@flowselections/floriday-voorraad 1.0.157 → 1.0.163

package/dist-lib/server-hooks/guard.js

@@ -19,9 +19,9 @@ const CORS = {
  * vóór 1.0.84 met een andere modus dan Uit). Anders uit: een Shell die alles
  * uit Floriday overneemt, verstuurt dan niets.
  */
-const DEFAULT_ON_IF_ERP_LEADING = new Set(["floriday_base_supply", "logistics_tasks"]);
+export const DEFAULT_ON_IF_ERP_LEADING = new Set(["floriday_base_supply", "logistics_tasks"]);
 /** Standaard aan zonder voorwaarde (alleen lezen uit Floriday, verstuurt niets). */
-const DEFAULT_ON = new Set(["follow_floriday", "floriday_versies"]);
+export const DEFAULT_ON = new Set(["follow_floriday", "floriday_versies"]);
 async function hasErpLeadingArticle(admin) {
     const lead = await admin
         .from("floriday_inventory_settings")
@@ -64,7 +64,8 @@ export async function hookEnabled(name) {
         .select("value")
         .eq("key", `voorraad_hook_enabled.${name}`)
         .maybeSingle();
-    if (!data) {
+    // 'standaard' (vastgelegd door voorraad_ensure_defaults) = dezelfde regel als geen rij.
+    if (!data || String(data.value).trim().toLowerCase() === "standaard") {
         if (DEFAULT_ON.has(name))
             return true;
         return DEFAULT_ON_IF_ERP_LEADING.has(name) && (await hasErpLeadingArticle(admin));

package/dist-lib/server-hooks/trade-item-photo.d.ts

@@ -1,3 +1,15 @@
+/**
+ * Upload-handler voor artikelfoto's (losse app én Shell via flowselections.serverRoutes).
+ * Alleen ingelogde gebruikers van deze database (sessie-bearer); de gateway-
+ * sleutel blijft server-side. Server-only.
+ *
+ * Flow (§14.11):
+ *  1. Browser POSTet multipart/form-data met `file` en optioneel `tradeItemId`.
+ *  2. Wij verifiëren de Supabase-bearer en bepalen de actieve koppeling zelf.
+ *  3. We sturen de RAW bytes door naar /api/public/gateway/media-upload —
+ *     géén base64-inflatie, géén formData-rebuild. HMAC zit in
+ *     gatewayMediaUpload (server-only secret).
+ */
 type UploadReason = "image_too_small" | "image_too_large" | "unsupported_type" | "invalid_payload" | "network" | "not_logged_in" | "not_connected" | "config_missing" | "unknown";
 /** Breedte/hoogte uit PNG-IHDR of JPEG-SOF-marker. */
 export declare function imageSize(b: Uint8Array): {

package/dist-lib/server-hooks/trade-item-photo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trade-item-photo.d.ts","sourceRoot":"","sources":["../../src/server-hooks/trade-item-photo.ts"],"names":[],"mappings":"AAqBA,KAAK,YAAY,GACb,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,GACT,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,SAAS,CAAC;AAgFd,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBxE;AAKD,wBAAgB,UAAU,CACxB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASjD;AAMD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+P9E"}
+{"version":3,"file":"trade-item-photo.d.ts","sourceRoot":"","sources":["../../src/server-hooks/trade-item-photo.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AASH,KAAK,YAAY,GACb,iBAAiB,GACjB,iBAAiB,GACjB,kBAAkB,GAClB,iBAAiB,GACjB,SAAS,GACT,eAAe,GACf,eAAe,GACf,gBAAgB,GAChB,SAAS,CAAC;AAgFd,sDAAsD;AACtD,wBAAgB,SAAS,CAAC,CAAC,EAAE,UAAU,GAAG;IAAE,CAAC,EAAE,MAAM,CAAC;IAAC,CAAC,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CAmBxE;AAKD,wBAAgB,UAAU,CACxB,IAAI,EAAE,UAAU,EAChB,IAAI,EAAE,MAAM,GACX;IAAE,MAAM,EAAE,YAAY,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,IAAI,CASjD;AAMD,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,CA+P9E"}

package/dist-lib/server-hooks/trade-item-photo.js

@@ -10,7 +10,6 @@
  *     géén base64-inflatie, géén formData-rebuild. HMAC zit in
  *     gatewayMediaUpload (server-only secret).
  */
-import { createClient } from "@supabase/supabase-js";
 function json(body, status = 200) {
     return new Response(JSON.stringify(body), {
         status,
@@ -134,10 +133,16 @@ export async function handleTradeItemPhoto(request) {
     if (request.method !== "POST")
         return json({ error: "Method not allowed" }, 405);
     try {
-        const SUPABASE_URL = process.env.SUPABASE_URL;
-        const SUPABASE_PUBLISHABLE_KEY = process.env.SUPABASE_PUBLISHABLE_KEY;
-        if (!SUPABASE_URL || !SUPABASE_PUBLISHABLE_KEY) {
-            return plainFail("config_missing", 500, "SUPABASE_URL/SUPABASE_PUBLISHABLE_KEY ontbreekt op de server");
+        // C1: geen eigen client met de publishable key. Sessie server-side
+        // controleren met de service-role-client (getUser), pas daarna verder.
+        let supabase;
+        try {
+            const { getAdminClient } = await import("../lib/supabase-admin.server.js");
+            supabase = getAdminClient();
+        }
+        catch (e) {
+            console.error("[trade-item-photo] serverconfiguratie ontbreekt", e);
+            return plainFail("config_missing", 500, "SUPABASE_URL/SUPABASE_SERVICE_ROLE_KEY ontbreekt op de server");
         }
         // --- 1. Bearer-validatie -------------------------------------------------
         const authHeader = request.headers.get("authorization");
@@ -148,12 +153,8 @@ export async function handleTradeItemPhoto(request) {
         const token = authHeader.slice("Bearer ".length).trim();
         if (!token)
             return plainFail("not_logged_in", 401, "Unauthorized: leeg token");
-        const supabase = createClient(SUPABASE_URL, SUPABASE_PUBLISHABLE_KEY, {
-            global: { headers: { Authorization: `Bearer ${token}` } },
-            auth: { storage: undefined, persistSession: false, autoRefreshToken: false },
-        });
-        const { data: claimsData, error: claimsErr } = await supabase.auth.getClaims(token);
-        if (claimsErr || !claimsData?.claims?.sub) {
+        const { data: userData, error: userErr } = await supabase.auth.getUser(token);
+        if (userErr || !userData?.user?.id) {
             return plainFail("not_logged_in", 401, "Unauthorized: token ongeldig");
         }
         // --- 2. Multipart body ---------------------------------------------------
@@ -218,7 +219,7 @@ export async function handleTradeItemPhoto(request) {
         // ZONDER versie-prefix — die moet dus in het pad zelf zitten.
         const path = "/suppliers-api-2026v1/media";
         const requestTimestamp = Date.now();
-        const clientUserId = claimsData.claims.sub;
+        const clientUserId = userData.user.id;
         const reportFailure = async (info) => {
             // (a) push naar Auth-module diagnostics-endpoint
             try {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@flowselections/floriday-voorraad",
-  "version": "1.0.157",
+  "version": "1.0.163",
   "sideEffects": false,
   "type": "module",
   "main": "./dist-lib/index.js",
@@ -185,6 +185,66 @@
           "OPTIONS"
         ]
       }
-    ]
+    ],
+    "crons": [
+      {
+        "name": "voorraad-floriday-base-supply",
+        "kind": "http",
+        "path": "/api/public/hooks/floriday-base-supply",
+        "schedule": "* * * * *"
+      },
+      {
+        "name": "voorraad-floriday-follow",
+        "kind": "http",
+        "path": "/api/public/hooks/floriday-follow",
+        "replaces": [
+          "floriday-follow-hourly"
+        ],
+        "schedule": "23 * * * *"
+      },
+      {
+        "name": "voorraad-logistics-tasks-run",
+        "kind": "http",
+        "path": "/api/public/hooks/logistics-tasks-run",
+        "schedule": "* * * * *",
+        "replaces": [
+          "logistics-tasks-run"
+        ]
+      },
+      {
+        "name": "floriday-stock-queue-process",
+        "schedule": "* * * * *",
+        "kind": "sql",
+        "sql": "SELECT public.run_floriday_stock_queue_process();"
+      },
+      {
+        "name": "floriday-continuous-stock-sync",
+        "schedule": "* * * * *",
+        "kind": "sql",
+        "sql": "SELECT public.run_floriday_continuous_stock_sync();"
+      },
+      {
+        "name": "floriday-stock-queue-reset",
+        "schedule": "*/15 * * * *",
+        "kind": "sql",
+        "sql": "SELECT public.reset_stalled_floriday_stock_queue(true);"
+      },
+      {
+        "name": "floriday-stock-queue-cleanup",
+        "schedule": "17 3 * * *",
+        "kind": "sql",
+        "sql": "SELECT public.cleanup_floriday_stock_queue();"
+      },
+      {
+        "name": "voorraad-module-history-cleanup",
+        "schedule": "37 3 * * *",
+        "kind": "sql",
+        "sql": "SELECT public.cleanup_voorraad_module_history();"
+      }
+    ],
+    "install": {
+      "ensureDefaults": "voorraad_ensure_defaults",
+      "installCheck": "voorraad_install_check"
+    }
   }
 }

package/sql/AGENTS.md

@@ -9,7 +9,7 @@
 - `sql/floriday-voorraad-schema.sql` must name the newest `supabase/migrations` file in its "Laatste migratie" header and contain the required objects; `scripts/check-schema-version.mjs` (prepublishOnly + test) blocks publishing otherwise; the header version is informational and never higher than package.json, because 1.0.139 shipped a stale schema and the dashboard bumps versions without schema changes.
 - Default data only via `voorraad_ensure_defaults()` (system data upserted by code keeping `naam_aangepast`, retired codes set inactive; customer settings only inserted when missing, with column defaults equal to reader fallbacks); bump `voorraad_defaults_versie()` on every list change, because new shells get the schema without data and the fast exit compares that version.
 - Load carrier → Engine code only via the Engine's `logistics_ladingdrager_resolve`; no own mapping list or fallback, because two lists drift.
-- Floriday trade items become own articles only via `voorraad_floriday_artikelen_aanmaken` (match GTIN → article code → name; ambiguity goes to `voorraad_koppel_twijfel`, never guessed; reuses the existing stock row keyed by the Floriday id); the cache trigger only enqueues and wakes a self-unscheduling drain, with an hourly safety net from `voorraad_ensure_defaults`, because inline creation slowed Floriday-auth syncs.
+- Floriday trade items become own articles only via `voorraad_floriday_artikelen_aanmaken` (match GTIN → article code → name; ambiguity goes to `voorraad_koppel_twijfel`, never guessed; reuses the existing stock row keyed by the Floriday id); the cache trigger only enqueues, because inline creation slowed Floriday-auth syncs.
 - Floriday order lines resolve their article only from source metadata (`voorraad_orderregel_trade_item`, sales order id → trade item), overriding name matches; existing empty lines only via `voorraad_correctie_1144` (unambiguous, not shipped/cancelled/processed, batched), because name matches linked the wrong article.
 - Fust balance counts only bookings from the start moment (`fust_startmoment`, global or per fust) plus the opening count; earlier bookings stay visible but outside the balance, and an automatic start moment is set only when none exists and `fust_stock_mutations` is empty, because existing shells must choose their own start.
 - The stock list reads only `voorraad_lijst` (search/filter/sort/count/page on the server, max 500 per page, archived rows only under filter `gearchiveerd`); quick stock changes from the list go through `voorraad_voorraad_corrigeren` (delta + reason, row-locked), because client-side merging hit silent 1,000-row limits and absolute saves could overwrite concurrent order consumption.
@@ -17,4 +17,4 @@
 - A price change re-queues Floriday stock rows only when `voorraad_floriday_volgt(product)` (ERP leading and mode not DISABLED), because local-steered articles must never gain queue rows.
 - Custom fields and tray sticker save only via `voorraad_eigen_velden_opslaan` / `voorraad_traysticker_opslaan` (compare against the state at opening), because direct table writes overwrote concurrent edits.
 - Replaced/expired Floriday trade item versions are recorded only by `voorraad_floriday_versies_vastleggen` (server-only, from a complete error-free per-id read round, blocked above the max share with a message, source recorded); they never become visible articles (alias to the successor or an archived article with stock mode off), and historic shipped lines of such versions never get recalculated fust (`voorraad_fust_historisch_vervallen`), because old versions doubled the catalogue and re-linking history must not book anything.
-- New visible articles from Floriday are created only after a successful version round for that connection (`voorraad_floriday_versieronde_geslaagd`); rounds run only automatically (cron → reconcile hook `?taak=versies`, portions via `_volgende`/`_portie`), an item failing 3 consecutive rounds is set aside as unknown (never marked, never created), and only a whole failed round produces a user notice, because users must never need a manual step and one bad item must not block forever.
+- New visible articles from Floriday are created only after a successful version round for that connection (`voorraad_floriday_versieronde_geslaagd`); rounds run only automatically (portions via `_volgende`/`_portie`), an item failing 3 consecutive rounds is set aside as unknown (never marked, never created), and only a whole failed round produces a user notice, because users must never need a manual step and one bad item must not block forever.