* feat(voucher): add create voucher and correct entry previews; update commit methods * feat: add support for pending operations in API key scopes and OAuth client management - Introduced new API key scopes for reading and approving pending operations. - Updated the scope groups to include pending operations. - Added new tools for listing and managing pending operations. - Implemented OAuth client registration and revocation endpoints. - Created a UI panel for managing OAuth clients, including registration and revocation. - Added tests for pending operations tools and OAuth allowlist functionality. - Implemented a database migration for OAuth client registrations with appropriate policies and constraints. * feat: Implement OAuth client registration rate limiting and enhance security measures - Added IP-based rate limiting to the OAuth client registration endpoint to prevent enumeration attacks. - Introduced a service-role client for allowlist lookups, ensuring trust boundaries are maintained. - Updated error responses to be uniform across different types of redirect URI validation failures. - Enhanced tests to reflect changes in OAuth scope handling, ensuring fallback to read-only scopes when no scopes are provided. - Improved handling of high-risk pending operations, requiring explicit confirmation for approvals. - Added audit logging for OAuth client revocations and pending operation approvals/rejections to maintain a security audit trail. - Refactored API key scope management to include default read-only scopes for OAuth-issued keys and added segregation-of-duties checks. * feat: add recurring invoice scheduling functionality - Implemented recurring invoice schedules with a new database schema. - Created API routes for managing recurring invoices (GET and POST). - Added cron job to automatically generate invoices based on schedules. - Developed service functions for computing next run dates and executing schedules. - Added tests for the new functionality, including validation and success cases. - Introduced error handling for various scenarios in the invoice creation process. * feat: refine VAT rate validation and enhance recurring invoice handling
148 lines
5.1 KiB
TypeScript
148 lines
5.1 KiB
TypeScript
import { createClient } from '@/lib/supabase/server'
|
|
import { NextResponse } from 'next/server'
|
|
import { renderToBuffer } from '@react-pdf/renderer'
|
|
import { InvoicePDF } from '@/lib/invoices/pdf-template'
|
|
import { getVatRules } from '@/lib/invoices/vat-rules'
|
|
import { requireCompanyId } from '@/lib/company/context'
|
|
import type { Invoice, InvoiceItem, Customer, CompanySettings, InvoiceDocumentType } from '@/types'
|
|
|
|
/**
|
|
* POST /api/invoices/preview-pdf
|
|
*
|
|
* Generates a preview PDF from form data without creating an invoice.
|
|
* Returns the PDF as an inline blob for display in a new browser tab.
|
|
*/
|
|
export async function POST(request: Request) {
|
|
const supabase = await createClient()
|
|
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
|
|
if (!user) {
|
|
return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
|
|
}
|
|
|
|
const companyId = await requireCompanyId(supabase, user.id)
|
|
|
|
const body = await request.json()
|
|
const { customer_id, invoice_date, due_date, delivery_date, currency, items, your_reference, our_reference, notes, document_type, invoice_number } = body
|
|
|
|
if (!customer_id || !items || items.length === 0) {
|
|
return NextResponse.json({ error: 'Kunduppgifter och rader krävs' }, { status: 400 })
|
|
}
|
|
|
|
// Fetch customer
|
|
const { data: customer, error: customerError } = await supabase
|
|
.from('customers')
|
|
.select('*')
|
|
.eq('id', customer_id)
|
|
.eq('company_id', companyId)
|
|
.single()
|
|
|
|
if (customerError || !customer) {
|
|
return NextResponse.json({ error: 'Kunden hittades inte' }, { status: 404 })
|
|
}
|
|
|
|
// Fetch company settings
|
|
const { data: company, error: companyError } = await supabase
|
|
.from('company_settings')
|
|
.select('*')
|
|
.eq('company_id', companyId)
|
|
.single()
|
|
|
|
if (companyError || !company) {
|
|
return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
|
|
}
|
|
|
|
const vatRules = getVatRules(customer.customer_type, customer.vat_number_validated)
|
|
|
|
const docType: InvoiceDocumentType = document_type || 'invoice'
|
|
const isDeliveryNote = docType === 'delivery_note'
|
|
|
|
// Build items with line totals and per-item VAT
|
|
const invoiceItems: InvoiceItem[] = items.map((item: { description: string; quantity: number; unit: string; unit_price: number; vat_rate?: number }, index: number) => {
|
|
const lineTotal = Math.round(item.quantity * item.unit_price * 100) / 100
|
|
const rate = item.vat_rate ?? vatRules.rate
|
|
return {
|
|
id: `preview-${index}`,
|
|
invoice_id: 'preview',
|
|
sort_order: index,
|
|
description: item.description,
|
|
quantity: item.quantity,
|
|
unit: item.unit,
|
|
unit_price: item.unit_price,
|
|
line_total: lineTotal,
|
|
vat_rate: rate,
|
|
vat_amount: isDeliveryNote ? 0 : Math.round(lineTotal * (rate / 100) * 100) / 100,
|
|
created_at: new Date().toISOString(),
|
|
}
|
|
})
|
|
|
|
const subtotal = invoiceItems.reduce((sum, item) => sum + item.line_total, 0)
|
|
const vatAmount = isDeliveryNote ? 0 : invoiceItems.reduce((sum, item) => sum + item.vat_amount, 0)
|
|
const total = isDeliveryNote ? 0 : subtotal + vatAmount
|
|
|
|
// Derive vat_rate from items: single rate → that rate, mixed → null
|
|
const itemRates = new Set(invoiceItems.map((item) => item.vat_rate))
|
|
const effectiveVatRate = isDeliveryNote ? 0 : (itemRates.size === 1 ? itemRates.values().next().value! : null)
|
|
|
|
// Construct a temporary Invoice-like object
|
|
const previewInvoice = {
|
|
id: 'preview',
|
|
user_id: user.id,
|
|
customer_id,
|
|
invoice_number: typeof invoice_number === 'string' && invoice_number.trim() ? invoice_number : 'FÖRHANDSGRANSKNING',
|
|
invoice_date: invoice_date || new Date().toISOString().split('T')[0],
|
|
due_date: due_date || new Date().toISOString().split('T')[0],
|
|
delivery_date: delivery_date || null,
|
|
status: 'draft',
|
|
currency: currency || 'SEK',
|
|
exchange_rate: null,
|
|
exchange_rate_date: null,
|
|
subtotal: isDeliveryNote ? 0 : subtotal,
|
|
subtotal_sek: null,
|
|
vat_amount: vatAmount,
|
|
vat_amount_sek: null,
|
|
total,
|
|
total_sek: null,
|
|
vat_treatment: vatRules.treatment,
|
|
vat_rate: effectiveVatRate,
|
|
moms_ruta: vatRules.momsRuta,
|
|
your_reference: your_reference || null,
|
|
our_reference: our_reference || null,
|
|
notes: notes || null,
|
|
reverse_charge_text: vatRules.reverseChargeText || null,
|
|
credited_invoice_id: null,
|
|
document_type: docType,
|
|
converted_from_id: null,
|
|
paid_at: null,
|
|
paid_amount: null,
|
|
created_at: new Date().toISOString(),
|
|
updated_at: new Date().toISOString(),
|
|
} as Invoice
|
|
|
|
try {
|
|
const pdfBuffer = await renderToBuffer(
|
|
InvoicePDF({
|
|
invoice: previewInvoice,
|
|
customer: customer as Customer,
|
|
items: invoiceItems,
|
|
company: company as CompanySettings,
|
|
isPreview: true,
|
|
})
|
|
)
|
|
|
|
return new Response(new Uint8Array(pdfBuffer), {
|
|
headers: {
|
|
'Content-Type': 'application/pdf',
|
|
'Content-Disposition': 'inline; filename="forhandsvisning.pdf"',
|
|
},
|
|
})
|
|
} catch (error) {
|
|
console.error('Preview PDF generation error:', error)
|
|
return NextResponse.json(
|
|
{ error: 'Kunde inte generera PDF-förhandsgranskning' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
}
|