Marco
6802636d1d
A validated EU business buyer (Österreich, the one cross-border option this checkout offers) gets the sale zero-rated per §4 Nr. 1b UStG — but only after a live VIES lookup confirms the VAT ID is actually registered right now, never from format-validity alone (real compliance risk otherwise). VIES unreachable fails closed: normal VAT applies, no guessed exemption. - lib/vies.ts: calls the EU's public VIES REST API. - lib/vatExemption.ts: de-grosses item/shipping prices and computes the exempt totals; also picks the actual destination country (shipping override when set, billing otherwise). - api/checkout/validate-vat: on-blur live check for instant feedback; api/checkout/route.ts re-runs the same check server-side at submit as the actual source of truth, and re-prices every line net-of-VAT when exempt. - CheckoutContent.tsx: VIES status + a live exempt-totals preview; BestellbestaetigungContent.tsx mirrors it from the persisted snapshot. Both blur-validate every other checkout field now too (immediate inline errors, not just on submit). - vatExempt/vatIdValidatedAt threaded through orderServer.ts, customerAuth.ts, orderEmail.ts, and both invoice-download routes so the invoice PDF and its e-invoice XML (companion payload-repo commit) reflect the exemption correctly wherever it's rendered. Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
47 lines
2.2 KiB
TypeScript
47 lines
2.2 KiB
TypeScript
// Server-only — calls the European Commission's public VIES REST API to
|
|
// confirm an EU VAT ID is actually registered, not just correctly
|
|
// formatted (see lib/vatId.ts's own comment: format alone is never
|
|
// enough to zero-rate an invoice). Confirmed live and working against
|
|
// the real endpoint 2026-07-23 (POST {countryCode, vatNumber} →
|
|
// {valid: boolean, ...}) — this is the Commission's own documented REST
|
|
// API, not a guess.
|
|
const VIES_URL = "https://ec.europa.eu/taxation_customs/vies/rest-api/check-vat-number";
|
|
|
|
export type ViesCheckResult =
|
|
| { ok: true; valid: boolean; name: string | null; address: string | null }
|
|
| { ok: false; reason: string };
|
|
|
|
// `vatNumber` must NOT include the country prefix (VIES wants it split
|
|
// out) — callers pass the full "DE123456789"-shaped id and this function
|
|
// does the splitting, since every call site already has the normalized
|
|
// full id (see lib/vatId.ts's normalizeVatId()) rather than the two parts
|
|
// separately.
|
|
export async function checkVatIdViaVies(vatId: string): Promise<ViesCheckResult> {
|
|
const countryCode = vatId.slice(0, 2);
|
|
const vatNumber = vatId.slice(2);
|
|
if (!countryCode || !vatNumber) return { ok: false, reason: "Ungültiges USt-IdNr.-Format." };
|
|
|
|
try {
|
|
// 8s timeout — VIES is a shared EU-wide government service with no
|
|
// uptime SLA to this shop; a slow/unreachable response must not hang
|
|
// checkout indefinitely. Callers treat `ok: false` as "couldn't
|
|
// confirm" and fail closed (no exemption), never as "confirmed invalid".
|
|
const res = await fetch(VIES_URL, {
|
|
method: "POST",
|
|
headers: { "Content-Type": "application/json" },
|
|
body: JSON.stringify({ countryCode, vatNumber }),
|
|
signal: AbortSignal.timeout(8000),
|
|
});
|
|
if (!res.ok) return { ok: false, reason: `VIES antwortete mit ${res.status}` };
|
|
const data: { valid?: boolean; name?: string; address?: string } = await res.json();
|
|
return {
|
|
ok: true,
|
|
valid: Boolean(data.valid),
|
|
name: data.name && data.name !== "---" ? data.name : null,
|
|
address: data.address && data.address !== "---" ? data.address : null,
|
|
};
|
|
} catch (err) {
|
|
return { ok: false, reason: err instanceof Error ? err.message : "VIES ist gerade nicht erreichbar." };
|
|
}
|
|
}
|