02f94ef631
* fix: add 15s timeout to accounting provider HTTP clients Node's built-in fetch has no default timeout, so a stalled provider could hold a serverless worker open for many minutes — worse with withRetry (6x on Fortnox, 3x on others) and getPaginated stacking across pages. Wrap each fetch() in the Fortnox, Visma, Bokio, Briox, and Björn Lundén clients with signal: AbortSignal.timeout(15_000), and treat TimeoutError/AbortError as retryable so a single stalled attempt retries cleanly instead of hanging the request. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: add timeouts to OAuth token endpoints Wrap every OAuth2 token exchange, refresh, and revoke POST in an AbortController via a new fetchWithTimeout helper. Without this, a hung provider endpoint holds the request thread indefinitely — worst case being Skatteverket, where refreshAccessToken sits on the hot path of every bookkeeping action and exchangeCodeForTokens races the 5-minute BankID auth-code TTL. On timeout, the Skatteverket OAuth callback now redirects to /reports?tab=vat-declaration with a Swedish retry message instead of leaving the user stranded on the callback URL. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: close RLS escalation on membership and settings tables Any authenticated user who was a member (including viewer) could issue a direct PostgREST PATCH against company_members and promote themselves to owner, bypassing the app-layer requireWritePermission guard entirely. Reproduced on prod, then verified the fix on staging. Tighten INSERT/UPDATE/DELETE policies on company_members, team_members, api_keys, company_invitations, team_invitations, companies, teams, and company_settings to require the caller to hold role IN ('owner','admin') in the target company/team. Role check is wrapped in SECURITY DEFINER helpers (user_is_company_admin, user_is_team_admin, user_role_in_company) to avoid RLS recursion when a policy on company_members references company_members in its subquery. Add a BEFORE UPDATE trigger on company_members that rejects any role change unless the caller already holds role='owner', so admins cannot mint further owners even though they can otherwise write. Legitimate write paths are unaffected: company creation goes through the create_company_with_owner SECURITY DEFINER RPC, invite acceptance uses the service role, and team->company membership syncs via SECURITY DEFINER triggers. All bypass RLS. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(migrations): resolve duplicate schema_migrations version 20260421160000 Two migration files shared timestamp 20260421160000 on main (booking_template_usage.sql and opening_balances_rpc.sql), causing supabase_migrations.schema_migrations PK collisions on any fresh CI run: duplicate key value violates unique constraint "schema_migrations_pkey" Key (version)=(20260421160000) already exists. Bump opening_balances_rpc.sql to 20260421160500. booking_template_usage keeps 20260421160000 because its table already exists on prod; the renamed file has an idempotent CREATE OR REPLACE FUNCTION body and has not yet been deployed to prod, so moving its version is free. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix(migrations): make booking_template_usage migration idempotent The table already exists on prod (applied out-of-band) but prod's schema_migrations does not track version 20260421160000, so the next PR-driven deploy would re-run this migration and fail on `CREATE TABLE public.booking_template_usage` with a duplicate-relation error. Add IF NOT EXISTS to CREATE TABLE and CREATE INDEX, and DROP POLICY IF EXISTS before each CREATE POLICY. No functional change on fresh databases; prod just silently no-ops the table/index creates and re-declares policies without dropping-then-missing them. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com> * fix: implement isTimeoutError utility and enforce role restrictions on company_members insert * fix: implement fallback for user_id in commit_journal_entry function when auth.uid() is NULL --------- Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>
65 lines
2.2 KiB
PL/PgSQL
65 lines
2.2 KiB
PL/PgSQL
-- commit_journal_entry: fall back to the draft entry's user_id when
|
|
-- auth.uid() is NULL.
|
|
--
|
|
-- Context: when this RPC is invoked via the service role (one-off repair
|
|
-- scripts, cron jobs, internal maintenance flows), auth.uid() returns NULL.
|
|
-- The INSERT into voucher_sequences then fails its user_id NOT NULL check
|
|
-- *before* ON CONFLICT can resolve to DO UPDATE (PostgreSQL evaluates NOT
|
|
-- NULL on the candidate tuple ahead of conflict arbitration). That made it
|
|
-- impossible to commit journal entries from any non-interactive context.
|
|
--
|
|
-- Fix: read user_id from the draft journal entry (which is always set by
|
|
-- createJournalEntry) and use it as the fallback attribution on the
|
|
-- voucher sequence row. Normal interactive flows still record auth.uid();
|
|
-- only the service-role path changes.
|
|
|
|
CREATE OR REPLACE FUNCTION public.commit_journal_entry(
|
|
p_company_id uuid,
|
|
p_entry_id uuid,
|
|
p_commit_method text DEFAULT NULL,
|
|
p_rubric_version text DEFAULT NULL
|
|
)
|
|
RETURNS TABLE (voucher_number integer)
|
|
LANGUAGE plpgsql
|
|
SECURITY DEFINER
|
|
AS $$
|
|
DECLARE
|
|
v_next integer;
|
|
v_fiscal_period_id uuid;
|
|
v_series text;
|
|
v_entry_user_id uuid;
|
|
BEGIN
|
|
SELECT je.fiscal_period_id, COALESCE(je.voucher_series, 'A'), je.user_id
|
|
INTO v_fiscal_period_id, v_series, v_entry_user_id
|
|
FROM public.journal_entries je
|
|
WHERE je.id = p_entry_id
|
|
AND je.company_id = p_company_id
|
|
AND je.status = 'draft'
|
|
FOR UPDATE;
|
|
|
|
IF NOT FOUND THEN
|
|
RAISE EXCEPTION 'Draft journal entry not found: %', p_entry_id;
|
|
END IF;
|
|
|
|
INSERT INTO public.voucher_sequences (company_id, user_id, fiscal_period_id, voucher_series, last_number)
|
|
VALUES (p_company_id, COALESCE(auth.uid(), v_entry_user_id), v_fiscal_period_id, v_series, 1)
|
|
ON CONFLICT (company_id, fiscal_period_id, voucher_series)
|
|
DO UPDATE SET
|
|
last_number = public.voucher_sequences.last_number + 1,
|
|
updated_at = now()
|
|
RETURNING last_number INTO v_next;
|
|
|
|
UPDATE public.journal_entries
|
|
SET voucher_number = v_next,
|
|
status = 'posted',
|
|
commit_method = p_commit_method,
|
|
rubric_version = p_rubric_version
|
|
WHERE id = p_entry_id
|
|
AND company_id = p_company_id;
|
|
|
|
RETURN QUERY SELECT v_next;
|
|
END;
|
|
$$;
|
|
|
|
NOTIFY pgrst, 'reload schema';
|