* feat(connect): peppol connector foundation: capability, ledger/budget service, quota Adds the storage + package shape for brokering Peppol through the connector with the same one-address + rate-budget model as bank/skatteverket: a peppol capability (connector-gated, free on hosted), peppol as a ledger + upstream service, a conservative rate budget, and a migration extending the ledger service CHECK and the per-key limits (peppol_connections_per_company). Proxy route + instance-side Qvalia reroute follow. Switch-on gated on the Qvalia brokering-terms check. (cherry picked from commit 3cc0da6a3, migration renumbered 20260902190000) Signed-off-by: Jakob Wennberg <jakob.wennberg@arcim.io> Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MMUUom4fUk6zi4xYZSSfat * feat(connect): Peppol through the connector: hosted proxy, instance transport, ownership ledger Completes the Peppol upstream for self-hosted instances on the connector (WS3): an instance with a connector key carrying the peppol scope and no Qvalia keys of its own sends and receives e-invoices through Arcim's contracted access point, the same way bank and Skatteverket already route. Hosted: app/api/connect/peppol/[...path] speaks the PeppolTransport operations (lookup, submit, status, evidence, recipient PUT/DELETE, inbound list/xml) rather than proxying Qvalia paths, because the Qvalia account is shared by every hosted company and every instance: reads must be scoped to what the caller owns, and the inbound read endpoint is destructive for the whole account. Ownership: a receiving registration is a ledger row (service peppol, participant id in account_uids, sha256 in handle_hash so one key holds a participant at a time); outbound submissions land in the new connector_peppol_submissions table and gate status/evidence; inbound documents are served from the hosted archive filtered by the participants the key holds. Per-company quota (peppol_connections_per_company), the shared PEPPOL_RECEIVING_MAX_REGISTRATIONS cap, and the global peppol rate budget apply. Provider failures cross as CONNECTOR_UPSTREAM_ERROR with the adapter's retryable flag (422 or 502). Instance: lib/invoices/transports/connector.ts implements PeppolTransport over that API and registers itself in connector mode (key present, no QVALIA_* keys); getPeppolTransportAvailability() defaults to it when no provider is selected, so an instance needs no PEPPOL_TRANSPORT_PROVIDER. Webhooks are not brokered; the existing outbound status poll covers it. Hosted is byte-identical: it has its own keys, so connector mode is never on. Docs: SELF-HOSTING.md, SOVEREIGN.md, .env.example. Switch-on for third-party instances stays gated on the Qvalia brokering-terms check; without the scope every operation answers 403. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MMUUom4fUk6zi4xYZSSfat Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> * fix(connect): authorize Peppol participants per key, harden the proxy after review Review follow-ups on #2177. Authorization: a key may only register (and send as) participant identifiers Arcim recorded on the key at issuance (connector_keys.peppol_participants, migration 20260902191000) or the licensee's own org number, and a document may only be submitted as a sender the key has registered; X-Connector-Company stays an opaque per-company ref. Cap: the shared access-point cap now counts fresh pending reservations and is re-checked after this request's own reservation, so concurrent registrations cannot both pass. Inbound: both halves of the participant id are filtered in the archive query (over-fetched, then exact-pair checked), so foreign rows sharing an identifier cannot consume the limit. Delete: deregistration is a required transport capability, checked before the ledger row is revoked, and registration refuses an access point that cannot deregister. Instance transport: the hosted URL must be https (loopback http only, same rule as getConnectorConfig), and the response body is read inside the timeout window with body-read failures mapped to retryable transport errors. issue-connector-key.ts gains --peppol-participants and --peppol-connections-per-company. Declined: NOT VALID on the ledger CHECK (the table is empty until keys are issued; the validated scan is instant). Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MMUUom4fUk6zi4xYZSSfat Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> * fix(connect): bind Peppol ownership to the instance company, query exact participant pairs Second review round on #2177. Ownership is now (key, company_ref), not key alone: a sender must be registered under the same company header, status and evidence reads look the submission up under the header company, DELETE and re-registration refuse a participant the key holds for another company, so one company on a multi-company instance cannot act on another company's registration through the shared key. The instance transport resolves the owning company from its own peppol_deliveries / peppol_registrations rows before status, evidence and deregistration calls (deps.companyFor, deps.companyForParticipant, wired in transports/index.ts). Inbound listing stays key-wide (the instance routes documents to its own companies by its own registrations). The archive query now runs one exact-pair query per scheme (scheme fixed, that scheme's identifiers), so neither foreign nor cross-pair rows can consume the limit. Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01MMUUom4fUk6zi4xYZSSfat Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> --------- Signed-off-by: Jakob Wennberg <jakob.wennberg@arcim.io> Signed-off-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
84 lines
3.1 KiB
TypeScript
84 lines
3.1 KiB
TypeScript
/**
|
|
* Registers the Peppol Access Point adapters that the environment configures.
|
|
* Core ships the Qvalia adapter; `PEPPOL_TRANSPORT_PROVIDER` still decides
|
|
* which registered adapter the product is allowed to use, so an adapter can be
|
|
* configured (for the probe script, for a preview) without being switched on.
|
|
*/
|
|
|
|
import { createServiceClientNoCookies } from '@/lib/auth/api-keys'
|
|
import { peppolConnectorMode } from '@/lib/connect/instance/upstreams'
|
|
import {
|
|
CONNECTOR_PEPPOL_PROVIDER,
|
|
getPeppolTransport,
|
|
registerPeppolTransport,
|
|
type PeppolParticipant,
|
|
type PeppolTransport,
|
|
} from '@/lib/invoices/peppol-transport'
|
|
import { createConnectorPeppolTransport } from '@/lib/invoices/transports/connector'
|
|
|
|
/**
|
|
* The hosted connector binds submissions and registrations to the instance
|
|
* company that made them. PeppolTransport's read methods carry no tenant, so
|
|
* the instance looks the company up in its own tables before each call.
|
|
*/
|
|
async function connectorCompanyForSubmission(providerSubmissionId: string): Promise<string | null> {
|
|
const { data } = await createServiceClientNoCookies()
|
|
.from('peppol_deliveries')
|
|
.select('company_id')
|
|
.eq('provider', CONNECTOR_PEPPOL_PROVIDER)
|
|
.eq('provider_submission_id', providerSubmissionId)
|
|
.limit(1)
|
|
.maybeSingle()
|
|
return (data as { company_id: string } | null)?.company_id ?? null
|
|
}
|
|
|
|
async function connectorCompanyForParticipant(participant: PeppolParticipant): Promise<string | null> {
|
|
const { data } = await createServiceClientNoCookies()
|
|
.from('peppol_registrations')
|
|
.select('company_id')
|
|
.eq('provider', CONNECTOR_PEPPOL_PROVIDER)
|
|
.eq('participant_scheme', participant.scheme)
|
|
.eq('participant_identifier', participant.identifier.replace(/\s/g, ''))
|
|
.in('status', ['pending', 'registered'])
|
|
.limit(1)
|
|
.maybeSingle()
|
|
return (data as { company_id: string } | null)?.company_id ?? null
|
|
}
|
|
import {
|
|
QVALIA_PROVIDER,
|
|
createQvaliaTransport,
|
|
readQvaliaConfigFromEnv,
|
|
} from '@/lib/invoices/transports/qvalia'
|
|
|
|
export function registerConfiguredPeppolTransports(
|
|
env: Record<string, string | undefined> = process.env,
|
|
): PeppolTransport[] {
|
|
const registered: PeppolTransport[] = []
|
|
|
|
if (!getPeppolTransport(QVALIA_PROVIDER)) {
|
|
const qvaliaConfig = readQvaliaConfigFromEnv(env)
|
|
if (qvaliaConfig) {
|
|
const transport = createQvaliaTransport(qvaliaConfig)
|
|
registerPeppolTransport(transport)
|
|
registered.push(transport)
|
|
}
|
|
}
|
|
|
|
// Self-hosted instance in connector mode (connector key, no own Qvalia
|
|
// keys): reach Arcim's access point through the hosted proxy. Hosted has
|
|
// its own keys, so peppolConnectorMode() is null there and nothing changes.
|
|
if (!getPeppolTransport(CONNECTOR_PEPPOL_PROVIDER)) {
|
|
const connector = peppolConnectorMode()
|
|
if (connector) {
|
|
const transport = createConnectorPeppolTransport(connector, {
|
|
companyFor: connectorCompanyForSubmission,
|
|
companyForParticipant: connectorCompanyForParticipant,
|
|
})
|
|
registerPeppolTransport(transport)
|
|
registered.push(transport)
|
|
}
|
|
}
|
|
|
|
return registered
|
|
}
|