Files
accounted/lib/transactions/__tests__/bank-sync-chip-state.test.ts
T
MattssonandClaude Fable 5.1 b68c082ef5 feat(bank-sync): close the F2 report: gap backfill, consent and paused chip states, agent-triggered sync (#2165)
* fix(bank-sync): cron backfills the gap since the last successful sync

The daily incremental sync always asked the bank for the last 7 days. Any
pause longer than that (a lapsed subscription paid again, a consent renewed
after expiry, an outage) silently lost the days in between: the connection
came back, looked healthy, and the missing transactions never arrived.

The lookback now widens to cover the gap since last_synced_at plus one day
of overlap, capped at the 90-day PSD2 limit, and a gap of a month or more
asks for strategy=longest like the manual sync route does. Dedup via
external_id makes the overlap harmless. First syncs keep their 90-day path.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* feat(bank-sync): chip warns seven days before a bank consent expires

The transactions-page chip only reacted once a connection was already dead
(expired/error) or had gone stale. A consent that is about to end looked
healthy until the morning it stopped syncing. New "expiring" state when a
live connection's consent_expires is within seven days, the same threshold
as the consent-expiry email in the sync cron. Precedence: attention,
expiring, stale, healthy.

getChipState moves to lib/transactions/bank-sync-chip-state.ts so the
precedence is unit-tested; the component keeps the rendering only.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* feat(bank-sync): chip says paused when the subscription lapsed

The daily cron filters connections by the bank_sync capability, so a
company whose trial or subscription ended keeps status=active rows with a
frozen last_synced_at. The chip read that as "stale, check the connection",
which sends the user to re-authorise a connection that is perfectly alive.
56 of 191 active connections on prod were in this state on 2026-09-01.

New "paused" state, ranked above everything else, when the company lacks
bank_sync: hosted points at billing, self-host at the connector key, the
same split BankSyncNowButton already makes. getChipState takes an options
object so the clock stays out of render (react-hooks/purity).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* feat(api): agent-triggerable bank sync in v1 and MCP

Closes the first wish in the F2 report: an integration could read bank
data but never refresh it. New POST /api/v1/companies/{id}/bank-connections/
{connectionId}/sync and MCP gnubok_sync_bank, both on a shared runner
(extensions/general/enable-banking/lib/trigger-sync.ts).

Cost is bounded structurally, not by policy: the window is never
caller-controlled (the cron's gap-aware 7 to 90 day lookback), a connection
synced within 15 minutes answers BANK_SYNC_COOLDOWN with next_allowed_at
(429 + Retry-After on v1; synced=false in-band on MCP so the agent reads on
instead of retrying), and a failing connection is throttled per process by
attempt time. A dead session is flipped to expired with a remediation that
hands the user the connect link: no API call revives a consent.

Gated on bank_sync like gnubok_connect_bank; scope transactions:write.
Registry, scope map, load-routes, spec snapshot and the generated
accounted-api skill updated; five BANK_SYNC_* / BANK_SESSION_EXPIRED codes
added to the structured-error registry. The web Synka-nu route is left as
is (see DECISIONS.md).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* test(bank-sync): use the options object in the remaining chip-state calls

Four multi-line calls still passed the clock positionally after
getChipState moved to an options object; tsc flagged them (vitest did not,
the extra argument was ignored at runtime).

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* fix(api): address skeptic findings on the agent-triggered bank sync

Three refutations from the pre-publish skeptic pass:

1. Core imported the extension. The v1 sync route pulled the runner
   straight from @/extensions, which the core-build gate rejects and which
   left a live bank endpoint on zero-extension builds. The route now
   resolves it through the registry's services channel against a contract
   in lib/bank-sync/trigger-sync-contract.ts (same pattern as the
   Skatteverket read service) and answers EXTENSION_DISABLED when the
   extension is absent.

2. The idempotency cache stored the handler-level 429. A same-key retry
   after Retry-After, which is the documented retry, replayed the stale
   cooldown as a 400 for the cache's 24-hour TTL. withApiV1 no longer
   caches 429 responses; regression test added. The endpoint's pitfall no
   longer claims Idempotency-Key is mandatory (it was never enforced).

3. Two cron tests read the clock twice and failed whenever a millisecond
   passed between the reads. They now pin the clock with fake timers.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01QdcDV7CngLkWUvfKSsxFhS

* fix(bank-sync): durable cooldown lease and review wording

Resolves the PR #2165 review findings in one pass.

Superagent P1: the attempt throttle was a process-local Map, so two agent
calls on different serverless instances (or a retry after a cold start on
a failing connection) could each bill an Enable Banking call, contradicting
the one-sync-per-15-minutes promise. New bank_connections.sync_lease_until
(migration 20260902150000), claimed with one conditional UPDATE before the
bank is called; Postgres row locking makes exactly one claimer win, the
rest answer BANK_SYNC_COOLDOWN. The lease stays for the full window on
success and failure. Tests cover the claim order, a failed attempt seen
from a second instance, a lost race, and an expired lease.

CodeRabbit: the =1 plural branch now reads "in 1 day" / "om 1 dag"
(daysUntilConsentExpiry rounds a partial day up, so "tomorrow" could be
today); the cooldown pitfall on the v1 endpoint, the MCP description and
the in-band cooldown instruction now say a cooldown can follow a failed
attempt and tell the agent to compare last_synced_at before deciding.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub

* fix(bank-sync): lease claim as a literal filter for the schema guard

CI's no-phantom-columns guard counts runtime-built query expressions and
its ceiling is exact; the templated `.or('sync_lease_until.is.null,...')`
claim added one. The column now defaults to epoch (NOT NULL), so "never
claimed" is just "expired long ago" and the atomic claim is a single
literal `.lte('sync_lease_until', now)` the guard can check. Migration is
unshipped (same PR), so it is edited in place.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub

* fix(bank-sync): runner verifies company membership before the lease

Superagent (round 3): the MCP path reached the shared runner without a
membership check of its own. Both callers do enforce it upstream
(withApiV1's company resolution and resolveMcpCompanyContext in the MCP
dispatcher), but the runner writes transactions and bills a bank call, so
it now checks company_members itself, before the cooldown and the lease
claim, and answers NOT_FOUND for a non-member. The viewer check that was
buried inside the sync block moves up with it.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_0125TMQQBjBBZG9YxP7wQWub

---------

Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
2026-09-02 17:17:41 +02:00

127 lines
4.3 KiB
TypeScript

import { describe, expect, it } from 'vitest'
import { daysUntilConsentExpiry, getChipState } from '../bank-sync-chip-state'
const NOW = Date.parse('2026-09-02T08:00:00Z')
const HOUR_MS = 60 * 60 * 1000
const DAY_MS = 24 * HOUR_MS
const at = (msFromNow: number) => new Date(NOW + msFromNow).toISOString()
function row(overrides: Partial<Parameters<typeof getChipState>[0][number]> = {}) {
return {
id: 'conn-1',
status: 'active',
last_synced_at: at(-2 * HOUR_MS),
consent_expires: at(60 * DAY_MS),
...overrides,
}
}
describe('daysUntilConsentExpiry', () => {
it('rounds a partial day up so "1 day left" never reads as 0', () => {
expect(daysUntilConsentExpiry(at(0.4 * DAY_MS), NOW)).toBe(1)
expect(daysUntilConsentExpiry(at(6.5 * DAY_MS), NOW)).toBe(7)
})
it('floors at zero once the consent has passed', () => {
expect(daysUntilConsentExpiry(at(-3 * DAY_MS), NOW)).toBe(0)
})
it('is null without a usable timestamp', () => {
expect(daysUntilConsentExpiry(null, NOW)).toBeNull()
expect(daysUntilConsentExpiry(undefined, NOW)).toBeNull()
expect(daysUntilConsentExpiry('nope', NOW)).toBeNull()
})
})
describe('getChipState', () => {
it('is hidden without connections', () => {
expect(getChipState([], { now: NOW })).toEqual({ kind: 'none' })
})
it('reads healthy for a recent sync with a distant consent', () => {
expect(getChipState([row()], { now: NOW })).toEqual({ kind: 'healthy', mostRecent: at(-2 * HOUR_MS) })
})
it('warns when a live consent ends within seven days', () => {
expect(getChipState([row({ consent_expires: at(7 * DAY_MS) })], { now: NOW })).toEqual({
kind: 'expiring',
daysLeft: 7,
count: 1,
})
})
it('stays quiet at eight days', () => {
expect(getChipState([row({ consent_expires: at(8 * DAY_MS) })], { now: NOW }).kind).toBe('healthy')
})
it('reports the soonest expiry and how many are affected', () => {
const state = getChipState(
[
row({ id: 'a', consent_expires: at(5 * DAY_MS) }),
row({ id: 'b', consent_expires: at(2 * DAY_MS) }),
row({ id: 'c', consent_expires: at(30 * DAY_MS) }),
],
{ now: NOW },
)
expect(state).toEqual({ kind: 'expiring', daysLeft: 2, count: 2 })
})
it('ranks a dead connection above an expiring one', () => {
const state = getChipState(
[
row({ id: 'a', status: 'expired' }),
row({ id: 'b', consent_expires: at(1 * DAY_MS) }),
],
{ now: NOW },
)
expect(state).toEqual({ kind: 'attention', count: 1 })
})
it('ranks expiring above stale: the deadline matters more than the age', () => {
const state = getChipState(
[row({ last_synced_at: at(-3 * DAY_MS), consent_expires: at(3 * DAY_MS) })],
{ now: NOW },
)
expect(state.kind).toBe('expiring')
})
it('ignores the consent on rows that are not live yet', () => {
const state = getChipState(
[row({ status: 'pending_selection', consent_expires: at(1 * DAY_MS), last_synced_at: null })],
{ now: NOW },
)
expect(state).toEqual({ kind: 'healthy', mostRecent: null })
})
it('reads stale after 36 hours without a sync', () => {
expect(getChipState([row({ last_synced_at: at(-37 * HOUR_MS) })], { now: NOW })).toEqual({
kind: 'stale',
mostRecent: at(-37 * HOUR_MS),
})
})
it('reads paused when the company lacks the bank_sync entitlement', () => {
// 56 of 191 active connections on prod sat in this state on 2026-09-01:
// the cron skips them, so they are neither dead nor merely stale.
const state = getChipState([row({ last_synced_at: at(-20 * DAY_MS) })], {
now: NOW,
hasBankSync: false,
})
expect(state).toEqual({ kind: 'paused' })
})
it('ranks paused above a dead connection: renewing without a subscription changes nothing', () => {
const state = getChipState([row({ status: 'expired' })], { now: NOW, hasBankSync: false })
expect(state).toEqual({ kind: 'paused' })
})
it('stays hidden without connections even when unentitled', () => {
expect(getChipState([], { now: NOW, hasBankSync: false })).toEqual({ kind: 'none' })
})
it('tolerates rows without the consent column', () => {
const state = getChipState([{ id: 'x', status: 'active', last_synced_at: at(-HOUR_MS) }], { now: NOW })
expect(state.kind).toBe('healthy')
})
})