Let invoice senders revoke and resend (#490)

ralyodio · claude · web-flow · commit 806c9e925fc9 · 2026-07-05T03:57:43.000-07:00
Previously only the payer could take an invoice off the table (reject),
and the sender (worker) had no way to pull back an invoice they'd sent —
so a mistaken invoice was stuck until the payer rejected it, with no
clear resend path.

Adds:
- POST /api/gigs/[id]/invoice/[invoiceId]/revoke — sender-only; cancels a
  draft/sent/expired invoice (status='cancelled') and notifies the payer.
  Idempotent for already-cancelled/rejected; refuses paid invoices.
- Gig-page InvoiceButton: a "Revoke invoice" control on the worker's
  active invoices, and a "Resend invoice" button on revoked/rejected ones
  that pre-fills the invoice form from the original (line items, notes,
  PR links, category) so they can fix and send a fresh one.
- Dashboard "Invoices Sent" tab: Revoke on active invoices and a Resend
  hand-off to the gig page.

Resend creates a brand-new invoice via the existing create route, which
already permits it because a cancelled/rejected invoice no longer counts
as an open (draft/sent) one. No migration needed — 'cancelled' is already
an allowed status.

Co-authored-by: Claude Opus 4.8 &lt;noreply@anthropic.com&gt;
diff --git a/src/app/api/gigs/[id]/invoice/[invoiceId]/revoke/route.test.ts b/src/app/api/gigs/[id]/invoice/[invoiceId]/revoke/route.test.ts
@@ -0,0 +1,127 @@
+import { describe, it, expect, vi, beforeEach } from "vitest";
+
+vi.mock("@/lib/auth/get-user", () => ({
+  getAuthContext: vi.fn(),
+}));
+
+vi.mock("@/lib/supabase/service", () => ({
+  createServiceClient: vi.fn(),
+}));
+
+import { POST } from "./route";
+import { getAuthContext } from "@/lib/auth/get-user";
+import { createServiceClient } from "@/lib/supabase/service";
+
+const GIG_ID = "8489a861-0999-4107-afca-2592021ac338";
+const INVOICE_ID = "f53e4a56-3cf7-42f9-9a33-bc1cb770c4f6";
+const POSTER_ID = "4f16c625-c37a-4654-82db-e391067cbb13";
+const WORKER_ID = "666cbaba-c6ea-4756-ad44-d6a5b4248f8f";
+
+const params = { params: Promise.resolve({ id: GIG_ID, invoiceId: INVOICE_ID }) };
+
+function invoiceQuery(invoice: any) {
+  return {
+    select: vi.fn().mockReturnThis(),
+    eq: vi.fn().mockReturnThis(),
+    maybeSingle: vi.fn().mockResolvedValue({ data: invoice, error: null }),
+  };
+}
+
+// Records the row passed to update() so the test can assert on it.
+function updateSpy(onUpdate: (row: any) => void) {
+  return {
+    update: vi.fn((row: any) => {
+      onUpdate(row);
+      return { eq: vi.fn().mockResolvedValue({ error: null }) };
+    }),
+  };
+}
+
+function baseInvoice(status: string) {
+  return {
+    id: INVOICE_ID,
+    gig_id: GIG_ID,
+    worker_id: WORKER_ID,
+    poster_id: POSTER_ID,
+    amount_usd: 125,
+    status,
+    gig: { id: GIG_ID, title: "Build thing" },
+  };
+}
+
+describe("POST /api/gigs/[id]/invoice/[invoiceId]/revoke", () => {
+  beforeEach(() => vi.clearAllMocks());
+
+  it("lets the sender cancel a sent invoice and notifies the payer", async () => {
+    let updatePayload: any = null;
+    let notification: any = null;
+
+    (getAuthContext as any).mockResolvedValue({
+      user: { id: WORKER_ID },
+      supabase: {
+        from: vi.fn(() => ({
+          ...invoiceQuery(baseInvoice("sent")),
+          ...updateSpy((row) => {
+            updatePayload = row;
+          }),
+        })),
+      },
+    });
+    (createServiceClient as any).mockReturnValue({
+      from: vi.fn(() => ({
+        insert: vi.fn((row: any) => {
+          notification = row;
+          return Promise.resolve({ error: null });
+        }),
+      })),
+    });
+
+    const res = await POST({} as any, params);
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual({ invoice_id: INVOICE_ID, status: "cancelled" });
+    expect(updatePayload).toMatchObject({ status: "cancelled" });
+    expect(notification).toMatchObject({
+      user_id: POSTER_ID,
+      title: "Invoice revoked",
+    });
+  });
+
+  it("blocks anyone but the sender from revoking", async () => {
+    (getAuthContext as any).mockResolvedValue({
+      user: { id: POSTER_ID },
+      supabase: { from: vi.fn(() => invoiceQuery(baseInvoice("sent"))) },
+    });
+
+    const res = await POST({} as any, params);
+
+    expect(res.status).toBe(403);
+    const body = await res.json();
+    expect(body.error).toBe("Only the sender can revoke this invoice");
+  });
+
+  it("refuses to revoke a paid invoice", async () => {
+    (getAuthContext as any).mockResolvedValue({
+      user: { id: WORKER_ID },
+      supabase: { from: vi.fn(() => invoiceQuery(baseInvoice("paid"))) },
+    });
+
+    const res = await POST({} as any, params);
+
+    expect(res.status).toBe(409);
+  });
+
+  it("is idempotent when the invoice is already cancelled", async () => {
+    (getAuthContext as any).mockResolvedValue({
+      user: { id: WORKER_ID },
+      supabase: { from: vi.fn(() => invoiceQuery(baseInvoice("cancelled"))) },
+    });
+
+    const res = await POST({} as any, params);
+
+    expect(res.status).toBe(200);
+    const body = await res.json();
+    expect(body.data).toEqual({ invoice_id: INVOICE_ID, status: "cancelled" });
+  });
+});
diff --git a/src/app/api/gigs/[id]/invoice/[invoiceId]/revoke/route.ts b/src/app/api/gigs/[id]/invoice/[invoiceId]/revoke/route.ts
@@ -0,0 +1,103 @@
+import { NextRequest, NextResponse } from "next/server";
+import { getAuthContext } from "@/lib/auth/get-user";
+import { createServiceClient } from "@/lib/supabase/service";
+
+export const dynamic = "force-dynamic";
+
+// POST /api/gigs/[id]/invoice/[invoiceId]/revoke
+// Lets the sender (the worker who billed) take back an invoice they sent before
+// it's paid — e.g. they billed the wrong amount or forgot a PR link. Sets
+// status='cancelled' and notifies the payer. The worker can then send a fresh
+// invoice ("resend"), which the create route already allows because a cancelled
+// invoice no longer counts as an open (draft/sent) one.
+export async function POST(
+  request: NextRequest,
+  { params }: { params: Promise<{ id: string; invoiceId: string }> }
+) {
+  try {
+    const { id: gigId, invoiceId } = await params;
+    const auth = await getAuthContext(request);
+    if (!auth) {
+      return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+    }
+
+    const { user, supabase } = auth;
+    const { data: invoice, error } = await (supabase as any)
+      .from("gig_invoices")
+      .select(
+        `
+          id,
+          gig_id,
+          worker_id,
+          poster_id,
+          amount_usd,
+          status,
+          gig:gigs(id, title)
+        `
+      )
+      .eq("id", invoiceId)
+      .eq("gig_id", gigId)
+      .maybeSingle();
+
+    if (error) {
+      return NextResponse.json({ error: error.message }, { status: 400 });
+    }
+    if (!invoice) {
+      return NextResponse.json({ error: "Invoice not found" }, { status: 404 });
+    }
+    // Only the worker who sent the invoice can revoke it. (The payer's equivalent
+    // is "reject".)
+    if (invoice.worker_id !== user.id) {
+      return NextResponse.json(
+        { error: "Only the sender can revoke this invoice" },
+        { status: 403 }
+      );
+    }
+    if (invoice.status === "paid") {
+      return NextResponse.json(
+        { error: "A paid invoice can't be revoked." },
+        { status: 409 }
+      );
+    }
+    if (invoice.status === "cancelled") {
+      return NextResponse.json({ data: { invoice_id: invoice.id, status: "cancelled" } });
+    }
+    // A payer-rejected invoice is already off the table; treat revoke as a no-op
+    // so the sender can just go straight to resending.
+    if (invoice.status === "rejected") {
+      return NextResponse.json({ data: { invoice_id: invoice.id, status: "rejected" } });
+    }
+
+    const { error: updateError } = await (supabase as any)
+      .from("gig_invoices")
+      .update({
+        status: "cancelled",
+        updated_at: new Date().toISOString(),
+      })
+      .eq("id", invoiceId);
+
+    if (updateError) {
+      return NextResponse.json({ error: updateError.message }, { status: 400 });
+    }
+
+    const gig = Array.isArray(invoice.gig) ? invoice.gig[0] : invoice.gig;
+    const title = gig?.title || "your gig";
+    const serviceSupabase = createServiceClient();
+    await (serviceSupabase.from("notifications") as any).insert({
+      user_id: invoice.poster_id,
+      type: "payment_received",
+      title: "Invoice revoked",
+      body: `The worker revoked their invoice for "${title}". A corrected one may follow.`,
+      data: {
+        gig_id: invoice.gig_id,
+        invoice_id: invoice.id,
+        previous_status: invoice.status,
+      },
+    });
+
+    return NextResponse.json({ data: { invoice_id: invoice.id, status: "cancelled" } });
+  } catch (err) {
+    console.error("[revoke invoice] failed:", err);
+    return NextResponse.json({ error: "Failed to revoke invoice" }, { status: 500 });
+  }
+}
diff --git a/src/app/dashboard/invoices/SentInvoiceActions.tsx b/src/app/dashboard/invoices/SentInvoiceActions.tsx
@@ -0,0 +1,89 @@
+"use client";
+
+import { useState } from "react";
+import { useRouter } from "next/navigation";
+import Link from "next/link";
+import { Button, buttonVariants } from "@/components/ui/button";
+import { Loader2, RefreshCw, Send } from "lucide-react";
+
+type InvoiceStatus =
+  | "draft"
+  | "sent"
+  | "paid"
+  | "cancelled"
+  | "expired"
+  | "rejected";
+
+interface SentInvoiceActionsProps {
+  invoiceId: string;
+  gigId: string;
+  status: InvoiceStatus;
+}
+
+// Sender-side controls on the "Invoices Sent" tab: revoke an invoice you sent
+// before it's paid, or resend a corrected one after it was revoked/rejected.
+// Resend hands off to the gig page, where the invoice form pre-fills from the
+// original (it has the wallet + line-item context this list doesn't).
+export function SentInvoiceActions({ invoiceId, gigId, status }: SentInvoiceActionsProps) {
+  const router = useRouter();
+  const [revoking, setRevoking] = useState(false);
+  const [error, setError] = useState<string | null>(null);
+
+  const canRevoke = status === "sent" || status === "draft" || status === "expired";
+  const canResend = status === "cancelled" || status === "rejected";
+
+  if (!canRevoke && !canResend) return null;
+
+  const revoke = async () => {
+    setRevoking(true);
+    setError(null);
+    try {
+      const res = await fetch(`/api/gigs/${gigId}/invoice/${invoiceId}/revoke`, {
+        method: "POST",
+        headers: { "Content-Type": "application/json" },
+      });
+      const json = await res.json();
+      if (!res.ok) {
+        setError(json.error || "Failed to revoke invoice");
+        return;
+      }
+      router.refresh();
+    } catch {
+      setError("Network error. Try again.");
+    } finally {
+      setRevoking(false);
+    }
+  };
+
+  return (
+    <div className="mt-3 flex flex-wrap items-center gap-2">
+      {canRevoke && (
+        <Button
+          type="button"
+          size="sm"
+          variant="ghost"
+          onClick={revoke}
+          disabled={revoking}
+          className="gap-2 text-destructive hover:bg-destructive/10 hover:text-destructive"
+        >
+          {revoking ? (
+            <Loader2 className="h-4 w-4 animate-spin" />
+          ) : (
+            <RefreshCw className="h-4 w-4" />
+          )}
+          Revoke invoice
+        </Button>
+      )}
+      {canResend && (
+        <Link
+          href={`/gigs/${gigId}`}
+          className={buttonVariants({ size: "sm", variant: "outline", className: "gap-2" })}
+        >
+          <Send className="h-4 w-4" />
+          Resend invoice
+        </Link>
+      )}
+      {error && <p className="text-sm text-destructive">{error}</p>}
+    </div>
+  );
+}
diff --git a/src/app/dashboard/invoices/page.tsx b/src/app/dashboard/invoices/page.tsx
@@ -5,6 +5,7 @@ import { Button } from "@/components/ui/button";
 import { Badge } from "@/components/ui/badge";
 import { InvoicePaymentActions } from "./InvoicePaymentActions";
 import { InvoiceCharges } from "./InvoiceCharges";
+import { SentInvoiceActions } from "./SentInvoiceActions";
 import {
   ArrowLeft,
   ExternalLink,
@@ -416,6 +417,12 @@ export default async function InvoicesDashboardPage({
                       </div>
                     )}
 
+                    {tab === "sent" && inv.status === "cancelled" && (
+                      <div className="mb-3 rounded-lg border border-border bg-muted/30 p-3 text-sm text-muted-foreground">
+                        You revoked this invoice. Resend a corrected one from the gig.
+                      </div>
+                    )}
+
                     <div className="flex items-center justify-between gap-3 text-xs text-muted-foreground">
                       <span>
                         Created {new Date(inv.created_at).toLocaleDateString()}
@@ -453,6 +460,14 @@ export default async function InvoicesDashboardPage({
                         />
                       </div>
                     )}
+
+                    {tab === "sent" && (
+                      <SentInvoiceActions
+                        invoiceId={inv.id}
+                        gigId={inv.gig_id}
+                        status={inv.status}
+                      />
+                    )}
                   </div>
                 );
               })}
diff --git a/src/components/gigs/InvoiceButton.tsx b/src/components/gigs/InvoiceButton.tsx
