* feat(skatteverket): expose filed VAT declarations and decisions via the v1 API
Add GET /api/v1/companies/:companyId/skatteverket/vat-declarations, returning
a period's momsdeklaration as Skatteverket has it on file: the submitted
declaration (SKV /inlamnat) and Skatteverket's beslut (SKV /beslutat), either
individually via ?state= or both.
- Auth: compliance:read scope; member-visibility read model per #1673
(resolveReadAuth: caller's token, any member's active token, or system
credentials with a verified ombud grant).
- Architecture: core reaches the Skatteverket extension through the
registry-resolved services channel (contract in
lib/skatteverket/declaration-status.ts), so core never imports from
@/extensions/.
- New structured error SKATTEVERKET_API_ERROR (502) for upstream SKV
failures; 404 from SKV maps to submitted/decided = null with HTTP 200.
- 19 new tests (route: auth, validation, extension-disabled, happy path;
extension service: auth resolution, state filtering, SKV error mapping).
Fixes#1663
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* fix(skatteverket): address review findings on the vat-declarations read API
Consolidated fixes for PR #1773 review round:
- apiskill sync (core-build Checks): map the new skatteverket endpoint
group into the periods.md reference and regenerate skills/accounted-api
(124 -> 125 operations).
- CodeRabbit: parse the SKV 2xx body before writing the audit row, so an
unreadable body is audited as skv_error and returns the structured
SKATTEVERKET_API_ERROR 502 instead of escaping as an internal 500;
regression test added.
- Compliance swarm (ISO A.8.12 / SOC2 CC6.1): stop forwarding the raw
upstream SKV response body to API consumers; the caller now gets the
status code and a generic Swedish message, the body is logged
server-side only.
- Compliance swarm (GDPR Art.30): add the moms.declaration_status_read
processing activity to .compliance/ropa.yaml (live read, no payload
persisted, audit-log metadata only).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
