K1: card purchases on the server (schema 4, Enable Banking adapter, E-36 to E-44)

Contract (SPEC §14.8): migration 0004_card_purchases.sql (server schema 4, byte-identical contract and server copies), E-36 to E-44 in contracts/openapi.yaml with the four new error codes and a 502 response, examples for every card body and error code, the match_card_purchase vectors (17 cases) with their Python reference in tools/contracts-check.py (157 checks), web/src/api/schema.d.ts regenerated; web/src/lib/vectors.test.ts lists match_card_purchase as not ported until K3 ports it (orchestrator's allowance). Server: src/cards/ with the provider registry (CP-1), the CardSource trait and its Enable Banking adapter (JWT RS256 kid = application id, /aspsps, /auth, /sessions, transactions with PSU headers for user-present fetches, CP-14 error mapping, CP-7 mapping), the windowed fetch (30-day windows newest first, split at the 100-row cap down to a day, de-duplication by provider_ref, continuation keys, WRONG_TRANSACTIONS_PERIOD ends the walk), CP-8 matching with the secondary rule, the background poller (06:45, 11:45, 16:45, 21:45, 4 per 24 hours, 2-hour skip, no backlog), the bilingual callback page (E-39), E-36 to E-38 and E-40 to E-44, link clearing in sync push step 7, attempt pruning at 04:00, the card_fetch log line with aggregates only, KVITT_EB_* configuration. Tests against a local stub (tests/cards_api/, 34 tests); the real API is never called. Infra: Pi compose mounts secrets/cards read-only and passes the two application ids; .env.example keys; dev stack stages infra/secrets/cards/; NPM block with the /cards/callback gate line and unlogged location (kvitt.conf and README step 4); README "Card purchases". Pre-commit hook bypassed (--no-verify, orchestrator's decision): the Android fast tests fail in :domain VectorFilesTest (and the full check in :data ExampleRoundTripTest) because they pin the contract's vector and example sets; matchCardPurchase and the card DTOs are K2's by design (contract-first landing; K2 lands next). Server, contracts-check and web gates are green. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01TQd3pEP9UeN2uifbHknQ7B
2026-10-24 16:43:26 +02:00
parent ae73f58079
commit 671c00d0d8
67 changed files with 9515 additions and 47 deletions
@@ -1,6 +1,6 @@
 {
  "status": "ok",
  "server_version": "0.1.0",
-  "schema_version": 3,
+  "schema_version": 4,
  "db_ok": true
 }
@@ -0,0 +1,11 @@
+{
+  "providers": [
+    {
+      "id": "sj_prio_mastercard",
+      "name": "SJ Prio Mastercard",
+      "issuer": "SEB Kort",
+      "image_key": "sj_prio_mastercard",
+      "available": true
+    }
+  ]
+}
@@ -0,0 +1,5 @@
+{
+  "provider_id": "sj_prio_mastercard",
+  "history_days": 30,
+  "client": "android"
+}
@@ -0,0 +1,9 @@
+{
+  "id": "0192c300-0000-7000-8000-000000000001",
+  "provider_id": "sj_prio_mastercard",
+  "status": "pending",
+  "failure": null,
+  "auth_url": "https://bank.example.invalid/authorize?session=example",
+  "expires_at": "2026-10-24T10:15:00.000Z",
+  "connection": null
+}
@@ -0,0 +1,21 @@
+{
+  "id": "0192c300-0000-7000-8000-000000000001",
+  "provider_id": "sj_prio_mastercard",
+  "status": "connected",
+  "failure": null,
+  "auth_url": null,
+  "expires_at": "2026-10-24T10:15:00.000Z",
+  "connection": {
+    "id": "0192c100-0000-7000-8000-000000000001",
+    "provider_id": "sj_prio_mastercard",
+    "status": "active",
+    "history_days": 30,
+    "valid_until": "2027-04-22T10:00:00.000Z",
+    "last_fetch_at": null,
+    "last_fetch_error": null,
+    "fetching": true,
+    "created_at": "2026-10-24T10:00:00.000Z",
+    "updated_at": "2026-10-24T10:00:00.000Z",
+    "card_version": 1
+  }
+}
@@ -0,0 +1,95 @@
+{
+  "since": 0,
+  "next_since": 5,
+  "has_more": false,
+  "server_time": "2026-10-24T12:00:00.000Z",
+  "connections": [
+    {
+      "id": "0192c100-0000-7000-8000-000000000001",
+      "provider_id": "sj_prio_mastercard",
+      "status": "active",
+      "history_days": 30,
+      "valid_until": "2027-04-22T10:00:00.000Z",
+      "last_fetch_at": "2026-10-24T10:00:05.000Z",
+      "last_fetch_error": null,
+      "fetching": false,
+      "created_at": "2026-10-24T10:00:00.000Z",
+      "updated_at": "2026-10-24T10:00:05.000Z",
+      "card_version": 5
+    }
+  ],
+  "purchases": [
+    {
+      "id": "0192c200-0000-7000-8000-000000000001",
+      "connection_id": "0192c100-0000-7000-8000-000000000001",
+      "status": "booked",
+      "direction": "debit",
+      "purchase_date": "2026-10-22",
+      "booking_date": "2026-10-22",
+      "amount_ore": 12900,
+      "original_amount": null,
+      "original_currency": null,
+      "merchant": "Kafé Exempel",
+      "expense_id": null,
+      "ignored": false,
+      "created_at": "2026-10-24T10:00:05.000Z",
+      "updated_at": "2026-10-24T10:00:05.000Z",
+      "deleted_at": null,
+      "card_version": 1
+    },
+    {
+      "id": "0192c200-0000-7000-8000-000000000002",
+      "connection_id": "0192c100-0000-7000-8000-000000000001",
+      "status": "pending",
+      "direction": "debit",
+      "purchase_date": "2026-10-23",
+      "booking_date": null,
+      "amount_ore": 45000,
+      "original_amount": null,
+      "original_currency": null,
+      "merchant": "Bokhandel Exempel",
+      "expense_id": null,
+      "ignored": false,
+      "created_at": "2026-10-24T10:00:05.000Z",
+      "updated_at": "2026-10-24T10:00:05.000Z",
+      "deleted_at": null,
+      "card_version": 2
+    },
+    {
+      "id": "0192c200-0000-7000-8000-000000000003",
+      "connection_id": "0192c100-0000-7000-8000-000000000001",
+      "status": "booked",
+      "direction": "debit",
+      "purchase_date": "2026-10-20",
+      "booking_date": "2026-10-21",
+      "amount_ore": null,
+      "original_amount": "24.90",
+      "original_currency": "EUR",
+      "merchant": "Museum Example",
+      "expense_id": null,
+      "ignored": false,
+      "created_at": "2026-10-24T10:00:05.000Z",
+      "updated_at": "2026-10-24T10:00:05.000Z",
+      "deleted_at": null,
+      "card_version": 3
+    },
+    {
+      "id": "0192c200-0000-7000-8000-000000000004",
+      "connection_id": "0192c100-0000-7000-8000-000000000001",
+      "status": "pending",
+      "direction": "debit",
+      "purchase_date": "1970-01-01",
+      "booking_date": null,
+      "amount_ore": null,
+      "original_amount": null,
+      "original_currency": null,
+      "merchant": "",
+      "expense_id": null,
+      "ignored": false,
+      "created_at": "2026-10-24T10:00:05.000Z",
+      "updated_at": "2026-10-24T10:00:05.000Z",
+      "deleted_at": "2026-10-24T10:00:05.000Z",
+      "card_version": 4
+    }
+  ]
+}
@@ -0,0 +1,3 @@
+{
+  "history_days": 7
+}
@@ -0,0 +1,13 @@
+{
+  "id": "0192c100-0000-7000-8000-000000000001",
+  "provider_id": "sj_prio_mastercard",
+  "status": "active",
+  "history_days": 7,
+  "valid_until": "2027-04-22T10:00:00.000Z",
+  "last_fetch_at": "2026-10-24T10:00:05.000Z",
+  "last_fetch_error": null,
+  "fetching": false,
+  "created_at": "2026-10-24T10:00:00.000Z",
+  "updated_at": "2026-10-24T12:00:00.000Z",
+  "card_version": 6
+}
@@ -0,0 +1,16 @@
+{
+  "connection": {
+    "id": "0192c100-0000-7000-8000-000000000001",
+    "provider_id": "sj_prio_mastercard",
+    "status": "active",
+    "history_days": 30,
+    "valid_until": "2027-04-22T10:00:00.000Z",
+    "last_fetch_at": "2026-10-24T12:00:03.000Z",
+    "last_fetch_error": null,
+    "fetching": false,
+    "created_at": "2026-10-24T10:00:00.000Z",
+    "updated_at": "2026-10-24T12:00:03.000Z",
+    "card_version": 9
+  },
+  "fetched": true
+}
@@ -0,0 +1,13 @@
+{
+  "id": "0192c100-0000-7000-8000-000000000001",
+  "provider_id": "sj_prio_mastercard",
+  "status": "disconnected",
+  "history_days": 30,
+  "valid_until": null,
+  "last_fetch_at": null,
+  "last_fetch_error": null,
+  "fetching": false,
+  "created_at": "2026-10-24T10:00:00.000Z",
+  "updated_at": "2026-10-24T12:30:00.000Z",
+  "card_version": 12
+}
@@ -0,0 +1,4 @@
+{
+  "expense_id": "0192e000-0000-7000-8000-000000000001",
+  "ignored": false
+}
@@ -0,0 +1,18 @@
+{
+  "id": "0192c200-0000-7000-8000-000000000001",
+  "connection_id": "0192c100-0000-7000-8000-000000000001",
+  "status": "booked",
+  "direction": "debit",
+  "purchase_date": "2026-10-22",
+  "booking_date": "2026-10-22",
+  "amount_ore": 12900,
+  "original_amount": null,
+  "original_currency": null,
+  "merchant": "Kafé Exempel",
+  "expense_id": "0192e000-0000-7000-8000-000000000001",
+  "ignored": false,
+  "created_at": "2026-10-24T10:00:05.000Z",
+  "updated_at": "2026-10-24T12:00:00.000Z",
+  "deleted_at": null,
+  "card_version": 10
+}
@@ -0,0 +1,5 @@
+{
+  "code": "card_bank_unavailable",
+  "message": "the card service or the bank did not answer or refused",
+  "field": null
+}
@@ -0,0 +1,5 @@
+{
+  "code": "card_consent_expired",
+  "message": "the card connection has expired or is disconnected",
+  "field": null
+}
@@ -0,0 +1,5 @@
+{
+  "code": "cards_unavailable",
+  "message": "the server has no card application for this user",
+  "field": null
+}
@@ -0,0 +1,5 @@
+{
+  "code": "expense_already_linked",
+  "message": "the expense is linked from another card purchase",
+  "field": "expense_id"
+}