From 21fb8c66494296c6155afd169daa4e6daf9dffe3 Mon Sep 17 00:00:00 2001
From: root <root@hermes.federspiel.tech>
Date: Tue, 1 Sep 2026 13:17:37 +0000
Subject: [PATCH] Zentralen BIC-Abgleich robust machen

---
 backend/src/modules/banking-institution.ts | 22 ++++++++++++++++++++++
 backend/src/routes/banking.ts              |  3 ++-
 backend/tests/bankingInstitution.test.ts   | 18 ++++++++++++++++++
 3 files changed, 42 insertions(+), 1 deletion(-)
 create mode 100644 backend/src/modules/banking-institution.ts
 create mode 100644 backend/tests/bankingInstitution.test.ts

diff --git a/backend/src/modules/banking-institution.ts b/backend/src/modules/banking-institution.ts
new file mode 100644
index 0000000..1c9de3e
--- /dev/null
+++ b/backend/src/modules/banking-institution.ts
@@ -0,0 +1,22 @@
+export type BankingInstitution = {
+    bic?: unknown
+    [key: string]: unknown
+}
+
+export const findBankInstitutionByBic = (
+    institutions: unknown,
+    bic: string,
+): BankingInstitution | null => {
+    if (!Array.isArray(institutions)) return null
+
+    const normalizedBic = bic.trim().toUpperCase()
+    if (!normalizedBic) return null
+
+    const institution = institutions.find((candidate): candidate is BankingInstitution => {
+        if (!candidate || typeof candidate !== "object") return false
+        const candidateBic = (candidate as BankingInstitution).bic
+        return typeof candidateBic === "string" && candidateBic.trim().toUpperCase() === normalizedBic
+    })
+
+    return institution || null
+}
diff --git a/backend/src/routes/banking.ts b/backend/src/routes/banking.ts
index 95a3d32..d80da56 100644
--- a/backend/src/routes/banking.ts
+++ b/backend/src/routes/banking.ts
@@ -8,6 +8,7 @@ import { decrypt, encrypt } from "../utils/crypt"
 import { DE_BANK_CODE_TO_NAME } from "../utils/deBankCodes"
 import { DE_BANK_CODE_TO_BIC } from "../utils/deBankBics"
 import { centralServicesClient } from "../modules/push-server.client"
+import { findBankInstitutionByBic } from "../modules/banking-institution"
 
 import {
     bankrequisitions,
@@ -1047,7 +1048,7 @@ export default async function bankingRoutes(server: FastifyInstance) {
                 ))
             }
 
-            const bank = data.find((i: any) => i.bic.toLowerCase() === bic.toLowerCase())
+            const bank = findBankInstitutionByBic(data, bic)
 
             if (!bank) return reply.code(404).send("Bank not found")
 
diff --git a/backend/tests/bankingInstitution.test.ts b/backend/tests/bankingInstitution.test.ts
new file mode 100644
index 0000000..8edd3ff
--- /dev/null
+++ b/backend/tests/bankingInstitution.test.ts
@@ -0,0 +1,18 @@
+import test from "node:test"
+import assert from "node:assert/strict"
+
+import { findBankInstitutionByBic } from "../src/modules/banking-institution"
+
+test("finds a banking institution by BIC case-insensitively", () => {
+    const institution = findBankInstitutionByBic([
+        { id: "without-bic" },
+        { id: "slz", bic: "slzode22xxx" },
+    ], " SLZODE22XXX ")
+
+    assert.equal(institution?.id, "slz")
+})
+
+test("ignores institutions without a BIC instead of throwing", () => {
+    assert.equal(findBankInstitutionByBic([{ id: "without-bic" }], "SLZODE22XXX"), null)
+    assert.equal(findBankInstitutionByBic(null, "SLZODE22XXX"), null)
+})
\ No newline at end of file