Files
accounted/app/api/import/customers/execute/route.ts
T
Mattsson 3918ff6620 fix(customers): make country ISO-2 everywhere and check it against the customer type (#2241)
* fix(customers): make country ISO-2 everywhere and check it against the customer type (#2025, #2028)

customers.country and suppliers.country were read as ISO codes by the
periodisk sammanstallning (SKV 5740), Peppol and the provider importers but
written as English names by the customer form and the v1 API, so a correct
German customer produced GERMANY811234567 in the SKV file plus two false
warnings, and an EU customer saved with land Sverige got reverse charge with
nothing objecting until after the invoice was sent.

- lib/vat/country-codes.ts: one helper that normalises codes and the
  Swedish/English names the writers used to store, the country-vs-type
  rule (swedish_business = SE, eu_business = EU member other than SE that
  matches the VAT prefix, non_eu_business = outside the EU), and the
  reverse-charge country gate.
- Writers: customer form and supplier form get a country select; internal
  REST, v1 REST, bulk-create, MCP create/update, CSV/Excel import and the
  provider migration mapper normalise to a code and refuse unknown text;
  the consistency rule is a form error and an API 400
  (CUSTOMER_COUNTRY_MISMATCH on update). An omitted country is SE for
  Swedish types, derived from the VAT prefix for eu_business, required
  for non_eu_business.
- vat-rules.ts: getVatRules and friends take the country as a third
  argument and grant reverse charge only for an EU country other than SE;
  every invoice/sales-order/MCP call site passes customer.country.
- periodisk sammanstallning reads legacy names through the same helper.
- Migration 20260903170000: normalize_country_code() SQL twin, country_raw
  rollback column on both tables, backfill of every non-code row; unknown
  text is left as-is. pg-real test for the function.

Closes #2025, closes #2028

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D5EmmndLyDCmY5NHYAvYkE

* fix(customers): keep reverse charge for defaulted-SE EU rows, gate the country rule on the fields it reads, fix build

Skeptic and CI findings on #2241, one pass:

- Migration step 4: eu_business rows whose country was null or only the old
  writer default (SE) while the VAT number names another EU member take the
  country from the prefix. The pre-2026-09 rules granted reverse charge on
  type + VIES validation alone, so these rows invoiced at 0% and would have
  flipped to 25% on the next invoice. country_raw = '' marks a null origin;
  rollback uses nullif(country_raw, '').
- countryPermitsReverseCharge refuses SE only: a VIES-validated number
  outweighs a non-EU address (Swiss company registered in DE, Monaco with a
  FR number, Northern Ireland XI).
- checkCountryConsistency: an eu_business outside the EU VAT area is
  accepted when the VAT prefix is an EU-trade registration (incl. XI);
  Monaco maps to the FR prefix.
- Internal PATCH, MCP update and the commit executor judge the country rule
  only when customer_type, country or vat_number is part of the update, so
  a contradictory legacy row can still change its email (v1 already did).
- Webshop-order customers get the order's billing country; spreadsheet
  import derives a missing country from the type and flags contradictions
  (parser row error + execute schema refine).
- Build: v1 [id] route typed the existing row through a narrowed alias
  (never) and passed messageSv/messageEn the v1 error context lacks; the
  self-billed customer projection lacked country.
- Checks: regenerated skills/accounted-api (customer example country SE).
- New parity test holds the migration's SQL name table to the TS table.
- DECISIONS.md: correct migration version and the revised rule.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01D5EmmndLyDCmY5NHYAvYkE

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-03 18:09:46 +02:00

210 lines
7.2 KiB
TypeScript

import { NextResponse } from 'next/server'
import { ensureInitialized } from '@/lib/init'
import { eventBus } from '@/lib/events'
import { validateBody } from '@/lib/api/validate'
import { CustomerImportExecuteSchema } from '@/lib/api/schemas'
import { normalizeOrgNumber, normalizeEmail } from '@/lib/import/shared/column-utils'
import { fetchAllRows } from '@/lib/supabase/fetch-all'
import { withRouteContext } from '@/lib/api/with-route-context'
import { errorResponseFromCode } from '@/lib/errors/get-structured-error'
import type { Customer } from '@/types'
import type { CustomerImportExecuteResult } from '@/lib/import/customers/types'
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
ensureInitialized()
interface ExistingCustomer {
id: string
name: string
org_number: string | null
email: string | null
phone: string | null
address_line1: string | null
address_line2: string | null
postal_code: string | null
city: string | null
country: string
vat_number: string | null
default_payment_terms: number
notes: string | null
customer_type: string
}
/**
* POST /api/import/customers/execute
*
* Imports validated customer rows. Duplicates (matched by org_number or email)
* are either updated (merge: only non-empty file fields overwrite) or skipped
* based on `update_duplicates`.
*/
export const POST = withRouteContext(
'register_import.customers.execute',
async (request, ctx) => {
const { user, supabase, companyId, log, requestId } = ctx
const result = await validateBody(request, CustomerImportExecuteSchema, {
log,
operation: 'register_import.customers.execute',
})
if (!result.success) return result.response
const { rows, update_duplicates } = result.data
const opLog = log.child({ rowCount: rows.length, updateDuplicates: update_duplicates })
if (rows.length === 0) {
return errorResponseFromCode('REG_IMPORT_NO_ROWS', opLog, { requestId })
}
try {
const existingRaw = await fetchAllRows(({ from, to }) =>
supabase
.from('customers')
.select(
'id, name, org_number, email, phone, address_line1, address_line2, ' +
'postal_code, city, country, vat_number, default_payment_terms, notes, ' +
'customer_type',
)
.eq('company_id', companyId)
.range(from, to),
)
const existing = existingRaw as unknown as ExistingCustomer[]
const byOrg = new Map<string, ExistingCustomer>()
const byEmail = new Map<string, ExistingCustomer>()
for (const c of existing) {
const org = normalizeOrgNumber(c.org_number)
if (org) byOrg.set(org, c)
const email = normalizeEmail(c.email)
if (email) byEmail.set(email, c)
}
const created: Customer[] = []
const updated: Customer[] = []
let skipped = 0
const errors: { row_index: number; name: string; reason: string }[] = []
for (const row of rows) {
const orgKey = normalizeOrgNumber(row.org_number)
const emailKey = normalizeEmail(row.email)
const match =
(orgKey && byOrg.get(orgKey)) ||
(emailKey && byEmail.get(emailKey)) ||
null
if (match) {
if (!update_duplicates) {
skipped++
continue
}
// Merge mode: only overwrite fields where the file has a non-empty value.
const merged: Record<string, unknown> = {}
if (row.name) merged.name = row.name
if (row.customer_type) merged.customer_type = row.customer_type
if (row.org_number) merged.org_number = row.org_number
if (row.email) merged.email = row.email
if (row.phone) merged.phone = row.phone
if (row.address_line1) merged.address_line1 = row.address_line1
if (row.address_line2) merged.address_line2 = row.address_line2
if (row.postal_code) merged.postal_code = row.postal_code
if (row.city) merged.city = row.city
if (row.country) merged.country = row.country
if (row.vat_number) merged.vat_number = row.vat_number
if (row.default_payment_terms) merged.default_payment_terms = row.default_payment_terms
if (row.notes) merged.notes = row.notes
if (Object.keys(merged).length === 0) {
skipped++
continue
}
const { data, error } = await supabase
.from('customers')
.update(merged)
.eq('id', match.id)
.eq('company_id', companyId)
.select()
.single()
if (error) {
errors.push({ row_index: row.row_index, name: row.name, reason: getUserErrorMessage(error) })
continue
}
if (data) updated.push(data as Customer)
continue
}
// No match, create.
const { data, error } = await supabase
.from('customers')
.insert({
user_id: user.id,
company_id: companyId,
name: row.name,
customer_type: row.customer_type,
email: row.email,
phone: row.phone,
address_line1: row.address_line1,
address_line2: row.address_line2,
postal_code: row.postal_code,
city: row.city,
country: row.country || 'SE',
org_number: row.org_number,
vat_number: row.vat_number,
default_payment_terms: row.default_payment_terms || 30,
notes: row.notes,
})
.select()
.single()
if (error) {
// Treat unique-violation as a soft skip (race with concurrent import).
if (error.code === '23505') {
skipped++
continue
}
errors.push({ row_index: row.row_index, name: row.name, reason: getUserErrorMessage(error) })
continue
}
if (data) {
created.push(data as Customer)
// Track newly inserted org/email so subsequent rows in the same batch
// dedup against them too.
const newOrg = normalizeOrgNumber(data.org_number)
if (newOrg) byOrg.set(newOrg, data as ExistingCustomer)
const newEmail = normalizeEmail(data.email)
if (newEmail) byEmail.set(newEmail, data as ExistingCustomer)
}
}
// Emit events for downstream listeners (non-blocking).
for (const c of created) {
await eventBus.emit({
type: 'customer.created',
payload: { customer: c, companyId: companyId!, userId: user.id },
})
}
const response: CustomerImportExecuteResult = {
success: errors.length === 0,
created: created.length,
updated: updated.length,
skipped,
failed: errors.length,
errors,
}
opLog.info('customer import complete', response)
return NextResponse.json({ data: response })
} catch (err) {
opLog.error('customer import execute failed', err as Error)
return errorResponseFromCode('REG_IMPORT_EXECUTE_FAILED', opLog, {
requestId,
details: { reason: err instanceof Error ? getUserErrorMessage(err) : 'unknown' },
})
}
},
{ requireWrite: true },
)