* fix(git): pin LF on generated extension registry and vitest snapshots setup:extensions and vitest write these files with LF; with core.autocrlf=true git expects CRLF and flags them as phantom modifications on every dev/build run. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(security): enforce MFA on mcp-oauth consent and gate viewer storno route mcp-oauth/authorize renders an HTML consent page and issues 303 redirects that withRouteContext cannot express, so it kept raw getUser() and thereby skipped the AAL2 gate: a password-only (AAL1) session could approve consent that mints a long-lived, MFA-bypassing API key. Add a route-local requireAal2() step-up on GET and POST; AAL1 sessions redirect to /mfa/verify, BankID users are exempt. Separately, POST /api/reports/vat-declaration/rc-basis-gaps/fix calls correctEntry() (storno of a posted entry) but lacked requireWrite, so viewer-role members could trigger it. Add { requireWrite: true }. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route transactions endpoints through withRouteContext Migrate the transactions routes off hand-rolled supabase.auth.getUser() onto the MFA-enforcing withRouteContext wrapper; add requireWrite on mutating handlers (book, uncategorize, attach-document, ignore, batch-match, create-from-document). Behavior and response shapes preserved; tests updated to the wrapper mock pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route SIE import and bank reconciliation through withRouteContext Migrate import/sie and reconciliation/bank routes onto the MFA-enforcing wrapper; requireWrite on mutations (import execute, create-accounts, mappings write verbs, link/unlink/run/mark-opening-balance). Reads (status, unmatched-entries) stay ungated. Response shapes preserved; tests added/updated to the wrapper mock pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route salary endpoints through withRouteContext Migrate salary employees and runs routes (plus ku, payroll-config, tax-tables) onto the MFA-enforcing wrapper; requireWrite on mutations. Personnummer masking/encryption untouched; file downloads (AGI XML, payslip PDF, payment files) keep their headers. Two payment-file GETs retain requireWrite because they stamp *_file_generated_at and previously gated viewers. Tests added/updated to the wrapper mock pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route report endpoints through withRouteContext Migrate the read-only report routes (trial balance, balansrapport, resultatrapport, income statement, ledgers, KPI, VAT declaration, salary journal, monthly breakdown, journal register, continuity check, full archive, etc.) onto the MFA-enforcing wrapper. All read-only, no requireWrite. JSON/XLSX/PDF/ZIP response bodies and headers preserved byte-for-byte; tests updated to the wrapper mock pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route invoices, skatteverket, agent and extension endpoints through withRouteContext Migrate invoices, supplier-invoices, skatteverket tax-payments, and dynamic extension routes onto the MFA-enforcing wrapper with requireWrite on mutations. The two NDJSON streaming agent routes (invoke, onboarding/stream) use requireAuth() directly (the wrapper can't wrap a streaming response) so MFA is still enforced. skatteverket payment-file GET keeps requireWrite (stamps a generated-at field). Response shapes and file headers preserved; tests added/updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route documents, events, team and account endpoints through withRouteContext Migrate documents, events, kpi/preferences, vat/validate, support/contact onto the MFA-enforcing wrapper with requireWrite on mutations. account/password, team/accept and team/members use requireAuth() directly (user-level or pre-membership flows with no active company context) so MFA is still enforced. events keeps its dual API-key-or-session auth. Document retention guard untouched; tests added/updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(api): route settings and pending-operations endpoints through withRouteContext Migrate settings (api-keys, oauth-clients, booking-templates, counterparty-templates, logo, company settings) and pending-operations (commit, bulk-commit, reject, edit-before-approve) onto the MFA-enforcing wrapper with requireWrite on mutations. Credential-guarding routes keep their per-user ownership filters. Response shapes preserved; tests added/updated to the wrapper mock pattern. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * chore(guards): ratchet raw-route-auth baseline 119->1 after A1 migration Lock in the withRouteContext migration so the count cannot regress. The single remaining entry, mcp-oauth/authorize, is a documented exception (HTML consent + redirects, MFA enforced via route-local step-up). Record the campaign and requireWrite decisions in DECISIONS.md. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(vat): add eSKD momsdeklaration file export for "Deklarera via fil" Generate the Skatteverket eSKDUpload v6.0 XML file so users can file VAT by upload instead of typing every ruta into the form. Extract buildFiledAmounts() as the shared whole-krona source of truth (öre truncated per SFL 22 kap 1 §) so the XML file and the manual-filing PDF can never disagree. Adds the /eskd API route, an XML option in the report export menu, and the upload button on the manual-filing card. Strings in sv + en. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(vat): add 'vat_settlement' source type and update related components * fix(booking): adjust search input layout and enable autofocus * fix(vat): support 12-digit org numbers and adjust emission order for eSKD file * fix(migration): add 'vat_settlement' to journal_entries.source_type CHECK --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
227 lines
8.6 KiB
TypeScript
227 lines
8.6 KiB
TypeScript
import { NextResponse } from 'next/server'
|
|
import { renderToBuffer } from '@react-pdf/renderer'
|
|
import { generateIncomeStatement } from '@/lib/reports/income-statement'
|
|
import { FinancialStatementPDF, type FinancialStatementGroup, type FinancialStatementSection, type FinancialStatementSummaryRow } from '@/lib/reports/financial-statement-pdf-template'
|
|
import { withRouteContext } from '@/lib/api/with-route-context'
|
|
import { parseReportDateRange } from '@/lib/reports/date-range'
|
|
import type { CompanySettings } from '@/types'
|
|
import { parseDimensionFilterParams, dimensionFilterDisclosure, dimensionFilterFileSuffix } from '@/lib/reports/dimension-filter'
|
|
|
|
// K2/K3 uppställningsform (ÅRL bilaga 2, kostnadsslagsindelad) splits class 8
|
|
// into three named blocks with subtotals:
|
|
// 80-84 → Finansiella poster (followed by "Resultat efter finansiella poster")
|
|
// 88 → Bokslutsdispositioner
|
|
// 89 → Skatt på årets resultat
|
|
// The generator lumps these together under financial_sections, so we split
|
|
// here by the first row's account prefix.
|
|
const FINANSIELLA_POSTER_PREFIXES = ['80', '81', '82', '83', '84']
|
|
const BOKSLUTSDISPOSITIONER_PREFIXES = ['88']
|
|
const SKATT_PREFIXES = ['89']
|
|
const KNOWN_CLASS_8_PREFIXES = [
|
|
...FINANSIELLA_POSTER_PREFIXES,
|
|
...BOKSLUTSDISPOSITIONER_PREFIXES,
|
|
...SKATT_PREFIXES,
|
|
]
|
|
|
|
function sectionPrefix(section: FinancialStatementSection, prefixes: string[]): boolean {
|
|
if (section.rows.length === 0) return false
|
|
const acc = section.rows[0].account_number
|
|
return prefixes.some((p) => acc.startsWith(p))
|
|
}
|
|
|
|
export const GET = withRouteContext('report.income_statement.pdf', async (request, { supabase, companyId }) => {
|
|
const { searchParams } = new URL(request.url)
|
|
const periodId = searchParams.get('period_id')
|
|
|
|
if (!periodId) {
|
|
return NextResponse.json({ error: 'period_id is required' }, { status: 400 })
|
|
}
|
|
|
|
const [{ data: period }, { data: companyRow }] = await Promise.all([
|
|
supabase
|
|
.from('fiscal_periods')
|
|
.select('period_start, period_end')
|
|
.eq('id', periodId)
|
|
.eq('company_id', companyId)
|
|
.single(),
|
|
supabase
|
|
.from('company_settings')
|
|
.select('*')
|
|
.eq('company_id', companyId)
|
|
.single(),
|
|
])
|
|
|
|
if (!companyRow) {
|
|
return NextResponse.json({ error: 'Företagsinställningar saknas' }, { status: 404 })
|
|
}
|
|
// An identifiable period is part of räkenskapsinformation (BFL 7 kap). Refuse
|
|
// to render a PDF that can't be archived with the period it refers to.
|
|
if (!period) {
|
|
return NextResponse.json(
|
|
{ error: 'Räkenskapsperioden kunde inte läsas. Välj en befintlig period innan du genererar PDF.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const parsedRange = parseReportDateRange(searchParams, period)
|
|
if (!parsedRange.ok) {
|
|
return NextResponse.json({ error: parsedRange.error }, { status: 400 })
|
|
}
|
|
const range = parsedRange.range
|
|
const effectiveStart = range.fromDate ?? period.period_start
|
|
const effectiveEnd = range.toDate ?? period.period_end
|
|
|
|
const dimFilter = parseDimensionFilterParams(searchParams)
|
|
if (!dimFilter.ok) {
|
|
return NextResponse.json({ error: dimFilter.error }, { status: 400 })
|
|
}
|
|
|
|
try {
|
|
const report = await generateIncomeStatement(supabase, companyId, periodId, {
|
|
...range,
|
|
dimensions: dimFilter.dimensions,
|
|
})
|
|
report.period = { start: effectiveStart, end: effectiveEnd }
|
|
|
|
const operatingResult = Math.round((report.total_revenue - report.total_expenses) * 100) / 100
|
|
|
|
// Split class 8 into its three K2/K3 blocks plus a catch-all for any
|
|
// prefix the generator emits but we haven't explicitly mapped. If a future
|
|
// generator change adds sections for 85/86/87 or similar, this keeps them
|
|
// visible and arithmetically accounted for rather than silently dropped.
|
|
const finansiellaPosterSections = report.financial_sections.filter((s) =>
|
|
sectionPrefix(s, FINANSIELLA_POSTER_PREFIXES),
|
|
)
|
|
const bokslutsdispositionerSections = report.financial_sections.filter((s) =>
|
|
sectionPrefix(s, BOKSLUTSDISPOSITIONER_PREFIXES),
|
|
)
|
|
const skattSections = report.financial_sections.filter((s) =>
|
|
sectionPrefix(s, SKATT_PREFIXES),
|
|
)
|
|
const ovrigaFinansiellaPosterSections = report.financial_sections.filter(
|
|
(s) => !sectionPrefix(s, KNOWN_CLASS_8_PREFIXES),
|
|
)
|
|
|
|
const totalFinansiellaPoster = Math.round(
|
|
finansiellaPosterSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
|
|
) / 100
|
|
const totalBokslutsdispositioner = Math.round(
|
|
bokslutsdispositionerSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
|
|
) / 100
|
|
const totalSkatt = Math.round(
|
|
skattSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
|
|
) / 100
|
|
const totalOvrigaFinansiellaPoster = Math.round(
|
|
ovrigaFinansiellaPosterSections.reduce((sum, s) => sum + s.subtotal, 0) * 100,
|
|
) / 100
|
|
// Catch-all is treated as part of "finansiella poster" for the subtotal:
|
|
// 85-87 accounts in BAS are financial-adjacent (not tax, not bokslut).
|
|
const resultatEfterFinansiellaPoster = Math.round(
|
|
(operatingResult + totalFinansiellaPoster + totalOvrigaFinansiellaPoster) * 100,
|
|
) / 100
|
|
|
|
const groups: FinancialStatementGroup[] = [
|
|
{
|
|
heading: 'Rörelseintäkter',
|
|
sections: report.revenue_sections,
|
|
totalLabel: 'Summa rörelseintäkter',
|
|
total: report.total_revenue,
|
|
},
|
|
{
|
|
heading: 'Rörelsekostnader',
|
|
sections: report.expense_sections,
|
|
totalLabel: 'Summa rörelsekostnader',
|
|
total: report.total_expenses,
|
|
negate: true,
|
|
},
|
|
]
|
|
|
|
if (finansiellaPosterSections.length > 0) {
|
|
groups.push({
|
|
heading: 'Finansiella poster',
|
|
sections: finansiellaPosterSections,
|
|
totalLabel: 'Summa finansiella poster',
|
|
total: totalFinansiellaPoster,
|
|
})
|
|
}
|
|
if (ovrigaFinansiellaPosterSections.length > 0) {
|
|
groups.push({
|
|
heading: 'Övriga finansiella poster',
|
|
sections: ovrigaFinansiellaPosterSections,
|
|
totalLabel: 'Summa övriga finansiella poster',
|
|
total: totalOvrigaFinansiellaPoster,
|
|
})
|
|
}
|
|
if (bokslutsdispositionerSections.length > 0) {
|
|
groups.push({
|
|
heading: 'Bokslutsdispositioner',
|
|
sections: bokslutsdispositionerSections,
|
|
totalLabel: 'Summa bokslutsdispositioner',
|
|
total: totalBokslutsdispositioner,
|
|
})
|
|
}
|
|
if (skattSections.length > 0) {
|
|
groups.push({
|
|
heading: 'Skatter',
|
|
sections: skattSections,
|
|
totalLabel: 'Summa skatter',
|
|
total: totalSkatt,
|
|
})
|
|
}
|
|
|
|
// K2/K3 uppställningsform (ÅRL bilaga 2) summary structure:
|
|
// Rörelseresultat
|
|
// Resultat efter finansiella poster (only if finansiella poster present)
|
|
// Bokslutsdispositioner (only if present)
|
|
// Skatt på årets resultat (always, so the reader can verify the tax calc)
|
|
// Årets resultat
|
|
const summary: FinancialStatementSummaryRow[] = [
|
|
{ label: 'Rörelseresultat', amount: operatingResult },
|
|
]
|
|
if (
|
|
finansiellaPosterSections.length > 0 ||
|
|
ovrigaFinansiellaPosterSections.length > 0
|
|
) {
|
|
summary.push({
|
|
label: 'Resultat efter finansiella poster',
|
|
amount: resultatEfterFinansiellaPoster,
|
|
})
|
|
}
|
|
if (bokslutsdispositionerSections.length > 0) {
|
|
summary.push({ label: 'Bokslutsdispositioner', amount: totalBokslutsdispositioner })
|
|
}
|
|
summary.push({ label: 'Skatt på årets resultat', amount: totalSkatt })
|
|
summary.push({ label: 'Årets resultat', amount: report.net_result, emphasis: true })
|
|
|
|
const pdfBuffer = await renderToBuffer(
|
|
FinancialStatementPDF({
|
|
// Partial-view disclosure in the document title (BFNAR 2013:2).
|
|
title: dimensionFilterDisclosure(dimFilter.dimensions)
|
|
? `Resultaträkning: ${dimensionFilterDisclosure(dimFilter.dimensions)}`
|
|
: 'Resultaträkning',
|
|
groups,
|
|
summary,
|
|
period: report.period,
|
|
company: companyRow as CompanySettings,
|
|
generatedAt: new Date().toISOString(),
|
|
})
|
|
)
|
|
|
|
// "-utkast" suffix keeps the draft status visible even after the file
|
|
// leaves the browser: complements the in-document ÅRL 2:7 disclaimer.
|
|
const filename = `resultatrakning${dimensionFilterFileSuffix(dimFilter.dimensions)}-${report.period.start}--${report.period.end}-utkast.pdf`
|
|
|
|
return new Response(new Uint8Array(pdfBuffer), {
|
|
headers: {
|
|
'Content-Type': 'application/pdf',
|
|
'Content-Disposition': `attachment; filename="${filename}"`,
|
|
},
|
|
})
|
|
} catch (err) {
|
|
return NextResponse.json(
|
|
{ error: err instanceof Error ? err.message : 'Kunde inte generera resultaträkning' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
})
|