
|
|
// Two distinct causes produce this identical error:
|
|
// 1. We requested a type not enabled on the tenant (most common,
|
|
// verify via GET /api/v1/enrichment/types)
|
|
// 2. The BankID session genuinely never went through the
|
|
// consent-to-enrich dialog
|
|
hint = 'Likely cause: a requested enrichment type is not enabled on the TIC tenant. Run `curl -H "X-Api-Key: $KEY" https://id.tic.io/api/v1/enrichment/types` to verify which types have `enabled: true` and adjust the requestEnrichment call to match.'
|
|
} else if (errField.toLowerCase().includes('not enabled')) {
|
|
hint = 'Enrichment explicitly disabled on TIC tenant: contact support@tic.io.'
|
|
} else if (errField.toLowerCase().includes('too old')) {
|
|
hint = '>30 min between auth completion and enrichment call: check for slow server-side work between /bankid/complete and fetchAndStoreEnrichment.'
|
|
}
|
|
|
|
log.warn('enrichment not usable', { ...responseDiagnostic, hint })
|
|
return
|
|
}
|
|
|
|
const enrichmentData = await fetchEnrichmentData(enrichment.secureUrl)
|
|
|
|
// Log a PII-free snapshot so we can debug the role filter in production.
|
|
// Raw personnummer / names / address values are deliberately omitted:
|
|
// only flat booleans and counts.
|
|
const firstRole = enrichmentData.companyRoles?.[0]
|
|
const spar = enrichmentData.spar
|
|
log.info('enrichment data shape', {
|
|
companyCount: enrichmentData.companyRoles?.length ?? 0,
|
|
firstRoleStatuses: firstRole
|
|
? {
|
|
companyStatus: firstRole.companyStatus,
|
|
positionEndIsNull: firstRole.positionEnd === null,
|
|
positionTypes: firstRole.positionTypes,
|
|
legalEntityType: firstRole.legalEntityType,
|
|
}
|
|
: null,
|
|
hasSpar: !!spar,
|
|
sparHasAddress: !!spar?.Folkbokforingsadress_SvenskAdress_Utdelningsadress1,
|
|
sparHasProtection: !!(spar?.Skydd_Sekretessmarkering || spar?.Skydd_SkyddadFolkbokforing),
|
|
})
|
|
|
|
// Persist only what consumers actually read. See block comment on
|
|
// fetchAndStoreEnrichment for why SPAR + personnummer + name are excluded.
|
|
const { error: upsertError } = await supabase
|
|
.from('bankid_enrichment')
|
|
.upsert({
|
|
user_id: userId,
|
|
company_roles: enrichmentData.companyRoles ?? [],
|
|
enriched_at_utc: enrichmentData.enrichedAtUtc ?? null,
|
|
}, { onConflict: 'user_id' })
|
|
|
|
if (upsertError) {
|
|
log.warn('enrichment upsert failed (non-blocking)', {
|
|
message: upsertError.message,
|
|
code: upsertError.code,
|
|
details: upsertError.details,
|
|
hint: upsertError.hint,
|
|
})
|
|
} else {
|
|
log.info('enrichment persisted to bankid_enrichment', {
|
|
roleCount: enrichmentData.companyRoles?.length ?? 0,
|
|
})
|
|
}
|
|
} catch (enrichError) {
|
|
log.warn('enrichment failed (non-blocking)', enrichError)
|
|
}
|
|
}
|
|
|
|
// Server-side per-IP rate limit for /bankid/start (each call = billable TIC session)
|
|
const bankIdStartCooldowns = new Map<string, number>()
|
|
const BANKID_START_COOLDOWN_MS = 5_000
|
|
|
|
/**
|
|
* Map a v2 `CompanyDocument` (financial-report subset) into the legacy
|
|
* `TICFinancialReportSummary` shape consumed by TicWorkspace. v2 nests
|
|
* the metadata under `financialReportMetadata` and replaces v1's
|
|
* `isAudited` boolean / `auditOpinion` string with auditor identity
|
|
* fields: we derive `isAudited` from the presence of an auditor.
|
|
*/
|
|
function toFinancialReportSummary(
|
|
doc: import('./lib/tic-types').TICDocument
|
|
): TICFinancialReportSummary {
|
|
const meta = doc.financialReportMetadata ?? {}
|
|
const hasAuditor = Boolean(meta.auditor || meta.auditorFullName || meta.auditCompanyName)
|
|
return {
|
|
title: doc.type === 'annualReport' ? 'Årsredovisning' : doc.type,
|
|
arrivalDate: meta.arrivalDate ?? undefined,
|
|
registrationDate: meta.registrationDate ?? undefined,
|
|
periodStart: meta.periodStart ?? undefined,
|
|
periodEnd: meta.periodEnd ?? undefined,
|
|
isInterimReport: meta.isInterimReport ?? undefined,
|
|
isConsolidatedAccounts: meta.isConsolidatedAccounts ?? undefined,
|
|
isAudited: hasAuditor ? true : undefined,
|
|
auditOpinion: meta.auditorFullName ?? meta.auditCompanyName ?? undefined,
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Translate any error from the TIC pipeline into a structured HTTP response.
|
|
*
|
|
* Status mapping:
|
|
* - NOT_CONFIGURED → 503 (proxy URL missing)
|
|
* - RATE_LIMIT_EXCEEDED → 429 (TIC quota hit)
|
|
* - TIMEOUT → 504 (TIC took longer than 15s)
|
|
* - upstream 4xx → 400 (TIC rejected the input: typically a malformed org number)
|
|
* - upstream 5xx → 502 (TIC outage)
|
|
* - other / unknown → 500
|
|
*
|
|
* Always logs the cleaned org number so we can correlate failures with input
|
|
* in Vercel logs.
|
|
*/
|
|
// Derive `{ startMonthDay, endMonthDay }` (e.g. "01-01" / "12-31") from the
|
|
// search doc's mostRecentFinancialSummary. periodStart/periodEnd are Unix
|
|
// timestamps in seconds. Returns null when the company has no closed period
|
|
// yet: the client's deriveFirstYearDefaults handles newly-registered
|
|
// companies from registrationDate instead.
|
|
function deriveFiscalYearMonthDay(
|
|
fin: { periodStart?: number; periodEnd?: number } | undefined,
|
|
): { startMonthDay: string | null; endMonthDay: string | null } | null {
|
|
if (!fin?.periodStart || !fin?.periodEnd) return null
|
|
const toMonthDay = (unixSeconds: number): string | null => {
|
|
const d = new Date(unixSeconds * 1000)
|
|
if (Number.isNaN(d.getTime())) return null
|
|
const mm = String(d.getUTCMonth() + 1).padStart(2, '0')
|
|
const dd = String(d.getUTCDate()).padStart(2, '0')
|
|
return `${mm}-${dd}`
|
|
}
|
|
const startMonthDay = toMonthDay(fin.periodStart)
|
|
const endMonthDay = toMonthDay(fin.periodEnd)
|
|
if (!startMonthDay && !endMonthDay) return null
|
|
return { startMonthDay, endMonthDay }
|
|
}
|
|
|
|
// The search doc's registrationDate is a Unix timestamp in seconds (same
|
|
// unit as periodStart/periodEnd above), but the app-facing contract
|
|
// (CompanyLookupResult / TICCompanyProfile) is a millisecond epoch:
|
|
// consumers feed it straight into `new Date()`. Skipping this conversion
|
|
// is how 2026 registrations rendered as "21 jan 1970" in onboarding.
|
|
function registrationDateToMs(unixSeconds: number | null | undefined): number | null {
|
|
if (unixSeconds == null || !Number.isFinite(unixSeconds)) return null
|
|
return unixSeconds * 1000
|
|
}
|
|
|
|
function handleTicError(
|
|
error: unknown,
|
|
log: { error: (msg: string, meta?: unknown) => void } | Console,
|
|
route: 'lookup' | 'profile',
|
|
orgNumber: string,
|
|
fallbackMessage: string
|
|
): Response {
|
|
if (error instanceof TICAPIError) {
|
|
const meta = {
|
|
route,
|
|
orgNumber,
|
|
message: error.message,
|
|
statusCode: error.statusCode,
|
|
code: error.code,
|
|
}
|
|
|
|
if (error.code === 'NOT_CONFIGURED') {
|
|
log.error(`[tic] ${route}: not configured`, meta)
|
|
return NextResponse.json({ error: 'TIC is not configured' }, { status: 503 })
|
|
}
|
|
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
log.error(`[tic] ${route}: rate limit exceeded`, meta)
|
|
return NextResponse.json({ error: 'Rate limit exceeded, try again later' }, { status: 429 })
|
|
}
|
|
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error(`[tic] ${route}: upstream timeout`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service did not respond in time' },
|
|
{ status: 504 }
|
|
)
|
|
}
|
|
|
|
// Upstream returned a non-OK status we surfaced as a TICAPIError
|
|
if (typeof error.statusCode === 'number') {
|
|
if (error.statusCode >= 400 && error.statusCode < 500) {
|
|
log.error(`[tic] ${route}: upstream rejected request`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'Invalid request to TIC (upstream rejected)' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
if (error.statusCode >= 500) {
|
|
log.error(`[tic] ${route}: upstream error`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
}
|
|
|
|
// Network/DNS/parse failure surfaced as a TICAPIError without code or statusCode
|
|
log.error(`[tic] ${route}: upstream failure`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
|
|
log.error(`[tic] ${route}: unexpected error`, {
|
|
route,
|
|
orgNumber,
|
|
error: error instanceof Error ? { name: error.name, message: error.message, stack: error.stack } : String(error),
|
|
})
|
|
return NextResponse.json({ error: fallbackMessage }, { status: 500 })
|
|
}
|
|
|
|
export const ticExtension: Extension = {
|
|
id: 'tic',
|
|
name: 'Bolagsuppgifter',
|
|
version: '1.0.0',
|
|
sector: 'general',
|
|
|
|
apiRoutes: [
|
|
{
|
|
method: 'GET',
|
|
path: '/lookup',
|
|
// Used during onboarding (Step2CompanyDetails debounced lookup + the
|
|
// BankID picker): user is authenticated but does not yet have a
|
|
// company. Must not require a company context.
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request, ctx?) => {
|
|
const log = ctx?.log ?? console
|
|
const url = new URL(request.url)
|
|
const orgNumber = url.searchParams.get('org_number')
|
|
|
|
if (!orgNumber) {
|
|
return NextResponse.json(
|
|
{ error: 'org_number query parameter is required' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const cleanedOrgNumber = orgNumber.replace(/[\s-]/g, '')
|
|
|
|
try {
|
|
// Single Lens call: the search-public document already includes
|
|
// sniCodes, bankAccounts, emailAddresses, phoneNumbers, and the
|
|
// registration flags at the top level: we used to fan out to
|
|
// five dedicated endpoints for the same data (6 calls total) and
|
|
// the 3 000/mo TIC budget couldn't sustain it. This endpoint now
|
|
// costs ~1 call. Fiscal-year MM-DD is derived from
|
|
// mostRecentFinancialSummary.periodStart/periodEnd when present;
|
|
// newly-registered companies without a financial summary return
|
|
// fiscalYear: null and the client-side first-year derivation
|
|
// takes over (see deriveFirstYearDefaults).
|
|
const doc = await searchCompanyByOrgNumber(orgNumber)
|
|
|
|
if (!doc) {
|
|
return NextResponse.json(
|
|
{ error: 'Company not found' },
|
|
{ status: 404 }
|
|
)
|
|
}
|
|
|
|
const nameEntry =
|
|
doc.names.find((n) => n.companyNamingType === 'name') ?? doc.names[0]
|
|
const companyName = nameEntry?.nameOrIdentifier ?? ''
|
|
|
|
const isCeased = doc.isCeased ?? doc.activityStatus === 'isNoLongerActive'
|
|
|
|
const address = doc.mostRecentRegisteredAddress
|
|
? {
|
|
street: doc.mostRecentRegisteredAddress.streetAddress ?? null,
|
|
postalCode: doc.mostRecentRegisteredAddress.postalCode ?? null,
|
|
city: doc.mostRecentRegisteredAddress.city ?? null,
|
|
}
|
|
: null
|
|
|
|
const registration = {
|
|
fTax: doc.isRegisteredForFTax ?? false,
|
|
vat: doc.isRegisteredForVAT ?? false,
|
|
}
|
|
|
|
const bankAccounts = (doc.bankAccounts ?? [])
|
|
.filter((ba) => ba.accountNumber != null && ba.bankAccountType === 'bankgiro')
|
|
.map((ba) => ({
|
|
type: 'bankgiro',
|
|
accountNumber: String(ba.accountNumber),
|
|
bic: null,
|
|
}))
|
|
|
|
// Search-doc shape is `{ rank, sni_2007Code, sni_2007Name, ... }`;
|
|
// map to the canonical { code, name } the rest of the app expects.
|
|
const sniCodes = (doc.sniCodes ?? [])
|
|
.filter((s) => s.sni_2007Code)
|
|
.map((s) => ({
|
|
code: s.sni_2007Code ?? '',
|
|
name: s.sni_2007Name ?? '',
|
|
}))
|
|
|
|
const email = doc.emailAddresses?.[0]?.emailAddress ?? null
|
|
|
|
const phone =
|
|
doc.phoneNumbers?.[0]?.phoneNumberFormatted
|
|
?? doc.phoneNumbers?.[0]?.e164PhoneNumber
|
|
?? null
|
|
|
|
const fiscalYear = deriveFiscalYearMonthDay(doc.mostRecentFinancialSummary)
|
|
|
|
const result: CompanyLookupResult = {
|
|
companyName,
|
|
isCeased,
|
|
address,
|
|
registration,
|
|
bankAccounts,
|
|
email,
|
|
phone,
|
|
sniCodes,
|
|
fiscalYear,
|
|
legalEntityType: doc.legalEntityType ?? null,
|
|
registrationDate: registrationDateToMs(doc.registrationDate),
|
|
}
|
|
|
|
return NextResponse.json({ data: result })
|
|
} catch (error) {
|
|
return handleTicError(error, log, 'lookup', cleanedOrgNumber, 'Failed to look up company')
|
|
}
|
|
},
|
|
},
|
|
{
|
|
method: 'GET',
|
|
path: '/profile',
|
|
// Used during onboarding to render richer company profile details:
|
|
// user is authenticated but may not yet have a company. See /lookup.
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request, ctx?) => {
|
|
const log = ctx?.log ?? console
|
|
const url = new URL(request.url)
|
|
const orgNumber = url.searchParams.get('org_number')
|
|
|
|
if (!orgNumber) {
|
|
return NextResponse.json(
|
|
{ error: 'org_number query parameter is required' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const cleanedOrgNumber = orgNumber.replace(/[\s-]/g, '')
|
|
|
|
try {
|
|
const doc = await searchCompanyByOrgNumber(orgNumber)
|
|
|
|
if (!doc) {
|
|
return NextResponse.json(
|
|
{ error: 'Company not found' },
|
|
{ status: 404 }
|
|
)
|
|
}
|
|
|
|
const nameEntry =
|
|
doc.names.find((n) => n.companyNamingType === 'name') ?? doc.names[0]
|
|
const companyName = nameEntry?.nameOrIdentifier ?? ''
|
|
const companyId = doc.companyId
|
|
|
|
// Phase 2: ONLY data not already present at the top level of the
|
|
// search doc. We dropped bank-accounts, industries, email-addresses,
|
|
// phone-numbers, purposes, and signatory: those duplicate the
|
|
// search-doc fields and were burning 6 Lens calls per /profile
|
|
// for nothing. Per-/profile cost: 13 → 7 calls.
|
|
const [
|
|
documentsResult,
|
|
fiscalYearResult,
|
|
payrollsResult,
|
|
representativesResult,
|
|
statusResult,
|
|
beneficialOwnersResult,
|
|
] = await Promise.allSettled([
|
|
getCompanyDocuments(companyId),
|
|
getFiscalYears(companyId),
|
|
getPayrolls(companyId),
|
|
getRepresentatives(companyId),
|
|
getCompanyStatus(companyId),
|
|
getBeneficialOwners(companyId),
|
|
])
|
|
|
|
// Bankgiro list from search-doc (v2 `bankAccounts` array with
|
|
// `{accountNumber, bankAccountType}`).
|
|
const bankAccounts = (doc.bankAccounts ?? [])
|
|
.filter((ba) => ba.accountNumber != null && ba.bankAccountType === 'bankgiro')
|
|
.map((ba) => ({
|
|
type: 'bankgiro',
|
|
accountNumber: String(ba.accountNumber),
|
|
bic: null,
|
|
}))
|
|
|
|
// SNI codes from search-doc (`sniCodes` array with `sni_2007Code`).
|
|
const sniCodes = (doc.sniCodes ?? [])
|
|
.filter((s) => s.sni_2007Code)
|
|
.map((s) => ({
|
|
code: s.sni_2007Code ?? '',
|
|
name: s.sni_2007Name ?? '',
|
|
}))
|
|
|
|
const email = doc.emailAddresses?.[0]?.emailAddress ?? null
|
|
|
|
const phone =
|
|
doc.phoneNumbers?.[0]?.phoneNumberFormatted
|
|
?? doc.phoneNumbers?.[0]?.e164PhoneNumber
|
|
?? null
|
|
|
|
// v2 `/companies/{id}/documents` returns every document the
|
|
// company has filed; filter to annualReport rows and map into
|
|
// the legacy summary shape the workspace expects. Kept as a
|
|
// dedicated call: doc.documents has a different shape
|
|
// (`companyDocumentType` vs `type`) so direct substitution
|
|
// would silently drop annualReport detection.
|
|
const financialReports =
|
|
documentsResult.status === 'fulfilled' && documentsResult.value
|
|
? documentsResult.value
|
|
.filter((d) => d.type === 'annualReport')
|
|
.map(toFinancialReportSummary)
|
|
: []
|
|
|
|
// Purpose: take `doc.mostRecentPurpose` directly. Dropped the
|
|
// /purposes call (which sorted history descending and picked
|
|
// the latest non-empty entry): the search doc's
|
|
// mostRecentPurpose is the same most-recently-registered string.
|
|
const purpose = doc.mostRecentPurpose ?? null
|
|
|
|
// ── New v2 sections ─────────────────────────────────────────
|
|
// Fiscal years: pick most-recently-updated row with both
|
|
// start and end populated, plus a deduped history of distinct
|
|
// start/end pairs sorted newest first.
|
|
const fiscalYearRows =
|
|
fiscalYearResult.status === 'fulfilled' && fiscalYearResult.value
|
|
? [...fiscalYearResult.value].sort((a, b) =>
|
|
(b.lastUpdatedAtUtc ?? '').localeCompare(a.lastUpdatedAtUtc ?? '')
|
|
)
|
|
: []
|
|
const fiscalYearCurrent = fiscalYearRows.find(
|
|
(fy) => fy.startMonthDay && fy.endMonthDay
|
|
)
|
|
const fiscalYear = fiscalYearCurrent
|
|
? {
|
|
startMonthDay: fiscalYearCurrent.startMonthDay ?? null,
|
|
endMonthDay: fiscalYearCurrent.endMonthDay ?? null,
|
|
description: fiscalYearCurrent.startEndDescription ?? null,
|
|
}
|
|
: null
|
|
|
|
const fiscalYearHistorySeen = new Set<string>()
|
|
const fiscalYearHistory: import('./lib/tic-types').TICProfileFiscalYear[] = []
|
|
for (const fy of fiscalYearRows) {
|
|
if (!fy.startMonthDay && !fy.endMonthDay) continue
|
|
const key = `${fy.startMonthDay ?? ''}|${fy.endMonthDay ?? ''}`
|
|
if (fiscalYearHistorySeen.has(key)) continue
|
|
fiscalYearHistorySeen.add(key)
|
|
fiscalYearHistory.push({
|
|
startMonthDay: fy.startMonthDay ?? null,
|
|
endMonthDay: fy.endMonthDay ?? null,
|
|
description: fy.startEndDescription ?? null,
|
|
})
|
|
}
|
|
|
|
// Signatory: free-form firmateckning descriptions. v2 search doc
|
|
// exposes `mostRecentSignatory` directly (single entry). Drops the
|
|
// dedicated /signatory call: historical signatory entries are rare
|
|
// to use in onboarding and the current entry is what the review
|
|
// card surfaces.
|
|
const signatory = (() => {
|
|
const desc = doc.mostRecentSignatory?.signatureDescription?.trim()
|
|
return desc ? [{ description: desc }] : []
|
|
})()
|
|
|
|
// Board summary: most recently updated row from
|
|
// representativeInformation
|
|
const reprInfoRows =
|
|
representativesResult.status === 'fulfilled' && representativesResult.value?.representativeInformation
|
|
? [...representativesResult.value.representativeInformation].sort((a, b) =>
|
|
(b.lastUpdatedAtUtc ?? '').localeCompare(a.lastUpdatedAtUtc ?? '')
|
|
)
|
|
: []
|
|
const reprInfo = reprInfoRows[0]
|
|
const board = reprInfo
|
|
? {
|
|
numberOfBoardMembers: reprInfo.numberOfBoardMembers ?? null,
|
|
numberOfDeputyBoardMembers: reprInfo.numberOfDeputyBoardMembers ?? null,
|
|
hasVacancy: reprInfo.hasVacancy ?? null,
|
|
missingCEODate: reprInfo.missingCEODate ?? null,
|
|
missingAuditor: reprInfo.missingAuditor ?? null,
|
|
lastChangeDate: reprInfo.lastChangeDate ?? null,
|
|
}
|
|
: null
|
|
|
|
// Representatives: filter to currently-active positions
|
|
// (positionEnd null or in the future) sorted by start date desc
|
|
const nowIso = new Date().toISOString()
|
|
const representatives =
|
|
representativesResult.status === 'fulfilled' && representativesResult.value?.representatives
|
|
? representativesResult.value.representatives
|
|
.filter((p) => !p.positionEnd || p.positionEnd > nowIso)
|
|
.sort((a, b) => (b.positionStart ?? '').localeCompare(a.positionStart ?? ''))
|
|
.map((p) => ({
|
|
name: p.roleByPersonName ?? null,
|
|
positionType: p.positionType ?? null,
|
|
positionDescription: p.positionDescription ?? null,
|
|
positionStart: p.positionStart ?? null,
|
|
positionEnd: p.positionEnd ?? null,
|
|
}))
|
|
: []
|
|
|
|
// Payrolls: map the modern payroll2 array, newest first
|
|
const payrolls =
|
|
payrollsResult.status === 'fulfilled' && payrollsResult.value?.payroll2
|
|
? [...payrollsResult.value.payroll2]
|
|
.sort((a, b) => (b.periodEnd ?? '').localeCompare(a.periodEnd ?? ''))
|
|
.map((p) => ({
|
|
periodStart: p.periodStart ?? null,
|
|
periodEnd: p.periodEnd ?? null,
|
|
numberOfEmployees: p.numberOfEmployees ?? null,
|
|
sumPayrollTax: p.sumPayrollTax ?? null,
|
|
calculatedPersonnelCosts: p.calculatedPersonnelCosts ?? null,
|
|
personnelCostsInAnnualReport: p.personnelCostsInAnnualReport ?? null,
|
|
deviation: p.deviation ?? null,
|
|
numberOfLateFeesForPeriod: p.numberOfLateFeesForPeriod ?? null,
|
|
}))
|
|
: []
|
|
|
|
// Statuses: most recent first; map traffic-light color through
|
|
// unchanged so the UI can render a badge.
|
|
const statuses: import('./lib/tic-types').TICProfileStatus[] =
|
|
statusResult.status === 'fulfilled' && statusResult.value
|
|
? [...statusResult.value]
|
|
.sort((a, b) => (b.statusDate ?? '').localeCompare(a.statusDate ?? ''))
|
|
.map((s) => {
|
|
const color = s.statusColor
|
|
const validColor: 'red' | 'yellow' | 'green' | 'neutral' | null =
|
|
color === 'red' || color === 'yellow' || color === 'green' || color === 'neutral'
|
|
? color
|
|
: null
|
|
return {
|
|
code: s.companyStatusDescription?.code ?? null,
|
|
description:
|
|
s.companyStatusDescription?.name_SE
|
|
?? s.statusDescription
|
|
?? s.companyStatusDescription?.name_EN
|
|
?? null,
|
|
color: validColor,
|
|
statusDate: s.statusDate ?? null,
|
|
isCeased: s.companyStatusDescription?.isCeased ?? null,
|
|
}
|
|
})
|
|
: []
|
|
|
|
// Log Phase 2 failures
|
|
if (documentsResult.status === 'rejected') {
|
|
log.warn('[tic] profile: documents fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(documentsResult.reason) })
|
|
}
|
|
if (fiscalYearResult.status === 'rejected') {
|
|
log.warn('[tic] profile: fiscal years fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(fiscalYearResult.reason) })
|
|
}
|
|
if (payrollsResult.status === 'rejected') {
|
|
log.warn('[tic] profile: payrolls fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(payrollsResult.reason) })
|
|
}
|
|
if (representativesResult.status === 'rejected') {
|
|
log.warn('[tic] profile: representatives fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(representativesResult.reason) })
|
|
}
|
|
if (statusResult.status === 'rejected') {
|
|
log.warn('[tic] profile: status fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(statusResult.reason) })
|
|
}
|
|
if (beneficialOwnersResult.status === 'rejected') {
|
|
log.warn('[tic] profile: beneficial-owners fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(beneficialOwnersResult.reason) })
|
|
}
|
|
|
|
// Flatten the beneficial-owners response. Bolagsverket returns one
|
|
// notification per registration event; the latest active
|
|
// notification's owners are the current ones. v2 returns the
|
|
// notifications as a top-level array (v1's wrapper with
|
|
// `.notifications` / `.exempts` is gone). Personnummer is
|
|
// intentionally excluded: PII we don't need cached and we
|
|
// don't want it persisted on `companies.tic_snapshot`.
|
|
let beneficialOwners: TICCompanyProfile['beneficialOwners'] = []
|
|
if (beneficialOwnersResult.status === 'fulfilled' && beneficialOwnersResult.value) {
|
|
const notifications = Array.isArray(beneficialOwnersResult.value)
|
|
? beneficialOwnersResult.value
|
|
: []
|
|
// Prefer the latest notification by notificationDate (already
|
|
// sorted descending in practice, but we sort defensively).
|
|
const latest = [...notifications]
|
|
.filter((n) => n && Array.isArray(n.bolagsverket_BeneficialOwner))
|
|
.sort((a, b) => {
|
|
const ad = a.notificationDate ?? ''
|
|
const bd = b.notificationDate ?? ''
|
|
return bd.localeCompare(ad)
|
|
})[0]
|
|
if (latest?.bolagsverket_BeneficialOwner) {
|
|
beneficialOwners = latest.bolagsverket_BeneficialOwner
|
|
.map((o) => {
|
|
const nameParts = [o.firstName, o.middleName, o.lastName]
|
|
.map((p) => (p ?? '').trim())
|
|
.filter((p) => p.length > 0)
|
|
const name = nameParts.length > 0 ? nameParts.join(' ') : (o.fallbackName ?? '').trim()
|
|
if (!name) return null
|
|
return {
|
|
name,
|
|
extentCode: o.extentCode ?? null,
|
|
extentDescription: o.extentDescription ?? null,
|
|
citizenshipCountryCode: o.citizenshipCountryCode ?? null,
|
|
countryOfResidenceCode: o.countryOfResidenceCode ?? null,
|
|
registeredAt: latest.fromDate ?? latest.notificationDate ?? null,
|
|
}
|
|
})
|
|
.filter((o): o is NonNullable<typeof o> => o !== null)
|
|
}
|
|
}
|
|
|
|
const fin = doc.mostRecentFinancialSummary
|
|
const financials = fin
|
|
? {
|
|
periodStart: fin.periodStart,
|
|
periodEnd: fin.periodEnd,
|
|
netSalesK: fin.rs_NetSalesK ?? null,
|
|
operatingProfitK: fin.rs_OperatingProfitOrLossK ?? null,
|
|
totalAssetsK: fin.bs_TotalAssetsK ?? null,
|
|
numberOfEmployees: fin.fn_NumberOfEmployees ?? null,
|
|
operatingMargin: fin.km_OperatingMargin ?? null,
|
|
netProfitMargin: fin.km_NetProfitMargin ?? null,
|
|
equityAssetsRatio: fin.km_EquityAssetsRatio ?? null,
|
|
}
|
|
: null
|
|
|
|
// Translate v2's activityStatus enum into the v1 string the
|
|
// TicWorkspace `!== 'ceased'` check still compares against, so
|
|
// the UI keeps showing "Avregistrerat" for deregistered
|
|
// companies without UI changes.
|
|
const isCeasedProfile = doc.isCeased ?? doc.activityStatus === 'isNoLongerActive'
|
|
const profile: TICCompanyProfile = {
|
|
companyId,
|
|
orgNumber: doc.registrationNumber,
|
|
companyName,
|
|
legalEntityType: doc.legalEntityType,
|
|
registrationDate: registrationDateToMs(doc.registrationDate) ?? 0,
|
|
activityStatus: isCeasedProfile ? 'ceased' : (doc.activityStatus ?? null),
|
|
purpose,
|
|
address: doc.mostRecentRegisteredAddress
|
|
? {
|
|
street: doc.mostRecentRegisteredAddress.streetAddress ?? null,
|
|
postalCode: doc.mostRecentRegisteredAddress.postalCode ?? null,
|
|
city: doc.mostRecentRegisteredAddress.city ?? null,
|
|
}
|
|
: null,
|
|
registration: {
|
|
fTax: doc.isRegisteredForFTax ?? false,
|
|
vat: doc.isRegisteredForVAT ?? false,
|
|
payroll: doc.isRegisteredForPayroll ?? false,
|
|
},
|
|
sector: doc.cSector
|
|
? { code: doc.cSector.categoryCode, description: doc.cSector.categoryCodeDescription }
|
|
: null,
|
|
employeeRange: doc.cNbrEmployeesInterval?.categoryCodeDescription ?? null,
|
|
turnoverRange: doc.cTurnoverInterval?.categoryCodeDescription ?? null,
|
|
email,
|
|
phone,
|
|
sniCodes,
|
|
bankAccounts,
|
|
beneficialOwners,
|
|
financials,
|
|
financialReports,
|
|
fiscalYear,
|
|
fiscalYearHistory,
|
|
signatory,
|
|
board,
|
|
representatives,
|
|
payrolls,
|
|
statuses,
|
|
fetchedAt: new Date().toISOString(),
|
|
}
|
|
|
|
return NextResponse.json({ data: profile })
|
|
} catch (error) {
|
|
return handleTicError(error, log, 'profile', cleanedOrgNumber, 'Failed to fetch company profile')
|
|
}
|
|
},
|
|
},
|
|
// ── BankID Authentication ──────────────────────────────────────
|
|
// Routes for BankID login/signup via TIC Identity API.
|
|
// skipAuth: true on auth routes (user has no Supabase session yet).
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/start',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const ip = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
|
|
|| request.headers.get('x-real-ip')
|
|
|| '127.0.0.1'
|
|
|
|
// The flow a session is opened for is fixed here and read back at
|
|
// /complete, so a 'link' session can never be finished as a 'login'.
|
|
// Validated before the rate limit: a malformed request starts no
|
|
// billable session, so it should not spend the caller's cooldown and
|
|
// lock them out of the retry that would have worked.
|
|
const body = await request.json().catch(() => ({}))
|
|
const mode = body?.mode
|
|
if (!isBankIdFlowMode(mode)) {
|
|
return NextResponse.json({ error: 'mode is required' }, { status: 400 })
|
|
}
|
|
|
|
// A link flow is owned by the user who opened it. /bankid/link binds
|
|
// the personnummer to whoever is authenticated when it runs, so an
|
|
// unowned link flow left behind in a shared browser would let the
|
|
// next person to sign in pick it up and bind the FIRST person's
|
|
// identity to their own account. Login and signup have no user yet
|
|
// and stay anonymous.
|
|
let userId: string | undefined
|
|
if (mode === 'link') {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
userId = auth.user.id
|
|
}
|
|
|
|
// Per-IP rate limit (each start = billable TIC session)
|
|
const now = Date.now()
|
|
const lastStart = bankIdStartCooldowns.get(ip) ?? 0
|
|
if (now - lastStart < BANKID_START_COOLDOWN_MS) {
|
|
return NextResponse.json({ error: 'Too many requests' }, { status: 429 })
|
|
}
|
|
bankIdStartCooldowns.set(ip, now)
|
|
|
|
// Prevent map from growing unbounded
|
|
if (bankIdStartCooldowns.size > 10_000) {
|
|
const cutoff = now - BANKID_START_COOLDOWN_MS
|
|
for (const [k, v] of bankIdStartCooldowns) {
|
|
if (v < cutoff) bankIdStartCooldowns.delete(k)
|
|
}
|
|
}
|
|
|
|
const userAgent = request.headers.get('user-agent') || undefined
|
|
const session = await startBankIdAuth(ip, userAgent)
|
|
const flowId = crypto.randomUUID()
|
|
|
|
// sessionId is deliberately NOT in the response. It is a bearer
|
|
// credential for the holder's personnummer and for a Supabase
|
|
// session; it goes into the signed HttpOnly cookie instead, and the
|
|
// client drives the flow without ever seeing it.
|
|
const response = NextResponse.json({
|
|
data: {
|
|
flowId,
|
|
autoStartToken: session.autoStartToken,
|
|
qrStartToken: session.qrStartToken,
|
|
qrStartSecret: session.qrStartSecret,
|
|
},
|
|
})
|
|
await setBankIdFlowCookies(response, {
|
|
version: 1,
|
|
sessionId: session.sessionId,
|
|
flowId,
|
|
mode,
|
|
userId,
|
|
startedAt: Date.now(),
|
|
expiresAt: Date.now() + FLOW_WINDOW_SECONDS * 1000,
|
|
})
|
|
return response
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
if (error.code === 'NOT_CONFIGURED') {
|
|
return NextResponse.json({ error: 'not_configured', message: 'BankID is not configured' }, { status: 503 })
|
|
}
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
return NextResponse.json({ error: 'rate_limit', message: 'Rate limit exceeded' }, { status: 429 })
|
|
}
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error('start timed out: TIC Identity API unreachable', { statusCode: error.statusCode })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is not responding' }, { status: 503 })
|
|
}
|
|
// TIC API returned an error (e.g. 5xx)
|
|
log.error('start failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' }, { status: 502 })
|
|
}
|
|
log.error('start failed: unexpected error', error)
|
|
return NextResponse.json({ error: 'internal_error', message: 'Failed to start BankID session' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/poll',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow) {
|
|
// No live flow in this browser: the tab is polling something that
|
|
// has finished, expired, or never belonged to it. Terminal, not an
|
|
// error, so the client can settle instead of spinning.
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
// The caller says which mode it is showing, and a flow only answers
|
|
// to its own. Without this a login session started on /login is
|
|
// picked up by the signup panel (or the reverse) whenever the user
|
|
// navigates between them. Deliberately NOT clearing: the flow is
|
|
// still legitimate for the page that started it.
|
|
const pollBody = await request.json().catch(() => ({}))
|
|
if (!isBankIdFlowMode(pollBody?.mode) || pollBody.mode !== flow.mode) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
const isProbe = pollBody?.probe === true
|
|
|
|
// The cookie is shared by every tab. A newer same-mode /start can
|
|
// replace it while an older tab is still polling, so mode alone is
|
|
// not enough: without the flow id, that stale tab would silently
|
|
// follow and complete the newer person's identification. A mount
|
|
// probe has no id yet and may discover it, but every active poll must
|
|
// present the id returned by /start or by that probe.
|
|
if (!isProbe && request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
let result: Awaited<ReturnType<typeof pollBankIdSession>>
|
|
try {
|
|
result = await pollBankIdSession(flow.sessionId)
|
|
} catch (error) {
|
|
// TIC no longer knows this session (404), or answered 410 for an
|
|
// expired one. Report it as no_session so the client settles
|
|
// instead of counting it as a service outage.
|
|
//
|
|
// Deliberately does NOT clear the cookie. A clearing Set-Cookie is
|
|
// untargeted: a slow response about a dead session would delete
|
|
// whatever flow is in the jar by the time it lands, including one
|
|
// the user has just started in another tab. The stale cookie is
|
|
// harmless (it answers no_session again and expires on its own),
|
|
// whereas deleting a live flow costs a billable session.
|
|
if (error instanceof TICAPIError && (error.statusCode === 404 || error.statusCode === 410)) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
throw error
|
|
}
|
|
|
|
// An expired-session body comes back with no `status` at all
|
|
// (identityFetch returns a 410 body verbatim). Same treatment.
|
|
if (!result?.status) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
if (result.status !== 'pending') {
|
|
log.info('poll status', { status: result.status, hintCode: result.hintCode, hasUser: !!result.user?.personalNumber })
|
|
}
|
|
|
|
// Whitelist the fields the UI renders. The raw TIC payload carries
|
|
// user.personalNumber, which the client has never used and must
|
|
// never receive: this endpoint is skipAuth, so anything it returns
|
|
// is readable by whoever holds the flow cookie.
|
|
//
|
|
// The name (givenName/surname) is withheld from a PROBE. A probe runs
|
|
// before the person here has confirmed the flow is theirs, so
|
|
// returning the name would hand a stranger's identity to whoever
|
|
// opened the page on a shared machine, defeating the confirm card.
|
|
// The signup e-mail step needs the name, but it is reached only
|
|
// through the active poll loop (no probe mode), which does get it.
|
|
const response = NextResponse.json({
|
|
data: {
|
|
flowId: isProbe ? flow.flowId : undefined,
|
|
status: result.status,
|
|
message: result.message,
|
|
hintCode: result.hintCode,
|
|
qrStartToken: result.qrStartToken,
|
|
qrStartSecret: result.qrStartSecret,
|
|
user: !isProbe && result.user
|
|
? { givenName: result.user.givenName, surname: result.user.surname }
|
|
: undefined,
|
|
},
|
|
})
|
|
|
|
// A failed or cancelled order is over. Not cleared here for the same
|
|
// reason as the dead-session branch above: the Set-Cookie cannot be
|
|
// aimed at one flow, so a late response would delete a newer one.
|
|
// The client settles on this status, and the cookie expires.
|
|
if (result.status === 'complete') {
|
|
// Identification is done; what remains is the signup e-mail step,
|
|
// which is a person typing. Re-issue with the longer window so a
|
|
// user hunting for the right address does not have the session
|
|
// expire under them: on the old client-state design this step was
|
|
// bounded only by TIC's own retention.
|
|
await setBankIdFlowCookies(response, {
|
|
...flow,
|
|
expiresAt: Date.now() + FLOW_VERIFIED_WINDOW_SECONDS * 1000,
|
|
})
|
|
}
|
|
return response
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
return NextResponse.json({ error: 'rate_limit', message: 'Rate limit exceeded' }, { status: 429 })
|
|
}
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error('poll timed out: TIC Identity API unreachable')
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is not responding' }, { status: 503 })
|
|
}
|
|
log.error('poll failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' }, { status: 502 })
|
|
}
|
|
log.error('poll failed: unexpected error', error)
|
|
return NextResponse.json({ error: 'internal_error', message: 'Failed to poll BankID session' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/complete',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
// Session id and mode come from the signed cookie, never the body:
|
|
// a caller who could name both could complete any session it had
|
|
// seen, in whatever flow suited it.
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
const { sessionId, mode } = flow
|
|
|
|
// The shared cookie may have been replaced by a newer flow after
|
|
// this tab started. Only the tab that started or explicitly resumed
|
|
// the current flow may complete it.
|
|
if (request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
if (mode === 'link') {
|
|
// Linking runs on the authenticated /bankid/link route, which
|
|
// proves who is being linked. Completing a link flow here would
|
|
// create or sign in an account off a session opened for something
|
|
// else entirely.
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const body = await request.json().catch(() => ({}))
|
|
const trimmedEmail = typeof body?.email === 'string'
|
|
? body.email.trim().toLowerCase()
|
|
: undefined
|
|
|
|
if (mode === 'signup' && !trimmedEmail) {
|
|
return NextResponse.json(
|
|
{ error: 'email is required for signup' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
/**
|
|
* Every exit from here clears the flow, so a session is usable
|
|
* exactly once. Two tabs that both observe completion cannot both
|
|
* mint a magic link: the second finds no cookie and gets
|
|
* session_invalid, instead of a generateLink that silently
|
|
* invalidates the first tab's link and breaks the sign-in.
|
|
*/
|
|
const settle = (response: NextResponse): NextResponse => {
|
|
clearBankIdFlowCookies(response)
|
|
return response
|
|
}
|
|
|
|
// Verify BankID session is complete. The message surfaces directly
|
|
// in the register-page toast, so it must be Swedish.
|
|
const session = await collectBankIdResult(sessionId)
|
|
if (session.status !== 'complete' || !session.user) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { personalNumber, givenName, surname, name } = session.user
|
|
const pnrHash = hashPersonalNumber(personalNumber)
|
|
const supabase = createServiceClient()
|
|
|
|
// Look up existing BankID identity
|
|
const { data: existing } = await supabase
|
|
.from('bankid_identities')
|
|
.select('user_id')
|
|
.eq('personal_number_hash', pnrHash)
|
|
.single()
|
|
|
|
if (mode === 'login') {
|
|
if (!existing) {
|
|
// Terminal for a login flow: the user is sent to signup, which
|
|
// starts its own session.
|
|
return settle(NextResponse.json({
|
|
error: 'no_account',
|
|
givenName,
|
|
surname,
|
|
}, { status: 404 }))
|
|
}
|
|
|
|
// Returning user: generate magic link
|
|
const { data: userData } = await supabase.auth.admin.getUserById(existing.user_id)
|
|
if (!userData?.user?.email) {
|
|
// Data problem, not a transient one: an identity with no user
|
|
// email will never complete. settle() so it is not re-offered as
|
|
// a resumable flow on the next page load.
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'User account not found' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Claim the session BEFORE minting anything. Two tabs sharing this
|
|
// browser's flow cookie can both arrive here; only one may mint,
|
|
// because the second magic link invalidates the first.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { data: link, error: linkError } = await supabase.auth.admin.generateLink({
|
|
type: 'magiclink',
|
|
email: userData.user.email,
|
|
})
|
|
|
|
if (linkError || !link?.properties?.hashed_token) {
|
|
log.error('generateLink failed for login', { message: linkError?.message, code: linkError?.code })
|
|
// The session is already consumed, so a retry would fail with
|
|
// session_invalid anyway; settle() clears the cookie now instead
|
|
// of leaving a spent flow to be re-offered as resumable.
|
|
return settle(NextResponse.json(
|
|
{ error: 'Failed to create session' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Refresh enrichment so /select-company sees current Bolagsverket roles.
|
|
await fetchAndStoreEnrichment(sessionId, existing.user_id, supabase)
|
|
|
|
// settle(): the magic link is minted, so the flow is spent. A
|
|
// second tab reaching here would mint another and invalidate this
|
|
// one; it now gets session_invalid instead.
|
|
return settle(NextResponse.json({
|
|
data: {
|
|
tokenHash: link.properties.hashed_token,
|
|
type: 'magiclink',
|
|
isNewUser: false,
|
|
},
|
|
}))
|
|
}
|
|
|
|
// mode === 'signup'
|
|
if (existing) {
|
|
// Terminal: this BankID already has an account, so the answer is
|
|
// to sign in, not to retry this session.
|
|
return settle(NextResponse.json(
|
|
{ error: 'already_linked', message: 'This BankID is already linked to an account' },
|
|
{ status: 409 }
|
|
))
|
|
}
|
|
|
|
// Create new Supabase user. Email uniqueness is checked by createUser
|
|
// itself against auth.users: do NOT pre-check profiles.email instead.
|
|
// The profile mirror can lack the address while the auth row still
|
|
// holds it (anonymize_user_account scrubs profiles.email but keeps the
|
|
// auth tombstone), which used to fall through to a dead-end 500 here.
|
|
const randomPassword = crypto.randomBytes(32).toString('base64url')
|
|
const { data: newUser, error: createError } = await supabase.auth.admin.createUser({
|
|
email: trimmedEmail!,
|
|
email_confirm: true,
|
|
password: randomPassword,
|
|
user_metadata: { full_name: name },
|
|
})
|
|
|
|
if (createError || !newUser?.user) {
|
|
// Email already registered (including deleted-account tombstones,
|
|
// which keep their email on purpose): refuse signup. Linking BankID
|
|
// to an existing account must go through the authenticated
|
|
// /bankid/link route so email ownership is proven by password login
|
|
// first. (CWE-287)
|
|
if (createError?.code === 'email_exists') {
|
|
// The session id is a bearer credential for a personnummer at
|
|
// TIC; a prefix is enough to correlate log lines.
|
|
log.warn('bankid signup rejected: email already registered', {
|
|
sessionIdPrefix: sessionId.slice(0, 8),
|
|
pnrHashPrefix: pnrHash.slice(0, 8),
|
|
})
|
|
// Deliberately NOT settled: nothing was consumed and the user
|
|
// may simply have typed the wrong address. Leaving the flow
|
|
// alive lets them correct it without a second BankID round trip.
|
|
return NextResponse.json(
|
|
{
|
|
error: 'account_exists',
|
|
message: 'Det finns redan ett konto med den här e-postadressen. Logga in och koppla BankID under Inställningar.',
|
|
},
|
|
{ status: 409 }
|
|
)
|
|
}
|
|
log.error('createUser failed', {
|
|
emailHashPrefix: crypto.createHash('sha256').update(trimmedEmail!).digest('hex').slice(0, 8),
|
|
status: createError?.status,
|
|
code: createError?.code,
|
|
message: createError?.message,
|
|
})
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Kunde inte skapa kontot. Försök igen.' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
|
|
const userId = newUser.user.id
|
|
|
|
// All-or-nothing signup: if any step after createUser fails, delete
|
|
// the just-created user so the same email/BankID can retry cleanly.
|
|
// Leaving the half-created account behind strands the user: a retry
|
|
// hits account_exists/already_linked, but the account only has a
|
|
// random password they never saw, so "log in instead" requires a
|
|
// password reset. bankid_identities cascades on user delete.
|
|
const rollbackSignup = async (step: string) => {
|
|
const { error: deleteError } = await supabase.auth.admin.deleteUser(userId)
|
|
if (deleteError) {
|
|
log.error(`signup rollback after failed ${step} could not delete user: orphaned account`, {
|
|
userId,
|
|
message: deleteError.message,
|
|
})
|
|
}
|
|
}
|
|
|
|
// Mark user as BankID-linked (skips TOTP MFA) and record that they
|
|
// do not have a password yet: the BankID signup gave them a random
|
|
// server-side password they will never see. This flag gates MFA
|
|
// enrollment (see lib/auth/has-password.ts).
|
|
const { error: metaError } = await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { bankid_linked: true, has_password: false },
|
|
})
|
|
|
|
if (metaError) {
|
|
log.error('signup app_metadata update failed', { message: metaError.message, code: metaError.code })
|
|
await rollbackSignup('app_metadata update')
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Kunde inte skapa kontot. Försök igen.' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
|
|
// Store BankID identity
|
|
const { error: insertError } = await supabase
|
|
.from('bankid_identities')
|
|
.insert({
|
|
user_id: userId,
|
|
personal_number_hash: pnrHash,
|
|
personal_number_enc: encryptPersonalNumberForStorage(personalNumber),
|
|
given_name: givenName,
|
|
surname,
|
|
})
|
|
|
|
if (insertError) {
|
|
log.error('insert bankid_identities failed', { message: insertError.message, code: insertError.code })
|
|
await rollbackSignup('bankid_identities insert')
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Kunde inte skapa kontot. Försök igen.' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
|
|
// Claim the session before minting. Placed after createUser so the
|
|
// recoverable account_exists path above leaves the flow reusable,
|
|
// and before generateLink so two tabs cannot both mint.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
await rollbackSignup('session already consumed')
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
// Generate magic link for session
|
|
const { data: link, error: linkError } = await supabase.auth.admin.generateLink({
|
|
type: 'magiclink',
|
|
email: trimmedEmail!,
|
|
})
|
|
|
|
if (linkError || !link?.properties?.hashed_token) {
|
|
log.error('generateLink failed for signup', { message: linkError?.message, code: linkError?.code })
|
|
await rollbackSignup('generateLink')
|
|
// The session was already consumed above, so this flow cannot be
|
|
// retried; settle() clears it rather than leaving a spent,
|
|
// rolled-back flow to be re-offered as resumable.
|
|
return settle(NextResponse.json(
|
|
{ error: 'internal_error', message: 'Kunde inte skapa kontot. Försök igen.' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Enrichment (CompanyRoles): pre-fills /select-company picker.
|
|
await fetchAndStoreEnrichment(sessionId, userId, supabase)
|
|
|
|
// settle(): account created and magic link minted. The flow is spent.
|
|
return settle(NextResponse.json({
|
|
data: {
|
|
tokenHash: link.properties.hashed_token,
|
|
type: 'magiclink',
|
|
isNewUser: true,
|
|
},
|
|
}))
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
log.error('complete failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
if (error.code === 'TIMEOUT') {
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID service is not responding' },
|
|
{ status: 503 }
|
|
)
|
|
}
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID verification failed' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
log.error('complete failed: unexpected error', error)
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Failed to complete BankID authentication' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
// Was DELETE /bankid/:sessionId. The id is no longer something the
|
|
// client knows, so cancelling is now "end whatever flow this browser
|
|
// holds": it cannot be aimed at anyone else's session.
|
|
path: '/bankid/cancel',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
// A malformed cookie must still be clearable rather than turning
|
|
// Avbryt into a 500.
|
|
const flow = await readBankIdFlow(request).catch(() => null)
|
|
|
|
if (flow && request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
// A newer tab replaced the shared cookie. This caller may settle its
|
|
// own stale UI, but it must not cancel or clear the newer flow.
|
|
return NextResponse.json({ data: { cancelled: false, replaced: true } })
|
|
}
|
|
|
|
const response = NextResponse.json({ data: { cancelled: true } })
|
|
clearBankIdFlowCookies(response)
|
|
|
|
if (flow) {
|
|
try {
|
|
await cancelBankIdSession(flow.sessionId)
|
|
} catch (error) {
|
|
log.error('cancel failed', error)
|
|
}
|
|
}
|
|
return response
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/link',
|
|
// Requires a Supabase session but NOT a company: a user who just
|
|
// signed up (or hasn't finished onboarding) must be able to manage
|
|
// their BankID connection from /settings/account. Without this flag
|
|
// the dispatcher's requireCompanyId() throws 'No company context'
|
|
// for zero-company users. skipCompanyContext dispatches without ctx,
|
|
// so the handler resolves the caller itself via requireAuth() (same
|
|
// MFA/AAL2 enforcement the dispatcher applies).
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
const userId = auth.user.id
|
|
|
|
// Cookie, not body, and the mode must be the one the session was
|
|
// opened for. Otherwise a session started to sign SOMEONE ELSE in
|
|
// could be redirected into binding their personnummer to whoever is
|
|
// currently logged in on this browser.
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow || flow.mode !== 'link') {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
if (request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
// The flow must belong to the caller. Mode alone is not enough: this
|
|
// route binds a personnummer to whoever is authenticated right now,
|
|
// so a link flow that someone else started and abandoned in this
|
|
// browser would otherwise bind THEIR identity to THIS account, and
|
|
// they could then sign in as this user with their own BankID.
|
|
if (flow.userId !== userId) {
|
|
log.warn('bankid link rejected: flow belongs to another user')
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
const { sessionId } = flow
|
|
|
|
/** Linking is single-use for the same reason completing is. */
|
|
const settle = (response: NextResponse): NextResponse => {
|
|
clearBankIdFlowCookies(response)
|
|
return response
|
|
}
|
|
|
|
// Verify BankID session
|
|
const session = await collectBankIdResult(sessionId)
|
|
if (session.status !== 'complete' || !session.user) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { personalNumber, givenName, surname } = session.user
|
|
const pnrHash = hashPersonalNumber(personalNumber)
|
|
const supabase = createServiceClient()
|
|
|
|
// Check personnummer not already linked to another user
|
|
const { data: existing } = await supabase
|
|
.from('bankid_identities')
|
|
.select('user_id')
|
|
.eq('personal_number_hash', pnrHash)
|
|
.single()
|
|
|
|
if (existing && existing.user_id !== userId) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'already_linked', message: 'This BankID is already linked to another account' },
|
|
{ status: 409 }
|
|
))
|
|
}
|
|
|
|
if (existing && existing.user_id === userId) {
|
|
return settle(NextResponse.json({ data: { linked: true, alreadyLinked: true } }))
|
|
}
|
|
|
|
// Single-use, same reason as /complete: two tabs sharing this
|
|
// browser's flow must not both act on one identification.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
// Link BankID to current user
|
|
const { error: insertError } = await supabase
|
|
.from('bankid_identities')
|
|
.insert({
|
|
user_id: userId,
|
|
personal_number_hash: pnrHash,
|
|
personal_number_enc: encryptPersonalNumberForStorage(personalNumber),
|
|
given_name: givenName,
|
|
surname,
|
|
})
|
|
|
|
if (insertError) {
|
|
log.error('link insert failed', { message: insertError.message, code: insertError.code })
|
|
// Session already consumed above, so the flow is spent; clear it.
|
|
return settle(NextResponse.json(
|
|
{ error: 'Failed to link BankID' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Read-merge-write: updateUserById REPLACES app_metadata wholesale
|
|
// (see app/api/account/password/route.ts). Passing just
|
|
// { bankid_linked: true } would wipe has_password for users who
|
|
// already set one, they'd then be incorrectly shown the
|
|
// set-password banner on their next session.
|
|
const { data: priorUser } = await supabase.auth.admin.getUserById(userId)
|
|
const priorMeta = priorUser?.user?.app_metadata ?? {}
|
|
await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { ...priorMeta, bankid_linked: true },
|
|
})
|
|
|
|
return settle(NextResponse.json({ data: { linked: true } }))
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
log.error('link failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
log.error('link failed: unexpected error', error)
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Failed to link BankID' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/unlink',
|
|
// Requires a Supabase session but NOT a company: see /bankid/link.
|
|
// A brand-new BankID signup (zero companies) must be able to undo
|
|
// the connection from /settings/account.
|
|
skipCompanyContext: true,
|
|
handler: async (_request: Request) => {
|
|
try {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
const userId = auth.user.id
|
|
|
|
const supabase = createServiceClient()
|
|
|
|
// Delete bankid_identities row
|
|
const { error: deleteError } = await supabase
|
|
.from('bankid_identities')
|
|
.delete()
|
|
.eq('user_id', userId)
|
|
|
|
if (deleteError) {
|
|
log.error('unlink delete failed', { message: deleteError.message, code: deleteError.code })
|
|
return NextResponse.json({ error: 'Failed to unlink BankID' }, { status: 500 })
|
|
}
|
|
|
|
// Clear app_metadata.bankid_linked so MFA enforcement resumes.
|
|
// Read-merge-write: updateUserById REPLACES app_metadata wholesale
|
|
// (same rationale as /bankid/link above). Writing only
|
|
// { bankid_linked: false } would wipe has_password: a BankID-only
|
|
// user (has_password: false) would then be inferred as HAVING a
|
|
// password (lib/auth/has-password.ts) and could strand themselves
|
|
// with no working login method.
|
|
const { data: priorUser } = await supabase.auth.admin.getUserById(userId)
|
|
const priorMeta = priorUser?.user?.app_metadata ?? {}
|
|
await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { ...priorMeta, bankid_linked: false },
|
|
})
|
|
|
|
return NextResponse.json({ data: { unlinked: true } })
|
|
} catch (error) {
|
|
log.error('unlink failed', error)
|
|
return NextResponse.json({ error: 'Failed to unlink BankID' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
],
|
|
|
|
eventHandlers: [],
|
|
}
|