@flowselections/floriday-authenticatie-module 1.0.31 → 1.0.36

package/dist-lib/integrations/supabase/types.js

@@ -8,18 +8,7 @@ export const Constants = {
                 "klaar",
                 "mislukt",
             ],
-            app_role: [
-                "admin",
-                "manager",
-                "warehouse",
-                "sales",
-                "developer",
-                "receptie",
-                "monteur",
-                "planner",
-                "administratie",
-                "ai_admin",
-            ],
+            app_role: ["admin", "planner", "monteur", "administratie", "ai_admin"],
             doc_layout_type: [
                 "pakbon",
                 "factuur",

package/dist-lib/lib/central-auth.server.d.ts

@@ -2,6 +2,9 @@ export type CentralFlorydayTokenResult = {
     ok: true;
     access_token: string;
     expires_at: string;
+    reauthorize_required?: boolean;
+    missing_scopes?: string[];
+    scope_state?: string | null;
     raw: {
         status: number;
         body: string;
@@ -13,7 +16,29 @@ export type CentralFlorydayTokenResult = {
         body: string;
     };
 };
-export declare function getFlorydayTokenFromCentral(environment: "staging" | "live", scope: string): Promise<CentralFlorydayTokenResult>;
+export declare function getFlorydayTokenFromCentral(environment: "staging" | "live", scope?: string, accountKey?: string): Promise<CentralFlorydayTokenResult>;
+export type CentralAccountsResult = {
+    ok: true;
+    accounts: any[];
+    raw: {
+        status: number;
+        body: string;
+    };
+} | {
+    ok: false;
+    raw: {
+        status: number;
+        body: string;
+    };
+};
+export declare function getFlorydayAccountsFromCentral(environment: "staging" | "live"): Promise<CentralAccountsResult>;
+export declare function revokeFlorydayAtCentral(environment: "staging" | "live", accountKey?: string): Promise<{
+    ok: boolean;
+    raw: {
+        status: number;
+        body: string;
+    };
+}>;
 export type CentralSecretResult = {
     ok: true;
     secret_name: string;

package/dist-lib/lib/central-auth.server.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"central-auth.server.d.ts","sourceRoot":"","sources":["../../src/lib/central-auth.server.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,0BAA0B,GAClC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAAC;AAEN,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,SAAS,GAAG,MAAM,EAC/B,KAAK,EAAE,MAAM,GACZ,OAAO,CAAC,0BAA0B,CAAC,CAwDrC;AAkBD,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAAC;AAEN,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAgD9B"}
+{"version":3,"file":"central-auth.server.d.ts","sourceRoot":"","sources":["../../src/lib/central-auth.server.ts"],"names":[],"mappings":"AAoBA,MAAM,MAAM,0BAA0B,GAClC;IACE,EAAE,EAAE,IAAI,CAAC;IACT,YAAY,EAAE,MAAM,CAAC;IACrB,UAAU,EAAE,MAAM,CAAC;IACnB,oBAAoB,CAAC,EAAE,OAAO,CAAC;IAC/B,cAAc,CAAC,EAAE,MAAM,EAAE,CAAC;IAC1B,WAAW,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5B,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAAC;AAON,wBAAsB,2BAA2B,CAC/C,WAAW,EAAE,SAAS,GAAG,MAAM,EAC/B,KAAK,CAAC,EAAE,MAAM,EACd,UAAU,SAAY,GACrB,OAAO,CAAC,0BAA0B,CAAC,CAmFrC;AAOD,MAAM,MAAM,qBAAqB,GAC7B;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,EAAE,GAAG,EAAE,CAAC;IAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,GACpE;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC;AAEzD,wBAAsB,8BAA8B,CAClD,WAAW,EAAE,SAAS,GAAG,MAAM,GAC9B,OAAO,CAAC,qBAAqB,CAAC,CA4BhC;AAED,wBAAsB,uBAAuB,CAC3C,WAAW,EAAE,SAAS,GAAG,MAAM,EAC/B,UAAU,SAAY,GACrB,OAAO,CAAC;IAAE,EAAE,EAAE,OAAO,CAAC;IAAC,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,CAAC,CAuBjE;AAmBD,MAAM,MAAM,mBAAmB,GAC3B;IACE,EAAE,EAAE,IAAI,CAAC;IACT,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,GACD;IACE,EAAE,EAAE,KAAK,CAAC;IACV,GAAG,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC;CACvC,CAAC;AAEN,wBAAsB,oBAAoB,CACxC,IAAI,EAAE,MAAM,GACX,OAAO,CAAC,mBAAmB,CAAC,CAgD9B"}

package/dist-lib/lib/central-auth.server.js

@@ -17,13 +17,23 @@
 //
 // NIET importeren vanuit client-code. De .server.ts-suffix houdt dit bestand
 // buiten de client-bundle (zoals bij client.server.ts).
-export async function getFlorydayTokenFromCentral(environment, scope) {
+/** Verwijdert de tokenwaarde uit een central-body vóór logging. */
+function redactTokenBody(body) {
+    return body.replace(/("access_token"\s*:\s*")[^"]*(")/g, "$1<redacted>$2").slice(0, 500);
+}
+export async function getFlorydayTokenFromCentral(environment, scope, accountKey = "default") {
     const baseUrl = process.env.CENTRAL_AUTH_URL;
     const secret = process.env.CENTRAL_AUTH_SECRET;
     if (!baseUrl || !secret) {
         throw new Error("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
     }
     const url = `${baseUrl.replace(/\/+$/, "")}/api/token/floriday`;
+    // Contract van Central Auth: environment + account_key zijn verplicht in de
+    // praktijk (staging en live zijn aparte connecties). `scope` alleen meesturen
+    // wanneer er expliciet een smallere set dan de standaard wordt gevraagd.
+    const payload = { environment, account_key: accountKey };
+    if (scope)
+        payload.scope = scope;
     // Netwerkfout (fetch throwt vóór er een response is) → doorgooien, er is
     // geen raw om te retourneren. Alle andere paden gaan via raw.
     const res = await fetch(url, {
@@ -32,7 +42,7 @@ export async function getFlorydayTokenFromCentral(environment, scope) {
             Authorization: `Bearer ${secret}`,
             "Content-Type": "application/json",
         },
-        body: JSON.stringify({ environment, scope }),
+        body: JSON.stringify(payload),
     });
     // Response ALTIJD eerst als tekst lezen — raw.body moet op elk pad gevuld
     // zijn (2xx én niet-ok). Bij niet-ok is dit het enige wat stap B heeft om
@@ -40,6 +50,7 @@ export async function getFlorydayTokenFromCentral(environment, scope) {
     // { "error": "upstream_error" }).
     const text = await res.text();
     const raw = { status: res.status, body: text };
+    console.log(`[central-auth] POST /api/token/floriday env=${environment} -> ${res.status} ${redactTokenBody(text)}`);
     if (!res.ok) {
         return { ok: false, raw };
     }
@@ -61,7 +72,62 @@ export async function getFlorydayTokenFromCentral(environment, scope) {
     if (!expires_at) {
         return { ok: false, raw };
     }
-    return { ok: true, access_token: json.access_token, expires_at, raw };
+    return {
+        ok: true,
+        access_token: json.access_token,
+        expires_at,
+        reauthorize_required: typeof json.reauthorize_required === "boolean" ? json.reauthorize_required : false,
+        missing_scopes: Array.isArray(json.missing_scopes)
+            ? json.missing_scopes.filter((s) => typeof s === "string")
+            : [],
+        scope_state: typeof json.scope_state === "string" ? json.scope_state : null,
+        raw,
+    };
+}
+export async function getFlorydayAccountsFromCentral(environment) {
+    const baseUrl = process.env.CENTRAL_AUTH_URL;
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!baseUrl || !secret) {
+        throw new Error("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/accounts/floriday?environment=${encodeURIComponent(environment)}`;
+    const res = await fetch(url, {
+        method: "GET",
+        headers: { Authorization: `Bearer ${secret}` },
+    });
+    const text = await res.text();
+    const raw = { status: res.status, body: text };
+    console.log(`[central-auth] GET /api/accounts/floriday env=${environment} -> ${res.status} ${text.slice(0, 500)}`);
+    if (!res.ok)
+        return { ok: false, raw };
+    try {
+        const json = JSON.parse(text);
+        if (!Array.isArray(json.accounts))
+            return { ok: false, raw };
+        return { ok: true, accounts: json.accounts, raw };
+    }
+    catch {
+        return { ok: false, raw };
+    }
+}
+export async function revokeFlorydayAtCentral(environment, accountKey = "default") {
+    const baseUrl = process.env.CENTRAL_AUTH_URL;
+    const secret = process.env.CENTRAL_AUTH_SECRET;
+    if (!baseUrl || !secret) {
+        throw new Error("Missing CENTRAL_AUTH_URL or CENTRAL_AUTH_SECRET environment variable.");
+    }
+    const url = `${baseUrl.replace(/\/+$/, "")}/api/revoke/floriday`;
+    const res = await fetch(url, {
+        method: "POST",
+        headers: {
+            Authorization: `Bearer ${secret}`,
+            "Content-Type": "application/json",
+        },
+        body: JSON.stringify({ account_key: accountKey, environment }),
+    });
+    const text = await res.text();
+    console.log(`[central-auth] POST /api/revoke/floriday env=${environment} -> ${res.status} ${text.slice(0, 500)}`);
+    return { ok: res.ok, raw: { status: res.status, body: text } };
 }
 export async function getSecretFromCentral(name) {
     const baseUrl = process.env.CENTRAL_AUTH_URL;

package/dist-lib/lib/cron/index.d.ts

@@ -32,4 +32,5 @@ export { handleRefreshFloricodeCodelists } from "./refresh-floricode-codelists.j
 export { handleRefreshFlorydayReferenceData } from "./refresh-floriday-reference-data.js";
 export { handleRefreshFlorydayTokens } from "./refresh-floriday-tokens.js";
 export { handleVerifyFloricodeCharacteristicsCoverage } from "./verify-floricode-characteristics-coverage.js";
+export { handleProcessStockQueue, runStockQueueRound, maybeTickStockQueue } from "./process-stock-queue.js";
 //# sourceMappingURL=index.d.ts.map

package/dist-lib/lib/cron/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/cron/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,eAAO,MAAM,4BAA4B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AACrD,eAAO,MAAM,mBAAmB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AAC5C,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAC1B,CAAC;AAC7C,eAAO,MAAM,gCAAgC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACxB,CAAC;AAC1D,eAAO,MAAM,iCAAiC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACvB,CAAC;AAC5D,eAAO,MAAM,+BAA+B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACxB,CAAC;AACzD,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AAC9C,eAAO,MAAM,yBAAyB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AAGlD,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AACvE,eAAO,MAAM,kBAAkB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACH,CAAC;AACjE,eAAO,MAAM,mBAAmB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACH,CAAC;AAClE,eAAO,MAAM,+BAA+B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC/E,eAAO,MAAM,0BAA0B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC1E,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC3E,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AACrE,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAGpE,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACvD,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACvD,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACxD,eAAO,MAAM,kBAAkB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACnB,CAAC;AACjD,eAAO,MAAM,gCAAgC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACjB,CAAC;AACjE,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACnB,CAAC;AAGnD,eAAO,MAAM,6BAA6B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAC9C,CAAC;AAGjC,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAC;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4CAA4C,EAAE,MAAM,gDAAgD,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/cron/index.ts"],"names":[],"mappings":"AAQA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAK5D,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,EAAE,yBAAyB,EAAE,MAAM,4BAA4B,CAAC;AACvE,OAAO,EAAE,qBAAqB,EAAE,MAAM,uBAAuB,CAAC;AAI9D,eAAO,MAAM,4BAA4B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AACrD,eAAO,MAAM,mBAAmB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAA8C,CAAC;AACnH,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAA+C,CAAC;AACtH,eAAO,MAAM,gCAAgC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACxB,CAAC;AAC1D,eAAO,MAAM,iCAAiC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACvB,CAAC;AAC5D,eAAO,MAAM,+BAA+B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACxB,CAAC;AACzD,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAAgD,CAAC;AACvH,eAAO,MAAM,yBAAyB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACzB,CAAC;AAGlD,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AACvE,eAAO,MAAM,kBAAkB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACH,CAAC;AACjE,eAAO,MAAM,mBAAmB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACH,CAAC;AAClE,eAAO,MAAM,+BAA+B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC/E,eAAO,MAAM,0BAA0B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC1E,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAC3E,eAAO,MAAM,qBAAqB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AACrE,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACF,CAAC;AAGpE,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACvD,eAAO,MAAM,uBAAuB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACvD,eAAO,MAAM,2BAA2B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AAC3D,eAAO,MAAM,wBAAwB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAClB,CAAC;AACxD,eAAO,MAAM,kBAAkB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAAmD,CAAC;AACvH,eAAO,MAAM,gCAAgC,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACjB,CAAC;AACjE,eAAO,MAAM,oBAAoB,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBACnB,CAAC;AAGnD,eAAO,MAAM,6BAA6B,GAAI,KAAK,OAAO,EAAE,IAAI,cAAc,sBAAmC,CAAC;AAGlH,OAAO,EAAE,sBAAsB,EAAE,MAAM,yBAAyB,CAAC;AACjE,OAAO,EAAE,qCAAqC,EAAE,MAAM,yCAAyC,CAAC;AAChG,OAAO,EAAE,+BAA+B,EAAE,MAAM,kCAAkC,CAAC;AACnF,OAAO,EAAE,kCAAkC,EAAE,MAAM,sCAAsC,CAAC;AAC1F,OAAO,EAAE,2BAA2B,EAAE,MAAM,8BAA8B,CAAC;AAC3E,OAAO,EAAE,4CAA4C,EAAE,MAAM,gDAAgD,CAAC;AAC9G,OAAO,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,0BAA0B,CAAC"}

package/dist-lib/lib/cron/index.js

@@ -47,3 +47,4 @@ export { handleRefreshFloricodeCodelists } from "./refresh-floricode-codelists.j
 export { handleRefreshFlorydayReferenceData } from "./refresh-floriday-reference-data.js";
 export { handleRefreshFlorydayTokens } from "./refresh-floriday-tokens.js";
 export { handleVerifyFloricodeCharacteristicsCoverage } from "./verify-floricode-characteristics-coverage.js";
+export { handleProcessStockQueue, runStockQueueRound, maybeTickStockQueue } from "./process-stock-queue.js";

package/dist-lib/lib/cron/process-stock-queue.d.ts

@@ -0,0 +1,43 @@
+import type { SupabaseClient } from "@supabase/supabase-js";
+import { type FlorydayEnvironment } from "../floriday.functions.js";
+type StockQueueRow = {
+    id: string;
+    connection_id: string;
+    trade_item_id: string;
+    number_of_pieces: number | null;
+    desired_available: boolean | null;
+    attempts: number | null;
+};
+/** ISO-weeknummer van vandaag. */
+export declare function isoWeekParts(input?: string | Date): {
+    year: number;
+    week: number;
+};
+/** Tijdelijk (netwerk/5xx/429) versus definitief (gegevensfout). */
+export declare function isPermanentError(message: string): boolean;
+export declare function isRateLimited(message: string): boolean;
+type PushOutcome = {
+    ok: boolean;
+    permanent?: boolean;
+    error?: string;
+    attemptId?: string | null;
+    quantitySkipped?: string;
+};
+/** Zet één wachtrijregel door naar Floriday. Gooit nooit. */
+export declare function pushStockRow(supabase: SupabaseClient, env: FlorydayEnvironment, row: StockQueueRow): Promise<PushOutcome>;
+/** Eén verwerkingsronde. Retourneert een compacte samenvatting. */
+export declare function runStockQueueRound(supabase: SupabaseClient, limit?: number): Promise<{
+    ok: true;
+    claimed: number;
+    succeeded: number;
+    failed: number;
+    rateLimited: boolean;
+}>;
+/**
+ * Cron-handler, zelfde vorm en beveiliging als de overige cron-routes:
+ * `apikey`-header moet gelijk zijn aan `SUPABASE_PUBLISHABLE_KEY`.
+ */
+export declare function handleProcessStockQueue(request: Request, supabase: SupabaseClient): Promise<Response>;
+export declare function maybeTickStockQueue(supabase: SupabaseClient): void;
+export {};
+//# sourceMappingURL=process-stock-queue.d.ts.map

package/dist-lib/lib/cron/process-stock-queue.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"process-stock-queue.d.ts","sourceRoot":"","sources":["../../../src/lib/cron/process-stock-queue.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAGL,KAAK,mBAAmB,EACzB,MAAM,0BAA0B,CAAC;AAIlC,KAAK,aAAa,GAAG;IACnB,EAAE,EAAE,MAAM,CAAC;IACX,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,gBAAgB,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,iBAAiB,EAAE,OAAO,GAAG,IAAI,CAAC;IAClC,QAAQ,EAAE,MAAM,GAAG,IAAI,CAAC;CACzB,CAAC;AAEF,kCAAkC;AAClC,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAYlF;AAED,oEAAoE;AACpE,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CASzD;AAED,wBAAgB,aAAa,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAEtD;AAmCD,KAAK,WAAW,GAAG;IACjB,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,eAAe,CAAC,EAAE,MAAM,CAAC;CAC1B,CAAC;AAEF,6DAA6D;AAC7D,wBAAsB,YAAY,CAChC,QAAQ,EAAE,cAAc,EACxB,GAAG,EAAE,mBAAmB,EACxB,GAAG,EAAE,aAAa,GACjB,OAAO,CAAC,WAAW,CAAC,CA6FtB;AAED,mEAAmE;AACnE,wBAAsB,kBAAkB,CACtC,QAAQ,EAAE,cAAc,EACxB,KAAK,SAAa,GACjB,OAAO,CAAC;IACT,EAAE,EAAE,IAAI,CAAC;IACT,OAAO,EAAE,MAAM,CAAC;IAChB,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,OAAO,CAAC;CACtB,CAAC,CA4CD;AAED;;;GAGG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiBnB;AAOD,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,cAAc,GAAG,IAAI,CAOlE"}

package/dist-lib/lib/cron/process-stock-queue.js

@@ -0,0 +1,218 @@
+// ============================================================================
+// Vaste verwerker voor de Floriday-voorraadwachtrij.
+// ----------------------------------------------------------------------------
+// Deze module neemt de voorraadsync volledig over van de voorraadmodule.
+// Werkwijze per ronde:
+//   1. `claim_floriday_stock_queue` claimt atomair max. N regels (lock 5 min).
+//   2. Per regel: werkelijk aantal stuks (weekaanbod) + beschikbaarheids-
+//      schakelaar via `florydayWrite` — dus met de tokens van deze module.
+//   3. `complete_floriday_stock_queue` schrijft het resultaat terug met
+//      exponentiële backoff (1 → 30 min, max 8 pogingen) en onderscheid
+//      tussen tijdelijke en definitieve fouten.
+// Bij een snelheidslimiet (429) breekt de ronde af; de volgende cron-tick
+// pakt het weer op.
+// ============================================================================
+import { florydayWrite, getActiveFlorydayEnvironment, } from "../floriday.functions.js";
+const BATCH_SIZE = 25;
+/** ISO-weeknummer van vandaag. */
+export function isoWeekParts(input) {
+    const parsed = input ? new Date(input) : new Date();
+    const source = Number.isNaN(parsed.getTime()) ? new Date() : parsed;
+    const date = new Date(Date.UTC(source.getUTCFullYear(), source.getUTCMonth(), source.getUTCDate()));
+    const day = date.getUTCDay() || 7;
+    date.setUTCDate(date.getUTCDate() + 4 - day);
+    const year = date.getUTCFullYear();
+    const yearStart = new Date(Date.UTC(year, 0, 1));
+    const week = Math.ceil(((date.getTime() - yearStart.getTime()) / 86400000 + 1) / 7);
+    return { year, week };
+}
+/** Tijdelijk (netwerk/5xx/429) versus definitief (gegevensfout). */
+export function isPermanentError(message) {
+    const m = message.toLowerCase();
+    if (/\b(429|500|502|503|504)\b/.test(m))
+        return false;
+    if (/timeout|timed out|network|fetch failed|econn|socket|rate limit|too many requests/.test(m)) {
+        return false;
+    }
+    if (/\b(400|401|403|404|409|422)\b/.test(m))
+        return true;
+    if (/unauthorized|forbidden|not found|validation|invalid/.test(m))
+        return true;
+    return false;
+}
+export function isRateLimited(message) {
+    return /\b429\b|rate limit|too many requests/i.test(message);
+}
+async function resolveWarehouseId(supabase, connectionId, tradeItemId, cachedItem) {
+    const { data: pref } = await supabase
+        .from("trade_item_warehouse_preferences")
+        .select("warehouse_id")
+        .eq("connection_id", connectionId)
+        .eq("trade_item_id", tradeItemId)
+        .maybeSingle();
+    const direct = pref?.warehouse_id ?? cachedItem?.warehouseId ?? cachedItem?.warehouse?.warehouseId;
+    if (direct)
+        return direct;
+    const { data: whs } = await supabase
+        .from("floriday_warehouses_cache")
+        .select("floriday_id, data")
+        .eq("connection_id", connectionId)
+        .limit(200);
+    const own = (whs ?? []).filter((w) => w?.data?.isDeleted !== true &&
+        w?.data?.isExternal !== true &&
+        w?.data?.hasAccess !== false);
+    const chosen = own.find((w) => w?.data?.isDefault === true) ?? own[0];
+    return chosen?.floriday_id ?? chosen?.data?.warehouseId;
+}
+/** Zet één wachtrijregel door naar Floriday. Gooit nooit. */
+export async function pushStockRow(supabase, env, row) {
+    const pieces = Math.max(0, Number(row.number_of_pieces ?? 0) || 0);
+    const available = row.desired_available ?? pieces > 0;
+    try {
+        const { data: cached } = await supabase
+            .from("floriday_trade_items_cache")
+            .select("data")
+            .eq("connection_id", row.connection_id)
+            .eq("floriday_id", row.trade_item_id)
+            .maybeSingle();
+        if (!cached) {
+            return {
+                ok: false,
+                permanent: true,
+                error: "Dit artikel staat nog niet in de lokale Floriday-cache. Synchroniseer de artikelen en probeer opnieuw.",
+            };
+        }
+        const item = cached.data ?? {};
+        const warehouseId = await resolveWarehouseId(supabase, row.connection_id, row.trade_item_id, item);
+        // 1. Werkelijk aantal stuks via het weekaanbod van de lopende week.
+        const { year, week } = isoWeekParts();
+        const { data: supply } = await supabase
+            .from("trade_item_supply_lines")
+            .select("price_per_piece, currency")
+            .eq("connection_id", row.connection_id)
+            .eq("trade_item_id", row.trade_item_id)
+            .order("updated_at", { ascending: false })
+            .limit(1)
+            .maybeSingle();
+        const pricePerPiece = Number(supply?.price_per_piece ?? NaN);
+        let quantitySkipped;
+        if (Number.isFinite(pricePerPiece) && pricePerPiece > 0) {
+            const qty = await florydayWrite(supabase, env, {
+                module: "inventory",
+                action: "edit-weekly-base-supply",
+                method: "PUT",
+                path: `/suppliers-api-2026v1/trade-items/${row.trade_item_id}/base-supply/${year}/${week}`,
+                referenceId: row.trade_item_id,
+                idempotencyKey: `inventory:weekly-base-supply:${row.trade_item_id}:${year}:${week}:${pieces}`,
+                body: {
+                    basePricePerPiece: {
+                        currency: supply?.currency ?? "EUR",
+                        value: pricePerPiece,
+                    },
+                    numberOfPieces: pieces,
+                },
+            });
+            if (!qty.ok) {
+                const message = qty.error ?? `HTTP ${qty.status}`;
+                return { ok: false, permanent: isPermanentError(message), error: message };
+            }
+        }
+        else {
+            quantitySkipped =
+                "Aantal niet doorgezet: er is nog geen prijs bekend voor dit artikel.";
+        }
+        // 2. Beschikbaarheidsschakelaar.
+        const body = { available };
+        if (warehouseId)
+            body.warehouseId = warehouseId;
+        const res = await florydayWrite(supabase, env, {
+            module: "inventory",
+            action: "publish-continuous-stock",
+            method: "PUT",
+            path: `/suppliers-api-2026v1/trade-items/${row.trade_item_id}/continuous-stock`,
+            referenceId: row.trade_item_id,
+            idempotencyKey: `inventory:continuous-stock:${row.trade_item_id}:${available}:${pieces}`,
+            body,
+        });
+        if (!res.ok) {
+            const message = res.error ?? `HTTP ${res.status}`;
+            return { ok: false, permanent: isPermanentError(message), error: message };
+        }
+        return { ok: true, attemptId: res.attemptId ?? null, quantitySkipped };
+    }
+    catch (e) {
+        const message = e instanceof Error ? e.message : String(e);
+        return { ok: false, permanent: isPermanentError(message), error: message };
+    }
+}
+/** Eén verwerkingsronde. Retourneert een compacte samenvatting. */
+export async function runStockQueueRound(supabase, limit = BATCH_SIZE) {
+    const env = await getActiveFlorydayEnvironment(supabase);
+    const { data: claimed, error } = await supabase.rpc("claim_floriday_stock_queue", { p_limit: limit, p_worker: "auth-module" });
+    if (error)
+        throw new Error(error.message);
+    const rows = (claimed ?? []);
+    let succeeded = 0;
+    let failed = 0;
+    let rateLimited = false;
+    for (const row of rows) {
+        if (rateLimited) {
+            // Ronde afgebroken: regel meteen vrijgeven voor de volgende tick.
+            await supabase.rpc("complete_floriday_stock_queue", {
+                p_id: row.id,
+                p_ok: false,
+                p_error: "Snelheidslimiet van Floriday bereikt; volgende ronde opnieuw.",
+                p_permanent: false,
+                p_attempt_id: null,
+            });
+            continue;
+        }
+        const outcome = await pushStockRow(supabase, env, row);
+        if (outcome.ok)
+            succeeded += 1;
+        else {
+            failed += 1;
+            if (outcome.error && isRateLimited(outcome.error))
+                rateLimited = true;
+        }
+        await supabase.rpc("complete_floriday_stock_queue", {
+            p_id: row.id,
+            p_ok: outcome.ok,
+            p_error: outcome.ok ? outcome.quantitySkipped ?? null : outcome.error ?? "Onbekende fout",
+            p_permanent: outcome.permanent ?? false,
+            p_attempt_id: outcome.attemptId ?? null,
+        });
+    }
+    return { ok: true, claimed: rows.length, succeeded, failed, rateLimited };
+}
+/**
+ * Cron-handler, zelfde vorm en beveiliging als de overige cron-routes:
+ * `apikey`-header moet gelijk zijn aan `SUPABASE_PUBLISHABLE_KEY`.
+ */
+export async function handleProcessStockQueue(request, supabase) {
+    const apikey = request.headers.get("apikey") ?? request.headers.get("x-api-key");
+    const expected = process.env.SUPABASE_PUBLISHABLE_KEY;
+    if (!expected || !apikey || apikey !== expected) {
+        return new Response("Unauthorized", { status: 401 });
+    }
+    try {
+        const summary = await runStockQueueRound(supabase);
+        return Response.json(summary);
+    }
+    catch (e) {
+        console.error("[stock-queue] ronde mislukt:", e?.message ?? e);
+        return Response.json({ ok: false, error: e?.message ?? "Onbekende fout" }, { status: 500 });
+    }
+}
+/**
+ * Vangnet: mag vanuit gewoon verkeer worden aangeroepen (fire-and-forget).
+ * Draait hoogstens één ronde per minuut per instantie.
+ */
+let lastTick = 0;
+export function maybeTickStockQueue(supabase) {
+    const now = Date.now();
+    if (now - lastTick < 60000)
+        return;
+    lastTick = now;
+    void runStockQueueRound(supabase, 10).catch((e) => console.warn("[stock-queue] vangnet-ronde mislukt:", e?.message ?? e));
+}

package/dist-lib/lib/cron/refresh-floriday-tokens.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"refresh-floriday-tokens.d.ts","sourceRoot":"","sources":["../../../src/lib/cron/refresh-floriday-tokens.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AA8D5D,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAmHnB"}
+{"version":3,"file":"refresh-floriday-tokens.d.ts","sourceRoot":"","sources":["../../../src/lib/cron/refresh-floriday-tokens.ts"],"names":[],"mappings":"AAYA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAE5D,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAqBnB"}

package/dist-lib/lib/cron/refresh-floriday-tokens.js

@@ -1,151 +1,30 @@
-import { FLORYDAY_STANDARD_SCOPE } from "../floriday-scopes.js";
-const FLORYDAY_ENDPOINTS = {
-    staging: "https://idm.staging.floriday.io/oauth2/ausmw6b47z1BnlHkw0h7/v1/token",
-    live: "https://idm.floriday.io/oauth2/aus3testdcf2vyfs70i7/v1/token",
-};
-// De algemene token-refresh gebruikt alleen basisrechten. Module-specifieke
-// rechten worden pas aangevraagd wanneer die module daadwerkelijk synchroniseert.
-const DEFAULT_SCOPE = FLORYDAY_STANDARD_SCOPE;
-const REFRESH_WINDOW_MS = 2 * 60 * 60 * 1000;
-function sanitize(input) {
-    if (!input)
-        return "";
-    let s = String(input).normalize("NFKC");
-    s = s.replace(/[\u200B-\u200D\uFEFF]/g, "");
-    s = s.replace(/[\u202A-\u202E\u2066-\u2069]/g, "");
-    s = s.replace(/[\u00A0\u2007\u202F]/g, " ");
-    s = s.replace(/[\u2018\u2019]/g, "'").replace(/[\u201C\u201D]/g, '"');
-    s = s.replace(/[\u0000-\u001F\u007F]/g, "");
-    return s.trim();
-}
-async function refreshOne(admin, row) {
-    const res = await fetch(FLORYDAY_ENDPOINTS[row.environment], {
-        method: "POST",
-        headers: {
-            "Content-Type": "application/x-www-form-urlencoded",
-            Accept: "application/json",
-        },
-        body: new URLSearchParams({
-            grant_type: "client_credentials",
-            client_id: sanitize(row.client_id),
-            client_secret: sanitize(row.client_secret),
-            scope: DEFAULT_SCOPE,
-        }).toString(),
-    });
-    const text = await res.text();
-    if (!res.ok) {
-        throw new Error(`Token request failed [${res.status}]: ${text.slice(0, 200)}`);
-    }
-    const json = JSON.parse(text);
-    const newExpiresAt = new Date(Date.now() + json.expires_in * 1000).toISOString();
-    const { error } = await admin
-        .from("floriday_connections")
-        .update({ access_token: json.access_token, token_expires_at: newExpiresAt })
-        .eq("id", row.id);
-    if (error)
-        throw new Error(`DB update failed: ${error.message}`);
-    return { id: row.id, environment: row.environment, expires_at: newExpiresAt };
-}
+// ============================================================================
+// refresh-floriday-tokens — bewust een no-op-statusendpoint.
+// ----------------------------------------------------------------------------
+// Central Auth is de token-broker: die cachet tokens en grant automatisch een
+// nieuw token zodra het verloopt. Deze module doet daarom zelf géén grant bij
+// Floriday, bewaart geen tokens en heeft geen eigen refresh-timer.
+//
+// De route en het serverRoutes-manifest blijven bestaan zodat shells die deze
+// cron al hebben ingeplanned niet breken; de handler bevestigt alleen dat er
+// niets te doen is en ruimt oude logregels op.
+// ============================================================================
 export async function handleRefreshFlorydayTokens(request, supabase) {
-    console.log("[cron] refresh-floriday-tokens start");
-    try {
-        // Authenticate with Supabase anon key (cron uses apikey header).
-        const apikey = request.headers.get("apikey") ?? request.headers.get("x-api-key");
-        const expected = process.env.SUPABASE_PUBLISHABLE_KEY;
-        if (!expected || !apikey || apikey !== expected) {
-            return new Response("Unauthorized", { status: 401 });
-        }
-        const supabaseAdmin = supabase;
-        const { data: rows, error } = await supabaseAdmin
-            .from("floriday_connections")
-            .select("id, environment, client_id, client_secret, token_expires_at")
-            .eq("is_active", true);
-        if (error) {
-            await supabaseAdmin.from("floriday_token_refresh_log").insert({
-                connection_id: null,
-                environment: "staging",
-                ok: false,
-                error: `DB select failed: ${error.message}`.slice(0, 500),
-            });
-            return Response.json({ ok: false, error: error.message }, { status: 500 });
-        }
-        const now = Date.now();
-        const due = (rows ?? []).filter((r) => {
-            if (!r.client_id || !r.client_secret)
-                return false;
-            if (!r.token_expires_at)
-                return true;
-            return Date.parse(r.token_expires_at) - now < REFRESH_WINDOW_MS;
-        });
-        const results = [];
-        if (due.length === 0 && (rows?.length ?? 0) > 0) {
-            await supabaseAdmin.from("floriday_token_refresh_log").insert({
-                connection_id: rows[0].id,
-                environment: rows[0].environment,
-                ok: true,
-                expires_at: rows[0].token_expires_at,
-                error: "heartbeat: nog niet binnen refresh-window",
-            });
-        }
-        for (const r of due) {
-            try {
-                const out = await refreshOne(supabaseAdmin, {
-                    id: r.id,
-                    environment: r.environment,
-                    client_id: r.client_id,
-                    client_secret: r.client_secret,
-                });
-                results.push({ ...out, ok: true });
-                await supabaseAdmin.from("floriday_token_refresh_log").insert({
-                    connection_id: r.id,
-                    environment: r.environment,
-                    ok: true,
-                    expires_at: out.expires_at,
-                });
-            }
-            catch (e) {
-                const msg = e?.message ?? "Onbekende fout";
-                results.push({
-                    id: r.id,
-                    environment: r.environment,
-                    ok: false,
-                    error: msg,
-                });
-                await supabaseAdmin.from("floriday_token_refresh_log").insert({
-                    connection_id: r.id,
-                    environment: r.environment,
-                    ok: false,
-                    error: String(msg).slice(0, 500),
-                });
-            }
-        }
-        await supabaseAdmin
-            .from("floriday_token_refresh_log")
-            .delete()
-            .lt("attempted_at", new Date(Date.now() - 14 * 24 * 60 * 60 * 1000).toISOString());
-        return Response.json({
-            ok: true,
-            checked: rows?.length ?? 0,
-            refreshed: results.filter((r) => r.ok).length,
-            failed: results.filter((r) => !r.ok).length,
-            results,
-        });
-    }
-    catch (e) {
-        const msg = String(e?.message ?? e);
-        console.error("[cron] refresh-floriday-tokens crashed:", msg);
-        // best-effort log
-        try {
-            await supabase.from("floriday_token_refresh_log").insert({
-                connection_id: null,
-                environment: "staging",
-                ok: false,
-                error: `handler crash: ${msg}`.slice(0, 500),
-            });
-        }
-        catch {
-            // ignore
-        }
-        return Response.json({ ok: false, error: msg }, { status: 500 });
+    // Zelfde beveiliging als de overige cron-routes.
+    const apikey = request.headers.get("apikey") ?? request.headers.get("x-api-key");
+    const expected = process.env.SUPABASE_PUBLISHABLE_KEY;
+    if (!expected || !apikey || apikey !== expected) {
+        return new Response("Unauthorized", { status: 401 });
     }
+    // Opruimen van de historie blijft nuttig voor de statusweergave.
+    await supabase
+        .from("floriday_token_refresh_log")
+        .delete()
+        .lt("attempted_at", new Date(Date.now() - 14 * 24 * 60 * 60 * 1000).toISOString())
+        .then(() => undefined, () => undefined);
+    return Response.json({
+        ok: true,
+        skipped: true,
+        reason: "Tokens worden door Central Auth beheerd; deze module vernieuwt niets zelf.",
+    });
 }