@flowselections/floriday-authenticatie-module 1.0.16 → 1.0.18

package/dist-lib/lib/floriday-auto-process.server.js

@@ -0,0 +1,365 @@
+// ============================================================================
+// Auto-fulfillment state-machine voor Floriday sales orders (2026v1).
+// ----------------------------------------------------------------------------
+// Belangrijkste verschil met de vorige versie: deze module doet GEEN eigen
+// `acknowledge` of `create-delivery-order` meer. Beide worden door Floriday
+// zelf afgehandeld nadat de klant de order committeert (na
+// `cancellationDeadline`). Deze module is een pure observer die één actie
+// uitvoert: het versturen van de fulfillment-order zodra alles klaarstaat.
+//
+// Statussen:
+//   waiting_for_commit          — cancellationDeadline nog niet verstreken
+//   waiting_for_delivery_order  — commit rond, maar Floriday heeft nog geen
+//                                 delivery-order gepushed (wachten op sync)
+//   waiting                     — timing (autoProcessMoment) nog niet bereikt
+//   sending_fulfillment         — POST /fulfillment-orders bezig
+//   done                        — fulfillment-order verzonden
+//   error                       — onherstelbaar
+// ============================================================================
+import { florydayWrite, getActiveFlorydayCredentials, getActiveFlorydayEnvironment, } from "./floriday.functions";
+import { computeAutoProcessDate, isPickdayToday } from "./planning-helpers";
+// ─── Helpers ────────────────────────────────────────────────────────────────
+async function readSalesOrderFromCache(supabase, connectionId, salesOrderId) {
+    const { data } = await supabase
+        .from("floriday_salesorders_cache")
+        .select("floriday_id, data")
+        .eq("connection_id", connectionId)
+        .eq("floriday_id", salesOrderId)
+        .maybeSingle();
+    return data;
+}
+/**
+ * Zoek de delivery-order in cache waarvan één van de fulfillmentRequests naar
+ * deze sales-order verwijst. Retourneert zowel de delivery-order als de
+ * matchende fulfillmentRequest(s).
+ */
+async function findDeliveryOrderForSalesOrder(supabase, connectionId, salesOrderId) {
+    // Floriday bewaart de link in data.fulfillmentRequests[].salesOrderId.
+    // We gebruiken jsonb containment via .contains() zodat Postgres een GIN
+    // index kan raken; geen full-table scan.
+    const { data, error } = await supabase
+        .from("floriday_delivery_orders_cache")
+        .select("floriday_id, data")
+        .eq("connection_id", connectionId)
+        .contains("data", {
+        fulfillmentRequests: [{ salesOrderId }],
+    })
+        .limit(1);
+    if (error || !data || data.length === 0)
+        return null;
+    const row = data[0];
+    const requests = Array.isArray(row.data?.fulfillmentRequests)
+        ? row.data.fulfillmentRequests.filter((r) => r?.salesOrderId === salesOrderId)
+        : [];
+    return {
+        deliveryOrderId: row.floriday_id,
+        data: row.data,
+        fulfillmentRequests: requests,
+    };
+}
+async function hasFulfillmentOrder(supabase, connectionId, deliveryOrderId) {
+    const { data } = await supabase
+        .from("floriday_fulfillment_orders_cache")
+        .select("floriday_id")
+        .eq("connection_id", connectionId)
+        .eq("delivery_order_id", deliveryOrderId)
+        .maybeSingle();
+    return data?.floriday_id ?? null;
+}
+async function loadAfhandelingSettings(supabase) {
+    const { data } = await supabase
+        .from("afhandeling_settings")
+        .select("auto_process_paused, pick_weekdays, max_workdays_earlier_pick, extra_pick_days_with_stickers")
+        .order("updated_at", { ascending: false })
+        .limit(1)
+        .maybeSingle();
+    return (data ?? {
+        auto_process_paused: false,
+        pick_weekdays: [1, 2, 3, 4, 5],
+        max_workdays_earlier_pick: 1,
+        extra_pick_days_with_stickers: 1,
+    });
+}
+async function logPhase(supabase, connectionId, salesOrderId, status, extra = {}) {
+    await supabase.rpc("upsert_auto_fulfillment_log", {
+        p_connection_id: connectionId,
+        p_sales_order_id: salesOrderId,
+        p_status: status,
+        p_reason: extra.reason ?? null,
+        p_error: extra.error ?? null,
+        p_fulfillment_order_id: extra.fulfillmentOrderId ?? null,
+    });
+}
+/**
+ * Haal `numberOfPackages` uit een fulfillmentRequest, met een reeks
+ * fallbacks voor licht afwijkende schema-varianten.
+ */
+function extractPackageCount(req) {
+    const candidates = [
+        req?.numberOfPackages,
+        req?.packageCount,
+        req?.numberOfLoadCarriers,
+        req?.quantity,
+    ];
+    for (const c of candidates) {
+        const n = Number(c);
+        if (Number.isFinite(n) && n > 0)
+            return n;
+    }
+    return 1;
+}
+// ─── Publieke API ───────────────────────────────────────────────────────────
+/**
+ * Voert de state-machine één stap uit voor een enkele sales-order. Idempotent
+ * en veilig te herhalen; alleen `sending_fulfillment` doet een write naar
+ * Floriday.
+ */
+export async function runAutoProcess(supabase, input) {
+    const salesOrderId = input.salesOrderId.trim();
+    if (!salesOrderId) {
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            error: "salesOrderId is verplicht",
+        };
+    }
+    const env = input.environment ?? (await getActiveFlorydayEnvironment(supabase));
+    const conn = await getActiveFlorydayCredentials(supabase, env);
+    if (!conn) {
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            error: `Geen actieve Floriday-koppeling voor ${env}`,
+        };
+    }
+    const cacheRow = await readSalesOrderFromCache(supabase, conn.id, salesOrderId);
+    if (!cacheRow) {
+        await logPhase(supabase, conn.id, salesOrderId, "error", {
+            error: "Sales order niet in cache",
+        });
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            error: "Sales order niet gevonden in cache",
+        };
+    }
+    const raw = cacheRow.data ?? {};
+    // ─ Guard 1: Order geannuleerd? ────────────────────────────────────────────
+    if (raw.automaticallyCancelledOn) {
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            error: `Order automatisch geannuleerd op ${raw.automaticallyCancelledOn}`,
+        };
+    }
+    // ─ Guard 2: Cancellation-deadline nog niet verstreken ────────────────────
+    const cancellationDeadline = raw.cancellationDeadline ?? raw.commitmentDeadline ?? null;
+    if (!input.force && cancellationDeadline) {
+        const deadline = new Date(cancellationDeadline);
+        if (Number.isFinite(deadline.getTime()) && deadline.getTime() > Date.now()) {
+            await logPhase(supabase, conn.id, salesOrderId, "waiting_for_commit", {
+                reason: `deadline_at_${cancellationDeadline}`,
+            });
+            return {
+                ok: true,
+                status: "waiting_for_commit",
+                salesOrderId,
+                cancellationDeadline,
+                reason: `deadline_at_${cancellationDeadline}`,
+            };
+        }
+    }
+    // ─ Guard 3: Delivery-order al door Floriday gepushed? ─────────────────────
+    const doMatch = await findDeliveryOrderForSalesOrder(supabase, conn.id, salesOrderId);
+    if (!doMatch) {
+        await logPhase(supabase, conn.id, salesOrderId, "waiting_for_delivery_order", {
+            reason: "no_delivery_order_in_cache_yet",
+        });
+        return {
+            ok: true,
+            status: "waiting_for_delivery_order",
+            salesOrderId,
+            cancellationDeadline,
+            reason: "no_delivery_order_in_cache_yet",
+        };
+    }
+    const deliveryOrderId = doMatch.deliveryOrderId;
+    // ─ Idempotency: fulfillment-order al verzonden? ──────────────────────────
+    const existingFo = await hasFulfillmentOrder(supabase, conn.id, deliveryOrderId);
+    if (existingFo) {
+        return {
+            ok: true,
+            status: "done",
+            salesOrderId,
+            deliveryOrderId,
+            fulfillmentOrderId: existingFo,
+            reason: "already_sent",
+        };
+    }
+    // ─ Guard 4: Timing (autoProcessMoment) ───────────────────────────────────
+    const deliveryDate = raw.deliveryDate ?? raw.requestedDeliveryDate ?? doMatch.data?.deliveryDate ?? null;
+    const requiresStickers = Boolean(raw.requiresStickers);
+    if (!input.force && deliveryDate) {
+        const settings = await loadAfhandelingSettings(supabase);
+        if (settings.auto_process_paused) {
+            return {
+                ok: true,
+                status: "waiting",
+                salesOrderId,
+                deliveryOrderId,
+                reason: "auto_process_paused",
+            };
+        }
+        const { moment, reason } = computeAutoProcessDate({
+            deliveryDate,
+            maxWorkdaysEarlierPick: settings.max_workdays_earlier_pick ?? 1,
+            pickWeekdays: settings.pick_weekdays ?? [1, 2, 3, 4, 5],
+            extraStickerDaysWithStickers: settings.extra_pick_days_with_stickers ?? 0,
+            requiresStickers,
+        });
+        if (moment && moment.getTime() > Date.now()) {
+            return {
+                ok: true,
+                status: "waiting",
+                salesOrderId,
+                deliveryOrderId,
+                reason: reason ?? "before_auto_process_moment",
+            };
+        }
+    }
+    // ─ Actie: POST /fulfillment-orders ───────────────────────────────────────
+    await logPhase(supabase, conn.id, salesOrderId, "sending_fulfillment");
+    const fulfillmentRequests = doMatch.fulfillmentRequests
+        .map((r) => {
+        const fulfillmentRequestId = r?.fulfillmentRequestId ?? r?.id ?? r?.requestId;
+        if (!fulfillmentRequestId)
+            return null;
+        return {
+            deliveryOrderId,
+            fulfillmentRequestId,
+            numberOfPackages: extractPackageCount(r),
+        };
+    })
+        .filter(Boolean);
+    if (fulfillmentRequests.length === 0) {
+        await logPhase(supabase, conn.id, salesOrderId, "error", {
+            error: "Delivery-order bevat geen fulfillmentRequests voor deze sales-order",
+        });
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            deliveryOrderId,
+            error: "Geen fulfillmentRequests gevonden in delivery-order",
+        };
+    }
+    const body = {
+        loadCarrierItems: [{ fulfillmentRequests }],
+    };
+    const foResult = await florydayWrite(supabase, env, {
+        module: "auto-process",
+        action: "send-fulfillment-order",
+        method: "POST",
+        path: "/fulfillment-orders",
+        body,
+        referenceId: deliveryOrderId,
+        idempotencyKey: `do:${deliveryOrderId}:fulfillment-order`,
+    });
+    if (!foResult.ok) {
+        await logPhase(supabase, conn.id, salesOrderId, "error", {
+            error: foResult.error ?? "Versturen fulfillment-order mislukt",
+        });
+        return {
+            ok: false,
+            status: "error",
+            salesOrderId,
+            deliveryOrderId,
+            error: foResult.error ?? "Versturen fulfillment-order mislukt",
+        };
+    }
+    const fulfillmentOrderId = foResult.data?.fulfillmentOrderId ??
+        foResult.data?.id ??
+        foResult.data?.floridayId;
+    await logPhase(supabase, conn.id, salesOrderId, "done", { fulfillmentOrderId });
+    return {
+        ok: true,
+        status: "done",
+        salesOrderId,
+        deliveryOrderId,
+        fulfillmentOrderId,
+    };
+}
+/**
+ * Cron-scan: sales-orders waarvan (a) de cancellation-deadline verstreken is,
+ * (b) er een delivery-order in cache staat en (c) nog geen fulfillment-order
+ * verzonden is → trigger `runAutoProcess`.
+ */
+export async function scanAndTriggerAutoProcess(supabase) {
+    const env = await getActiveFlorydayEnvironment(supabase);
+    const conn = await getActiveFlorydayCredentials(supabase, env);
+    if (!conn)
+        return { scanned: 0, triggered: 0, results: [] };
+    const settings = await loadAfhandelingSettings(supabase);
+    if (settings.auto_process_paused)
+        return { scanned: 0, triggered: 0, results: [] };
+    // Vandaag geen pickdag? Alleen spoedorders (computeAutoProcessDate laat die
+    // via `outside_pickday` alsnog door).
+    void isPickdayToday(settings.pick_weekdays ?? [1, 2, 3, 4, 5]);
+    const nowIso = new Date().toISOString();
+    // Filter aan de bron: order niet geannuleerd, deadline verstreken. De
+    // "delivery-order aanwezig?" en "fulfillment-order al verzonden?" checks
+    // gebeuren per-order in runAutoProcess (blijven zo idempotent).
+    const { data: orders } = await supabase
+        .from("floriday_salesorders_cache")
+        .select("floriday_id, data")
+        .eq("connection_id", conn.id)
+        .eq("is_deleted", false)
+        .is("data->>automaticallyCancelledOn", null)
+        .lt("data->>cancellationDeadline", nowIso)
+        .limit(500);
+    const candidates = orders ?? [];
+    // Circuit-breaker: sla orders over die 5× of vaker op 'error' zijn geëindigd.
+    // Handmatige retry via runAutoProcess({ force: true }) reset attempts vanzelf
+    // omdat de nieuwe status ≠ 'error' is.
+    const ids = candidates.map((c) => c.floriday_id);
+    let blocked = new Set();
+    if (ids.length > 0) {
+        const { data: logs } = await supabase
+            .from("floriday_auto_fulfillment_log")
+            .select("sales_order_id, status, attempts")
+            .eq("connection_id", conn.id)
+            .in("sales_order_id", ids);
+        blocked = new Set((logs ?? [])
+            .filter((l) => l.status === "error" && (l.attempts ?? 0) >= 5)
+            .map((l) => l.sales_order_id));
+    }
+    const filtered = candidates.filter((c) => !blocked.has(c.floriday_id));
+    const results = [];
+    const concurrency = 5;
+    let idx = 0;
+    async function worker() {
+        while (idx < filtered.length) {
+            const i = idx++;
+            const row = filtered[i];
+            const outcome = await runAutoProcess(supabase, {
+                salesOrderId: row.floriday_id,
+                environment: env,
+            }).catch((e) => ({
+                ok: false,
+                status: "error",
+                salesOrderId: row.floriday_id,
+                error: String(e?.message ?? e),
+            }));
+            results.push(outcome);
+        }
+    }
+    await Promise.all(Array.from({ length: concurrency }, worker));
+    const triggered = results.filter((r) => r.status !== "waiting" &&
+        r.status !== "waiting_for_commit" &&
+        r.status !== "waiting_for_delivery_order").length;
+    return { scanned: candidates.length, triggered, results };
+}

package/dist-lib/lib/floriday-fulfillment-lookup.server.d.ts

@@ -0,0 +1,19 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type FlorydayEnvironment } from "./floriday.functions";
+export interface LookupInput {
+    environment: FlorydayEnvironment;
+    fulfillmentOrderId?: string | null;
+    deliveryOrderId?: string | null;
+    salesOrderId?: string | null;
+}
+export interface LookupResult {
+    fulfillmentOrderIds: string[];
+    source: "input" | "cache" | "delivery-order" | "sales-order" | "sales-order-cache";
+}
+/**
+ * Retourneert alle bekende fulfillmentOrderIds voor de gegeven referenties.
+ * Wanneer `fulfillmentOrderId` gegeven is wordt die direct teruggegeven —
+ * er wordt niets extra bevraagd.
+ */
+export declare function resolveFulfillmentOrderIds(supabase: SupabaseClient, input: LookupInput): Promise<LookupResult>;
+//# sourceMappingURL=floriday-fulfillment-lookup.server.d.ts.map

package/dist-lib/lib/floriday-fulfillment-lookup.server.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floriday-fulfillment-lookup.server.d.ts","sourceRoot":"","sources":["../../src/lib/floriday-fulfillment-lookup.server.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAIL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B,MAAM,WAAW,WAAW;IAC1B,WAAW,EAAE,mBAAmB,CAAC;IACjC,kBAAkB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC,eAAe,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;CAC9B;AAED,MAAM,WAAW,YAAY;IAC3B,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,MAAM,EACF,OAAO,GACP,OAAO,GACP,gBAAgB,GAChB,aAAa,GACb,mBAAmB,CAAC;CACzB;AAED;;;;GAIG;AACH,wBAAsB,0BAA0B,CAC9C,QAAQ,EAAE,cAAc,EACxB,KAAK,EAAE,WAAW,GACjB,OAAO,CAAC,YAAY,CAAC,CAoGvB"}

package/dist-lib/lib/floriday-fulfillment-lookup.server.js

@@ -0,0 +1,130 @@
+// ============================================================================
+// Resolve een fulfillmentOrderId vanuit deliveryOrderId of salesOrderId.
+// ----------------------------------------------------------------------------
+// Modules als Verkoop en Afhandeling kennen doorgaans alleen de sales-order
+// of delivery-order ID. Voor afleverbrieven hebben we een fulfillmentOrderId
+// nodig. Deze helper zoekt hem op — eerst in de lokale cache, daarna
+// on-demand via de Floriday-API.
+// ============================================================================
+import { SUPPLIERS_API_VERSION, florydayFetch, getActiveFlorydayCredentials, } from "./floriday.functions";
+/**
+ * Retourneert alle bekende fulfillmentOrderIds voor de gegeven referenties.
+ * Wanneer `fulfillmentOrderId` gegeven is wordt die direct teruggegeven —
+ * er wordt niets extra bevraagd.
+ */
+export async function resolveFulfillmentOrderIds(supabase, input) {
+    if (input.fulfillmentOrderId?.trim()) {
+        return { fulfillmentOrderIds: [input.fulfillmentOrderId.trim()], source: "input" };
+    }
+    const env = input.environment;
+    const conn = await getActiveFlorydayCredentials(supabase, env);
+    if (!conn)
+        throw new Error(`Geen actieve Floriday-koppeling voor ${env}`);
+    // 1) deliveryOrderId → cache-lookup
+    if (input.deliveryOrderId?.trim()) {
+        const deliveryOrderId = input.deliveryOrderId.trim();
+        const { data: cached } = await supabase
+            .from("floriday_fulfillment_orders_cache")
+            .select("floriday_id")
+            .eq("connection_id", conn.id)
+            .eq("delivery_order_id", deliveryOrderId)
+            .eq("is_deleted", false);
+        const cachedIds = (cached ?? [])
+            .map((r) => String(r.floriday_id))
+            .filter(Boolean);
+        if (cachedIds.length > 0) {
+            return { fulfillmentOrderIds: cachedIds, source: "cache" };
+        }
+        // Cache-miss → live ophalen bij Floriday
+        const ids = await fetchFulfillmentIdsForDeliveryOrder(supabase, env, deliveryOrderId);
+        if (ids.length === 0) {
+            throw new Error(`Geen fulfillment-order gevonden voor delivery-order ${deliveryOrderId}`);
+        }
+        return { fulfillmentOrderIds: ids, source: "delivery-order" };
+    }
+    // 2) salesOrderId → fulfillment-orders cache doorzoeken.
+    // In Floriday 2026v1 verwijst de fulfillment-order naar de sales-order
+    // (via loadCarriers[].loadCarrierItems[].salesOrderId), niet andersom.
+    if (input.salesOrderId?.trim()) {
+        const salesOrderId = input.salesOrderId.trim();
+        // Eerst cache raadplegen
+        let matched = await findFulfillmentIdsForSalesOrderInCache(supabase, conn.id, salesOrderId);
+        // Cache-miss? Triggert een korte on-demand delta-sync (fulfillment-orders
+        // groeit meestal met 0-enkele items per minuut) en probeer opnieuw. Zo
+        // hoeven we niet op de volgende cron-tick te wachten.
+        if (matched.length === 0) {
+            try {
+                const { runFloridayResourceSync } = await import("./floriday-sync.functions");
+                await runFloridayResourceSync(supabase, env, "fulfillment-orders");
+            }
+            catch (e) {
+                console.warn("[fulfillment-lookup] on-demand sync faalde:", e);
+            }
+            matched = await findFulfillmentIdsForSalesOrderInCache(supabase, conn.id, salesOrderId);
+        }
+        if (matched.length > 0) {
+            return { fulfillmentOrderIds: matched, source: "sales-order-cache" };
+        }
+        // Nog steeds niets. Onderscheid maken tussen "order onbekend" en
+        // "order bekend, maar Floriday heeft nog geen fulfillment aangemaakt".
+        const { data: soRow } = await supabase
+            .from("floriday_salesorders_cache")
+            .select("floriday_id")
+            .eq("connection_id", conn.id)
+            .eq("floriday_id", salesOrderId)
+            .maybeSingle();
+        if (!soRow) {
+            throw new Error(`Deze order (${salesOrderId}) is nog niet gesynchroniseerd vanuit Floriday. Probeer het over een minuut opnieuw.`);
+        }
+        throw new Error(`Floriday heeft voor deze order nog geen afleverbrief aangemaakt. Open de order in het Floriday-portaal en wijs de order toe aan een trolley of afleverronde. Zodra dat gedaan is verschijnt de afleverbrief hier automatisch (binnen ongeveer een minuut).`);
+    }
+    throw new Error("Geef ten minste één van fulfillmentOrderId, deliveryOrderId of salesOrderId op");
+}
+async function fetchFulfillmentIdsForDeliveryOrder(supabase, env, deliveryOrderId) {
+    const res = await florydayFetch(supabase, env, `/${SUPPLIERS_API_VERSION}/delivery-orders/${encodeURIComponent(deliveryOrderId)}`, { cache: "no-store" });
+    if (!res.ok) {
+        const body = await res.text().catch(() => "");
+        throw new Error(`Delivery-order ${res.status}: ${body.slice(0, 200)}`);
+    }
+    const json = await res.json();
+    const ids = [];
+    const push = (v) => {
+        if (typeof v === "string" && v)
+            ids.push(v);
+    };
+    push(json?.fulfillmentOrderId);
+    if (Array.isArray(json?.fulfillmentOrderIds)) {
+        for (const id of json.fulfillmentOrderIds)
+            push(id);
+    }
+    if (Array.isArray(json?.fulfillmentOrders)) {
+        for (const fo of json.fulfillmentOrders) {
+            push(fo?.fulfillmentOrderId ?? fo?.id);
+        }
+    }
+    return Array.from(new Set(ids));
+}
+async function findFulfillmentIdsForSalesOrderInCache(supabase, connectionId, salesOrderId) {
+    const { data: candidates } = await supabase
+        .from("floriday_fulfillment_orders_cache")
+        .select("floriday_id, data")
+        .eq("connection_id", connectionId)
+        .eq("is_deleted", false)
+        .ilike("data", `%${salesOrderId}%`);
+    const matched = new Set();
+    for (const row of candidates ?? []) {
+        const data = row.data;
+        const carriers = Array.isArray(data?.loadCarriers)
+            ? data.loadCarriers
+            : [];
+        const hit = carriers.some((lc) => Array.isArray(lc?.loadCarrierItems)
+            ? lc.loadCarrierItems.some((it) => it?.salesOrderId === salesOrderId)
+            : false);
+        if (hit) {
+            const id = String(row.floriday_id ?? data?.fulfillmentOrderId ?? "");
+            if (id)
+                matched.add(id);
+        }
+    }
+    return Array.from(matched);
+}

package/dist-lib/lib/floriday-gateway-auth.d.ts

@@ -0,0 +1,24 @@
+import type { GatewayAuthFail, GatewayAuthOk, GatewayBinaryAuthOk } from "./floriday-gateway-hmac";
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type FlorydayEnvironment } from "./floriday.functions";
+/**
+ * Resolveert welke Floriday-omgeving voor deze gateway-call gebruikt moet worden.
+ *
+ * Regels:
+ *  1. Als de caller een omgeving opgeeft én die heeft een actieve koppeling → gebruik die.
+ *  2. Anders → val terug op de in deze module actieve omgeving (`floriday_settings.active_environment`).
+ *  3. Als ook die geen actieve koppeling heeft → gooi een duidelijke fout.
+ *
+ * Op deze manier crasht de gateway niet meer wanneer een externe module `live`
+ * stuurt terwijl alleen `staging` is ingericht (of omgekeerd).
+ */
+export declare function resolveGatewayEnvironment(supabase: SupabaseClient, requested?: FlorydayEnvironment | string | null): Promise<FlorydayEnvironment>;
+export declare const GATEWAY_CORS_HEADERS: Record<string, string>;
+export declare function corsPreflight(): Response;
+export declare function withCors(response: Response): Response;
+/**
+ * Accepteert HMAC of Supabase Bearer. Retourneert de raw body voor JSON.parse.
+ */
+export declare function verifyGatewayCaller(request: Request): Promise<GatewayAuthOk | GatewayAuthFail>;
+export declare function verifyGatewayBinaryCaller(request: Request): Promise<GatewayBinaryAuthOk | GatewayAuthFail>;
+//# sourceMappingURL=floriday-gateway-auth.d.ts.map

package/dist-lib/lib/floriday-gateway-auth.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floriday-gateway-auth.d.ts","sourceRoot":"","sources":["../../src/lib/floriday-gateway-auth.ts"],"names":[],"mappings":"AAaA,OAAO,KAAK,EACV,eAAe,EACf,aAAa,EACb,mBAAmB,EACpB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,sBAAsB,CAAC;AAE9B;;;;;;;;;;GAUG;AACH,wBAAsB,yBAAyB,CAC7C,QAAQ,EAAE,cAAc,EACxB,SAAS,CAAC,EAAE,mBAAmB,GAAG,MAAM,GAAG,IAAI,GAC9C,OAAO,CAAC,mBAAmB,CAAC,CAyB9B;AAED,eAAO,MAAM,oBAAoB,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAMvD,CAAC;AAEF,wBAAgB,aAAa,IAAI,QAAQ,CAExC;AAED,wBAAgB,QAAQ,CAAC,QAAQ,EAAE,QAAQ,GAAG,QAAQ,CAQrD;AAgCD;;GAEG;AACH,wBAAsB,mBAAmB,CACvC,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,aAAa,GAAG,eAAe,CAAC,CAuB1C;AAGD,wBAAsB,yBAAyB,CAC7C,OAAO,EAAE,OAAO,GACf,OAAO,CAAC,mBAAmB,GAAG,eAAe,CAAC,CAahD"}

package/dist-lib/lib/floriday-gateway-auth.js

@@ -0,0 +1,127 @@
+// ============================================================================
+// Dual-mode auth voor de PDF-gateway routes.
+// ----------------------------------------------------------------------------
+// Accepteert:
+//   - HMAC-handtekening (server-to-server callers met shared secret), of
+//   - Supabase Bearer JWT (ingelogde gebruiker in een andere Lovable-module).
+//
+// Alleen bedoeld voor de lees-/PDF-endpoints. Schrijf-endpoints blijven
+// exclusief HMAC.
+// ============================================================================
+import { createClient } from "@supabase/supabase-js";
+import { verifyGatewayRequest, verifyGatewayBinaryRequest } from "./floriday-gateway-hmac";
+import { getActiveFlorydayCredentials, getActiveFlorydayEnvironment, } from "./floriday.functions";
+/**
+ * Resolveert welke Floriday-omgeving voor deze gateway-call gebruikt moet worden.
+ *
+ * Regels:
+ *  1. Als de caller een omgeving opgeeft én die heeft een actieve koppeling → gebruik die.
+ *  2. Anders → val terug op de in deze module actieve omgeving (`floriday_settings.active_environment`).
+ *  3. Als ook die geen actieve koppeling heeft → gooi een duidelijke fout.
+ *
+ * Op deze manier crasht de gateway niet meer wanneer een externe module `live`
+ * stuurt terwijl alleen `staging` is ingericht (of omgekeerd).
+ */
+export async function resolveGatewayEnvironment(supabase, requested) {
+    const wanted = requested === "staging" || requested === "live"
+        ? requested
+        : null;
+    if (wanted) {
+        const row = await getActiveFlorydayCredentials(supabase, wanted);
+        if (row)
+            return wanted;
+    }
+    const active = await getActiveFlorydayEnvironment(supabase);
+    const activeRow = await getActiveFlorydayCredentials(supabase, active);
+    if (!activeRow) {
+        throw new Error("Er is geen actieve Floriday-koppeling geconfigureerd. Open het beheerscherm en verbind Floriday.");
+    }
+    if (wanted && wanted !== active) {
+        console.warn(`[gateway] gevraagde omgeving "${wanted}" heeft geen actieve koppeling; val terug op "${active}"`);
+    }
+    return active;
+}
+export const GATEWAY_CORS_HEADERS = {
+    "Access-Control-Allow-Origin": "*",
+    "Access-Control-Allow-Methods": "GET, POST, OPTIONS",
+    "Access-Control-Allow-Headers": "Content-Type, Authorization, apikey, x-floriday-timestamp, x-floriday-signature, x-floriday-caller",
+    "Access-Control-Max-Age": "86400",
+};
+export function corsPreflight() {
+    return new Response(null, { status: 204, headers: GATEWAY_CORS_HEADERS });
+}
+export function withCors(response) {
+    const headers = new Headers(response.headers);
+    for (const [k, v] of Object.entries(GATEWAY_CORS_HEADERS))
+        headers.set(k, v);
+    return new Response(response.body, {
+        status: response.status,
+        statusText: response.statusText,
+        headers,
+    });
+}
+async function verifySupabaseBearer(request) {
+    const authHeader = request.headers.get("authorization");
+    if (!authHeader || !authHeader.toLowerCase().startsWith("bearer "))
+        return null;
+    const token = authHeader.slice(7).trim();
+    if (!token)
+        return null;
+    const SUPABASE_URL = process.env.SUPABASE_URL;
+    const SUPABASE_PUBLISHABLE_KEY = process.env.SUPABASE_PUBLISHABLE_KEY;
+    if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
+        return { ok: false, status: 500, error: "Supabase niet geconfigureerd op gateway" };
+    }
+    const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
+        auth: { storage: undefined, persistSession: false, autoRefreshToken: false },
+    });
+    try {
+        const { data, error } = await supabase.auth.getClaims(token);
+        if (error || !data?.claims?.sub) {
+            return { ok: false, status: 401, error: "Ongeldige of verlopen sessie" };
+        }
+        return { ok: true, userId: String(data.claims.sub) };
+    }
+    catch {
+        return { ok: false, status: 401, error: "Sessie kon niet worden geverifieerd" };
+    }
+}
+/**
+ * Accepteert HMAC of Supabase Bearer. Retourneert de raw body voor JSON.parse.
+ */
+export async function verifyGatewayCaller(request) {
+    // 1) apikey-header met publishable key (bv. pg_cron via net.http_post)?
+    const apiKey = request.headers.get("apikey");
+    if (apiKey && apiKey === process.env.SUPABASE_PUBLISHABLE_KEY) {
+        const rawBody = await request.text();
+        return { ok: true, caller: "cron:pg_cron", rawBody };
+    }
+    // 2) Supabase Bearer? Dan die weg gebruiken.
+    const bearer = await verifySupabaseBearer(request);
+    if (bearer && bearer.ok) {
+        const rawBody = await request.text();
+        return { ok: true, caller: `user:${bearer.userId}`, rawBody };
+    }
+    if (bearer && !bearer.ok) {
+        const hasHmac = request.headers.get("x-floriday-signature") &&
+            request.headers.get("x-floriday-timestamp");
+        if (!hasHmac)
+            return bearer;
+    }
+    // 3) Val terug op HMAC.
+    return verifyGatewayRequest(request);
+}
+export async function verifyGatewayBinaryCaller(request) {
+    const bearer = await verifySupabaseBearer(request);
+    if (bearer && bearer.ok) {
+        const bodyBytes = new Uint8Array(await request.arrayBuffer());
+        return { ok: true, caller: `user:${bearer.userId}`, bodyBytes };
+    }
+    if (bearer && !bearer.ok) {
+        const hasHmac = request.headers.get("x-floriday-signature") &&
+            request.headers.get("x-floriday-timestamp");
+        if (!hasHmac)
+            return bearer;
+    }
+    return verifyGatewayBinaryRequest(request);
+}