* feat(onboarding): company setup from the conversation and POST /api/v1/companies Third PR of agent-first onboarding (#1814). Once connected, the agent can now set up a company end to end without the web wizard, and partner platforms can provision companies over REST. - create_company_for_user: service-role-only SECURITY DEFINER twin of create_company_with_owner taking the owner explicitly (service clients have no auth.uid()). pg-real test covers creation, role gating, unknown owner and foreign team. - lib/company/create-company.ts: the wizard's creation sequence (org number, TIC snapshot, BAS chart, settings, first fiscal period, tax deadlines, rollback) extracted into createCompanyCore; the Server Action delegates to it, behaviour unchanged. - lib/company/onboarding-input.ts: one Zod schema + planner for the agent/API paths; a VAT-registered company without moms_period is refused (a missing period silently yields zero VAT deadlines). - MCP: gnubok_create_company (two-phase: preview, then confirm=true; companies:write, company-independent), gnubok_connect_bank and gnubok_connect_skatteverket (status + the browser link, gated on bank_sync / skatteverket, search-only in the catalog), the "onboarding" skill, and initialize instructions pointing at it. - Consent page pre-ticks companies:write for an account with no company yet, so the setup does not dead-end on insufficient scope after signup. - POST /api/v1/companies (companies:write, dry-run aware) on the same core; scope map, registry, spec snapshot and the generated API skill updated. - tools/list payload ceiling raised 59.95K -> 60.4K for the one new default-catalog tool (documented in the guard). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(onboarding): explicit f_skatt, org number when VAT-registered, EF first year ends 31 Dec Review findings on #1864 (Swedish compliance review): - f_skatt is required, never defaulted to approved (SE-R-005 risk). - org_number is required when vat_registered: the invoice momsregistreringsnummer derives from it (ML 17 kap 24 §). - An enskild firma's first fiscal year must end on 31 December and its start month is forced to 1 even with first_fiscal_year set, mirroring the wizard's own rule text (BFL 3 kap. 1 §). - POST /api/v1/companies no longer claims Idempotency-Key support (the wrapper only honours it on company-scoped routes). - pg-real: createCompanyCore's chart seed runs under the real service_role, which the unit tests could not prove. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * test(pg): starter chart has 41 accounts, assert non-empty The service_role chart-seed proof passed the part that mattered (no 42501 from seed_chart_of_accounts) and failed on a wrong row-count guess: the seeded chart is a curated starter set, not the full BAS list. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(migrations): move create_company_for_user to 20260825120000 main gained 20260824170000_bulk_book_transactions_service_actor.sql with the same version while this branch was open; two files on one version abort every Supabase branch apply and the prod auto-apply. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * chore(api): refresh spec snapshot and generated skill after rebasing onto main Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 * fix(mcp): flat create_company result, refuse localhost connect links, test hygiene CodeRabbit on #1864: the confirmed-create result was wrapped in the { data, next } envelope while its outputSchema promised top-level fields; it now returns the fields with next as a sibling. The two connect-link tools refuse to build a link when NEXT_PUBLIC_APP_URL is unset instead of handing a remote user a localhost URL. Tests clear mocks and the event bus in beforeEach. Not changed: the rollback already survives user_preferences.active_company_id (that FK is ON DELETE SET NULL since 20260331010000), and v1 error details stay in the surface's English developer convention. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_018wCdzRTatKiDByKB8hCNT6 --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
130 lines
4.9 KiB
TypeScript
130 lines
4.9 KiB
TypeScript
import { beforeEach, describe, expect, it, vi } from 'vitest'
|
|
import { TOOL_SCOPE_MAP } from '@/lib/auth/api-keys'
|
|
import { eventBus } from '@/lib/events/bus'
|
|
|
|
const mocks = vi.hoisted(() => ({
|
|
createCompanyCore: vi.fn(),
|
|
}))
|
|
|
|
vi.mock('@/lib/company/create-company', () => ({
|
|
createCompanyCore: (...args: unknown[]) => mocks.createCompanyCore(...args),
|
|
}))
|
|
|
|
import { tools } from '../server'
|
|
import { isCompanyDependentTool } from '../company-routing'
|
|
|
|
const tool = tools.find((t) => t.name === 'gnubok_create_company')!
|
|
const TEAM_ID = '44444444-4444-4444-8444-444444444444'
|
|
const COMPANY_ID = '55555555-5555-4555-8555-555555555555'
|
|
|
|
function supabaseWithTeam(teamId: string | null) {
|
|
const chain: Record<string, ReturnType<typeof vi.fn>> = {
|
|
select: vi.fn(() => chain),
|
|
eq: vi.fn(() => chain),
|
|
order: vi.fn(() => chain),
|
|
limit: vi.fn(() => chain),
|
|
maybeSingle: vi.fn().mockResolvedValue({ data: teamId ? { team_id: teamId } : null, error: null }),
|
|
}
|
|
return {
|
|
from: vi.fn(() => chain),
|
|
rpc: vi.fn().mockResolvedValue({ data: COMPANY_ID, error: null }),
|
|
}
|
|
}
|
|
|
|
const setup = {
|
|
name: 'Testbolaget AB',
|
|
entity_type: 'aktiebolag',
|
|
org_number: '556000-0001',
|
|
vat_registered: true,
|
|
moms_period: 'quarterly',
|
|
accounting_method: 'accrual',
|
|
f_skatt: true,
|
|
}
|
|
|
|
describe('gnubok_create_company', () => {
|
|
beforeEach(() => {
|
|
vi.clearAllMocks()
|
|
eventBus.clear()
|
|
})
|
|
|
|
it('is a companies:write, company-independent write tool', () => {
|
|
expect(tool).toBeDefined()
|
|
expect(TOOL_SCOPE_MAP.gnubok_create_company).toBe('companies:write')
|
|
expect(isCompanyDependentTool('gnubok_create_company')).toBe(false)
|
|
expect(tool.annotations.readOnlyHint).toBe(false)
|
|
expect(tool.annotations.destructiveHint).toBe(false)
|
|
})
|
|
|
|
it('previews without creating when confirm is not true', async () => {
|
|
const supabase = supabaseWithTeam(TEAM_ID)
|
|
const result = (await tool.execute(setup, '', 'user-1', supabase as never)) as Record<string, unknown>
|
|
|
|
expect(result.created).toBe(false)
|
|
expect(result.requires_confirmation).toBe(true)
|
|
const preview = result.preview as Record<string, unknown>
|
|
expect(preview.org_number).toBe('5560000001')
|
|
expect(preview.vat_number).toBe('SE556000000101')
|
|
expect(preview.team_id).toBe(TEAM_ID)
|
|
expect(preview.fiscal_period).toMatchObject({ name: expect.stringContaining('Räkenskapsår') })
|
|
expect(mocks.createCompanyCore).not.toHaveBeenCalled()
|
|
expect(supabase.rpc).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('creates through the service-role RPC for the key user with confirm=true', async () => {
|
|
const supabase = supabaseWithTeam(TEAM_ID)
|
|
mocks.createCompanyCore.mockImplementation(
|
|
async (_client: unknown, _input: unknown, createRow: () => Promise<{ data: unknown; error: unknown }>) => {
|
|
const { data } = await createRow()
|
|
return { companyId: data as string }
|
|
}
|
|
)
|
|
|
|
const result = (await tool.execute(
|
|
{ ...setup, confirm: true },
|
|
'',
|
|
'user-1',
|
|
supabase as never
|
|
)) as Record<string, unknown>
|
|
|
|
expect(result.created).toBe(true)
|
|
expect(result.company_id).toBe(COMPANY_ID)
|
|
expect(supabase.rpc).toHaveBeenCalledWith('create_company_for_user', {
|
|
p_user_id: 'user-1',
|
|
p_name: 'Testbolaget AB',
|
|
p_entity_type: 'aktiebolag',
|
|
p_team_id: TEAM_ID,
|
|
})
|
|
const [, input] = mocks.createCompanyCore.mock.calls[0] as [unknown, Record<string, unknown>]
|
|
expect(input.settings).toMatchObject({ moms_period: 'quarterly', vat_registered: true, company_name: 'Testbolaget AB' })
|
|
expect((result.next as Record<string, unknown>).tool).toBe('gnubok_load_skill')
|
|
})
|
|
|
|
it('refuses a VAT-registered company without a moms period before touching the database', async () => {
|
|
const supabase = supabaseWithTeam(TEAM_ID)
|
|
await expect(
|
|
tool.execute({ ...setup, moms_period: undefined, confirm: true }, '', 'user-1', supabase as never)
|
|
).rejects.toMatchObject({ code: 'VALIDATION_ERROR', message: expect.stringContaining('moms_period') })
|
|
expect(supabase.rpc).not.toHaveBeenCalled()
|
|
expect(mocks.createCompanyCore).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('uses an explicit team_id over the default team', async () => {
|
|
const supabase = supabaseWithTeam(TEAM_ID)
|
|
const other = '66666666-6666-4666-8666-666666666666'
|
|
const result = (await tool.execute({ ...setup, team_id: other }, '', 'user-1', supabase as never)) as Record<
|
|
string,
|
|
unknown
|
|
>
|
|
expect((result.preview as Record<string, unknown>).team_id).toBe(other)
|
|
expect(supabase.from).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('surfaces a creation failure as a coded error', async () => {
|
|
const supabase = supabaseWithTeam(null)
|
|
mocks.createCompanyCore.mockResolvedValue({ error: 'Kunde inte skapa kontoplan. Försök igen.' })
|
|
await expect(
|
|
tool.execute({ ...setup, confirm: true }, '', 'user-1', supabase as never)
|
|
).rejects.toMatchObject({ code: 'COMPANY_CREATE_FAILED' })
|
|
})
|
|
})
|