@flowselections/floriday-authenticatie-module 1.0.53 → 1.0.55

package/dist-lib/lib/gateway/floriday-get.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"floriday-get.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/floriday-get.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,eAAO,MAAM,uBAAuB;;;;CAInC,CAAC;AAEF,uEAAuE;AACvE,eAAO,MAAM,0BAA0B;;;;CAItC,CAAC;AAWF,QAAA,MAAM,aAAa;;;;iBAIjB,CAAC;AAMH,MAAM,MAAM,iBAAiB,GACzB;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GACzD;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7G,KAAK,OAAO,GAAG;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC9B,MAAM,EAAE;QAAE,MAAM,EAAE,MAAM,CAAC;QAAC,QAAQ,EAAE,MAAM,CAAC;QAAC,YAAY,EAAE,MAAM,CAAA;KAAE,CAAC;CACpE,CAAC;AAEF,oFAAoF;AACpF,wBAAgB,uBAAuB,CACrC,GAAG,EAAE,CAAC,CAAC,KAAK,CAAC,OAAO,aAAa,CAAC,GACjC;IAAE,EAAE,EAAE,IAAI,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GAAG;IAAE,EAAE,EAAE,KAAK,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,CAsB7D;AAyFD,wBAAsB,cAAc,CAClC,QAAQ,EAAE,cAAc,EACxB,OAAO,EAAE,OAAO,EAChB,MAAM,SAAa,GAClB,OAAO,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,CAsB5D;AAID,wBAAsB,iBAAiB,CACrC,OAAO,EAAE,OAAO,EAChB,QAAQ,EAAE,cAAc,GACvB,OAAO,CAAC,QAAQ,CAAC,CAiBnB"}

package/dist-lib/lib/gateway/floriday-get.js

@@ -0,0 +1,185 @@
+// Gateway: beperkt Floriday-leespad (floridayGet).
+// Alleen HMAC (verifyGatewayRequest), vaste padenlijst, actieve omgeving,
+// rate-limit via token bucket, 403 → supply:read-melding, 429 → één retry.
+import { z } from "zod";
+import { verifyGatewayRequest } from "../floriday-gateway-hmac.js";
+import { corsPreflight, withCors, resolveGatewayEnvironment } from "../floriday-gateway-auth.js";
+import { florydayFetch, getFlorydayAccessToken, SUPPLIERS_API_VERSION } from "../floriday.functions.js";
+import { acquireFlorydayRateLimit } from "../floriday-rate-limit.server.js";
+import { FLORYDAY_SUPPLY_PERMISSION_MESSAGE, floridayErrorShowsMissingPermission, getFlorydayScopeForPath, scopesFromAccessToken, } from "../floriday-scopes.js";
+export const BASE_SUPPLY_READ_BUCKET = {
+    bucket: "base-supply-read",
+    capacity: 1,
+    refillPerSec: 1,
+};
+/** Swagger: /trade-items/availabilities — 2 per seconde, burst 200. */
+export const AVAILABILITIES_READ_BUCKET = {
+    bucket: "availabilities-read",
+    capacity: 200,
+    refillPerSec: 2,
+};
+const MAX_RETRY_AFTER_MS = 5000;
+const baseSupplyQuery = z
+    .object({
+    year: z.coerce.number().int().min(2000).max(2100),
+    week: z.coerce.number().int().min(1).max(53),
+})
+    .strict();
+const requestSchema = z.object({
+    method: z.literal("GET").optional(),
+    path: z.string().min(1).max(200),
+    query: z.record(z.string(), z.unknown()).optional(),
+});
+const bodySchema = z.object({
+    requests: z.array(requestSchema).min(1).max(10),
+});
+/** Vaste lijst met toegestane leespaden. Geeft null + reden terug bij weigering. */
+export function checkFloridayGetAllowed(req) {
+    const path = req.path.split("?")[0].replace(/\/+$/, "");
+    if (req.path.includes("?")) {
+        return { ok: false, error: "Querystring hoort in 'query', niet in 'path'" };
+    }
+    if (path === "/trade-items/base-supply") {
+        const q = baseSupplyQuery.safeParse(req.query ?? {});
+        if (!q.success) {
+            return { ok: false, error: "Alleen de queryparameters 'year' (2000-2100) en 'week' (1-53) zijn toegestaan" };
+        }
+        return {
+            ok: true,
+            value: { path, query: { year: String(q.data.year), week: String(q.data.week) }, bucket: BASE_SUPPLY_READ_BUCKET },
+        };
+    }
+    if (path === "/trade-items/availabilities") {
+        if (req.query && Object.keys(req.query).length > 0) {
+            return { ok: false, error: "Voor /trade-items/availabilities zijn geen queryparameters toegestaan" };
+        }
+        return { ok: true, value: { path, query: {}, bucket: AVAILABILITIES_READ_BUCKET } };
+    }
+    return { ok: false, error: `Pad niet toegestaan: ${path}` };
+}
+function parseRetryAfterMs(h) {
+    if (!h)
+        return 1000;
+    const s = Number(h);
+    if (Number.isFinite(s))
+        return Math.max(0, s * 1000);
+    const d = Date.parse(h);
+    return Number.isFinite(d) ? Math.max(0, d - Date.now()) : 1000;
+}
+const sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+async function fetchOne(supabase, env, a, caller) {
+    const qs = new URLSearchParams(a.query).toString();
+    const url = `/${SUPPLIERS_API_VERSION}${a.path}${qs ? `?${qs}` : ""}`;
+    const doCall = async () => {
+        await acquireFlorydayRateLimit(supabase, a.bucket);
+        return florydayFetch(supabase, env, url, {
+            method: "GET",
+            flowLog: { module: "gateway", caller: `gateway:${caller}`, action: "floriday-get" },
+        });
+    };
+    let res = await doCall();
+    if (res.status === 429) {
+        const waitMs = parseRetryAfterMs(res.headers.get("retry-after"));
+        if (waitMs <= MAX_RETRY_AFTER_MS) {
+            await sleep(waitMs);
+            res = await doCall();
+        }
+        if (res.status === 429) {
+            const retryAfterMs = parseRetryAfterMs(res.headers.get("retry-after"));
+            console.warn(`[gateway floriday-get] 429 op ${a.path}, retryAfterMs=${retryAfterMs}`);
+            return { ok: false, status: 429, path: a.path, error: "Floriday rate-limit (429)", retryAfterMs };
+        }
+    }
+    if (res.status === 403) {
+        const body = await res.text().catch(() => "");
+        const requested = getFlorydayScopeForPath(url, "GET");
+        const needed = String(requested ?? "")
+            .split(/\s+/)
+            .filter((x) => x && !x.startsWith("role:"));
+        let missingScope = null;
+        try {
+            const tok = await getFlorydayAccessToken(supabase, env, { scope: requested });
+            const scopes = scopesFromAccessToken(tok);
+            if (scopes)
+                missingScope = needed.find((n) => !scopes.includes(n)) ?? null;
+        }
+        catch {
+            /* geen bewijs → echte body tonen */
+        }
+        const bodyShowsPermission = floridayErrorShowsMissingPermission(body);
+        if (missingScope || bodyShowsPermission) {
+            const scopeName = missingScope ?? needed[0] ?? "onbekend";
+            console.warn(`[gateway floriday-get] 403 op ${a.path}: recht ${scopeName} ontbreekt (bewezen)`);
+            const message = scopeName === "supply:read"
+                ? FLORYDAY_SUPPLY_PERMISSION_MESSAGE
+                : `Floriday heeft het recht \`${scopeName}\` nog niet vrijgegeven voor deze koppeling. Laat dit recht in Floriday activeren en vernieuw daarna de verbinding.`;
+            return { ok: false, status: 403, path: a.path, error: message };
+        }
+        console.warn(`[gateway floriday-get] 403 op ${a.path}: ${body.slice(0, 300)}`);
+        return {
+            ok: false,
+            status: 403,
+            path: a.path,
+            error: `Floriday 403: ${body.slice(0, 300)}`,
+            floridayBody: body.slice(0, 2000),
+        };
+    }
+    const text = await res.text();
+    if (!res.ok) {
+        return { ok: false, status: res.status, path: a.path, error: `Floriday ${res.status}: ${text.slice(0, 300)}` };
+    }
+    let data = null;
+    try {
+        data = text ? JSON.parse(text) : null;
+    }
+    catch {
+        data = text;
+    }
+    return { ok: true, status: res.status, path: a.path, data };
+}
+export async function runFloridayGet(supabase, rawBody, caller = "external") {
+    const parsed = bodySchema.safeParse(rawBody);
+    if (!parsed.success) {
+        return { status: 400, body: { ok: false, error: "Ongeldig verzoek: verwacht { requests: [{ path, query }] }" } };
+    }
+    const allowed = [];
+    for (const r of parsed.data.requests) {
+        const c = checkFloridayGetAllowed(r);
+        if (!c.ok)
+            return { status: 400, body: { ok: false, error: c.error } };
+        allowed.push(c.value);
+    }
+    const environment = await resolveGatewayEnvironment(supabase);
+    const results = [];
+    for (const a of allowed) {
+        try {
+            results.push(await fetchOne(supabase, environment, a, caller));
+        }
+        catch (e) {
+            results.push({ ok: false, status: 502, path: a.path, error: String(e?.message ?? e) });
+        }
+    }
+    return { status: 200, body: { ok: true, environment, results } };
+}
+const _json = (data, init) => withCors(Response.json(data, init));
+export async function handleFloridayGet(request, supabase) {
+    if (request.method === "OPTIONS")
+        return corsPreflight();
+    const auth = await verifyGatewayRequest(request);
+    if (!auth.ok)
+        return _json({ ok: false, error: auth.error }, { status: auth.status });
+    let body;
+    try {
+        body = JSON.parse(auth.rawBody || "{}");
+    }
+    catch {
+        return _json({ ok: false, error: "Body is geen geldige JSON" }, { status: 400 });
+    }
+    try {
+        const r = await runFloridayGet(supabase, body, auth.caller);
+        return _json(r.body, { status: r.status });
+    }
+    catch (e) {
+        return _json({ ok: false, error: String(e?.message ?? e) }, { status: 409 });
+    }
+}

package/dist-lib/lib/gateway/index.d.ts

@@ -24,4 +24,5 @@ export * from "./trade-item-version.js";
 export * from "./webhook.js";
 export * from "./webhook-process.js";
 export * from "./webhook-sns.js";
+export * from "./floriday-get.js";
 //# sourceMappingURL=index.d.ts.map

package/dist-lib/lib/gateway/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAC;AAC5B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,yBAAyB,CAAC;AACxC,cAAc,wBAAwB,CAAC;AACvC,cAAc,8BAA8B,CAAC;AAC7C,cAAc,gBAAgB,CAAC;AAC/B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC;AACzB,cAAc,eAAe,CAAC;AAC9B,cAAc,sBAAsB,CAAC;AACrC,cAAc,YAAY,CAAC;AAC3B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,+BAA+B,CAAC;AAC9C,cAAc,kBAAkB,CAAC;AACjC,cAAc,YAAY,CAAC;AAC3B,cAAc,mBAAmB,CAAC;AAClC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC;AAClC,cAAc,gBAAgB,CAAC;AAC/B,cAAc,gBAAgB,CAAC;AAC/B,cAAc,6BAA6B,CAAC;AAC5C,cAAc,yBAAyB,CAAC;AACxC,cAAc,cAAc,CAAC;AAC7B,cAAc,sBAAsB,CAAC;AACrC,cAAc,kBAAkB,CAAC;AACjC,cAAc,mBAAmB,CAAC"}

package/dist-lib/lib/gateway/index.js

@@ -24,3 +24,4 @@ export * from "./trade-item-version.js";
 export * from "./webhook.js";
 export * from "./webhook-process.js";
 export * from "./webhook-sns.js";
+export * from "./floriday-get.js";

package/dist-lib/lib/gateway/webhook-subscribe.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"webhook-subscribe.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook-subscribe.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,KAAK,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;AAM9B,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CACtE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUvH;AAQD,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBnF;AAuBD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrG,OAAO,CAAC,YAAY,CAAC,CA2GvB;AA6BD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,cAAc;iBAKlC,MAAM;qBAc3C;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAWhH"}
+{"version":3,"file":"webhook-subscribe.d.ts","sourceRoot":"","sources":["../../../src/lib/gateway/webhook-subscribe.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AAG5D,KAAK,GAAG,GAAG,SAAS,GAAG,MAAM,CAAC;AAM9B,MAAM,MAAM,YAAY,GAAG;IACzB,EAAE,EAAE,OAAO,CAAC;IACZ,MAAM,EAAE,SAAS,GAAG,YAAY,GAAG,QAAQ,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,CAAC,EAAE,OAAO,GAAG,UAAU,GAAG,SAAS,GAAG,QAAQ,GAAG,UAAU,CAAC;CACtE,CAAC;AAEF;;;;;GAKG;AACH,wBAAgB,0BAA0B,CAAC,OAAO,CAAC,EAAE,OAAO,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC,GAAG,IAAI,GAAG,MAAM,GAAG,IAAI,CAUvH;AAQD,iFAAiF;AACjF,wBAAsB,wBAAwB,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,GAAG,IAAI,CAAC,CAgBnF;AAuBD,wBAAsB,iCAAiC,CACrD,QAAQ,EAAE,cAAc,EACxB,WAAW,EAAE,GAAG,EAChB,IAAI,EAAE;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IAAC,SAAS,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAA;CAAE,GACrG,OAAO,CAAC,YAAY,CAAC,CA2GvB;AA6BD,wBAAsB,yBAAyB,CAAC,QAAQ,EAAE,cAAc;iBAKlC,MAAM;qBAc3C;AAED,wBAAsB,4BAA4B,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,EAAE,cAAc,GAAG,OAAO,CAAC,QAAQ,CAAC,CAsBhH"}

package/dist-lib/lib/gateway/webhook-subscribe.js

@@ -228,8 +228,20 @@ export async function handleEnsureFloridayWebhooks(request, supabase) {
     const { withJobLock } = await import("../cron/job-lock.js");
     return withJobLock(supabase, "floriday-sync:webhook-ensure", async () => {
         const results = await runEnsureFloridayWebhooks(supabase);
+        // Uurlijkse meelift: controleer of de Shell alle gateway-routes bedient.
+        const shellRoutes = await (async () => {
+            try {
+                const { checkShellRoutes, logShellRoutesReport } = await import("../shell-routes.js");
+                const r = await checkShellRoutes();
+                await logShellRoutesReport(supabase, r, "uurlijkse zelfcontrole");
+                return { ok: r.ok, missing: r.missing, error: r.error ?? null };
+            }
+            catch (e) {
+                return { ok: false, missing: [], error: String(e?.message ?? e) };
+            }
+        })();
         const { runWebhookRetryRound } = await import("./webhook.js");
         const retry = await runWebhookRetryRound(supabase).catch(() => ({ picked: 0 }));
-        return Response.json({ ok: true, resource: "webhook-ensure", results, retried: retry.picked });
+        return Response.json({ ok: true, resource: "webhook-ensure", results, retried: retry.picked, shellRoutes });
     });
 }

package/dist-lib/lib/shell-base.d.ts

@@ -0,0 +1,2 @@
+export declare function normalizeShellBase(raw: unknown): string | null;
+//# sourceMappingURL=shell-base.d.ts.map

package/dist-lib/lib/shell-base.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-base.d.ts","sourceRoot":"","sources":["../../src/lib/shell-base.ts"],"names":[],"mappings":"AAGA,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,OAAO,GAAG,MAAM,GAAG,IAAI,CAkB9D"}

package/dist-lib/lib/shell-base.js

@@ -0,0 +1,31 @@
+// Strenge normalisatie van een shell-host uit Central Auth.
+// Alleen `https://<domeinnaam>`: kleine letters, geen pad/poort/query,
+// geen localhost of IP-adres. Anders null (= niet schrijven).
+export function normalizeShellBase(raw) {
+    if (typeof raw !== "string")
+        return null;
+    const t = raw.trim();
+    if (!t)
+        return null;
+    let u;
+    try {
+        u = new URL(/^[a-z]+:\/\//i.test(t) ? t : `https://${t}`);
+    }
+    catch {
+        return null;
+    }
+    if (u.protocol !== "https:")
+        return null;
+    if (u.port || u.username || u.password || u.search || u.hash)
+        return null;
+    if (u.pathname && u.pathname !== "/")
+        return null;
+    const host = u.hostname.toLowerCase();
+    if (host === "localhost" || host.endsWith(".localhost"))
+        return null;
+    if (/^\d{1,3}(\.\d{1,3}){3}$/.test(host) || host.includes(":"))
+        return null;
+    if (!/^(?=.{1,253}$)([a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?\.)+[a-z]{2,63}$/.test(host))
+        return null;
+    return `https://${host}`;
+}

package/dist-lib/lib/shell-routes.d.ts

@@ -0,0 +1,25 @@
+/** Moet gelijk zijn aan de gateway-routes in package.json (bewaakt door test). */
+export declare const SHELL_GATEWAY_ROUTES: readonly ["/api/public/gateway/active-environment", "/api/public/gateway/auto-process", "/api/public/gateway/cached-list", "/api/public/gateway/code-list", "/api/public/gateway/cron/scan", "/api/public/gateway/diagnostics", "/api/public/gateway/floricode-records", "/api/public/gateway/fulfillment-order/send", "/api/public/gateway/fulfillment-order/status", "/api/public/gateway/media", "/api/public/gateway/media-upload", "/api/public/gateway/pdf", "/api/public/gateway/pdf/bulk", "/api/public/gateway/pdf/bulk-merged", "/api/public/gateway/product-characteristics", "/api/public/gateway/schema", "/api/public/gateway/supply-line", "/api/public/gateway/floriday-get", "/api/public/gateway/write", "/api/public/gateway/trade-item-version"];
+export type ShellRouteState = {
+    path: string;
+    present: boolean;
+    status: number | null;
+    reason: string | null;
+};
+export type ShellRoutesReport = {
+    ok: boolean;
+    shellHost: string | null;
+    checkedAt: string;
+    missing: string[];
+    routes: ShellRouteState[];
+    advice: string | null;
+    error?: string;
+};
+/** Controleert alle gateway-routes op `base` (standaard: shell-host uit Central Auth). */
+export declare function checkShellRoutes(opts?: {
+    base?: string | null;
+    force?: boolean;
+}): Promise<ShellRoutesReport>;
+/** Legt een ontbrekende-routes-uitkomst vast in het schrijflogboek (alleen bij ontbreken). */
+export declare function logShellRoutesReport(supabase: any, report: ShellRoutesReport, reason: string): Promise<void>;
+//# sourceMappingURL=shell-routes.d.ts.map

package/dist-lib/lib/shell-routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"shell-routes.d.ts","sourceRoot":"","sources":["../../src/lib/shell-routes.ts"],"names":[],"mappings":"AAYA,kFAAkF;AAClF,eAAO,MAAM,oBAAoB,suBAqBvB,CAAC;AAEX,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,iBAAiB,GAAG;IAC9B,EAAE,EAAE,OAAO,CAAC;IACZ,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,SAAS,EAAE,MAAM,CAAC;IAClB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,MAAM,EAAE,eAAe,EAAE,CAAC;IAC1B,MAAM,EAAE,MAAM,GAAG,IAAI,CAAC;IACtB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAyBF,0FAA0F;AAC1F,wBAAsB,gBAAgB,CAAC,IAAI,GAAE;IAAE,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAAC,KAAK,CAAC,EAAE,OAAO,CAAA;CAAO,GAAG,OAAO,CAAC,iBAAiB,CAAC,CA4CvH;AAED,8FAA8F;AAC9F,wBAAsB,oBAAoB,CAAC,QAAQ,EAAE,GAAG,EAAE,MAAM,EAAE,iBAAiB,EAAE,MAAM,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAoBlH"}

package/dist-lib/lib/shell-routes.js

@@ -0,0 +1,127 @@
+// ============================================================================
+// Controle: bedient de Shell de gateway-routes van deze module?
+// ----------------------------------------------------------------------------
+// De Shell biedt alleen de routes aan die in het geïnstalleerde pakket staan
+// (package.json → flowselections.serverRoutes). Een nieuwe route bestaat daar
+// pas na uitbrengen + installeren. Deze controle roept elke gateway-route op
+// de shell-host aan ZONDER handtekening: onze eigen route antwoordt met een
+// JSON-weigering (401/400), een ontbrekende route geeft de Shell-404 (HTML).
+// Resultaat 5 minuten gecachet per shell-host. Nooit gegevens, nooit schrijven
+// naar Floriday.
+// ============================================================================
+/** Moet gelijk zijn aan de gateway-routes in package.json (bewaakt door test). */
+export const SHELL_GATEWAY_ROUTES = [
+    "/api/public/gateway/active-environment",
+    "/api/public/gateway/auto-process",
+    "/api/public/gateway/cached-list",
+    "/api/public/gateway/code-list",
+    "/api/public/gateway/cron/scan",
+    "/api/public/gateway/diagnostics",
+    "/api/public/gateway/floricode-records",
+    "/api/public/gateway/fulfillment-order/send",
+    "/api/public/gateway/fulfillment-order/status",
+    "/api/public/gateway/media",
+    "/api/public/gateway/media-upload",
+    "/api/public/gateway/pdf",
+    "/api/public/gateway/pdf/bulk",
+    "/api/public/gateway/pdf/bulk-merged",
+    "/api/public/gateway/product-characteristics",
+    "/api/public/gateway/schema",
+    "/api/public/gateway/supply-line",
+    "/api/public/gateway/floriday-get",
+    "/api/public/gateway/write",
+    "/api/public/gateway/trade-item-version",
+];
+const TTL_MS = 5 * 60 * 1000;
+const cache = new Map();
+async function probe(base, path) {
+    try {
+        const res = await fetch(`${base}${path}`, {
+            method: "POST",
+            headers: { "content-type": "application/json" },
+            body: "{}",
+            signal: AbortSignal.timeout(8000),
+        });
+        const ct = res.headers.get("content-type") ?? "";
+        await res.text().catch(() => "");
+        const isHtml = ct.includes("text/html");
+        if (res.status === 404 || isHtml) {
+            return { path, present: false, status: res.status, reason: "Shell kent deze route niet (404/website-pagina)" };
+        }
+        return { path, present: true, status: res.status, reason: null };
+    }
+    catch (e) {
+        return { path, present: false, status: null, reason: `Niet bereikbaar: ${e?.message ?? e}` };
+    }
+}
+/** Controleert alle gateway-routes op `base` (standaard: shell-host uit Central Auth). */
+export async function checkShellRoutes(opts = {}) {
+    let base = opts.base ?? null;
+    if (!base) {
+        try {
+            const { getShellHostFromCentral } = await import("./central-auth.server.js");
+            base = await getShellHostFromCentral();
+        }
+        catch (e) {
+            return {
+                ok: false, shellHost: null, checkedAt: new Date().toISOString(), missing: [], routes: [],
+                advice: null, error: `Shell-host niet op te vragen: ${e?.message ?? e}`,
+            };
+        }
+    }
+    if (!base) {
+        return {
+            ok: false, shellHost: null, checkedAt: new Date().toISOString(), missing: [], routes: [],
+            advice: null, error: "Central Auth geeft geen shell-host terug",
+        };
+    }
+    base = base.replace(/\/+$/, "");
+    const hit = cache.get(base);
+    if (!opts.force && hit && Date.now() - hit.at < TTL_MS)
+        return hit.report;
+    const routes = [];
+    for (let i = 0; i < SHELL_GATEWAY_ROUTES.length; i += 5) {
+        const chunk = SHELL_GATEWAY_ROUTES.slice(i, i + 5);
+        routes.push(...(await Promise.all(chunk.map((p) => probe(base, p)))));
+    }
+    const missing = routes.filter((r) => !r.present).map((r) => r.path);
+    const report = {
+        ok: missing.length === 0,
+        shellHost: base,
+        checkedAt: new Date().toISOString(),
+        missing,
+        routes,
+        advice: missing.length
+            ? "Ontbreekt in de Shell: de developer moet een nieuwe versie van de Floriday-module uitbrengen en in de Shell installeren."
+            : null,
+    };
+    if (missing.length) {
+        console.error(`[shell-routes] ${base} mist ${missing.length} route(s): ${missing.join(", ")}`);
+    }
+    cache.set(base, { at: Date.now(), report });
+    return report;
+}
+/** Legt een ontbrekende-routes-uitkomst vast in het schrijflogboek (alleen bij ontbreken). */
+export async function logShellRoutesReport(supabase, report, reason) {
+    if (report.ok && !report.error)
+        return;
+    try {
+        await supabase.from("floriday_write_log").insert({
+            connection_id: null,
+            module: "floriday-authenticatie",
+            action: "shell-routes-check",
+            resource: "shell-routes",
+            floriday_id: null,
+            request: { reason, shellHost: report.shellHost },
+            response: { missing: report.missing, error: report.error ?? null },
+            http_status: 0,
+            ok: false,
+            error: report.error ?? `${report.missing.length} route(s) ontbreken in de Shell – ${report.advice}`,
+            idempotency_key: null,
+            caller: "shell-routes-check",
+        });
+    }
+    catch (e) {
+        console.error("[shell-routes] loggen mislukt:", e?.message ?? e);
+    }
+}