accounted/app/api/transactions/[id]/attach-document/__tests__/route.test.ts

import { describe, it, expect, vi, beforeEach } from 'vitest'
import { NextResponse } from 'next/server'
import {
  parseJsonResponse,
  createMockRouteParams,
  createQueuedMockSupabase,
} from '@/tests/helpers'

const { supabase: mockSupabase, enqueue, reset, findCalls } = createQueuedMockSupabase()

const requireAuthMock = vi.fn()
vi.mock('@/lib/auth/require-auth', () => ({
  requireAuth: (...args: unknown[]) => requireAuthMock(...args),
}))

vi.mock('@/lib/company/context', () => ({
  requireCompanyId: vi.fn().mockResolvedValue('company-1'),
  getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
}))

const requireWriteMock = vi.fn()
vi.mock('@/lib/auth/require-write', () => ({
  requireWritePermission: (...args: unknown[]) => requireWriteMock(...args),
}))

vi.mock('@/lib/init', () => ({
  ensureInitialized: vi.fn(),
}))

import { POST, DELETE } from '../route'

const mockUser = { id: 'user-1', email: 'test@test.se' }

beforeEach(() => {
  vi.clearAllMocks()
  reset()
  requireAuthMock.mockResolvedValue({ user: mockUser, supabase: mockSupabase })
  requireWriteMock.mockResolvedValue({ ok: true })
})

function makeReq(body: unknown, method: 'POST' | 'DELETE' = 'POST') {
  return new Request('http://localhost/api/transactions/tx-1/attach-document', {
    method,
    headers: { 'Content-Type': 'application/json' },
    body: method === 'POST' ? JSON.stringify(body) : undefined,
  })
}

describe('POST /api/transactions/[id]/attach-document', () => {
  it('returns 401 when not authenticated', async () => {
    requireAuthMock.mockResolvedValue({
      user: null,
      supabase: mockSupabase,
      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
    })
    const res = await POST(makeReq({ document_id: 'doc-1' }), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(401)
    expect(body).toEqual({ error: 'Unauthorized' })
  })

  it('returns 403 when the caller is a viewer', async () => {
    requireWriteMock.mockResolvedValue({
      ok: false,
      response: NextResponse.json({ error: 'Forbidden' }, { status: 403 }),
    })
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(403)
    expect(body).toEqual({ error: 'Forbidden' })
  })

  it('returns 400 when document_id missing', async () => {
    const res = await POST(makeReq({}), createMockRouteParams({ id: 'tx-1' }))
    const { status } = await parseJsonResponse(res)
    expect(status).toBe(400)
  })

  it('returns 404 when transaction not in company', async () => {
    enqueue({ data: null, error: null }) // tx fetch
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(404)
    expect(body).toEqual({ error: 'Transaction not found' })
  })

  it('returns 404 when document not in company', async () => {
    enqueue({ data: { id: 'tx-1' }, error: null }) // tx fetch
    enqueue({ data: null, error: null }) // doc fetch
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(404)
    expect(body).toEqual({ error: 'Document not found' })
  })

  it('attaches when both rows exist', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: null }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: [], error: null }) // completion: voucher-link resolution (not bulk-booked)
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ data: { transaction_id: string; document_id: string; journal_entry_id: string | null } }>(res)
    expect(status).toBe(200)
    expect(body.data.transaction_id).toBe('tx-1')
    expect(body.data.document_id).toBe('11111111-1111-4111-8111-111111111111')
    expect(body.data.journal_entry_id).toBeNull()
    // Unbooked tx: document_attachments is only read (doc fetch), never
    // written: no journal entry to propagate to.
    const fromCalls = mockSupabase.from.mock.calls.map((c) => c[0])
    expect(fromCalls.filter((t) => t === 'document_attachments')).toHaveLength(1)
  })

  it('propagates the link onto the verifikation when the transaction is booked', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: 'je-1' }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: 'je-1' }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: null, error: null }) // document_attachments propagation
    enqueue({ data: [], error: null }) // completion: matched inbox items (none)
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ data: { journal_entry_id: string } }>(res)
    expect(status).toBe(200)
    expect(body.data.journal_entry_id).toBe('je-1')
    // doc fetch + propagation write
    const fromCalls = mockSupabase.from.mock.calls.map((c) => c[0])
    expect(fromCalls.filter((t) => t === 'document_attachments')).toHaveLength(2)
  })

  it('skips propagation when the doc already points at the same verifikation (idempotent re-attach)', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: 'je-1' }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: 'je-1' }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: 'je-1' }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: [], error: null }) // completion: matched inbox items (none)
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status } = await parseJsonResponse(res)
    expect(status).toBe(200)
    // No propagation write: only the doc fetch touched document_attachments.
    const fromCalls = mockSupabase.from.mock.calls.map((c) => c[0])
    expect(fromCalls.filter((t) => t === 'document_attachments')).toHaveLength(1)
  })

  it('returns 409 when the document already belongs to a different verifikation', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: 'je-1' }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: 'je-OTHER' }, error: null }) // doc fetch
    enqueue({ data: [], error: null }) // voucher-link check: je-OTHER anchors nothing here
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(409)
    expect(body.error).toContain('annan verifikation')
  })

  it('completes the matched inbox item when the tx is anchored via a bulk-book samlingsverifikat', async () => {
    // A bulk-booked tx keeps transactions.journal_entry_id null: the
    // verifikat hangs off transaction_voucher_links. Attaching a receipt to
    // it must link the underlag to that verifikat and stamp the matched
    // inbox item, or the item strands as "linked" (the 2026-08-12 report).
    const DOC = '11111111-1111-4111-8111-111111111111'
    enqueue({ data: { id: 'tx-1', journal_entry_id: null }, error: null }) // tx fetch
    enqueue({ data: { id: DOC, journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: [{ transaction_id: 'tx-1', journal_entry_id: 'je-9' }], error: null }) // voucher links
    enqueue({ data: [{ id: 'inbox-1', document_id: DOC }], error: null }) // matched inbox items
    enqueue({ data: { journal_entry_id: null }, error: null }) // doc anchor check: free
    enqueue({ data: { id: 'je-9' }, error: null }) // linkToJournalEntry: JE ownership check
    enqueue({ data: { id: DOC, journal_entry_id: 'je-9' }, error: null }) // linkToJournalEntry: doc update
    enqueue({ data: null, error: null }) // created_journal_entry_id stamp

    const res = await POST(makeReq({ document_id: DOC }), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse<{ data: { journal_entry_id: string } }>(res)
    expect(status).toBe(200)
    // The response reports the samlingsverifikat the attach completed against.
    expect(body.data.journal_entry_id).toBe('je-9')
  })

  it('returns 409 when the verifikation period is locked during propagation', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: 'je-1' }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: 'je-1' }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: null, error: { message: 'cannot link document in a locked/closed fiscal period' } }) // propagation blocked
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(409)
    expect(body.error).toContain('låst')
  })

  it('returns 500 with the idempotent-retry message when propagation fails', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: 'je-1' }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: 'je-1' }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link best-effort update
    enqueue({ data: null, error: { message: 'boom' } }) // propagation fails
    const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(500)
    expect(body.error).toContain('idempotent')
    spy.mockRestore()
  })

  it('returns 404 when the update matches no row (concurrent delete)', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: null }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: null, error: null }) // transactions update returns no row
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status } = await parseJsonResponse(res)
    expect(status).toBe(404)
  })

  it('attempts to update invoice_inbox_items.matched_transaction_id after successful attach', async () => {
    // The side effect lets the inbox UI flip an item from "needs action" to
    // "Kopplad till transaktion" without an extra round-trip.
    enqueue({ data: { id: 'tx-1', journal_entry_id: null }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: null }) // inbox-link update
    enqueue({ data: [], error: null }) // completion: voucher-link resolution (not bulk-booked)

    await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    // Verify the inbox_items table was touched.
    const fromCalls = mockSupabase.from.mock.calls.map((c) => c[0])
    expect(fromCalls).toContain('invoice_inbox_items')
  })

  it('tolerates a failing inbox-link update: the document attach is the primary effect', async () => {
    enqueue({ data: { id: 'tx-1', journal_entry_id: null }, error: null }) // tx fetch
    enqueue({ data: { id: 'doc-1', journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // transactions update (RETURNING)
    enqueue({ data: null, error: { message: 'rls denied' } }) // inbox-link fails
    enqueue({ data: [], error: null }) // completion: voucher-link resolution (not bulk-booked)

    const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
    const res = await POST(
      makeReq({ document_id: '11111111-1111-4111-8111-111111111111' }),
      createMockRouteParams({ id: 'tx-1' }),
    )
    const { status, body } = await parseJsonResponse<{ data: { transaction_id: string } }>(res)
    // Side-effect failure must not roll back the (compliant) document attach.
    expect(status).toBe(200)
    expect(body.data.transaction_id).toBe('tx-1')
    // The Supabase client resolves with { error } rather than rejecting, so
    // we additionally assert that the error was actually inspected and logged
    // (not silently dropped by a try/catch that never fires).
    expect(spy).toHaveBeenCalledWith(
      '[attach-document] Failed to link inbox item:',
      expect.objectContaining({ message: 'rls denied' }),
    )
    spy.mockRestore()
  })
})

describe('DELETE /api/transactions/[id]/attach-document', () => {
  it('returns 401 when not authenticated', async () => {
    requireAuthMock.mockResolvedValue({
      user: null,
      supabase: mockSupabase,
      error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
    })
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(401)
    expect(body).toEqual({ error: 'Unauthorized' })
  })

  it('returns 403 when the caller is a viewer', async () => {
    requireWriteMock.mockResolvedValue({
      ok: false,
      response: NextResponse.json({ error: 'Forbidden' }, { status: 403 }),
    })
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(403)
    expect(body).toEqual({ error: 'Forbidden' })
  })

  it('returns 404 when transaction not in company', async () => {
    enqueue({ data: null, error: null }) // tx fetch
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse(res)
    expect(status).toBe(404)
    expect(body).toEqual({ error: 'Transaction not found' })
  })

  it('returns 409 when document is already on a journal entry', async () => {
    enqueue({ data: { id: 'tx-1', document_id: 'doc-1' }, error: null }) // tx fetch
    enqueue({ data: { journal_entry_id: 'je-1' }, error: null }) // doc fetch
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(409)
    expect(body.error).toContain('verifikation')
    // Nothing is written on the immutability path.
    expect(findCalls('invoice_inbox_items', 'update')).toEqual([])
    expect(findCalls('transactions', 'update')).toEqual([])
  })

  it('clears document_id when no journal entry link', async () => {
    enqueue({ data: { id: 'tx-1', document_id: 'doc-1' }, error: null }) // tx fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: null, error: null }) // inbox unlink
    enqueue({ data: { id: 'tx-1' }, error: null }) // pin CAS (RETURNING id)
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse<{ data: { document_id: string | null } }>(res)
    expect(status).toBe(200)
    expect(body.data.document_id).toBeNull()
  })

  it('clears document_id when no doc was attached', async () => {
    enqueue({ data: { id: 'tx-1', document_id: null }, error: null }) // tx fetch
    enqueue({ data: null, error: null }) // inbox unlink
    enqueue({ data: { id: 'tx-1' }, error: null }) // pin CAS
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status } = await parseJsonResponse(res)
    expect(status).toBe(200)
    // The back-link is released even with nothing pinned (a stale item from
    // the replace path would re-anchor just the same), and the CAS then
    // requires the pin to still be empty.
    expect(findCalls('invoice_inbox_items', 'update')).toEqual([[{ matched_transaction_id: null }]])
    expect(findCalls('transactions', 'is')).toContainEqual(['document_id', null])
  })

  it('releases the inbox back-link BEFORE the pin, scoped by transaction (else booking re-anchors it)', async () => {
    // propagateUnderlagForBookedTransaction selects inbox items by
    // matched_transaction_id at categorize time; a stale back-link would pin
    // the rejected receipt onto the new verifikation as immutable underlag.
    enqueue({ data: { id: 'tx-1', document_id: 'doc-1' }, error: null }) // tx fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: null, error: null }) // inbox unlink
    enqueue({ data: { id: 'tx-1' }, error: null }) // pin CAS
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status } = await parseJsonResponse(res)
    expect(status).toBe(200)
    expect(findCalls('invoice_inbox_items', 'update')).toEqual([[{ matched_transaction_id: null }]])
    const eqArgs = findCalls('invoice_inbox_items', 'eq')
    // Scoped by transaction (unique index: at most one item points here), not
    // by the pinned doc, so a stale item from the replace path is cleared too.
    expect(eqArgs).toContainEqual(['matched_transaction_id', 'tx-1'])
    expect(eqArgs).toContainEqual(['company_id', 'company-1'])
    expect(eqArgs).not.toContainEqual(['document_id', 'doc-1'])
    // Items already consumed by a verifikat are left alone.
    expect(findCalls('invoice_inbox_items', 'is')).toContainEqual(['created_journal_entry_id', null])
    // Order: the unlink table is touched before the pin update.
    const tables = mockSupabase.from.mock.calls.map((c) => c[0])
    expect(tables.indexOf('invoice_inbox_items')).toBeLessThan(tables.lastIndexOf('transactions'))
    // Compare-and-set: the pin is cleared only if it is still doc-1.
    expect(findCalls('transactions', 'eq')).toContainEqual(['document_id', 'doc-1'])
    expect(findCalls('transactions', 'update')).toEqual([[{ document_id: null }]])
  })

  it('refuses with 409 when the pin changed under us (concurrent re-attach)', async () => {
    // Interleaving: we read doc-1, a POST pins doc-2 (and links its inbox
    // item) before our CAS runs. Zero rows come back: the new pin is kept and
    // the caller is told nothing happened, instead of a success for a state
    // that is now "doc-2 pinned, doc-2 inbox item unlinked".
    enqueue({ data: { id: 'tx-1', document_id: 'doc-1' }, error: null }) // tx fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: null, error: null }) // inbox unlink
    enqueue({ data: null, error: null }) // pin CAS: 0 rows
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(409)
    expect(body.error).toContain('samtidigt')
  })

  it('reports a failing inbox unlink as 500 with nothing changed, logging a coded cause only', async () => {
    // A stale back-link is the exact defect the detach exists to prevent, so
    // a 200 here would hide a compliance hazard. Because the unlink runs
    // first, the pin is untouched and a retry is trivially idempotent.
    enqueue({ data: { id: 'tx-1', document_id: 'doc-1' }, error: null }) // tx fetch
    enqueue({ data: { journal_entry_id: null }, error: null }) // doc fetch
    enqueue({ data: null, error: { code: '42501', message: 'rls denied: row values here' } }) // unlink fails
    const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
    const res = await DELETE(makeReq(null, 'DELETE'), createMockRouteParams({ id: 'tx-1' }))
    const { status, body } = await parseJsonResponse<{ error: string }>(res)
    expect(status).toBe(500)
    expect(body.error).toContain('fortfarande kopplat')
    expect(findCalls('transactions', 'update')).toEqual([])
    // Raw driver messages can quote row values: only the coded cause is logged.
    expect(spy).toHaveBeenCalledWith('[attach-document] Failed to unlink inbox item:', {
      cause: '42501',
    })
    spy.mockRestore()
  })
})