Make invoice file separate field

.github/workflows/ci.yml

@@ -17,6 +17,7 @@ env:
   NODE_ENV: test
   AWS_KEY: ${{ secrets.AWS_KEY }}
   AWS_SECRET: ${{ secrets.AWS_SECRET }}
+  DISABLE_MOCK_UPLOADS: 1
 
 jobs:
   lint:

.github/workflows/e2e.yml

@@ -13,6 +13,16 @@ env:
   API_KEY: dvl-1510egmf4a23d80342403fb599qd
   CI: true
 
+  AWS_KEY: user
+  AWS_SECRET: password
+  AWS_S3_BUCKET: opencollective-e2e
+  AWS_S3_REGION: us-east-1
+  AWS_S3_API_VERSION: latest
+  AWS_S3_ENDPOINT: http://localhost:9000
+  AWS_S3_SSL_ENABLED: false
+  AWS_S3_FORCE_PATH_STYLE: true
+  GRAPHQL_ERROR_DETAILED: true
+  DISABLE_MOCK_UPLOADS: 1
   E2E_TEST: 1
   PGHOST: localhost
   PGUSER: opencollective
@@ -30,8 +40,6 @@ env:
   TERM: xterm
   STRIPE_WEBHOOK_KEY: ${{ secrets.STRIPE_WEBHOOK_KEY }}
   STRIPE_WEBHOOK_SIGNING_SECRET: ${{ secrets.STRIPE_WEBHOOK_SIGNING_SECRET }}
-  AWS_KEY: ${{ secrets.AWS_KEY }}
-  AWS_SECRET: ${{ secrets.AWS_SECRET }}
 
 jobs:
   e2e:
@@ -58,6 +66,14 @@ jobs:
           - 5432:5432
         # needed because the postgres container does not provide a healthcheck
         options: --health-cmd pg_isready --health-interval 10s --health-timeout 5s --health-retries 5
+      minio:
+        image: minio/minio:edge-cicd
+        ports:
+          - 9000:9000
+        options: --name=minio --health-cmd "curl http://localhost:9000/minio/health/live"
+        env:
+          MINIO_ROOT_USER: user
+          MINIO_ROOT_PASSWORD: password
 
     steps:
       # man-db trigger on apt install is taking some time
@@ -82,6 +98,13 @@ jobs:
           wget /~https://github.com/stripe/stripe-cli/releases/download/v1.13.9/stripe_1.13.9_linux_x86_64.tar.gz -O /tmp/stripe_1.13.9_linux_x86_64.tar.gz
           sudo tar xzvf /tmp/stripe_1.13.9_linux_x86_64.tar.gz -C /bin/
 
+      - name: Setup minio bucket
+        run: |
+          wget https://dl.min.io/client/mc/release/linux-amd64/mc
+          chmod +x ./mc
+          ./mc alias set minio http://127.0.0.1:9000 user password
+          ./mc mb --ignore-existing minio/opencollective-e2e
+
       - name: Checkout
         uses: actions/checkout@v4
 

migrations/20250219090540-add-invoiceFile-to-expense.js

@@ -0,0 +1,27 @@
+'use strict';
+
+/** @type {import('sequelize-cli').Migration} */
+module.exports = {
+  async up(queryInterface, Sequelize) {
+    await queryInterface.addColumn('Expenses', 'InvoiceFileId', {
+      type: Sequelize.INTEGER,
+      allowNull: true,
+      references: {
+        model: 'UploadedFiles',
+        key: 'id',
+      },
+      onDelete: 'SET NULL',
+      onUpdate: 'CASCADE',
+    });
+
+    await queryInterface.addColumn('ExpenseHistories', 'InvoiceFileId', {
+      type: Sequelize.INTEGER,
+      allowNull: true,
+    });
+  },
+
+  async down(queryInterface) {
+    await queryInterface.removeColumn('ExpenseHistories', 'InvoiceFileId');
+    await queryInterface.removeColumn('Expenses', 'InvoiceFileId');
+  },
+};

server/constants/file-kind.ts

@@ -16,6 +16,7 @@ export const SUPPORTED_FILE_KINDS = [
   'TIER_LONG_DESCRIPTION',
   'ACCOUNT_CUSTOM_EMAIL',
   'AGREEMENT_ATTACHMENT',
+  'EXPENSE_INVOICE',
 ] as const;
 
 export type FileKind = (typeof SUPPORTED_FILE_KINDS)[number];

server/graphql/common/expenses.ts

@@ -1551,6 +1551,7 @@ type ExpenseData = {
   payeeLocation?: Location;
   items?: (Record<string, unknown> & { url?: string })[];
   attachedFiles?: (Record<string, unknown> & { url: string })[];
+  invoiceFile?: { url: string };
   collective?: Collective;
   fromCollective?: Collective;
   tags?: string[];
@@ -1676,6 +1677,22 @@ export async function prepareAttachedFiles(req: Request, attachedFiles: ExpenseD
   }));
 }
 
+export async function prepareInvoiceFile(req: Request, invoiceFile: ExpenseData['invoiceFile']): Promise<UploadedFile> {
+  if (!invoiceFile) {
+    return null;
+  }
+
+  if (!UploadedFile.isUploadedFileURL(invoiceFile.url)) {
+    throw new ValidationFailed('Invalid expense invoice file url');
+  }
+
+  if (!(await hasProtectedUrlPermission(req, invoiceFile.url))) {
+    throw new ValidationFailed('Invalid expense invoice file url');
+  }
+
+  return await UploadedFile.getFromURL(invoiceFile.url);
+}
+
 export const prepareExpenseItemInputs = async (
   req: Request,
   expenseCurrency: SupportedCurrency,
@@ -1993,6 +2010,12 @@ export async function createExpense(
   }
 
   const expense = await sequelize.transaction(async t => {
+    let invoiceFileId: number;
+    if (expenseData.type === EXPENSE_TYPE.INVOICE && expenseData.invoiceFile) {
+      const invoiceFile = await prepareInvoiceFile(req, expenseData.invoiceFile);
+      invoiceFileId = invoiceFile.id;
+    }
+
     // Create expense
     const createdExpense = await models.Expense.create(
       {
@@ -2009,6 +2032,7 @@ export async function createExpense(
         legacyPayoutMethod: models.Expense.getLegacyPayoutMethodTypeFromPayoutMethod(payoutMethod),
         amount: models.Expense.computeTotalAmountForExpense(itemsData, taxes),
         AccountingCategoryId: expenseData.accountingCategory?.id,
+        InvoiceFileId: invoiceFileId,
         data,
       },
       { transaction: t },
@@ -2237,7 +2261,10 @@ const isValueChanging = (expense: Expense, expenseData: Partial<ExpenseData>, ke
   const value = expenseData[key];
   if (key === 'accountingCategory') {
     return !isUndefined(value) && (value?.id ?? null) !== expense.AccountingCategoryId;
-  } else {
+  } else if (key === 'invoiceFile') {
+    return !isUndefined(value) && !isEqual(value, expense[key]);
+  }
+  {
     return !isNil(value) && !isEqual(value, expense[key]);
   }
 };
@@ -2335,6 +2362,11 @@ export async function editExpenseDraft(
     (await prepareExpenseItemInputs(req, currency, expenseData.items, { isEditing: true })) || existingExpense.items;
 
   const attachedFiles = await prepareAttachedFiles(req, expenseData.attachedFiles);
+  const invoiceFile =
+    (expenseData.type || existingExpense.type) === EXPENSE_TYPE.INVOICE
+      ? await prepareInvoiceFile(req, expenseData.invoiceFile)
+      : null;
+
   const newExpenseValues = {
     ...pick(expenseData, DRAFT_EXPENSE_FIELDS),
     amount: models.Expense.computeTotalAmountForExpense(items, expenseData.tax),
@@ -2344,6 +2376,7 @@ export async function editExpenseDraft(
       items,
       taxes: expenseData.tax,
       attachedFiles: attachedFiles,
+      invoiceFile: invoiceFile ? { url: invoiceFile.getDataValue('url') } : null,
     },
   };
 
@@ -2692,6 +2725,22 @@ export async function editExpense(
       );
     }
 
+    if (!isUndefined(expenseData.invoiceFile) && (expenseData.type || expense.type) === EXPENSE_TYPE.INVOICE) {
+      const newInvoiceUploadedFile = expenseData.invoiceFile
+        ? await prepareInvoiceFile(req, expenseData.invoiceFile)
+        : null;
+
+      if (expense.InvoiceFileId && (!newInvoiceUploadedFile || expense.InvoiceFileId !== newInvoiceUploadedFile.id)) {
+        const oldInvoiceUploadedFile = await UploadedFile.findByPk(expense.InvoiceFileId, { transaction });
+        await oldInvoiceUploadedFile.destroy({ transaction });
+        cleanExpenseData['InvoiceFileId'] = null;
+      }
+
+      if (newInvoiceUploadedFile) {
+        cleanExpenseData['InvoiceFileId'] = newInvoiceUploadedFile.id;
+      }
+    }
+
     let status = expense.status;
     if (status === 'INCOMPLETE') {
       // When dealing with expenses marked as INCOMPLETE, only return to PENDING if the expense change requires Collective review

server/graphql/common/uploaded-file.ts

@@ -48,8 +48,9 @@ export async function hasUploadedFilePermission(
     const attachedFileMatches = ((expense.data?.attachedFiles as { url?: string }[]) || []).some(
       item => item.url && item.url === actualUrl,
     );
+    const invoiceFileMatches = (expense.data?.invoiceFile as { url: string })?.url === actualUrl;
 
-    const fileIsInDraft = itemMatches || attachedFileMatches;
+    const fileIsInDraft = itemMatches || attachedFileMatches || invoiceFileMatches;
 
     if (fileIsInDraft && (await canSeeExpenseDraftPrivateDetails(req, expense))) {
       return true;
@@ -84,6 +85,23 @@ export async function hasUploadedFilePermission(
       }
       break;
     }
+    case 'EXPENSE_INVOICE': {
+      const expense = await Expense.findOne({
+        where: {
+          InvoiceFileId: uploadedFile.id,
+        },
+        include: [{ association: 'fromCollective' }],
+      });
+
+      if (!expense) {
+        return req.remoteUser?.id === uploadedFile.CreatedByUserId;
+      }
+
+      if (await canSeeExpenseAttachments(req, expense)) {
+        return true;
+      }
+      break;
+    }
     case 'EXPENSE_ATTACHED_FILE': {
       const expenseAttachedFile = await ExpenseAttachedFile.findOne({
         where: {

server/graphql/schemaV2.graphql

@@ -2484,6 +2484,11 @@
   (Optional) files attached to the expense
   """
   attachedFiles: [ExpenseAttachedFile!]
+
+  """
+  (Optional - applicable to invoice expense only) The invoice file for this expense
+  """
+  invoiceFile: FileInfo
   items: [ExpenseItem]
 
   """
@@ -22005,6 +22010,11 @@
   """
   attachedFiles: [ExpenseAttachedFileInput!]
 
+  """
+  (Optional - applicable to invoice expense only) The invoice file for this expense
+  """
+  invoiceFile: ExpenseAttachedFileInput
+
   """
   Account to reimburse
   """
@@ -22210,6 +22220,11 @@
   """
   attachedFiles: [ExpenseAttachedFileInput!]
 
+  """
+  (Optional - applicable to invoice expense only) The invoice file for this expense
+  """
+  invoiceFile: ExpenseAttachedFileInput
+
   """
   Account to reimburse
   """
@@ -22489,6 +22504,11 @@
   """
   attachedFiles: [JSON]
 
+  """
+  (Optional - applicable to invoice expense only) The invoice file for this expense
+  """
+  invoiceFile: JSON
+
   """
   Account to reimburse
   """
@@ -23468,6 +23488,7 @@
   TIER_LONG_DESCRIPTION
   ACCOUNT_CUSTOM_EMAIL
   AGREEMENT_ATTACHMENT
+  EXPENSE_INVOICE
 }
 
 """

server/graphql/v2/input/ExpenseCreateInput.ts

@@ -60,6 +60,10 @@ export const getExpenseCreateInputFields = (): GraphQLInputFieldConfigMap => ({
     type: new GraphQLList(new GraphQLNonNull(GraphQLExpenseAttachedFileInput)),
     description: '(Optional) A list of files that you want to attach to this expense',
   },
+  invoiceFile: {
+    type: GraphQLExpenseAttachedFileInput,
+    description: '(Optional - applicable to invoice expense only) The invoice file for this expense',
+  },
   payee: {
     type: new GraphQLNonNull(GraphQLAccountReferenceInput),
     description: 'Account to reimburse',

server/graphql/v2/input/ExpenseInviteDraftInput.ts

@@ -68,5 +68,9 @@ export const GraphQLExpenseInviteDraftInput = new GraphQLInputObjectType({
       type: new GraphQLList(GraphQLJSON),
       description: '(Optional) A list of files that you want to attach to this expense',
     },
+    invoiceFile: {
+      type: GraphQLJSON,
+      description: '(Optional - applicable to invoice expense only) The invoice file for this expense',
+    },
   }),
 });

server/graphql/v2/input/ExpenseUpdateInput.ts

@@ -71,6 +71,10 @@ export const GraphQLExpenseUpdateInput = new GraphQLInputObjectType({
       type: new GraphQLList(new GraphQLNonNull(GraphQLExpenseAttachedFileInput)),
       description: '(Optional) A list of files that you want to attach to this expense',
     },
+    invoiceFile: {
+      type: GraphQLExpenseAttachedFileInput,
+      description: '(Optional - applicable to invoice expense only) The invoice file for this expense',
+    },
     payee: {
       type: GraphQLNewAccountOrReferenceInput,
       description: 'Account to reimburse',

server/graphql/v2/mutation/ExpenseMutations.ts

@@ -38,6 +38,7 @@ import {
   payExpense,
   prepareAttachedFiles,
   prepareExpenseItemInputs,
+  prepareInvoiceFile,
   rejectExpense,
   releaseExpense,
   requestExpenseReApproval,
@@ -127,6 +128,7 @@ const expenseMutations = {
             'type',
             'privateMessage',
             'attachedFiles',
+            'invoiceFile',
             'invoiceInfo',
             'payeeLocation',
             'currency',
@@ -225,6 +227,7 @@ const expenseMutations = {
           id: attachedFile.id && idDecode(attachedFile.id, IDENTIFIER_TYPES.EXPENSE_ATTACHED_FILE),
           url: attachedFile.url,
         })),
+        invoiceFile: expense.invoiceFile,
         fromCollective: requestedPayee,
         accountingCategory: isNil(args.expense.accountingCategory)
           ? args.expense.accountingCategory // This will make sure we pass either `null` (to remove the category) or `undefined` (to keep the existing one)
@@ -539,6 +542,7 @@ const expenseMutations = {
       const currency = expenseData.currency || collective.currency;
       const items = await prepareExpenseItemInputs(req, currency, expenseData.items);
       const attachedFiles = await prepareAttachedFiles(req, expenseData.attachedFiles);
+      const invoiceFile = await prepareInvoiceFile(req, expenseData.invoiceFile);
 
       const payee = payeeLegacyId
         ? (await fetchAccountWithReference({ legacyId: payeeLegacyId }, { throwIfMissing: true }))?.minimal
@@ -572,6 +576,11 @@ const expenseMutations = {
         data: {
           items,
           attachedFiles,
+          invoiceFile: invoiceFile
+            ? {
+                url: invoiceFile.getDataValue('url'),
+              }
+            : null,
           payee,
           invitedByCollectiveId: fromCollective.id,
           draftKey,

server/graphql/v2/mutation/UploadedFileMutations.ts

@@ -60,9 +60,11 @@ const uploadedFileMutations = {
       // Limit on `kind` for this first release. If removing this, remember to update the part about `parseDocument`
       // as we don't want to support parsing for all kinds (e.g. Avatars).
       const allKinds = args.files.map(f => f.kind);
-      const unSupportedKinds = difference(allKinds, ['EXPENSE_ITEM', 'EXPENSE_ATTACHED_FILE']);
+      const unSupportedKinds = difference(allKinds, ['EXPENSE_ITEM', 'EXPENSE_ATTACHED_FILE', 'EXPENSE_INVOICE']);
       if (unSupportedKinds.length > 0) {
-        throw new Error(`This mutation only supports the following kinds: EXPENSE_ITEM, EXPENSE_ATTACHED_FILE`);
+        throw new Error(
+          `This mutation only supports the following kinds: EXPENSE_ITEM, EXPENSE_ATTACHED_FILE, EXPENSE_INVOICE`,
+        );
       }
 
       // Since we're only supporting for expense at the moment, we check the expenses scope