SEPA-Mandatsauswahlen als Wörterbücher pflegen #183

backend/src/routes/resources/main.ts

@@ -21,6 +21,9 @@ import { decrypt, encrypt } from "../../utils/crypt";
 
 const PORTAL_ALLOWED_RESOURCES = new Set(["customers", "contracts", "createddocuments", "contracttypes"])
 const PORTAL_VISIBLE_DOCUMENT_TYPES = ["invoices", "advanceInvoices", "cancellationInvoices"]
+const OUTGOING_SEPA_MANDATE_STATUSES = new Set(["Entwurf", "Aktiv", "Widerrufen", "Abgelaufen"])
+const OUTGOING_SEPA_MANDATE_TYPES = new Set(["CORE", "B2B"])
+const OUTGOING_SEPA_SEQUENCE_TYPES = new Set(["RCUR", "OOFF", "FRST", "FNAL"])
 
 // -------------------------------------------------------------
 // SQL Suche auf mehreren Feldern (Haupttabelle + Relationen)
@@ -378,6 +381,21 @@ async function validateOutgoingSepaMandatePayload(
         return "Kunde und Bankverbindung sind Pflichtfelder."
     }
 
+    const status = payload.status ?? existing?.status ?? "Entwurf"
+    if (!OUTGOING_SEPA_MANDATE_STATUSES.has(status)) {
+        return "Ungültiger Mandatsstatus."
+    }
+
+    const mandateType = payload.mandateType ?? existing?.mandateType ?? "CORE"
+    if (!OUTGOING_SEPA_MANDATE_TYPES.has(mandateType)) {
+        return "Ungültiger Mandatstyp."
+    }
+
+    const sequenceType = payload.sequenceType ?? existing?.sequenceType ?? "RCUR"
+    if (!OUTGOING_SEPA_SEQUENCE_TYPES.has(sequenceType)) {
+        return "Ungültige Mandatssequenz."
+    }
+
     const [customer] = await server.db
         .select()
         .from(customers)