f3e4fdcf32
The Fortnox document import needs the archive and connectfile scopes, which the registered Fortnox app does not have. Since #1549 pulled them out of the connect request (they broke every connect with invalid_scope before login), every attachment call fails and the user was told "Koppla om Fortnox och godkann behorigheterna", under a button that reruns an authorize URL still not asking for those scopes. Klura AB followed that loop four times and bought the Fortnox Arkiv module trying to satisfy it. Prod evidence: no Fortnox attachment has ever imported, across 166 companies and 24 consents since the feature shipped, and no live token carries the scopes. The error and the scope list now derive from one flag, FORTNOX_DOCUMENT_SCOPES_APPROVED. While it is false a permission failure maps to a new PROVIDER_DOCUMENT_SCOPES_UNAVAILABLE, which says the permission is missing on our side, that reconnecting will not help, and that the rest of the migration came through; the card offers no button, because no user action can succeed. The attachment scopes also become an opt-in consent rather than part of every connect. Fortnox derives customer licence requirements from what an integration requests, so asking everyone for Arkivplats would put a licence in front of customers who never import a receipt; and keeping it off the default connect caps the blast radius of a wrong portal registration at the underlag flow rather than every Fortnox connection. buildFortnoxAuthUrl already took per-call scopes, provider-client simply never passed any, so this threads documentScopes from that one button through /connect into the authorize URL. A document consent is always a superset of an ordinary one: the callback overwrites the consent's tokens in place, so a narrower grant would revoke the migration's own ledger access. Pinned by a test that holds either way the flag is set, alongside one for the 400-with-behorighet answer that six companies hit between 08-13 and 08-19 and saw only a generic retry for. Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
81 lines
3.0 KiB
TypeScript
81 lines
3.0 KiB
TypeScript
import { describe, it, expect, vi } from 'vitest'
|
|
|
|
/**
|
|
* The voucher-attachment scopes (Arkivplats + Koppla filer) are opt-in per
|
|
* authorize call rather than part of every Fortnox connect. Two reasons, both
|
|
* of which have already cost us once:
|
|
*
|
|
* 1. Fortnox derives its customer licence requirements from what the
|
|
* integration requests, so asking every customer for Arkivplats would put
|
|
* a licence in front of people who never import a receipt.
|
|
* 2. A scope the registered app lacks makes authorize reject with
|
|
* invalid_scope before login. Keeping it off the ordinary connect means
|
|
* the blast radius of getting it wrong is the underlag flow, not every
|
|
* Fortnox connection in production (incident 2026-08-13).
|
|
*/
|
|
|
|
vi.mock('@/lib/supabase/server', () => ({
|
|
createServiceClient: () => ({ from: vi.fn() }),
|
|
createServiceClientNoCookies: () => ({ from: vi.fn() }),
|
|
}))
|
|
|
|
vi.mock('@/lib/providers/oauth-config', () => ({
|
|
getOAuthConfig: () => ({
|
|
clientId: 'client-id',
|
|
clientSecret: 'client-secret',
|
|
redirectUri: 'https://accounted.example.test/callback',
|
|
}),
|
|
}))
|
|
|
|
import {
|
|
fortnoxConsentScopes,
|
|
FORTNOX_DOCUMENT_SCOPES,
|
|
} from '@/lib/providers/fortnox/oauth'
|
|
import { getAuthUrl } from '../lib/provider-client'
|
|
|
|
const scopesOf = (url: string) =>
|
|
new URL(url).searchParams.get('scope')?.split(' ') ?? []
|
|
|
|
describe('Fortnox document scopes are opt-in', () => {
|
|
it('leaves the attachment scopes out of an ordinary consent', () => {
|
|
expect(fortnoxConsentScopes()).not.toContain('archive')
|
|
expect(fortnoxConsentScopes()).not.toContain('connectfile')
|
|
})
|
|
|
|
// The OAuth callback overwrites the consent's tokens in place, so a document
|
|
// consent that dropped the base scopes would silently revoke the migration's
|
|
// own access to the ledger it just imported.
|
|
it('never drops the base scopes when asking for the attachment scopes', () => {
|
|
const base = fortnoxConsentScopes()
|
|
const withDocuments = fortnoxConsentScopes({ documents: true })
|
|
|
|
for (const scope of base) {
|
|
expect(withDocuments).toContain(scope)
|
|
}
|
|
expect(withDocuments.length).toBeGreaterThanOrEqual(base.length)
|
|
expect(new Set(withDocuments).size).toBe(withDocuments.length)
|
|
})
|
|
|
|
it('names both attachment scopes, so the portal registration has a source of truth', () => {
|
|
expect(FORTNOX_DOCUMENT_SCOPES).toEqual(['archive', 'connectfile'])
|
|
})
|
|
|
|
it('builds the ordinary connect URL without the attachment scopes', async () => {
|
|
const { url } = await getAuthUrl('fortnox', 'state-1', 'https://cb.test')
|
|
|
|
expect(scopesOf(url)).toEqual(fortnoxConsentScopes())
|
|
expect(scopesOf(url)).not.toContain('archive')
|
|
})
|
|
|
|
it('builds the underlag reconnect URL from the document consent scopes', async () => {
|
|
const { url } = await getAuthUrl('fortnox', 'state-2', 'https://cb.test', {
|
|
documentScopes: true,
|
|
})
|
|
|
|
expect(scopesOf(url)).toEqual(fortnoxConsentScopes({ documents: true }))
|
|
for (const scope of fortnoxConsentScopes()) {
|
|
expect(scopesOf(url)).toContain(scope)
|
|
}
|
|
})
|
|
})
|