Mattsson
a1a816b4a5
* Implement company and account deletion features - Add event types for company and account deletion to CoreEvent. - Enhance Supabase middleware to handle company context resolution and cookie management for archived companies. - Create API routes for deleting accounts and companies, including necessary validations and event emissions. - Implement tests for account and company deletion endpoints to ensure proper functionality and error handling. - Add retention notice component to inform users about bookkeeping data retention during destructive actions. - Create database migrations to support soft deletion of companies and anonymization of user accounts, ensuring compliance with retention laws. * feat: enhance account deletion process and update user notifications * Add service client for onboarding completion check and update escape hatch visibility * Enhance invite flow and email handling for company members * Refactor company context and RLS policies for active company isolation - Update `switchCompany` to remove unnecessary revalidation as client handles navigation. - Revise `getActiveCompanyId` to prioritize `user_preferences` and validate against non-archived memberships. - Modify `setActiveCompany` to ensure `user_preferences` is the authoritative source while maintaining cookie compatibility. - Enhance middleware to resolve active company using `user_preferences` and fallback to first non-archived membership. - Introduce new API route `/api/company/current` to fetch the active company ID for cross-tab synchronization. - Implement `CompanyTabSync` component for real-time active company enforcement across tabs. - Create migration for RLS policies to enforce single-active-company isolation using `current_active_company_id()`. * feat: implement viewer role enforcement for write permissions - Added `useCanWrite` hook to determine if the current user has write permissions based on their role in the active company. - Updated various components (JournalEntryForm, CustomerForm, DeadlineForm, etc.) to disable write actions and show a lock icon with a tooltip for users without write permissions. - Introduced `requireWritePermission` function to enforce write permissions at the API level, returning a 403 response for viewers. - Created tests to verify the behavior of the viewer role and write permissions. - Added database migration to enforce read-only access for viewers at the database level.
489 lines
17 KiB
TypeScript
489 lines
17 KiB
TypeScript
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
|
import {
|
|
createMockRequest,
|
|
parseJsonResponse,
|
|
createMockRouteParams,
|
|
createQueuedMockSupabase,
|
|
makeTransaction,
|
|
makeInvoice,
|
|
makeCustomer,
|
|
} from '@/tests/helpers'
|
|
|
|
const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
|
|
vi.mock('@/lib/supabase/server', () => ({
|
|
createClient: () => Promise.resolve(mockSupabase),
|
|
}))
|
|
|
|
const mockCreateInvoicePaymentJournalEntry = vi.fn()
|
|
const mockCreateInvoiceCashEntry = vi.fn()
|
|
vi.mock('@/lib/bookkeeping/invoice-entries', () => ({
|
|
createInvoicePaymentJournalEntry: (...args: unknown[]) => mockCreateInvoicePaymentJournalEntry(...args),
|
|
createInvoiceCashEntry: (...args: unknown[]) => mockCreateInvoiceCashEntry(...args),
|
|
getRevenueAccount: vi.fn().mockReturnValue('3001'),
|
|
getOutputVatAccount: vi.fn().mockReturnValue('2611'),
|
|
}))
|
|
|
|
const mockReverseEntry = vi.fn()
|
|
vi.mock('@/lib/bookkeeping/engine', () => ({
|
|
reverseEntry: (...args: unknown[]) => mockReverseEntry(...args),
|
|
}))
|
|
|
|
vi.mock('@/lib/invoices/match-log', () => ({
|
|
logMatchEvent: vi.fn(),
|
|
}))
|
|
|
|
vi.mock('@/lib/events/bus', () => ({
|
|
eventBus: { emit: vi.fn() },
|
|
}))
|
|
|
|
vi.mock('@/lib/init', () => ({
|
|
ensureInitialized: vi.fn(),
|
|
}))
|
|
|
|
vi.mock('@/lib/company/context', () => ({
|
|
requireCompanyId: vi.fn().mockResolvedValue('company-1'),
|
|
getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
|
|
}))
|
|
|
|
vi.mock('@/lib/auth/require-write', () => ({
|
|
requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
|
|
}))
|
|
|
|
import { POST } from '../route'
|
|
|
|
const VALID_UUID = '550e8400-e29b-41d4-a716-446655440000'
|
|
const VALID_UUID_2 = '550e8400-e29b-41d4-a716-446655440001'
|
|
|
|
describe('POST /api/transactions/[id]/match-invoice', () => {
|
|
const mockUser = { id: 'user-1', email: 'test@test.se' }
|
|
|
|
beforeEach(() => {
|
|
vi.clearAllMocks()
|
|
reset()
|
|
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: mockUser } })
|
|
})
|
|
|
|
it('returns 401 when not authenticated', async () => {
|
|
mockSupabase.auth.getUser.mockResolvedValue({ data: { user: null } })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse(response)
|
|
|
|
expect(status).toBe(401)
|
|
expect(body).toEqual({ error: 'Unauthorized' })
|
|
})
|
|
|
|
it('returns 400 when invoice_id is missing', async () => {
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: {},
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(400)
|
|
expect(body.error).toBe('Validation failed')
|
|
})
|
|
|
|
it('returns 404 when transaction not found', async () => {
|
|
enqueue({ data: null, error: { message: 'Not found' } })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-999/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-999' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(404)
|
|
expect(body.error).toBe('Transaction not found')
|
|
})
|
|
|
|
it('returns 400 when transaction is an expense (amount <= 0)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: -500 })
|
|
enqueue({ data: tx, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(400)
|
|
expect(body.error).toBe('Only income transactions can be matched to invoices')
|
|
})
|
|
|
|
it('returns 400 when transaction is already linked to an invoice', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: 'inv-other' })
|
|
enqueue({ data: tx, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(400)
|
|
expect(body.error).toBe('Transaction is already linked to an invoice')
|
|
})
|
|
|
|
it('returns 404 when invoice not found', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null })
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: null, error: { message: 'Not found' } })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID_2 },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(404)
|
|
expect(body.error).toBe('Invoice not found')
|
|
})
|
|
|
|
it('returns 400 when invoice is not in unpaid state', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null })
|
|
const invoice = makeInvoice({ id: VALID_UUID, status: 'paid' })
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(400)
|
|
expect(body.error).toBe('Invoice is not in an unpaid state')
|
|
})
|
|
|
|
it('matches transaction to invoice with accrual method (full payment)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null, date: '2024-06-15' })
|
|
const customer = makeCustomer()
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
subtotal: 10000,
|
|
vat_amount: 2500,
|
|
invoice_number: 'F-2024001',
|
|
customer,
|
|
})
|
|
|
|
// Fetch transaction
|
|
enqueue({ data: tx, error: null })
|
|
// Fetch invoice
|
|
enqueue({ data: invoice, error: null })
|
|
// Fetch company settings
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-1' })
|
|
|
|
// Update invoice (optimistic lock returns updated row)
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// Insert invoice_payments
|
|
enqueue({ data: null, error: null })
|
|
// Update transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent insert (fire-and-forget)
|
|
enqueue({ data: null, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{
|
|
success: boolean
|
|
invoice_status: string
|
|
paid_amount: number
|
|
remaining_amount: number
|
|
journal_entry_id: string
|
|
}>(response)
|
|
|
|
expect(status).toBe(200)
|
|
expect(body.success).toBe(true)
|
|
expect(body.invoice_status).toBe('paid')
|
|
expect(body.paid_amount).toBe(12500)
|
|
expect(body.remaining_amount).toBe(0)
|
|
expect(body.journal_entry_id).toBe('je-1')
|
|
|
|
// Verify accrual payment entry was called with paymentAmount
|
|
expect(mockCreateInvoicePaymentJournalEntry).toHaveBeenCalledWith(
|
|
expect.anything(),
|
|
'company-1',
|
|
'user-1',
|
|
expect.objectContaining({ id: VALID_UUID }),
|
|
'2024-06-15',
|
|
undefined,
|
|
expect.anything(),
|
|
12500
|
|
)
|
|
})
|
|
|
|
it('stornos conflicting journal entry before matching', async () => {
|
|
const tx = makeTransaction({
|
|
id: 'tx-1',
|
|
amount: 12500,
|
|
invoice_id: null,
|
|
journal_entry_id: 'je-conflict',
|
|
date: '2024-06-15',
|
|
})
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
})
|
|
|
|
// Fetch transaction
|
|
enqueue({ data: tx, error: null })
|
|
// Fetch invoice
|
|
enqueue({ data: invoice, error: null })
|
|
|
|
mockReverseEntry.mockResolvedValue({ id: 'je-storno' })
|
|
// Clear journal_entry_id on transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent for storno
|
|
enqueue({ data: null, error: null })
|
|
|
|
// Fetch company settings
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-payment' })
|
|
|
|
// Update invoice (optimistic lock)
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// Insert invoice_payments
|
|
enqueue({ data: null, error: null })
|
|
// Update transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent for match
|
|
enqueue({ data: null, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ success: boolean; journal_entry_id: string }>(response)
|
|
|
|
expect(status).toBe(200)
|
|
expect(body.success).toBe(true)
|
|
expect(body.journal_entry_id).toBe('je-payment')
|
|
expect(mockReverseEntry).toHaveBeenCalledWith(expect.anything(), 'company-1', 'user-1', 'je-conflict')
|
|
})
|
|
|
|
it('returns 500 when storno fails — no partial state change', async () => {
|
|
const tx = makeTransaction({
|
|
id: 'tx-1',
|
|
amount: 12500,
|
|
invoice_id: null,
|
|
journal_entry_id: 'je-conflict',
|
|
})
|
|
const invoice = makeInvoice({ id: VALID_UUID, status: 'sent', remaining_amount: 12500 })
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
|
|
mockReverseEntry.mockRejectedValue(new Error('Period locked'))
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(500)
|
|
expect(body.error).toBe('Failed to reverse conflicting journal entry')
|
|
// Invoice should NOT have been updated — no further DB calls after storno failure
|
|
expect(mockCreateInvoicePaymentJournalEntry).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('supports partial payment (partially_paid status)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 5000, invoice_id: null, date: '2024-06-15' })
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
paid_amount: 0,
|
|
})
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-partial' })
|
|
|
|
// Update invoice (optimistic lock)
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// Insert invoice_payments
|
|
enqueue({ data: null, error: null })
|
|
// Update transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent
|
|
enqueue({ data: null, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{
|
|
success: boolean
|
|
invoice_status: string
|
|
paid_amount: number
|
|
remaining_amount: number
|
|
}>(response)
|
|
|
|
expect(status).toBe(200)
|
|
expect(body.invoice_status).toBe('partially_paid')
|
|
expect(body.paid_amount).toBe(5000)
|
|
expect(body.remaining_amount).toBe(7500)
|
|
})
|
|
|
|
it('cash method partial payment uses clearing entry with note', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 5000, invoice_id: null, date: '2024-06-15' })
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
paid_amount: 0,
|
|
})
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
enqueue({ data: { accounting_method: 'cash', entity_type: 'enskild_firma' }, error: null })
|
|
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-clearing' })
|
|
|
|
// Update invoice
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// Insert invoice_payments
|
|
enqueue({ data: null, error: null })
|
|
// Update transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent
|
|
enqueue({ data: null, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ invoice_status: string }>(response)
|
|
|
|
expect(status).toBe(200)
|
|
expect(body.invoice_status).toBe('partially_paid')
|
|
// Cash partial uses accrual-style clearing entry, NOT createInvoiceCashEntry
|
|
expect(mockCreateInvoicePaymentJournalEntry).toHaveBeenCalled()
|
|
expect(mockCreateInvoiceCashEntry).not.toHaveBeenCalled()
|
|
})
|
|
|
|
it('returns 409 when invoice is fully paid (optimistic lock)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null })
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
})
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-1' })
|
|
|
|
// Optimistic lock returns 0 rows (another request fully paid it)
|
|
enqueue({ data: [], error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(409)
|
|
expect(body.error).toContain('already been fully paid')
|
|
})
|
|
|
|
it('returns 409 on duplicate invoice_payment (unique constraint)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null })
|
|
const invoice = makeInvoice({
|
|
id: VALID_UUID,
|
|
status: 'sent',
|
|
total: 12500,
|
|
remaining_amount: 12500,
|
|
})
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
mockCreateInvoicePaymentJournalEntry.mockResolvedValue({ id: 'je-1' })
|
|
|
|
// Optimistic lock succeeds
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// invoice_payments insert fails with unique constraint violation
|
|
enqueue({ data: null, error: { code: '23505', message: 'duplicate' } })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{ error: string }>(response)
|
|
|
|
expect(status).toBe(409)
|
|
expect(body.error).toContain('already matched')
|
|
})
|
|
|
|
it('returns success with journal_entry_error when journal entry fails (non-blocking)', async () => {
|
|
const tx = makeTransaction({ id: 'tx-1', amount: 12500, invoice_id: null, date: '2024-06-15' })
|
|
const invoice = makeInvoice({ id: VALID_UUID, status: 'sent', total: 12500, remaining_amount: 12500 })
|
|
|
|
enqueue({ data: tx, error: null })
|
|
enqueue({ data: invoice, error: null })
|
|
enqueue({ data: { accounting_method: 'accrual', entity_type: 'enskild_firma' }, error: null })
|
|
|
|
mockCreateInvoicePaymentJournalEntry.mockRejectedValue(new Error('Period locked'))
|
|
|
|
// Update invoice (optimistic lock)
|
|
enqueue({ data: [{ id: VALID_UUID }], error: null })
|
|
// Insert invoice_payments
|
|
enqueue({ data: null, error: null })
|
|
// Update transaction
|
|
enqueue({ data: null, error: null })
|
|
// logMatchEvent
|
|
enqueue({ data: null, error: null })
|
|
|
|
const request = createMockRequest('/api/transactions/tx-1/match-invoice', {
|
|
method: 'POST',
|
|
body: { invoice_id: VALID_UUID },
|
|
})
|
|
const response = await POST(request, createMockRouteParams({ id: 'tx-1' }))
|
|
const { status, body } = await parseJsonResponse<{
|
|
success: boolean
|
|
journal_entry_id: null
|
|
journal_entry_error: string
|
|
}>(response)
|
|
|
|
expect(status).toBe(200)
|
|
expect(body.success).toBe(true)
|
|
expect(body.journal_entry_id).toBeNull()
|
|
expect(body.journal_entry_error).toBe('Period locked')
|
|
})
|
|
})
|