MattssonandClaude Opus 4.7
32d9978f1b
* feat: add option to exclude year-end closing entries in SIE export and related reports * delete docs * fix: allow Chrome's PDF viewer in verifikat document preview The /api/documents/:id/inline route shipped with `object-src 'none'` in its CSP, which blocked Chrome's built-in PDF viewer (it renders inline PDFs via an internal <embed>). Users on Chrome saw "Det här innehållet har blockerats" when expanding a PDF attachment in the bookkeeping view; Firefox (PDF.js) and Edge (own viewer) were unaffected, and JPGs worked because <img> isn't subject to object-src. Drops the CSP for this route to the minimum needed for embeddability: `frame-ancestors 'self'`. X-Content-Type-Options: nosniff plus the fixed Content-Type from the handler already block MIME confusion; X-Frame-Options: SAMEORIGIN + frame-ancestors still block clickjacking. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * feat(auth): add webmail deep link to email confirmation screens Mirrors Stripe's signup UX: after asking the user to verify their email, detect their webmail provider from the domain and show a button that opens the inbox in a new tab. Gmail gets a from:<sender> search pre-populated; Outlook/Yahoo/iCloud/Proton open the inbox directly. Unknown / custom domains fall back to the existing copy. Sender address is configurable via NEXT_PUBLIC_BRANDING_AUTH_EMAIL_FROM (default noreply@gnubok.se) so white-label installs can match their Supabase Auth SMTP config. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(auth): unblock first-time password set for BankID users with MFA Supabase rejects updateUser({password}) and mfa.unenroll with "AAL2 session is required" whenever a TOTP factor is enrolled. BankID magic-link logins produce AAL1, and middleware skips MFA enforcement for bankid_linked users, so they had no path to AAL2 — leaving them unable to set a backup password or disable MFA without going through the email-recovery escape hatch. - /api/account/password: branch on app_metadata.has_password. First-time set writes via service.auth.admin.updateUserById (no existing credential to protect, AAL2 guard does not apply). Change-password keeps the user-session updateUser so AAL2 still fires for credential rotation. - /mfa/verify: accept a safeReturnTo query param and route there after successful verify, so step-up flows can land back where they came from. - SecuritySettings: detect the AAL2 error from both change-password and mfa.unenroll and redirect through /mfa/verify?returnTo=/settings/account instead of toasting a dead-end error. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * Add tests and rounding utility for öre precision in bokslut calculations - Implemented `roundOre` function for rounding SEK amounts to two decimal places, ensuring consistent monetary calculations. - Introduced `ORE_TOLERANCE` constant for comparing rounded amounts, facilitating invariant checks in financial entries. - Created comprehensive tests for `roundOre`, covering typical cases, edge cases, and idempotency. - Added year-end invariants tests to verify database-level guarantees for closing entries, ensuring they balance to the öre and reject discrepancies. - Developed end-to-end tests for the dispositions chain, validating the correctness of calculations across various scenarios. * fix: update PDF rendering to remove Swish QR code generation and set default to disable Swish visibility * fix: enhance security by rejecting data URIs in safeReturnTo function tests * fix: improve rounding logic in roundOre function and add customer_type migration * fix: add customer_type column to customers and enforce CHECK constraint --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
114 lines
3.7 KiB
TypeScript
114 lines
3.7 KiB
TypeScript
import type { SalaryLineItemType } from '@/types'
|
|
|
|
/**
|
|
* Salary account mapping — maps line item types and calculation results
|
|
* to BAS accounts per Swedish chart of accounts standards.
|
|
*/
|
|
|
|
/** Default BAS account for each salary line item type */
|
|
const LINE_ITEM_ACCOUNTS: Record<SalaryLineItemType, string> = {
|
|
// Salary components
|
|
monthly_salary: '7210',
|
|
hourly_salary: '7210',
|
|
overtime: '7210',
|
|
overtime_50: '7210',
|
|
overtime_100: '7210',
|
|
// OB-tillägg — bookat på samma lönekonto som grundlönen; differentieras via
|
|
// rad-text på verifikatet och lönespecifikationen.
|
|
ob_weekday_evening: '7210',
|
|
ob_weekend: '7210',
|
|
ob_night: '7210',
|
|
ob_holiday: '7210',
|
|
bonus: '7210',
|
|
commission: '7210',
|
|
// Gross deductions
|
|
gross_deduction_pension: '7218',
|
|
gross_deduction_other: '7210',
|
|
// Benefits (förmånsvärden — not a cash payment, just tax base)
|
|
benefit_car: '7385',
|
|
benefit_housing: '7381',
|
|
benefit_meals: '7382',
|
|
benefit_wellness: '7699',
|
|
benefit_bike: '7388',
|
|
benefit_other: '7389',
|
|
// Absence
|
|
sick_karens: '7281',
|
|
sick_day2_14: '7281',
|
|
sick_day15_plus: '7281',
|
|
vab: '7210',
|
|
parental_leave: '7210',
|
|
vacation: '7285',
|
|
semesterersattning: '7285',
|
|
// Travel
|
|
traktamente_taxfree: '7321',
|
|
traktamente_taxable: '7322',
|
|
mileage_taxfree: '7331',
|
|
mileage_taxable: '7332',
|
|
// Net deductions
|
|
net_deduction_advance: '7210',
|
|
net_deduction_union: '7210',
|
|
net_deduction_benefit_payment: '7385',
|
|
net_deduction_other: '7210',
|
|
// Other
|
|
correction: '7210',
|
|
other: '7210',
|
|
}
|
|
|
|
/**
|
|
* Get the BAS account number for a salary line item type.
|
|
* Can be overridden per line item via account_number field.
|
|
*/
|
|
export function getLineItemAccount(
|
|
itemType: SalaryLineItemType,
|
|
employmentType: string = 'employee'
|
|
): string {
|
|
// Company owner uses 7220 instead of 7210
|
|
if (employmentType === 'company_owner') {
|
|
const baseAccount = LINE_ITEM_ACCOUNTS[itemType]
|
|
if (baseAccount === '7210') return '7220'
|
|
if (baseAccount === '7281') return '7282'
|
|
if (baseAccount === '7285') return '7286'
|
|
}
|
|
|
|
// Board member uses 7240
|
|
if (employmentType === 'board_member') {
|
|
const baseAccount = LINE_ITEM_ACCOUNTS[itemType]
|
|
if (baseAccount === '7210') return '7240'
|
|
}
|
|
return LINE_ITEM_ACCOUNTS[itemType]
|
|
}
|
|
|
|
/** Journal entry accounts for salary booking */
|
|
export const SALARY_ACCOUNTS = {
|
|
// Salary expense (debit)
|
|
SALARY_EMPLOYEE: '7210', // Löner till tjänstemän
|
|
SALARY_OWNER: '7220', // Löner till företagsledare
|
|
SALARY_BOARD: '7240', // Styrelsearvoden
|
|
SICK_PAY: '7281', // Sjuklöner
|
|
VACATION_PAY: '7285', // Semesterlöner
|
|
|
|
// Tax withholding (credit)
|
|
TAX_WITHHELD: '2710', // Personalskatt
|
|
|
|
// Bank / payment (credit)
|
|
BANK: '1930', // Företagskonto
|
|
|
|
// Employer contributions
|
|
AVGIFTER_EXPENSE: '7510', // Lagstadgade sociala avgifter (debit)
|
|
AVGIFTER_LIABILITY: '2731', // Avräkning sociala avgifter (credit)
|
|
|
|
// Vacation accrual
|
|
VACATION_ACCRUAL_EXPENSE: '7290', // Förändring semesterlöneskuld (debit)
|
|
VACATION_ACCRUAL_LIABILITY: '2920', // Upplupna semesterlöner (credit)
|
|
|
|
// Vacation accrual avgifter
|
|
VACATION_AVGIFTER_EXPENSE: '7519', // Sociala avgifter semester (debit)
|
|
VACATION_AVGIFTER_LIABILITY: '2940', // Upplupna sociala avgifter (credit)
|
|
|
|
// Pension provisions (löneväxling)
|
|
PENSION_EXPENSE: '7410', // Pensionsförsäkringspremier (debit)
|
|
PENSION_LIABILITY: '2740', // Skuld pensionsförsäkringar (credit)
|
|
SLP_EXPENSE: '7533', // Särskild löneskatt på pensionskostnader (debit)
|
|
SLP_LIABILITY: '2514', // Beräknad särskild löneskatt (credit)
|
|
} as const
|