* fix: surface active TIC companies + block duplicate org numbers
Three fixes from live-prod testing:
1. Enrichment filter hid the user's directorships. Now accepts both
Completed and PartiallyCompleted status from TIC (tenants without
CompanyRoles enabled still get SPAR) and the /select-company role
filter no longer requires companyStatus === 'Aktivt' — real TIC
payloads have been observed with different values, and positionEnd
alone is the authoritative "currently a director" signal. Added
PII-free diagnostic logs so the next shape-mismatch is debuggable
from Vercel logs without a round trip.
2. Manual wizard silently allowed duplicate org numbers. Added:
- findExistingCompanyByOrgNumber helper in actions.ts (service role,
bypasses RLS to see cross-tenant rows)
- Server-side guard in createCompanyFromOnboarding — returns
'org_number_exists' before the create RPC so we don't leave ghost
companies
- New /api/company/check-org-number endpoint for debounced client
checks
- Warning + disabled submit in Step2CompanyDetails
- Friendly error toasts in WelcomeOnboarding + BankIdCompanyPicker
- Mirror cleaned org_number onto companies.org_number on creation so
future duplicate checks and lookups are reliable
3. /onboarding ignored ?org_number= when the picker routed there as a
fallback. Now reads searchParams and pre-fills settings; also fixed
a latent bug where Step1's entity-type change wiped the pre-fill on
*first* selection (it should only reset on a genuine change).
Tests: duplicate-org guard (with formatted-input normalization),
check-org-number route (auth + 400 + exists true/false +
normalization).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: address PR review feedback on duplicate-org guard
Greptile P1 findings + swedish-compliance feedback:
- findExistingCompanyByOrgNumber now throws on Supabase error instead
of silently returning null. Previously a DB outage or RLS
misconfiguration would bypass the entire duplicate guard and allow
duplicates through.
- createCompanyFromOnboarding catches the throw and returns a
user-facing error ("Kunde inte verifiera organisationsnummer"),
failing closed instead of open.
- companies.update({ org_number }) error is now checked and triggers a
rollback. Silent failure would leave the company without an
org_number, breaking all future duplicate checks for that entity.
- New normalizeOrgNumber helper validates 10- or 12-digit input,
strips the century prefix for 12-digit personnummer form, and
rejects anything else. Malformed input would have corrupted SIE4
(#ORGNR) and SRU (INFO.SRU) exports downstream.
- /select-company now uses loose `== null` for positionEnd — TIC has
been observed returning `undefined` for open-ended positions, which
strict `=== null` would silently filter out. Documented the two
downstream isCeased guards so future maintainers don't remove one
without the other.
- createCompanyFromTicRole refuses to provision when lookup.isCeased
(BFL 2 kap — bokföringsskyldighet ends at avregistrering).
BankIdCompanyPicker surfaces this client-side too.
- WelcomeOnboarding + BankIdCompanyPicker recognise new error codes:
org_number_invalid, company_ceased.
Tests: +4 cases covering malformed input rejection, fail-closed
behaviour on DB error, 12-digit personnummer normalization, and the
ceased-company refusal path. Full suite: 2306 passing.
Out of scope for this PR (follow-up):
- Partial unique index on companies(org_number) WHERE archived_at IS
NULL. Closes the race-condition window but needs a migration plus
any existing-duplicate cleanup — too risky for this hotfix.
- Rate limiting on /api/company/check-org-number. Endpoint is
auth-gated so not an immediate concern.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix: add Luhn validation and extract org-number normalization
Third round of PR review feedback (swedish-compliance):
- Add Luhn-10 check-digit validation to normalizeOrgNumber. Rejects
structurally invalid org_numbers (wrong check digit) at the boundary
instead of letting them propagate into SIE4 #ORGNR and SRU INFO.SRU,
where Skatteverket and receiving accounting systems would reject
them later anyway. Reuses the existing luhnValidate helper from
lib/bankgiro/luhn.ts (Bankgirot 10-modulen — same algorithm applies
to both Bolagsverket org numbers and Swedish personnummer).
- Extract normalizeOrgNumber into lib/company-lookup/normalize-org-number.ts
so the server action and /api/company/check-org-number use the same
rule. Previously the API route only stripped hyphens/spaces, so a
12-digit input would miss a stored 10-digit duplicate and mislead the
client debounce check ("not a duplicate" → submit → server rejects).
- /api/company/check-org-number now returns exists=false for
Luhn-invalid input rather than querying the DB. The submit-time
server action surfaces org_number_invalid, which is the right place
for the error.
Test coverage: dedicated normalize-org-number.test.ts (10 cases
covering both-lengths, Luhn, whitespace tolerance, garbage). Updated
existing tests to use Luhn-valid numbers (real Volvo 5560125790,
synthetic personnummer 8001011231). New failing-Luhn test in
actions.test.ts. New 12-digit-normalization and
luhn-invalid-returns-false tests in route.test.ts.
Full suite: 2315 passing.
Not fixed (out of scope for this hotfix):
- 10↔12 digit round-trip fragility for personnummer born 2000+. This
is a codebase-wide architectural choice (see lib/skatteverket/format.ts
which uses a two-digit-year heuristic to choose 19/20 at export).
Migrating to 12-digit storage is a separate refactor.
- Server-side re-fetch of TIC /lookup for isCeased. The trust boundary
here is user-to-their-own-onboarding, not adversarial; doubling TIC
API cost isn't proportionate.
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
384 lines
14 KiB
TypeScript
384 lines
14 KiB
TypeScript
'use client'
|
|
|
|
import { useState, useEffect } from 'react'
|
|
import { useRouter } from 'next/navigation'
|
|
import { createClient } from '@/lib/supabase/client'
|
|
import { createCompanyFromOnboarding } from '@/lib/company/actions'
|
|
import { computeFiscalPeriod } from '@/lib/company/compute-fiscal-period'
|
|
import { useToast } from '@/components/ui/use-toast'
|
|
import { Loader2, Building2 } from 'lucide-react'
|
|
import { cn } from '@/lib/utils'
|
|
import { ENABLED_EXTENSION_IDS } from '@/lib/extensions/_generated/enabled-extensions'
|
|
import type { CompanyLookupResult } from '@/lib/company-lookup/types'
|
|
import type { CompanySettings, EntityType, MomsPeriod } from '@/types'
|
|
|
|
import Step1EntityType from '@/components/onboarding/Step1EntityType'
|
|
import Step2CompanyDetails from '@/components/onboarding/Step2CompanyDetails'
|
|
import Step3TaxRegistration from '@/components/onboarding/Step3TaxRegistration'
|
|
import Step4VatAccounting from '@/components/onboarding/Step4VatAccounting'
|
|
|
|
const STEP_INFO = [
|
|
{ title: 'Företagsform', subtitle: 'Välj din företagsform för att komma igång.' },
|
|
{ title: 'Uppgifter', subtitle: 'Uppgifterna visas på fakturor och dokument.' },
|
|
{ title: 'F-skatt & räkenskapsår', subtitle: 'Ange din skatteregistrering och räkenskapsår.' },
|
|
{ title: 'Moms & bokföring', subtitle: 'Momsregistrering och bokföringsmetod.' },
|
|
]
|
|
|
|
function translatePeriodError(msg: string): string {
|
|
if (msg.includes('end must be after')) return 'Slutdatumet måste vara efter startdatumet.'
|
|
if (msg.includes('start must be the 1st')) return 'Startdatumet måste vara den 1:a i en månad.'
|
|
if (msg.includes('end must be the last day')) return 'Slutdatumet måste vara sista dagen i en månad.'
|
|
if (msg.includes('exceeds maximum 18 months')) return 'Räkenskapsåret får inte överstiga 18 månader (BFL 3 kap.).'
|
|
return 'Ogiltigt räkenskapsår. Kontrollera datumen och försök igen.'
|
|
}
|
|
|
|
const LOG = '[welcome-onboarding]'
|
|
|
|
function logError(message: string, extra?: Record<string, unknown>) {
|
|
console.error(LOG, message, extra ?? '')
|
|
fetch('/api/log', {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({ message: `welcome-onboarding: ${message}`, extra }),
|
|
}).catch(() => {})
|
|
}
|
|
|
|
interface WelcomeOnboardingProps {
|
|
firstName?: string | null
|
|
teamId: string
|
|
skipWelcome?: boolean
|
|
hasExistingCompanies?: boolean
|
|
/** Pre-fill Step 2 org_number when the picker routed here via ?org_number=. */
|
|
initialOrgNumber?: string
|
|
}
|
|
|
|
export default function WelcomeOnboarding({
|
|
firstName,
|
|
teamId,
|
|
skipWelcome,
|
|
hasExistingCompanies,
|
|
initialOrgNumber,
|
|
}: WelcomeOnboardingProps) {
|
|
const router = useRouter()
|
|
const { toast } = useToast()
|
|
const supabase = createClient()
|
|
|
|
const [started, setStarted] = useState(skipWelcome ?? false)
|
|
const [isLoading, setIsLoading] = useState(true)
|
|
const [isSaving, setIsSaving] = useState(false)
|
|
const [currentStep, setCurrentStep] = useState(1)
|
|
const [settings, setSettings] = useState<Partial<CompanySettings>>(
|
|
initialOrgNumber ? { org_number: initialOrgNumber } : {},
|
|
)
|
|
const ticEnabled = ENABLED_EXTENSION_IDS.has('tic')
|
|
const [ticLookup, setTicLookup] = useState<CompanyLookupResult | null>(null)
|
|
|
|
const totalSteps = 4
|
|
|
|
const hour = new Date().getHours()
|
|
const greeting = hour < 5 ? 'God natt' : hour < 10 ? 'Godmorgon' : hour < 14 ? 'Hej' : hour < 18 ? 'God eftermiddag' : 'God kväll'
|
|
|
|
// Pre-fill the user's folkbokföringsadress from BankID/SPAR enrichment when
|
|
// available. The row is persisted (not consumed here) so /select-company and
|
|
// repeat /onboarding visits still see it; it's deleted only once a company
|
|
// is successfully created (see createCompanyFromOnboarding).
|
|
useEffect(() => {
|
|
async function loadSparAddress() {
|
|
const { data: { user } } = await supabase.auth.getUser()
|
|
if (!user) {
|
|
router.push('/login')
|
|
return
|
|
}
|
|
|
|
try {
|
|
const { data: enrichmentRow } = await supabase
|
|
.from('extension_data')
|
|
.select('value')
|
|
.eq('user_id', user.id)
|
|
.eq('extension_id', 'tic')
|
|
.eq('key', 'bankid_enrichment')
|
|
.maybeSingle()
|
|
|
|
const spar = (enrichmentRow?.value as { spar?: Record<string, string> } | null)?.spar
|
|
if (spar) {
|
|
setSettings((prev) => ({
|
|
...prev,
|
|
address_line1: spar.Folkbokforingsadress_SvenskAdress_Utdelningsadress1 || prev.address_line1,
|
|
postal_code: spar.Folkbokforingsadress_SvenskAdress_PostNr || prev.postal_code,
|
|
city: spar.Folkbokforingsadress_SvenskAdress_Postort || prev.city,
|
|
}))
|
|
}
|
|
} catch (err) {
|
|
console.warn(LOG, 'enrichment loading failed (non-blocking)', err)
|
|
}
|
|
|
|
setIsLoading(false)
|
|
}
|
|
|
|
loadSparAddress()
|
|
}, [supabase, router])
|
|
|
|
const handleNext = async (stepData: Partial<CompanySettings>) => {
|
|
// Reset org_number/company_name only on a genuine change (user going back
|
|
// and picking a different entity type). First-time selection must not
|
|
// wipe a pre-fill (e.g. ?org_number= deep-link from /select-company).
|
|
if (
|
|
currentStep === 1 &&
|
|
stepData.entity_type &&
|
|
settings.entity_type &&
|
|
stepData.entity_type !== settings.entity_type
|
|
) {
|
|
stepData = { ...stepData, org_number: '', company_name: '' }
|
|
setTicLookup(null)
|
|
}
|
|
|
|
const mergedSettings = { ...settings, ...stepData }
|
|
|
|
// Validate fiscal period at step 3 before advancing
|
|
if (currentStep === 3) {
|
|
const periodResult = computeFiscalPeriod(mergedSettings)
|
|
if (periodResult.error) {
|
|
toast({
|
|
title: 'Ogiltigt räkenskapsår',
|
|
description: translatePeriodError(periodResult.error),
|
|
variant: 'destructive',
|
|
})
|
|
return
|
|
}
|
|
}
|
|
|
|
// Steps 1-3: collect data client-side only, advance step
|
|
if (currentStep < totalSteps) {
|
|
setSettings(mergedSettings)
|
|
setCurrentStep(currentStep + 1)
|
|
return
|
|
}
|
|
|
|
// Step 4 (final): create everything via server action.
|
|
// Going through a server action ensures that if the Next.js server is
|
|
// unreachable, nothing touches Supabase — no ghost companies.
|
|
const periodResult = computeFiscalPeriod(mergedSettings)
|
|
if (periodResult.error) {
|
|
toast({
|
|
title: 'Ogiltigt räkenskapsår',
|
|
description: translatePeriodError(periodResult.error),
|
|
variant: 'destructive',
|
|
})
|
|
return
|
|
}
|
|
|
|
setIsSaving(true)
|
|
try {
|
|
const result = await createCompanyFromOnboarding({
|
|
teamId,
|
|
settings: mergedSettings as Record<string, unknown>,
|
|
fiscalPeriod: {
|
|
startDate: periodResult.startStr,
|
|
endDate: periodResult.endStr,
|
|
name: periodResult.periodName,
|
|
},
|
|
})
|
|
|
|
if (result.error || !result.companyId) {
|
|
logError('create company action failed', { error: result.error })
|
|
let title = 'Fel'
|
|
let description: string = result.error || 'Kunde inte skapa företag. Försök igen.'
|
|
let backToStep2 = false
|
|
if (result.error === 'org_number_exists') {
|
|
title = 'Företaget finns redan'
|
|
description = 'Det här företaget finns redan i gnubok. Be en befintlig administratör att bjuda in dig.'
|
|
backToStep2 = true
|
|
} else if (result.error === 'org_number_invalid') {
|
|
title = 'Ogiltigt organisationsnummer'
|
|
description = 'Kontrollera att du angett ett giltigt 10- eller 12-siffrigt organisationsnummer.'
|
|
backToStep2 = true
|
|
}
|
|
toast({
|
|
title,
|
|
description,
|
|
variant: 'destructive',
|
|
})
|
|
// Back user up to step 2 so they can correct the org number.
|
|
if (backToStep2) {
|
|
setCurrentStep(2)
|
|
}
|
|
return
|
|
}
|
|
|
|
console.log(LOG, 'onboarding completed', result.companyId)
|
|
toast({
|
|
title: 'Välkommen!',
|
|
description: 'Ditt företag är nu redo.',
|
|
})
|
|
router.push('/')
|
|
} catch (err) {
|
|
const message = err instanceof Error ? err.message : String(err)
|
|
logError('create company action threw', { error: message })
|
|
toast({ title: 'Fel', description: 'Ett oväntat fel uppstod. Försök igen.', variant: 'destructive' })
|
|
} finally {
|
|
setIsSaving(false)
|
|
}
|
|
}
|
|
|
|
const handleBack = () => {
|
|
if (currentStep > 1) {
|
|
setCurrentStep(currentStep - 1)
|
|
}
|
|
}
|
|
|
|
if (isLoading) {
|
|
return (
|
|
<div className="flex items-center justify-center py-20">
|
|
<Loader2 className="h-8 w-8 animate-spin text-muted-foreground" />
|
|
</div>
|
|
)
|
|
}
|
|
|
|
const stepInfo = STEP_INFO[currentStep - 1]
|
|
|
|
// Welcome screen — show before user clicks "Lägg till ditt första företag"
|
|
if (!started) {
|
|
return (
|
|
<div className="flex flex-col items-start justify-center min-h-[60vh] animate-fade-in">
|
|
<p className="text-muted-foreground/50 text-sm mb-2">{greeting}</p>
|
|
<h1 className="font-display text-4xl md:text-5xl font-medium tracking-tight leading-[1.05] mb-10">
|
|
Välkommen till Gnubok
|
|
</h1>
|
|
<button
|
|
onClick={() => setStarted(true)}
|
|
className="px-5 py-2.5 rounded-lg bg-foreground text-background text-sm font-medium hover:bg-foreground/85 transition-colors duration-150 active:scale-[0.98]"
|
|
>
|
|
{hasExistingCompanies ? 'Lägg till ett företag' : 'Lägg till ditt första företag'}
|
|
</button>
|
|
</div>
|
|
)
|
|
}
|
|
|
|
return (
|
|
<div className="stagger-enter">
|
|
{/* Greeting header */}
|
|
<header className="mb-10">
|
|
<h1 className="font-display text-2xl md:text-3xl font-medium tracking-tight">
|
|
{greeting}{firstName ? `, ${firstName}` : ''}
|
|
</h1>
|
|
<p className="text-muted-foreground text-sm mt-1.5">
|
|
{hasExistingCompanies ? 'Lägg till ett företag.' : 'Lägg till ditt första företag för att komma igång.'}
|
|
</p>
|
|
</header>
|
|
|
|
{/* Onboarding card */}
|
|
<div className="max-w-lg">
|
|
<div className="rounded-xl border bg-card overflow-hidden" style={{ boxShadow: 'var(--shadow-md)' }}>
|
|
{/* Card header with step info */}
|
|
<div className="bg-[#141414] text-white px-6 py-5 relative overflow-hidden">
|
|
<div className="absolute inset-0 pointer-events-none" aria-hidden>
|
|
<div
|
|
className="absolute inset-0"
|
|
style={{
|
|
background: 'radial-gradient(ellipse at 30% -20%, rgba(255,255,255,0.04) 0%, transparent 50%)',
|
|
}}
|
|
/>
|
|
</div>
|
|
|
|
<div className="relative z-10">
|
|
<div className="flex items-center justify-between mb-3">
|
|
<div className="flex items-center gap-2">
|
|
<Building2 className="h-4 w-4 text-white/60" />
|
|
<span className="text-xs text-white/40 tracking-wide uppercase">Nytt företag</span>
|
|
</div>
|
|
<div className="flex items-center gap-1.5">
|
|
{STEP_INFO.map((_, i) => {
|
|
const num = i + 1
|
|
return (
|
|
<div
|
|
key={i}
|
|
className={cn(
|
|
'h-[3px] rounded-full transition-all duration-500',
|
|
num === currentStep && 'w-6 bg-white',
|
|
num < currentStep && 'w-3 bg-white/50',
|
|
num > currentStep && 'w-3 bg-white/[0.1]',
|
|
)}
|
|
/>
|
|
)
|
|
})}
|
|
<span className="text-[10px] text-white/30 ml-1.5">
|
|
{currentStep}/{totalSteps}
|
|
</span>
|
|
</div>
|
|
</div>
|
|
|
|
<h2 className="font-display text-lg font-medium tracking-tight leading-tight">
|
|
{stepInfo.title}
|
|
</h2>
|
|
<p className="text-white/40 mt-1 text-sm">
|
|
{stepInfo.subtitle}
|
|
</p>
|
|
</div>
|
|
</div>
|
|
|
|
{/* Form content */}
|
|
<div className="px-6 py-6">
|
|
<div key={`step-${currentStep}`} className="animate-slide-up">
|
|
{currentStep === 1 && (
|
|
<Step1EntityType
|
|
initialData={{ entity_type: settings.entity_type as EntityType }}
|
|
onNext={(data) => handleNext(data)}
|
|
isSaving={isSaving}
|
|
/>
|
|
)}
|
|
|
|
{currentStep === 2 && (
|
|
<Step2CompanyDetails
|
|
key={settings.entity_type}
|
|
initialData={{
|
|
company_name: settings.company_name ?? undefined,
|
|
org_number: settings.org_number ?? undefined,
|
|
address_line1: settings.address_line1 ?? undefined,
|
|
postal_code: settings.postal_code ?? undefined,
|
|
city: settings.city ?? undefined,
|
|
}}
|
|
entityType={settings.entity_type as EntityType}
|
|
ticEnabled={ticEnabled}
|
|
onTicLookup={setTicLookup}
|
|
onNext={(data) => handleNext(data)}
|
|
onBack={handleBack}
|
|
isSaving={isSaving}
|
|
/>
|
|
)}
|
|
|
|
{currentStep === 3 && (
|
|
<Step3TaxRegistration
|
|
initialData={{
|
|
f_skatt: settings.f_skatt ?? (ticLookup ? ticLookup.registration.fTax : undefined),
|
|
fiscal_year_start_month: settings.fiscal_year_start_month ?? undefined,
|
|
}}
|
|
entityType={settings.entity_type as EntityType}
|
|
onNext={(data) => handleNext(data)}
|
|
onBack={handleBack}
|
|
isSaving={isSaving}
|
|
/>
|
|
)}
|
|
|
|
{currentStep === 4 && (
|
|
<Step4VatAccounting
|
|
initialData={{
|
|
vat_registered: settings.vat_registered ?? (ticLookup ? ticLookup.registration.vat : undefined),
|
|
vat_number: settings.vat_number ?? undefined,
|
|
moms_period: (settings.moms_period as MomsPeriod | null) ?? undefined,
|
|
accounting_method: (settings.accounting_method as 'accrual' | 'cash') ?? undefined,
|
|
}}
|
|
entityType={settings.entity_type as EntityType}
|
|
orgNumber={settings.org_number ?? undefined}
|
|
onNext={(data) => handleNext(data)}
|
|
onBack={handleBack}
|
|
isSaving={isSaving}
|
|
/>
|
|
)}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
)
|
|
}
|