@flowselections/floriday-authenticatie-module 1.0.13 → 1.0.14

package/dist-lib/lib/floriday.functions.js

@@ -6,6 +6,7 @@
 // ============================================================================
 import { createServerFn } from "@tanstack/react-start";
 import { requireSupabaseAuth } from "../integrations/supabase/auth-middleware";
+import { FLORYDAY_CLOCK_SUPPLY_PERMISSION_MESSAGE, FLORYDAY_CONTRACT_PERMISSION_MESSAGE, FLORYDAY_STANDARD_SCOPE, getFlorydayScopeForPath, isClockSupplyScope, isContractScope, } from "./floriday-scopes";
 /**
  * Valideert een GS1 GLN: exact 13 cijfers met geldige check digit.
  * Retourneert null als geldig, anders een nl-foutmelding.
@@ -37,7 +38,10 @@ const FLORYDAY_ENDPOINTS = {
         apiBaseUrl: "https://api.floriday.io",
     },
 };
-const DEFAULT_SCOPE = "role:app catalog:read catalog:write sales-order:write organization:read supply:read supply:write sales-order:read delivery-conditions:read fulfillment:write fulfillment:read network:read network:write";
+// LET OP: houd scopes centraal in `floriday-scopes.ts`. De standaard token-
+// refresh gebruikt bewust alleen basisrechten; module-specifieke rechten zoals
+// Klokaanvoer worden pas aangevraagd voor endpoints die ze nodig hebben.
+const DEFAULT_SCOPE = FLORYDAY_STANDARD_SCOPE;
 export const SUPPLIERS_API_VERSION = "suppliers-api-2026v1";
 const TOKEN_REFRESH_LEEWAY_S = 300;
 function mask(value, keep = 4) {
@@ -103,14 +107,16 @@ export async function getFlorydayAccessToken(supabase, env, options = {}) {
     const row = await getActiveFlorydayCredentials(supabase, env);
     if (!row)
         throw new Error(`Geen actieve Floriday-koppeling voor ${env}`);
+    const requestedScope = options.scope ?? DEFAULT_SCOPE;
+    const canReuseStoredToken = requestedScope === DEFAULT_SCOPE;
     const now = Date.now();
     const expiresAt = row.token_expires_at ? Date.parse(row.token_expires_at) : 0;
-    if (!options.forceRefresh && row.access_token && expiresAt - TOKEN_REFRESH_LEEWAY_S * 1000 > now) {
+    if (canReuseStoredToken && !options.forceRefresh && row.access_token && expiresAt - TOKEN_REFRESH_LEEWAY_S * 1000 > now) {
         return row.access_token;
     }
     // Concurrency-guard: vlak voor de tokenrequest opnieuw lezen — een parallelle worker
     // kan zojuist een fresh token hebben geschreven en dan hoeven we niet nóg eens te refreshen.
-    if (!options.forceRefresh) {
+    if (canReuseStoredToken && !options.forceRefresh) {
         const { data: fresh } = await supabase
             .from("floriday_connections")
             .select("access_token, token_expires_at")
@@ -134,19 +140,21 @@ export async function getFlorydayAccessToken(supabase, env, options = {}) {
                 grant_type: "client_credentials",
                 client_id: deepSanitizeCredential(row.client_id),
                 client_secret: deepSanitizeCredential(row.client_secret),
-                scope: DEFAULT_SCOPE,
+                scope: requestedScope,
             }).toString(),
         });
         const text = await tokenRes.text();
         if (!tokenRes.ok) {
-            throw new Error(`Floriday token-aanvraag mislukt [${tokenRes.status}]: ${text.slice(0, 300)}`);
+            throw createFlorydayTokenError(tokenRes.status, text, requestedScope);
         }
         json = JSON.parse(text);
         newExpiresAt = new Date(now + json.expires_in * 1000).toISOString();
-        await supabase
-            .from("floriday_connections")
-            .update({ access_token: json.access_token, token_expires_at: newExpiresAt })
-            .eq("id", row.id);
+        if (canReuseStoredToken) {
+            await supabase
+                .from("floriday_connections")
+                .update({ access_token: json.access_token, token_expires_at: newExpiresAt })
+                .eq("id", row.id);
+        }
         // Best-effort logging (faalt nooit hard).
         await supabase.from("floriday_token_refresh_log").insert({
             connection_id: row.id,
@@ -166,6 +174,19 @@ export async function getFlorydayAccessToken(supabase, env, options = {}) {
     }
     return json.access_token;
 }
+function createFlorydayTokenError(status, body, scope) {
+    const normalized = body.toLowerCase();
+    const policyDenied = normalized.includes("access_denied") || normalized.includes("policy evaluation failed");
+    if (status === 401 && policyDenied) {
+        if (isClockSupplyScope(scope)) {
+            return new Error(FLORYDAY_CLOCK_SUPPLY_PERMISSION_MESSAGE);
+        }
+        if (isContractScope(scope)) {
+            return new Error(FLORYDAY_CONTRACT_PERMISSION_MESSAGE);
+        }
+    }
+    return new Error(`Floriday token-aanvraag mislukt [${status}]: ${body.slice(0, 300)}`);
+}
 async function fetchAndStoreFlorydayOrganizationName(supabase, env, connectionId) {
     try {
         // Stap 1: bepaal de eigen organizationId via trade-settings.
@@ -249,18 +270,33 @@ export async function florydayFetch(supabase, pathOrEnv, pathOrInit, maybeInit =
             headers.set("Accept", "application/json");
         return fetch(url, { ...init, headers });
     };
-    let token = await getFlorydayAccessToken(supabase, env);
+    const tokenScope = getFlorydayScopeForPath(path, init.method ?? "GET");
+    let token = await getFlorydayAccessToken(supabase, env, { scope: tokenScope });
     let res = await doFetch(token);
     // Auto-retry op 401/403 met een force-refreshed token. Dit is het vangnet
     // voor het geval de cron faalt of een race-condition ons toch een verlopen
     // token gaf. Body wordt niet gelezen vóór de retry — als de caller .json()
     // doet werkt dat normaal op het nieuwe Response object.
     if (res.status === 401 || res.status === 403) {
-        token = await getFlorydayAccessToken(supabase, env, { forceRefresh: true });
+        token = await getFlorydayAccessToken(supabase, env, { forceRefresh: true, scope: tokenScope });
         res = await doFetch(token);
         if (res.status === 401 || res.status === 403) {
             const body = await res.clone().text().catch(() => "");
-            throw new Error(`Floriday API ${res.status} na force-refresh — controleer client_id/client_secret op /floriday-connection. Body: ${body.slice(0, 200)}`);
+            // Scope-specifieke meldingen alleen bij 401 (= token/scope-probleem).
+            // Bij een persistente 403 ná token-refresh is het bijna altijd een
+            // verkeerd pad of een rechten-issue op de resource zelf; dan willen
+            // we de Floriday-response één-op-één laten zien, niet een misleidende
+            // "controleer rechten"-tekst.
+            if (res.status === 401) {
+                if (isClockSupplyScope(tokenScope)) {
+                    throw new Error(FLORYDAY_CLOCK_SUPPLY_PERMISSION_MESSAGE);
+                }
+                if (isContractScope(tokenScope)) {
+                    throw new Error(FLORYDAY_CONTRACT_PERMISSION_MESSAGE);
+                }
+                throw new Error(`Floriday API 401 na vernieuwen van de verbinding. Body: ${body.slice(0, 300)}`);
+            }
+            throw new Error(`Floriday weigert ${(init.method ?? "GET").toUpperCase()} ${path} (403 Forbidden). Body: ${body.slice(0, 300)}`);
         }
     }
     return res;
@@ -370,6 +406,24 @@ export const upsertFlorydayConnection = createServerFn({ method: "POST" })
             "sales-orders",
             "customer-organizations",
             "carriers",
+            "fulfillment-orders",
+            "customer-stickers",
+            "warehouses",
+            "packings",
+            "delivery-locations",
+            "clock-supplies",
+            "delivery-orders",
+            "clock-presales",
+            "contracts",
+            "blanket-orders",
+            "additional-services",
+            "commercial-service-types",
+            "collections",
+            "price-groups",
+            "delivery-condition-sets",
+            "sales-strategies",
+            "base-items",
+            "contract-trade-item-groups",
         ];
         for (const r of resources) {
             try {
@@ -379,6 +433,14 @@ export const upsertFlorydayConnection = createServerFn({ method: "POST" })
                 console.error(`[floriday] auto-schedule ${r} cron failed:`, e);
             }
         }
+        // Plan ook de dagelijkse referentiedata-refresh (schema + code-lijsten)
+        try {
+            const { scheduleFlorydayReferenceDataRefreshInternal } = await import("./floriday-sync.functions");
+            await scheduleFlorydayReferenceDataRefreshInternal(context.supabase);
+        }
+        catch (e) {
+            console.error("[floriday] auto-schedule reference-data cron failed:", e);
+        }
     }
     catch (e) {
         console.error("[floriday] auto-schedule resource crons failed:", e);
@@ -456,6 +518,27 @@ const MANAGED_FLORYDAY_CRON_JOB_NAMES = new Set([
     "floriday-salesorders-sync-5min",
     "floriday-customer-organizations-sync-twice-daily",
     "floriday-carriers-sync-twice-daily",
+    "floriday-fulfillment-orders-sync-5min",
+    "floriday-customer-stickers-sync-5min",
+    "floriday-warehouses-sync-twice-daily",
+    "floriday-packings-sync-daily",
+    "floriday-delivery-locations-sync-twice-daily",
+    "floriday-clock-supplies-sync-5min",
+    "floriday-delivery-orders-sync-5min",
+    "floriday-clock-presales-sync-5min",
+    "floriday-contracts-sync-hourly",
+    "floriday-blanket-orders-sync-15min",
+    // Stamdata
+    "floriday-additional-services-sync-hourly",
+    "floriday-commercial-service-types-sync-hourly",
+    "floriday-collections-sync-hourly",
+    "floriday-price-groups-sync-hourly",
+    "floriday-delivery-condition-sets-sync-hourly",
+    "floriday-sales-strategies-sync-hourly",
+    "floriday-base-items-sync-hourly",
+    "floriday-contract-trade-item-groups-sync-hourly",
+    // Referentiedata (schema + code-lijsten)
+    "floriday-reference-data-refresh-daily",
 ]);
 export function resolveFlorydayCronBaseUrl() {
     const custom = process.env.FLORIDAY_CRON_BASE_URL?.trim();
@@ -651,8 +734,13 @@ export async function syncFloridayEntityBySequence(supabase, env, connectionId,
         while (cursor < maxSeq && safety < 1000) {
             safety++;
             const batch = await fetchBySequence(supabase, env, opts.bySequenceEndpointBase, cursor);
-            if (batch.length === 0)
+            if (batch.length === 0) {
+                // Floriday-richtlijn: bij een lege batch zijn er geen nieuwe wijzigingen
+                // tot het huidige max-sequence-punt. Cursor doorzetten zodat we niet
+                // elke run dezelfde lege call doen.
+                cursor = maxSeq;
                 break;
+            }
             const highest = batch.reduce((m, item) => {
                 const s = Number(item?.sequenceNumber ?? item?.sequence_number ?? 0);
                 return s > m ? s : m;
@@ -662,16 +750,22 @@ export async function syncFloridayEntityBySequence(supabase, env, connectionId,
             if (highest <= cursor)
                 break;
             cursor = highest;
-            if (batch.length < SEQUENCE_BATCH_CAP)
+            if (batch.length < SEQUENCE_BATCH_CAP) {
+                // Kleine batch ⇒ caught up tot maxSeq op moment van eerste call.
+                cursor = Math.max(cursor, maxSeq);
                 break;
+            }
         }
+        const nowIso = new Date().toISOString();
         await supabase
             .from("floriday_sync_state")
             .upsert({
             connection_id: connectionId,
             entity_type: opts.entityType,
             last_sequence_number: cursor,
-            last_synced_at: new Date().toISOString(),
+            last_synced_at: nowIso,
+            last_success_at: nowIso,
+            last_items_processed: totalSynced,
             last_error: null,
         });
         return {
@@ -695,36 +789,32 @@ export async function syncFloridayEntityBySequence(supabase, env, connectionId,
     }
 }
 // ─── Connections sync (productie) ───────────────────────────────────────────
-// In-memory cache voor organisatienamen — TTL 24u, per Worker-instance.
-// Voorkomt dat we voor elke connection-sync opnieuw /organizations/{id} aanroepen.
-const ORG_NAME_TTL_MS = 24 * 60 * 60 * 1000;
-const orgNameCache = new Map();
-async function fetchBuyerOrganizationName(supabase, env, orgId) {
-    const key = `${env}:${orgId}`;
-    const hit = orgNameCache.get(key);
-    if (hit && Date.now() - hit.at < ORG_NAME_TTL_MS)
-        return hit.name;
-    try {
-        const res = await florydayFetch(supabase, env, `/${SUPPLIERS_API_VERSION}/organizations/${orgId}`, { cache: "no-store" });
-        if (!res.ok) {
-            const body = await res.text().catch(() => "");
-            console.error(`[floriday] organizations/${orgId} failed [${res.status}]: ${body.slice(0, 200)}`);
-            orgNameCache.set(key, { name: null, at: Date.now() });
-            return null;
+//
+// Floriday-richtlijn: gebruik altijd sequence-endpoints en vermijd per-id
+// `GET /organizations/{id}` aanroepen. De klantnaam wordt daarom lokaal
+// opgehaald uit `floriday_customers_cache`, die wordt gevuld door de eigen
+// `customer-organizations` sync via `/organizations/sync` (CUSTOMER-filter).
+async function lookupBuyerOrganizationNames(supabase, ids) {
+    const map = new Map();
+    if (ids.length === 0)
+        return map;
+    // .in() heeft een PostgREST-limiet; batch in stukken van 200.
+    const CHUNK = 200;
+    for (let i = 0; i < ids.length; i += CHUNK) {
+        const slice = ids.slice(i, i + CHUNK);
+        const { data, error } = await supabase
+            .from("floriday_customers_cache")
+            .select("organization_id, name")
+            .in("organization_id", slice);
+        if (error) {
+            console.error(`[floriday] customers-cache lookup faalde voor ${slice.length} ids: ${error.message}`);
+            continue;
         }
-        const json = await res.json().catch(() => null);
-        const name = json?.name ?? json?.commercialName ?? json?.organizationName ?? null;
-        if (!name) {
-            console.error(`[floriday] organizations/${orgId} OK but no name field; keys=${Object.keys(json ?? {}).join(",")}`);
+        for (const row of (data ?? [])) {
+            map.set(row.organization_id, row.name ?? null);
         }
-        orgNameCache.set(key, { name, at: Date.now() });
-        return name;
-    }
-    catch (e) {
-        console.error(`[floriday] organizations/${orgId} threw: ${e?.message ?? e}`);
-        orgNameCache.set(key, { name: null, at: Date.now() });
-        return null;
     }
+    return map;
 }
 export async function runFloridayConnectionsSync(supabase, env) {
     const row = await getActiveFlorydayCredentials(supabase, env);
@@ -754,15 +844,9 @@ export async function runFloridayConnectionsSync(supabase, env) {
                 .filter(Boolean);
             if (baseRows.length === 0)
                 return;
-            // Verzamel unieke buyer_organization_ids en haal namen op (parallel, max 5 tegelijk).
+            // Naam-enrichment uit lokale customers-cache (geen externe API-call).
             const uniqueIds = Array.from(new Set(baseRows.map((r) => r.buyer_organization_id)));
-            const nameMap = new Map();
-            const CONCURRENCY = 5;
-            for (let i = 0; i < uniqueIds.length; i += CONCURRENCY) {
-                const slice = uniqueIds.slice(i, i + CONCURRENCY);
-                const results = await Promise.all(slice.map((id) => fetchBuyerOrganizationName(supabase, env, id)));
-                slice.forEach((id, idx) => nameMap.set(id, results[idx] ?? null));
-            }
+            const nameMap = await lookupBuyerOrganizationNames(supabase, uniqueIds);
             const rows = baseRows.map((r) => ({
                 ...r,
                 buyer_organization_name: nameMap.get(r.buyer_organization_id) ?? null,
@@ -814,18 +898,38 @@ export const getFlorydaySyncStatus = createServerFn({ method: "POST" })
         "sales-orders": "floriday_salesorders_cache",
         "customer-organizations": "floriday_customers_cache",
         "carriers": "floriday_carriers_cache",
+        "fulfillment-orders": "floriday_fulfillment_orders_cache",
+        "customer-stickers": "floriday_customer_stickers_cache",
+        "warehouses": "floriday_warehouses_cache",
+        "packings": "floriday_packings_cache",
+        "delivery-locations": "floriday_delivery_locations_cache",
+        "clock-supplies": "floriday_clock_supplies_cache",
+        "delivery-orders": "floriday_delivery_orders_cache",
+        "clock-presales": "floriday_clock_presales_cache",
+        "contracts": "floriday_contracts_cache",
+        "blanket-orders": "floriday_blanket_orders_cache",
+        "additional-services": "floriday_additional_services_cache",
+        "commercial-service-types": "floriday_commercial_service_types_cache",
+        "collections": "floriday_collections_cache",
+        "price-groups": "floriday_price_groups_cache",
+        "delivery-condition-sets": "floriday_delivery_condition_sets_cache",
+        "sales-strategies": "floriday_sales_strategies_cache",
+        "base-items": "floriday_base_items_cache",
+        "contract-trade-item-groups": "floriday_contract_trade_item_groups_cache",
     };
     const statuses = [];
     for (const s of (states ?? [])) {
-        let cached_count = 0;
         const table = CACHE_TABLE[s.entity_type];
-        if (table) {
-            const { count } = await context.supabase
-                .from(table)
-                .select("connection_id", { count: "exact", head: true })
-                .eq("connection_id", row.id);
-            cached_count = count ?? 0;
-        }
+        // Verberg legacy/onbeheerde entity-types (bv. oude agreements, trips,
+        // invoices, daytrade-offerings) zodat de UI alleen actuele bronnen toont.
+        if (!table)
+            continue;
+        let cached_count = 0;
+        const { count } = await context.supabase
+            .from(table)
+            .select("connection_id", { count: "exact", head: true })
+            .eq("connection_id", row.id);
+        cached_count = count ?? 0;
         statuses.push({
             entity_type: s.entity_type,
             last_sequence_number: s.last_sequence_number,
@@ -887,3 +991,292 @@ export const reinstallFlorydayCrons = createServerFn({ method: "POST" })
     const conn = await scheduleFlorydayConnectionsSyncInternal(context.supabase);
     return { ok: true, token, connections: conn };
 });
+async function hashIdempotencyKey(input) {
+    // Web-Crypto is beschikbaar in de Worker-runtime; geen Node-crypto nodig.
+    const bytes = new TextEncoder().encode(input);
+    const digest = await crypto.subtle.digest("SHA-256", bytes);
+    const hex = Array.from(new Uint8Array(digest))
+        .map((b) => b.toString(16).padStart(2, "0"))
+        .join("");
+    return hex.slice(0, 32);
+}
+/**
+ * Eén centrale schrijfactie naar Floriday voor álle modules.
+ *
+ * - Token-refresh, X-Api-Key en 401-retry komen gratis (via florydayFetch).
+ * - Idempotency-Key wordt automatisch berekend uit (module, action, body)
+ *   als de caller er geen meegeeft — Floriday accepteert deze header voor
+ *   POST/PUT/PATCH/DELETE en geeft op herhaling dezelfde response.
+ * - Iedere poging — geslaagd of niet — landt in `floriday_write_log`.
+ * - Bij duplicate idempotency-key wordt de eerdere log-rij teruggegeven
+ *   zonder Floriday opnieuw aan te roepen.
+ */
+export async function florydayWrite(supabase, env, opts) {
+    const conn = await getActiveFlorydayCredentials(supabase, env);
+    if (!conn) {
+        return {
+            ok: false,
+            status: 0,
+            data: null,
+            attemptId: null,
+            error: `Geen actieve Floriday-koppeling voor ${env}`,
+        };
+    }
+    const idemKey = opts.idempotencyKey ??
+        (await hashIdempotencyKey(`${opts.module}|${opts.action}|${opts.referenceId ?? ""}|${JSON.stringify(opts.body ?? null)}`));
+    // Idempotency-guard: zelfde (connection, module, action, key) al verwerkt?
+    const { data: existing } = await supabase
+        .from("floriday_write_log")
+        .select("id, ok, http_status, response, error")
+        .eq("connection_id", conn.id)
+        .eq("module", opts.module)
+        .eq("action", opts.action)
+        .eq("idempotency_key", idemKey)
+        .maybeSingle();
+    if (existing) {
+        return {
+            ok: Boolean(existing.ok),
+            status: Number(existing.http_status ?? 0),
+            data: existing.response ?? null,
+            attemptId: existing.id ?? null,
+            error: existing.error ?? undefined,
+        };
+    }
+    // Pre-flight enum-validatie tegen lokale code-list-cache. Een ongeldige
+    // waarde wordt direct geblokt + gelogd, zonder Floriday-call.
+    if (opts.validateEnums?.length && opts.body != null) {
+        const violation = await validateBodyEnums(supabase, env, opts.body, opts.validateEnums);
+        if (violation) {
+            const errorMsg = `Veld "${violation.field}" heeft ongeldige waarde "${violation.value}" voor lijst "${violation.listName}". Toegestaan: ${violation.allowed.slice(0, 8).join(", ")}${violation.allowed.length > 8 ? "…" : ""}`;
+            const { data: inserted } = await supabase
+                .from("floriday_write_log")
+                .insert({
+                connection_id: conn.id,
+                module: opts.module,
+                action: opts.action,
+                resource: opts.module,
+                floriday_id: opts.referenceId ?? null,
+                request: opts.body ?? null,
+                response: null,
+                http_status: 0,
+                ok: false,
+                error: errorMsg,
+                idempotency_key: idemKey,
+                caller: opts.caller ?? "self",
+            })
+                .select("id")
+                .maybeSingle();
+            return {
+                ok: false,
+                status: 0,
+                data: null,
+                attemptId: inserted?.id ?? null,
+                error: errorMsg,
+            };
+        }
+    }
+    const headers = {
+        "Content-Type": "application/json",
+        "Idempotency-Key": idemKey,
+    };
+    let status = 0;
+    let parsed = null;
+    let text = "";
+    let ok = false;
+    let errMsg;
+    try {
+        const res = await florydayFetch(supabase, env, opts.path, {
+            method: opts.method,
+            headers,
+            body: opts.body == null ? undefined : JSON.stringify(opts.body),
+        });
+        status = res.status;
+        text = await res.text().catch(() => "");
+        parsed = text ? safeJson(text) : null;
+        ok = res.ok;
+        if (!ok)
+            errMsg = `Floriday ${status}: ${text.slice(0, 300)}`;
+    }
+    catch (e) {
+        errMsg = String(e?.message ?? e);
+    }
+    const { data: inserted } = await supabase
+        .from("floriday_write_log")
+        .insert({
+        connection_id: conn.id,
+        module: opts.module,
+        action: opts.action,
+        resource: opts.module,
+        floriday_id: opts.referenceId ?? null,
+        request: opts.body ?? null,
+        response: parsed,
+        http_status: status,
+        ok,
+        error: errMsg ?? null,
+        idempotency_key: idemKey,
+        caller: opts.caller ?? "self",
+    })
+        .select("id")
+        .maybeSingle();
+    return {
+        ok,
+        status,
+        data: parsed,
+        attemptId: inserted?.id ?? null,
+        error: errMsg,
+    };
+}
+function safeJson(text) {
+    try {
+        return JSON.parse(text);
+    }
+    catch {
+        return text;
+    }
+}
+/**
+ * Loopt door `validateEnums` heen en zoekt de eerste waarde in `body`
+ * die niet voorkomt in de bijbehorende code-lijst. Velden ondersteunen
+ * dot-pad-notatie met `[]` voor arrays, bv. `lines[].salesUnit`.
+ */
+async function validateBodyEnums(supabase, env, body, rules) {
+    const cache = new Map();
+    const loadList = async (listName) => {
+        if (cache.has(listName))
+            return cache.get(listName);
+        const { data: rows } = await supabase
+            .from("floriday_code_lists_cache")
+            .select("code")
+            .eq("environment", env)
+            .eq("list_name", listName);
+        const codes = (rows ?? []).map((r) => r.code);
+        cache.set(listName, codes);
+        return codes;
+    };
+    const resolvePath = (root, path) => {
+        const parts = path.split(".");
+        let current = [root];
+        for (const part of parts) {
+            const isArr = part.endsWith("[]");
+            const key = isArr ? part.slice(0, -2) : part;
+            const next = [];
+            for (const node of current) {
+                if (node == null || typeof node !== "object")
+                    continue;
+                const value = node[key];
+                if (value === undefined || value === null)
+                    continue;
+                if (isArr) {
+                    if (Array.isArray(value))
+                        next.push(...value);
+                }
+                else {
+                    next.push(value);
+                }
+            }
+            current = next;
+        }
+        return current;
+    };
+    for (const rule of rules) {
+        const values = resolvePath(body, rule.field);
+        if (values.length === 0)
+            continue;
+        const allowed = await loadList(rule.listName);
+        if (allowed.length === 0)
+            continue; // cache leeg → laat Floriday valideren
+        for (const v of values) {
+            const str = String(v);
+            if (!allowed.includes(str)) {
+                return { field: rule.field, value: str, listName: rule.listName, allowed };
+            }
+        }
+    }
+    return null;
+}
+// ─── Sync-gezondheid (gap-detectie) ─────────────────────────────────────────
+const SYNC_INTERVAL_MIN = {
+    "connections": 720,
+    "trade-items": 5,
+    "sales-orders": 5,
+    "customer-organizations": 720,
+    "carriers": 720,
+    "fulfillment-orders": 5,
+    "customer-stickers": 5,
+    "warehouses": 720,
+    "packings": 1440,
+    "delivery-locations": 720,
+    "clock-supplies": 5,
+    "delivery-orders": 5,
+    "clock-presales": 5,
+    "contracts": 60,
+    "blanket-orders": 15,
+    // Stamdata wijzigt zelden — uur tot dag is voldoende
+    "additional-services": 60,
+    "commercial-service-types": 60,
+    "collections": 60,
+    "price-groups": 60,
+    "delivery-condition-sets": 60,
+    "sales-strategies": 60,
+    "base-items": 60,
+    "contract-trade-item-groups": 60,
+};
+export const getFlorydaySyncHealth = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((input) => {
+    if (!["staging", "live"].includes(input.environment)) {
+        throw new Error("Ongeldige environment");
+    }
+    return input;
+})
+    .handler(async ({ data, context }) => {
+    const row = await getActiveFlorydayCredentials(context.supabase, data.environment);
+    if (!row)
+        return { ok: false, error: `Geen actieve koppeling voor ${data.environment}` };
+    const { data: states } = await context.supabase
+        .from("floriday_sync_state")
+        .select("entity_type, last_success_at, last_synced_at, last_error")
+        .eq("connection_id", row.id);
+    const items = [];
+    const now = Date.now();
+    for (const entity of Object.keys(SYNC_INTERVAL_MIN)) {
+        const interval = SYNC_INTERVAL_MIN[entity];
+        const s = (states ?? []).find((r) => r.entity_type === entity);
+        const last = s?.last_success_at ?? s?.last_synced_at ?? null;
+        const minsBehind = last
+            ? Math.max(0, Math.round((now - Date.parse(last)) / 60000) - interval)
+            : 99999;
+        items.push({
+            entity_type: entity,
+            last_success_at: last,
+            expected_interval_min: interval,
+            minutes_behind: minsBehind,
+            is_stale: minsBehind > interval, // > 2× interval achter
+            last_error: s?.last_error ?? null,
+        });
+    }
+    return { ok: true, items };
+});
+// ─── Cursor reset (backfill) ────────────────────────────────────────────────
+export const resetFlorydaySyncCursor = createServerFn({ method: "POST" })
+    .middleware([requireSupabaseAuth])
+    .inputValidator((input) => {
+    if (!["staging", "live"].includes(input.environment)) {
+        throw new Error("Ongeldige environment");
+    }
+    if (!input.entityType?.trim())
+        throw new Error("entityType is verplicht");
+    return input;
+})
+    .handler(async ({ data, context }) => {
+    const row = await getActiveFlorydayCredentials(context.supabase, data.environment);
+    if (!row)
+        throw new Error(`Geen actieve koppeling voor ${data.environment}`);
+    const { error } = await context.supabase.rpc("reset_floriday_sync_cursor", {
+        p_connection_id: row.id,
+        p_entity_type: data.entityType,
+    });
+    if (error)
+        throw new Error(error.message);
+    return { ok: true };
+});

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/floriday-authenticatie-module",
-  "version": "1.0.13",
+  "version": "1.0.14",
   "sideEffects": false,
   "type": "module",
   "main": "./dist-lib/index.js",
@@ -37,7 +37,7 @@
   "devDependencies": {
     "@flowselections/core": "^1.0.11",
     "@eslint/js": "^9.32.0",
-    "@lovable.dev/vite-tanstack-config": "2.5.3",
+    "@lovable.dev/vite-tanstack-config": "2.6.4",
     "@types/node": "^22.16.5",
     "@types/react": "^19.2.0",
     "@types/react-dom": "^19.2.0",