@vario-software/vario-app-framework-backend 2026.22.2 → 2026.25.0

package/api/ErpApi.js

@@ -9,6 +9,7 @@ const TextEnum = require('#backend/api/modules/textEnum.js');
 const Webhook = require('#backend/api/modules/webhook.js');
 const PermittedToken = require('#backend/api/modules/permittedToken.js');
 const { validateOfflineToken, isAppTokenExpired, refreshAppToken } = require('#backend/utils/token.js');
+const HttpError = require('#backend/utils/httpError.js');
 
 const singletonPromise = new PromiseSingletonMap();
 class ErpApi extends Api
@@ -58,7 +59,10 @@ class ErpApi extends Api
     {
       const tenant = getTenant();
 
-      await this.app.accessToken.delete(tenant);
+      if (tenant)
+      {
+        await this.app.accessToken.delete(tenant);
+      }
     }
   }
 
@@ -66,13 +70,22 @@ class ErpApi extends Api
   {
     const tenant = getTenant();
 
+    if (!tenant)
+    {
+      throw new HttpError(
+        'MISSING_TENANT',
+        400,
+        'backend/api/ErpApi',
+      );
+    }
+
     return singletonPromise.run(tenant, async () =>
     {
       const savedAccessToken = await this.app.accessToken.get(tenant);
 
       if (savedAccessToken)
       {
-        const baseUrl = await this.app.baseUrlCache.get();
+        const baseUrl = await this.app.baseUrlCache.get(tenant);
 
         return {
           baseUrl,
@@ -86,7 +99,7 @@ class ErpApi extends Api
       const domain = iss.replace('https://sso.', '').split('/')[0];
       const baseUrl = `https://${tenant}.${domain}`;
 
-      await this.app.baseUrlCache.set(baseUrl);
+      await this.app.baseUrlCache.set(tenant, baseUrl);
 
       const {
         access_token: accessToken,
@@ -98,7 +111,7 @@ class ErpApi extends Api
 
       const expiresAt = Date.now() + (expiresIn * 0.9) * 1000;
 
-      this.app.accessToken.set(tenant, accessToken, expiresAt);
+      await this.app.accessToken.set(tenant, accessToken, expiresAt);
 
       return {
         baseUrl,

package/api/helpers/streamResponse.js

@@ -18,6 +18,13 @@ function streamResponse(res, handler)
     res.write(`${JSON.stringify(data)}\n`);
   };
 
+  // Keep the connection non-idle during long silent phases (e.g. polling for the
+  // ERP import to extract). Reverse proxies/gateways close idle connections with a
+  // 504 after ~60s; a periodic blank line resets that timer. Blank lines are ignored
+  // by the client parsers (they filter out non-JSON / empty lines).
+  const HEARTBEAT_INTERVAL_MS = 15_000;
+  const heartbeat = setInterval(() => res.write('\n'), HEARTBEAT_INTERVAL_MS);
+
   return handler(onProgress)
     .then(result =>
     {
@@ -29,6 +36,7 @@ function streamResponse(res, handler)
     })
     .finally(() =>
     {
+      clearInterval(heartbeat);
       res.end();
     });
 }

package/modules/accessToken.js

@@ -1,3 +1,5 @@
+const HttpError = require('#backend/utils/httpError.js');
+
 class AccessToken
 {
   #cache = {};
@@ -9,6 +11,8 @@ class AccessToken
 
   async get(tenant)
   {
+    this.#assertTenant(tenant);
+
     const tokenData = this.#cache[tenant];
 
     if (!tokenData)
@@ -28,6 +32,8 @@ class AccessToken
 
   async set(tenant, accessToken, expiresAt)
   {
+    this.#assertTenant(tenant);
+
     this.#cache[tenant] = {
       accessToken,
       expiresAt,
@@ -36,8 +42,22 @@ class AccessToken
 
   async delete(tenant)
   {
+    this.#assertTenant(tenant);
+
     delete this.#cache[tenant];
   }
+
+  #assertTenant(tenant)
+  {
+    if (!tenant)
+    {
+      throw new HttpError(
+        'MISSING_TENANT',
+        400,
+        'backend/modules/accessToken',
+      );
+    }
+  }
 }
 
 module.exports = AccessToken;

package/modules/baseUrlCache.js

@@ -1,5 +1,5 @@
-const { getTenant } = require('#backend/utils/context.js');
 const { validateOfflineToken } = require('#backend/utils/token.js');
+const HttpError = require('#backend/utils/httpError.js');
 
 class BaseUrlCache
 {
@@ -15,9 +15,21 @@ class BaseUrlCache
     return Promise.resolve();
   }
 
-  async get()
+  #assertTenant(tenant)
   {
-    const tenant = getTenant();
+    if (!tenant)
+    {
+      throw new HttpError(
+        'MISSING_TENANT',
+        400,
+        'backend/modules/baseUrlCache',
+      );
+    }
+  }
+
+  async get(tenant)
+  {
+    this.#assertTenant(tenant);
 
     if (this.#cache[tenant])
     {
@@ -30,21 +42,21 @@ class BaseUrlCache
     const domain = iss.replace('https://sso.', '').split('/')[0];
     const baseUrl = `https://${tenant}.${domain}`;
 
-    await this.set(baseUrl);
+    await this.set(tenant, baseUrl);
 
     return baseUrl;
   }
 
-  async set(value)
+  async set(tenant, value)
   {
-    const tenant = getTenant();
+    this.#assertTenant(tenant);
 
     this.#cache[tenant] = value;
   }
 
-  async delete()
+  async delete(tenant)
   {
-    const tenant = getTenant();
+    this.#assertTenant(tenant);
 
     delete this.#cache[tenant];
   }

package/modules/offlineToken.js

@@ -1,3 +1,5 @@
+const HttpError = require('#backend/utils/httpError.js');
+
 class OfflineToken
 {
   constructor(app, filename = 'offlineToken.db')
@@ -15,13 +17,29 @@ class OfflineToken
     this.database = await JSONFilePreset(this.filename, {});
   }
 
+  #assertTenant(tenant)
+  {
+    if (!tenant)
+    {
+      throw new HttpError(
+        'MISSING_TENANT',
+        400,
+        'backend/modules/offlineToken',
+      );
+    }
+  }
+
   async get(tenant)
   {
+    this.#assertTenant(tenant);
+
     return this.database.data[tenant];
   }
 
   async set(tenant, offlineToken)
   {
+    this.#assertTenant(tenant);
+
     this.app.accessToken.delete(tenant);
 
     return this.database.update(tokens =>
@@ -32,6 +50,8 @@ class OfflineToken
 
   async delete(tenant)
   {
+    this.#assertTenant(tenant);
+
     this.app.accessToken.delete(tenant);
 
     return this.database.update(tokens =>

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@vario-software/vario-app-framework-backend",
-  "version": "2026.22.2",
+  "version": "2026.25.0",
   "repository": "https://github.com/vario-software/vario-app-framework",
   "author": "VARIO Software AG",
   "homepage": "https://www.vario.ag",