* fix(invoices): return attachment filename in delivery history summaries The 20260723003000 hardening dropped attachment_filename from list_invoice_delivery_summaries, so the delivery history UI always fell back to the generic "faktura.pdf" label. Recreate the RPC with the filename included: it is derived from company name, customer name, invoice number, and date, all already visible to every company member, so the minimization boundary is unchanged. Addresses stay masked and message content, BCC, and checksums stay server-side. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reconciliation): surface own-account transfer legs in match-to-voucher by default The second (incoming) leg of a transfer between two of the company's own bank accounts was hidden in the 'Matcha mot befintlig verifikation' dialog because the voucher counted as 'already matched' once its outgoing leg was linked, even though the incoming account's line had no settling transaction. Users read the empty default list as 'the app won't let me link this'. get_account_gl_lines_for_matching now counts links per settlement account: a transaction provably on another cash account no longer marks the voucher as matched for the requested account, so the unsettled transfer leg surfaces by default (and auto-selects on an exact match). Same-account N:1 stays behind the 'Visa aven matchade verifikationer' opt-in, and transactions without a resolvable cash account conservatively keep counting everywhere. get_unlinked_gl_lines is deliberately untouched (feeds auto-reconcile). Companion guard: mark_entry_as_opening_balance now refuses entries with linked bank transactions, since half-settled transfer vouchers became reachable in the reconciliation view's unmatched table where 'Mark som IB' renders; re-tagging one would strand its transaction against a movement- excluded entry. getReconciliationStatus counts unmatched GL lines with the account-scoped RPC so the status card agrees with the table. Fixes #1026 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * perf(api): cut prod p95 latency via local JWT auth, single-RT company resolution, and report aggregate RPCs Baseline 2026-07-23 (487 prod samples): p50 160ms, p95 480ms, 13% of requests over 300ms. Target: p95 under 300ms. - requireAuth: verify JWTs locally via getClaims (ES256/JWKS) instead of a second network getUser per request; getUser fallback keeps HS256 self-hosted and existing test mocks working; middleware still revocation-checks every /api request - resolve_active_company RPC (20260723161000): one round trip replaces 2-3 queries in getActiveCompanyId and middleware; PGRST202/42501 fall back to the legacy query path - arsredovisning build-data: ~33 sequential round trips down to ~7, output byte-identical (snapshot-proven) - currency rate route: stop bypassing the exchange_rates cache (missing supabase arg caused an external Riksbanken call on every request) - document.get: parallelize row fetch, signed URL and audit event - list_company_accounts RPC (20260723170000): accounts list in one round trip instead of paging past PostgREST's 1000-row cap - vat-declaration route: drop a dead sequential company_settings query - get_kpi_report_aggregates RPC (20260723180000): KPI report's three full-period line scans collapsed into one aggregate call; dimension- filtered path unchanged - lint: fix 9 baseline errors, downgrade 4 react-hooks compiler rules to warn, zero the eslint baseline ratchet All four gates green: lint 0 errors, 9163 tests, check:guards, build. Migrations applied idempotently to staging only; prod receives them via Supabase branching on merge. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(review): resolve PR review findings across auth, VAT declaration, and IB retag - requireAuth getClaims fast path: pin iss (project URL) and aud ('authenticated'), log every fallback to getUser (ASVS V9.1 finding) - remove the ignored accountingMethod parameter from calculateVatDeclaration and the dead company_settings.accounting_method reads in xlsx/pdf/eskd routes; v1 API keeps accepting the query param but documents it as a no-op - close the mark_entry_as_opening_balance TOCTOU race with a transactions trigger (20260723190000, FOR KEY SHARE on journal_entries) + pg tests; applied to staging and smoke-verified both directions - re-add the 42501 tenant guard to branch-local migration 20260723160000 (function body had silently reverted to the pre-20260619130100 definition) - document the buildK3Noter tbFullRows full-TB contract (uppskjuten skatt opening balance per BFNAR 2012:1 ch.29) - add KPI VAT-liability test covering reduced-rate output accounts 2621/2631 Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(db): use NULL-safe caller_is_company_member in opening-balance retag guard The re-added tenant guard carried the pre-20260703180000 raw NOT IN (SELECT user_company_ids()) pattern, which the null-safe-tenant-guards ratchet blocks. Staging re-synced. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
284 lines
12 KiB
TypeScript
284 lines
12 KiB
TypeScript
/**
|
|
* pg-real test for get_account_gl_lines_for_matching
|
|
* (20260610120000_gl_lines_for_matching.sql, link-count semantics reworked in
|
|
* 20260723160000_gl_lines_matching_account_scoped_count.sql).
|
|
*
|
|
* This RPC backs the N:1 "lägga på flera" feature: it mirrors get_unlinked_gl_lines
|
|
* but can ALSO surface already-matched vouchers (so a second/third bank
|
|
* transaction can be attached to one verifikat), each carrying how many
|
|
* transactions already point at it.
|
|
*
|
|
* Since 20260723090000 the link count is scoped to the requested settlement
|
|
* account: a transaction provably on ANOTHER cash account does not mark the
|
|
* voucher as matched for p_account_number. This surfaces the unsettled second
|
|
* leg of an own-account transfer by default (issue #1026) while transactions
|
|
* with no resolvable cash account keep counting for every account.
|
|
* (The companion mark_entry_as_opening_balance guard from the same migration
|
|
* is covered in mark-entry-as-opening-balance.pg.test.ts.)
|
|
*/
|
|
import { describe, it, expect } from 'vitest'
|
|
import { randomUUID } from 'node:crypto'
|
|
import { getPool } from './setup'
|
|
import {
|
|
insertAuthUser,
|
|
insertCashAccount,
|
|
insertCompany,
|
|
insertFiscalPeriod,
|
|
insertTransaction,
|
|
} from './fixtures'
|
|
|
|
async function insertPostedJournalEntry(params: {
|
|
userId: string
|
|
companyId: string
|
|
fiscalPeriodId: string
|
|
entryDate: string
|
|
sourceType: 'opening_balance' | 'manual' | 'bank_transaction' | 'import' | 'storno' | 'correction'
|
|
voucherNumber: number
|
|
amount?: number
|
|
/** Line rows to book; defaults to the classic 1930 debit / 2091 credit pair. */
|
|
lines?: Array<{ account: string; debit: number; credit: number }>
|
|
}): Promise<string> {
|
|
const id = randomUUID()
|
|
const amount = params.amount ?? 1000
|
|
await getPool().query(
|
|
`INSERT INTO public.journal_entries
|
|
(id, user_id, company_id, fiscal_period_id, voucher_number, voucher_series,
|
|
entry_date, description, source_type, status)
|
|
VALUES ($1, $2, $3, $4, $5, 'A', $6, $7, $8, 'posted')`,
|
|
[
|
|
id,
|
|
params.userId,
|
|
params.companyId,
|
|
params.fiscalPeriodId,
|
|
params.voucherNumber,
|
|
params.entryDate,
|
|
`Test ${params.sourceType}`,
|
|
params.sourceType,
|
|
],
|
|
)
|
|
const lines = params.lines ?? [
|
|
{ account: '1930', debit: amount, credit: 0 },
|
|
{ account: '2091', debit: 0, credit: amount },
|
|
]
|
|
for (const line of lines) {
|
|
await getPool().query(
|
|
`INSERT INTO public.journal_entry_lines
|
|
(journal_entry_id, account_number, debit_amount, credit_amount)
|
|
VALUES ($1, $2, $3, $4)`,
|
|
[id, line.account, line.debit, line.credit],
|
|
)
|
|
}
|
|
return id
|
|
}
|
|
|
|
describe('get_account_gl_lines_for_matching RPC: N:1 candidates', () => {
|
|
it('returns already-matched vouchers (with link count) only when p_include_matched is true', async () => {
|
|
const userId = await insertAuthUser()
|
|
const companyId = await insertCompany({ createdBy: userId })
|
|
const fiscalPeriodId = await insertFiscalPeriod({
|
|
userId, companyId, periodStart: '2026-01-01', periodEnd: '2026-12-31',
|
|
})
|
|
|
|
// One unmatched voucher, one voucher already settled by TWO transactions
|
|
// (the salary-run-paid-in-two-transfers shape).
|
|
const unmatchedEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-03-15', sourceType: 'bank_transaction', voucherNumber: 1, amount: 1500,
|
|
})
|
|
const matchedEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-03-20', sourceType: 'manual', voucherNumber: 2, amount: 30000,
|
|
})
|
|
await insertTransaction({ companyId, userId, currency: 'SEK', journalEntryId: matchedEntry })
|
|
await insertTransaction({ companyId, userId, currency: 'SEK', journalEntryId: matchedEntry })
|
|
|
|
// Default (p_include_matched=false): parity with get_unlinked_gl_lines: only
|
|
// the unmatched voucher, count 0.
|
|
const { rows: unmatchedOnly } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1)`,
|
|
[companyId],
|
|
)
|
|
const unmatchedIds = new Set(unmatchedOnly.map((r) => r.journal_entry_id))
|
|
expect(unmatchedIds.has(unmatchedEntry)).toBe(true)
|
|
expect(unmatchedIds.has(matchedEntry)).toBe(false)
|
|
expect(unmatchedOnly.find((r) => r.journal_entry_id === unmatchedEntry).linked_transaction_count).toBe(0)
|
|
|
|
// p_include_matched=true: the matched voucher appears too, reporting both links.
|
|
const { rows: withMatched } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_include_matched => true)`,
|
|
[companyId],
|
|
)
|
|
const byId = new Map(withMatched.map((r) => [r.journal_entry_id, r.linked_transaction_count]))
|
|
expect(byId.get(unmatchedEntry)).toBe(0)
|
|
expect(byId.get(matchedEntry)).toBe(2)
|
|
})
|
|
|
|
it('still excludes opening_balance / storno / correction even with p_include_matched', async () => {
|
|
const userId = await insertAuthUser()
|
|
const companyId = await insertCompany({ createdBy: userId })
|
|
const fiscalPeriodId = await insertFiscalPeriod({
|
|
userId, companyId, periodStart: '2026-01-01', periodEnd: '2026-12-31',
|
|
})
|
|
|
|
// These book-only / IB vouchers have no bank-feed counterpart and can never
|
|
// be a match target: the include_matched opt-in must not resurrect them.
|
|
await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-01-01', sourceType: 'opening_balance', voucherNumber: 1, amount: 50000,
|
|
})
|
|
await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-05-02', sourceType: 'storno', voucherNumber: 2, amount: 25000,
|
|
})
|
|
await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-05-02', sourceType: 'correction', voucherNumber: 3, amount: 25000,
|
|
})
|
|
const bankEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-05-03', sourceType: 'bank_transaction', voucherNumber: 4, amount: 1500,
|
|
})
|
|
|
|
const { rows } = await getPool().query(
|
|
`SELECT journal_entry_id, source_type
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_include_matched => true)`,
|
|
[companyId],
|
|
)
|
|
|
|
const returnedIds = new Set(rows.map((r) => r.journal_entry_id))
|
|
expect(returnedIds.has(bankEntry)).toBe(true)
|
|
expect(rows.find((r) => r.source_type === 'opening_balance')).toBeUndefined()
|
|
expect(rows.find((r) => r.source_type === 'storno')).toBeUndefined()
|
|
expect(rows.find((r) => r.source_type === 'correction')).toBeUndefined()
|
|
})
|
|
})
|
|
|
|
describe('get_account_gl_lines_for_matching RPC: account-scoped link count (#1026)', () => {
|
|
it('surfaces the unsettled leg of an own-account transfer by default', async () => {
|
|
const userId = await insertAuthUser()
|
|
const companyId = await insertCompany({ createdBy: userId })
|
|
const fiscalPeriodId = await insertFiscalPeriod({
|
|
userId, companyId, periodStart: '2026-01-01', periodEnd: '2026-12-31',
|
|
})
|
|
await insertCashAccount({ companyId, ledgerAccount: '1930' })
|
|
const acc1940 = await insertCashAccount({ companyId, ledgerAccount: '1940' })
|
|
|
|
// Own-account transfer: one voucher, debit 1930 / credit 1940. The outgoing
|
|
// leg (a transaction on the 1940 account) is already matched to it.
|
|
const transferEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-06-26', sourceType: 'manual', voucherNumber: 1,
|
|
lines: [
|
|
{ account: '1930', debit: 2344.16, credit: 0 },
|
|
{ account: '1940', debit: 0, credit: 2344.16 },
|
|
],
|
|
})
|
|
await insertTransaction({
|
|
companyId, userId, amount: -2344.16, date: '2026-06-26',
|
|
journalEntryId: transferEntry, cashAccountId: acc1940,
|
|
})
|
|
|
|
// From 1930's perspective the voucher is unmatched: it must appear in the
|
|
// DEFAULT list (no toggle) with a zero link count, so ranking/auto-select
|
|
// treat it as a normal candidate.
|
|
const { rows: on1930 } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_account_number => '1930')`,
|
|
[companyId],
|
|
)
|
|
const row1930 = on1930.find((r) => r.journal_entry_id === transferEntry)
|
|
expect(row1930).toBeDefined()
|
|
expect(row1930.linked_transaction_count).toBe(0)
|
|
|
|
// From 1940's perspective it IS settled: hidden by default, visible with
|
|
// the opt-in and carrying the link.
|
|
const { rows: on1940Default } = await getPool().query(
|
|
`SELECT journal_entry_id
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_account_number => '1940')`,
|
|
[companyId],
|
|
)
|
|
expect(on1940Default.find((r) => r.journal_entry_id === transferEntry)).toBeUndefined()
|
|
|
|
const { rows: on1940Matched } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(
|
|
p_company_id => $1, p_account_number => '1940', p_include_matched => true)`,
|
|
[companyId],
|
|
)
|
|
expect(on1940Matched.find((r) => r.journal_entry_id === transferEntry).linked_transaction_count).toBe(1)
|
|
})
|
|
|
|
it('keeps same-account N:1 vouchers behind the include_matched opt-in', async () => {
|
|
const userId = await insertAuthUser()
|
|
const companyId = await insertCompany({ createdBy: userId })
|
|
const fiscalPeriodId = await insertFiscalPeriod({
|
|
userId, companyId, periodStart: '2026-01-01', periodEnd: '2026-12-31',
|
|
})
|
|
const acc1930 = await insertCashAccount({ companyId, ledgerAccount: '1930' })
|
|
|
|
// A salary-run shape: one voucher on 1930, partially settled by a first
|
|
// transfer FROM THE SAME account. The second instalment must still require
|
|
// the deliberate opt-in; account scoping must not open the N:1 floodgate.
|
|
const salaryEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-06-25', sourceType: 'manual', voucherNumber: 1, amount: 30000,
|
|
})
|
|
await insertTransaction({
|
|
companyId, userId, amount: -10000, date: '2026-06-25',
|
|
journalEntryId: salaryEntry, cashAccountId: acc1930,
|
|
})
|
|
|
|
const { rows: byDefault } = await getPool().query(
|
|
`SELECT journal_entry_id
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_account_number => '1930')`,
|
|
[companyId],
|
|
)
|
|
expect(byDefault.find((r) => r.journal_entry_id === salaryEntry)).toBeUndefined()
|
|
|
|
const { rows: withMatched } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(
|
|
p_company_id => $1, p_account_number => '1930', p_include_matched => true)`,
|
|
[companyId],
|
|
)
|
|
expect(withMatched.find((r) => r.journal_entry_id === salaryEntry).linked_transaction_count).toBe(1)
|
|
})
|
|
|
|
it('treats transactions without a resolvable cash account as settling every account', async () => {
|
|
const userId = await insertAuthUser()
|
|
const companyId = await insertCompany({ createdBy: userId })
|
|
const fiscalPeriodId = await insertFiscalPeriod({
|
|
userId, companyId, periodStart: '2026-01-01', periodEnd: '2026-12-31',
|
|
})
|
|
|
|
// Legacy shape: the linked transaction carries no cash_account_id, so it
|
|
// could belong to any account. The voucher must stay hidden by default
|
|
// (conservative: pre-account-scoping behavior).
|
|
const legacyEntry = await insertPostedJournalEntry({
|
|
userId, companyId, fiscalPeriodId,
|
|
entryDate: '2026-06-20', sourceType: 'bank_transaction', voucherNumber: 1, amount: 500,
|
|
})
|
|
await insertTransaction({
|
|
companyId, userId, amount: 500, date: '2026-06-20',
|
|
journalEntryId: legacyEntry, cashAccountId: null,
|
|
})
|
|
|
|
const { rows: byDefault } = await getPool().query(
|
|
`SELECT journal_entry_id
|
|
FROM public.get_account_gl_lines_for_matching(p_company_id => $1, p_account_number => '1930')`,
|
|
[companyId],
|
|
)
|
|
expect(byDefault.find((r) => r.journal_entry_id === legacyEntry)).toBeUndefined()
|
|
|
|
const { rows: withMatched } = await getPool().query(
|
|
`SELECT journal_entry_id, linked_transaction_count
|
|
FROM public.get_account_gl_lines_for_matching(
|
|
p_company_id => $1, p_account_number => '1930', p_include_matched => true)`,
|
|
[companyId],
|
|
)
|
|
expect(withMatched.find((r) => r.journal_entry_id === legacyEntry).linked_transaction_count).toBe(1)
|
|
})
|
|
})
|