Bug/invalid imports (#1146)
* feat: add Accounted MCP namespace * fix(bookkeeping): stop flagging verifikat whose underlag lives on a referenced supplier invoice The missing-underlag surfaces only accepted a document directly linked to the entry, so payment verifikat for supplier invoices (doc on the registration entry per design) and entries whose doc was pinned to the bank transaction before matching were falsely flagged; opening the entry showed the referenced doc and cleared the warning client-side, and it came back on reload. - verifikat_without_documents + transactions_without_documents now treat an entry as covered when a supplier invoice referencing it (registration or payment FK, or a supplier_invoice_payments row) carries a document anchored to a journal entry (BFL 5 kap 7 paragraf hänvisning till underlag; anchoring required because the WORM deletion guards key on document_attachments.journal_entry_id) - match-supplier-invoice routes (dashboard + v1) propagate the transaction's pinned document onto the payment verifikat, mirroring the categorize route; migration backfills rows already written (open unlocked periods, company-guarded, never steals a linked doc) - /api/documents/counts, the transactions-page badges, the bulk "Inget underlag krävs" count and the push-notification scheduler share the same reference-aware predicate, so every surface agrees with the RPC - counts route validates journal_entry_ids as UUIDs (they are interpolated into a PostgREST or-filter) Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(transactions): align table columns flush with page edges Collapse the checkbox gutter column to zero width and hang the hover-revealed checkbox/expand chevron in the page margins, drop the outer padding so DATUM sits flush left and STATUS flush right, and tuck the overflow-menu dots under the middle of the STATUS header. Applied to both the inbox and history tables so they stay identical. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(arsredovisning): tie anlaggningstillgangar note to booked depreciation The ARL 5:8 roll-forward note recomputed depreciation from its own day-based linear formula (365.25/12 month length, non-inclusive day count, linear only), drifting ~20 kr per year per asset from the ledger-driven resultat- and balansrakning and misstating non-linear methods entirely. Note figures now come from posted depreciation_schedules rows (the same source disposeAsset reverses), falling back to the engine's computeAnnualDepreciation when nothing is posted; pre-onboarding opening balances iterate prior years through the engine. Adds a note-vs-trial-balance tie-out warning (accounts 1000-1299, over 1 kr) surfaced before download. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * refactor(stripe): move connect and sync surface from settings to import page Stripe's transaction feed is a continuous import source in the same category as the PSD2 bank connection, so its connect/sync surface now lives on the import page as a source card (mode=stripe), gated "kommer snart" on hosted like before; self-hosted keeps the full panel. - Import page: Stripe card after Koppla bank, renders the existing StripeSettingsPanel via the settings-panel registry - OAuth callback and panel cleanup return to /import?mode=stripe - Settings > Betalningar retired: nav item removed, route redirects, PaymentsSettingsContent deleted, legacy ?tab=payments mapped - New import.stripe_* strings in sv+en; dead settings_nav.payments removed Crons and sync logic unchanged; payment-link settings stay in the invoicing section. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(underlag): paginate missing-underlag cron and harden doc-surface queries Resolve PR review findings on bug/invalid-imports: - notification-scheduler: fetchAllRows on all 5 global reads; past 1000 rows the capped reads produced false "saknade underlag" notifications - bulk-missing: LOOKUP_CHUNK 300->150 so the twice-embedded .or() id list stays under the PostgREST URL limit - bulk-missing + transactions page: UUID-guard the .or()-interpolated id lists, matching documents/counts - match-supplier-invoice (dashboard + v1): log documentId/journalEntryId on the non-fatal doc-link warning - well-known/oauth-protected-resource: document the tool_namespace allow-list - messages/en: reword stripe_description - DECISIONS.md: record the asset ibAck tie-out and Tailwind !important calls Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com> * fix(tic): convert registrationDate from Unix seconds to millisecond epoch in lookup and profile tests --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
This commit is contained in:
Mattsson
co-authored by
Claude Opus 4.8
Claude Opus 4.8
parent
51ca574ca4
commit
53e343ee92
@@ -0,0 +1,193 @@
|
||||
import { describe, it, expect, vi, beforeEach } from 'vitest'
|
||||
import { parseJsonResponse, createQueuedMockSupabase } from '@/tests/helpers'
|
||||
import { NextResponse } from 'next/server'
|
||||
|
||||
const { supabase: mockSupabase, enqueue, reset } = createQueuedMockSupabase()
|
||||
|
||||
vi.mock('@/lib/auth/require-auth', () => ({ requireAuth: vi.fn() }))
|
||||
vi.mock('@/lib/company/context', () => ({ getActiveCompanyId: vi.fn() }))
|
||||
|
||||
import { GET } from '../route'
|
||||
import { requireAuth } from '@/lib/auth/require-auth'
|
||||
import { getActiveCompanyId } from '@/lib/company/context'
|
||||
|
||||
const mockUser = { id: 'user-1', email: 't@t.se' }
|
||||
|
||||
const JE_A = 'aaaaaaaa-aaaa-4aaa-8aaa-aaaaaaaaaaaa'
|
||||
const JE_B = 'bbbbbbbb-bbbb-4bbb-8bbb-bbbbbbbbbbbb'
|
||||
const JE_C = 'cccccccc-cccc-4ccc-8ccc-cccccccccccc'
|
||||
|
||||
function makeReq(ids: string[]) {
|
||||
return new Request(
|
||||
`http://localhost/api/documents/counts?journal_entry_ids=${ids.join(',')}`,
|
||||
)
|
||||
}
|
||||
|
||||
beforeEach(() => {
|
||||
vi.clearAllMocks()
|
||||
reset()
|
||||
;(requireAuth as ReturnType<typeof vi.fn>).mockResolvedValue({
|
||||
user: mockUser,
|
||||
supabase: mockSupabase,
|
||||
})
|
||||
;(getActiveCompanyId as ReturnType<typeof vi.fn>).mockResolvedValue('company-1')
|
||||
})
|
||||
|
||||
// Queue order mirrors the route's Promise.all: direct docs, supplier_invoices
|
||||
// references, supplier_invoice_payments references. The `document` embed
|
||||
// carries the anchor state (journal_entry_id) of the SI's retained doc.
|
||||
function enqueueAll(opts: {
|
||||
direct?: Array<{ id: string; journal_entry_id: string }>
|
||||
si?: Array<{
|
||||
document_id: string
|
||||
registration_journal_entry_id: string | null
|
||||
payment_journal_entry_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
}>
|
||||
sip?: Array<{
|
||||
journal_entry_id: string
|
||||
supplier_invoice: {
|
||||
document_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
} | null
|
||||
}>
|
||||
}) {
|
||||
enqueue({ data: opts.direct ?? [], error: null })
|
||||
enqueue({ data: opts.si ?? [], error: null })
|
||||
enqueue({ data: opts.sip ?? [], error: null })
|
||||
}
|
||||
|
||||
describe('GET /api/documents/counts', () => {
|
||||
it('returns 401 when not authenticated', async () => {
|
||||
;(requireAuth as ReturnType<typeof vi.fn>).mockResolvedValue({
|
||||
error: NextResponse.json({ error: 'Unauthorized' }, { status: 401 }),
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
expect((await parseJsonResponse(res)).status).toBe(401)
|
||||
})
|
||||
|
||||
it('returns 400 without journal_entry_ids', async () => {
|
||||
const res = await GET(new Request('http://localhost/api/documents/counts'))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('returns 400 for more than 50 ids', async () => {
|
||||
const ids = Array.from({ length: 51 }, (_, i) => `id-${i}`)
|
||||
const res = await GET(makeReq(ids))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('returns 400 for non-UUID ids (they are interpolated into a PostgREST or-filter)', async () => {
|
||||
const res = await GET(makeReq([JE_A, 'registration_journal_entry_id.in.(x)']))
|
||||
expect((await parseJsonResponse(res)).status).toBe(400)
|
||||
})
|
||||
|
||||
it('counts direct attachments per entry', async () => {
|
||||
enqueueAll({
|
||||
direct: [
|
||||
{ id: 'doc-1', journal_entry_id: JE_A },
|
||||
{ id: 'doc-2', journal_entry_id: JE_A },
|
||||
{ id: 'doc-3', journal_entry_id: JE_B },
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B, JE_C]))
|
||||
const { status, body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(status).toBe(200)
|
||||
expect(body.data).toEqual({ [JE_A]: 2, [JE_B]: 1 })
|
||||
})
|
||||
|
||||
it('counts a supplier invoice doc for both referenced entries (registration + payment)', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: JE_B,
|
||||
document: { journal_entry_id: JE_A },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1, [JE_B]: 1 })
|
||||
})
|
||||
|
||||
it('ignores an UNANCHORED supplier invoice doc (outside the WORM deletion guards)', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: JE_B,
|
||||
document: { journal_entry_id: null },
|
||||
},
|
||||
],
|
||||
sip: [
|
||||
{
|
||||
journal_entry_id: JE_C,
|
||||
supplier_invoice: { document_id: 'doc-si', document: { journal_entry_id: null } },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A, JE_B, JE_C]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({})
|
||||
})
|
||||
|
||||
it('counts a partial-payment reference via supplier_invoice_payments', async () => {
|
||||
enqueueAll({
|
||||
sip: [
|
||||
{
|
||||
journal_entry_id: JE_A,
|
||||
supplier_invoice: { document_id: 'doc-si', document: { journal_entry_id: JE_B } },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
})
|
||||
|
||||
it('deduplicates a doc that is both directly linked and referenced', async () => {
|
||||
enqueueAll({
|
||||
direct: [{ id: 'doc-si', journal_entry_id: JE_A }],
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
registration_journal_entry_id: JE_A,
|
||||
payment_journal_entry_id: null,
|
||||
document: { journal_entry_id: JE_A },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
})
|
||||
|
||||
it('never returns entries the caller did not ask about', async () => {
|
||||
enqueueAll({
|
||||
si: [
|
||||
{
|
||||
document_id: 'doc-si',
|
||||
// The SI's other FK points at an entry outside the request.
|
||||
registration_journal_entry_id: JE_C,
|
||||
payment_journal_entry_id: JE_A,
|
||||
document: { journal_entry_id: JE_C },
|
||||
},
|
||||
],
|
||||
})
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
const { body } = await parseJsonResponse<{ data: Record<string, number> }>(res)
|
||||
expect(body.data).toEqual({ [JE_A]: 1 })
|
||||
expect(body.data[JE_C]).toBeUndefined()
|
||||
})
|
||||
|
||||
it('returns 500 when a lookup fails', async () => {
|
||||
enqueue({ data: null, error: { message: 'boom' } })
|
||||
enqueue({ data: [], error: null })
|
||||
enqueue({ data: [], error: null })
|
||||
const res = await GET(makeReq([JE_A]))
|
||||
expect((await parseJsonResponse(res)).status).toBe(500)
|
||||
})
|
||||
})
|
||||
@@ -1,11 +1,28 @@
|
||||
import { NextResponse } from 'next/server'
|
||||
import { z } from 'zod'
|
||||
import { withRouteContext } from '@/lib/api/with-route-context'
|
||||
import { getErrorMessage as getUserErrorMessage } from '@/lib/errors/get-error-message'
|
||||
|
||||
const uuidSchema = z.string().uuid()
|
||||
|
||||
/**
|
||||
* GET /api/documents/counts?journal_entry_ids=id1,id2,...
|
||||
* Returns attachment counts per journal entry ID.
|
||||
* Max 50 IDs per request.
|
||||
* Returns underlag counts per journal entry ID.
|
||||
* Max 50 IDs per request; every ID must be a UUID (the ids are interpolated
|
||||
* into a PostgREST .or() filter string, so validation doubles as injection
|
||||
* protection).
|
||||
*
|
||||
* Counts BOTH direct attachments (document_attachments.journal_entry_id) and
|
||||
* documents retained on a supplier invoice that references the entry
|
||||
* (registration/payment FK or a supplier_invoice_payments row). BFL 5 kap 7 §
|
||||
* accepts underlag via hänvisning, and the expanded-row view
|
||||
* (JournalEntryAttachments) already lists referenced docs: counting only
|
||||
* direct links here made the list warning disagree with the opened row.
|
||||
* A referenced doc counts only when ANCHORED to a journal entry
|
||||
* (journal_entry_id set): unanchored docs sit outside the WORM deletion
|
||||
* guards, so they must not silence the missing-underlag warning (mirrors the
|
||||
* verifikat_without_documents RPC). Documents are deduplicated per entry so a
|
||||
* doc that is both directly linked and referenced counts once.
|
||||
*/
|
||||
export const GET = withRouteContext('document.counts', async (request, ctx) => {
|
||||
const { supabase, companyId } = ctx
|
||||
@@ -27,23 +44,93 @@ export const GET = withRouteContext('document.counts', async (request, ctx) => {
|
||||
return NextResponse.json({ error: 'Maximum 50 IDs per request' }, { status: 400 })
|
||||
}
|
||||
|
||||
const { data, error } = await supabase
|
||||
.from('document_attachments')
|
||||
.select('journal_entry_id')
|
||||
.eq('company_id', companyId)
|
||||
.eq('is_current_version', true)
|
||||
.in('journal_entry_id', ids)
|
||||
|
||||
if (error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(error) }, { status: 500 })
|
||||
if (ids.some((id) => !uuidSchema.safeParse(id).success)) {
|
||||
return NextResponse.json(
|
||||
{ error: 'journal_entry_ids must be UUIDs' },
|
||||
{ status: 400 },
|
||||
)
|
||||
}
|
||||
|
||||
// Group and count by journal_entry_id
|
||||
const counts: Record<string, number> = {}
|
||||
for (const row of data || []) {
|
||||
if (row.journal_entry_id) {
|
||||
counts[row.journal_entry_id] = (counts[row.journal_entry_id] || 0) + 1
|
||||
const inList = `(${ids.join(',')})`
|
||||
const [directRes, siRes, sipRes] = await Promise.all([
|
||||
supabase
|
||||
.from('document_attachments')
|
||||
.select('id, journal_entry_id')
|
||||
.eq('company_id', companyId)
|
||||
.eq('is_current_version', true)
|
||||
.in('journal_entry_id', ids),
|
||||
supabase
|
||||
.from('supplier_invoices')
|
||||
.select(
|
||||
'document_id, registration_journal_entry_id, payment_journal_entry_id, document:document_attachments(journal_entry_id)',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.not('document_id', 'is', null)
|
||||
.or(
|
||||
`registration_journal_entry_id.in.${inList},payment_journal_entry_id.in.${inList}`,
|
||||
),
|
||||
supabase
|
||||
.from('supplier_invoice_payments')
|
||||
.select(
|
||||
'journal_entry_id, supplier_invoice:supplier_invoices(document_id, document:document_attachments(journal_entry_id))',
|
||||
)
|
||||
.eq('company_id', companyId)
|
||||
.in('journal_entry_id', ids),
|
||||
])
|
||||
|
||||
if (directRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(directRes.error) }, { status: 500 })
|
||||
}
|
||||
if (siRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(siRes.error) }, { status: 500 })
|
||||
}
|
||||
if (sipRes.error) {
|
||||
return NextResponse.json({ error: getUserErrorMessage(sipRes.error) }, { status: 500 })
|
||||
}
|
||||
|
||||
// Distinct doc ids per entry: a supplier invoice's document referenced from
|
||||
// both FK paths, or already directly linked, must not double count.
|
||||
const docsByEntry = new Map<string, Set<string>>()
|
||||
const add = (journalEntryId: string | null | undefined, documentId: string | null | undefined) => {
|
||||
if (!journalEntryId || !documentId) return
|
||||
let set = docsByEntry.get(journalEntryId)
|
||||
if (!set) {
|
||||
set = new Set<string>()
|
||||
docsByEntry.set(journalEntryId, set)
|
||||
}
|
||||
set.add(documentId)
|
||||
}
|
||||
|
||||
for (const row of (directRes.data ?? []) as { id: string; journal_entry_id: string | null }[]) {
|
||||
add(row.journal_entry_id, row.id)
|
||||
}
|
||||
for (const row of (siRes.data ?? []) as unknown as {
|
||||
document_id: string | null
|
||||
registration_journal_entry_id: string | null
|
||||
payment_journal_entry_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
}[]) {
|
||||
if (!row.document?.journal_entry_id) continue // unanchored: not underlag
|
||||
add(row.registration_journal_entry_id, row.document_id)
|
||||
add(row.payment_journal_entry_id, row.document_id)
|
||||
}
|
||||
for (const row of (sipRes.data ?? []) as unknown as {
|
||||
journal_entry_id: string | null
|
||||
supplier_invoice: {
|
||||
document_id: string | null
|
||||
document: { journal_entry_id: string | null } | null
|
||||
} | null
|
||||
}[]) {
|
||||
if (!row.supplier_invoice?.document?.journal_entry_id) continue // unanchored
|
||||
add(row.journal_entry_id, row.supplier_invoice.document_id)
|
||||
}
|
||||
|
||||
// Referenced entries outside the requested set (an SI FK can point at an
|
||||
// entry the caller didn't ask about) must not leak into the response.
|
||||
const requested = new Set(ids)
|
||||
const counts: Record<string, number> = {}
|
||||
for (const [journalEntryId, docIds] of docsByEntry) {
|
||||
if (requested.has(journalEntryId)) counts[journalEntryId] = docIds.size
|
||||
}
|
||||
|
||||
return NextResponse.json({ data: counts })
|
||||
|
||||
Reference in New Issue
Block a user