Files
accounted/lib/providers/bokio/client.ts
T
MattssonandClaude Opus 4.7 02f94ef631 Fix/critical issues (#351)
* fix: add 15s timeout to accounting provider HTTP clients

Node's built-in fetch has no default timeout, so a stalled provider
could hold a serverless worker open for many minutes — worse with
withRetry (6x on Fortnox, 3x on others) and getPaginated stacking
across pages.

Wrap each fetch() in the Fortnox, Visma, Bokio, Briox, and Björn
Lundén clients with signal: AbortSignal.timeout(15_000), and treat
TimeoutError/AbortError as retryable so a single stalled attempt
retries cleanly instead of hanging the request.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: add timeouts to OAuth token endpoints

Wrap every OAuth2 token exchange, refresh, and revoke POST in an
AbortController via a new fetchWithTimeout helper. Without this, a
hung provider endpoint holds the request thread indefinitely — worst
case being Skatteverket, where refreshAccessToken sits on the hot
path of every bookkeeping action and exchangeCodeForTokens races the
5-minute BankID auth-code TTL.

On timeout, the Skatteverket OAuth callback now redirects to
/reports?tab=vat-declaration with a Swedish retry message instead
of leaving the user stranded on the callback URL.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: close RLS escalation on membership and settings tables

Any authenticated user who was a member (including viewer) could issue a
direct PostgREST PATCH against company_members and promote themselves to
owner, bypassing the app-layer requireWritePermission guard entirely.
Reproduced on prod, then verified the fix on staging.

Tighten INSERT/UPDATE/DELETE policies on company_members, team_members,
api_keys, company_invitations, team_invitations, companies, teams, and
company_settings to require the caller to hold role IN ('owner','admin')
in the target company/team. Role check is wrapped in SECURITY DEFINER
helpers (user_is_company_admin, user_is_team_admin, user_role_in_company)
to avoid RLS recursion when a policy on company_members references
company_members in its subquery.

Add a BEFORE UPDATE trigger on company_members that rejects any role
change unless the caller already holds role='owner', so admins cannot
mint further owners even though they can otherwise write.

Legitimate write paths are unaffected: company creation goes through the
create_company_with_owner SECURITY DEFINER RPC, invite acceptance uses
the service role, and team->company membership syncs via SECURITY
DEFINER triggers. All bypass RLS.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(migrations): resolve duplicate schema_migrations version 20260421160000

Two migration files shared timestamp 20260421160000 on main
(booking_template_usage.sql and opening_balances_rpc.sql), causing
supabase_migrations.schema_migrations PK collisions on any fresh CI run:

  duplicate key value violates unique constraint "schema_migrations_pkey"
  Key (version)=(20260421160000) already exists.

Bump opening_balances_rpc.sql to 20260421160500. booking_template_usage
keeps 20260421160000 because its table already exists on prod; the
renamed file has an idempotent CREATE OR REPLACE FUNCTION body and has
not yet been deployed to prod, so moving its version is free.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix(migrations): make booking_template_usage migration idempotent

The table already exists on prod (applied out-of-band) but prod's
schema_migrations does not track version 20260421160000, so the next
PR-driven deploy would re-run this migration and fail on
`CREATE TABLE public.booking_template_usage` with a duplicate-relation
error.

Add IF NOT EXISTS to CREATE TABLE and CREATE INDEX, and DROP POLICY
IF EXISTS before each CREATE POLICY. No functional change on fresh
databases; prod just silently no-ops the table/index creates and
re-declares policies without dropping-then-missing them.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

* fix: implement isTimeoutError utility and enforce role restrictions on company_members insert

* fix: implement fallback for user_id in commit_journal_entry function when auth.uid() is NULL

---------

Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
2026-04-22 18:14:01 +02:00

189 lines
5.6 KiB
TypeScript

import { TokenBucketRateLimiter } from '../rate-limiter';
import { withRetry } from '../retry';
import { BOKIO_BASE_URL, BOKIO_RATE_LIMIT } from './config';
import { createLogger } from '@/lib/logger';
import { isTimeoutError } from '@/lib/http/fetch-with-timeout';
const log = createLogger('bokio-client');
const FETCH_TIMEOUT_MS = 15_000;
export class BokioApiError extends Error {
constructor(
message: string,
public readonly statusCode: number,
public readonly body?: string,
) {
super(message);
this.name = 'BokioApiError';
}
}
function isRetryableError(error: unknown): boolean {
if (isTimeoutError(error)) return true;
if (error instanceof BokioApiError) {
if (error.statusCode === 401 || error.statusCode === 403 || error.statusCode === 404) {
return false;
}
return error.statusCode === 429 || error.statusCode >= 500;
}
return false;
}
interface BokioPaginatedResponse<T> {
items?: T[];
data?: T[]; // Some Bokio endpoints use 'data' instead of 'items'
totalItems: number;
totalPages: number;
currentPage: number;
}
export class BokioClient {
private readonly rateLimiter: TokenBucketRateLimiter;
private readonly baseUrl: string;
constructor(baseUrl?: string) {
this.baseUrl = baseUrl ?? BOKIO_BASE_URL;
this.rateLimiter = new TokenBucketRateLimiter(BOKIO_RATE_LIMIT, 'ratelimit:bokio');
}
async get<T>(accessToken: string, path: string): Promise<T> {
return withRetry(
async () => {
await this.rateLimiter.acquire();
const url = `${this.baseUrl}${path}`;
const response = await fetch(url, {
headers: {
Authorization: `Bearer ${accessToken}`,
Accept: 'application/json',
},
signal: AbortSignal.timeout(FETCH_TIMEOUT_MS),
});
if (!response.ok) {
const body = await response.text().catch(() => '');
throw new BokioApiError(
`Bokio API error: ${response.status} ${response.statusText}`,
response.status,
body,
);
}
return await response.json() as T;
},
{
maxAttempts: 3,
initialDelayMs: 1000,
shouldRetry: isRetryableError,
},
);
}
/**
* Fetch a paginated list endpoint.
* Bokio returns `{ items: [...], totalItems, totalPages, currentPage }`.
* Some endpoints may use `data` instead of `items`.
*/
async getPage<T>(
accessToken: string,
companyId: string,
relativePath: string,
options?: {
page?: number;
pageSize?: number;
query?: string;
},
): Promise<{ items: T[]; page: number; totalPages: number; totalCount: number }> {
const params = new URLSearchParams();
params.set('page', String(options?.page ?? 1));
params.set('pageSize', String(options?.pageSize ?? 50));
if (options?.query) {
params.set('query', options.query);
}
const path = `/companies/${companyId}${relativePath}?${params.toString()}`;
const response = await this.get<BokioPaginatedResponse<T>>(accessToken, path);
// Bokio uses 'items' for most endpoints but 'data' for some (e.g., credit notes)
const items = Array.isArray(response.items)
? response.items
: Array.isArray(response.data)
? response.data
: [];
const result = {
items,
page: response.currentPage ?? (options?.page ?? 1),
totalPages: response.totalPages ?? 1,
totalCount: response.totalItems ?? 0,
};
log.info(
`getPage ${relativePath} page=${result.page}/${result.totalPages}: ` +
`${result.items.length} items (totalCount=${result.totalCount})` +
(result.items.length === 0 && result.totalCount > 0
? ` — WARNING: 0 items despite totalCount=${result.totalCount}, raw keys: ${Object.keys(response).join(', ')}`
: ''),
);
// Extra diagnostic: if no items found and response has unexpected keys, log them
if (result.items.length === 0) {
const rawObj = response as unknown as Record<string, unknown>;
const keys = Object.keys(rawObj).filter(k => !['totalItems', 'totalPages', 'currentPage', 'items', 'data'].includes(k));
if (keys.length > 0) {
log.warn(
`Unexpected response keys for ${relativePath}: ${keys.join(', ')}. ` +
`Values: ${keys.map(k => `${k}=${typeof rawObj[k] === 'object' ? JSON.stringify(rawObj[k]).slice(0, 200) : rawObj[k]}`).join(', ')}`,
);
}
}
return result;
}
/**
* Fetch a non-paginated list endpoint (e.g. chart-of-accounts).
* Returns the full `data` array.
*/
async getAll<T>(
accessToken: string,
companyId: string,
relativePath: string,
): Promise<T[]> {
const path = `/companies/${companyId}${relativePath}`;
const response = await this.get<T[] | { items: T[] }>(accessToken, path);
// Bokio returns a raw array for some endpoints (e.g. chart-of-accounts)
if (Array.isArray(response)) {
return response;
}
return Array.isArray(response.items) ? response.items : [];
}
/**
* Fetch a single resource detail.
* Bokio returns the object directly (no wrapper).
*/
async getDetail<T>(
accessToken: string,
companyId: string,
relativePath: string,
): Promise<T> {
const path = `/companies/${companyId}${relativePath}`;
return this.get<T>(accessToken, path);
}
async getCompany<T>(
accessToken: string,
companyId: string,
): Promise<T | null> {
try {
return await this.get<T>(accessToken, `/companies/${companyId}`);
} catch (err) {
if (err instanceof BokioApiError && err.statusCode === 404) {
return null;
}
throw err;
}
}
}