diff --git a/app/(dashboard)/dimensions/page.tsx b/app/(dashboard)/dimensions/page.tsx
new file mode 100644
index 00000000..29e29860
--- /dev/null
+++ b/app/(dashboard)/dimensions/page.tsx
@@ -0,0 +1,21 @@
+import { getTranslations } from 'next-intl/server'
+import { PageHeader } from '@/components/ui/page-header'
+import DimensionsManager from '@/components/dimensions/DimensionsManager'
+
+/**
+ * Kostnadsställen & projekt (dimension registry) — a Redovisning-group
+ * register peer to Kontoplan. Reference/configuration surface: manage the
+ * dimension values (#OBJEKT) that voucher lines are tagged with. Reachable
+ * only via the nav row when company_settings.dimensions_enabled is on, but
+ * the page itself never gates — the toggle is UI visibility, not correctness
+ * (dimensions plan §2).
+ */
+export default async function DimensionsPage() {
+ const t = await getTranslations('nav')
+ return (
+
+
+
+
+ )
+}
diff --git a/app/(dashboard)/layout.tsx b/app/(dashboard)/layout.tsx
index 45348691..955b59e9 100644
--- a/app/(dashboard)/layout.tsx
+++ b/app/(dashboard)/layout.tsx
@@ -188,7 +188,7 @@ export default async function DashboardLayout({
] = await Promise.all([
supabase
.from('company_settings')
- .select('company_name, onboarding_complete, entity_type, pays_salaries, is_sandbox')
+ .select('company_name, onboarding_complete, entity_type, pays_salaries, is_sandbox, dimensions_enabled')
.eq('company_id', companyId)
.single(),
// Shared worklist predicates (lib/worklist) — the badge must show the
@@ -226,6 +226,10 @@ export default async function DashboardLayout({
(companyRow.entity_type as EntityType) ||
'enskild_firma'
const paysSalaries = settings?.pays_salaries ?? false
+ // Dimensions register visibility (Kostnadsställen & projekt nav row). Same
+ // mechanism as paysSalaries: UI gate only, never load-bearing for
+ // correctness (dimensions plan §2).
+ const dimensionsEnabled = settings?.dimensions_enabled ?? false
const companyWithName = {
...companyRow,
name: displayName,
@@ -292,6 +296,7 @@ export default async function DashboardLayout({
companyName={settings?.company_name || 'Min verksamhet'}
entityType={entityType}
paysSalaries={paysSalaries}
+ dimensionsEnabled={dimensionsEnabled}
uncategorizedTransactionCount={uncategorizedCount}
pendingOperationsCount={pendingOpsCount}
isSandbox={isSandbox}
diff --git a/app/api/dimensions/[id]/route.ts b/app/api/dimensions/[id]/route.ts
new file mode 100644
index 00000000..447df499
--- /dev/null
+++ b/app/api/dimensions/[id]/route.ts
@@ -0,0 +1,78 @@
+/**
+ * PATCH /api/dimensions/[id] — update a dimension (name / is_active / sort_order).
+ *
+ * Guard rails:
+ * - Renaming an is_system dimension (1 = Kostnadsställe, 6 = Projekt) is
+ * rejected with 400 DIMENSION_SYSTEM_RENAME ("Systemdimensioner kan inte
+ * döpas om"). Archiving (is_active=false) and reordering remain allowed.
+ * - sie_dim_no / is_system are immutable at the DB level
+ * (enforce_dimension_registry_guards) and not accepted here at all.
+ */
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { validateBody } from '@/lib/api/validate'
+import { UpdateDimensionSchema } from '@/lib/api/schemas'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
+
+ensureInitialized()
+
+export const PATCH = withRouteContext(
+ 'dimension.update',
+ async (request, ctx, { params }: { params: Promise<{ id: string }> }) => {
+ const { id } = await params
+ const { supabase, companyId, log, requestId } = ctx
+ const opLog = log.child({ dimensionId: id })
+
+ const result = await validateBody(request, UpdateDimensionSchema, {
+ log: opLog,
+ operation: 'dimension.update',
+ })
+ if (!result.success) return result.response
+ const body = result.data
+
+ const { data: existing, error: fetchError } = await supabase
+ .from('dimensions')
+ .select('id, name, is_system')
+ .eq('id', id)
+ .eq('company_id', companyId)
+ .maybeSingle()
+
+ if (fetchError) {
+ opLog.error('dimension fetch failed', fetchError)
+ return errorResponse(fetchError, opLog, { requestId })
+ }
+ if (!existing) {
+ return errorResponseFromCode('DIMENSION_NOT_FOUND', opLog, { requestId })
+ }
+
+ if (existing.is_system && body.name !== undefined && body.name !== existing.name) {
+ return errorResponseFromCode('DIMENSION_SYSTEM_RENAME', opLog, { requestId })
+ }
+
+ // Sparse update — only the fields the caller actually sent.
+ const updateData: Record = {}
+ for (const key of ['name', 'is_active', 'sort_order'] as const) {
+ if (body[key] !== undefined) updateData[key] = body[key]
+ }
+
+ const { data, error } = await supabase
+ .from('dimensions')
+ .update(updateData)
+ .eq('id', id)
+ .eq('company_id', companyId)
+ .select('id, sie_dim_no, name, resets_annually, is_system, is_active, sort_order')
+ .single()
+
+ if (error) {
+ opLog.error('dimension update failed', error)
+ return errorResponseFromCode('DIMENSION_UPDATE_FAILED', opLog, {
+ requestId,
+ details: { reason: error.message },
+ })
+ }
+
+ return NextResponse.json({ data })
+ },
+ { requireWrite: true },
+)
diff --git a/app/api/dimensions/[id]/values/[valueId]/route.ts b/app/api/dimensions/[id]/values/[valueId]/route.ts
new file mode 100644
index 00000000..97161d5f
--- /dev/null
+++ b/app/api/dimensions/[id]/values/[valueId]/route.ts
@@ -0,0 +1,132 @@
+/**
+ * PATCH /api/dimensions/[id]/values/[valueId] — update a dimension value
+ * (name / is_active / start_date / end_date; `code` is immutable in v1).
+ * DELETE /api/dimensions/[id]/values/[valueId] — delete an UNREFERENCED value.
+ *
+ * Deleting a value referenced by posted/reversed lines is blocked by the DB
+ * retention trigger (enforce_dimension_value_retention, BFL 7-year
+ * philosophy). Its Swedish message ("Värdet "X" används på bokförda verifikat
+ * och kan inte tas bort — arkivera det istället.") is surfaced verbatim as a
+ * 409 DIMENSION_VALUE_REFERENCED so the register UI can toast it and offer
+ * archive instead.
+ */
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { validateBody } from '@/lib/api/validate'
+import { UpdateDimensionValueSchema } from '@/lib/api/schemas'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
+
+ensureInitialized()
+
+type ValueParams = { params: Promise<{ id: string; valueId: string }> }
+
+export const PATCH = withRouteContext(
+ 'dimension.value.update',
+ async (request, ctx, { params }: ValueParams) => {
+ const { id, valueId } = await params
+ const { supabase, companyId, log, requestId } = ctx
+ const opLog = log.child({ dimensionId: id, valueId })
+
+ const result = await validateBody(request, UpdateDimensionValueSchema, {
+ log: opLog,
+ operation: 'dimension.value.update',
+ })
+ if (!result.success) return result.response
+ const body = result.data
+
+ // Value dates only make sense on accumulating dimensions (projekt-style
+ // ranges). When the request carries an actual date (explicit null = clear,
+ // always allowed), check the parent dimension's resets_annually flag.
+ if (body.start_date != null || body.end_date != null) {
+ const { data: dimension, error: dimError } = await supabase
+ .from('dimensions')
+ .select('id, resets_annually')
+ .eq('id', id)
+ .eq('company_id', companyId)
+ .maybeSingle()
+
+ if (dimError) {
+ opLog.error('dimension fetch failed', dimError)
+ return errorResponse(dimError, opLog, { requestId })
+ }
+ if (!dimension) {
+ return errorResponseFromCode('DIMENSION_NOT_FOUND', opLog, { requestId })
+ }
+ if (dimension.resets_annually) {
+ return errorResponseFromCode('DIMENSION_VALUE_DATES_NOT_ALLOWED', opLog, { requestId })
+ }
+ }
+
+ // Sparse update — only the fields the caller actually sent. `code` is
+ // deliberately absent from the schema: renaming a code would silently
+ // orphan every line tagged with it.
+ const updateData: Record = {}
+ for (const key of ['name', 'is_active', 'start_date', 'end_date'] as const) {
+ if (body[key] !== undefined) updateData[key] = body[key]
+ }
+
+ const { data, error } = await supabase
+ .from('dimension_values')
+ .update(updateData)
+ .eq('id', valueId)
+ .eq('dimension_id', id)
+ .eq('company_id', companyId)
+ .select('id, dimension_id, code, name, is_active, start_date, end_date')
+ .single()
+
+ if (error) {
+ if (error.code === 'PGRST116') {
+ return errorResponseFromCode('DIMENSION_VALUE_NOT_FOUND', opLog, { requestId })
+ }
+ opLog.error('dimension value update failed', error)
+ return errorResponseFromCode('DIMENSION_VALUE_UPDATE_FAILED', opLog, {
+ requestId,
+ details: { reason: error.message },
+ })
+ }
+
+ return NextResponse.json({ data })
+ },
+ { requireWrite: true },
+)
+
+export const DELETE = withRouteContext(
+ 'dimension.value.delete',
+ async (_request, ctx, { params }: ValueParams) => {
+ const { id, valueId } = await params
+ const { supabase, companyId, log, requestId } = ctx
+ const opLog = log.child({ dimensionId: id, valueId })
+
+ const { data, error } = await supabase
+ .from('dimension_values')
+ .delete()
+ .eq('id', valueId)
+ .eq('dimension_id', id)
+ .eq('company_id', companyId)
+ .select('id')
+
+ if (error) {
+ // P0001 = plpgsql RAISE EXCEPTION — the retention trigger refusing the
+ // delete. Surface its Swedish message verbatim (it names the code).
+ if (error.code === 'P0001') {
+ return errorResponseFromCode('DIMENSION_VALUE_REFERENCED', opLog, {
+ requestId,
+ messageSv: error.message,
+ })
+ }
+ opLog.error('dimension value delete failed', error)
+ return errorResponseFromCode('DIMENSION_VALUE_DELETE_FAILED', opLog, {
+ requestId,
+ details: { reason: error.message },
+ })
+ }
+
+ if (!data || data.length === 0) {
+ return errorResponseFromCode('DIMENSION_VALUE_NOT_FOUND', opLog, { requestId })
+ }
+
+ return NextResponse.json({ success: true })
+ },
+ { requireWrite: true },
+)
diff --git a/app/api/dimensions/[id]/values/route.ts b/app/api/dimensions/[id]/values/route.ts
new file mode 100644
index 00000000..ed4cf50b
--- /dev/null
+++ b/app/api/dimensions/[id]/values/route.ts
@@ -0,0 +1,91 @@
+/**
+ * POST /api/dimensions/[id]/values — create a dimension value (SIE #OBJEKT).
+ *
+ * Codes are validated against the strict Fortnox format
+ * (^[A-Za-z0-9ÅÄÖåäö_+\-]{1,20}$) for user-created values — the DB CHECK is
+ * looser by design so legacy free-text codes survive the backfill/SIE import,
+ * but new registry codes minted here stay portable. Duplicate codes within the
+ * dimension return 409 DIMENSION_VALUE_DUPLICATE_CODE with a Swedish message.
+ * `code` is immutable after creation (v1: no rename — retag instead).
+ */
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { validateBody } from '@/lib/api/validate'
+import { CreateDimensionValueSchema } from '@/lib/api/schemas'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { errorResponse, errorResponseFromCode } from '@/lib/errors/get-structured-error'
+
+ensureInitialized()
+
+export const POST = withRouteContext(
+ 'dimension.value.create',
+ async (request, ctx, { params }: { params: Promise<{ id: string }> }) => {
+ const { id } = await params
+ const { supabase, companyId, log, requestId } = ctx
+ const opLog = log.child({ dimensionId: id })
+
+ const result = await validateBody(request, CreateDimensionValueSchema, {
+ log: opLog,
+ operation: 'dimension.value.create',
+ })
+ if (!result.success) return result.response
+ const body = result.data
+
+ // The dimension must exist and belong to the active company (defense in
+ // depth alongside the composite FK — a foreign dimension id 404s here).
+ const { data: dimension, error: dimError } = await supabase
+ .from('dimensions')
+ .select('id, resets_annually')
+ .eq('id', id)
+ .eq('company_id', companyId)
+ .maybeSingle()
+
+ if (dimError) {
+ opLog.error('dimension fetch failed', dimError)
+ return errorResponse(dimError, opLog, { requestId })
+ }
+ if (!dimension) {
+ return errorResponseFromCode('DIMENSION_NOT_FOUND', opLog, { requestId })
+ }
+
+ // Value dates only make sense on accumulating dimensions (projekt-style
+ // ranges). A resets-annually dimension (e.g. kostnadsställe) rejects any
+ // request carrying an actual date (explicit null is a harmless no-op).
+ if (dimension.resets_annually && (body.start_date != null || body.end_date != null)) {
+ return errorResponseFromCode('DIMENSION_VALUE_DATES_NOT_ALLOWED', opLog, { requestId })
+ }
+
+ const { data, error } = await supabase
+ .from('dimension_values')
+ .insert({
+ company_id: companyId,
+ dimension_id: id,
+ code: body.code,
+ name: body.name,
+ // Default true; is_active=false makes "create as archived" atomic
+ // (no follow-up PATCH from the register UI).
+ is_active: body.is_active ?? true,
+ start_date: body.start_date ?? null,
+ end_date: body.end_date ?? null,
+ })
+ .select('id, dimension_id, code, name, is_active, start_date, end_date')
+ .single()
+
+ if (error) {
+ if (error.code === '23505') {
+ return errorResponseFromCode('DIMENSION_VALUE_DUPLICATE_CODE', opLog, {
+ requestId,
+ details: { code: body.code },
+ })
+ }
+ opLog.error('dimension value insert failed', error)
+ return errorResponseFromCode('DIMENSION_VALUE_CREATE_FAILED', opLog, {
+ requestId,
+ details: { reason: error.message },
+ })
+ }
+
+ return NextResponse.json({ data })
+ },
+ { requireWrite: true },
+)
diff --git a/app/api/dimensions/__tests__/id.test.ts b/app/api/dimensions/__tests__/id.test.ts
new file mode 100644
index 00000000..364a1303
--- /dev/null
+++ b/app/api/dimensions/__tests__/id.test.ts
@@ -0,0 +1,139 @@
+/**
+ * Tests for PATCH /api/dimensions/[id] (update dimension).
+ *
+ * Covers: 401, empty-body validation (400), 404, the is_system name-lock
+ * ("Systemdimensioner kan inte döpas om" — 400 DIMENSION_SYSTEM_RENAME),
+ * archiving a system dimension (allowed), and the happy rename of a custom
+ * dimension.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import {
+ createQueuedMockSupabase,
+ createMockRequest,
+ createMockRouteParams,
+ parseJsonResponse,
+} from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+ requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+ getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+ requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+const requireWriteMock = vi.fn()
+vi.mock('@/lib/auth/require-write', () => ({
+ requireWritePermission: (...args: unknown[]) => requireWriteMock(...args),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { PATCH } from '../[id]/route'
+
+const params = () => createMockRouteParams({ id: 'dim-1' })
+
+describe('PATCH /api/dimensions/[id]', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ requireWriteMock.mockResolvedValue({ ok: true })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1', {
+ method: 'PATCH',
+ body: { name: 'Avdelning' },
+ })
+ const response = await PATCH(request, params())
+
+ expect(response.status).toBe(401)
+ })
+
+ it('rejects an empty body with 400', async () => {
+ const request = createMockRequest('/api/dimensions/dim-1', { method: 'PATCH', body: {} })
+ const response = await PATCH(request, params())
+
+ expect(response.status).toBe(400)
+ })
+
+ it('returns 404 when the dimension does not belong to the company', async () => {
+ enqueue({ data: null }) // maybeSingle fetch
+
+ const request = createMockRequest('/api/dimensions/dim-1', {
+ method: 'PATCH',
+ body: { name: 'Avdelning' },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(404)
+ expect(body.error.code).toBe('DIMENSION_NOT_FOUND')
+ })
+
+ it('rejects renaming a system dimension with 400 DIMENSION_SYSTEM_RENAME', async () => {
+ enqueue({ data: { id: 'dim-1', name: 'Kostnadsställe', is_system: true } })
+
+ const request = createMockRequest('/api/dimensions/dim-1', {
+ method: 'PATCH',
+ body: { name: 'Avdelning' },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string; message: string } }>(response)
+
+ expect(status).toBe(400)
+ expect(body.error.code).toBe('DIMENSION_SYSTEM_RENAME')
+ expect(body.error.message).toBe('Systemdimensioner kan inte döpas om.')
+ })
+
+ it('allows archiving a system dimension (is_active only, no rename)', async () => {
+ enqueue({ data: { id: 'dim-1', name: 'Kostnadsställe', is_system: true } })
+ enqueue({
+ data: {
+ id: 'dim-1', sie_dim_no: 1, name: 'Kostnadsställe',
+ resets_annually: true, is_system: true, is_active: false, sort_order: 10,
+ },
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1', {
+ method: 'PATCH',
+ body: { is_active: false },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ data: { is_active: boolean } }>(response)
+
+ expect(status).toBe(200)
+ expect(body.data.is_active).toBe(false)
+ })
+
+ it('renames a non-system dimension (happy path)', async () => {
+ enqueue({ data: { id: 'dim-1', name: 'Dimension 7', is_system: false } })
+ enqueue({
+ data: {
+ id: 'dim-1', sie_dim_no: 7, name: 'Avdelning',
+ resets_annually: true, is_system: false, is_active: true, sort_order: 30,
+ },
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1', {
+ method: 'PATCH',
+ body: { name: 'Avdelning', sort_order: 30 },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ data: { name: string; sort_order: number } }>(response)
+
+ expect(status).toBe(200)
+ expect(body.data.name).toBe('Avdelning')
+ expect(body.data.sort_order).toBe(30)
+ })
+})
diff --git a/app/api/dimensions/__tests__/import-existing.test.ts b/app/api/dimensions/__tests__/import-existing.test.ts
new file mode 100644
index 00000000..43288ea8
--- /dev/null
+++ b/app/api/dimensions/__tests__/import-existing.test.ts
@@ -0,0 +1,172 @@
+/**
+ * Tests for POST /api/dimensions/import-existing (backfill scan).
+ *
+ * Covers: 401, the empty-company early exit, the happy path where codes
+ * found on journal lines but missing from the registry are created as
+ * inactive placeholder values ({ created: n }), code sanitization (PR1
+ * backfill parity), and duplicate-tolerant upserts.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { createQueuedMockSupabase, createMockRequest, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+ requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+ getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+ requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+ requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { POST } from '../import-existing/route'
+
+const request = () => createMockRequest('/api/dimensions/import-existing', { method: 'POST' })
+const noParams = { params: Promise.resolve({}) }
+
+describe('POST /api/dimensions/import-existing', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const response = await POST(request(), noParams)
+
+ expect(response.status).toBe(401)
+ })
+
+ it('returns { created: 0 } when no line carries dimensions', async () => {
+ enqueue({ data: null }) // ensure RPC
+ enqueue({ data: [] }) // journal_entry_lines scan
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ created: number }>(response)
+
+ expect(status).toBe(200)
+ expect(body.created).toBe(0)
+ })
+
+ it('creates inactive placeholder values for codes missing from the registry', async () => {
+ enqueue({ data: null }) // ensure RPC
+ // Lines: KS01 (dim 1) appears twice, P001 (dim 6) once, BUTIK already registered.
+ enqueue({
+ data: [
+ { id: 'l1', dimensions: { '1': 'KS01' } },
+ { id: 'l2', dimensions: { '1': 'KS01', '6': 'P001' } },
+ { id: 'l3', dimensions: { '1': 'BUTIK' } },
+ ],
+ })
+ // Registry dims 1 & 6 exist (system dims).
+ enqueue({
+ data: [
+ { id: 'dim-1', sie_dim_no: 1 },
+ { id: 'dim-6', sie_dim_no: 6 },
+ ],
+ })
+ // Existing values: BUTIK is already registered under dim 1.
+ enqueue({ data: [{ dimension_id: 'dim-1', code: 'BUTIK' }] })
+ // Upsert of the two missing values succeeds — created counts returned rows.
+ enqueue({ data: [{ id: 'nv1' }, { id: 'nv2' }] })
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ created: number }>(response)
+
+ expect(status).toBe(200)
+ expect(body.created).toBe(2) // KS01 + P001; BUTIK skipped (already registered)
+ })
+
+ it('sanitizes candidate codes like the PR1 backfill and de-duplicates after sanitization', async () => {
+ enqueue({ data: null }) // ensure RPC
+ // 'KS"01"' and 'KS{01}' both sanitize to KS01 (one candidate); a 50-char
+ // code is capped at 40; '"{}"' sanitizes to empty and is dropped entirely.
+ enqueue({
+ data: [
+ { id: 'l1', dimensions: { '1': 'KS"01"' } },
+ { id: 'l2', dimensions: { '1': 'KS{01}' } },
+ { id: 'l3', dimensions: { '1': 'X'.repeat(50) } },
+ { id: 'l4', dimensions: { '1': '"{}"' } },
+ ],
+ })
+ enqueue({ data: [{ id: 'dim-1', sie_dim_no: 1 }] }) // registry dims
+ enqueue({ data: [] }) // no existing values
+ // Upsert returns the two surviving sanitized codes (KS01 + the capped one).
+ enqueue({ data: [{ id: 'nv1' }, { id: 'nv2' }] })
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ created: number }>(response)
+
+ expect(status).toBe(200)
+ expect(body.created).toBe(2)
+ })
+
+ it('tolerates duplicates in the batch — created counts only the rows the upsert returned', async () => {
+ enqueue({ data: null }) // ensure RPC
+ enqueue({
+ data: [
+ { id: 'l1', dimensions: { '1': 'KS01' } },
+ { id: 'l2', dimensions: { '1': 'KS02' } },
+ ],
+ })
+ enqueue({ data: [{ id: 'dim-1', sie_dim_no: 1 }] }) // registry dims
+ enqueue({ data: [] }) // existing-values snapshot missed a raced KS02
+ // ignoreDuplicates upsert skips the conflicting row instead of aborting
+ // the batch — only KS01 comes back.
+ enqueue({ data: [{ id: 'nv1' }] })
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ created: number }>(response)
+
+ expect(status).toBe(200)
+ expect(body.created).toBe(1)
+ })
+
+ it('creates a registry dimension for an unregistered dim number found on lines', async () => {
+ enqueue({ data: null }) // ensure RPC
+ enqueue({ data: [{ id: 'l1', dimensions: { '7': 'AVD-A' } }] }) // lines
+ // Registry only has the system dims — dim 7 is missing.
+ enqueue({
+ data: [
+ { id: 'dim-1', sie_dim_no: 1 },
+ { id: 'dim-6', sie_dim_no: 6 },
+ ],
+ })
+ // Upsert of the missing dimension row returns its id.
+ enqueue({ data: [{ id: 'dim-7', sie_dim_no: 7 }] })
+ // No existing values.
+ enqueue({ data: [] })
+ // Value upsert succeeds.
+ enqueue({ data: [{ id: 'nv1' }] })
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ created: number }>(response)
+
+ expect(status).toBe(200)
+ expect(body.created).toBe(1)
+ })
+
+ it('returns 500 DIMENSION_IMPORT_FAILED when the scan blows up', async () => {
+ enqueue({ data: null }) // ensure RPC
+ enqueue({ error: { message: 'relation missing' } }) // fetchAllRows throws
+
+ const response = await POST(request(), noParams)
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(500)
+ expect(body.error.code).toBe('DIMENSION_IMPORT_FAILED')
+ })
+})
diff --git a/app/api/dimensions/__tests__/route.test.ts b/app/api/dimensions/__tests__/route.test.ts
new file mode 100644
index 00000000..003a175b
--- /dev/null
+++ b/app/api/dimensions/__tests__/route.test.ts
@@ -0,0 +1,136 @@
+/**
+ * Tests for GET /api/dimensions (dimension registry list).
+ *
+ * Exercises the route through the real withRouteContext wrapper, mocking only
+ * its auth/company dependencies and injecting a queued Supabase mock via
+ * requireAuth. Covers: 401, the ensure-RPC failure path, and the contract
+ * shape ({ dimensions: [...] } with values nested per dimension).
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import { createQueuedMockSupabase, createMockRequest, parseJsonResponse } from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+ requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+ getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+ requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+ requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { GET } from '../route'
+
+interface DimensionsBody {
+ dimensions: Array<{
+ id: string
+ sie_dim_no: number
+ name: string
+ resets_annually: boolean
+ is_system: boolean
+ is_active: boolean
+ sort_order: number
+ values: Array<{
+ id: string
+ code: string
+ name: string
+ is_active: boolean
+ start_date: string | null
+ end_date: string | null
+ }>
+ }>
+}
+
+describe('GET /api/dimensions', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const response = await GET(createMockRequest('/api/dimensions'), { params: Promise.resolve({}) })
+
+ expect(response.status).toBe(401)
+ })
+
+ it('ensures system dims exist, then returns dimensions with nested values', async () => {
+ // 1st DB hit: ensure_company_dimensions RPC.
+ enqueue({ data: null })
+ // 2nd: dimensions list (sorted by sort_order server-side).
+ enqueue({
+ data: [
+ { id: 'dim-1', sie_dim_no: 1, name: 'Kostnadsställe', resets_annually: true, is_system: true, is_active: true, sort_order: 10 },
+ { id: 'dim-6', sie_dim_no: 6, name: 'Projekt', resets_annually: false, is_system: true, is_active: true, sort_order: 20 },
+ ],
+ })
+ // 3rd: dimension_values list (sorted by code server-side).
+ enqueue({
+ data: [
+ { id: 'v1', dimension_id: 'dim-1', code: 'BUTIK', name: 'Butiken', is_active: true, start_date: null, end_date: null },
+ { id: 'v2', dimension_id: 'dim-6', code: 'P001', name: 'Projekt Björk', is_active: false, start_date: '2026-01-01', end_date: '2026-06-30' },
+ ],
+ })
+
+ const response = await GET(createMockRequest('/api/dimensions'), { params: Promise.resolve({}) })
+ const { status, body } = await parseJsonResponse(response)
+
+ expect(status).toBe(200)
+ expect(supabase.rpc).toHaveBeenCalledWith('ensure_company_dimensions', {
+ p_company_id: 'company-1',
+ })
+ expect(body.dimensions).toHaveLength(2)
+ expect(body.dimensions[0]).toMatchObject({
+ id: 'dim-1',
+ sie_dim_no: 1,
+ name: 'Kostnadsställe',
+ resets_annually: true,
+ is_system: true,
+ values: [
+ { id: 'v1', code: 'BUTIK', name: 'Butiken', is_active: true, start_date: null, end_date: null },
+ ],
+ })
+ expect(body.dimensions[1].values).toEqual([
+ { id: 'v2', code: 'P001', name: 'Projekt Björk', is_active: false, start_date: '2026-01-01', end_date: '2026-06-30' },
+ ])
+ })
+
+ it('returns a dimension with an empty values array when it has no values', async () => {
+ enqueue({ data: null }) // ensure RPC
+ enqueue({
+ data: [
+ { id: 'dim-1', sie_dim_no: 1, name: 'Kostnadsställe', resets_annually: true, is_system: true, is_active: true, sort_order: 10 },
+ ],
+ })
+ enqueue({ data: [] })
+
+ const response = await GET(createMockRequest('/api/dimensions'), { params: Promise.resolve({}) })
+ const { status, body } = await parseJsonResponse(response)
+
+ expect(status).toBe(200)
+ expect(body.dimensions[0].values).toEqual([])
+ })
+
+ it('returns 500 when the ensure RPC fails', async () => {
+ enqueue({ error: { code: 'XX000', message: 'boom' } })
+
+ const response = await GET(createMockRequest('/api/dimensions'), { params: Promise.resolve({}) })
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(500)
+ expect(body.error.code).toBeTruthy()
+ })
+})
diff --git a/app/api/dimensions/__tests__/value-id.test.ts b/app/api/dimensions/__tests__/value-id.test.ts
new file mode 100644
index 00000000..5ed9e3b1
--- /dev/null
+++ b/app/api/dimensions/__tests__/value-id.test.ts
@@ -0,0 +1,195 @@
+/**
+ * Tests for PATCH/DELETE /api/dimensions/[id]/values/[valueId].
+ *
+ * The DELETE suite pins the retention-trigger contract: a P0001 raise from
+ * enforce_dimension_value_retention surfaces as 409 DIMENSION_VALUE_REFERENCED
+ * with the trigger's own Swedish message ("…arkivera det istället") so the UI
+ * can toast it verbatim.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import {
+ createQueuedMockSupabase,
+ createMockRequest,
+ createMockRouteParams,
+ parseJsonResponse,
+} from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+ requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+ getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+ requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+ requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { PATCH, DELETE } from '../[id]/values/[valueId]/route'
+
+const params = () => createMockRouteParams({ id: 'dim-1', valueId: 'v1' })
+const URL_PATH = '/api/dimensions/dim-1/values/v1'
+
+describe('PATCH /api/dimensions/[id]/values/[valueId]', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const request = createMockRequest(URL_PATH, { method: 'PATCH', body: { name: 'Nytt namn' } })
+ const response = await PATCH(request, params())
+
+ expect(response.status).toBe(401)
+ })
+
+ it('rejects an empty body with 400', async () => {
+ const request = createMockRequest(URL_PATH, { method: 'PATCH', body: {} })
+ const response = await PATCH(request, params())
+
+ expect(response.status).toBe(400)
+ })
+
+ it('returns 404 when the value does not exist in the company', async () => {
+ enqueue({ error: { code: 'PGRST116', message: 'No rows found' } })
+
+ const request = createMockRequest(URL_PATH, { method: 'PATCH', body: { name: 'Nytt namn' } })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(404)
+ expect(body.error.code).toBe('DIMENSION_VALUE_NOT_FOUND')
+ })
+
+ it('archives a value via is_active=false (happy path)', async () => {
+ // The request carries end_date, so the route first checks the parent
+ // dimension's resets_annually flag (accumulating → dates allowed).
+ enqueue({ data: { id: 'dim-1', resets_annually: false } })
+ enqueue({
+ data: {
+ id: 'v1', dimension_id: 'dim-1', code: 'BUTIK', name: 'Butiken',
+ is_active: false, start_date: null, end_date: '2026-06-30',
+ },
+ })
+
+ const request = createMockRequest(URL_PATH, {
+ method: 'PATCH',
+ body: { is_active: false, end_date: '2026-06-30' },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ data: { is_active: boolean; code: string } }>(response)
+
+ expect(status).toBe(200)
+ expect(body.data.is_active).toBe(false)
+ // Code untouched — immutable in v1.
+ expect(body.data.code).toBe('BUTIK')
+ })
+
+ it('rejects start/end dates on a resets-annually dimension with 400', async () => {
+ enqueue({ data: { id: 'dim-1', resets_annually: true } })
+
+ const request = createMockRequest(URL_PATH, {
+ method: 'PATCH',
+ body: { start_date: '2026-01-01' },
+ })
+ const response = await PATCH(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string; message: string } }>(response)
+
+ expect(status).toBe(400)
+ expect(body.error.code).toBe('DIMENSION_VALUE_DATES_NOT_ALLOWED')
+ expect(body.error.message).toBe(
+ 'Datum kan bara sättas på ackumulerande dimensioner (t.ex. projekt).',
+ )
+ })
+
+ it('allows clearing dates (explicit null) without checking the dimension', async () => {
+ // start_date: null clears the field — a harmless no-op on any dimension,
+ // so the route must not spend a dimension fetch on it. The single queued
+ // result feeds the update itself.
+ enqueue({
+ data: {
+ id: 'v1', dimension_id: 'dim-1', code: 'BUTIK', name: 'Butiken',
+ is_active: true, start_date: null, end_date: null,
+ },
+ })
+
+ const request = createMockRequest(URL_PATH, {
+ method: 'PATCH',
+ body: { start_date: null, end_date: null },
+ })
+ const response = await PATCH(request, params())
+ const { status } = await parseJsonResponse(response)
+
+ expect(status).toBe(200)
+ })
+})
+
+describe('DELETE /api/dimensions/[id]/values/[valueId]', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const request = createMockRequest(URL_PATH, { method: 'DELETE' })
+ const response = await DELETE(request, params())
+
+ expect(response.status).toBe(401)
+ })
+
+ it('surfaces the retention trigger as 409 with the trigger\'s Swedish message', async () => {
+ const triggerMessage =
+ 'Värdet "BUTIK" används på bokförda verifikat och kan inte tas bort — arkivera det istället.'
+ enqueue({ error: { code: 'P0001', message: triggerMessage } })
+
+ const request = createMockRequest(URL_PATH, { method: 'DELETE' })
+ const response = await DELETE(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string; message: string } }>(response)
+
+ expect(status).toBe(409)
+ expect(body.error.code).toBe('DIMENSION_VALUE_REFERENCED')
+ // The trigger's message (naming the code) is surfaced verbatim for the toast.
+ expect(body.error.message).toBe(triggerMessage)
+ expect(body.error.message).toContain('arkivera det istället')
+ })
+
+ it('returns 404 when nothing was deleted', async () => {
+ enqueue({ data: [] })
+
+ const request = createMockRequest(URL_PATH, { method: 'DELETE' })
+ const response = await DELETE(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(404)
+ expect(body.error.code).toBe('DIMENSION_VALUE_NOT_FOUND')
+ })
+
+ it('deletes an unreferenced value (happy path)', async () => {
+ enqueue({ data: [{ id: 'v1' }] })
+
+ const request = createMockRequest(URL_PATH, { method: 'DELETE' })
+ const response = await DELETE(request, params())
+ const { status, body } = await parseJsonResponse<{ success: boolean }>(response)
+
+ expect(status).toBe(200)
+ expect(body.success).toBe(true)
+ })
+})
diff --git a/app/api/dimensions/__tests__/values.test.ts b/app/api/dimensions/__tests__/values.test.ts
new file mode 100644
index 00000000..959c81fb
--- /dev/null
+++ b/app/api/dimensions/__tests__/values.test.ts
@@ -0,0 +1,175 @@
+/**
+ * Tests for POST /api/dimensions/[id]/values (create dimension value).
+ *
+ * Covers: 401, the strict Fortnox code format (400), 404 on a foreign
+ * dimension, the duplicate-code conflict (409 with Swedish message), the
+ * dates-on-resets-annually rejection (400), atomic create-as-archived
+ * (is_active=false), and the happy path.
+ */
+import { describe, it, expect, vi, beforeEach } from 'vitest'
+import { NextResponse } from 'next/server'
+import {
+ createQueuedMockSupabase,
+ createMockRequest,
+ createMockRouteParams,
+ parseJsonResponse,
+} from '@/tests/helpers'
+
+const { supabase, enqueue, reset } = createQueuedMockSupabase()
+
+const requireAuthMock = vi.fn()
+vi.mock('@/lib/auth/require-auth', () => ({
+ requireAuth: (...args: unknown[]) => requireAuthMock(...args),
+}))
+
+vi.mock('@/lib/company/context', () => ({
+ getActiveCompanyId: vi.fn().mockResolvedValue('company-1'),
+ requireCompanyId: vi.fn().mockResolvedValue('company-1'),
+}))
+
+vi.mock('@/lib/auth/require-write', () => ({
+ requireWritePermission: vi.fn().mockResolvedValue({ ok: true }),
+}))
+
+vi.mock('@/lib/init', () => ({ ensureInitialized: vi.fn() }))
+
+import { POST } from '../[id]/values/route'
+
+const params = () => createMockRouteParams({ id: 'dim-1' })
+
+describe('POST /api/dimensions/[id]/values', () => {
+ beforeEach(() => {
+ vi.clearAllMocks()
+ reset()
+ requireAuthMock.mockResolvedValue({ user: { id: 'user-1' }, supabase })
+ })
+
+ it('returns 401 when not authenticated', async () => {
+ requireAuthMock.mockResolvedValue({
+ error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'P001', name: 'Projekt Björk' },
+ })
+ const response = await POST(request, params())
+
+ expect(response.status).toBe(401)
+ })
+
+ it.each([
+ ['space in code', 'P 001'],
+ ['too long (>20 chars)', 'A'.repeat(21)],
+ ['SIE-breaking char', 'P{1}'],
+ ])('rejects an invalid code (%s) with 400', async (_label, code) => {
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code, name: 'Projekt' },
+ })
+ const response = await POST(request, params())
+
+ expect(response.status).toBe(400)
+ })
+
+ it('rejects end_date before start_date with 400', async () => {
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'P001', name: 'Projekt', start_date: '2026-06-01', end_date: '2026-01-01' },
+ })
+ const response = await POST(request, params())
+
+ expect(response.status).toBe(400)
+ })
+
+ it('returns 404 when the dimension does not belong to the company', async () => {
+ enqueue({ data: null }) // dimension maybeSingle
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'P001', name: 'Projekt Björk' },
+ })
+ const response = await POST(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string } }>(response)
+
+ expect(status).toBe(404)
+ expect(body.error.code).toBe('DIMENSION_NOT_FOUND')
+ })
+
+ it('rejects start/end dates on a resets-annually dimension with 400', async () => {
+ // Kostnadsställe-style dims reset annually — value date ranges are only
+ // meaningful on accumulating dims (projekt).
+ enqueue({ data: { id: 'dim-1', resets_annually: true } })
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'KS01', name: 'Kontoret', start_date: '2026-01-01' },
+ })
+ const response = await POST(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string; message: string } }>(response)
+
+ expect(status).toBe(400)
+ expect(body.error.code).toBe('DIMENSION_VALUE_DATES_NOT_ALLOWED')
+ expect(body.error.message).toBe(
+ 'Datum kan bara sättas på ackumulerande dimensioner (t.ex. projekt).',
+ )
+ })
+
+ it('creates a value as archived when is_active=false (atomic, no follow-up PATCH)', async () => {
+ enqueue({ data: { id: 'dim-1', resets_annually: false } })
+ enqueue({
+ data: {
+ id: 'v2', dimension_id: 'dim-1', code: 'NEDLAGD', name: 'Nedlagd avdelning',
+ is_active: false, start_date: null, end_date: null,
+ },
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'NEDLAGD', name: 'Nedlagd avdelning', is_active: false },
+ })
+ const response = await POST(request, params())
+ const { status, body } = await parseJsonResponse<{ data: { id: string; is_active: boolean } }>(response)
+
+ expect(status).toBe(200)
+ expect(body.data.id).toBe('v2')
+ expect(body.data.is_active).toBe(false)
+ })
+
+ it('returns 409 with a Swedish message on a duplicate code', async () => {
+ enqueue({ data: { id: 'dim-1' } })
+ enqueue({ error: { code: '23505', message: 'duplicate key value' } })
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'P001', name: 'Projekt Björk' },
+ })
+ const response = await POST(request, params())
+ const { status, body } = await parseJsonResponse<{ error: { code: string; message: string } }>(response)
+
+ expect(status).toBe(409)
+ expect(body.error.code).toBe('DIMENSION_VALUE_DUPLICATE_CODE')
+ expect(body.error.message).toBe('Ett värde med samma kod finns redan i dimensionen.')
+ })
+
+ it('creates a value (happy path, Swedish chars allowed in code)', async () => {
+ enqueue({ data: { id: 'dim-1' } })
+ enqueue({
+ data: {
+ id: 'v1', dimension_id: 'dim-1', code: 'GÖTEBORG', name: 'Göteborgskontoret',
+ is_active: true, start_date: null, end_date: null,
+ },
+ })
+
+ const request = createMockRequest('/api/dimensions/dim-1/values', {
+ method: 'POST',
+ body: { code: 'GÖTEBORG', name: 'Göteborgskontoret' },
+ })
+ const response = await POST(request, params())
+ const { status, body } = await parseJsonResponse<{ data: { id: string; code: string } }>(response)
+
+ expect(status).toBe(200)
+ expect(body.data.id).toBe('v1')
+ expect(body.data.code).toBe('GÖTEBORG')
+ })
+})
diff --git a/app/api/dimensions/import-existing/route.ts b/app/api/dimensions/import-existing/route.ts
new file mode 100644
index 00000000..a6a8f024
Binary files /dev/null and b/app/api/dimensions/import-existing/route.ts differ
diff --git a/app/api/dimensions/route.ts b/app/api/dimensions/route.ts
new file mode 100644
index 00000000..5897b089
--- /dev/null
+++ b/app/api/dimensions/route.ts
@@ -0,0 +1,103 @@
+/**
+ * GET /api/dimensions — the dimension registry (kostnadsställe/projekt + custom
+ * dims) with nested values, for the register page and pickers.
+ *
+ * Calls ensure_company_dimensions first so the system dims (1 = Kostnadsställe,
+ * 6 = Projekt) always exist — lazy seeding keeps core zero-config for companies
+ * that never touch dimensions (dev_docs/dimensions_implementation_plan.md §6).
+ *
+ * Response contract (PR2 — the register UI builds against this exactly):
+ * 200 { dimensions: [{ id, sie_dim_no, name, resets_annually, is_system,
+ * is_active, sort_order, values: [{ id, code, name, is_active,
+ * start_date, end_date }] }] }
+ * Dimensions sorted by sort_order, values by code.
+ */
+import { NextResponse } from 'next/server'
+import { ensureInitialized } from '@/lib/init'
+import { withRouteContext } from '@/lib/api/with-route-context'
+import { errorResponse } from '@/lib/errors/get-structured-error'
+
+ensureInitialized()
+
+interface DimensionValueRow {
+ id: string
+ dimension_id: string
+ code: string
+ name: string
+ is_active: boolean
+ start_date: string | null
+ end_date: string | null
+}
+
+interface DimensionRow {
+ id: string
+ sie_dim_no: number
+ name: string
+ resets_annually: boolean
+ is_system: boolean
+ is_active: boolean
+ sort_order: number
+}
+
+export const GET = withRouteContext(
+ 'dimension.list',
+ async (_request, ctx) => {
+ // dimensions_enabled is deliberately NOT enforced here — it is a
+ // UI-visibility flag only (dev_docs/dimensions_implementation_plan.md §2).
+ // Agents/MCP and SIE import must operate on the registry regardless of the
+ // toggle; the security boundary is company scoping (withRouteContext + RLS).
+ const { supabase, companyId, log, requestId } = ctx
+
+ const { error: ensureError } = await supabase.rpc('ensure_company_dimensions', {
+ p_company_id: companyId,
+ })
+ if (ensureError) {
+ log.error('ensure_company_dimensions failed', ensureError)
+ return errorResponse(ensureError, log, { requestId })
+ }
+
+ const { data: dims, error: dimsError } = await supabase
+ .from('dimensions')
+ .select('id, sie_dim_no, name, resets_annually, is_system, is_active, sort_order')
+ .eq('company_id', companyId)
+ .order('sort_order', { ascending: true })
+ .order('sie_dim_no', { ascending: true })
+
+ if (dimsError) {
+ log.error('dimension list failed', dimsError)
+ return errorResponse(dimsError, log, { requestId })
+ }
+
+ const { data: values, error: valuesError } = await supabase
+ .from('dimension_values')
+ .select('id, dimension_id, code, name, is_active, start_date, end_date')
+ .eq('company_id', companyId)
+ .order('code', { ascending: true })
+
+ if (valuesError) {
+ log.error('dimension value list failed', valuesError)
+ return errorResponse(valuesError, log, { requestId })
+ }
+
+ const valuesByDimension = new Map[]>()
+ for (const v of (values ?? []) as DimensionValueRow[]) {
+ const bucket = valuesByDimension.get(v.dimension_id) ?? []
+ bucket.push({
+ id: v.id,
+ code: v.code,
+ name: v.name,
+ is_active: v.is_active,
+ start_date: v.start_date,
+ end_date: v.end_date,
+ })
+ valuesByDimension.set(v.dimension_id, bucket)
+ }
+
+ const dimensions = ((dims ?? []) as DimensionRow[]).map((d) => ({
+ ...d,
+ values: valuesByDimension.get(d.id) ?? [],
+ }))
+
+ return NextResponse.json({ dimensions })
+ },
+)
diff --git a/app/api/sandbox/seed/route.ts b/app/api/sandbox/seed/route.ts
index ff1ceb34..079112a6 100644
--- a/app/api/sandbox/seed/route.ts
+++ b/app/api/sandbox/seed/route.ts
@@ -7,6 +7,7 @@ import { createLogger } from '@/lib/logger'
import { checkRateLimit } from '@/lib/auth/rate-limit-http'
import { truncateIp } from '@/lib/api/v1/with-api-v1'
import { ensureSandboxAgentProfile } from '@/lib/sandbox/ensure-agent'
+import { lineDimensionColumns } from '@/lib/bookkeeping/dimension-resolver'
// Anonymous sign-in is enabled in all environments so visitors can try the
// product; a per-/24 cap on the seed endpoint keeps a single network from
@@ -146,6 +147,8 @@ export async function POST(request: Request) {
onboarding_step: 6,
onboarding_complete: true,
is_sandbox: true,
+ // Dimensions demo — the register/pickers render out of the box.
+ dimensions_enabled: true,
})
if (settingsError) throw settingsError
@@ -157,6 +160,39 @@ export async function POST(request: Request) {
})
if (coaError) throw coaError
+ // 3b. Seed demo dimensions (kostnadsställe/projekt). ensure_company_dimensions
+ // lazily creates the system dims 1/6; two values per dim give the register,
+ // pickers, and the dimension-tagged journal lines below something to show.
+ const { error: dimsRpcError } = await supabase.rpc('ensure_company_dimensions', {
+ p_company_id: companyId,
+ })
+ if (dimsRpcError) throw dimsRpcError
+
+ const { data: demoDims, error: demoDimsError } = await supabase
+ .from('dimensions')
+ .select('id, sie_dim_no')
+ .eq('company_id', companyId)
+ .in('sie_dim_no', [1, 6])
+ if (demoDimsError) throw demoDimsError
+
+ const dimIdByNo = Object.fromEntries(
+ (demoDims ?? []).map(d => [d.sie_dim_no as number, d.id as string])
+ ) as Record
+
+ if (dimIdByNo[1] && dimIdByNo[6]) {
+ const seededDimensionCodes = ['BUTIK', 'WEBB', 'P001', 'P002']
+ const { error: dimValuesError } = await supabase
+ .from('dimension_values')
+ .insert([
+ { company_id: companyId, dimension_id: dimIdByNo[1], code: 'BUTIK', name: 'Butiken' },
+ { company_id: companyId, dimension_id: dimIdByNo[1], code: 'WEBB', name: 'Webbshoppen' },
+ { company_id: companyId, dimension_id: dimIdByNo[6], code: 'P001', name: 'Projekt Björk' },
+ { company_id: companyId, dimension_id: dimIdByNo[6], code: 'P002', name: 'Projekt Alm' },
+ ])
+ if (dimValuesError) throw dimValuesError
+ log.info('seeded sandbox dimension values', { companyId, codes: seededDimensionCodes })
+ }
+
// 4. Create fiscal period (current year)
const currentYear = new Date().getFullYear()
const { data: fiscalPeriod, error: fpError } = await supabase
@@ -424,11 +460,20 @@ export async function POST(request: Request) {
if (je2Error) throw je2Error
- // 10. Create journal entry lines
+ // 10. Create journal entry lines. The P&L line carries demo dimensions
+ // ({"1":"BUTIK","6":"P001"}) so the register's "antal taggade rader",
+ // voucher-detail badges, and the dimension P&L report light up in the
+ // sandbox. Mirror columns derived via lineDimensionColumns — never set
+ // independently of the dimensions map.
+ const revenueDims = { '1': 'BUTIK', '6': 'P001' }
const { error: jelError } = await supabase
.from('journal_entry_lines')
.insert([
// JE1: Invoice creation — Debit AR, Credit Revenue + VAT
+ // NB: `dimensions` must be set explicitly on EVERY row — same PostgREST
+ // bulk-insert normalization as paid_amount below: omitting it on some
+ // rows while one row sets it sends null (violating NOT NULL) instead
+ // of falling through to the schema default '{}'.
{
journal_entry_id: je1.id,
account_number: '1510',
@@ -436,6 +481,7 @@ export async function POST(request: Request) {
debit_amount: 18750,
credit_amount: 0,
sort_order: 0,
+ dimensions: {},
},
{
journal_entry_id: je1.id,
@@ -444,6 +490,8 @@ export async function POST(request: Request) {
debit_amount: 0,
credit_amount: 15000,
sort_order: 1,
+ dimensions: revenueDims,
+ ...lineDimensionColumns(revenueDims),
},
{
journal_entry_id: je1.id,
@@ -452,6 +500,7 @@ export async function POST(request: Request) {
debit_amount: 0,
credit_amount: 3750,
sort_order: 2,
+ dimensions: {},
},
// JE2: Invoice payment — Debit Bank, Credit AR
{
@@ -461,6 +510,7 @@ export async function POST(request: Request) {
debit_amount: 18750,
credit_amount: 0,
sort_order: 0,
+ dimensions: {},
},
{
journal_entry_id: je2.id,
@@ -469,6 +519,7 @@ export async function POST(request: Request) {
debit_amount: 0,
credit_amount: 18750,
sort_order: 1,
+ dimensions: {},
},
])
diff --git a/app/api/v1/companies/[companyId]/dimensions/[id]/values/route.ts b/app/api/v1/companies/[companyId]/dimensions/[id]/values/route.ts
new file mode 100644
index 00000000..5f9bef39
--- /dev/null
+++ b/app/api/v1/companies/[companyId]/dimensions/[id]/values/route.ts
@@ -0,0 +1,166 @@
+/**
+ * POST /api/v1/companies/{companyId}/dimensions/{id}/values
+ *
+ * Create a dimension value (SIE #OBJEKT). Idempotent (mandatory
+ * Idempotency-Key), dry-runnable. Codes follow the strict Fortnox format
+ * (^[A-Za-z0-9ÅÄÖåäö_+\-]{1,20}$) for user-created values; the DB CHECK is
+ * looser by design so legacy free-text codes survive imports. `code` is
+ * immutable after creation.
+ */
+import { z } from 'zod'
+import { created } from '@/lib/api/v1/response'
+import { dryRunPreview } from '@/lib/api/v1/dry-run'
+import { registerEndpoint, dataEnvelope } from '@/lib/api/v1/registry'
+import { withApiV1 } from '@/lib/api/v1/with-api-v1'
+import { v1ErrorResponse, v1ErrorResponseFromCode } from '@/lib/api/v1/errors'
+import { CreateDimensionValueSchema } from '@/lib/api/schemas'
+
+const DimensionValueCreated = z.object({
+ id: z.string().uuid().nullable(),
+ dimension_id: z.string().uuid(),
+ code: z.string(),
+ name: z.string(),
+ is_active: z.boolean(),
+ start_date: z.string().nullable(),
+ end_date: z.string().nullable(),
+ created_at: z.string().nullable(),
+})
+
+registerEndpoint({
+ operation: 'dimensions.values.create',
+ method: 'POST',
+ path: '/api/v1/companies/:companyId/dimensions/:id/values',
+ summary: 'Create a dimension value (kostnadsställe/projekt code).',
+ description:
+ 'Registers a new value (SIE #OBJEKT) under a dimension — e.g. a new project code under dimension 6. Requires Idempotency-Key (UUID). Supports ?dry_run=true to validate the code format without committing. The `:id` path segment is the dimension row id (from GET …/dimensions), not the sie_dim_no. Duplicate codes within the dimension return 409 DIMENSION_VALUE_DUPLICATE_CODE.',
+ useWhen:
+ 'A voucher or invoice references a cost centre / project code that does not exist yet and the user has confirmed it should be created.',
+ doNotUseFor:
+ 'Renaming or archiving an existing value (dashboard register in v1). Tagging lines — pass the dimensions map on the journal-entry line instead.',
+ pitfalls: [
+ 'Idempotency-Key is mandatory — calls without it return 400 VALIDATION_ERROR.',
+ 'The :id segment is the dimension UUID, not the SIE dimension number.',
+ 'Codes are limited to the strict Fortnox charset (A–Ö, digits, _, +, -; max 20 chars) even though historical imported codes may be looser.',
+ 'code is immutable after creation — there is no rename in v1; create the correct code and archive the wrong one.',
+ ],
+ example: {
+ request: { code: 'P001', name: 'Villa Almgren tak' },
+ response: {
+ data: {
+ id: '0e9c…',
+ dimension_id: 'a8f1…',
+ code: 'P001',
+ name: 'Villa Almgren tak',
+ is_active: true,
+ start_date: null,
+ end_date: null,
+ created_at: '2026-07-02T12:00:00Z',
+ },
+ meta: { request_id: 'req_…', api_version: '2026-05-12' },
+ },
+ },
+ scope: 'bookkeeping:write',
+ risk: 'low',
+ idempotent: true,
+ reversible: true,
+ dryRunSupported: true,
+ request: { body: CreateDimensionValueSchema },
+ response: { success: dataEnvelope(DimensionValueCreated) },
+})
+
+export const POST = withApiV1<{ params: Promise<{ companyId: string; id: string }> }>(
+ 'dimensions.values.create',
+ async (request, ctx, { params }) => {
+ const { id } = await params
+
+ if (!z.string().uuid().safeParse(id).success) {
+ return v1ErrorResponseFromCode('VALIDATION_ERROR', ctx.log, {
+ requestId: ctx.requestId,
+ details: { field: 'id', message: 'Dimension id must be a UUID.' },
+ })
+ }
+
+ let rawBody: unknown
+ try {
+ rawBody = await request.json()
+ } catch {
+ return v1ErrorResponseFromCode('VALIDATION_ERROR', ctx.log, {
+ requestId: ctx.requestId,
+ details: { field: 'body', message: 'Body is not valid JSON.' },
+ })
+ }
+
+ const parsed = CreateDimensionValueSchema.safeParse(rawBody)
+ if (!parsed.success) {
+ return v1ErrorResponseFromCode('VALIDATION_ERROR', ctx.log, {
+ requestId: ctx.requestId,
+ details: {
+ issues: parsed.error.issues.map((i) => ({
+ field: i.path.join('.'),
+ message: i.message,
+ })),
+ },
+ })
+ }
+ const body = parsed.data
+
+ // The dimension must exist and belong to the company in the URL.
+ const { data: dimension, error: dimError } = await ctx.supabase
+ .from('dimensions')
+ .select('id')
+ .eq('id', id)
+ .eq('company_id', ctx.companyId!)
+ .maybeSingle()
+ if (dimError) {
+ return v1ErrorResponse(dimError, ctx.log, { requestId: ctx.requestId })
+ }
+ if (!dimension) {
+ return v1ErrorResponseFromCode('DIMENSION_NOT_FOUND', ctx.log, {
+ requestId: ctx.requestId,
+ details: { dimension_id: id },
+ })
+ }
+
+ if (ctx.dryRun) {
+ return dryRunPreview(
+ {
+ id: null,
+ dimension_id: id,
+ code: body.code,
+ name: body.name,
+ is_active: true,
+ start_date: body.start_date ?? null,
+ end_date: body.end_date ?? null,
+ created_at: null,
+ },
+ { requestId: ctx.requestId, log: ctx.log },
+ )
+ }
+
+ const { data, error } = await ctx.supabase
+ .from('dimension_values')
+ .insert({
+ company_id: ctx.companyId!,
+ dimension_id: id,
+ code: body.code,
+ name: body.name,
+ start_date: body.start_date ?? null,
+ end_date: body.end_date ?? null,
+ })
+ .select('id, dimension_id, code, name, is_active, start_date, end_date, created_at')
+ .single()
+
+ if (error) {
+ if (error.code === '23505') {
+ return v1ErrorResponseFromCode('DIMENSION_VALUE_DUPLICATE_CODE', ctx.log, {
+ requestId: ctx.requestId,
+ details: { code: body.code },
+ })
+ }
+ return v1ErrorResponse(error, ctx.log, { requestId: ctx.requestId })
+ }
+
+ return created(data, { requestId: ctx.requestId })
+ },
+ { requireIdempotencyKey: true },
+)
diff --git a/app/api/v1/companies/[companyId]/dimensions/__tests__/route.test.ts b/app/api/v1/companies/[companyId]/dimensions/__tests__/route.test.ts
new file mode 100644
index 00000000..52353b0d
--- /dev/null
+++ b/app/api/v1/companies/[companyId]/dimensions/__tests__/route.test.ts
@@ -0,0 +1,327 @@
+/**
+ * Integration tests for the v1 dimensions surface (dimensions PR2):
+ * GET /api/v1/companies/:companyId/dimensions
+ * POST /api/v1/companies/:companyId/dimensions/:id/values
+ *
+ * Mirrors the suppliers/accounts test pattern: a Proxy-backed Supabase mock
+ * returns whatever the route awaits, keyed by table name (plus an `rpc` key
+ * for ensure_company_dimensions).
+ */
+import { beforeAll, beforeEach, describe, expect, it, vi } from 'vitest'
+
+beforeAll(() => {
+ if (process.env.NODE_ENV !== 'test') throw new Error('NODE_ENV=test required')
+ process.env.NEXT_PUBLIC_SUPABASE_URL ||= 'http://localhost:54321'
+ process.env.NEXT_PUBLIC_SUPABASE_ANON_KEY ||= 'test-anon-key'
+})
+
+vi.mock('@/lib/auth/api-keys', async () => {
+ const actual = await vi.importActual('@/lib/auth/api-keys')
+ return { ...actual, validateApiKey: vi.fn(), createServiceClientNoCookies: vi.fn() }
+})
+vi.mock('@supabase/supabase-js', async () => {
+ const actual = await vi.importActual('@supabase/supabase-js')
+ return { ...actual, createClient: vi.fn().mockReturnValue({}) }
+})
+
+import { validateApiKey, createServiceClientNoCookies } from '@/lib/auth/api-keys'
+import { GET as listDimensions } from '../route'
+import { POST as createValue } from '../[id]/values/route'
+
+const mockValidate = validateApiKey as ReturnType
+const mockServiceClient = createServiceClientNoCookies as ReturnType
+
+interface TableResp {
+ data?: unknown
+ error?: unknown
+}
+
+/**
+ * Per-table queue mock: TableResp[] consumes one entry per await, then sticks
+ * on the last entry. The special key `rpc` answers `supabase.rpc(...)` calls.
+ */
+function makeFlexibleSupabase(byTable: Record) {
+ const queues = new Map()
+ for (const [t, val] of Object.entries(byTable)) {
+ queues.set(t, Array.isArray(val) ? [...val] : [val])
+ }
+ const buildChain = (key: string): unknown => {
+ const handler: ProxyHandler