* fix(invoices): duplicate-payment guard on customer mark-paid + categorize
Two-pronged fix preventing duplicate verifikationer when a customer
invoice is marked paid OR a 19xx→1510 categorization is applied to an
inbound bank tx that already belongs to an open invoice.
Prong A (mark-paid): before booking, scan unlinked positive business
bank txs from the same customer within ±2% / ±60 days. If candidates
exist, return 409 INVOICE_PAID_LIKELY_DUPLICATE with per-candidate
match_reason (ocr_exact > name_amount_fuzzy > amount_only). Override
via `{ force: true }`. Applied to both legacy /api/invoices/[id]/
mark-paid and v1 /api/v1/.../invoices/[id]/mark-paid; v1 guard runs
before dry-run so previews can't mask the warning.
Prong B (categorize): when the user assigns 1930→1510 directly on a
positive business tx with a matching open customer invoice (by name
OR by OCR-normalized reference), return 409
TX_CATEGORIZE_SUGGEST_CI_MATCH routing them to /match-invoice.
Mirrors the supplier-side guard from #461. Shared helpers
(DUPLICATE_AMOUNT_TOLERANCE_PCT, escapeLikePattern) reused as-is.
New helper normalizeOcrReference() strips non-digits for Swedish OCR
equality. New shared candidate-finder
lib/invoices/duplicate-payment-candidates.ts keeps the legacy and v1
routes calling the same code.
Frontend:
- PaymentBookingDialog intercepts the 409, renders candidate list
with match_reason badges (Exakt OCR-träff / Sannolik träff /
Möjlig träff), offers "Länka transaktion" or "Bokför ändå"
(force-retry generates a fresh Idempotency-Key for v1 callers)
- transactions/page.tsx mirrors siMatchSuggestion handling as
ciMatchSuggestion with a parallel "Matcha mot kundfaktura?" dialog
v1 caveat documented in the route's pitfalls block:
INVOICE_PAID_LIKELY_DUPLICATE force-retry requires a fresh
Idempotency-Key because the original is body-hash bound; reusing it
returns 400 IDEMPOTENCY_KEY_REUSE.
Tests: 5 new mark-paid tests (legacy + v1) covering 409, force
bypass, partial-payment skip, ocr_exact match_reason, multi-candidate
ranking. 1 v1-only test verifying dry-run also surfaces the 409. 2
categorize Prong B tests (409 + confirm_no_match bypass).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* fix(invoices): address compliance-swarm review on duplicate-payment guard
Three review-driven fixes:
1. **PostgREST .or() injection (OWASP V1.2.5).** `escapeLikePattern` neutralises
LIKE wildcards but NOT PostgREST filter-DSL chars (`,`, `.`, `(`, `)`). A
customer name like `Acme,fake.eq.true` could otherwise inject a synthetic
filter clause into the `.or('merchant_name.ilike.%X%,description.ilike.%X%')`
string. Replaced with two parameterised `.ilike()` queries dispatched in
parallel and merged by id in JS. Slight perf cost (two index hits per call),
eliminates the DSL-injection surface entirely.
2. **Date window anchored on invoice_date instead of due_date
(swedish-accounting-compliance bot).** The Prong B categorize intercept
filtered open customer invoices by `invoice_date ± 60d` relative to the
bank-tx date. For invoices with 60–90 day payment terms, the actual
payment lands well after `invoice_date`, so the legitimate match falls
outside the window and the guard silently misses it. Switched to
`due_date ± 60d` — the better proxy for "around when payment is expected."
No corresponding change for Prong A (mark-paid), which is correctly
anchored on `paymentDate` (the user-supplied or default-today date) and
scans bank-tx dates around that anchor.
3. **Force-bypass log enrichment (ISO A.8.15, OWASP V16).** Both
`duplicate-payment guard bypassed` warn entries now include `userId` and
`paymentAmount`. Attribution was previously incomplete — the bypass log
carried only `invoiceId`, which forced a join in log aggregation to
identify the acting principal.
Tests updated for the two-query pattern (legacy mark-paid suite enqueues
two transactions-table responses per guard invocation; v1 tests already
worked with the single-entry-per-table mock semantics).
Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
* chore(docs): redirect /docs/api and /llms-full.txt to docs.gnubok.se
Canonical docs host is now docs.gnubok.se. Every `docs_url` field on the
v1 error envelope still points at /docs/api/* on this app; the 308
permanent redirect forwards humans and agent crawlers to the docs
subdomain without us needing to mass-update structured-errors.ts.
/llms-full.txt also routes through the docs host where it's served from
the docs site's own build.
---------
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
504 lines
19 KiB
TypeScript
504 lines
19 KiB
TypeScript
'use client'
|
|
|
|
import { useState, useEffect, useMemo } from 'react'
|
|
import { useRouter } from 'next/navigation'
|
|
import {
|
|
Dialog,
|
|
DialogContent,
|
|
DialogDescription,
|
|
DialogFooter,
|
|
DialogHeader,
|
|
DialogTitle,
|
|
} from '@/components/ui/dialog'
|
|
import { Button } from '@/components/ui/button'
|
|
import { Input } from '@/components/ui/input'
|
|
import { Label } from '@/components/ui/label'
|
|
import { Badge } from '@/components/ui/badge'
|
|
import { useToast } from '@/components/ui/use-toast'
|
|
import AccountCombobox from '@/components/bookkeeping/AccountCombobox'
|
|
import { proposePaymentLines } from '@/lib/bookkeeping/propose-payment-lines'
|
|
import { getErrorMessage } from '@/lib/errors/get-error-message'
|
|
import { formatCurrency, formatDate } from '@/lib/utils'
|
|
import { createClient } from '@/lib/supabase/client'
|
|
import { useCompany } from '@/contexts/CompanyContext'
|
|
import { Plus, Trash2, Loader2 } from 'lucide-react'
|
|
import type { FormLine } from '@/components/bookkeeping/JournalEntryForm'
|
|
import type { Invoice, InvoiceItem, Customer, BASAccount, EntityType } from '@/types'
|
|
|
|
type DuplicateMatchReason = 'ocr_exact' | 'name_amount_fuzzy' | 'amount_only'
|
|
|
|
interface DuplicateCandidate {
|
|
id: string
|
|
date: string
|
|
amount: number
|
|
description: string | null
|
|
merchant_name: string | null
|
|
reference: string | null
|
|
match_reason: DuplicateMatchReason
|
|
match_confidence: number
|
|
}
|
|
|
|
const MATCH_REASON_LABEL: Record<DuplicateMatchReason, string> = {
|
|
ocr_exact: 'Exakt OCR-träff',
|
|
name_amount_fuzzy: 'Sannolik träff',
|
|
amount_only: 'Möjlig träff',
|
|
}
|
|
|
|
interface InvoiceWithRelations extends Invoice {
|
|
customer: Customer
|
|
items: InvoiceItem[]
|
|
}
|
|
|
|
interface PaymentBookingDialogProps {
|
|
open: boolean
|
|
onOpenChange: (open: boolean) => void
|
|
invoice: InvoiceWithRelations
|
|
onSuccess: () => void
|
|
}
|
|
|
|
const BLANK_LINE: FormLine = { account_number: '', debit_amount: '', credit_amount: '', line_description: '' }
|
|
|
|
export default function PaymentBookingDialog({
|
|
open,
|
|
onOpenChange,
|
|
invoice,
|
|
onSuccess,
|
|
}: PaymentBookingDialogProps) {
|
|
const { toast } = useToast()
|
|
const router = useRouter()
|
|
const supabase = createClient()
|
|
const { company } = useCompany()
|
|
|
|
const [accounts, setAccounts] = useState<BASAccount[]>([])
|
|
const [lines, setLines] = useState<FormLine[]>([])
|
|
const [paymentDate, setPaymentDate] = useState(() => new Date().toISOString().split('T')[0])
|
|
const [isSubmitting, setIsSubmitting] = useState(false)
|
|
const [isInitialized, setIsInitialized] = useState(false)
|
|
const [duplicateCandidates, setDuplicateCandidates] = useState<DuplicateCandidate[] | null>(null)
|
|
|
|
// Load accounts and settings when dialog opens
|
|
useEffect(() => {
|
|
if (!open) {
|
|
setIsInitialized(false)
|
|
setDuplicateCandidates(null)
|
|
return
|
|
}
|
|
|
|
let cancelled = false
|
|
|
|
async function init() {
|
|
try {
|
|
// Fetch accounts
|
|
const accountsRes = await fetch('/api/bookkeeping/accounts')
|
|
if (!accountsRes.ok) throw new Error('Kunde inte ladda kontoplanen')
|
|
const accountsData = await accountsRes.json()
|
|
const fetchedAccounts: BASAccount[] = accountsData.data || []
|
|
|
|
if (!company?.id) throw new Error('Inget aktivt företag')
|
|
|
|
// Fetch company settings
|
|
const { data: settings, error: settingsError } = await supabase
|
|
.from('company_settings')
|
|
.select('accounting_method, entity_type')
|
|
.eq('company_id', company.id)
|
|
.maybeSingle()
|
|
|
|
if (settingsError) throw new Error('Kunde inte ladda företagsinställningar')
|
|
if (cancelled) return
|
|
|
|
setAccounts(fetchedAccounts)
|
|
|
|
const accountingMethod = (settings?.accounting_method || 'accrual') as 'accrual' | 'cash'
|
|
const entityType = (settings?.entity_type as EntityType) || 'enskild_firma'
|
|
|
|
const proposed = proposePaymentLines({
|
|
invoice: {
|
|
invoice_number: invoice.invoice_number,
|
|
total: invoice.total,
|
|
total_sek: invoice.total_sek,
|
|
subtotal: invoice.subtotal,
|
|
subtotal_sek: invoice.subtotal_sek,
|
|
vat_amount: invoice.vat_amount,
|
|
vat_amount_sek: invoice.vat_amount_sek,
|
|
currency: invoice.currency,
|
|
exchange_rate: invoice.exchange_rate,
|
|
vat_treatment: invoice.vat_treatment,
|
|
items: invoice.items,
|
|
},
|
|
accountingMethod,
|
|
entityType,
|
|
})
|
|
|
|
setLines(proposed)
|
|
setPaymentDate(new Date().toISOString().split('T')[0])
|
|
setIsInitialized(true)
|
|
} catch (err) {
|
|
if (cancelled) return
|
|
toast({
|
|
title: 'Kunde inte ladda bokföringsdialog',
|
|
description: err instanceof Error ? err.message : 'Försök igen.',
|
|
variant: 'destructive',
|
|
})
|
|
onOpenChange(false)
|
|
}
|
|
}
|
|
|
|
init()
|
|
return () => { cancelled = true }
|
|
}, [open, invoice.id, company?.id])
|
|
|
|
// Balance computation
|
|
const { totalDebit, totalCredit, isBalanced } = useMemo(() => {
|
|
let totalDebit = 0
|
|
let totalCredit = 0
|
|
for (const line of lines) {
|
|
totalDebit += parseFloat(line.debit_amount) || 0
|
|
totalCredit += parseFloat(line.credit_amount) || 0
|
|
}
|
|
const isBalanced = Math.round((totalDebit - totalCredit) * 100) === 0 && totalDebit > 0
|
|
return { totalDebit, totalCredit, isBalanced }
|
|
}, [lines])
|
|
|
|
const updateLine = (index: number, field: keyof FormLine, value: string) => {
|
|
setLines((prev) => {
|
|
const next = [...prev]
|
|
const updated = { ...next[index], [field]: value }
|
|
|
|
// Debit/credit exclusion: clear the other when one is entered
|
|
if (field === 'debit_amount' && value) {
|
|
updated.credit_amount = ''
|
|
} else if (field === 'credit_amount' && value) {
|
|
updated.debit_amount = ''
|
|
}
|
|
|
|
next[index] = updated
|
|
return next
|
|
})
|
|
}
|
|
|
|
const addLine = () => {
|
|
setLines((prev) => [...prev, { ...BLANK_LINE }])
|
|
}
|
|
|
|
const removeLine = (index: number) => {
|
|
if (lines.length <= 2) return
|
|
setLines((prev) => prev.filter((_, i) => i !== index))
|
|
}
|
|
|
|
const submit = async (force: boolean) => {
|
|
if (!isBalanced) return
|
|
|
|
setIsSubmitting(true)
|
|
|
|
try {
|
|
const apiLines = lines
|
|
.filter((l) => l.account_number && (parseFloat(l.debit_amount) || parseFloat(l.credit_amount)))
|
|
.map((l) => ({
|
|
account_number: l.account_number,
|
|
debit_amount: parseFloat(l.debit_amount) || 0,
|
|
credit_amount: parseFloat(l.credit_amount) || 0,
|
|
line_description: l.line_description || undefined,
|
|
}))
|
|
|
|
const response = await fetch(`/api/invoices/${invoice.id}/mark-paid`, {
|
|
method: 'POST',
|
|
headers: { 'Content-Type': 'application/json' },
|
|
body: JSON.stringify({
|
|
payment_date: paymentDate,
|
|
lines: apiLines,
|
|
...(force ? { force: true } : {}),
|
|
}),
|
|
})
|
|
|
|
if (!response.ok) {
|
|
const data = await response.json()
|
|
const code = (data as { error?: { code?: string } })?.error?.code
|
|
if (code === 'INVOICE_PAID_LIKELY_DUPLICATE') {
|
|
const details = (data as { error?: { details?: { candidates?: DuplicateCandidate[] } } })
|
|
?.error?.details
|
|
setDuplicateCandidates(details?.candidates ?? [])
|
|
setIsSubmitting(false)
|
|
return
|
|
}
|
|
const error = new Error('Kunde inte markera som betald') as Error & { body?: unknown; status?: number }
|
|
error.body = data
|
|
error.status = response.status
|
|
throw error
|
|
}
|
|
|
|
onOpenChange(false)
|
|
onSuccess()
|
|
} catch (error) {
|
|
const anyErr = error as { body?: unknown; status?: number }
|
|
toast({
|
|
title: 'Bokföring misslyckades',
|
|
description: getErrorMessage(anyErr.body ?? error, { context: 'invoice', statusCode: anyErr.status }),
|
|
variant: 'destructive',
|
|
})
|
|
}
|
|
|
|
setIsSubmitting(false)
|
|
}
|
|
|
|
const handleSubmit = () => submit(false)
|
|
const handleForceSubmit = () => submit(true)
|
|
|
|
const handleLinkExisting = (transactionId: string) => {
|
|
onOpenChange(false)
|
|
router.push(`/transactions?highlight=${encodeURIComponent(transactionId)}`)
|
|
}
|
|
|
|
return (
|
|
<Dialog open={open} onOpenChange={onOpenChange}>
|
|
<DialogContent className="sm:max-w-[680px]">
|
|
<DialogHeader>
|
|
<DialogTitle>Bokför betalning{invoice.invoice_number ? ` — ${invoice.invoice_number}` : ''}</DialogTitle>
|
|
<DialogDescription>
|
|
{formatCurrency(invoice.total, invoice.currency)}
|
|
{invoice.currency !== 'SEK' && invoice.total_sek && (
|
|
<> ({formatCurrency(invoice.total_sek)} SEK)</>
|
|
)}
|
|
</DialogDescription>
|
|
</DialogHeader>
|
|
|
|
{duplicateCandidates && duplicateCandidates.length > 0 ? (
|
|
<div className="space-y-4">
|
|
<div className="space-y-1">
|
|
<p className="text-sm font-medium">Möjlig dubblettbetalning</p>
|
|
<p className="text-sm text-muted-foreground">
|
|
{duplicateCandidates.length === 1
|
|
? 'En inkommande banktransaktion ser ut att vara denna betalning. Länka den istället för att skapa en ny verifikation, eller bokför ändå om du är säker.'
|
|
: `${duplicateCandidates.length} inkommande banktransaktioner ser ut att kunna vara denna betalning. Länka rätt transaktion istället för att skapa en ny verifikation, eller bokför ändå om du är säker.`}
|
|
</p>
|
|
</div>
|
|
<ul className="space-y-2">
|
|
{duplicateCandidates.map((c) => {
|
|
const reasonVariant: 'success' | 'secondary' | 'outline' =
|
|
c.match_reason === 'ocr_exact'
|
|
? 'success'
|
|
: c.match_reason === 'name_amount_fuzzy'
|
|
? 'secondary'
|
|
: 'outline'
|
|
return (
|
|
<li
|
|
key={c.id}
|
|
className="flex flex-col gap-2 rounded-lg border bg-card p-3 sm:flex-row sm:items-center sm:justify-between"
|
|
>
|
|
<div className="min-w-0 space-y-1">
|
|
<div className="flex flex-wrap items-center gap-2">
|
|
<Badge variant={reasonVariant}>{MATCH_REASON_LABEL[c.match_reason]}</Badge>
|
|
<span className="text-sm tabular-nums text-muted-foreground">
|
|
{formatDate(c.date)}
|
|
</span>
|
|
<span className="text-sm font-medium tabular-nums">
|
|
{formatCurrency(c.amount, invoice.currency)}
|
|
</span>
|
|
</div>
|
|
<p className="truncate text-xs text-muted-foreground">
|
|
{c.merchant_name || c.description || '—'}
|
|
</p>
|
|
</div>
|
|
<Button
|
|
type="button"
|
|
variant="outline"
|
|
size="sm"
|
|
onClick={() => handleLinkExisting(c.id)}
|
|
className="shrink-0"
|
|
>
|
|
Länka transaktion
|
|
</Button>
|
|
</li>
|
|
)
|
|
})}
|
|
</ul>
|
|
</div>
|
|
) : !isInitialized ? (
|
|
<div className="flex items-center justify-center py-12">
|
|
<Loader2 className="h-6 w-6 animate-spin text-muted-foreground" />
|
|
</div>
|
|
) : (
|
|
<div className="space-y-4">
|
|
{/* Payment date */}
|
|
<div className="space-y-1.5">
|
|
<Label htmlFor="payment-date">Betalningsdatum</Label>
|
|
<Input
|
|
id="payment-date"
|
|
type="date"
|
|
value={paymentDate}
|
|
onChange={(e) => setPaymentDate(e.target.value)}
|
|
className="w-full sm:w-48"
|
|
/>
|
|
</div>
|
|
|
|
{/* Journal entry lines */}
|
|
{/* Mobile card layout */}
|
|
<div className="sm:hidden space-y-3">
|
|
{lines.map((line, index) => (
|
|
<div key={index} className="rounded-lg border bg-card p-3 space-y-2">
|
|
<div className="flex items-start gap-2">
|
|
<div className="flex-1">
|
|
<AccountCombobox
|
|
value={line.account_number}
|
|
accounts={accounts}
|
|
onChange={(val) => updateLine(index, 'account_number', val)}
|
|
/>
|
|
</div>
|
|
<Button
|
|
type="button"
|
|
variant="ghost"
|
|
size="sm"
|
|
className="h-8 w-8 p-0 min-h-[44px] min-w-[44px] shrink-0 -mr-1 -mt-1"
|
|
onClick={() => removeLine(index)}
|
|
disabled={lines.length <= 2}
|
|
>
|
|
<Trash2 className="h-3.5 w-3.5" />
|
|
</Button>
|
|
</div>
|
|
<div className="grid grid-cols-2 gap-2">
|
|
<div className="space-y-1">
|
|
<Label className="text-xs text-muted-foreground">Debet</Label>
|
|
<Input
|
|
type="number"
|
|
step="0.01"
|
|
min="0"
|
|
placeholder="0,00"
|
|
value={line.debit_amount}
|
|
onChange={(e) => updateLine(index, 'debit_amount', e.target.value)}
|
|
className="font-mono text-right"
|
|
inputMode="decimal"
|
|
/>
|
|
</div>
|
|
<div className="space-y-1">
|
|
<Label className="text-xs text-muted-foreground">Kredit</Label>
|
|
<Input
|
|
type="number"
|
|
step="0.01"
|
|
min="0"
|
|
placeholder="0,00"
|
|
value={line.credit_amount}
|
|
onChange={(e) => updateLine(index, 'credit_amount', e.target.value)}
|
|
className="font-mono text-right"
|
|
inputMode="decimal"
|
|
/>
|
|
</div>
|
|
</div>
|
|
</div>
|
|
))}
|
|
<Button type="button" variant="outline" size="sm" onClick={addLine} className="w-full">
|
|
<Plus className="mr-1 h-3.5 w-3.5" /> Lägg till rad
|
|
</Button>
|
|
</div>
|
|
|
|
{/* Desktop table layout */}
|
|
<div className="hidden sm:block space-y-2">
|
|
{/* Header */}
|
|
<div className="grid grid-cols-[1fr_120px_120px_32px] gap-2 text-xs font-medium text-muted-foreground px-1">
|
|
<span>Konto</span>
|
|
<span className="text-right">Debet</span>
|
|
<span className="text-right">Kredit</span>
|
|
<span />
|
|
</div>
|
|
|
|
{/* Lines */}
|
|
{lines.map((line, index) => (
|
|
<div key={index} className="grid grid-cols-[1fr_120px_120px_32px] gap-2 items-start">
|
|
<div className="min-w-0">
|
|
<AccountCombobox
|
|
value={line.account_number}
|
|
accounts={accounts}
|
|
onChange={(val) => updateLine(index, 'account_number', val)}
|
|
/>
|
|
</div>
|
|
<Input
|
|
type="number"
|
|
step="0.01"
|
|
min="0"
|
|
placeholder="0,00"
|
|
value={line.debit_amount}
|
|
onChange={(e) => updateLine(index, 'debit_amount', e.target.value)}
|
|
className="font-mono text-right h-8"
|
|
/>
|
|
<Input
|
|
type="number"
|
|
step="0.01"
|
|
min="0"
|
|
placeholder="0,00"
|
|
value={line.credit_amount}
|
|
onChange={(e) => updateLine(index, 'credit_amount', e.target.value)}
|
|
className="font-mono text-right h-8"
|
|
/>
|
|
<Button
|
|
type="button"
|
|
variant="ghost"
|
|
size="icon"
|
|
className="h-8 w-8 text-muted-foreground hover:text-destructive"
|
|
onClick={() => removeLine(index)}
|
|
disabled={lines.length <= 2}
|
|
>
|
|
<Trash2 className="h-3.5 w-3.5" />
|
|
</Button>
|
|
</div>
|
|
))}
|
|
|
|
{/* Add row */}
|
|
<Button
|
|
type="button"
|
|
variant="ghost"
|
|
size="sm"
|
|
onClick={addLine}
|
|
className="text-muted-foreground"
|
|
>
|
|
<Plus className="mr-1 h-3.5 w-3.5" />
|
|
Lägg till rad
|
|
</Button>
|
|
</div>
|
|
|
|
{/* Balance indicator */}
|
|
<div className="flex items-center justify-between border-t pt-3">
|
|
<div className="flex items-center gap-2">
|
|
{isBalanced ? (
|
|
<Badge variant="secondary" className="bg-success/10 text-success">
|
|
Debet = Kredit
|
|
</Badge>
|
|
) : (
|
|
<Badge variant="destructive">
|
|
Obalanserad ({formatCurrency(Math.abs(totalDebit - totalCredit))})
|
|
</Badge>
|
|
)}
|
|
</div>
|
|
<div className="text-sm text-muted-foreground font-mono">
|
|
{formatCurrency(totalDebit)} / {formatCurrency(totalCredit)}
|
|
</div>
|
|
</div>
|
|
</div>
|
|
)}
|
|
|
|
<DialogFooter>
|
|
<Button variant="outline" onClick={() => onOpenChange(false)} disabled={isSubmitting} className="w-full sm:w-auto min-h-11">
|
|
Avbryt
|
|
</Button>
|
|
{duplicateCandidates && duplicateCandidates.length > 0 ? (
|
|
<Button
|
|
onClick={handleForceSubmit}
|
|
disabled={!isBalanced || isSubmitting}
|
|
className="w-full sm:w-auto min-h-11"
|
|
>
|
|
{isSubmitting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
|
|
Bokför ändå
|
|
</Button>
|
|
) : (
|
|
<Button
|
|
onClick={handleSubmit}
|
|
disabled={!isBalanced || isSubmitting || !isInitialized}
|
|
className="w-full sm:w-auto min-h-11"
|
|
>
|
|
{isSubmitting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
|
|
Bekräfta & bokför
|
|
</Button>
|
|
)}
|
|
</DialogFooter>
|
|
</DialogContent>
|
|
</Dialog>
|
|
)
|
|
}
|