Issue #1716: a user stuck in Handelsbankens fullmakt step got a raw
provider token back (server_error, invalid_state) and support had nothing
to look at afterwards: the failed pending row is deleted by design, the
callback only logged to console (short retention), and event_log recorded
successes only. Diagnosis of the reported case: the failures were on the
bank's side (the corporate fullmakt requirement); both of the reporter's
companies connected successfully on 2026-08-12 with no code change on our
side in between, and the connections have been active and syncing since.
Changes:
- lib/errors/get-error-message.ts: getBankConnectionErrorMessage() maps
PSD2 callback outcomes (access_denied, server_error,
temporarily_unavailable, session expiry, plus the internal
invalid_state, missing_parameters and invalid_code_format tokens) to
Swedish user messages, appending the raw provider description so the
underlying error is still surfaced.
- callback route: every bank_error redirect and the stored error_message
now carry the mapped Swedish text; bank_error_code, bank_name and
psu_type still flow so the settings page keeps its targeted guidance
(Handelsbanken fullmakt steps included).
- New audit events bank_connection.consent_denied and
bank_connection.finalize_failed are emitted on the two failure paths
and persisted to event_log, so support can answer which attempt failed,
with which provider error, on whose side, even after the row is gone.
Claude-Session: https://claude.ai/code/session_01SyDuePXxUFowaPBKpAv8SF
Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com>
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Jakob Wennberg
64119d30bc