Allow to delete expenses

I remove the related taxes and attachments, but keep related payments
because i believe it is not likely that deleting a paid expense is what
the user wants.  If the user wants to do so, she can delete the payments
first.

Part of #84

deploy/remove_expense.sql

@@ -0,0 +1,34 @@
+-- Deploy numerus:remove_expense to pg
+-- requires: roles
+-- requires: schema_numerus
+-- requires: expense_tax
+-- requires: expense_attachment
+-- requires: expense
+
+begin;
+
+set search_path to numerus, public;
+
+create or replace function remove_expense(expense_slug uuid) returns void as
+$$
+declare
+	eid integer;
+begin
+	select expense_id into eid from expense where slug = expense_slug;
+	if not found then
+		return;
+	end if;
+
+	delete from expense_tax where expense_id = eid;
+	delete from expense_attachment where expense_id = eid;
+	delete from expense where expense_id = eid;
+end
+$$
+	language plpgsql
+;
+
+revoke execute on function remove_expense(uuid) from public;
+grant execute on function remove_expense(uuid) to invoicer;
+grant execute on function remove_expense(uuid) to admin;
+
+commit;

pkg/expenses.go

@@ -699,3 +699,22 @@ func mustCollectExpenseEntriesVATIN(ctx context.Context, conn *Conn, entries []*
 		where expense_id = any ($1)	
 	`)
 }
+
+func handleRemoveExpense(w http.ResponseWriter, r *http.Request, params httprouter.Params) {
+	slug := params[0].Value
+	if !ValidUuid(slug) {
+		http.NotFound(w, r)
+		return
+	}
+
+	if err := verifyCsrfTokenValid(r); err != nil {
+		http.Error(w, err.Error(), http.StatusForbidden)
+		return
+	}
+
+	conn := getConn(r)
+	conn.MustExec(r.Context(), "select remove_expense($1)", slug)
+
+	company := mustGetCompany(r)
+	htmxRedirect(w, r, companyURI(company, "/expenses"))
+}

pkg/router.go

@@ -66,6 +66,7 @@ func NewRouter(db *Db, demo bool) http.Handler {
 	companyRouter.GET("/expenses/:slug", ServeExpenseForm)
 	companyRouter.POST("/expenses/:slug", HandleEditExpenseAction)
 	companyRouter.PUT("/expenses/:slug", HandleUpdateExpense)
+	companyRouter.DELETE("/expenses/:slug", handleRemoveExpense)
 	companyRouter.PUT("/expenses/:slug/tags", HandleUpdateExpenseTags)
 	companyRouter.GET("/expenses/:slug/tags/edit", ServeEditExpenseTags)
 	companyRouter.GET("/expenses/:slug/download/:filename", ServeExpenseAttachment)

revert/remove_expense.sql

@@ -0,0 +1,7 @@
+-- Revert numerus:remove_expense from pg
+
+begin;
+
+drop function if exists numerus.remove_expense(uuid);
+
+commit;

sqitch.plan

@@ -167,3 +167,4 @@ collection_attachment [roles schema_numerus collection] 2024-08-20T00:34:09Z jor
 attach_to_collection [roles schema_numerus collection collection_attachment] 2024-08-20T00:41:53Z jordi fita mas <jordi@tandem.blog> # Add function to attach files to collections
 remove_collection [roles schema_numerus invoice_collection collection collection_attachment update_invoice_collection_status] 2024-08-20T00:47:27Z jordi fita mas <jordi@tandem.blog> # Add function to remove collections
 edit_invoice [edit_invoice@v2] 2024-08-26T08:18:08Z jordi fita mas <jordi@tandem.blog> # Remove the invoice_status parameter from edit_invoice
+remove_expense [roles schema_numerus expense_tax expense_attachment expense] 2024-09-08T21:42:51Z jordi fita mas <jordi@tandem.blog> # Add function to remove expenses

test/remove_expense.sql

@@ -0,0 +1,112 @@
+-- Test remove_expense
+set client_min_messages to warning;
+create extension if not exists pgtap;
+reset client_min_messages;
+
+begin;
+
+select plan(14);
+
+set search_path to numerus, auth, public;
+
+select has_function('numerus', 'remove_expense', array['uuid']);
+select function_lang_is('numerus', 'remove_expense', array['uuid'], 'plpgsql');
+select function_returns('numerus', 'remove_expense', array['uuid'], 'void');
+select isnt_definer('numerus', 'remove_expense', array['uuid']);
+select volatility_is('numerus', 'remove_expense', array['uuid'], 'volatile');
+
+select function_privs_are('numerus', 'remove_expense', array ['uuid'], 'guest', array []::text[]);
+select function_privs_are('numerus', 'remove_expense', array ['uuid'], 'invoicer', array ['EXECUTE']);
+select function_privs_are('numerus', 'remove_expense', array ['uuid'], 'admin', array ['EXECUTE']);
+select function_privs_are('numerus', 'remove_expense', array ['uuid'], 'authenticator', array []::text[]);
+
+
+set client_min_messages to warning;
+truncate expense_tax;
+truncate expense_attachment;
+truncate expense cascade;
+truncate contact cascade;
+truncate tax cascade;
+truncate tax_class cascade;
+truncate payment_method cascade;
+truncate company cascade;
+reset client_min_messages;
+
+
+set constraints "company_default_payment_method_id_fkey" deferred;
+
+insert into company (company_id, business_name, vatin, trade_name, phone, email, web, address, city, province, postal_code, country_code, currency_code, default_payment_method_id)
+values (1, 'Company 2', 'XX123', '', '555-555-555', 'a@a', '', '', '', '', '', 'ES', 'EUR', 111)
+;
+
+insert into payment_method (payment_method_id, company_id, name, instructions)
+values (111, 1, 'cash', 'cash')
+;
+
+set constraints "company_default_payment_method_id_fkey" immediate;
+
+insert into tax_class (tax_class_id, company_id, name)
+values (11, 1, 'tax')
+;
+
+insert into tax (tax_id, company_id, tax_class_id, name, rate)
+values (3, 1, 11, 'IRPF -15 %', -0.15)
+     , (4, 1, 11, 'IVA 21 %', 0.21)
+;
+
+insert into contact (contact_id, company_id, name)
+values ( 9, 1, 'Customer 1')
+;
+
+insert into expense (expense_id, company_id, slug, invoice_number, contact_id, invoice_date, amount, currency_code, expense_status)
+values (13, 1, '3816f5a2-0275-4a5f-9808-a180cf1e169d', 'INV001', 9, '2011-01-11', 111, 'EUR', 'paid')
+     , (14, 1, '0af59ae8-df8f-44e8-ae76-b7af0d58b93d', 'INV002', 9, '2022-02-22', 222, 'EUR', 'paid')
+     , (15, 1, 'cf548a2a-c7e9-4b0c-8fc2-c86e004f7aad', 'INV003', 9, '2022-02-22', 333, 'EUR', 'partial')
+;
+
+insert into expense_tax (expense_id, tax_id, tax_rate)
+values (14, 4, 0.21)
+     , (14, 3, -0.07)
+     , (15, 4, 0.20)
+;
+
+insert into expense_attachment (expense_id, original_filename, mime_type, content)
+values (14, 'something.txt', 'text/plain', convert_to('Once upon a time…', 'UTF-8'))
+     , (15, 'else.txt', 'text/plain', convert_to('What do i know?', 'UTF-8'))
+;
+
+
+select lives_ok(
+	$$ select remove_expense('3816f5a2-0275-4a5f-9808-a180cf1e169d') $$,
+	'Should be able to remove an expense without taxes nor attachments'
+);
+
+select lives_ok(
+	$$ select remove_expense('0af59ae8-df8f-44e8-ae76-b7af0d58b93d') $$,
+	'Should be able to remove an expense with both taxes and attachments'
+);
+
+select bag_eq(
+	$$ select expense_id, invoice_number from expense $$,
+	$$ values (15, 'INV003')
+	$$,
+	'Should have deleted all given expenses'
+);
+
+select bag_eq(
+	$$ select expense_id, tax_id, tax_rate from expense_tax $$,
+	$$ values (15, 4, 0.20)
+	$$,
+	'Should have deleted all related taxes'
+);
+
+select bag_eq(
+	$$ select expense_id, original_filename from expense_attachment $$,
+	$$ values (15, 'else.txt') $$,
+	'Should have deleted all related attachments'
+);
+
+select *
+from finish();
+
+rollback;

verify/remove_expense.sql

@@ -0,0 +1,7 @@
+-- Verify numerus:remove_expense on pg
+
+begin;
+
+select has_function_privilege('numerus.remove_expense(uuid)', 'execute');
+
+rollback;

web/template/expenses/index.gohtml

@@ -77,6 +77,7 @@
         </thead>
         <tbody>
         {{ with .Expenses }}
+            {{ $confirm := (gettext "Are you sure you wish to delete this expense?") }}
             {{- range $expense := . }}
                 <tr>
                     <td>{{ .InvoicerName }}</td>
@@ -131,6 +132,20 @@
                                         </a>
                                     </li>
                                 {{ end }}
+                                <li role="presentation">
+                                    <form method="POST" action="{{ companyURI "/expenses/"}}{{ .Slug }}"
+                                          data-hx-boost="true"
+                                          data-hx-target="main"
+                                          data-hx-confirm="{{ $confirm }}"
+                                    >
+                                        {{ csrfToken }}
+                                        {{ deleteMethod }}
+                                        <button class="icon">
+                                            <i class="ri-delete-back-2-line"></i>
+                                            {{( pgettext "Remove" "action" )}}
+                                        </button>
+                                    </form>
+                                </li>
                             </ul>
                         </details>
                     </td>