f63d3e3100
* fix(enable-banking): pin Mobile BankID (decoupled) auth_method so Handelsbanken corporate connects We never sent auth_method to Enable Banking, so it fell back to the ASPSP's visible default — REDIRECT for Handelsbanken. For Handelsbanken *corporate* PSUs the redirect flow does not support Mobile BankID, so authorization failed right after the user approved in the BankID app. Mobile BankID at Handelsbanken is a DECOUPLED method flagged hidden_method=true, which Enable Banking only uses when requested explicitly. Resolve the bank's preferred auth method before /auth: query the ASPSP's auth_methods and pick the DECOUPLED (Mobile BankID) method when present, otherwise leave auth_method unset so banks that already work are untouched. The method name is read dynamically per psu_type, so it is robust across sandbox/production naming. - api-client: add approach/hidden_method to AuthMethod, fix ASPSP.auth_methods field name (was available_auth_methods, never populated), add getPreferredAuthMethod(), thread optional authMethod through startAuthorization - index: resolve authMethod in /connect and pass it on both fresh + reconnect - tests: cover method selection and request-body shaping Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * refactor(invoice-inbox): clean up bulk-selection toolbar UI Redesign the selection toolbar shown when inbox items are checked: one solid primary "Bokför valda" button with outlined secondary actions ("Fråga assistenten", "Ta bort") and a plain selection count. Removes the redundant "Avmarkera" button (users uncheck the still-visible box), fixes label clipping, and gives the toolbar more breathing room. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * chore(entitlements): bypass paywall in local development Add isPaywallBypassed() so all gated capabilities are testable locally without a subscription. Fires only on NODE_ENV=development (npm run dev) or an explicit DISABLE_PAYWALL=true escape hatch — production builds run under NODE_ENV=production and the entitlement suite runs under 'test', so both keep exercising the real gate. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): resolve enskild firma bolagsuppgifter via 12-digit personnummer TIC's Lens search is fuzzy and only resolves an enskild firma from the 12-digit (century-prefixed) personnummer; a 10-digit form fuzzy-matched an unrelated entity. Expand personnummer to 12 digits before querying and reject hits whose registration number is unrelated to the request. Add a "Hämta" action to the settings Bolagsuppgifter panel to (re)fetch on demand. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * feat(transactions): implement categorize core for bank transaction categorization - Added `categorize-core.ts` to handle categorization of bank transactions, supporting single and bulk operations. - Introduced `categorizeMatchedTransaction` and `bulkBookMatchedInboxItems` functions for transaction processing. - Implemented fiscal period validation and duplicate booking detection. - Enhanced logging and error handling for transaction categorization. feat(scripts): add diagnostic script for Handelsbanken ASPSP metadata - Created `check-handelsbanken-aspsp.mjs` to fetch and display available authentication methods for Handelsbanken. - Outputs metadata for business and personal PSU types, including default authentication methods. fix(migrations): increase statement timeout for SIE bulk delete operations - Updated `20260629160000_sie_bulk_delete_statement_timeout.sql` to set a longer statement timeout for bulk delete RPCs to prevent cancellations during large imports. feat(migrations): add bulk book inbox items to pending operations - Expanded `pending_operations` table to include `bulk_book_inbox_items` operation type in `20260630120000_pending_operations_add_bulk_book_inbox_items.sql`. - Supports bulk booking of matched inbox items against bank transactions. test(pg): add tests for replace_period_opening_balance_link RPC - Implemented tests in `replace-period-opening-balance-link.pg.test.ts` to validate the functionality of the opening-balance correction flow. - Ensured immutability of opening balance links and proper handling of posted vs. non-posted entries. * fix(sie-export): update journal entries and lines handling in SIE export tests * fix(migrations): resolve version collision on 20260629160000 The SIE bulk-delete statement_timeout migration shared version 20260629160000 with journal_entries_list_series_filter (merged from main via #798/#823), causing a schema_migrations_pkey duplicate key error on apply. Rename the branch's migration to 20260629160100. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(compliance): resolve compliance-swarm + review findings - opening-balance/correct: compensating rollback for the non-atomic storno+rebook so a mid-sequence failure never leaves two posted OB entries (ASVS V2.3); durable audit event on every failure path (V16); reference the original verifikationsnummer in the corrected entry per BFL 5 kap 5§; document that requireWrite already enforces write-role + membership (V8.2.1 was a false positive) - reports sources routes: validate the cursor date component as ISO (/^\d{4}-\d{2}-\d{2}$/) before use, 400 on malformed (ASVS V1.2), applied to both the VAT-declaration and trial-balance routes - AgentSessionList: await the rename PATCH, revert the optimistic title and toast on failure (ASVS V4.5) - bank booking: exclude same-batch siblings from the booking-time duplicate guard so bulk-booking distinct same-(date,amount) transactions no longer false-positives; pre-existing duplicate detection is preserved - BulkBookInboxDialog: drop the unsafe currency-based reverse_charge default, add an omvänd skattskyldighet advisory, and type VAT options to the backend VatTreatment union - OpeningBalanceRowEditor: hold onChange in a ref (synced in effect, not during render) so an unstable callback can't cause a render loop Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
190 lines
6.7 KiB
TypeScript
190 lines
6.7 KiB
TypeScript
'use client'
|
|
|
|
import { useEffect, useState } from 'react'
|
|
import { useTranslations } from 'next-intl'
|
|
import { ExternalLink, FileText } from 'lucide-react'
|
|
import { Skeleton } from '@/components/ui/skeleton'
|
|
import { cn } from '@/lib/utils'
|
|
|
|
/**
|
|
* Side-by-side document viewer used while booking manually, so the user can
|
|
* read the figures off a receipt/invoice while filling in the journal entry.
|
|
*
|
|
* Renders by document id through the same-origin inline proxy
|
|
* (/api/documents/:id/inline). PDFs use <object type="application/pdf"> rather
|
|
* than <iframe> — Chrome intermittently blocks PDFs in a frame even with a
|
|
* permissive CSP (see the note in AttachmentPreviewSheet), and <object>
|
|
* invokes the PDF plugin directly. Images use <img>.
|
|
*
|
|
* Unlike AttachmentPreviewSheet this is keyed off a document id, not a
|
|
* journal_entry_id — during manual booking the entry does not exist yet.
|
|
*/
|
|
|
|
function isImageType(type: string | null, fileName?: string | null): boolean {
|
|
if (type?.startsWith('image/')) return true
|
|
// Legacy uploads sometimes leave mime_type null or application/octet-stream —
|
|
// fall back to the filename extension.
|
|
if (type === null || type === 'application/octet-stream') {
|
|
return /\.(jpe?g|png|gif|webp|svg)$/i.test(fileName ?? '')
|
|
}
|
|
return false
|
|
}
|
|
|
|
function isPdfType(type: string | null, fileName?: string | null): boolean {
|
|
if (type === 'application/pdf') return true
|
|
if (type === null || type === 'application/octet-stream') {
|
|
return fileName?.toLowerCase().endsWith('.pdf') ?? false
|
|
}
|
|
return false
|
|
}
|
|
|
|
interface DocumentViewerPaneProps {
|
|
/** Document id. Bytes are served via the same-origin inline proxy. */
|
|
documentId?: string | null
|
|
/** Pre-known mime type. When omitted it's fetched from /api/documents/:id. */
|
|
mime?: string | null
|
|
/** Pre-known signed URL for the "open in new tab" link. Optional. */
|
|
downloadUrl?: string | null
|
|
/** Optional filename — used for mime sniffing on legacy/octet-stream files. */
|
|
fileName?: string | null
|
|
className?: string
|
|
}
|
|
|
|
export default function DocumentViewerPane({
|
|
documentId,
|
|
mime: mimeProp = null,
|
|
downloadUrl: downloadUrlProp = null,
|
|
fileName = null,
|
|
className,
|
|
}: DocumentViewerPaneProps) {
|
|
const t = useTranslations('document_viewer')
|
|
// Fetched metadata is tagged with the document id it belongs to, so a stale
|
|
// response for a previously-shown document is ignored rather than flashed.
|
|
const [fetched, setFetched] = useState<
|
|
{ id: string; mime: string | null; url: string | null } | null
|
|
>(null)
|
|
|
|
// Resolve mime / download_url from the documents API only when the caller did
|
|
// not supply a mime (e.g. a pre-linked transaction document). When a mime is
|
|
// provided (fresh upload, inbox preview) we skip the round-trip entirely.
|
|
// setState happens only inside the async callbacks — never synchronously in
|
|
// the effect body — to avoid cascading renders (react-hooks/set-state-in-effect).
|
|
useEffect(() => {
|
|
if (!documentId || mimeProp) return
|
|
let cancelled = false
|
|
fetch(`/api/documents/${documentId}`)
|
|
.then((r) => (r.ok ? r.json() : null))
|
|
.then((body) => {
|
|
if (cancelled) return
|
|
setFetched({
|
|
id: documentId,
|
|
mime: body?.data?.mime_type ?? null,
|
|
url: body?.data?.download_url ?? null,
|
|
})
|
|
})
|
|
.catch(() => {
|
|
// preview is best-effort — record an empty result so we stop "loading"
|
|
if (!cancelled) setFetched({ id: documentId, mime: null, url: null })
|
|
})
|
|
return () => {
|
|
cancelled = true
|
|
}
|
|
}, [documentId, mimeProp])
|
|
|
|
const fetchedForThis = fetched?.id === documentId ? fetched : null
|
|
const mime = mimeProp ?? fetchedForThis?.mime ?? null
|
|
const downloadUrl = downloadUrlProp ?? fetchedForThis?.url ?? null
|
|
const loadingMeta = !!documentId && !mimeProp && !fetchedForThis
|
|
|
|
if (!documentId) {
|
|
return (
|
|
<div
|
|
className={cn(
|
|
'flex h-full w-full items-center justify-center rounded-lg border bg-muted/20 text-sm text-muted-foreground',
|
|
className,
|
|
)}
|
|
>
|
|
<FileText className="mr-2 h-5 w-5" />
|
|
{t('empty')}
|
|
</div>
|
|
)
|
|
}
|
|
|
|
const inlineSrc = `/api/documents/${documentId}/inline`
|
|
const newTabHref = downloadUrl ?? inlineSrc
|
|
const showAsImage = isImageType(mime, fileName)
|
|
const showAsPdf = isPdfType(mime, fileName)
|
|
|
|
return (
|
|
<div
|
|
className={cn(
|
|
'flex h-full w-full flex-col overflow-hidden rounded-lg border bg-muted/20',
|
|
className,
|
|
)}
|
|
>
|
|
<div className="flex shrink-0 items-center justify-between gap-2 border-b px-3 py-1.5">
|
|
<span className="truncate text-xs text-muted-foreground">
|
|
{fileName ?? t('header_label')}
|
|
</span>
|
|
<a
|
|
href={newTabHref}
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground transition-colors duration-150 hover:text-foreground"
|
|
>
|
|
<ExternalLink className="h-3.5 w-3.5" />
|
|
{t('open_in_new_tab')}
|
|
</a>
|
|
</div>
|
|
|
|
<div className="min-h-0 flex-1 overflow-auto bg-background">
|
|
{loadingMeta ? (
|
|
<div className="p-3">
|
|
<Skeleton className="h-full min-h-[40vh] w-full rounded-md" />
|
|
</div>
|
|
) : showAsPdf ? (
|
|
<object
|
|
data={inlineSrc}
|
|
type="application/pdf"
|
|
aria-label={fileName ?? t('header_label')}
|
|
className="h-full w-full"
|
|
>
|
|
<div className="flex h-full w-full items-center justify-center p-4 text-center text-sm text-muted-foreground">
|
|
{t('not_previewable')}
|
|
{' — '}
|
|
<a
|
|
href={newTabHref}
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
className="ml-1 underline"
|
|
>
|
|
{t('open_in_new_tab')}
|
|
</a>
|
|
</div>
|
|
</object>
|
|
) : showAsImage ? (
|
|
// eslint-disable-next-line @next/next/no-img-element
|
|
<img
|
|
src={inlineSrc}
|
|
alt={fileName ?? t('header_label')}
|
|
className="mx-auto max-w-full object-contain"
|
|
/>
|
|
) : (
|
|
<div className="flex h-full w-full flex-col items-center justify-center gap-2 p-4 text-center text-sm text-muted-foreground">
|
|
<FileText className="h-6 w-6" />
|
|
<span>{t('not_previewable')}</span>
|
|
<a
|
|
href={newTabHref}
|
|
target="_blank"
|
|
rel="noopener noreferrer"
|
|
className="underline"
|
|
>
|
|
{t('open_in_new_tab')}
|
|
</a>
|
|
</div>
|
|
)}
|
|
</div>
|
|
</div>
|
|
)
|
|
}
|