Files
accounted/lib/import/__tests__/sie-import.replace.pg.test.ts
T
Mattsson f63d3e3100 Bug/open banking flow (#854)
* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects

We never sent auth_method to Enable Banking, so it fell back to the ASPSP's
visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate*
PSUs the redirect flow does not support Mobile BankID, so authorization failed
right after the user approved in the BankID app. Mobile BankID at Handelsbanken
is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses
when requested explicitly.

Resolve the bank's preferred auth method before /auth: query the ASPSP's
auth_methods and pick the DECOUPLED (Mobile BankID) method when present,
otherwise leave auth_method unset so banks that already work are untouched.
The method name is read dynamically per psu_type, so it is robust across
sandbox/production naming.

- api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods
  field name (was available_auth_methods, never populated), add
  getPreferredAuthMethod(), thread optional authMethod through startAuthorization
- index: resolve authMethod in /connect and pass it on both fresh + reconnect
- tests: cover method selection and request-body shaping

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* refactor(invoice-inbox): clean up bulk-selection toolbar UI

Redesign the selection toolbar shown when inbox items are checked:
one solid primary "Bokför valda" button with outlined secondary
actions ("Fråga assistenten", "Ta bort") and a plain selection
count. Removes the redundant "Avmarkera" button (users uncheck the
still-visible box), fixes label clipping, and gives the toolbar more
breathing room.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* chore(entitlements): bypass paywall in local development

Add isPaywallBypassed() so all gated capabilities are testable locally
without a subscription. Fires only on NODE_ENV=development (npm run dev)
or an explicit DISABLE_PAYWALL=true escape hatch — production builds run
under NODE_ENV=production and the entitlement suite runs under 'test',
so both keep exercising the real gate.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer

TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* feat(transactions): implement categorize core for bank transaction categorization

- Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations.
- Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing.
- Implemented fiscal period validation and duplicate booking detection.
- Enhanced logging and error handling for transaction categorization.

feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata

- Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken.
- Outputs metadata for business and personal PSU types, including default authentication methods.

fix(migrations): increase statement timeout for SIE bulk delete operations

- Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports.

feat(migrations): add bulk book inbox items to pending operations

- Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`.
- Supports bulk booking of matched inbox items against bank transactions.

test(pg): add tests for replace_period_opening_balance_link RPC

- Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow.
- Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries.

* fix(sie-export): update journal entries and lines handling in SIE export tests

* fix(migrations): resolve version collision on 20260629160000

The SIE bulk-delete statement_timeout migration shared version
20260629160000 with journal_entries_list_series_filter (merged from
main via #798/#823), causing a schema_migrations_pkey duplicate key
error on apply. Rename the branch's migration to 20260629160100.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

* fix(compliance): resolve compliance-swarm + review findings

- opening-balance/correct: compensating rollback for the non-atomic
  storno+rebook so a mid-sequence failure never leaves two posted OB
  entries (ASVS V2.3); durable audit event on every failure path
  (V16); reference the original verifikationsnummer in the corrected
  entry per BFL 5 kap 5§; document that requireWrite already enforces
  write-role + membership (V8.2.1 was a false positive)
- reports sources routes: validate the cursor date component as ISO
  (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2),
  applied to both the VAT-declaration and trial-balance routes
- AgentSessionList: await the rename PATCH, revert the optimistic
  title and toast on failure (ASVS V4.5)
- bank booking: exclude same-batch siblings from the booking-time
  duplicate guard so bulk-booking distinct same-(date,amount)
  transactions no longer false-positives; pre-existing duplicate
  detection is preserved
- BulkBookInboxDialog: drop the unsafe currency-based reverse_charge
  default, add an omvänd skattskyldighet advisory, and type VAT
  options to the backend VatTreatment union
- OpeningBalanceRowEditor: hold onChange in a ref (synced in effect,
  not during render) so an unstable callback can't cause a render loop

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
2026-07-01 18:13:00 +02:00

416 lines
14 KiB
TypeScript

import { randomUUID } from 'node:crypto'
import { describe, expect, it } from 'vitest'
import { getPool } from '@/tests/pg/setup'
import { seedCompany } from '@/tests/pg/fixtures'
// Covers the Fortnox re-sync flow:
// 1. The partial unique index `sie_imports_company_id_file_hash_active_idx`
// (added in migration 20260517150000) blocks duplicate (company_id,
// file_hash) rows for active statuses but allows them once a prior row
// is marked 'replaced' or 'failed'.
// 2. The replace_sie_import RPC hard-deletes journal entries with
// source_type='import' (since 20260526120000), detaches user-attached
// documents from them, clears the fiscal-period opening-balance
// pointer if it came from the import, and resets voucher_sequences
// so the next re-import restarts the series. User-created entries
// (source_type='manual', 'bank_transaction', etc.) are left intact.
async function insertSIEImport(params: {
companyId: string
userId: string
fileHash: string
status: 'pending' | 'mapped' | 'completed' | 'failed' | 'replaced'
fiscalPeriodId?: string
openingBalanceEntryId?: string
fiscalYearStart?: string
fiscalYearEnd?: string
}): Promise<string> {
const id = randomUUID()
await getPool().query(
`INSERT INTO public.sie_imports
(id, user_id, company_id, filename, file_hash, sie_type,
fiscal_year_start, fiscal_year_end, accounts_count, transactions_count,
status, fiscal_period_id, opening_balance_entry_id, imported_at)
VALUES ($1, $2, $3, 'fortnox-export.se', $4, 4,
$5, $6, 0, 0,
$7, $8, $9, $10)`,
[
id,
params.userId,
params.companyId,
params.fileHash,
params.fiscalYearStart ?? '2026-01-01',
params.fiscalYearEnd ?? '2026-12-31',
params.status,
params.fiscalPeriodId ?? null,
params.openingBalanceEntryId ?? null,
params.status === 'completed' ? new Date().toISOString() : null,
],
)
return id
}
async function insertPostedEntry(params: {
userId: string
companyId: string
fiscalPeriodId: string
sourceType: 'import' | 'manual' | 'bank_transaction'
voucherNumber: number
voucherSeries?: string
entryDate?: string
}): Promise<string> {
const id = randomUUID()
await getPool().query(
`INSERT INTO public.journal_entries
(id, user_id, company_id, fiscal_period_id, voucher_number, voucher_series,
entry_date, description, source_type, status)
VALUES ($1, $2, $3, $4, $5, $6, $7, 'Test entry', $8, 'posted')`,
[
id,
params.userId,
params.companyId,
params.fiscalPeriodId,
params.voucherNumber,
params.voucherSeries ?? 'A',
params.entryDate ?? '2026-06-01',
params.sourceType,
],
)
await getPool().query(
`INSERT INTO public.journal_entry_lines
(journal_entry_id, account_number, debit_amount, credit_amount)
VALUES ($1, '1930', 100, 0),
($1, '3001', 0, 100)`,
[id],
)
return id
}
async function insertVoucherSequence(params: {
companyId: string
userId: string
fiscalPeriodId: string
series: string
lastNumber: number
}): Promise<void> {
await getPool().query(
`INSERT INTO public.voucher_sequences
(company_id, user_id, fiscal_period_id, voucher_series, last_number)
VALUES ($1, $2, $3, $4, $5)`,
[params.companyId, params.userId, params.fiscalPeriodId, params.series, params.lastNumber],
)
}
async function insertDocumentAttachment(params: {
userId: string
companyId: string
journalEntryId: string
}): Promise<string> {
const id = randomUUID()
await getPool().query(
`INSERT INTO public.document_attachments
(id, user_id, company_id, storage_path, file_name, sha256_hash, journal_entry_id, upload_source)
VALUES ($1, $2, $3, $4, $5, $6, $7, 'file_upload')`,
[
id,
params.userId,
params.companyId,
`test/${id}.pdf`,
`test-${id}.pdf`,
`sha256-${id}`,
params.journalEntryId,
],
)
return id
}
describe('sie_imports: partial unique index + replace flow', () => {
it('blocks a second active row with the same (company_id, file_hash)', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
const hash = `hash-${randomUUID()}`
await insertSIEImport({
companyId,
userId,
fileHash: hash,
status: 'completed',
fiscalPeriodId,
})
await expect(
insertSIEImport({
companyId,
userId,
fileHash: hash,
status: 'pending',
fiscalPeriodId,
}),
).rejects.toThrow(/sie_imports_company_id_file_hash_active_idx/)
})
it('allows a new pending row with the same hash once the prior row is replaced', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
const hash = `hash-${randomUUID()}`
const priorId = await insertSIEImport({
companyId,
userId,
fileHash: hash,
status: 'completed',
fiscalPeriodId,
})
// Mark the prior row as replaced (simulating what replace_sie_import does)
await getPool().query(
`UPDATE public.sie_imports SET status = 'replaced', replaced_at = now() WHERE id = $1`,
[priorId],
)
// A new pending row with the same hash now succeeds
const newId = await insertSIEImport({
companyId,
userId,
fileHash: hash,
status: 'pending',
fiscalPeriodId,
})
expect(newId).toBeTruthy()
})
it('replace_sie_import deletes source_type=import entries, leaves manual/bank_transaction posted, and resets voucher_sequences to MAX of remaining', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
const obEntry = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 1,
})
const importEntry1 = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 2,
})
const importEntry2 = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 3,
})
const manualEntry = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'manual', voucherNumber: 4,
})
const txnEntry = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'bank_transaction', voucherNumber: 5,
})
// Voucher_sequences advanced past the imports (5 total inserted in series A)
await insertVoucherSequence({
companyId, userId, fiscalPeriodId, series: 'A', lastNumber: 5,
})
// The fiscal period has its opening_balance_entry_id set to the OB entry,
// matching what a real SIE import would have produced.
await getPool().query(
`UPDATE public.fiscal_periods
SET opening_balance_entry_id = $1, opening_balances_set = true
WHERE id = $2`,
[obEntry, fiscalPeriodId],
)
const importId = await insertSIEImport({
companyId,
userId,
fileHash: `hash-${randomUUID()}`,
status: 'completed',
fiscalPeriodId,
openingBalanceEntryId: obEntry,
})
const { rows } = await getPool().query<{ replace_sie_import: number }>(
`SELECT public.replace_sie_import($1::uuid, $2::uuid) AS replace_sie_import`,
[companyId, importId],
)
expect(rows[0]!.replace_sie_import).toBe(3) // OB + 2 import entries
// The import entries (and their lines) are gone
const entries = await getPool().query<{ id: string; status: string }>(
`SELECT id, status FROM public.journal_entries WHERE id = ANY($1)`,
[[obEntry, importEntry1, importEntry2, manualEntry, txnEntry]],
)
const statusById = Object.fromEntries(entries.rows.map(r => [r.id, r.status]))
expect(statusById[obEntry]).toBeUndefined()
expect(statusById[importEntry1]).toBeUndefined()
expect(statusById[importEntry2]).toBeUndefined()
expect(statusById[manualEntry]).toBe('posted')
expect(statusById[txnEntry]).toBe('posted')
const lines = await getPool().query<{ count: string }>(
`SELECT count(*)::text FROM public.journal_entry_lines
WHERE journal_entry_id = ANY($1)`,
[[obEntry, importEntry1, importEntry2]],
)
expect(lines.rows[0]!.count).toBe('0')
// voucher_sequences reset to max of remaining entries in series A (5, the bank tx)
const vs = await getPool().query<{ last_number: number }>(
`SELECT last_number FROM public.voucher_sequences
WHERE company_id = $1 AND fiscal_period_id = $2 AND voucher_series = 'A'`,
[companyId, fiscalPeriodId],
)
expect(vs.rows[0]?.last_number).toBe(5)
// fiscal_periods OB pointer cleared
const fp = await getPool().query<{
opening_balance_entry_id: string | null
opening_balances_set: boolean
}>(
`SELECT opening_balance_entry_id, opening_balances_set
FROM public.fiscal_periods WHERE id = $1`,
[fiscalPeriodId],
)
expect(fp.rows[0]?.opening_balance_entry_id).toBeNull()
expect(fp.rows[0]?.opening_balances_set).toBe(false)
// sie_imports OB FK cleared, status replaced
const importRow = await getPool().query<{
status: string
replaced_at: string | null
opening_balance_entry_id: string | null
}>(
`SELECT status, replaced_at, opening_balance_entry_id
FROM public.sie_imports WHERE id = $1`,
[importId],
)
expect(importRow.rows[0]?.status).toBe('replaced')
expect(importRow.rows[0]?.replaced_at).not.toBeNull()
expect(importRow.rows[0]?.opening_balance_entry_id).toBeNull()
})
it('replace_sie_import resets voucher_sequences.last_number to 0 when no entries remain in the series', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 1,
})
await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 2,
})
await insertVoucherSequence({
companyId, userId, fiscalPeriodId, series: 'A', lastNumber: 2,
})
const importId = await insertSIEImport({
companyId,
userId,
fileHash: `hash-${randomUUID()}`,
status: 'completed',
fiscalPeriodId,
})
await getPool().query(
`SELECT public.replace_sie_import($1::uuid, $2::uuid)`,
[companyId, importId],
)
const vs = await getPool().query<{ last_number: number }>(
`SELECT last_number FROM public.voucher_sequences
WHERE company_id = $1 AND fiscal_period_id = $2 AND voucher_series = 'A'`,
[companyId, fiscalPeriodId],
)
expect(vs.rows[0]?.last_number).toBe(0)
})
it('replace_sie_import detaches documents from deleted entries without losing the document rows', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
const importEntry = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'import', voucherNumber: 1,
})
const manualEntry = await insertPostedEntry({
userId, companyId, fiscalPeriodId, sourceType: 'manual', voucherNumber: 2,
})
const attachedDoc = await insertDocumentAttachment({
userId, companyId, journalEntryId: importEntry,
})
const manualDoc = await insertDocumentAttachment({
userId, companyId, journalEntryId: manualEntry,
})
const importId = await insertSIEImport({
companyId,
userId,
fileHash: `hash-${randomUUID()}`,
status: 'completed',
fiscalPeriodId,
})
await getPool().query(
`SELECT public.replace_sie_import($1::uuid, $2::uuid)`,
[companyId, importId],
)
// The document attached to the deleted import entry is detached but preserved
const detached = await getPool().query<{
id: string
journal_entry_id: string | null
storage_path: string
file_name: string
}>(
`SELECT id, journal_entry_id, storage_path, file_name
FROM public.document_attachments WHERE id = $1`,
[attachedDoc],
)
expect(detached.rows[0]).toBeTruthy()
expect(detached.rows[0]?.journal_entry_id).toBeNull()
expect(detached.rows[0]?.storage_path).toBeTruthy()
expect(detached.rows[0]?.file_name).toBeTruthy()
// The document attached to the surviving manual entry is left alone
const untouched = await getPool().query<{ journal_entry_id: string | null }>(
`SELECT journal_entry_id FROM public.document_attachments WHERE id = $1`,
[manualDoc],
)
expect(untouched.rows[0]?.journal_entry_id).toBe(manualEntry)
})
it('replace_sie_import and undo_sie_import carry a raised statement_timeout', async () => {
// Regression for the 8s-timeout cancellation (migration 20260629160000):
// these RPCs run on the service-role REST client, which still inherits the
// authenticator login role's 8s statement_timeout (service_role.rolconfig
// is NULL). A large import's delete exceeded that and was cancelled, so the
// functions now set a function-local statement_timeout well above 8s.
const { rows } = await getPool().query<{ proname: string; proconfig: string[] | null }>(
`SELECT proname, proconfig
FROM pg_proc p JOIN pg_namespace n ON n.oid = p.pronamespace
WHERE n.nspname = 'public'
AND proname IN ('replace_sie_import', 'undo_sie_import')`,
)
expect(rows.length).toBe(2)
for (const fn of rows) {
const timeout = (fn.proconfig ?? []).find(c => c.startsWith('statement_timeout='))
expect(timeout, `${fn.proname} should set statement_timeout`).toBeTruthy()
const seconds = Number(/statement_timeout=(\d+)s/.exec(timeout!)?.[1] ?? 0)
expect(seconds).toBeGreaterThan(8)
}
})
it('replace_sie_import on an already-replaced import raises', async () => {
const { companyId, userId, fiscalPeriodId } = await seedCompany()
const importId = await insertSIEImport({
companyId,
userId,
fileHash: `hash-${randomUUID()}`,
status: 'completed',
fiscalPeriodId,
})
await getPool().query(
`SELECT public.replace_sie_import($1::uuid, $2::uuid)`,
[companyId, importId],
)
await expect(
getPool().query(
`SELECT public.replace_sie_import($1::uuid, $2::uuid)`,
[companyId, importId],
),
).rejects.toThrow(/not found or not in completed status/)
})
})