* fix(inbox): never extract the receiving company as its own supplier The model sometimes reads the Kund/Kunduppgifter block of bank agreements and similar documents as the issuer, so the inbox offered to create the user's own company as a leverantor. Two layers: a supplier-direction rule in the extraction prompt (issuer, never the customer/recipient block), and a deterministic post-extraction guard that nulls the supplier block when its org number, derived VAT number, or exact name equals the receiving company's own. All AI extraction paths (upload, deferred, retry, attach-document, document-extraction, MCP) pass the company identity. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hqm9QgdyNAFaWiz6Ww7pgb * fix(inbox): keep the own-company guard alive for photographed documents Skeptic findings on PR #2080: normalizeImageForExtraction rebuilt the input without ownCompany, so the guard never fired for HEIC/oversized phone photos (the motivating case). Spread the original input instead. Also let a provably different extracted org number outvote a name coincidence, and accept 12-digit personnummer-form own org numbers (19/20 century prefix, enskild firma) alongside the 16-prefixed organisation form. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hqm9QgdyNAFaWiz6Ww7pgb * docs(compliance): add RoPA entry for the own-company-identity lookup Compliance swarm (GDPR Art. 30): fetchOwnCompanyIdentity reads companies.name and org_number on every extraction; record the processing activity (transient in-memory comparison, never sent to the model). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hqm9QgdyNAFaWiz6Ww7pgb * fix(inbox): log own-company identity lookup failures instead of failing silent Compliance swarm (SOC 2 CC7.2): the bare catch in fetchOwnCompanyIdentity made a persistently broken lookup (RLS misconfig, DB outage) disable the guard invisibly. Also pin the VAT-number match across prefixed and bare digit forms in the test matrix. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hqm9QgdyNAFaWiz6Ww7pgb * fix(inbox): surface maybeSingle query errors in the own-company lookup CodeRabbit: maybeSingle() reports RLS/query failures in error without throwing, so the failure log added for SOC 2 CC7.2 never fired for exactly those cases. Throw the reported error into the existing catch (still fail open to nulls). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01Hqm9QgdyNAFaWiz6Ww7pgb --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
285 lines
11 KiB
TypeScript
285 lines
11 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
|
import { invoiceInboxExtension } from '@/extensions/general/invoice-inbox'
|
|
import {
|
|
createQueuedMockSupabase,
|
|
createMockRequest,
|
|
parseJsonResponse,
|
|
} from '@/tests/helpers'
|
|
import type { ExtensionContext } from '@/lib/extensions/types'
|
|
|
|
vi.mock('@/extensions/general/invoice-inbox/lib/extract-invoice-fields', () => ({
|
|
extractInvoiceFields: vi.fn(),
|
|
fetchOwnCompanyIdentity: vi.fn().mockResolvedValue({ orgNumber: null, name: null }),
|
|
}))
|
|
|
|
vi.mock('@/lib/rate-limits/inbox', () => ({
|
|
checkInboxUploadRateLimit: vi.fn().mockResolvedValue({ ok: true }),
|
|
}))
|
|
|
|
// Paid AI OCR gate. Retry is an explicit "run AI now" action, so a company
|
|
// without CAPABILITY.ai is hard-blocked (403). Default to entitled here;
|
|
// capabilityBlockedResponse stays real so the 403 envelope is exercised.
|
|
vi.mock('@/lib/entitlements/has-capability', async (importOriginal) => {
|
|
const actual = await importOriginal<typeof import('@/lib/entitlements/has-capability')>()
|
|
return { ...actual, hasCapability: vi.fn().mockResolvedValue(true) }
|
|
})
|
|
|
|
// The attachment download runs on the service-role client (the storage
|
|
// SELECT policy is per-uploader-folder, and inbox documents are attributed
|
|
// to the company creator, not the caller).
|
|
const serviceDownloadMock = vi.fn()
|
|
vi.mock('@/lib/supabase/server', () => ({
|
|
createServiceClient: () => ({
|
|
storage: { from: vi.fn(() => ({ download: serviceDownloadMock })) },
|
|
}),
|
|
}))
|
|
|
|
import { extractInvoiceFields } from '@/extensions/general/invoice-inbox/lib/extract-invoice-fields'
|
|
import { checkInboxUploadRateLimit } from '@/lib/rate-limits/inbox'
|
|
import { hasCapability } from '@/lib/entitlements/has-capability'
|
|
|
|
function findRoute(method: string, path: string) {
|
|
return invoiceInboxExtension.apiRoutes!.find(
|
|
(r) => r.method === method && r.path === path,
|
|
)!
|
|
}
|
|
|
|
const retryRoute = findRoute('POST', '/items/:id/retry-extraction')
|
|
|
|
function buildCtx(supabase: unknown): ExtensionContext {
|
|
return {
|
|
userId: 'user-1',
|
|
companyId: 'company-1',
|
|
extensionId: 'invoice-inbox',
|
|
supabase: supabase as ExtensionContext['supabase'],
|
|
emit: vi.fn(),
|
|
settings: { get: vi.fn(), set: vi.fn() },
|
|
storage: { from: vi.fn() } as unknown as ExtensionContext['storage'],
|
|
log: { info: vi.fn(), warn: vi.fn(), error: vi.fn(), debug: vi.fn() } as unknown as ExtensionContext['log'],
|
|
services: {},
|
|
} as ExtensionContext
|
|
}
|
|
|
|
function makeReq() {
|
|
return createMockRequest('/items/item-1/retry-extraction', {
|
|
method: 'POST',
|
|
searchParams: { _id: 'item-1' },
|
|
})
|
|
}
|
|
|
|
const EXTRACTION_SUCCESS = {
|
|
data: {
|
|
supplier: { name: 'Acme AB', orgNumber: null, vatNumber: null, address: null, bankgiro: null, plusgiro: null },
|
|
invoice: { invoiceNumber: 'F-1', invoiceDate: '2026-05-01', dueDate: null, paymentReference: null, currency: 'SEK' },
|
|
lineItems: [],
|
|
totals: { subtotal: 100, vatAmount: 25, total: 125 },
|
|
vatBreakdown: [],
|
|
confidence: 1,
|
|
},
|
|
rawText: 'mock',
|
|
}
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks()
|
|
vi.mocked(checkInboxUploadRateLimit).mockResolvedValue({ ok: true })
|
|
vi.mocked(hasCapability).mockResolvedValue(true)
|
|
})
|
|
|
|
describe('POST /items/:id/retry-extraction', () => {
|
|
it('returns 401 when no context', async () => {
|
|
const res = await retryRoute.handler(makeReq(), undefined)
|
|
const { status } = await parseJsonResponse(res)
|
|
expect(status).toBe(401)
|
|
})
|
|
|
|
it('returns 429 when the per-company rate limit is exceeded', async () => {
|
|
vi.mocked(checkInboxUploadRateLimit).mockResolvedValueOnce({
|
|
ok: false,
|
|
scope: 'minute',
|
|
retryAfterSec: 30,
|
|
})
|
|
const { supabase } = createQueuedMockSupabase()
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(res)
|
|
expect(status).toBe(429)
|
|
expect(body.error).toMatch(/för många/i)
|
|
expect(res.headers.get('Retry-After')).toBe('30')
|
|
})
|
|
|
|
it('returns 404 when the inbox item is missing', async () => {
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({ data: null, error: null }) // item lookup
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status } = await parseJsonResponse(res)
|
|
expect(status).toBe(404)
|
|
})
|
|
|
|
it('returns 409 when already booked as supplier invoice', async () => {
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: 'si-1' },
|
|
error: null,
|
|
})
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(res)
|
|
expect(status).toBe(409)
|
|
expect(body.error).toMatch(/redan bokfört/i)
|
|
})
|
|
|
|
it('hard-blocks with 403 capability_blocked when the company lacks the ai capability', async () => {
|
|
vi.mocked(hasCapability).mockResolvedValueOnce(false)
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
}) // item lookup: the ai gate fires immediately after
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ capability_blocked: boolean; capability: string }>(res)
|
|
expect(status).toBe(403)
|
|
expect(body.capability_blocked).toBe(true)
|
|
expect(body.capability).toBe('ai')
|
|
expect(extractInvoiceFields).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('returns 400 when the item has no attached document', async () => {
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: null, correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
})
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(res)
|
|
expect(status).toBe(400)
|
|
expect(body.error).toMatch(/Ingen bilaga/i)
|
|
})
|
|
|
|
it('returns 200 with re-extracted data on the happy path', async () => {
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
})
|
|
enqueue({ data: { is_sandbox: false }, error: null }) // sandbox check
|
|
enqueue({
|
|
data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
|
|
error: null,
|
|
})
|
|
enqueue({ data: null, error: null }) // supplier name lookup: no match
|
|
enqueue({ data: null, error: null }) // inbox update on success
|
|
|
|
serviceDownloadMock.mockResolvedValue({
|
|
data: new Blob([new Uint8Array([1, 2, 3])], { type: 'application/pdf' }),
|
|
error: null,
|
|
})
|
|
|
|
vi.mocked(extractInvoiceFields).mockResolvedValueOnce(EXTRACTION_SUCCESS as never)
|
|
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ data: { extracted_data: { totals: { total: number } } } }>(res)
|
|
expect(status).toBe(200)
|
|
expect(body.data.extracted_data.totals.total).toBe(125)
|
|
})
|
|
|
|
it('re-links the supplier on retry, matching a foreign supplier by VAT number', async () => {
|
|
// Re-running the extraction used to rewrite extracted_data and leave
|
|
// matched_supplier_id untouched, so "Tolka om" could never repair a link
|
|
// that failed the first time (e.g. because the supplier was created after
|
|
// the document arrived).
|
|
const { supabase, enqueue, findCall } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
})
|
|
enqueue({ data: { is_sandbox: false }, error: null }) // sandbox check
|
|
enqueue({
|
|
data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
|
|
error: null,
|
|
})
|
|
enqueue({
|
|
data: [{ id: 'adobe-supplier', vat_number: 'IE6364992H' }],
|
|
error: null,
|
|
}) // vat_number scan
|
|
enqueue({ data: null, error: null }) // inbox update on success
|
|
|
|
serviceDownloadMock.mockResolvedValue({
|
|
data: new Blob([new Uint8Array([1, 2, 3])], { type: 'application/pdf' }),
|
|
error: null,
|
|
})
|
|
|
|
vi.mocked(extractInvoiceFields).mockResolvedValueOnce({
|
|
...EXTRACTION_SUCCESS,
|
|
data: {
|
|
...EXTRACTION_SUCCESS.data,
|
|
supplier: {
|
|
...EXTRACTION_SUCCESS.data.supplier,
|
|
name: 'Adobe Systems Software Ireland Ltd',
|
|
vatNumber: 'IE6364992H',
|
|
},
|
|
},
|
|
} as never)
|
|
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status } = await parseJsonResponse(res)
|
|
expect(status).toBe(200)
|
|
|
|
const update = findCall('invoice_inbox_items', 'update')?.[0] as Record<string, unknown>
|
|
expect(update.matched_supplier_id).toBe('adobe-supplier')
|
|
})
|
|
|
|
it('leaves a hand-picked supplier alone when the retry finds no match', async () => {
|
|
const { supabase, enqueue, findCall } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
})
|
|
enqueue({ data: { is_sandbox: false }, error: null }) // sandbox check
|
|
enqueue({
|
|
data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
|
|
error: null,
|
|
})
|
|
enqueue({ data: null, error: null }) // supplier name lookup: no match
|
|
enqueue({ data: null, error: null }) // inbox update on success
|
|
|
|
serviceDownloadMock.mockResolvedValue({
|
|
data: new Blob([new Uint8Array([1, 2, 3])], { type: 'application/pdf' }),
|
|
error: null,
|
|
})
|
|
vi.mocked(extractInvoiceFields).mockResolvedValueOnce(EXTRACTION_SUCCESS as never)
|
|
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status } = await parseJsonResponse(res)
|
|
expect(status).toBe(200)
|
|
|
|
const update = findCall('invoice_inbox_items', 'update')?.[0] as Record<string, unknown>
|
|
expect(update).not.toHaveProperty('matched_supplier_id')
|
|
})
|
|
|
|
it('marks the item as error and returns 500 when extraction throws', async () => {
|
|
const { supabase, enqueue } = createQueuedMockSupabase()
|
|
enqueue({
|
|
data: { id: 'item-1', document_id: 'doc-1', correlation_id: null, created_supplier_invoice_id: null },
|
|
error: null,
|
|
})
|
|
enqueue({ data: { is_sandbox: false }, error: null }) // sandbox check
|
|
enqueue({
|
|
data: { storage_path: 'path/to.pdf', mime_type: 'application/pdf', file_name: 'invoice.pdf' },
|
|
error: null,
|
|
})
|
|
enqueue({ data: null, error: null }) // error-state update
|
|
|
|
serviceDownloadMock.mockResolvedValue({
|
|
data: new Blob([new Uint8Array([1])], { type: 'application/pdf' }),
|
|
error: null,
|
|
})
|
|
|
|
vi.mocked(extractInvoiceFields).mockRejectedValueOnce(new Error('pdfjs blew up'))
|
|
const spy = vi.spyOn(console, 'error').mockImplementation(() => {})
|
|
|
|
const res = await retryRoute.handler(makeReq(), buildCtx(supabase))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(res)
|
|
expect(status).toBe(500)
|
|
expect(body.error).toBe('pdfjs blew up')
|
|
spy.mockRestore()
|
|
})
|
|
})
|