Files
accounted/lib/bookkeeping/currency-revaluation.ts
T
Jakob WennbergandClaude Opus 4.8 f8504f3bd0 fix: audit batch — pagination truncation, MFA/dead-code cleanup, mark-paid fail-closed (#841)
* fix(reports): paginate 8 more report/ledger queries (1000-row truncation)

Raw .select() without fetchAllRows() silently caps at PostgREST's 1000-row
limit, producing wrong statutory output for high-volume companies. Following
#806 (trial-balance/VAT), wrap the remaining offenders in
fetchAllRows + a stable .order('id') + dedupeBy:

- ink2-engine / ne-engine: INK2 & NE-bilaga tax declarations under-counted
- ar-reconciliation (1510/1513), supplier-reconciliation (2440): phantom
  "Ej avstämd" gaps
- full-archive-export: 7-year DR archive (added a unique total order so rows
  are not silently skipped/duplicated across pages)
- avgifter-basis, currency-revaluation, vat-declaration

Adds a regression guard test asserting >1000 ledger lines are summed, not
truncated at 1000.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(api): close extension-dispatcher MFA gap, scope /api/events to API key, sweep dead code

Security/correctness:
- ext/[...path] dispatcher now uses requireAuth() instead of inline
  supabase.auth.getUser(), enforcing MFA (AAL2) on hosted across the whole
  enabled-extension surface (banking sync, document upload/booking, supplier
  invoices, migration). Ratchets antipatterns-baseline raw-route-auth 168->165.
- /api/events now filters by the API key's bound company_id instead of the
  user's active company (was a cross-company read with a scoped key).
- enable-banking OAuth callback calls ensureInitialized() at module load so
  the PSD2 consent audit event (ASVS V16 / GDPR Art.30) isn't dropped on a
  cold-start instance.

Dead-code sweep (all confirmed zero importers):
- delete lib/tax/calculator.ts, lib/salary/engangsskatt.ts (+test),
  lib/email/resend.ts, lib/salary/salary-transaction-matcher.ts,
  lib/webhooks/diff.ts, lib/salary/effective-values.ts,
  lib/bookkeeping/template-prompt.ts
- trim unused lib/vat/eu-countries.ts helpers (keep EU_COUNTRIES)
- remove dead getAutomaticStatus() and the abandoned Activepieces CSP entry

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(invoices): fail closed when a payment journal entry doesn't post

Three mark-paid paths (legacy route, v1 API, agent commit) diverged on the
"mark paid but the JE failed" case — two would flip the invoice to paid (or
leave an orphaned posted voucher) with no booking, silently diverging the GL
from the AR/AP sub-ledger. Unify on fail-closed:

- legacy + v1 + agent commitMarkInvoicePaid: never mark paid without a posted
  voucher; on a null/failed JE return INVOICE_PAID_BOOK_FAILED before any
  state mutation (v1 mirrors the match-invoice strict mode).
- agent path: add the .in('status',[...]).select('id') CAS guard and cancel
  the orphaned voucher (cancelOrphanedPaymentEntry) on a lost race or update
  error, matching the web route.
- legacy route: cancel the orphan on a non-race update error too (was only
  handled on the race branch).
- supplier mark-paid: stop swallowing a failed supplier_invoice_payments
  insert — that row drives the reversal amount in payment-sync; roll back the
  status flip and cancel the voucher instead.
- pending-ops orchestrator: error-check the terminal 'committed' write so an
  op stranded in 'committing' (the expire sweep only targets 'pending') is at
  least logged loudly.

Adds a guard test for the legacy fail-closed path. Full unit suite green.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(ci): unblock core build + address compliance-review findings

- avgifter-basis.ts: fix the core-build TypeScript error — PostgREST's
  type-level select parser models the salary_run embed as an array, which
  wasn't assignable to the object-typed generic. Type it `unknown` (rows are
  read via an explicit cast), making it robust across postgrest-js versions.
- /api/events: add a non-null companyId guard before the event_log query
  (defense-in-depth for the API-key-bound scope) — addresses ASVS V8.2.1 /
  ISO A.5.15.
- supplier mark-paid: add a CAS guard (.eq('status', newStatus)) to the
  payment-insert-failure rollback so a concurrent settlement can't be
  clobbered — addresses ASVS V2.3.
- dispatcher: add an AAL2 regression test asserting a non-MFA session is
  rejected (403) and the extension handler never runs — addresses the
  GDPR Art.32 review ask for the single extension chokepoint.

Verified deletions are safe: effective-values.ts was a dead duplicate — the
live AGI/payslip path inlines the same `?? override` coalescing
(generate-declaration.ts), so AGI correctness is unaffected.

next build: exit 0. Full unit suite: 6147 passing. ESLint clean.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-06-30 14:34:23 +02:00

336 lines
10 KiB
TypeScript

import type { SupabaseClient } from '@supabase/supabase-js'
import { fetchAllRows } from '@/lib/supabase/fetch-all'
import { fetchMultipleRates } from '@/lib/currency/riksbanken'
import { createJournalEntry } from '@/lib/bookkeeping/engine'
import {
BookkeepingDatabaseError,
CurrencyRevaluationAlreadyExistsError,
} from '@/lib/bookkeeping/errors'
import type {
Currency,
Invoice,
SupplierInvoice,
RevaluationItem,
CurrencyRevaluationPreview,
CurrencyRevaluationResult,
CreateJournalEntryLineInput,
} from '@/types'
/**
* Fetch open foreign-currency receivables (invoices).
* Returns invoices with status 'sent' or 'overdue', non-SEK currency,
* and a known exchange rate.
*/
export async function getOpenForeignCurrencyReceivables(
supabase: SupabaseClient,
companyId: string
): Promise<Invoice[]> {
try {
// Paginated with a stable id order so a company with >1000 open FX invoices
// is fully revalued rather than silently truncated at 1000 rows.
return await fetchAllRows<Invoice>(({ from, to }) =>
supabase
.from('invoices')
.select('*')
.eq('company_id', companyId)
.in('status', ['sent', 'overdue'])
.neq('currency', 'SEK')
.not('exchange_rate', 'is', null)
.order('id', { ascending: true })
.range(from, to)
, { dedupeBy: (i) => i.id })
} catch (err) {
throw new BookkeepingDatabaseError(
'fetch_currency_receivables',
err instanceof Error ? err.message : 'fetch failed'
)
}
}
/**
* Fetch open foreign-currency payables (supplier invoices).
* Returns supplier invoices with open statuses, non-SEK currency,
* and a known exchange rate. Uses remaining_amount for partial payments.
*/
export async function getOpenForeignCurrencyPayables(
supabase: SupabaseClient,
companyId: string
): Promise<SupplierInvoice[]> {
try {
// Paginated with a stable id order so a company with >1000 open FX payables
// is fully revalued rather than silently truncated at 1000 rows.
return await fetchAllRows<SupplierInvoice>(({ from, to }) =>
supabase
.from('supplier_invoices')
.select('*')
.eq('company_id', companyId)
.in('status', ['registered', 'approved', 'overdue', 'partially_paid'])
.neq('currency', 'SEK')
.not('exchange_rate', 'is', null)
.order('id', { ascending: true })
.range(from, to)
, { dedupeBy: (i) => i.id })
} catch (err) {
throw new BookkeepingDatabaseError(
'fetch_currency_payables',
err instanceof Error ? err.message : 'fetch failed'
)
}
}
/**
* Preview currency revaluation without persisting.
* Computes per-item differences and aggregated journal lines.
*
* Receivables (1510):
* closing > original → gain: Debit 1510, Credit 3960
* closing < original → loss: Credit 1510, Debit 7960
*
* Payables (2440):
* closing > original → loss (liability grew): Debit 7960, Credit 2440
* closing < original → gain (liability shrank): Debit 2440, Credit 3960
*/
export async function previewCurrencyRevaluation(
supabase: SupabaseClient,
companyId: string,
closingDate: string
): Promise<CurrencyRevaluationPreview> {
const [receivables, payables] = await Promise.all([
getOpenForeignCurrencyReceivables(supabase, companyId),
getOpenForeignCurrencyPayables(supabase, companyId),
])
// Collect distinct currencies
const currencies = new Set<Currency>()
for (const inv of receivables) {
currencies.add(inv.currency)
}
for (const si of payables) {
currencies.add(si.currency as Currency)
}
if (currencies.size === 0) {
return {
items: [],
lines: [],
closingRates: {},
totalGain: 0,
totalLoss: 0,
netEffect: 0,
}
}
// Fetch closing rates
const rateMap = await fetchMultipleRates(
Array.from(currencies),
new Date(closingDate)
)
const closingRates: Record<string, number> = {}
for (const [currency, rate] of rateMap) {
closingRates[currency] = rate.rate
}
const items: RevaluationItem[] = []
// Process receivables
for (const inv of receivables) {
const closingRate = rateMap.get(inv.currency)?.rate
if (!closingRate || !inv.exchange_rate) continue
const amountInCurrency = inv.total
const originalSek = Math.round(amountInCurrency * inv.exchange_rate * 100) / 100
const closingSek = Math.round(amountInCurrency * closingRate * 100) / 100
const difference = Math.round((closingSek - originalSek) * 100) / 100
if (Math.abs(difference) < 0.01) continue
items.push({
type: 'receivable',
source_id: inv.id,
reference: inv.invoice_number ?? '',
currency: inv.currency,
amount_in_currency: amountInCurrency,
original_rate: inv.exchange_rate,
closing_rate: closingRate,
original_sek: originalSek,
closing_sek: closingSek,
difference_sek: difference,
})
}
// Process payables (use remaining_amount for partial payments)
for (const si of payables) {
const closingRate = rateMap.get(si.currency as Currency)?.rate
if (!closingRate || !si.exchange_rate) continue
const amountInCurrency = si.remaining_amount
if (amountInCurrency <= 0) continue
const originalSek = Math.round(amountInCurrency * si.exchange_rate * 100) / 100
const closingSek = Math.round(amountInCurrency * closingRate * 100) / 100
const difference = Math.round((closingSek - originalSek) * 100) / 100
if (Math.abs(difference) < 0.01) continue
items.push({
type: 'payable',
source_id: si.id,
reference: si.supplier_invoice_number,
currency: si.currency as Currency,
amount_in_currency: amountInCurrency,
original_rate: si.exchange_rate,
closing_rate: closingRate,
original_sek: originalSek,
closing_sek: closingSek,
difference_sek: difference,
})
}
// Build aggregated journal lines
let debit1510 = 0 // Receivable gain (revalue up)
let credit1510 = 0 // Receivable loss (revalue down)
let debit2440 = 0 // Payable gain (liability shrank)
let credit2440 = 0 // Payable loss (liability grew)
let credit3960 = 0 // Gains
let debit7960 = 0 // Losses
for (const item of items) {
if (item.type === 'receivable') {
if (item.difference_sek > 0) {
// Closing > original → gain: Debit 1510, Credit 3960
debit1510 += item.difference_sek
credit3960 += item.difference_sek
} else {
// Closing < original → loss: Credit 1510, Debit 7960
credit1510 += Math.abs(item.difference_sek)
debit7960 += Math.abs(item.difference_sek)
}
} else {
// Payable
if (item.difference_sek > 0) {
// Closing > original → loss (liability grew): Debit 7960, Credit 2440
debit7960 += item.difference_sek
credit2440 += item.difference_sek
} else {
// Closing < original → gain (liability shrank): Debit 2440, Credit 3960
debit2440 += Math.abs(item.difference_sek)
credit3960 += Math.abs(item.difference_sek)
}
}
}
const lines: CreateJournalEntryLineInput[] = []
if (debit1510 > 0) {
lines.push({
account_number: '1510',
debit_amount: Math.round(debit1510 * 100) / 100,
credit_amount: 0,
line_description: 'Omvärdering kundfordringar — orealiserad kursvinst',
})
}
if (credit1510 > 0) {
lines.push({
account_number: '1510',
debit_amount: 0,
credit_amount: Math.round(credit1510 * 100) / 100,
line_description: 'Omvärdering kundfordringar — orealiserad kursförlust',
})
}
if (debit2440 > 0) {
lines.push({
account_number: '2440',
debit_amount: Math.round(debit2440 * 100) / 100,
credit_amount: 0,
line_description: 'Omvärdering leverantörsskulder — orealiserad kursvinst',
})
}
if (credit2440 > 0) {
lines.push({
account_number: '2440',
debit_amount: 0,
credit_amount: Math.round(credit2440 * 100) / 100,
line_description: 'Omvärdering leverantörsskulder — orealiserad kursförlust',
})
}
if (credit3960 > 0) {
lines.push({
account_number: '3960',
debit_amount: 0,
credit_amount: Math.round(credit3960 * 100) / 100,
line_description: 'Orealiserade valutakursvinster',
})
}
if (debit7960 > 0) {
lines.push({
account_number: '7960',
debit_amount: Math.round(debit7960 * 100) / 100,
credit_amount: 0,
line_description: 'Orealiserade valutakursförluster',
})
}
const totalGain = Math.round(credit3960 * 100) / 100
const totalLoss = Math.round(debit7960 * 100) / 100
const netEffect = Math.round((totalGain - totalLoss) * 100) / 100
return {
items,
lines,
closingRates,
totalGain,
totalLoss,
netEffect,
}
}
/**
* Execute currency revaluation for a fiscal period.
* Creates a journal entry with source_type 'currency_revaluation'.
*
* Returns null if no foreign-currency items exist.
* Throws if a revaluation entry already exists for this period (idempotency).
*/
export async function executeCurrencyRevaluation(
supabase: SupabaseClient,
companyId: string,
closingDate: string,
fiscalPeriodId: string,
userId?: string
): Promise<CurrencyRevaluationResult | null> {
// Idempotency check: prevent double revaluation
const { count, error: checkError } = await supabase
.from('journal_entries')
.select('id', { count: 'exact', head: true })
.eq('company_id', companyId)
.eq('fiscal_period_id', fiscalPeriodId)
.eq('source_type', 'currency_revaluation')
.eq('status', 'posted')
if (checkError) {
throw new BookkeepingDatabaseError('check_existing_revaluation', checkError.message)
}
if ((count ?? 0) > 0) {
throw new CurrencyRevaluationAlreadyExistsError()
}
const preview = await previewCurrencyRevaluation(supabase, companyId, closingDate)
if (preview.items.length === 0 || preview.lines.length === 0) {
return null
}
const entry = await createJournalEntry(supabase, companyId, userId ?? companyId, {
fiscal_period_id: fiscalPeriodId,
entry_date: closingDate,
description: `Omvärdering utländsk valuta ${closingDate}`,
source_type: 'currency_revaluation',
voucher_series: 'A',
lines: preview.lines,
})
return { entry, preview }
}