accounted/tests/pg/match-batch-allocate.pg.test.ts

import { randomUUID } from 'node:crypto'
import { describe, expect, it } from 'vitest'
import {
  insertAuthUser,
  insertCompany,
  insertCompanyMember,
  insertFiscalPeriod,
} from '@/tests/pg/fixtures'
import { getPool, withUserContext } from '@/tests/pg/setup'

/**
 * Covers 20260529120100_match_batch_allocate:
 *   - 1 bank tx → N supplier invoices: builds ONE combined verifikat with
 *     N × Dr 2440 + 1 × Cr 1930, inserts N supplier_invoice_payments rows
 *     all pointing at the same JE.
 *   - Per-invoice paid_amount/remaining_amount/status advance correctly.
 *   - Overshoot guard returns BATCH_OVERSHOOT cleanly (no partial state).
 *   - Already-booked tx rejection.
 *   - Direction mismatch rejection.
 *   - Mixed customer + supplier kinds rejection.
 *
 * These tests bypass RLS by writing through the superuser pool — they
 * exercise the RPC logic + DB constraints, not the policy layer.
 */

async function insertSupplier(params: {
  userId: string
  companyId: string
  name?: string
}): Promise<string> {
  const id = randomUUID()
  await getPool().query(
    `INSERT INTO public.suppliers
       (id, user_id, company_id, name, supplier_type, country, default_payment_terms, default_currency)
     VALUES ($1, $2, $3, $4, 'swedish_business', 'SE', 30, 'SEK')`,
    [id, params.userId, params.companyId, params.name ?? 'Leverantör AB'],
  )
  return id
}

async function insertSupplierInvoice(params: {
  userId: string
  companyId: string
  supplierId: string
  total: number
  status?: string
  invoiceDate?: string
  dueDate?: string
}): Promise<string> {
  const id = randomUUID()
  // Arrival numbers are generated per-company by get_next_arrival_number,
  // but for an isolated test we can hardcode a unique value via current time
  // millis modulo a wide range. The unique constraint allows that.
  const arrivalNumber = (Date.now() % 1_000_000_000) + Math.floor(Math.random() * 10_000)
  await getPool().query(
    `INSERT INTO public.supplier_invoices
       (id, user_id, company_id, supplier_id, arrival_number, supplier_invoice_number,
        invoice_date, due_date, received_date, status, currency,
        subtotal, vat_amount, total, paid_amount, remaining_amount,
        vat_treatment, reverse_charge, is_credit_note)
     VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $7, $9, 'SEK',
             $10, 0, $10, 0, $10, 'standard_25', false, false)`,
    [
      id,
      params.userId,
      params.companyId,
      params.supplierId,
      arrivalNumber,
      `LF-${arrivalNumber}`,
      params.invoiceDate ?? '2026-06-01',
      params.dueDate ?? '2026-07-01',
      params.status ?? 'approved',
      params.total,
    ],
  )
  return id
}

async function insertTransaction(params: {
  userId: string
  companyId: string
  amount: number
  date?: string
  currency?: string
}): Promise<string> {
  const id = randomUUID()
  await getPool().query(
    `INSERT INTO public.transactions
       (id, user_id, company_id, date, description, amount, currency, category)
     VALUES ($1, $2, $3, $4, $5, $6, $7, 'uncategorized')`,
    [
      id,
      params.userId,
      params.companyId,
      params.date ?? '2026-06-05',
      'Bank transfer',
      params.amount,
      params.currency ?? 'SEK',
    ],
  )
  return id
}

async function seedTenant(opts: { isClosed?: boolean } = {}) {
  const userId = await insertAuthUser()
  const companyId = await insertCompany({ createdBy: userId })
  await insertCompanyMember({ companyId, userId, role: 'owner' })
  const fiscalPeriodId = await insertFiscalPeriod({
    userId,
    companyId,
    periodStart: '2026-01-01',
    periodEnd: '2026-12-31',
    isClosed: opts.isClosed,
  })
  return { userId, companyId, fiscalPeriodId }
}

interface RpcResult {
  ok: boolean
  code?: string
  details?: Record<string, unknown>
  journal_entry_id?: string
  voucher_number?: number
  allocations?: Array<{
    kind: string
    supplier_invoice_id?: string
    invoice_id?: string
    payment_id: string
    status: string
    paid_amount: number
    remaining_amount: number
    amount: number
  }>
  total_allocated?: number
  leftover?: number
}

describe('match_batch_allocate', () => {
  it('builds a single combined verifikat for 1 tx → 3 supplier invoices', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })

    const si1 = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 2000,
    })
    const si2 = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 3000,
    })
    const si3 = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1500,
    })

    const txId = await insertTransaction({
      userId, companyId, amount: -6500, date: '2026-06-05',
    })

    const allocations = [
      { kind: 'supplier_invoice', supplier_invoice_id: si1, amount: 2000 },
      { kind: 'supplier_invoice', supplier_invoice_id: si2, amount: 3000 },
      { kind: 'supplier_invoice', supplier_invoice_id: si3, amount: 1500 },
    ]

    // withUserContext sets request.jwt.claim.sub so the RPC's auth.uid()
    // membership check (PR #603 round 2) resolves the seeded owner.
    // ALL assertions about post-RPC state must run inside this block since
    // it rolls back at the end.
    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [txId, JSON.stringify(allocations), userId, companyId],
      )
      const result = r.rows[0]!.match_batch_allocate

      expect(result.ok).toBe(true)
      expect(result.journal_entry_id).toBeTruthy()
      expect(result.voucher_number).toBeGreaterThan(0)
      expect(result.total_allocated).toBe(6500)
      expect(result.leftover).toBe(0)
      expect(result.allocations).toHaveLength(3)

      // Verify one verifikat with N+1 lines (3 × Dr 2440 + 1 × Cr 1930).
      const lines = await client.query<{
        account_number: string
        debit_amount: string
        credit_amount: string
      }>(
        `SELECT account_number, debit_amount, credit_amount
           FROM public.journal_entry_lines
          WHERE journal_entry_id = $1
          ORDER BY sort_order`,
        [result.journal_entry_id],
      )
      expect(lines.rows).toHaveLength(4)
      const apLines = lines.rows.filter((l) => l.account_number === '2440')
      const bankLines = lines.rows.filter((l) => l.account_number === '1930')
      expect(apLines).toHaveLength(3)
      expect(bankLines).toHaveLength(1)
      expect(Number(bankLines[0]!.credit_amount)).toBe(6500)
      const apSum = apLines.reduce((s, l) => s + Number(l.debit_amount), 0)
      expect(apSum).toBe(6500)

      // Verify all 3 supplier invoices flipped to 'paid'.
      const inv1 = await client.query<{ status: string; paid_amount: string; remaining_amount: string }>(
        `SELECT status, paid_amount, remaining_amount FROM public.supplier_invoices WHERE id = $1`,
        [si1],
      )
      expect(inv1.rows[0]!.status).toBe('paid')
      expect(Number(inv1.rows[0]!.paid_amount)).toBe(2000)
      expect(Number(inv1.rows[0]!.remaining_amount)).toBe(0)

      // Verify 3 supplier_invoice_payments rows all reference the same JE.
      const payments = await client.query<{ journal_entry_id: string; supplier_invoice_id: string }>(
        `SELECT journal_entry_id, supplier_invoice_id
           FROM public.supplier_invoice_payments WHERE transaction_id = $1`,
        [txId],
      )
      expect(payments.rows).toHaveLength(3)
      const jeIds = new Set(payments.rows.map((p) => p.journal_entry_id))
      expect(jeIds.size).toBe(1)
      expect(jeIds.has(result.journal_entry_id!)).toBe(true)

      // Verify tx.journal_entry_id is set + supplier_invoice_id left NULL (multi).
      const txRow = await client.query<{
        journal_entry_id: string | null
        supplier_invoice_id: string | null
        is_business: boolean
      }>(
        `SELECT journal_entry_id, supplier_invoice_id, is_business
           FROM public.transactions WHERE id = $1`,
        [txId],
      )
      expect(txRow.rows[0]!.journal_entry_id).toBe(result.journal_entry_id)
      expect(txRow.rows[0]!.supplier_invoice_id).toBeNull()
      expect(txRow.rows[0]!.is_business).toBe(true)

      // Verify samlingsverifikat carries the supplier-side source_type
      // (PR #603 compliance fix — was previously 'invoice_paid' for both
      // directions which mis-routed behandlingshistorik filters).
      const je = await client.query<{ source_type: string }>(
        `SELECT source_type FROM public.journal_entries WHERE id = $1`,
        [result.journal_entry_id],
      )
      expect(je.rows[0]!.source_type).toBe('supplier_invoice_paid')
    })
  })

  it('rejects with BATCH_OVERSHOOT when allocation exceeds invoice remaining', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })
    const txId = await insertTransaction({ userId, companyId, amount: -5000 })

    const allocations = [
      { kind: 'supplier_invoice', supplier_invoice_id: si, amount: 5000 },
    ]

    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [txId, JSON.stringify(allocations), userId, companyId],
      )
      const result = r.rows[0]!.match_batch_allocate

      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_OVERSHOOT')
      expect(result.details).toMatchObject({ supplier_invoice_id: si, requested: 5000 })

      // No journal entry should have been created.
      const txRow = await client.query<{ journal_entry_id: string | null }>(
        `SELECT journal_entry_id FROM public.transactions WHERE id = $1`,
        [txId],
      )
      expect(txRow.rows[0]!.journal_entry_id).toBeNull()

      const inv = await client.query<{ paid_amount: string; remaining_amount: string }>(
        `SELECT paid_amount, remaining_amount FROM public.supplier_invoices WHERE id = $1`,
        [si],
      )
      expect(Number(inv.rows[0]!.paid_amount)).toBe(0)
      expect(Number(inv.rows[0]!.remaining_amount)).toBe(1000)
    })
  })

  it('rejects with BATCH_UNAUTHORIZED when caller is not a member of the company', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })
    const txId = await insertTransaction({ userId, companyId, amount: -1000 })

    // Different user — never added to company_members for companyId. The
    // SECURITY DEFINER check (PR #603 compliance) refuses any access.
    const outsiderId = await insertAuthUser()

    await withUserContext(outsiderId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [
          txId,
          JSON.stringify([{ kind: 'supplier_invoice', supplier_invoice_id: si, amount: 1000 }]),
          outsiderId,
          companyId,
        ],
      )
      const result = r.rows[0]!.match_batch_allocate
      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_UNAUTHORIZED')
    })
  })

  it('rejects with BATCH_TX_ALREADY_BOOKED when tx already has a JE', async () => {
    const { userId, companyId, fiscalPeriodId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })

    // Pre-book the tx by linking it to a manual posted JE.
    const existingJeId = randomUUID()
    await getPool().query(
      `INSERT INTO public.journal_entries
         (id, user_id, company_id, fiscal_period_id, voucher_number, voucher_series,
          entry_date, description, source_type, status)
       VALUES ($1, $2, $3, $4, 1, 'A', '2026-06-05', 'Manual', 'manual', 'draft')`,
      [existingJeId, userId, companyId, fiscalPeriodId],
    )
    await getPool().query(
      `INSERT INTO public.journal_entry_lines (journal_entry_id, account_number, debit_amount, credit_amount)
       VALUES ($1, '1930', 0, 1000), ($1, '4010', 1000, 0)`,
      [existingJeId],
    )
    await getPool().query(`UPDATE public.journal_entries SET status = 'posted' WHERE id = $1`, [existingJeId])

    const txId = await insertTransaction({ userId, companyId, amount: -1000 })
    await getPool().query(
      `UPDATE public.transactions SET journal_entry_id = $1 WHERE id = $2`,
      [existingJeId, txId],
    )

    const allocations = [
      { kind: 'supplier_invoice', supplier_invoice_id: si, amount: 1000 },
    ]

    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [txId, JSON.stringify(allocations), userId, companyId],
      )
      const result = r.rows[0]!.match_batch_allocate
      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_TX_ALREADY_BOOKED')
    })
  })

  it('rejects with BATCH_DIRECTION_MISMATCH for supplier allocation against income tx', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })

    // Positive tx (income) — wrong direction for supplier_invoice allocation.
    const txId = await insertTransaction({ userId, companyId, amount: 1000 })

    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [
          txId,
          JSON.stringify([{ kind: 'supplier_invoice', supplier_invoice_id: si, amount: 1000 }]),
          userId,
          companyId,
        ],
      )
      const result = r.rows[0]!.match_batch_allocate
      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_DIRECTION_MISMATCH')
    })
  })

  it('rejects BATCH_DUPLICATE_ALLOCATION when the same supplier invoice appears twice', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })
    const txId = await insertTransaction({ userId, companyId, amount: -800 })

    // Same supplier_invoice_id listed twice. Per-allocation amounts (400 each)
    // do not individually overshoot the 1 000 remaining, but their sum would
    // insert two payment rows for one invoice. The dedupe guard catches
    // this in the validation loop before any write.
    const allocations = [
      { kind: 'supplier_invoice', supplier_invoice_id: si, amount: 400 },
      { kind: 'supplier_invoice', supplier_invoice_id: si, amount: 400 },
    ]

    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [txId, JSON.stringify(allocations), userId, companyId],
      )
      const result = r.rows[0]!.match_batch_allocate
      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_DUPLICATE_ALLOCATION')
      expect(result.details?.id).toBe(si)
    })
  })

  it('rejects BATCH_MIXED_KINDS_UNSUPPORTED on customer + supplier in same batch', async () => {
    const { userId, companyId } = await seedTenant()
    const supplier = await insertSupplier({ userId, companyId })
    const si = await insertSupplierInvoice({
      userId, companyId, supplierId: supplier, total: 1000,
    })

    // Insert a customer + invoice for the customer-side allocation.
    const customerId = randomUUID()
    await getPool().query(
      `INSERT INTO public.customers
         (id, user_id, company_id, name, customer_type, country)
       VALUES ($1, $2, $3, 'Kund AB', 'swedish_business', 'SE')`,
      [customerId, userId, companyId],
    )
    const invoiceId = randomUUID()
    await getPool().query(
      `INSERT INTO public.invoices
         (id, user_id, company_id, customer_id, invoice_number, invoice_date, due_date, status,
          currency, subtotal, vat_amount, total, paid_amount, remaining_amount, vat_treatment)
       VALUES ($1, $2, $3, $4, 'F-001', '2026-06-01', '2026-07-01', 'sent', 'SEK',
               1000, 0, 1000, 0, 1000, 'standard_25')`,
      [invoiceId, userId, companyId, customerId],
    )

    // Negative tx — direction makes both sides individually plausible, but
    // we reject mixed kinds outright. Actually negative=supplier and we need
    // either income or expense; the mixed check fires before the direction
    // check, so the result code is MIXED_KINDS regardless.
    const txId = await insertTransaction({ userId, companyId, amount: -2000 })

    await withUserContext(userId, async (client) => {
      const r = await client.query<{ match_batch_allocate: RpcResult }>(
        `SELECT match_batch_allocate($1, $2::jsonb, $3, $4)`,
        [
          txId,
          JSON.stringify([
            { kind: 'supplier_invoice', supplier_invoice_id: si, amount: 1000 },
            { kind: 'customer_invoice', invoice_id: invoiceId, amount: 1000 },
          ]),
          userId,
          companyId,
        ],
      )
      const result = r.rows[0]!.match_batch_allocate
      expect(result.ok).toBe(false)
      expect(result.code).toBe('BATCH_MIXED_KINDS_UNSUPPORTED')
    })
  })
})