Jakob Wennberg
16fbcefbbc
* feat(invariants): centralise shared format contracts, reconcile the org-number paths
The same format rules were written out independently across the codebase, and
where they disagreed the disagreement was invisible until a filing failed.
Worst case, now fixed: four Skatteverket- and Bolagsverket-bound export paths
each had their own idea of a valid organisationsnummer.
lib/skatteverket/format.ts strip '-' only threw on any input with a space
lib/salary/ku/ku10-generator.ts replace('-', '') first hyphen only, spaces survived
lib/salary/agi/xml-generator.ts strip non-digits stray letters passed the length check
lib/bokslut/ixbrl/validate /^\d{6}-?\d{4}$/ rejected the 12-digit form, no Luhn
A company stored with a space or in 12-digit form could file AGI all year and
then fail at the arsredovisning deadline with a message that did not say why.
lib/invariants/ now owns account number, ISO date, four-digit fiscal year and
org number, each with the rationale recorded next to the rule. normalizeOrgNumber
moves here from lib/company-lookup/ and isSaneDateString from lib/utils.ts; both
old paths re-export, so no caller changes. lib/api/schemas.ts builds its
primitives on the module, so ~100 schemas inherit any correction.
The arsredovisning check-digit verdict is a warn, not an error: a wrong Luhn
digit is almost certainly a typo worth surfacing, but whether every org number
Bolagsverket accepts satisfies Luhn is a Swedish domain question we have not
verified against a primary source, and an error there blocks Skicka in. We do
not block a statutory filing on an unverified assumption.
KU10 still passes a 12-digit stored org number through unfolded. That is
pre-existing, and whether the KU10 schema wants 10 or 12 digits is not covered
by the swedish-payroll skill, so it is pinned by a test rather than changed
silently.
Guard 8 (hand-rolled-invariant) tracks the remaining 114 inline copies as a
ratchet that may only go down, same mechanism as the roundOre guard.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* test(ci): add an upgrade-path job that applies new migrations against real data
The pg-real job applies all 548 migrations to an EMPTY database. Empty means
zero rows, so a migration that adds a NOT NULL, adds a CHECK, creates a unique
index or backfills passes trivially in CI and can still fail on production,
where the rows exist. CI proved that a fresh install works; nothing proved that
an existing install upgrades.
The new pg-upgrade job: apply the schema as it stands at the merge base, seed a
small real company (three posted verifikat, balanced lines, one ore-level
amount), then apply ONLY the migrations this PR adds, then assert the data
survived (entries still posted, lines intact, ledger still balances, ore
unchanged, voucher numbers sequential). A PR with no migration no-ops.
Verified locally against supabase/postgres:15.8.1.060 rather than assumed, with
three deliberately bad migrations:
rescale money on posted lines empty: would pass seeded: ERROR (immutability trigger)
CHECK violating the ore row empty: exit 0 seeded: exit 3
NOT NULL on a populated column empty: exit 0 seeded: exit 3
Base migrations are read out of the merge-base git tree, not the working tree,
so a PR that edits an already-shipped migration still gets the original applied
and the edit surfaces as a failure here.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs: record the invariants and upgrade-CI decisions
Two entries covering what this PR changes and, more importantly, the calls that
are not obvious from the diff: why the arsredovisning check-digit verdict is a
warning rather than an error, why KU10's 12-digit passthrough is pinned instead
of fixed, and why the ROT/RUT brf org-number schemas stay on their own rule.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
* docs(test): mark the upgrade fixture as CI-only, never a production template
The fixture writes posted journal_entries and their lines directly, bypassing
the engine and the atomic commit RPC. That is the only way to hand a migration
pre-existing posted rows to break, and it is safe against a throwaway CI
database, but it reads like a sanctioned pattern to anyone who finds it later.
Says so explicitly, with the reason it is confined here (no voucher sequence to
keep gapless, no retention obligation on a database destroyed with the job) and
a pointer back to Hard Rule 2 for anything touching a real database.
Raised by the Swedish compliance review bot on #1364.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
---------
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
70 lines
2.8 KiB
TypeScript
70 lines
2.8 KiB
TypeScript
import { parseISO, isValid } from 'date-fns'
|
|
|
|
/**
|
|
* ISO calendar date format (`YYYY-MM-DD`).
|
|
*
|
|
* ## The rule
|
|
*
|
|
* Accounting dates are exchanged and stored as `YYYY-MM-DD`, never as a locale
|
|
* format and never as a timestamp. `lib/utils.ts` `formatDate()` renders this
|
|
* same shape for display, so what a user reads matches what the API accepts.
|
|
*
|
|
* ## Why it is centralised
|
|
*
|
|
* The literal `/^\d{4}-\d{2}-\d{2}$/` appeared at 68 sites outside tests, with
|
|
* at least three different error messages for the same failure ("Expected
|
|
* YYYY-MM-DD", "Expected YYYY-MM-DD date format", "Ogiltigt datumformat
|
|
* (YYYY-MM-DD)"). An API surface that rejects the same input three different
|
|
* ways is three surfaces to a client.
|
|
*
|
|
* ## Two rules, not one
|
|
*
|
|
* - {@link isIsoDateShaped} is a **shape** check. `2026-02-31` passes it.
|
|
* - {@link isSaneDateString} additionally requires the date to exist and to sit
|
|
* in a plausible year range. Use it for anything a human typed.
|
|
*
|
|
* `isSaneDateString` moved here from `lib/utils.ts`, where it was already
|
|
* documented as "the ONE authoritative date rule shared by the client form and
|
|
* the server-side CreateTransactionSchema". `lib/utils.ts` re-exports it so
|
|
* existing imports keep working; this module is now its home because the same
|
|
* rule is needed by consumers that must not import UI helpers.
|
|
*/
|
|
|
|
/** `YYYY-MM-DD` shape. Does not check that the date exists. */
|
|
export const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/
|
|
|
|
/** Canonical validation error message. */
|
|
export const ISO_DATE_MESSAGE = 'Expected YYYY-MM-DD'
|
|
|
|
/** Swedish-facing variant, for surfaces that render errors to end users. */
|
|
export const ISO_DATE_MESSAGE_SV = 'Ogiltigt datumformat (YYYY-MM-DD)'
|
|
|
|
/** Message for the stricter {@link isSaneDateString} rule. */
|
|
export const SANE_DATE_MESSAGE = 'Invalid or out-of-range date (expected YYYY-MM-DD, year 1900-2100)'
|
|
|
|
/** Earliest year accepted for a user-entered date. */
|
|
export const SANE_DATE_MIN_YEAR = 1900
|
|
|
|
/** Latest year accepted for a user-entered date. */
|
|
export const SANE_DATE_MAX_YEAR = 2100
|
|
|
|
/** True when the input has `YYYY-MM-DD` shape. */
|
|
export function isIsoDateShaped(raw: string | null | undefined): boolean {
|
|
return typeof raw === 'string' && ISO_DATE_RE.test(raw)
|
|
}
|
|
|
|
/**
|
|
* Strict ISO date validation for user-entered dates: correct shape, a date that
|
|
* actually exists, and a plausible year.
|
|
*
|
|
* Rejects impossible dates (`2024-13-40`, `2026-02-31`) and absurd years. The
|
|
* year bound exists because a mistyped or misparsed date most often lands far
|
|
* outside it, and an accounting date in year 0202 silently creates a fiscal
|
|
* period nobody can close.
|
|
*/
|
|
export function isSaneDateString(s: string): boolean {
|
|
if (!ISO_DATE_RE.test(s)) return false
|
|
const d = parseISO(s)
|
|
return isValid(d) && d.getFullYear() >= SANE_DATE_MIN_YEAR && d.getFullYear() <= SANE_DATE_MAX_YEAR
|
|
}
|