Jakob Wennberg
5bacda4839
* fix(vat): drop personnummer century so enskild firma VAT number is SE+12 not SE+14
Onboarding derived the VAT number as SE${orgNumber}01. For an enskild firma the
org number is a 12-digit personnummer, producing SE + 14 digits, which fails the
^SE\d{12}$ validation — the pre-filled value is re-submitted on save and the tax
settings page becomes unsavable.
New shared helper lib/vat/vat-number.ts (normalize/validate/derive, reusing
normalizeOrgNumber to drop the century + Luhn-validate). UpdateSettingsSchema,
the onboarding wizard, the onboarding upsert in lib/company/actions.ts, and the
arcim-migration provider import all route through it. Backfill migration repairs
existing SE+14 rows to SE+12 (idempotent, scoped to ^SE\d{14}$ only).
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
* chore(arcim): warn when a provider VAT number is dropped as malformed
The provider VAT guard silently discarded a value that doesn't normalise to a
valid SE+12 momsregistreringsnummer. Emit a structured warn (provider +
company, no raw value — it can embed a personnummer) so consistently-bad
provider data is observable rather than invisible. Addresses the OWASP V16
logging finding on the arcim VAT-normalisation change in this PR.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
72 lines
2.4 KiB
TypeScript
72 lines
2.4 KiB
TypeScript
import { describe, it, expect } from 'vitest'
|
|
import {
|
|
normalizeVatNumber,
|
|
isValidSwedishVatNumber,
|
|
deriveSwedishVatNumber,
|
|
} from '@/lib/vat/vat-number'
|
|
|
|
describe('normalizeVatNumber', () => {
|
|
it('uppercases and strips spaces and hyphens', () => {
|
|
expect(normalizeVatNumber('se 556123-4567 01')).toBe('SE556123456701')
|
|
})
|
|
|
|
it('leaves an already-canonical number unchanged', () => {
|
|
expect(normalizeVatNumber('SE556123456701')).toBe('SE556123456701')
|
|
})
|
|
})
|
|
|
|
describe('isValidSwedishVatNumber', () => {
|
|
it('accepts SE followed by exactly 12 digits', () => {
|
|
expect(isValidSwedishVatNumber('SE556123456701')).toBe(true)
|
|
})
|
|
|
|
it('rejects SE followed by 14 digits (century not dropped)', () => {
|
|
expect(isValidSwedishVatNumber('SE19900101123401')).toBe(false)
|
|
})
|
|
|
|
it('rejects lowercase / spaced input (must be normalised first)', () => {
|
|
expect(isValidSwedishVatNumber('se556123456701')).toBe(false)
|
|
expect(isValidSwedishVatNumber('SE 556123 4567 01')).toBe(false)
|
|
})
|
|
|
|
it('rejects a non-SE prefix', () => {
|
|
expect(isValidSwedishVatNumber('DE123456789')).toBe(false)
|
|
})
|
|
})
|
|
|
|
describe('deriveSwedishVatNumber', () => {
|
|
it('derives from a 10-digit aktiebolag org number (used as-is + 01)', () => {
|
|
// 5561234567 is a valid-Luhn organisationsnummer
|
|
expect(deriveSwedishVatNumber('5561234567')).toBe('SE556123456701')
|
|
})
|
|
|
|
it('accepts hyphen-formatted org numbers', () => {
|
|
expect(deriveSwedishVatNumber('556123-4567')).toBe('SE556123456701')
|
|
})
|
|
|
|
it('drops the century from a 12-digit personnummer (enskild firma)', () => {
|
|
// 19850101-0006 → 10-digit form 8501010006 → SE8501010006 01
|
|
expect(deriveSwedishVatNumber('198501010006')).toBe('SE850101000601')
|
|
})
|
|
|
|
it('derives from a 10-digit personnummer as-is', () => {
|
|
expect(deriveSwedishVatNumber('850101-0006')).toBe('SE850101000601')
|
|
})
|
|
|
|
it('returns null for a structurally invalid (bad Luhn) identity', () => {
|
|
expect(deriveSwedishVatNumber('1234567890')).toBeNull()
|
|
})
|
|
|
|
it('returns null for empty / nullish input', () => {
|
|
expect(deriveSwedishVatNumber('')).toBeNull()
|
|
expect(deriveSwedishVatNumber(null)).toBeNull()
|
|
expect(deriveSwedishVatNumber(undefined)).toBeNull()
|
|
})
|
|
|
|
it('never produces an SE+14 value from a 12-digit personnummer', () => {
|
|
const derived = deriveSwedishVatNumber('198501010006')
|
|
expect(derived).not.toBeNull()
|
|
expect(isValidSwedishVatNumber(derived as string)).toBe(true)
|
|
})
|
|
})
|