@flowselections/floriday-authenticatie-module 1.0.16 → 1.0.18

package/dist-lib/lib/floricode-credentials.server.d.ts

@@ -0,0 +1,21 @@
+interface Credentials {
+    clientId: string;
+    clientSecret: string;
+    source: "database" | "env";
+}
+export declare function encryptClientSecret(plaintext: string): Promise<string>;
+export declare function decryptClientSecret(ciphertext: string): Promise<string>;
+export declare function getFloricodeCredentials(): Promise<Credentials>;
+export declare function getFloricodeAccessToken(scope: string): Promise<string>;
+/**
+ * Test a single scope to validate credentials work. Writes the result back to
+ * `floricode_connection_settings.last_token_test_*`.
+ */
+export declare function testFloricodeCredentials(): Promise<{
+    ok: boolean;
+    error?: string;
+    scope: string;
+}>;
+export declare function invalidateFloricodeTokenCache(): void;
+export {};
+//# sourceMappingURL=floricode-credentials.server.d.ts.map

package/dist-lib/lib/floricode-credentials.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floricode-credentials.server.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-credentials.server.ts"],"names":[],"mappings":"AAgBA,UAAU,WAAW;IACnB,QAAQ,EAAE,MAAM,CAAC;IACjB,YAAY,EAAE,MAAM,CAAC;IACrB,MAAM,EAAE,UAAU,GAAG,KAAK,CAAC;CAC5B;AA0CD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAc5E;AAED,wBAAsB,mBAAmB,CAAC,UAAU,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAgB7E;AAiBD,wBAAsB,uBAAuB,IAAI,OAAO,CAAC,WAAW,CAAC,CAWpE;AAyBD,wBAAsB,uBAAuB,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,CAS5E;AAED;;;GAGG;AACH,wBAAsB,wBAAwB,IAAI,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAAC,CAoBxG;AAED,wBAAgB,6BAA6B,IAAI,IAAI,CAEpD"}

package/dist-lib/lib/floricode-credentials.server.js

@@ -0,0 +1,158 @@
+// ============================================================================
+// Floricode credentials store (server-only)
+// ----------------------------------------------------------------------------
+// Centrale plek voor Floricode OAuth-inloggegevens. Waarden komen uit de tabel
+// `public.floricode_connection_settings` en worden versleuteld opgeslagen met
+// AES-256-GCM, met de encryption key uit env-var `FLORICODE_SECRET_ENCRYPTION_KEY`.
+// Fallback naar env-vars `FLORICODE_CLIENT_ID/SECRET` bestaat alleen voor
+// migratieperiode zolang de UI nog niet ingevuld is.
+// ============================================================================
+// Web Crypto API — werkt in browser, Node 15+ en Deno. Geen Node "crypto" import,
+// zodat dist-lib client-side gebundeld kan worden zonder Node builtins te resolven.
+import { supabaseAdmin } from "../integrations/supabase/client.server";
+const FLORICODE_TOKEN_URL = "https://api.floricode.com/oauth/token";
+const tokenCache = new Map();
+function getSubtle() {
+    const subtle = globalThis.crypto?.subtle;
+    if (!subtle)
+        throw new Error("Web Crypto (crypto.subtle) is niet beschikbaar in deze runtime.");
+    return subtle;
+}
+function toBase64(bytes) {
+    let bin = "";
+    for (let i = 0; i < bytes.length; i++)
+        bin += String.fromCharCode(bytes[i]);
+    // btoa is beschikbaar in browser, Node 16+ en Deno.
+    return globalThis.btoa(bin);
+}
+function fromBase64(b64) {
+    const bin = globalThis.atob(b64);
+    const out = new Uint8Array(bin.length);
+    for (let i = 0; i < bin.length; i++)
+        out[i] = bin.charCodeAt(i);
+    return out;
+}
+async function getEncryptionKey() {
+    const raw = process.env.FLORICODE_SECRET_ENCRYPTION_KEY;
+    if (!raw) {
+        throw new Error("FLORICODE_SECRET_ENCRYPTION_KEY ontbreekt — kan Floricode-credentials niet ontsleutelen.");
+    }
+    const subtle = getSubtle();
+    // Normaliseer naar 32 bytes via SHA-256, ongeacht lengte/format van de bron.
+    const digest = await subtle.digest("SHA-256", new TextEncoder().encode(raw));
+    return subtle.importKey("raw", digest, { name: "AES-GCM" }, false, ["encrypt", "decrypt"]);
+}
+export async function encryptClientSecret(plaintext) {
+    const subtle = getSubtle();
+    const key = await getEncryptionKey();
+    const iv = globalThis.crypto.getRandomValues(new Uint8Array(12));
+    const cipherBuf = await subtle.encrypt({ name: "AES-GCM", iv: iv }, key, new TextEncoder().encode(plaintext));
+    const cipherBytes = new Uint8Array(cipherBuf);
+    // AES-GCM in WebCrypto plakt de 16-byte auth tag aan het einde van de ciphertext.
+    const tag = cipherBytes.slice(cipherBytes.length - 16);
+    const enc = cipherBytes.slice(0, cipherBytes.length - 16);
+    return `v1.${toBase64(iv)}.${toBase64(tag)}.${toBase64(enc)}`;
+}
+export async function decryptClientSecret(ciphertext) {
+    if (!ciphertext.startsWith("v1.")) {
+        throw new Error("Onbekend ciphertext-formaat voor Floricode-credential.");
+    }
+    const [, ivB64, tagB64, dataB64] = ciphertext.split(".");
+    if (!ivB64 || !tagB64 || !dataB64)
+        throw new Error("Ongeldig ciphertext-formaat.");
+    const subtle = getSubtle();
+    const key = await getEncryptionKey();
+    const iv = fromBase64(ivB64);
+    const tag = fromBase64(tagB64);
+    const data = fromBase64(dataB64);
+    const combined = new Uint8Array(data.length + tag.length);
+    combined.set(data, 0);
+    combined.set(tag, data.length);
+    const plainBuf = await subtle.decrypt({ name: "AES-GCM", iv: iv }, key, combined);
+    return new TextDecoder().decode(plainBuf);
+}
+async function loadCredentialsFromDb() {
+    const { data, error } = await supabaseAdmin
+        .from("floricode_connection_settings")
+        .select("client_id, client_secret_ciphertext")
+        .eq("id", 1)
+        .maybeSingle();
+    if (error)
+        throw new Error(`Kon Floricode-instellingen niet laden: ${error.message}`);
+    if (!data?.client_id || !data?.client_secret_ciphertext)
+        return null;
+    return {
+        clientId: data.client_id,
+        clientSecret: await decryptClientSecret(data.client_secret_ciphertext),
+        source: "database",
+    };
+}
+export async function getFloricodeCredentials() {
+    const fromDb = await loadCredentialsFromDb();
+    if (fromDb)
+        return fromDb;
+    const clientId = process.env.FLORICODE_CLIENT_ID;
+    const clientSecret = process.env.FLORICODE_CLIENT_SECRET;
+    if (clientId && clientSecret) {
+        return { clientId, clientSecret, source: "env" };
+    }
+    throw new Error("Floricode-credentials ontbreken. Vul ze in via de Floricode-instellingen in het beheerscherm.");
+}
+async function requestToken(scope, creds) {
+    const body = new URLSearchParams({
+        grant_type: "client_credentials",
+        client_id: creds.clientId,
+        client_secret: creds.clientSecret,
+        scope,
+    });
+    const res = await fetch(FLORICODE_TOKEN_URL, {
+        method: "POST",
+        headers: { "content-type": "application/x-www-form-urlencoded" },
+        body,
+    });
+    const json = (await res.json().catch(() => ({})));
+    if (!res.ok || !json?.access_token) {
+        throw new Error(`Floricode token (${scope}) mislukt (${res.status}): ${json?.error_description ?? json?.error ?? res.statusText}`);
+    }
+    return { token: String(json.access_token), expiresIn: Number(json.expires_in ?? 3600) };
+}
+export async function getFloricodeAccessToken(scope) {
+    const cached = tokenCache.get(scope);
+    const now = Date.now();
+    // 60s safety margin
+    if (cached && cached.expiresAt - 60000 > now)
+        return cached.token;
+    const creds = await getFloricodeCredentials();
+    const { token, expiresIn } = await requestToken(scope, creds);
+    tokenCache.set(scope, { token, expiresAt: now + expiresIn * 1000 });
+    return token;
+}
+/**
+ * Test a single scope to validate credentials work. Writes the result back to
+ * `floricode_connection_settings.last_token_test_*`.
+ */
+export async function testFloricodeCredentials() {
+    const scope = "vbn_productfeature:read";
+    let ok = false;
+    let error;
+    try {
+        const creds = await getFloricodeCredentials();
+        await requestToken(scope, creds);
+        ok = true;
+    }
+    catch (e) {
+        error = String(e?.message ?? e);
+    }
+    await supabaseAdmin
+        .from("floricode_connection_settings")
+        .update({
+        last_token_test_at: new Date().toISOString(),
+        last_token_test_ok: ok,
+        last_token_test_error: ok ? null : error ?? "onbekende fout",
+    })
+        .eq("id", 1);
+    return { ok, error, scope };
+}
+export function invalidateFloricodeTokenCache() {
+    tokenCache.clear();
+}

package/dist-lib/lib/floricode-product-features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floricode-product-features.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-product-features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAShE,QAAA,MAAM,yBAAyB,+BAA+B,CAAC;AAc/D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAuRD,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EACjC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC;IACT,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACnC,YAAY,EAAE,OAAO,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,EAAE,CAAC;CAC1C,CAAC,CAiFD;AAED,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;GAiF1D"}
+{"version":3,"file":"floricode-product-features.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-product-features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAShE,QAAA,MAAM,yBAAyB,+BAA+B,CAAC;AAc/D,MAAM,WAAW,qBAAqB;IACpC,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,kBAAkB,EAAE,MAAM,CAAC;IAC3B,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,EAAE,OAAO,CAAC;IAClB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,eAAe,EAAE,MAAM,GAAG,IAAI,CAAC;IAC/B,iBAAiB,EAAE,MAAM,GAAG,IAAI,CAAC;IACjC,aAAa,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;IAC7D,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AAoQD,wBAAsB,mCAAmC,CACvD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,mBAAmB,EAChC,gBAAgB,EAAE,MAAM,GAAG,MAAM,EACjC,OAAO,GAAE;IAAE,YAAY,CAAC,EAAE,OAAO,CAAA;CAAO,GACvC,OAAO,CAAC;IACT,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;IAC9B,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,MAAM,EAAE,OAAO,GAAG,gBAAgB,CAAC;IACnC,YAAY,EAAE,OAAO,yBAAyB,CAAC;IAC/C,eAAe,EAAE,qBAAqB,EAAE,CAAC;CAC1C,CAAC,CAiFD;AAED,wBAAsB,4BAA4B,CAChD,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAA;CAAO;;;;;;;;GAiF1D"}

package/dist-lib/lib/floricode-product-features.js

@@ -1,5 +1,5 @@
 import { fetchFloricodeRegulatoryFeaturesForProduct, upsertRegulatoryFeatureRecords, } from "./floricode-regulatory-features";
-const FLORICODE_TOKEN_URL = "https://api.floricode.com/oauth/token";
+import { getFloricodeAccessToken as getSharedFloricodeToken } from "./floricode-credentials.server";
 const FLORICODE_PRODUCT_FEATURE_URL = "https://api.floricode.com/v2/VBN/ProductFeature";
 const PRODUCT_FEATURE_SCOPE = "vbn_productfeature:read";
 const PRODUCT_FEATURE_LIST_NAME = "vbn-product-characteristic";
@@ -20,29 +20,7 @@ function chunk(items, size) {
     return out;
 }
 async function getFloricodeAccessToken() {
-    const clientId = process.env.FLORICODE_CLIENT_ID;
-    const clientSecret = process.env.FLORICODE_CLIENT_SECRET;
-    if (!clientId || !clientSecret) {
-        throw new Error("Floricode credentials ontbreken (FLORICODE_CLIENT_ID/FLORICODE_CLIENT_SECRET)");
-    }
-    const body = new URLSearchParams({
-        grant_type: "client_credentials",
-        client_id: clientId,
-        client_secret: clientSecret,
-        scope: PRODUCT_FEATURE_SCOPE,
-    });
-    const res = await fetch(FLORICODE_TOKEN_URL, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body,
-    });
-    const json = (await res.json().catch(() => ({})));
-    if (!res.ok) {
-        throw new Error(`Floricode token-aanvraag mislukt (${res.status}): ${json?.error_description ?? json?.error ?? res.statusText}`);
-    }
-    if (!json?.access_token)
-        throw new Error("Floricode token-response bevat geen access_token");
-    return String(json.access_token);
+    return getSharedFloricodeToken(PRODUCT_FEATURE_SCOPE);
 }
 async function fetchFloricodeProductFeaturesForProduct(productCode) {
     const token = await getFloricodeAccessToken();
@@ -74,21 +52,29 @@ async function fetchFloricodeProductFeaturesPage(token, skip, top) {
     return Array.isArray(json?.value) ? json.value : [];
 }
 async function upsertFloricodeProductFeatureRecords(supabase, items) {
-    const rows = items
-        .filter((item) => item?.product_id != null && item?.feature_type_id)
-        .map((item) => {
+    const dedup = new Map();
+    const now = new Date().toISOString();
+    for (const item of items) {
+        if (item?.product_id == null || !item?.feature_type_id)
+            continue;
         const productCode = String(item.product_id);
         const featureCode = String(item.feature_type_id);
         const valueCode = item.feature_value_code == null ? "" : String(item.feature_value_code);
-        return {
+        const record_id = `${productCode}:${featureCode}:${valueCode}`;
+        // Later occurrences win: keep the newest change_date_time
+        const existing = dedup.get(record_id);
+        if (existing && existing.change_date_time && item.change_date_time && existing.change_date_time > item.change_date_time)
+            continue;
+        dedup.set(record_id, {
             resource: PRODUCT_FEATURE_RESOURCE,
-            record_id: `${productCode}:${featureCode}:${valueCode}`,
+            record_id,
             data: item,
             change_date_time: item.change_date_time ?? null,
-            last_synced_at: new Date().toISOString(),
-        };
-    });
-    for (const part of chunk(rows, 1000)) {
+            last_synced_at: now,
+        });
+    }
+    const rows = Array.from(dedup.values());
+    for (const part of chunk(rows, 250)) {
         const { error } = await supabase
             .from("floricode_records")
             .upsert(part, { onConflict: "resource,record_id" });

package/dist-lib/lib/floricode-regulatory-features.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"floricode-regulatory-features.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-regulatory-features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAY5D,UAAU,cAAc;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,UAAU,cAAc;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAoCD,wBAAsB,0CAA0C,CAC9D,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAgB3B;AAkCD,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAiBD,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,cAAc;;;;;;GA2B1E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;GAwI5E"}
+{"version":3,"file":"floricode-regulatory-features.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-regulatory-features.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAY5D,UAAU,cAAc;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,EAAE,MAAM,GAAG,MAAM,CAAC;IAC5B,eAAe,EAAE,MAAM,CAAC;IACxB,kBAAkB,EAAE,MAAM,GAAG,MAAM,CAAC;IACpC,kBAAkB,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC;IAC5C,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAED,UAAU,cAAc;IACtB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,gBAAgB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAClC;AAYD,wBAAsB,0CAA0C,CAC9D,WAAW,EAAE,MAAM,GAClB,OAAO,CAAC,cAAc,EAAE,CAAC,CAgB3B;AAiDD,wBAAsB,8BAA8B,CAClD,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAED,wBAAsB,2BAA2B,CAC/C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,cAAc,EAAE,GACtB,OAAO,CAAC,MAAM,CAAC,CAqBjB;AAiBD,wBAAsB,4BAA4B,CAAC,QAAQ,EAAE,cAAc;;;;;;GA2B1E;AAED,wBAAsB,+BAA+B,CACnD,QAAQ,EAAE,cAAc,EACxB,OAAO,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO;;;;;;;;;;;;;;;;;;;;;;GAoK5E"}

package/dist-lib/lib/floricode-regulatory-features.js

@@ -1,4 +1,4 @@
-const FLORICODE_TOKEN_URL = "https://api.floricode.com/oauth/token";
+import { getFloricodeAccessToken } from "./floricode-credentials.server";
 const REG_FEATURE_TYPE_URL = "https://api.floricode.com/v2/VBN/RegulatoryFeatureType";
 const REGULATION_TYPE_URL = "https://api.floricode.com/v2/VBN/RegulationType";
 const REG_FEATURE_TYPE_RESOURCE = "RegulatoryFeatureType";
@@ -12,27 +12,7 @@ function chunk(items, size) {
     return out;
 }
 async function getFloricodeToken(scope) {
-    const clientId = process.env.FLORICODE_CLIENT_ID;
-    const clientSecret = process.env.FLORICODE_CLIENT_SECRET;
-    if (!clientId || !clientSecret) {
-        throw new Error("Floricode credentials ontbreken (FLORICODE_CLIENT_ID/FLORICODE_CLIENT_SECRET)");
-    }
-    const body = new URLSearchParams({
-        grant_type: "client_credentials",
-        client_id: clientId,
-        client_secret: clientSecret,
-        scope,
-    });
-    const res = await fetch(FLORICODE_TOKEN_URL, {
-        method: "POST",
-        headers: { "content-type": "application/x-www-form-urlencoded" },
-        body,
-    });
-    const json = (await res.json().catch(() => ({})));
-    if (!res.ok || !json?.access_token) {
-        throw new Error(`Floricode token (${scope}) mislukt (${res.status}): ${json?.error_description ?? json?.error ?? res.statusText}`);
-    }
-    return String(json.access_token);
+    return getFloricodeAccessToken(scope);
 }
 export async function fetchFloricodeRegulatoryFeaturesForProduct(productCode) {
     const token = await getFloricodeToken(REG_FEATURE_TYPE_SCOPE);
@@ -47,11 +27,18 @@ export async function fetchFloricodeRegulatoryFeaturesForProduct(productCode) {
     }
     return Array.isArray(json?.value) ? json.value : [];
 }
-async function fetchRegFeatureTypePage(token, skip, top) {
+async function fetchRegFeatureTypePage(token, skip, top, sinceIso) {
     const url = new URL(REG_FEATURE_TYPE_URL);
     url.searchParams.set("$top", String(top));
     url.searchParams.set("$skip", String(skip));
-    url.searchParams.set("$orderby", "product_id,feature_type_id");
+    // Strict-unique tuple so OData $skip pagination is deterministic.
+    // Without regulation_type_id in the sort key, rows with multiple
+    // regulation_type_ids per (product, feature) can be silently skipped
+    // between pages — that's how S96/S97/S98/S99 fell out of the cache.
+    url.searchParams.set("$orderby", ["change_date_time", "product_id", "feature_type_id", "regulation_type_id"].join(","));
+    if (sinceIso) {
+        url.searchParams.set("$filter", `change_date_time gt ${sinceIso}`);
+    }
     const res = await fetch(url.toString(), { headers: { authorization: `Bearer ${token}` } });
     const json = (await res.json().catch(() => ({})));
     if (!res.ok) {
@@ -84,7 +71,7 @@ export async function upsertRegulatoryFeatureRecords(supabase, items) {
         });
     }
     const rows = Array.from(dedup.values());
-    for (const part of chunk(rows, 1000)) {
+    for (const part of chunk(rows, 250)) {
         const { error } = await supabase
             .from("floricode_records")
             .upsert(part, { onConflict: "resource,record_id" });
@@ -136,7 +123,7 @@ export async function syncFloricodeRegulationTypes(supabase) {
         const items = await fetchRegulationTypeAll(token);
         const upserted = await upsertRegulationTypeRecords(supabase, items);
         await setSyncState(supabase, REGULATION_TYPE_RESOURCE, {
-            status: "success",
+            status: "ok",
             error_message: null,
             last_sequence_number: upserted,
             last_sync_at: new Date().toISOString(),
@@ -161,18 +148,31 @@ export async function syncFloricodeRegulatoryFeatures(supabase, options = {}) {
     // Read cursor from state so we can resume where the previous invocation stopped.
     let skip = 0;
     let maxChangeDateTime = null;
+    // sinceIso: watermark applied via $filter on subsequent runs after a full scan.
+    // - status 'running': we're mid full-scan or mid incremental-scan; keep the
+    //   cursor/watermark that pass started with (do not filter differently mid-run).
+    // - status 'ok' with a watermark: kick off an incremental scan of only newer rows.
+    // - anything else (no state / error / no watermark yet): full re-scan from 0.
+    let sinceIso = null;
     if (resume) {
         const { data: state } = await supabase
             .from("floricode_sync_state")
             .select("cursor_skip,last_change_date_time,status")
             .eq("resource", REG_FEATURE_TYPE_RESOURCE)
             .maybeSingle();
-        if (state && state.status === "running") {
-            skip = Number(state.cursor_skip ?? 0) || 0;
-            maxChangeDateTime = state.last_change_date_time ?? null;
+        const s = state;
+        if (s?.status === "running") {
+            skip = Number(s.cursor_skip ?? 0) || 0;
+            maxChangeDateTime = s.last_change_date_time ?? null;
+            sinceIso = s.last_change_date_time ?? null;
+        }
+        else if (s?.status === "ok" && s.last_change_date_time) {
+            sinceIso = s.last_change_date_time;
+            maxChangeDateTime = s.last_change_date_time;
         }
     }
     const startSkip = skip;
+    const incremental = Boolean(sinceIso);
     let fetched = 0;
     let upserted = 0;
     let batches = 0;
@@ -181,12 +181,13 @@ export async function syncFloricodeRegulatoryFeatures(supabase, options = {}) {
         status: "running",
         error_message: null,
         cursor_skip: skip,
+        last_change_date_time: maxChangeDateTime,
         last_sync_at: new Date().toISOString(),
     });
     try {
         const token = await getFloricodeToken(REG_FEATURE_TYPE_SCOPE);
         while (batches < maxBatches) {
-            const items = await fetchRegFeatureTypePage(token, skip, batchSize);
+            const items = await fetchRegFeatureTypePage(token, skip, batchSize, sinceIso);
             if (items.length === 0) {
                 completed = true;
                 break;
@@ -208,19 +209,28 @@ export async function syncFloricodeRegulatoryFeatures(supabase, options = {}) {
                 last_change_date_time: maxChangeDateTime,
                 last_sync_at: new Date().toISOString(),
             });
-            if (items.length < batchSize) {
-                completed = true;
-                break;
-            }
-        }
-        // Ook bij partial runs projectie draaien zodat vbn-product-characteristic
-        // meegroeit met de raw cache. Fouten hier mogen de cursor niet blokkeren.
-        if (!completed && upserted > 0) {
+            // Lichte per-product projectie: alleen de zojuist geraakte producten
+            // opnieuw projecteren i.p.v. de volledige (200k+) rebuild na elke batch.
+            // Voorkomt "canceling statement due to statement timeout" tijdens partial syncs.
             try {
-                await supabase.rpc("refresh_floricode_derived_code_lists");
+                const productIds = Array.from(new Set(items
+                    .map((i) => (i?.product_id != null ? String(i.product_id) : null))
+                    .filter((v) => Boolean(v))));
+                if (productIds.length > 0) {
+                    // Chunk om payload-limieten en planner-blowups te vermijden.
+                    for (const part of chunk(productIds, 500)) {
+                        await supabase.rpc("refresh_floricode_derived_for_products", {
+                            _product_ids: part,
+                        });
+                    }
+                }
             }
             catch (e) {
-                console.warn("[regulatory] partial projection skipped:", String(e?.message ?? e));
+                console.warn("[regulatory] partial per-product projection skipped:", String(e?.message ?? e));
+            }
+            if (items.length < batchSize) {
+                completed = true;
+                break;
             }
         }
         if (completed) {
@@ -235,7 +245,7 @@ export async function syncFloricodeRegulatoryFeatures(supabase, options = {}) {
             if (projectionError)
                 throw new Error(`Projectie naar code-lists mislukt: ${projectionError.message}`);
             await setSyncState(supabase, REG_FEATURE_TYPE_RESOURCE, {
-                status: "success",
+                status: "ok",
                 error_message: null,
                 cursor_skip: 0,
                 last_sequence_number: skip,

package/dist-lib/lib/floricode-sync.server.d.ts

@@ -0,0 +1,35 @@
+export interface FloricodeResourceDef {
+    resource: string;
+    endpoint: string;
+    scope: string;
+    /** Columns forming the primary key; order used for $orderby unique sort. */
+    keyColumns: string[];
+}
+export declare const FLORICODE_RESOURCES: FloricodeResourceDef[];
+export interface FloricodeSyncResult {
+    ok: true;
+    resource: string;
+    fetched: number;
+    upserted: number;
+    batches: number;
+    finished: boolean;
+    nextWatermark: string | null;
+    durationMs: number;
+}
+export declare function syncFloricodeResource(resource: string, opts?: {
+    batchSize?: number;
+    maxBatches?: number;
+    resume?: boolean;
+}): Promise<FloricodeSyncResult>;
+export declare function syncAllFloricodeResources(opts: {
+    batchSize?: number;
+    maxBatchesPerResource?: number;
+}): Promise<{
+    ok: true;
+    results: Array<FloricodeSyncResult | {
+        resource: string;
+        ok: false;
+        error: string;
+    }>;
+}>;
+//# sourceMappingURL=floricode-sync.server.d.ts.map

package/dist-lib/lib/floricode-sync.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floricode-sync.server.d.ts","sourceRoot":"","sources":["../../src/lib/floricode-sync.server.ts"],"names":[],"mappings":"AAiBA,MAAM,WAAW,oBAAoB;IACnC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,KAAK,EAAE,MAAM,CAAC;IACd,4EAA4E;IAC5E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,eAAO,MAAM,mBAAmB,EAAE,oBAAoB,EAkBrD,CAAC;AA6EF,MAAM,WAAW,mBAAmB;IAClC,EAAE,EAAE,IAAI,CAAC;IACT,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,OAAO,CAAC;IAClB,aAAa,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,UAAU,EAAE,MAAM,CAAC;CACpB;AAED,wBAAsB,qBAAqB,CACzC,QAAQ,EAAE,MAAM,EAChB,IAAI,GAAE;IAAE,SAAS,CAAC,EAAE,MAAM,CAAC;IAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,OAAO,CAAA;CAAO,GACvE,OAAO,CAAC,mBAAmB,CAAC,CAmH9B;AAED,wBAAsB,yBAAyB,CAAC,IAAI,EAAE;IACpD,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,qBAAqB,CAAC,EAAE,MAAM,CAAC;CAChC,GAAG,OAAO,CAAC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,OAAO,EAAE,KAAK,CAAC,mBAAmB,GAAG;QAAE,QAAQ,EAAE,MAAM,CAAC;QAAC,EAAE,EAAE,KAAK,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAc9G"}