Jakob Wennberg
0f1c7c9365
A Bokio integration token is scoped to one Bokio company and the company id is typed in by hand, so credentials for the user's other company imported that company's customers, suppliers and invoices with no error at all. Probe /companies/{id} before storing, mirroring the Bjorn Lunden /details probe, and refuse on a confident org-number mismatch.
Also surface the inbox mail body when nothing was attached: it was captured in email_body_text and never read back, which made Gmail's forwarding-confirmation mail unreadable and the forward impossible to complete.
574 lines
20 KiB
TypeScript
574 lines
20 KiB
TypeScript
/**
|
|
* Direct provider client: replaces arcim-client.ts.
|
|
*
|
|
* Instead of making HTTP calls to the Arcim Sync gateway, this module
|
|
* performs consent/OTC operations directly against Supabase and delegates
|
|
* data fetching to the provider clients in lib/providers/.
|
|
*/
|
|
|
|
import { randomBytes } from 'node:crypto'
|
|
import { createServiceClient } from '@/lib/supabase/server'
|
|
import type { ProviderName } from '@/lib/providers/types'
|
|
import { getOAuthConfig } from '@/lib/providers/oauth-config'
|
|
import { buildFortnoxAuthUrl } from '@/lib/providers/fortnox/oauth'
|
|
import { exchangeFortnoxCode } from '@/lib/providers/fortnox/oauth'
|
|
import { buildVismaAuthUrl, exchangeVismaCode } from '@/lib/providers/visma/oauth'
|
|
import { refreshBjornLundenToken } from '@/lib/providers/bjornlunden/oauth'
|
|
import { BjornLundenClient, BjornLundenApiError } from '@/lib/providers/bjornlunden/client'
|
|
import { exchangeBrioxCode } from '@/lib/providers/briox/oauth'
|
|
import { BrioxApiError } from '@/lib/providers/briox/client'
|
|
import { BokioClient, BokioApiError } from '@/lib/providers/bokio/client'
|
|
import { normalizeOrgNumber } from '@/lib/company-lookup/normalize-org-number'
|
|
import type { ConsentRecord, OtcResponse } from '../types'
|
|
|
|
// Singleton (holds the rate limiter): used to validate BL User-Keys at submit
|
|
const bjornLundenClient = new BjornLundenClient()
|
|
|
|
// Singleton (holds the rate limiter): used to verify Bokio company identity
|
|
const bokioClient = new BokioClient()
|
|
|
|
/**
|
|
* Thrown by submitProviderToken when the provider actively rejects the
|
|
* submitted credentials (as opposed to a transient failure). The route maps
|
|
* this to the PROVIDER_TOKEN_INVALID structured error so the wizard can tell
|
|
* the user to re-check what they pasted.
|
|
*/
|
|
export class ProviderTokenInvalidError extends Error {
|
|
constructor(message: string) {
|
|
super(message)
|
|
this.name = 'ProviderTokenInvalidError'
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Thrown when a consent does not exist OR does not belong to the caller's
|
|
* company. The two cases are deliberately indistinguishable so a caller
|
|
* cannot probe whether other tenants' consent IDs exist. The route maps this
|
|
* to PROVIDER_CONSENT_NOT_FOUND (404).
|
|
*/
|
|
export class ConsentNotFoundError extends Error {
|
|
constructor() {
|
|
super('Consent not found')
|
|
this.name = 'ConsentNotFoundError'
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Thrown when the credentials are valid but open a company whose org number is
|
|
* not the one being imported into. Reported as PROVIDER_COMPANY_MISMATCH (422).
|
|
*
|
|
* The failure this prevents is silent and expensive: a token that works plus a
|
|
* company id for the wrong company imports a FOREIGN legal entity's customers,
|
|
* suppliers and invoices into this ledger. Nothing errors, so the first signal
|
|
* is the user noticing their books are full of a stranger's data. Both org
|
|
* numbers are carried on the error so the wizard can name the two companies.
|
|
*/
|
|
export class ProviderCompanyMismatchError extends Error {
|
|
constructor(
|
|
public readonly expectedOrgNumber: string,
|
|
public readonly actualOrgNumber: string,
|
|
public readonly actualCompanyName: string | null,
|
|
) {
|
|
super(
|
|
`Provider company mismatch: credentials open ${actualOrgNumber}, ` +
|
|
`but the target company is ${expectedOrgNumber}`,
|
|
)
|
|
this.name = 'ProviderCompanyMismatchError'
|
|
}
|
|
}
|
|
|
|
// Re-export data fetching functions from the provider layer
|
|
export { resolveConsent } from '@/lib/providers/resolve-consent'
|
|
export {
|
|
fetchCompanyInfoDirect,
|
|
fetchCustomersDirect,
|
|
fetchSuppliersDirect,
|
|
fetchSalesInvoicesDirect,
|
|
fetchSupplierInvoicesDirect,
|
|
} from '@/lib/providers/provider-data-fetcher'
|
|
|
|
// ── Consent lifecycle (direct Supabase) ─────────────────────────────
|
|
|
|
export async function createConsent(
|
|
companyId: string,
|
|
provider: ProviderName,
|
|
name: string,
|
|
orgNumber?: string,
|
|
companyName?: string,
|
|
): Promise<ConsentRecord> {
|
|
const supabase = createServiceClient()
|
|
|
|
const { data, error } = await supabase
|
|
.from('provider_consents')
|
|
.insert({
|
|
company_id: companyId,
|
|
name,
|
|
provider,
|
|
org_number: orgNumber,
|
|
company_name: companyName,
|
|
status: 0, // Created
|
|
})
|
|
.select('*')
|
|
.single()
|
|
|
|
if (error || !data) {
|
|
throw new Error(`Failed to create consent: ${error?.message}`)
|
|
}
|
|
|
|
return {
|
|
id: data.id,
|
|
name: data.name,
|
|
provider: data.provider as ProviderName,
|
|
status: data.status,
|
|
orgNumber: data.org_number,
|
|
companyName: data.company_name,
|
|
}
|
|
}
|
|
|
|
export async function listConsents(companyId: string): Promise<ConsentRecord[]> {
|
|
const supabase = createServiceClient()
|
|
|
|
const { data, error } = await supabase
|
|
.from('provider_consents')
|
|
.select('*')
|
|
.eq('company_id', companyId)
|
|
.in('status', [0, 1]) // Created or Accepted
|
|
.order('created_at', { ascending: false })
|
|
|
|
if (error) {
|
|
throw new Error(`Failed to list consents: ${error.message}`)
|
|
}
|
|
|
|
return (data ?? []).map(d => ({
|
|
id: d.id,
|
|
name: d.name,
|
|
provider: d.provider as ProviderName,
|
|
status: d.status,
|
|
orgNumber: d.org_number,
|
|
companyName: d.company_name,
|
|
createdAt: d.created_at,
|
|
updatedAt: d.updated_at,
|
|
}))
|
|
}
|
|
|
|
/**
|
|
* Read a consent, scoped to the company that owns it.
|
|
*
|
|
* `ownerCompanyId` is mandatory: this module runs on the service client, which
|
|
* bypasses RLS, so the predicate below is the only tenant boundary. Without it
|
|
* any authenticated user could pass a foreign consent id and read back its
|
|
* status/provider/company name, i.e. a cross-tenant existence oracle. A consent
|
|
* that exists but belongs to another company throws the same
|
|
* ConsentNotFoundError as one that does not exist. Mirrors the guard in
|
|
* submitProviderToken() and resolveConsent().
|
|
*/
|
|
export async function getConsent(
|
|
consentId: string,
|
|
ownerCompanyId: string,
|
|
): Promise<ConsentRecord> {
|
|
const supabase = createServiceClient()
|
|
|
|
const { data, error } = await supabase
|
|
.from('provider_consents')
|
|
.select('*')
|
|
.eq('id', consentId)
|
|
.eq('company_id', ownerCompanyId)
|
|
.maybeSingle()
|
|
|
|
if (error || !data) {
|
|
throw new ConsentNotFoundError()
|
|
}
|
|
|
|
return {
|
|
id: data.id,
|
|
name: data.name,
|
|
provider: data.provider as ProviderName,
|
|
status: data.status,
|
|
orgNumber: data.org_number,
|
|
companyName: data.company_name,
|
|
}
|
|
}
|
|
|
|
export async function deleteConsent(consentId: string): Promise<void> {
|
|
const supabase = createServiceClient()
|
|
|
|
// Delete tokens first (cascade should handle this, but be explicit)
|
|
await supabase.from('provider_consent_tokens').delete().eq('consent_id', consentId)
|
|
await supabase.from('provider_otc').delete().eq('consent_id', consentId)
|
|
|
|
const { error } = await supabase
|
|
.from('provider_consents')
|
|
.delete()
|
|
.eq('id', consentId)
|
|
|
|
if (error) {
|
|
throw new Error(`Failed to delete consent: ${error.message}`)
|
|
}
|
|
}
|
|
|
|
/**
|
|
* Mint a one-time code bound to a consent.
|
|
*
|
|
* The code doubles as the OAuth `state` parameter: it is an opaque random
|
|
* identifier for a server-written row, and the callback resolves the consent
|
|
* from that row rather than from anything the browser carried. 32 random bytes
|
|
* (not the previous 16 hex chars of a UUID) because this value is now the only
|
|
* thing standing between an attacker and binding their provider account to
|
|
* someone else's consent.
|
|
*
|
|
* Default lifetime is 10 minutes: the state only has to survive the redirect
|
|
* to the provider's login page and back. OAuth guidance puts state/OTC
|
|
* lifetimes at 5-10 minutes; every extra minute widens the window in which a
|
|
* leaked or phished state can still be consumed.
|
|
*/
|
|
export async function generateOtc(
|
|
consentId: string,
|
|
expiresInMinutes: number = 10,
|
|
): Promise<OtcResponse> {
|
|
const supabase = createServiceClient()
|
|
|
|
const code = randomBytes(32).toString('base64url')
|
|
const expiresAt = new Date(Date.now() + expiresInMinutes * 60 * 1000).toISOString()
|
|
|
|
const { error } = await supabase
|
|
.from('provider_otc')
|
|
.insert({
|
|
code,
|
|
consent_id: consentId,
|
|
expires_at: expiresAt,
|
|
})
|
|
|
|
if (error) {
|
|
throw new Error(`Failed to generate OTC: ${error.message}`)
|
|
}
|
|
|
|
return { code, consentId, expiresAt }
|
|
}
|
|
|
|
/**
|
|
* Atomically consume an OAuth `state` token and resolve what it was minted for.
|
|
*
|
|
* The single UPDATE is the entire check: `used_at IS NULL` and
|
|
* `expires_at > now` sit in the WHERE clause, so a replayed callback loses the
|
|
* row-lock race (under READ COMMITTED the second statement re-evaluates the
|
|
* predicate after the first commits, matches nothing, and updates 0 rows).
|
|
* There is no read-then-write window to exploit.
|
|
*
|
|
* The provider is read from the consent row (written server-side at connect
|
|
* time), never from the callback query string.
|
|
*
|
|
* Returns null for every failure mode: unknown/forged state, expired state,
|
|
* already-consumed state, deleted consent. Callers must not distinguish them,
|
|
* that distinction is exactly the oracle this function exists to remove.
|
|
*/
|
|
export async function consumeOAuthState(
|
|
state: string,
|
|
): Promise<{ consentId: string; provider: ProviderName } | null> {
|
|
const supabase = createServiceClient()
|
|
const now = new Date().toISOString()
|
|
|
|
const { data: consumed, error } = await supabase
|
|
.from('provider_otc')
|
|
.update({ used_at: now })
|
|
.eq('code', state)
|
|
.is('used_at', null)
|
|
.gt('expires_at', now)
|
|
.select('consent_id')
|
|
.maybeSingle()
|
|
|
|
if (error || !consumed?.consent_id) {
|
|
return null
|
|
}
|
|
|
|
const { data: consent } = await supabase
|
|
.from('provider_consents')
|
|
.select('provider')
|
|
.eq('id', consumed.consent_id)
|
|
.maybeSingle()
|
|
|
|
if (!consent?.provider) {
|
|
return null
|
|
}
|
|
|
|
return {
|
|
consentId: consumed.consent_id as string,
|
|
provider: consent.provider as ProviderName,
|
|
}
|
|
}
|
|
|
|
// ── OAuth helpers (direct provider calls) ───────────────────────────
|
|
|
|
export async function getAuthUrl(
|
|
provider: ProviderName,
|
|
state?: string,
|
|
redirectUri?: string,
|
|
): Promise<{ url: string }> {
|
|
const config = getOAuthConfig(provider)
|
|
|
|
// Override redirect URI if provided (extension callback URL)
|
|
const effectiveConfig = redirectUri
|
|
? { ...config, redirectUri }
|
|
: config
|
|
|
|
if (provider === 'fortnox') {
|
|
const url = buildFortnoxAuthUrl(effectiveConfig, { state })
|
|
return { url }
|
|
}
|
|
|
|
if (provider === 'visma') {
|
|
const url = buildVismaAuthUrl(effectiveConfig, { state })
|
|
return { url }
|
|
}
|
|
|
|
throw new Error(`OAuth is not supported for provider: ${provider}`)
|
|
}
|
|
|
|
export async function exchangeAuthToken(
|
|
consentId: string,
|
|
provider: ProviderName,
|
|
code: string,
|
|
redirectUri?: string,
|
|
): Promise<{ success: boolean; consentId: string }> {
|
|
const config = getOAuthConfig(provider)
|
|
const effectiveConfig = redirectUri ? { ...config, redirectUri } : config
|
|
const supabase = createServiceClient()
|
|
|
|
let tokenResponse: { access_token: string; refresh_token: string; expires_in: number }
|
|
|
|
if (provider === 'fortnox') {
|
|
tokenResponse = await exchangeFortnoxCode(effectiveConfig, code)
|
|
} else if (provider === 'visma') {
|
|
tokenResponse = await exchangeVismaCode(effectiveConfig, code)
|
|
} else {
|
|
throw new Error(`OAuth exchange not supported for provider: ${provider}`)
|
|
}
|
|
|
|
const expiresAt = new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
|
|
|
|
// Store tokens
|
|
await supabase
|
|
.from('provider_consent_tokens')
|
|
.upsert({
|
|
consent_id: consentId,
|
|
provider,
|
|
access_token: tokenResponse.access_token,
|
|
refresh_token: tokenResponse.refresh_token,
|
|
token_expires_at: expiresAt,
|
|
})
|
|
|
|
// Mark consent as accepted
|
|
await supabase
|
|
.from('provider_consents')
|
|
.update({ status: 1 })
|
|
.eq('id', consentId)
|
|
|
|
return { success: true, consentId }
|
|
}
|
|
|
|
export async function submitProviderToken(
|
|
consentId: string,
|
|
provider: ProviderName,
|
|
apiToken: string,
|
|
providerCompanyId: string | undefined,
|
|
ownerCompanyId: string,
|
|
): Promise<{ success: boolean; consentId: string }> {
|
|
const supabase = createServiceClient()
|
|
|
|
// Ownership guard (IDOR): the consent must belong to the caller's company
|
|
// before ANY write: this module runs on the service client, which bypasses
|
|
// RLS, so this check is the only tenant boundary. Mirrors resolveConsent()
|
|
// in lib/providers/resolve-consent.ts. A consent that exists but belongs to
|
|
// another company throws the same not-found error as a nonexistent one.
|
|
const { data: ownedRows } = await supabase
|
|
.from('provider_consents')
|
|
.select('id')
|
|
.eq('id', consentId)
|
|
.eq('company_id', ownerCompanyId)
|
|
.limit(1)
|
|
|
|
if (!ownedRows || ownedRows.length === 0) {
|
|
throw new ConsentNotFoundError()
|
|
}
|
|
|
|
let accessToken = apiToken
|
|
let refreshToken: string | null = null
|
|
let tokenExpiresAt: string | null = null
|
|
|
|
// BL uses app-level client credentials: get a real token, then prove the
|
|
// pasted User-Key actually opens a company before storing anything.
|
|
if (provider === 'bjornlunden') {
|
|
if (!providerCompanyId) {
|
|
throw new ProviderTokenInvalidError('Björn Lundén requires a company key (User-Key)')
|
|
}
|
|
const tokenResponse = await refreshBjornLundenToken()
|
|
accessToken = tokenResponse.access_token
|
|
tokenExpiresAt = new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
|
|
|
|
// Sandbox-verified: an unknown User-Key makes /details answer 500 (BL
|
|
// fails to bind the company database), not 401/403. Without this probe a
|
|
// typo'd GUID is stored silently and only surfaces as a confusing failure
|
|
// at preview. retry:false makes a bad key fail fast instead of burning
|
|
// the client's full retry budget on the "retryable" 500.
|
|
try {
|
|
const details = await bjornLundenClient.get<Record<string, unknown>>(
|
|
accessToken,
|
|
providerCompanyId,
|
|
'/details',
|
|
{ retry: false },
|
|
)
|
|
// Bonus from the probe: label the consent with the company name so the
|
|
// wizard's connection list shows which BL company was linked.
|
|
const blCompanyName = typeof details?.['name'] === 'string' ? (details['name'] as string).trim() : ''
|
|
if (blCompanyName) {
|
|
await supabase
|
|
.from('provider_consents')
|
|
.update({ company_name: blCompanyName })
|
|
.eq('id', consentId)
|
|
}
|
|
} catch (error) {
|
|
if (error instanceof BjornLundenApiError) {
|
|
// 429 and gateway-style 5xx (502/503/504) are transient provider
|
|
// failures, not a verdict on the key: rethrow so the route reports a
|
|
// generic submit failure instead of "your key is wrong". 500 stays
|
|
// mapped to invalid credentials: per the sandbox finding above, 500
|
|
// IS the bad-key signal at BL. Tradeoff: a genuine BL 500 outage also
|
|
// reads as a rejected key.
|
|
if (error.statusCode === 429 || error.statusCode >= 501) {
|
|
throw error
|
|
}
|
|
throw new ProviderTokenInvalidError(
|
|
`Björn Lundén rejected the company key (HTTP ${error.statusCode})`,
|
|
)
|
|
}
|
|
throw error
|
|
}
|
|
}
|
|
|
|
// Briox: the user pastes an application token + account ID, which we
|
|
// exchange ONCE for an access/refresh token pair. Storing the raw
|
|
// application token would fail on every data call.
|
|
if (provider === 'briox') {
|
|
if (!providerCompanyId) {
|
|
throw new ProviderTokenInvalidError('Briox requires an account ID (clientid)')
|
|
}
|
|
try {
|
|
const tokenResponse = await exchangeBrioxCode(providerCompanyId, apiToken)
|
|
accessToken = tokenResponse.access_token
|
|
refreshToken = tokenResponse.refresh_token
|
|
tokenExpiresAt = new Date(Date.now() + tokenResponse.expires_in * 1000).toISOString()
|
|
} catch (error) {
|
|
// /token answers 400/401/404 for a wrong account ID or application
|
|
// token: surface as invalid credentials, not a server error.
|
|
if (error instanceof BrioxApiError && error.statusCode < 500 && error.statusCode !== 429) {
|
|
throw new ProviderTokenInvalidError(
|
|
`Briox rejected the credentials (HTTP ${error.statusCode})`,
|
|
)
|
|
}
|
|
throw error
|
|
}
|
|
}
|
|
|
|
// Bokio: the pasted integration token is scoped to ONE Bokio company, and the
|
|
// company GUID is typed in by hand. Nothing upstream ties either to the
|
|
// Accounted company being imported into, so a token/GUID for the user's other
|
|
// company imports that company's customers, suppliers and invoices here with
|
|
// no error at all. Probe /companies/{guid} before storing anything: it both
|
|
// proves the credentials work and returns the orgNumber to compare.
|
|
if (provider === 'bokio') {
|
|
if (!providerCompanyId) {
|
|
throw new ProviderTokenInvalidError('Bokio requires a company id')
|
|
}
|
|
|
|
let bokioCompany: Record<string, unknown> | null
|
|
try {
|
|
bokioCompany = await bokioClient.getCompany<Record<string, unknown>>(
|
|
accessToken,
|
|
providerCompanyId,
|
|
)
|
|
} catch (error) {
|
|
if (error instanceof BokioApiError) {
|
|
// 429/5xx are transient provider failures, not a verdict on the token:
|
|
// rethrow so the route reports a generic submit failure rather than
|
|
// telling the user their credentials are wrong. 401/403/404 mean the
|
|
// token or the GUID genuinely does not open this company.
|
|
if (error.statusCode === 429 || error.statusCode >= 500) {
|
|
throw error
|
|
}
|
|
throw new ProviderTokenInvalidError(
|
|
`Bokio rejected the credentials (HTTP ${error.statusCode})`,
|
|
)
|
|
}
|
|
throw error
|
|
}
|
|
|
|
// getCompany() maps 404 to null: an unknown GUID is a bad company id, not
|
|
// an outage.
|
|
if (!bokioCompany) {
|
|
throw new ProviderTokenInvalidError('Bokio does not know that company id')
|
|
}
|
|
|
|
const bokioName = typeof bokioCompany['name'] === 'string'
|
|
? (bokioCompany['name'] as string).trim()
|
|
: ''
|
|
const bokioOrgNumber = normalizeOrgNumber(bokioCompany['orgNumber'] as string | undefined)
|
|
|
|
const { data: targetCompany } = await supabase
|
|
.from('companies')
|
|
.select('org_number')
|
|
.eq('id', ownerCompanyId)
|
|
.maybeSingle()
|
|
const targetOrgNumber = normalizeOrgNumber(targetCompany?.org_number)
|
|
|
|
// Only a confident mismatch blocks. A missing org number on either side is
|
|
// not evidence of anything (Accounted allows companies without one, and a
|
|
// Bokio response could omit it), so those fall through to the labelling
|
|
// below: the wizard still shows WHICH Bokio company was linked, which is
|
|
// what lets the user catch it themselves.
|
|
if (bokioOrgNumber && targetOrgNumber && bokioOrgNumber !== targetOrgNumber) {
|
|
throw new ProviderCompanyMismatchError(
|
|
targetOrgNumber,
|
|
bokioOrgNumber,
|
|
bokioName || null,
|
|
)
|
|
}
|
|
|
|
// Label the consent with what the credentials actually opened. Written as
|
|
// an object literal (not a conditional spread) so the phantom-column guard
|
|
// can see which columns this touches. `undefined` is dropped by the JSON
|
|
// serialisation, so a field Bokio did not return is left alone rather than
|
|
// overwriting a value the user typed at connect time with null.
|
|
if (bokioName || bokioOrgNumber) {
|
|
await supabase
|
|
.from('provider_consents')
|
|
.update({
|
|
company_name: bokioName || undefined,
|
|
org_number: bokioOrgNumber || undefined,
|
|
})
|
|
.eq('id', consentId)
|
|
}
|
|
}
|
|
|
|
// Store tokens: consent stays at status 0 until migration/SIE import completes
|
|
await supabase
|
|
.from('provider_consent_tokens')
|
|
.upsert({
|
|
consent_id: consentId,
|
|
provider,
|
|
access_token: accessToken,
|
|
refresh_token: refreshToken,
|
|
token_expires_at: tokenExpiresAt,
|
|
provider_company_id: providerCompanyId,
|
|
})
|
|
|
|
return { success: true, consentId }
|
|
}
|
|
|
|
/** Mark a consent as accepted (status 1): call after migration or SIE import succeeds */
|
|
export async function acceptConsent(consentId: string): Promise<void> {
|
|
const supabase = createServiceClient()
|
|
await supabase
|
|
.from('provider_consents')
|
|
.update({ status: 1 })
|
|
.eq('id', consentId)
|
|
}
|