MattssonandClaude Fable 5.1
1157ff1b66
* feat(onboarding): the orgnr field also accepts a company name The journey's first question kept asking for an organisationsnummer, and people who do not know theirs by heart left to look it up. The same field now takes either: digits (with dashes or spaces) run the existing orgnr lookup unchanged; anything else with three or more characters runs a free-text name search against the same TIC index. One hit continues exactly as a typed orgnr would; several hits render as a chip row "Name / orgnr / city" inside the same question, and the pick applies the hit's already-fetched lookup result. No hits stays on the step with a note to refine or type the number. The screen, placeholder and hint are otherwise untouched; only the mobile keyboard changes from numeric to text. Why the problem occurred: the lookup was keyed on the one identifier the user is least likely to remember, while the provider index behind it is a full-text index that already answers names. What was removed or simplified: nothing new is stored. The TIC search document carries every field /lookup returns, so a name hit is mapped by the same mapper and a picked hit costs no second provider call. The reducer gained one shared "TIC answered" transition (applyLookupFound) that the typed-orgnr path, the single-hit path and the pick path all use, instead of three copies of the fact-to-settings mapping. Why this shape and not the proposed one: search-as-you-type autocomplete would burn the 3000/mo TIC budget in days, so the search fires on Enter only, like the orgnr lookup. Taking the top hit blind on several matches was rejected: name ranking is fuzzy and common names or sole-trader surnames would land on a stranger's company; a five-chip pick row is the smallest thing that keeps the user in control. The route answers 400 under three characters, 404 in the handler's own "Company not found" shape so the client's existing dispatcher-vs-handler mapping applies, and every TIC failure code maps through the same handler as /lookup. Fixes #2418 Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKHTqmnvBJAgdW4V7wZsAW * fix(onboarding): reduce Lens registration numbers to the 10-digit form for name-search hits Skeptic pass on 1d70716a8 (issue #2418). A sole trader found by name got Lens's 16-digit registration number (century-prefixed personnummer plus a 4-digit serial) stored as org_number; createCompany refuses anything normalizeOrgNumber rejects, so the journey dead-ended at the last step and the returned orgnr step could only shake. The typed-orgnr path never stored Lens's number, so this was the first place it reached settings. - searchCompaniesForLookup derives orgNumber through the new lensRegistrationToOrgNumber (16-prefixed 12 digits and the 16-digit enskild-firma form reduce to the 10-digit key; hits that do not normalize are dropped, never dead-ended). - Sole-trader chips show "Enskild firma" and city instead of the number, which is the owner's personnummer. - The name path resets the duplicate note on submit, so an earlier orgnr's "you already have X" no longer sits above the chip row. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKHTqmnvBJAgdW4V7wZsAW * fix(onboarding): keep the typed name in the field after a search pick Compliance swarm on PR #2421: writing the picked hit's org number into the visible input printed a sole trader's personnummer in plain text on Back, the one thing the chip row masks. The field now keeps the name the user typed; Back re-searches it. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01FKHTqmnvBJAgdW4V7wZsAW --------- Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
1734 lines
75 KiB
TypeScript
1734 lines
75 KiB
TypeScript
import type { Extension } from '@/lib/extensions/types'
|
|
import { NextResponse } from 'next/server'
|
|
import {
|
|
searchCompanyByOrgNumber,
|
|
getBankAccounts,
|
|
getIndustryCodes,
|
|
getEmails,
|
|
getPhones,
|
|
getCompanyPurpose,
|
|
getCompanyDocuments,
|
|
getFiscalYears,
|
|
getPayrolls,
|
|
getSignatory,
|
|
getRepresentatives,
|
|
getCompanyStatus,
|
|
getBeneficialOwners,
|
|
} from './lib/tic-client'
|
|
import {
|
|
startBankIdAuth,
|
|
pollBankIdSession,
|
|
collectBankIdResult,
|
|
cancelBankIdSession,
|
|
requestEnrichment,
|
|
fetchEnrichmentData,
|
|
} from './lib/bankid-client'
|
|
import { TICAPIError } from './lib/tic-types'
|
|
import type { TICCompanyProfile, TICFinancialReportSummary } from './lib/tic-types'
|
|
import {
|
|
BANKID_FLOW_ID_HEADER,
|
|
FLOW_VERIFIED_WINDOW_SECONDS,
|
|
FLOW_WINDOW_SECONDS,
|
|
clearBankIdFlowCookies,
|
|
isBankIdFlowMode,
|
|
readBankIdFlow,
|
|
setBankIdFlowCookies,
|
|
} from './lib/bankid-flow-cookie'
|
|
import {
|
|
lookupCompanyByOrgNumber,
|
|
registrationDateToMs,
|
|
searchCompaniesForLookup,
|
|
} from './lib/lookup'
|
|
import { COMPANY_SEARCH_MIN_CHARS } from '@/lib/company-lookup/types'
|
|
import {
|
|
hasForeignCredential,
|
|
isUnadoptedPendingAccount,
|
|
revokePendingIdentity,
|
|
} from './lib/bankid-pending'
|
|
import { sendBankIdSignupConfirmation } from './lib/bankid-confirmation-mail'
|
|
import { hashPersonalNumber, encryptPersonalNumberForStorage } from '@/lib/auth/bankid'
|
|
import {
|
|
evaluateBrandSignupGate,
|
|
readInviteTokenFromCookieHeader,
|
|
} from '@/lib/auth/brand-signup-gate'
|
|
import { requireAuth } from '@/lib/auth/require-auth'
|
|
import { createServiceClient } from '@/lib/supabase/server'
|
|
import { createLogger } from '@/lib/logger'
|
|
import type { SupabaseClient, User } from '@supabase/supabase-js'
|
|
import crypto from 'crypto'
|
|
|
|
const log = createLogger('tic/bankid')
|
|
|
|
const SIGNUP_FAILED = { error: 'internal_error', message: 'Kunde inte skapa kontot. Försök igen.' }
|
|
|
|
/** Host the browser is on, as the proxy forwarded it. '' when unknown. */
|
|
function forwardedHost(request: Request): string {
|
|
return request.headers.get('x-forwarded-host') ?? request.headers.get('host') ?? ''
|
|
}
|
|
|
|
/**
|
|
* Login attempt by a BankID identity whose address was never proven
|
|
* (`email_verified_at IS NULL`, see lib/bankid-pending.ts). Never mints a
|
|
* session. Two outcomes:
|
|
*
|
|
* - The account has since been adopted through another credential (the real
|
|
* owner of the address set a password or signed in with Google): the
|
|
* pending link is revoked so it can never be promoted, and the BankID
|
|
* holder is told there is no account, which for them is now true.
|
|
* - Otherwise the account is still the unconfirmed shell the signup made:
|
|
* the confirmation mail is re-sent (best effort; every attempt costs a
|
|
* BankID identification, which bounds the volume) and the caller is asked
|
|
* to confirm first. The message surfaces in the login page, so Swedish.
|
|
*/
|
|
async function refusePendingLogin(
|
|
supabase: SupabaseClient,
|
|
userId: string,
|
|
user: User | null | undefined,
|
|
names: { givenName?: string; surname?: string },
|
|
request: Request,
|
|
): Promise<NextResponse> {
|
|
if (!user || hasForeignCredential(user)) {
|
|
if (user) {
|
|
log.warn('pending bankid identity revoked at login: account adopted by another credential', {
|
|
userId,
|
|
})
|
|
}
|
|
await revokePendingIdentity(supabase, userId, user?.app_metadata)
|
|
return NextResponse.json({ error: 'no_account', ...names }, { status: 404 })
|
|
}
|
|
|
|
if (user.email) {
|
|
// /auth/callback only looks for a pending identity when the flag is set.
|
|
// Rows created by the old flow (before the column existed) have the flag
|
|
// missing; heal it here so the re-sent mail can actually promote them.
|
|
if (user.app_metadata?.bankid_pending !== true) {
|
|
await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { ...(user.app_metadata ?? {}), bankid_pending: true },
|
|
})
|
|
}
|
|
const sent = await sendBankIdSignupConfirmation({
|
|
supabase,
|
|
email: user.email,
|
|
host: forwardedHost(request),
|
|
})
|
|
if (!sent.ok) {
|
|
log.warn('could not re-send bankid confirmation mail', { userId, step: sent.step })
|
|
}
|
|
}
|
|
|
|
return NextResponse.json(
|
|
{
|
|
error: 'email_unconfirmed',
|
|
message:
|
|
'Bekräfta din e-postadress först. Vi har skickat ett nytt bekräftelsemail till adressen du angav när kontot skapades.',
|
|
},
|
|
{ status: 403 }
|
|
)
|
|
}
|
|
|
|
/**
|
|
* The same BankID signs up again while an earlier signup is still pending
|
|
* (typo'd address, lost mail). Clear the stale link so this attempt can start
|
|
* over with the address typed now. The stale account is deleted outright only
|
|
* while it is still the unconfirmed shell the signup made (bankid_identities
|
|
* cascades); if somebody else has adopted it in the meantime, only the BankID
|
|
* link is removed and their account is left alone. False = could not clear.
|
|
*/
|
|
async function clearStalePendingSignup(supabase: SupabaseClient, userId: string): Promise<boolean> {
|
|
const { data } = await supabase.auth.admin.getUserById(userId)
|
|
const user = data?.user
|
|
|
|
if (user && isUnadoptedPendingAccount(user)) {
|
|
const { error } = await supabase.auth.admin.deleteUser(userId)
|
|
if (error) {
|
|
log.error('could not delete stale pending bankid signup', { userId, message: error.message })
|
|
return false
|
|
}
|
|
log.info('stale pending bankid signup deleted for re-signup', { userId })
|
|
return true
|
|
}
|
|
|
|
if (user) {
|
|
log.warn('pending bankid identity revoked at re-signup: account adopted by another credential', {
|
|
userId,
|
|
})
|
|
}
|
|
return revokePendingIdentity(supabase, userId, user?.app_metadata)
|
|
}
|
|
|
|
/**
|
|
* Claim a BankID session, atomically and exactly once.
|
|
*
|
|
* The flow lives in a cookie now, so every tab of the browser shares one
|
|
* session and two of them can observe `status: complete` in the same poll tick.
|
|
* Both would call generateLink(), and the second magic link invalidates the
|
|
* first, so the tab the user is actually looking at may be the one that fails.
|
|
* Expiring the cookie on the way out does not prevent it: a Set-Cookie only
|
|
* applies once a response reaches the browser, and two requests that already
|
|
* carried the cookie both pass. The primary key is the only genuinely atomic
|
|
* thing available (serverless has no shared memory), so the loser of the race
|
|
* gets 23505 and stops before minting anything.
|
|
*
|
|
* Returns false when the session was already spent.
|
|
*/
|
|
async function consumeBankIdSession(
|
|
supabase: SupabaseClient,
|
|
sessionId: string
|
|
): Promise<boolean> {
|
|
const { error } = await supabase
|
|
.from('bankid_consumed_sessions')
|
|
.insert({ session_id: sessionId })
|
|
|
|
if (!error) return true
|
|
// 23505 unique_violation: another request got here first.
|
|
if (error.code === '23505') return false
|
|
|
|
// Anything else (table missing, connection lost) must fail closed: minting a
|
|
// second magic link is worse than making the user authenticate again.
|
|
log.error('could not claim bankid session; refusing to complete', {
|
|
code: error.code,
|
|
message: error.message,
|
|
})
|
|
return false
|
|
}
|
|
|
|
/**
|
|
* Request SPAR + CompanyRoles enrichment for a completed BankID session and
|
|
* cache the CompanyRoles slice in `bankid_enrichment` for the
|
|
* /select-company picker.
|
|
*
|
|
* Stored in `bankid_enrichment` (user-keyed) rather than `extension_data`
|
|
* because enrichment runs before the user has a company; `extension_data`
|
|
* has been company-scoped (NOT NULL company_id) since the multi-tenant
|
|
* refactor.
|
|
*
|
|
* SPAR (personnummer, address, name, birth date) is requested so TIC will
|
|
* complete the enrichment, but is intentionally NOT persisted: personnummer
|
|
* is already hashed + encrypted in `bankid_identities`, names live there too,
|
|
* and no UI currently consumes the address. Storing the SPAR blob alongside
|
|
* company roles would expose national-ID-level PII. If/when address pre-fill
|
|
* is built, encrypt the relevant fields the same way `encryptPersonalNumber`
|
|
* does for pnr.
|
|
*
|
|
* Non-blocking: any failure is logged and swallowed: BankID auth must still
|
|
* succeed even if enrichment is down.
|
|
*/
|
|
async function fetchAndStoreEnrichment(
|
|
sessionId: string,
|
|
userId: string,
|
|
supabase: SupabaseClient,
|
|
): Promise<void> {
|
|
try {
|
|
// Both 'SPAR' and 'CompanyRoles' are enabled on our TIC tenant as of
|
|
// 2026-05-06 (TIC ticket re. enrichment). Verify with:
|
|
// curl -H "X-Api-Key: $KEY" https://id.tic.io/api/v1/enrichment/types
|
|
//
|
|
// If a requested type is disabled on the tenant, TIC rejects the WHOLE
|
|
// enrichment with body field `error: 'Session not completed'` (HTTP 200,
|
|
// not a real HTTP error). The message is misleading: it does NOT mean
|
|
// the BankID session is incomplete. The hint mapping below catches it.
|
|
const enrichment = await requestEnrichment(sessionId, ['SPAR', 'CompanyRoles'])
|
|
log.info('enrichment request returned', {
|
|
status: enrichment.status,
|
|
requestedTypes: enrichment.requestedTypes,
|
|
completedTypes: enrichment.completedTypes,
|
|
hasSecureUrl: !!enrichment.secureUrl,
|
|
})
|
|
|
|
// Case-insensitive status comparison: TIC has been observed returning
|
|
// lowercase values ('completed', 'failed') in addition to the docs' canonical
|
|
// capitalized form. Accept both fully and partially completed runs.
|
|
const statusLower = String(enrichment.status ?? '').toLowerCase()
|
|
const isCompleted = statusLower === 'completed' || statusLower === 'partiallycompleted'
|
|
const usable = isCompleted && enrichment.secureUrl
|
|
if (!usable) {
|
|
// Log the full response shape (sans secureUrl, time-limited token)
|
|
// so we can diagnose why a real-user enrichment comes back non-usable.
|
|
// eslint-disable-next-line @typescript-eslint/no-unused-vars
|
|
const { secureUrl: _omit, ...responseDiagnostic } = enrichment
|
|
|
|
// Interpret common failure shapes into actionable hints so developers
|
|
// don't have to re-trace this every time. TIC returns these as body
|
|
// fields with HTTP 200, not as errors: see TIC_AUTH.md §enrichment.
|
|
const errField = (enrichment as { error?: string }).error ?? ''
|
|
let hint: string | undefined
|
|
if (errField === 'Session not completed') {
|
|
// Two distinct causes produce this identical error:
|
|
// 1. We requested a type not enabled on the tenant (most common,
|
|
// verify via GET /api/v1/enrichment/types)
|
|
// 2. The BankID session genuinely never went through the
|
|
// consent-to-enrich dialog
|
|
hint = 'Likely cause: a requested enrichment type is not enabled on the TIC tenant. Run `curl -H "X-Api-Key: $KEY" https://id.tic.io/api/v1/enrichment/types` to verify which types have `enabled: true` and adjust the requestEnrichment call to match.'
|
|
} else if (errField.toLowerCase().includes('not enabled')) {
|
|
hint = 'Enrichment explicitly disabled on TIC tenant: contact support@tic.io.'
|
|
} else if (errField.toLowerCase().includes('too old')) {
|
|
hint = '>30 min between auth completion and enrichment call: check for slow server-side work between /bankid/complete and fetchAndStoreEnrichment.'
|
|
}
|
|
|
|
log.warn('enrichment not usable', { ...responseDiagnostic, hint })
|
|
return
|
|
}
|
|
|
|
const enrichmentData = await fetchEnrichmentData(enrichment.secureUrl)
|
|
|
|
// Log a PII-free snapshot so we can debug the role filter in production.
|
|
// Raw personnummer / names / address values are deliberately omitted:
|
|
// only flat booleans and counts.
|
|
const firstRole = enrichmentData.companyRoles?.[0]
|
|
const spar = enrichmentData.spar
|
|
log.info('enrichment data shape', {
|
|
companyCount: enrichmentData.companyRoles?.length ?? 0,
|
|
firstRoleStatuses: firstRole
|
|
? {
|
|
companyStatus: firstRole.companyStatus,
|
|
positionEndIsNull: firstRole.positionEnd === null,
|
|
positionTypes: firstRole.positionTypes,
|
|
legalEntityType: firstRole.legalEntityType,
|
|
}
|
|
: null,
|
|
hasSpar: !!spar,
|
|
sparHasAddress: !!spar?.Folkbokforingsadress_SvenskAdress_Utdelningsadress1,
|
|
sparHasProtection: !!(spar?.Skydd_Sekretessmarkering || spar?.Skydd_SkyddadFolkbokforing),
|
|
})
|
|
|
|
// Persist only what consumers actually read. See block comment on
|
|
// fetchAndStoreEnrichment for why SPAR + personnummer + name are excluded.
|
|
const { error: upsertError } = await supabase
|
|
.from('bankid_enrichment')
|
|
.upsert({
|
|
user_id: userId,
|
|
company_roles: enrichmentData.companyRoles ?? [],
|
|
enriched_at_utc: enrichmentData.enrichedAtUtc ?? null,
|
|
}, { onConflict: 'user_id' })
|
|
|
|
if (upsertError) {
|
|
log.warn('enrichment upsert failed (non-blocking)', {
|
|
message: upsertError.message,
|
|
code: upsertError.code,
|
|
details: upsertError.details,
|
|
hint: upsertError.hint,
|
|
})
|
|
} else {
|
|
log.info('enrichment persisted to bankid_enrichment', {
|
|
roleCount: enrichmentData.companyRoles?.length ?? 0,
|
|
})
|
|
}
|
|
} catch (enrichError) {
|
|
log.warn('enrichment failed (non-blocking)', enrichError)
|
|
}
|
|
}
|
|
|
|
// Server-side per-IP rate limit for /bankid/start (each call = billable TIC session)
|
|
const bankIdStartCooldowns = new Map<string, number>()
|
|
const BANKID_START_COOLDOWN_MS = 5_000
|
|
|
|
/**
|
|
* Map a v2 `CompanyDocument` (financial-report subset) into the legacy
|
|
* `TICFinancialReportSummary` shape consumed by TicWorkspace. v2 nests
|
|
* the metadata under `financialReportMetadata` and replaces v1's
|
|
* `isAudited` boolean / `auditOpinion` string with auditor identity
|
|
* fields: we derive `isAudited` from the presence of an auditor.
|
|
*/
|
|
function toFinancialReportSummary(
|
|
doc: import('./lib/tic-types').TICDocument
|
|
): TICFinancialReportSummary {
|
|
const meta = doc.financialReportMetadata ?? {}
|
|
const hasAuditor = Boolean(meta.auditor || meta.auditorFullName || meta.auditCompanyName)
|
|
return {
|
|
title: doc.type === 'annualReport' ? 'Årsredovisning' : doc.type,
|
|
arrivalDate: meta.arrivalDate ?? undefined,
|
|
registrationDate: meta.registrationDate ?? undefined,
|
|
periodStart: meta.periodStart ?? undefined,
|
|
periodEnd: meta.periodEnd ?? undefined,
|
|
isInterimReport: meta.isInterimReport ?? undefined,
|
|
isConsolidatedAccounts: meta.isConsolidatedAccounts ?? undefined,
|
|
isAudited: hasAuditor ? true : undefined,
|
|
auditOpinion: meta.auditorFullName ?? meta.auditCompanyName ?? undefined,
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Translate any error from the TIC pipeline into a structured HTTP response.
|
|
*
|
|
* Status mapping:
|
|
* - NOT_CONFIGURED → 503 (proxy URL missing)
|
|
* - RATE_LIMIT_EXCEEDED → 429 (TIC quota hit)
|
|
* - TIMEOUT → 504 (TIC took longer than 15s)
|
|
* - upstream 4xx → 400 (TIC rejected the input: typically a malformed org number)
|
|
* - upstream 5xx → 502 (TIC outage)
|
|
* - other / unknown → 500
|
|
*
|
|
* Always logs the cleaned org number so we can correlate failures with input
|
|
* in Vercel logs.
|
|
*/
|
|
function handleTicError(
|
|
error: unknown,
|
|
log: { error: (msg: string, meta?: unknown) => void } | Console,
|
|
route: 'lookup' | 'profile' | 'search',
|
|
orgNumber: string,
|
|
fallbackMessage: string
|
|
): Response {
|
|
if (error instanceof TICAPIError) {
|
|
const meta = {
|
|
route,
|
|
orgNumber,
|
|
message: error.message,
|
|
statusCode: error.statusCode,
|
|
code: error.code,
|
|
}
|
|
|
|
if (error.code === 'NOT_CONFIGURED') {
|
|
log.error(`[tic] ${route}: not configured`, meta)
|
|
return NextResponse.json({ error: 'TIC is not configured' }, { status: 503 })
|
|
}
|
|
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
log.error(`[tic] ${route}: rate limit exceeded`, meta)
|
|
return NextResponse.json({ error: 'Rate limit exceeded, try again later' }, { status: 429 })
|
|
}
|
|
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error(`[tic] ${route}: upstream timeout`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service did not respond in time' },
|
|
{ status: 504 }
|
|
)
|
|
}
|
|
|
|
// Upstream returned a non-OK status we surfaced as a TICAPIError
|
|
if (typeof error.statusCode === 'number') {
|
|
if (error.statusCode >= 400 && error.statusCode < 500) {
|
|
log.error(`[tic] ${route}: upstream rejected request`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'Invalid request to TIC (upstream rejected)' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
if (error.statusCode >= 500) {
|
|
log.error(`[tic] ${route}: upstream error`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
}
|
|
|
|
// Network/DNS/parse failure surfaced as a TICAPIError without code or statusCode
|
|
log.error(`[tic] ${route}: upstream failure`, meta)
|
|
return NextResponse.json(
|
|
{ error: 'TIC service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
|
|
log.error(`[tic] ${route}: unexpected error`, {
|
|
route,
|
|
orgNumber,
|
|
error: error instanceof Error ? { name: error.name, message: error.message, stack: error.stack } : String(error),
|
|
})
|
|
return NextResponse.json({ error: fallbackMessage }, { status: 500 })
|
|
}
|
|
|
|
export const ticExtension: Extension = {
|
|
id: 'tic',
|
|
name: 'Bolagsuppgifter',
|
|
version: '1.0.0',
|
|
sector: 'general',
|
|
|
|
apiRoutes: [
|
|
{
|
|
method: 'GET',
|
|
path: '/lookup',
|
|
// Used during onboarding (Step2CompanyDetails debounced lookup + the
|
|
// BankID picker): user is authenticated but does not yet have a
|
|
// company. Must not require a company context.
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request, ctx?) => {
|
|
const log = ctx?.log ?? console
|
|
const url = new URL(request.url)
|
|
const orgNumber = url.searchParams.get('org_number')
|
|
|
|
if (!orgNumber) {
|
|
return NextResponse.json(
|
|
{ error: 'org_number query parameter is required' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const cleanedOrgNumber = orgNumber.replace(/[\s-]/g, '')
|
|
|
|
try {
|
|
// Single Lens call: the search-public document already includes
|
|
// sniCodes, bankAccounts, emailAddresses, phoneNumbers, and the
|
|
// registration flags at the top level: we used to fan out to
|
|
// five dedicated endpoints for the same data (6 calls total) and
|
|
// the 3 000/mo TIC budget couldn't sustain it. This endpoint now
|
|
// costs ~1 call. Fiscal-year MM-DD is derived from
|
|
// mostRecentFinancialSummary.periodStart/periodEnd when present;
|
|
// newly-registered companies without a financial summary return
|
|
// fiscalYear: null and the client-side first-year derivation
|
|
// takes over (see deriveFirstYearDefaults).
|
|
const result = await lookupCompanyByOrgNumber(orgNumber)
|
|
|
|
if (!result) {
|
|
return NextResponse.json(
|
|
{ error: 'Company not found' },
|
|
{ status: 404 }
|
|
)
|
|
}
|
|
|
|
return NextResponse.json({ data: result })
|
|
} catch (error) {
|
|
return handleTicError(error, log, 'lookup', cleanedOrgNumber, 'Failed to look up company')
|
|
}
|
|
},
|
|
},
|
|
{
|
|
method: 'GET',
|
|
path: '/profile',
|
|
// Used during onboarding to render richer company profile details:
|
|
// user is authenticated but may not yet have a company. See /lookup.
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request, ctx?) => {
|
|
const log = ctx?.log ?? console
|
|
const url = new URL(request.url)
|
|
const orgNumber = url.searchParams.get('org_number')
|
|
|
|
if (!orgNumber) {
|
|
return NextResponse.json(
|
|
{ error: 'org_number query parameter is required' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const cleanedOrgNumber = orgNumber.replace(/[\s-]/g, '')
|
|
|
|
try {
|
|
const doc = await searchCompanyByOrgNumber(orgNumber)
|
|
|
|
if (!doc) {
|
|
return NextResponse.json(
|
|
{ error: 'Company not found' },
|
|
{ status: 404 }
|
|
)
|
|
}
|
|
|
|
const nameEntry =
|
|
doc.names.find((n) => n.companyNamingType === 'name') ?? doc.names[0]
|
|
const companyName = nameEntry?.nameOrIdentifier ?? ''
|
|
const companyId = doc.companyId
|
|
|
|
// Phase 2: ONLY data not already present at the top level of the
|
|
// search doc. We dropped bank-accounts, industries, email-addresses,
|
|
// phone-numbers, purposes, and signatory: those duplicate the
|
|
// search-doc fields and were burning 6 Lens calls per /profile
|
|
// for nothing. Per-/profile cost: 13 → 7 calls.
|
|
const [
|
|
documentsResult,
|
|
fiscalYearResult,
|
|
payrollsResult,
|
|
representativesResult,
|
|
statusResult,
|
|
beneficialOwnersResult,
|
|
] = await Promise.allSettled([
|
|
getCompanyDocuments(companyId),
|
|
getFiscalYears(companyId),
|
|
getPayrolls(companyId),
|
|
getRepresentatives(companyId),
|
|
getCompanyStatus(companyId),
|
|
getBeneficialOwners(companyId),
|
|
])
|
|
|
|
// Bankgiro list from search-doc (v2 `bankAccounts` array with
|
|
// `{accountNumber, bankAccountType}`).
|
|
const bankAccounts = (doc.bankAccounts ?? [])
|
|
.filter((ba) => ba.accountNumber != null && ba.bankAccountType === 'bankgiro')
|
|
.map((ba) => ({
|
|
type: 'bankgiro',
|
|
accountNumber: String(ba.accountNumber),
|
|
bic: null,
|
|
}))
|
|
|
|
// SNI codes from search-doc (`sniCodes` array with `sni_2007Code`).
|
|
const sniCodes = (doc.sniCodes ?? [])
|
|
.filter((s) => s.sni_2007Code)
|
|
.map((s) => ({
|
|
code: s.sni_2007Code ?? '',
|
|
name: s.sni_2007Name ?? '',
|
|
}))
|
|
|
|
const email = doc.emailAddresses?.[0]?.emailAddress ?? null
|
|
|
|
const phone =
|
|
doc.phoneNumbers?.[0]?.phoneNumberFormatted
|
|
?? doc.phoneNumbers?.[0]?.e164PhoneNumber
|
|
?? null
|
|
|
|
// v2 `/companies/{id}/documents` returns every document the
|
|
// company has filed; filter to annualReport rows and map into
|
|
// the legacy summary shape the workspace expects. Kept as a
|
|
// dedicated call: doc.documents has a different shape
|
|
// (`companyDocumentType` vs `type`) so direct substitution
|
|
// would silently drop annualReport detection.
|
|
const financialReports =
|
|
documentsResult.status === 'fulfilled' && documentsResult.value
|
|
? documentsResult.value
|
|
.filter((d) => d.type === 'annualReport')
|
|
.map(toFinancialReportSummary)
|
|
: []
|
|
|
|
// Purpose: take `doc.mostRecentPurpose` directly. Dropped the
|
|
// /purposes call (which sorted history descending and picked
|
|
// the latest non-empty entry): the search doc's
|
|
// mostRecentPurpose is the same most-recently-registered string.
|
|
const purpose = doc.mostRecentPurpose ?? null
|
|
|
|
// ── New v2 sections ─────────────────────────────────────────
|
|
// Fiscal years: pick most-recently-updated row with both
|
|
// start and end populated, plus a deduped history of distinct
|
|
// start/end pairs sorted newest first.
|
|
const fiscalYearRows =
|
|
fiscalYearResult.status === 'fulfilled' && fiscalYearResult.value
|
|
? [...fiscalYearResult.value].sort((a, b) =>
|
|
(b.lastUpdatedAtUtc ?? '').localeCompare(a.lastUpdatedAtUtc ?? '')
|
|
)
|
|
: []
|
|
const fiscalYearCurrent = fiscalYearRows.find(
|
|
(fy) => fy.startMonthDay && fy.endMonthDay
|
|
)
|
|
const fiscalYear = fiscalYearCurrent
|
|
? {
|
|
startMonthDay: fiscalYearCurrent.startMonthDay ?? null,
|
|
endMonthDay: fiscalYearCurrent.endMonthDay ?? null,
|
|
description: fiscalYearCurrent.startEndDescription ?? null,
|
|
}
|
|
: null
|
|
|
|
const fiscalYearHistorySeen = new Set<string>()
|
|
const fiscalYearHistory: import('./lib/tic-types').TICProfileFiscalYear[] = []
|
|
for (const fy of fiscalYearRows) {
|
|
if (!fy.startMonthDay && !fy.endMonthDay) continue
|
|
const key = `${fy.startMonthDay ?? ''}|${fy.endMonthDay ?? ''}`
|
|
if (fiscalYearHistorySeen.has(key)) continue
|
|
fiscalYearHistorySeen.add(key)
|
|
fiscalYearHistory.push({
|
|
startMonthDay: fy.startMonthDay ?? null,
|
|
endMonthDay: fy.endMonthDay ?? null,
|
|
description: fy.startEndDescription ?? null,
|
|
})
|
|
}
|
|
|
|
// Signatory: free-form firmateckning descriptions. v2 search doc
|
|
// exposes `mostRecentSignatory` directly (single entry). Drops the
|
|
// dedicated /signatory call: historical signatory entries are rare
|
|
// to use in onboarding and the current entry is what the review
|
|
// card surfaces.
|
|
const signatory = (() => {
|
|
const desc = doc.mostRecentSignatory?.signatureDescription?.trim()
|
|
return desc ? [{ description: desc }] : []
|
|
})()
|
|
|
|
// Board summary: most recently updated row from
|
|
// representativeInformation
|
|
const reprInfoRows =
|
|
representativesResult.status === 'fulfilled' && representativesResult.value?.representativeInformation
|
|
? [...representativesResult.value.representativeInformation].sort((a, b) =>
|
|
(b.lastUpdatedAtUtc ?? '').localeCompare(a.lastUpdatedAtUtc ?? '')
|
|
)
|
|
: []
|
|
const reprInfo = reprInfoRows[0]
|
|
const board = reprInfo
|
|
? {
|
|
numberOfBoardMembers: reprInfo.numberOfBoardMembers ?? null,
|
|
numberOfDeputyBoardMembers: reprInfo.numberOfDeputyBoardMembers ?? null,
|
|
hasVacancy: reprInfo.hasVacancy ?? null,
|
|
missingCEODate: reprInfo.missingCEODate ?? null,
|
|
missingAuditor: reprInfo.missingAuditor ?? null,
|
|
lastChangeDate: reprInfo.lastChangeDate ?? null,
|
|
}
|
|
: null
|
|
|
|
// Representatives: filter to currently-active positions
|
|
// (positionEnd null or in the future) sorted by start date desc
|
|
const nowIso = new Date().toISOString()
|
|
const representatives =
|
|
representativesResult.status === 'fulfilled' && representativesResult.value?.representatives
|
|
? representativesResult.value.representatives
|
|
.filter((p) => !p.positionEnd || p.positionEnd > nowIso)
|
|
.sort((a, b) => (b.positionStart ?? '').localeCompare(a.positionStart ?? ''))
|
|
.map((p) => ({
|
|
name: p.roleByPersonName ?? null,
|
|
positionType: p.positionType ?? null,
|
|
positionDescription: p.positionDescription ?? null,
|
|
positionStart: p.positionStart ?? null,
|
|
positionEnd: p.positionEnd ?? null,
|
|
}))
|
|
: []
|
|
|
|
// Payrolls: map the modern payroll2 array, newest first
|
|
const payrolls =
|
|
payrollsResult.status === 'fulfilled' && payrollsResult.value?.payroll2
|
|
? [...payrollsResult.value.payroll2]
|
|
.sort((a, b) => (b.periodEnd ?? '').localeCompare(a.periodEnd ?? ''))
|
|
.map((p) => ({
|
|
periodStart: p.periodStart ?? null,
|
|
periodEnd: p.periodEnd ?? null,
|
|
numberOfEmployees: p.numberOfEmployees ?? null,
|
|
sumPayrollTax: p.sumPayrollTax ?? null,
|
|
calculatedPersonnelCosts: p.calculatedPersonnelCosts ?? null,
|
|
personnelCostsInAnnualReport: p.personnelCostsInAnnualReport ?? null,
|
|
deviation: p.deviation ?? null,
|
|
numberOfLateFeesForPeriod: p.numberOfLateFeesForPeriod ?? null,
|
|
}))
|
|
: []
|
|
|
|
// Statuses: most recent first; map traffic-light color through
|
|
// unchanged so the UI can render a badge.
|
|
const statuses: import('./lib/tic-types').TICProfileStatus[] =
|
|
statusResult.status === 'fulfilled' && statusResult.value
|
|
? [...statusResult.value]
|
|
.sort((a, b) => (b.statusDate ?? '').localeCompare(a.statusDate ?? ''))
|
|
.map((s) => {
|
|
const color = s.statusColor
|
|
const validColor: 'red' | 'yellow' | 'green' | 'neutral' | null =
|
|
color === 'red' || color === 'yellow' || color === 'green' || color === 'neutral'
|
|
? color
|
|
: null
|
|
return {
|
|
code: s.companyStatusDescription?.code ?? null,
|
|
description:
|
|
s.companyStatusDescription?.name_SE
|
|
?? s.statusDescription
|
|
?? s.companyStatusDescription?.name_EN
|
|
?? null,
|
|
color: validColor,
|
|
statusDate: s.statusDate ?? null,
|
|
isCeased: s.companyStatusDescription?.isCeased ?? null,
|
|
}
|
|
})
|
|
: []
|
|
|
|
// Log Phase 2 failures
|
|
if (documentsResult.status === 'rejected') {
|
|
log.warn('[tic] profile: documents fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(documentsResult.reason) })
|
|
}
|
|
if (fiscalYearResult.status === 'rejected') {
|
|
log.warn('[tic] profile: fiscal years fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(fiscalYearResult.reason) })
|
|
}
|
|
if (payrollsResult.status === 'rejected') {
|
|
log.warn('[tic] profile: payrolls fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(payrollsResult.reason) })
|
|
}
|
|
if (representativesResult.status === 'rejected') {
|
|
log.warn('[tic] profile: representatives fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(representativesResult.reason) })
|
|
}
|
|
if (statusResult.status === 'rejected') {
|
|
log.warn('[tic] profile: status fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(statusResult.reason) })
|
|
}
|
|
if (beneficialOwnersResult.status === 'rejected') {
|
|
log.warn('[tic] profile: beneficial-owners fetch failed', { orgNumber: cleanedOrgNumber, companyId, reason: String(beneficialOwnersResult.reason) })
|
|
}
|
|
|
|
// Flatten the beneficial-owners response. Bolagsverket returns one
|
|
// notification per registration event; the latest active
|
|
// notification's owners are the current ones. v2 returns the
|
|
// notifications as a top-level array (v1's wrapper with
|
|
// `.notifications` / `.exempts` is gone). Personnummer is
|
|
// intentionally excluded: PII we don't need cached and we
|
|
// don't want it persisted on `companies.tic_snapshot`.
|
|
let beneficialOwners: TICCompanyProfile['beneficialOwners'] = []
|
|
if (beneficialOwnersResult.status === 'fulfilled' && beneficialOwnersResult.value) {
|
|
const notifications = Array.isArray(beneficialOwnersResult.value)
|
|
? beneficialOwnersResult.value
|
|
: []
|
|
// Prefer the latest notification by notificationDate (already
|
|
// sorted descending in practice, but we sort defensively).
|
|
const latest = [...notifications]
|
|
.filter((n) => n && Array.isArray(n.bolagsverket_BeneficialOwner))
|
|
.sort((a, b) => {
|
|
const ad = a.notificationDate ?? ''
|
|
const bd = b.notificationDate ?? ''
|
|
return bd.localeCompare(ad)
|
|
})[0]
|
|
if (latest?.bolagsverket_BeneficialOwner) {
|
|
beneficialOwners = latest.bolagsverket_BeneficialOwner
|
|
.map((o) => {
|
|
const nameParts = [o.firstName, o.middleName, o.lastName]
|
|
.map((p) => (p ?? '').trim())
|
|
.filter((p) => p.length > 0)
|
|
const name = nameParts.length > 0 ? nameParts.join(' ') : (o.fallbackName ?? '').trim()
|
|
if (!name) return null
|
|
return {
|
|
name,
|
|
extentCode: o.extentCode ?? null,
|
|
extentDescription: o.extentDescription ?? null,
|
|
citizenshipCountryCode: o.citizenshipCountryCode ?? null,
|
|
countryOfResidenceCode: o.countryOfResidenceCode ?? null,
|
|
registeredAt: latest.fromDate ?? latest.notificationDate ?? null,
|
|
}
|
|
})
|
|
.filter((o): o is NonNullable<typeof o> => o !== null)
|
|
}
|
|
}
|
|
|
|
const fin = doc.mostRecentFinancialSummary
|
|
const financials = fin
|
|
? {
|
|
periodStart: fin.periodStart,
|
|
periodEnd: fin.periodEnd,
|
|
netSalesK: fin.rs_NetSalesK ?? null,
|
|
operatingProfitK: fin.rs_OperatingProfitOrLossK ?? null,
|
|
totalAssetsK: fin.bs_TotalAssetsK ?? null,
|
|
numberOfEmployees: fin.fn_NumberOfEmployees ?? null,
|
|
operatingMargin: fin.km_OperatingMargin ?? null,
|
|
netProfitMargin: fin.km_NetProfitMargin ?? null,
|
|
equityAssetsRatio: fin.km_EquityAssetsRatio ?? null,
|
|
}
|
|
: null
|
|
|
|
// Translate v2's activityStatus enum into the v1 string the
|
|
// TicWorkspace `!== 'ceased'` check still compares against, so
|
|
// the UI keeps showing "Avregistrerat" for deregistered
|
|
// companies without UI changes.
|
|
const isCeasedProfile = doc.isCeased ?? doc.activityStatus === 'isNoLongerActive'
|
|
const profile: TICCompanyProfile = {
|
|
companyId,
|
|
orgNumber: doc.registrationNumber,
|
|
companyName,
|
|
legalEntityType: doc.legalEntityType,
|
|
registrationDate: registrationDateToMs(doc.registrationDate) ?? 0,
|
|
activityStatus: isCeasedProfile ? 'ceased' : (doc.activityStatus ?? null),
|
|
purpose,
|
|
address: doc.mostRecentRegisteredAddress
|
|
? {
|
|
street: doc.mostRecentRegisteredAddress.streetAddress ?? null,
|
|
postalCode: doc.mostRecentRegisteredAddress.postalCode ?? null,
|
|
city: doc.mostRecentRegisteredAddress.city ?? null,
|
|
}
|
|
: null,
|
|
registration: {
|
|
fTax: doc.isRegisteredForFTax ?? false,
|
|
vat: doc.isRegisteredForVAT ?? false,
|
|
payroll: doc.isRegisteredForPayroll ?? false,
|
|
},
|
|
sector: doc.cSector
|
|
? { code: doc.cSector.categoryCode, description: doc.cSector.categoryCodeDescription }
|
|
: null,
|
|
employeeRange: doc.cNbrEmployeesInterval?.categoryCodeDescription ?? null,
|
|
turnoverRange: doc.cTurnoverInterval?.categoryCodeDescription ?? null,
|
|
email,
|
|
phone,
|
|
sniCodes,
|
|
bankAccounts,
|
|
beneficialOwners,
|
|
financials,
|
|
financialReports,
|
|
fiscalYear,
|
|
fiscalYearHistory,
|
|
signatory,
|
|
board,
|
|
representatives,
|
|
payrolls,
|
|
statuses,
|
|
fetchedAt: new Date().toISOString(),
|
|
}
|
|
|
|
return NextResponse.json({ data: profile })
|
|
} catch (error) {
|
|
return handleTicError(error, log, 'profile', cleanedOrgNumber, 'Failed to fetch company profile')
|
|
}
|
|
},
|
|
},
|
|
// ── BankID Authentication ──────────────────────────────────────
|
|
// Routes for BankID login/signup via TIC Identity API.
|
|
// skipAuth: true on auth routes (user has no Supabase session yet).
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/start',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const ip = request.headers.get('x-forwarded-for')?.split(',')[0]?.trim()
|
|
|| request.headers.get('x-real-ip')
|
|
|| '127.0.0.1'
|
|
|
|
// The flow a session is opened for is fixed here and read back at
|
|
// /complete, so a 'link' session can never be finished as a 'login'.
|
|
// Validated before the rate limit: a malformed request starts no
|
|
// billable session, so it should not spend the caller's cooldown and
|
|
// lock them out of the retry that would have worked.
|
|
const body = await request.json().catch(() => ({}))
|
|
const mode = body?.mode
|
|
if (!isBankIdFlowMode(mode)) {
|
|
return NextResponse.json({ error: 'mode is required' }, { status: 400 })
|
|
}
|
|
|
|
// A link flow is owned by the user who opened it. /bankid/link binds
|
|
// the personnummer to whoever is authenticated when it runs, so an
|
|
// unowned link flow left behind in a shared browser would let the
|
|
// next person to sign in pick it up and bind the FIRST person's
|
|
// identity to their own account. Login and signup have no user yet
|
|
// and stay anonymous.
|
|
let userId: string | undefined
|
|
if (mode === 'link') {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
userId = auth.user.id
|
|
}
|
|
|
|
// Per-IP rate limit (each start = billable TIC session)
|
|
const now = Date.now()
|
|
const lastStart = bankIdStartCooldowns.get(ip) ?? 0
|
|
if (now - lastStart < BANKID_START_COOLDOWN_MS) {
|
|
return NextResponse.json({ error: 'Too many requests' }, { status: 429 })
|
|
}
|
|
bankIdStartCooldowns.set(ip, now)
|
|
|
|
// Prevent map from growing unbounded
|
|
if (bankIdStartCooldowns.size > 10_000) {
|
|
const cutoff = now - BANKID_START_COOLDOWN_MS
|
|
for (const [k, v] of bankIdStartCooldowns) {
|
|
if (v < cutoff) bankIdStartCooldowns.delete(k)
|
|
}
|
|
}
|
|
|
|
const userAgent = request.headers.get('user-agent') || undefined
|
|
const session = await startBankIdAuth(ip, userAgent)
|
|
const flowId = crypto.randomUUID()
|
|
|
|
// sessionId is deliberately NOT in the response. It is a bearer
|
|
// credential for the holder's personnummer and for a Supabase
|
|
// session; it goes into the signed HttpOnly cookie instead, and the
|
|
// client drives the flow without ever seeing it.
|
|
const response = NextResponse.json({
|
|
data: {
|
|
flowId,
|
|
autoStartToken: session.autoStartToken,
|
|
qrStartToken: session.qrStartToken,
|
|
qrStartSecret: session.qrStartSecret,
|
|
},
|
|
})
|
|
await setBankIdFlowCookies(response, {
|
|
version: 1,
|
|
sessionId: session.sessionId,
|
|
flowId,
|
|
mode,
|
|
userId,
|
|
startedAt: Date.now(),
|
|
expiresAt: Date.now() + FLOW_WINDOW_SECONDS * 1000,
|
|
})
|
|
return response
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
if (error.code === 'NOT_CONFIGURED') {
|
|
return NextResponse.json({ error: 'not_configured', message: 'BankID is not configured' }, { status: 503 })
|
|
}
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
return NextResponse.json({ error: 'rate_limit', message: 'Rate limit exceeded' }, { status: 429 })
|
|
}
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error('start timed out: TIC Identity API unreachable', { statusCode: error.statusCode })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is not responding' }, { status: 503 })
|
|
}
|
|
// TIC API returned an error (e.g. 5xx)
|
|
log.error('start failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' }, { status: 502 })
|
|
}
|
|
log.error('start failed: unexpected error', error)
|
|
return NextResponse.json({ error: 'internal_error', message: 'Failed to start BankID session' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/poll',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow) {
|
|
// No live flow in this browser: the tab is polling something that
|
|
// has finished, expired, or never belonged to it. Terminal, not an
|
|
// error, so the client can settle instead of spinning.
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
// The caller says which mode it is showing, and a flow only answers
|
|
// to its own. Without this a login session started on /login is
|
|
// picked up by the signup panel (or the reverse) whenever the user
|
|
// navigates between them. Deliberately NOT clearing: the flow is
|
|
// still legitimate for the page that started it.
|
|
const pollBody = await request.json().catch(() => ({}))
|
|
if (!isBankIdFlowMode(pollBody?.mode) || pollBody.mode !== flow.mode) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
const isProbe = pollBody?.probe === true
|
|
|
|
// The cookie is shared by every tab. A newer same-mode /start can
|
|
// replace it while an older tab is still polling, so mode alone is
|
|
// not enough: without the flow id, that stale tab would silently
|
|
// follow and complete the newer person's identification. A mount
|
|
// probe has no id yet and may discover it, but every active poll must
|
|
// present the id returned by /start or by that probe.
|
|
if (!isProbe && request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
let result: Awaited<ReturnType<typeof pollBankIdSession>>
|
|
try {
|
|
result = await pollBankIdSession(flow.sessionId)
|
|
} catch (error) {
|
|
// TIC no longer knows this session (404), or answered 410 for an
|
|
// expired one. Report it as no_session so the client settles
|
|
// instead of counting it as a service outage.
|
|
//
|
|
// Deliberately does NOT clear the cookie. A clearing Set-Cookie is
|
|
// untargeted: a slow response about a dead session would delete
|
|
// whatever flow is in the jar by the time it lands, including one
|
|
// the user has just started in another tab. The stale cookie is
|
|
// harmless (it answers no_session again and expires on its own),
|
|
// whereas deleting a live flow costs a billable session.
|
|
if (error instanceof TICAPIError && (error.statusCode === 404 || error.statusCode === 410)) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
throw error
|
|
}
|
|
|
|
// An expired-session body comes back with no `status` at all
|
|
// (identityFetch returns a 410 body verbatim). Same treatment.
|
|
if (!result?.status) {
|
|
return NextResponse.json({ error: 'no_session' }, { status: 404 })
|
|
}
|
|
|
|
if (result.status !== 'pending') {
|
|
log.info('poll status', { status: result.status, hintCode: result.hintCode, hasUser: !!result.user?.personalNumber })
|
|
}
|
|
|
|
// Whitelist the fields the UI renders. The raw TIC payload carries
|
|
// user.personalNumber, which the client has never used and must
|
|
// never receive: this endpoint is skipAuth, so anything it returns
|
|
// is readable by whoever holds the flow cookie.
|
|
//
|
|
// The name (givenName/surname) is withheld from a PROBE. A probe runs
|
|
// before the person here has confirmed the flow is theirs, so
|
|
// returning the name would hand a stranger's identity to whoever
|
|
// opened the page on a shared machine, defeating the confirm card.
|
|
// The signup e-mail step needs the name, but it is reached only
|
|
// through the active poll loop (no probe mode), which does get it.
|
|
const response = NextResponse.json({
|
|
data: {
|
|
flowId: isProbe ? flow.flowId : undefined,
|
|
status: result.status,
|
|
message: result.message,
|
|
hintCode: result.hintCode,
|
|
qrStartToken: result.qrStartToken,
|
|
qrStartSecret: result.qrStartSecret,
|
|
user: !isProbe && result.user
|
|
? { givenName: result.user.givenName, surname: result.user.surname }
|
|
: undefined,
|
|
},
|
|
})
|
|
|
|
// A failed or cancelled order is over. Not cleared here for the same
|
|
// reason as the dead-session branch above: the Set-Cookie cannot be
|
|
// aimed at one flow, so a late response would delete a newer one.
|
|
// The client settles on this status, and the cookie expires.
|
|
if (result.status === 'complete') {
|
|
// Identification is done; what remains is the signup e-mail step,
|
|
// which is a person typing. Re-issue with the longer window so a
|
|
// user hunting for the right address does not have the session
|
|
// expire under them: on the old client-state design this step was
|
|
// bounded only by TIC's own retention.
|
|
await setBankIdFlowCookies(response, {
|
|
...flow,
|
|
expiresAt: Date.now() + FLOW_VERIFIED_WINDOW_SECONDS * 1000,
|
|
})
|
|
}
|
|
return response
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
if (error.code === 'RATE_LIMIT_EXCEEDED') {
|
|
return NextResponse.json({ error: 'rate_limit', message: 'Rate limit exceeded' }, { status: 429 })
|
|
}
|
|
if (error.code === 'TIMEOUT') {
|
|
log.error('poll timed out: TIC Identity API unreachable')
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is not responding' }, { status: 503 })
|
|
}
|
|
log.error('poll failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json({ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' }, { status: 502 })
|
|
}
|
|
log.error('poll failed: unexpected error', error)
|
|
return NextResponse.json({ error: 'internal_error', message: 'Failed to poll BankID session' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/complete',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
// Session id and mode come from the signed cookie, never the body:
|
|
// a caller who could name both could complete any session it had
|
|
// seen, in whatever flow suited it.
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
const { sessionId, mode } = flow
|
|
|
|
// The shared cookie may have been replaced by a newer flow after
|
|
// this tab started. Only the tab that started or explicitly resumed
|
|
// the current flow may complete it.
|
|
if (request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
if (mode === 'link') {
|
|
// Linking runs on the authenticated /bankid/link route, which
|
|
// proves who is being linked. Completing a link flow here would
|
|
// create or sign in an account off a session opened for something
|
|
// else entirely.
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
const body = await request.json().catch(() => ({}))
|
|
const trimmedEmail = typeof body?.email === 'string'
|
|
? body.email.trim().toLowerCase()
|
|
: undefined
|
|
|
|
if (mode === 'signup' && !trimmedEmail) {
|
|
return NextResponse.json(
|
|
{ error: 'email is required for signup' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
/**
|
|
* Every exit from here clears the flow, so a session is usable
|
|
* exactly once. Two tabs that both observe completion cannot both
|
|
* mint a magic link: the second finds no cookie and gets
|
|
* session_invalid, instead of a generateLink that silently
|
|
* invalidates the first tab's link and breaks the sign-in.
|
|
*/
|
|
const settle = (response: NextResponse): NextResponse => {
|
|
clearBankIdFlowCookies(response)
|
|
return response
|
|
}
|
|
|
|
// Verify BankID session is complete. The message surfaces directly
|
|
// in the register-page toast, so it must be Swedish.
|
|
const session = await collectBankIdResult(sessionId)
|
|
if (session.status !== 'complete' || !session.user) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { personalNumber, givenName, surname, name } = session.user
|
|
const pnrHash = hashPersonalNumber(personalNumber)
|
|
const supabase = createServiceClient()
|
|
|
|
// Look up existing BankID identity. email_verified_at NULL means the
|
|
// address on the account was never proven (pending signup): such an
|
|
// identity signs nobody in and is not "linked" for signup purposes.
|
|
const { data: existing, error: lookupError } = await supabase
|
|
.from('bankid_identities')
|
|
.select('user_id, email_verified_at')
|
|
.eq('personal_number_hash', pnrHash)
|
|
.single()
|
|
|
|
// PGRST116 is .single() finding no row, which is the normal "not
|
|
// linked" answer. Anything else (schema behind the code, connection
|
|
// lost) must not read as "no account": that would send every
|
|
// returning BankID user to signup. Not settled, so the completed
|
|
// identification survives a retry.
|
|
if (lookupError && lookupError.code !== 'PGRST116') {
|
|
log.error('bankid_identities lookup failed', {
|
|
code: lookupError.code,
|
|
message: lookupError.message,
|
|
})
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'Tillfälligt fel. Försök igen om en stund.' },
|
|
{ status: 503 }
|
|
)
|
|
}
|
|
|
|
if (mode === 'login') {
|
|
if (!existing) {
|
|
// Terminal for a login flow: the user is sent to signup, which
|
|
// starts its own session.
|
|
return settle(NextResponse.json({
|
|
error: 'no_account',
|
|
givenName,
|
|
surname,
|
|
}, { status: 404 }))
|
|
}
|
|
|
|
// Returning user. Load the account before deciding anything: a
|
|
// pending identity is refused (never a magic link), see
|
|
// refusePendingLogin.
|
|
const { data: userData } = await supabase.auth.admin.getUserById(existing.user_id)
|
|
|
|
if (existing.email_verified_at === null) {
|
|
return settle(
|
|
await refusePendingLogin(
|
|
supabase,
|
|
existing.user_id,
|
|
userData?.user,
|
|
{ givenName, surname },
|
|
request,
|
|
)
|
|
)
|
|
}
|
|
|
|
if (!userData?.user?.email) {
|
|
// Data problem, not a transient one: an identity with no user
|
|
// email will never complete. settle() so it is not re-offered as
|
|
// a resumable flow on the next page load.
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'User account not found' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Claim the session BEFORE minting anything. Two tabs sharing this
|
|
// browser's flow cookie can both arrive here; only one may mint,
|
|
// because the second magic link invalidates the first.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { data: link, error: linkError } = await supabase.auth.admin.generateLink({
|
|
type: 'magiclink',
|
|
email: userData.user.email,
|
|
})
|
|
|
|
if (linkError || !link?.properties?.hashed_token) {
|
|
log.error('generateLink failed for login', { message: linkError?.message, code: linkError?.code })
|
|
// The session is already consumed, so a retry would fail with
|
|
// session_invalid anyway; settle() clears the cookie now instead
|
|
// of leaving a spent flow to be re-offered as resumable.
|
|
return settle(NextResponse.json(
|
|
{ error: 'Failed to create session' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Refresh enrichment so /select-company sees current Bolagsverket roles.
|
|
await fetchAndStoreEnrichment(sessionId, existing.user_id, supabase)
|
|
|
|
// settle(): the magic link is minted, so the flow is spent. A
|
|
// second tab reaching here would mint another and invalidate this
|
|
// one; it now gets session_invalid instead.
|
|
return settle(NextResponse.json({
|
|
data: {
|
|
tokenHash: link.properties.hashed_token,
|
|
type: 'magiclink',
|
|
isNewUser: false,
|
|
},
|
|
}))
|
|
}
|
|
|
|
// mode === 'signup'
|
|
if (existing && existing.email_verified_at !== null) {
|
|
// Terminal: this BankID already has an account, so the answer is
|
|
// to sign in, not to retry this session.
|
|
return settle(NextResponse.json(
|
|
{ error: 'already_linked', message: 'This BankID is already linked to an account' },
|
|
{ status: 409 }
|
|
))
|
|
}
|
|
|
|
if (existing) {
|
|
// Pending identity from an earlier signup by this same BankID.
|
|
// Not settled: the identification is still good, only the stale
|
|
// link is in the way. A failure here is transient by nature.
|
|
if (!await clearStalePendingSignup(supabase, existing.user_id)) {
|
|
return NextResponse.json(SIGNUP_FAILED, { status: 500 })
|
|
}
|
|
}
|
|
|
|
const host = forwardedHost(request)
|
|
|
|
// Invite-only brand domain gate (founder decision 2026-08-27):
|
|
// same rule POST /api/auth/signup enforces on the email path. Runs
|
|
// AFTER the existing-identity check so a returning user's login is
|
|
// never blocked, and before anything is created or consumed:
|
|
// deliberately NOT settled, so the visitor keeps the completed
|
|
// BankID identification if the byrå allowlists them mid-flow.
|
|
const gateResult = await evaluateBrandSignupGate({
|
|
host,
|
|
email: trimmedEmail!,
|
|
inviteToken: readInviteTokenFromCookieHeader(request.headers.get('cookie')),
|
|
})
|
|
if (!gateResult.allowed && 'lookupFailed' in gateResult) {
|
|
// Transient brands-table error: fail safe, do not create the
|
|
// account. Not settled, so the completed BankID flow can retry.
|
|
return NextResponse.json(
|
|
{
|
|
error: 'brand_lookup_failed',
|
|
message: 'Tillfälligt fel. Försök igen om en stund.',
|
|
},
|
|
{ status: 503 }
|
|
)
|
|
}
|
|
if (!gateResult.allowed) {
|
|
return NextResponse.json(
|
|
{
|
|
error: 'signup_not_allowed',
|
|
message: 'Registrering på den här domänen kräver inbjudan.',
|
|
},
|
|
{ status: 403 }
|
|
)
|
|
}
|
|
|
|
// Create new Supabase user. Email uniqueness is checked by createUser
|
|
// itself against auth.users: do NOT pre-check profiles.email instead.
|
|
// The profile mirror can lack the address while the auth row still
|
|
// holds it (anonymize_user_account scrubs profiles.email but keeps the
|
|
// auth tombstone), which used to fall through to a dead-end 500 here.
|
|
//
|
|
// email_confirm: false. The address came from the request body and
|
|
// nothing has proven it belongs to the person holding the BankID.
|
|
// Confirming it here let anyone open an account on a stranger's
|
|
// address and keep a BankID login into it after the stranger adopted
|
|
// it (account pre-hijacking, security audit 2026-09). The address is
|
|
// confirmed by the mail sent below, and only then does the identity
|
|
// count (see lib/bankid-pending.ts).
|
|
const randomPassword = crypto.randomBytes(32).toString('base64url')
|
|
const { data: newUser, error: createError } = await supabase.auth.admin.createUser({
|
|
email: trimmedEmail!,
|
|
email_confirm: false,
|
|
password: randomPassword,
|
|
user_metadata: { full_name: name },
|
|
})
|
|
|
|
if (createError || !newUser?.user) {
|
|
// Email already registered (including deleted-account tombstones,
|
|
// which keep their email on purpose): refuse signup. Linking BankID
|
|
// to an existing account must go through the authenticated
|
|
// /bankid/link route so email ownership is proven by password login
|
|
// first. (CWE-287)
|
|
if (createError?.code === 'email_exists') {
|
|
// The session id is a bearer credential for a personnummer at
|
|
// TIC; a prefix is enough to correlate log lines.
|
|
log.warn('bankid signup rejected: email already registered', {
|
|
sessionIdPrefix: sessionId.slice(0, 8),
|
|
pnrHashPrefix: pnrHash.slice(0, 8),
|
|
})
|
|
// Deliberately NOT settled: nothing was consumed and the user
|
|
// may simply have typed the wrong address. Leaving the flow
|
|
// alive lets them correct it without a second BankID round trip.
|
|
return NextResponse.json(
|
|
{
|
|
error: 'account_exists',
|
|
message: 'Det finns redan ett konto med den här e-postadressen. Logga in och koppla BankID under Inställningar.',
|
|
},
|
|
{ status: 409 }
|
|
)
|
|
}
|
|
log.error('createUser failed', {
|
|
emailHashPrefix: crypto.createHash('sha256').update(trimmedEmail!).digest('hex').slice(0, 8),
|
|
status: createError?.status,
|
|
code: createError?.code,
|
|
message: createError?.message,
|
|
})
|
|
return NextResponse.json(SIGNUP_FAILED, { status: 500 })
|
|
}
|
|
|
|
const userId = newUser.user.id
|
|
|
|
// All-or-nothing signup: if any step after createUser fails, delete
|
|
// the just-created user so the same email/BankID can retry cleanly.
|
|
// Leaving the half-created account behind strands the user: a retry
|
|
// hits account_exists/already_linked, but the account only has a
|
|
// random password they never saw, so "log in instead" requires a
|
|
// password reset. bankid_identities cascades on user delete.
|
|
const rollbackSignup = async (step: string) => {
|
|
const { error: deleteError } = await supabase.auth.admin.deleteUser(userId)
|
|
if (deleteError) {
|
|
log.error(`signup rollback after failed ${step} could not delete user: orphaned account`, {
|
|
userId,
|
|
message: deleteError.message,
|
|
})
|
|
}
|
|
}
|
|
|
|
// Mark the BankID link as PENDING, not linked: bankid_linked (which
|
|
// skips TOTP MFA, lib/auth/mfa.ts) is set by /auth/callback once the
|
|
// confirmation mail is clicked. has_password: false records that the
|
|
// BankID signup gave them a random server-side password they will
|
|
// never see; it gates MFA enrollment (see lib/auth/has-password.ts).
|
|
const { error: metaError } = await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { bankid_pending: true, has_password: false },
|
|
})
|
|
|
|
if (metaError) {
|
|
log.error('signup app_metadata update failed', { message: metaError.message, code: metaError.code })
|
|
await rollbackSignup('app_metadata update')
|
|
return NextResponse.json(SIGNUP_FAILED, { status: 500 })
|
|
}
|
|
|
|
// Store BankID identity, unverified until the mail is clicked.
|
|
const { error: insertError } = await supabase
|
|
.from('bankid_identities')
|
|
.insert({
|
|
user_id: userId,
|
|
personal_number_hash: pnrHash,
|
|
personal_number_enc: encryptPersonalNumberForStorage(personalNumber),
|
|
given_name: givenName,
|
|
surname,
|
|
email_verified_at: null,
|
|
})
|
|
|
|
if (insertError) {
|
|
log.error('insert bankid_identities failed', { message: insertError.message, code: insertError.code })
|
|
await rollbackSignup('bankid_identities insert')
|
|
return NextResponse.json(SIGNUP_FAILED, { status: 500 })
|
|
}
|
|
|
|
// Claim the session before mailing. Placed after createUser so the
|
|
// recoverable account_exists path above leaves the flow reusable,
|
|
// and before the mail so two tabs cannot both send one.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
await rollbackSignup('session already consumed')
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID-sessionen är inte längre giltig. Försök igen.' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
// Mail the confirmation link to the typed address. The token never
|
|
// reaches the browser: whoever reads that inbox proves the address,
|
|
// and /auth/callback promotes the identity when they click.
|
|
const sent = await sendBankIdSignupConfirmation({
|
|
supabase,
|
|
email: trimmedEmail!,
|
|
host,
|
|
})
|
|
|
|
if (!sent.ok) {
|
|
log.error('bankid signup confirmation mail failed', { step: sent.step, message: sent.message })
|
|
await rollbackSignup(`confirmation mail (${sent.step})`)
|
|
// The session was already consumed above, so this flow cannot be
|
|
// retried; settle() clears it rather than leaving a spent,
|
|
// rolled-back flow to be re-offered as resumable.
|
|
return settle(NextResponse.json(
|
|
{ error: 'internal_error', message: 'Kunde inte skicka bekräftelsemailet. Försök igen.' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Enrichment (CompanyRoles): pre-fills /select-company picker.
|
|
await fetchAndStoreEnrichment(sessionId, userId, supabase)
|
|
|
|
// settle(): account created and the mail is out. The flow is spent.
|
|
// Same shape as POST /api/auth/signup, so the register page can show
|
|
// its existing "check your inbox" screen. No session, no token.
|
|
return settle(NextResponse.json({
|
|
data: {
|
|
status: 'confirmation_sent',
|
|
email: trimmedEmail!,
|
|
},
|
|
}))
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
log.error('complete failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
if (error.code === 'TIMEOUT') {
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID service is not responding' },
|
|
{ status: 503 }
|
|
)
|
|
}
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID verification failed' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
log.error('complete failed: unexpected error', error)
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Failed to complete BankID authentication' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
// Was DELETE /bankid/:sessionId. The id is no longer something the
|
|
// client knows, so cancelling is now "end whatever flow this browser
|
|
// holds": it cannot be aimed at anyone else's session.
|
|
path: '/bankid/cancel',
|
|
skipAuth: true,
|
|
handler: async (request: Request) => {
|
|
// A malformed cookie must still be clearable rather than turning
|
|
// Avbryt into a 500.
|
|
const flow = await readBankIdFlow(request).catch(() => null)
|
|
|
|
if (flow && request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
// A newer tab replaced the shared cookie. This caller may settle its
|
|
// own stale UI, but it must not cancel or clear the newer flow.
|
|
return NextResponse.json({ data: { cancelled: false, replaced: true } })
|
|
}
|
|
|
|
const response = NextResponse.json({ data: { cancelled: true } })
|
|
clearBankIdFlowCookies(response)
|
|
|
|
if (flow) {
|
|
try {
|
|
await cancelBankIdSession(flow.sessionId)
|
|
} catch (error) {
|
|
log.error('cancel failed', error)
|
|
}
|
|
}
|
|
return response
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/link',
|
|
// Requires a Supabase session but NOT a company: a user who just
|
|
// signed up (or hasn't finished onboarding) must be able to manage
|
|
// their BankID connection from /settings/account. Without this flag
|
|
// the dispatcher's requireCompanyId() throws 'No company context'
|
|
// for zero-company users. skipCompanyContext dispatches without ctx,
|
|
// so the handler resolves the caller itself via requireAuth() (same
|
|
// MFA/AAL2 enforcement the dispatcher applies).
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request) => {
|
|
try {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
const userId = auth.user.id
|
|
|
|
// Cookie, not body, and the mode must be the one the session was
|
|
// opened for. Otherwise a session started to sign SOMEONE ELSE in
|
|
// could be redirected into binding their personnummer to whoever is
|
|
// currently logged in on this browser.
|
|
const flow = await readBankIdFlow(request)
|
|
if (!flow || flow.mode !== 'link') {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
if (request.headers.get(BANKID_FLOW_ID_HEADER) !== flow.flowId) {
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
// The flow must belong to the caller. Mode alone is not enough: this
|
|
// route binds a personnummer to whoever is authenticated right now,
|
|
// so a link flow that someone else started and abandoned in this
|
|
// browser would otherwise bind THEIR identity to THIS account, and
|
|
// they could then sign in as this user with their own BankID.
|
|
if (flow.userId !== userId) {
|
|
log.warn('bankid link rejected: flow belongs to another user')
|
|
return NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
const { sessionId } = flow
|
|
|
|
/** Linking is single-use for the same reason completing is. */
|
|
const settle = (response: NextResponse): NextResponse => {
|
|
clearBankIdFlowCookies(response)
|
|
return response
|
|
}
|
|
|
|
// Verify BankID session
|
|
const session = await collectBankIdResult(sessionId)
|
|
if (session.status !== 'complete' || !session.user) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
const { personalNumber, givenName, surname } = session.user
|
|
const pnrHash = hashPersonalNumber(personalNumber)
|
|
const supabase = createServiceClient()
|
|
|
|
// Check personnummer not already linked to another user
|
|
const { data: existing } = await supabase
|
|
.from('bankid_identities')
|
|
.select('user_id')
|
|
.eq('personal_number_hash', pnrHash)
|
|
.single()
|
|
|
|
if (existing && existing.user_id !== userId) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'already_linked', message: 'This BankID is already linked to another account' },
|
|
{ status: 409 }
|
|
))
|
|
}
|
|
|
|
if (existing && existing.user_id === userId) {
|
|
return settle(NextResponse.json({ data: { linked: true, alreadyLinked: true } }))
|
|
}
|
|
|
|
// Single-use, same reason as /complete: two tabs sharing this
|
|
// browser's flow must not both act on one identification.
|
|
if (!await consumeBankIdSession(supabase, sessionId)) {
|
|
return settle(NextResponse.json(
|
|
{ error: 'session_invalid', message: 'BankID session is not complete' },
|
|
{ status: 400 }
|
|
))
|
|
}
|
|
|
|
// Link BankID to current user. The caller is authenticated, so the
|
|
// address on the account is already theirs: verified from the start
|
|
// (the column has no default; NULL would make this a pending link
|
|
// that refuses to sign in).
|
|
const { error: insertError } = await supabase
|
|
.from('bankid_identities')
|
|
.insert({
|
|
user_id: userId,
|
|
personal_number_hash: pnrHash,
|
|
personal_number_enc: encryptPersonalNumberForStorage(personalNumber),
|
|
given_name: givenName,
|
|
surname,
|
|
email_verified_at: new Date().toISOString(),
|
|
})
|
|
|
|
if (insertError) {
|
|
log.error('link insert failed', { message: insertError.message, code: insertError.code })
|
|
// Session already consumed above, so the flow is spent; clear it.
|
|
return settle(NextResponse.json(
|
|
{ error: 'Failed to link BankID' },
|
|
{ status: 500 }
|
|
))
|
|
}
|
|
|
|
// Read-merge-write: updateUserById REPLACES app_metadata wholesale
|
|
// (see app/api/account/password/route.ts). Passing just
|
|
// { bankid_linked: true } would wipe has_password for users who
|
|
// already set one, they'd then be incorrectly shown the
|
|
// set-password banner on their next session.
|
|
const { data: priorUser } = await supabase.auth.admin.getUserById(userId)
|
|
const priorMeta = priorUser?.user?.app_metadata ?? {}
|
|
await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { ...priorMeta, bankid_linked: true },
|
|
})
|
|
|
|
return settle(NextResponse.json({ data: { linked: true } }))
|
|
} catch (error) {
|
|
if (error instanceof TICAPIError) {
|
|
log.error('link failed: TIC API error', { statusCode: error.statusCode, code: error.code, message: error.message })
|
|
return NextResponse.json(
|
|
{ error: 'service_unavailable', message: 'BankID service is temporarily unavailable' },
|
|
{ status: 502 }
|
|
)
|
|
}
|
|
log.error('link failed: unexpected error', error)
|
|
return NextResponse.json(
|
|
{ error: 'internal_error', message: 'Failed to link BankID' },
|
|
{ status: 500 }
|
|
)
|
|
}
|
|
},
|
|
},
|
|
|
|
{
|
|
method: 'POST',
|
|
path: '/bankid/unlink',
|
|
// Requires a Supabase session but NOT a company: see /bankid/link.
|
|
// A brand-new BankID signup (zero companies) must be able to undo
|
|
// the connection from /settings/account.
|
|
skipCompanyContext: true,
|
|
handler: async (_request: Request) => {
|
|
try {
|
|
const auth = await requireAuth()
|
|
if (auth.error) return auth.error
|
|
const userId = auth.user.id
|
|
|
|
const supabase = createServiceClient()
|
|
|
|
// Delete bankid_identities row
|
|
const { error: deleteError } = await supabase
|
|
.from('bankid_identities')
|
|
.delete()
|
|
.eq('user_id', userId)
|
|
|
|
if (deleteError) {
|
|
log.error('unlink delete failed', { message: deleteError.message, code: deleteError.code })
|
|
return NextResponse.json({ error: 'Failed to unlink BankID' }, { status: 500 })
|
|
}
|
|
|
|
// Clear app_metadata.bankid_linked so MFA enforcement resumes.
|
|
// Read-merge-write: updateUserById REPLACES app_metadata wholesale
|
|
// (same rationale as /bankid/link above). Writing only
|
|
// { bankid_linked: false } would wipe has_password: a BankID-only
|
|
// user (has_password: false) would then be inferred as HAVING a
|
|
// password (lib/auth/has-password.ts) and could strand themselves
|
|
// with no working login method.
|
|
const { data: priorUser } = await supabase.auth.admin.getUserById(userId)
|
|
const priorMeta = priorUser?.user?.app_metadata ?? {}
|
|
await supabase.auth.admin.updateUserById(userId, {
|
|
app_metadata: { ...priorMeta, bankid_linked: false },
|
|
})
|
|
|
|
return NextResponse.json({ data: { unlinked: true } })
|
|
} catch (error) {
|
|
log.error('unlink failed', error)
|
|
return NextResponse.json({ error: 'Failed to unlink BankID' }, { status: 500 })
|
|
}
|
|
},
|
|
},
|
|
{
|
|
method: 'GET',
|
|
path: '/search',
|
|
// Onboarding's orgnr field also accepts a company name: one Lens call
|
|
// returns up to five hits in /lookup's shape so a pick needs no second
|
|
// call. User is authenticated but may not yet have a company.
|
|
skipCompanyContext: true,
|
|
handler: async (request: Request, ctx?) => {
|
|
const log = ctx?.log ?? console
|
|
const url = new URL(request.url)
|
|
const query = (url.searchParams.get('q') ?? '').trim()
|
|
|
|
if (query.length < COMPANY_SEARCH_MIN_CHARS) {
|
|
return NextResponse.json(
|
|
{ error: `q must be at least ${COMPANY_SEARCH_MIN_CHARS} characters` },
|
|
{ status: 400 }
|
|
)
|
|
}
|
|
|
|
try {
|
|
const hits = await searchCompaniesForLookup(query)
|
|
if (hits.length === 0) {
|
|
return NextResponse.json({ error: 'Company not found' }, { status: 404 })
|
|
}
|
|
return NextResponse.json({ data: hits })
|
|
} catch (error) {
|
|
return handleTicError(error, log, 'search', query, 'Failed to search companies')
|
|
}
|
|
},
|
|
},
|
|
],
|
|
|
|
eventHandlers: [],
|
|
}
|