3a62c5419e
* feat(reconciliation): skattekonto bridge engine, sync-time twin proposals, account-keyed facade The engine half of the reconciliation page (design: Avstämningsmotorn). - lib/reconciliation/skattekonto-reconciliation.ts: getSkattekontoReconciliationStatus anchors at the saldo snapshot and returns the bridge (saldo hos Skatteverket, händelser som saknas, 1630-rader utan händelse, ignorerade, ingående skillnad, bokfört), the item buckets the page shows (proposed, unmatched external, unmatched ledger, matched, ignored, upcoming), opening_difference, unexplained_difference (0,00 by construction when data is consistent), dead-link handling (a link to a reversed/draft entry counts as unlinked and is flagged), awaiting_external for ledger lines within 5 days of the snapshot, staleness, and a window that scopes item lists without hiding older rows. Core reads skattekonto_transactions and the extension's snapshot row directly; no @/extensions import. - lib/reconciliation/gl-balance.ts: one ledger-balance helper with the trial-balance predicate status IN (posted, reversed). The drift check summed posted only, which misstated 1630 for any company with a storno on the account; skattekonto-drift.ts now delegates to the helper. - Proposals at sync: migration 20260823120000 adds suggested_journal_entry_id / suggested_at (ON DELETE SET NULL, partial index on open rows); the sync calls refreshSkattekontoProposals after the upsert. findMatchSuggestionsBulk now assigns one-to-one across rows (AGI period first, then nearest date) and falls back to an entry whose 1630 lines net to the amount (split lines); a proposal is never a link. - lib/reconciliation/service.ts + schemas.ts: the account-keyed facade (bank:<cash_account_id> | skattekonto | manual:NNNN) with listReconciliationAccounts (enabled cash accounts folded per IBAN, skattekonto when configured) and getAccountStatus dispatching to the bank engine or the new one; shared Zod shapes for the v1 registry, MCP schemas and the UI (PR 2). Tests: identity on a mixed fixture, storno pair, stale snapshot, awaiting window, window scoping, failed ledger read, live-linked entries never proposed; matcher one-to-one and split-line cases; proposal refresh writes/clears; service dedupe and dispatch. No UI in this PR. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reconciliation): roundOre instead of inline öre rounding (guard ratchet) The antipattern ratchet counts Math.round(x*100)/100; the new engine used it in five places. Switch to roundOre from @/lib/money and ratchet the baseline down by the three occurrences this removes net of the matcher rewrite. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * feat(reconciliation): three doors over one engine: dashboard routes, v1 API and MCP tools for account-keyed reconciliation PR 2 of the Avstämning build (design: Avstämning via API och MCP). Every door calls lib/reconciliation/{service,items,actions}.ts; none re-implements a link. - lib/reconciliation/items.ts: listAccountItems per account_key, the page's buckets (proposed, unmatched_external, unmatched_ledger, matched, ignored, upcoming), limit/offset; skattekonto from the engine, bank from the scoped transactions + unlinked GL lines (netted per entry). - lib/reconciliation/actions.ts: matchPairs (pairs or use_proposals, dry run, partial success with codes), unmatchLink, setItemIgnored; emits reconciliation.matched / reconciliation.unmatched. - lib/skatteverket/skattekonto-link.ts: canonical core link semantics for a skattekonto row (single line or entry net on 1630, live-link guard, race-safe update, unlink, ignore); the extension keeps its own matchSkattekontoToEntry until its tests are ported. - Dashboard routes /api/reconciliation/accounts[...]: list, status, items, links (POST), links/{linkId} (DELETE), items/{itemId}/ignore (POST); apply directly (a human clicked). - v1 routes /api/v1/companies/{id}/reconciliation/accounts[...]: same six, withApiV1, new scopes reconciliation:read / reconciliation:write (write is a staging scope for SoD), Idempotency-Key + dry_run on writes, registered for OpenAPI, load-routes, skills/accounted-api regenerated. Legacy bank routes and their transactions:* scopes unchanged. - MCP: gnubok_get_reconciliation_status takes account_key (legacy bank path untouched), new gnubok_list_reconciliation_items (default catalog), gnubok_reconcile_match (stages reconciliation_match, preflight = status) and gnubok_reconcile_unmatch (stages reconciliation_unmatch), both search-only to stay under the tools/list payload ceiling; gnubok_link_transaction_to_journal_entry moved to search. Executors in commit.ts; risk tiers medium/low; migration pair 20260823130000/130001 adds the two op types to the CHECK constraint (value list = live prod as of 2026-08-23 + the two); close_period loadout updated. Tests: service/actions/items/link unit tests, v1 route tests (401/403/400/404/ happy, idempotency, dry run), dashboard route tests, MCP tool tests + the guard suite (payload ceiling, descriptions, staging meta, qualified ids). Guards and apiskill:check green; no type errors in changed files. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * fix(reconciliation): refresh the v1 spec snapshot and keep the ignore update readable by the phantom-column guard The six new v1 reconciliation endpoints and the two new scopes were not recorded in the spec snapshot, and setSkattekontoRowIgnored updated through one conditional payload, which the phantom-column scanner cannot read (ceiling 380 -> 381). Two literal payloads instead; snapshot updated. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> --------- Co-authored-by: Jakob Wennberg <311770904+jakobwennberg-oss@users.noreply.github.com> Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
291 lines
17 KiB
TypeScript
291 lines
17 KiB
TypeScript
/**
|
|
* v1 REST API endpoint → required scope map.
|
|
*
|
|
* This is the REST-route analogue of `TOOL_SCOPE_MAP` in api-keys.ts (which
|
|
* maps MCP tool names to scopes). Both share the same `ApiKeyScope` registry.
|
|
*
|
|
* Key format: `<METHOD> <pattern>` where pattern uses `:param` for path
|
|
* variables, matching Next.js dynamic-segment conventions (one for one).
|
|
*
|
|
* Endpoints not listed here are public (no auth): only the discovery routes
|
|
* (`/llms.txt`, `/.well-known/skills`, `/api/v1/health`, `/api/v1/openapi.json`)
|
|
* fall into that bucket. Everything else under `/api/v1/` MUST be in this map
|
|
* or the wrapper will refuse the request with INSUFFICIENT_SCOPE.
|
|
*/
|
|
|
|
import type { ApiKeyScope } from './api-keys'
|
|
|
|
/**
|
|
* Routes that require authentication but no scope check beyond "is the key
|
|
* valid?". The wrapper still validates the key and runs rate limiting.
|
|
*/
|
|
export const V1_PUBLIC_ENDPOINTS: ReadonlyArray<string> = [
|
|
'GET /api/v1/health',
|
|
'GET /api/v1/openapi.json',
|
|
'GET /api/v1/openapi.yaml',
|
|
]
|
|
|
|
/**
|
|
* Map of v1 endpoint pattern → required scope.
|
|
*
|
|
* Patterns use `:param` placeholders that match a single path segment.
|
|
* The wrapper compiles these into regexes at startup and matches incoming
|
|
* requests by (method, normalized-path) tuple.
|
|
*
|
|
* When adding a new endpoint, add it here BEFORE shipping the route file:
|
|
* otherwise the wrapper will reject all requests to it.
|
|
*/
|
|
export const V1_ENDPOINT_SCOPES: Record<string, ApiKeyScope> = {
|
|
// Companies
|
|
'GET /api/v1/companies': 'companies:read',
|
|
'GET /api/v1/companies/:companyId': 'companies:read',
|
|
// Issue #1348: company-settings write (same field set as the MCP tool
|
|
// gnubok_update_company_settings; direct write, no staging).
|
|
'PATCH /api/v1/companies/:companyId/settings': 'companies:write',
|
|
|
|
// Operations (async long-running tasks)
|
|
'GET /api/v1/operations/:id': 'operations:read',
|
|
|
|
// Events (webhook fallback / event log polling)
|
|
'GET /api/v1/companies/:companyId/events': 'events:read',
|
|
|
|
// Customers (Phase 2 PR-A: reads; Phase 2 PR-B-1: writes)
|
|
'GET /api/v1/companies/:companyId/customers': 'customers:read',
|
|
'GET /api/v1/companies/:companyId/customers/:id': 'customers:read',
|
|
'POST /api/v1/companies/:companyId/customers': 'customers:write',
|
|
'PATCH /api/v1/companies/:companyId/customers/:id': 'customers:write',
|
|
'DELETE /api/v1/companies/:companyId/customers/:id': 'customers:write',
|
|
|
|
// Invoices (Phase 2 PR-A: reads; Phase 2 PR-B-2a: draft writes)
|
|
'GET /api/v1/companies/:companyId/invoices': 'invoices:read',
|
|
'GET /api/v1/companies/:companyId/invoices/:id': 'invoices:read',
|
|
'POST /api/v1/companies/:companyId/invoices': 'invoices:write',
|
|
'PATCH /api/v1/companies/:companyId/invoices/:id': 'invoices:write',
|
|
// Phase 2 PR-B-2b: action verbs. URL uses /verb subpath (not Google-AIP-style :verb)
|
|
// because Next.js routes don't support `:` in folder names.
|
|
'POST /api/v1/companies/:companyId/invoices/:id/mark-sent': 'invoices:write',
|
|
'POST /api/v1/companies/:companyId/invoices/:id/mark-paid': 'invoices:write',
|
|
'POST /api/v1/companies/:companyId/invoices/:id/credit': 'invoices:write',
|
|
'POST /api/v1/companies/:companyId/invoices/:id/send': 'invoices:write',
|
|
'POST /api/v1/companies/:companyId/invoices/bulk-create': 'invoices:write',
|
|
// Phase 2 PR-B-3: invoice PDF + customer bulk-create.
|
|
'GET /api/v1/companies/:companyId/invoices/:id/pdf': 'invoices:read',
|
|
'POST /api/v1/companies/:companyId/customers/bulk-create': 'customers:write',
|
|
|
|
// Phase 4 PR-1: Suppliers + Supplier-invoices verticals (AP world).
|
|
// Suppliers
|
|
'GET /api/v1/companies/:companyId/suppliers': 'suppliers:read',
|
|
'GET /api/v1/companies/:companyId/suppliers/:id': 'suppliers:read',
|
|
'POST /api/v1/companies/:companyId/suppliers': 'suppliers:write',
|
|
'PATCH /api/v1/companies/:companyId/suppliers/:id': 'suppliers:write',
|
|
'DELETE /api/v1/companies/:companyId/suppliers/:id': 'suppliers:write',
|
|
'POST /api/v1/companies/:companyId/suppliers/bulk-create': 'suppliers:write',
|
|
// Supplier invoices
|
|
'GET /api/v1/companies/:companyId/supplier-invoices': 'suppliers:read',
|
|
'GET /api/v1/companies/:companyId/supplier-invoices/:id': 'suppliers:read',
|
|
'POST /api/v1/companies/:companyId/supplier-invoices': 'suppliers:write',
|
|
'PATCH /api/v1/companies/:companyId/supplier-invoices/:id': 'suppliers:write',
|
|
// Note: no DELETE: supplier-invoice withdrawal is via :credit (mirrors v1 invoices).
|
|
'POST /api/v1/companies/:companyId/supplier-invoices/:id/approve': 'suppliers:write',
|
|
'POST /api/v1/companies/:companyId/supplier-invoices/:id/mark-paid': 'suppliers:write',
|
|
'POST /api/v1/companies/:companyId/supplier-invoices/:id/credit': 'suppliers:write',
|
|
|
|
// Phase 4 PR-2: Engine, periods async ops, documents, compliance-check.
|
|
// Journal-entries primitives (highest-risk surface).
|
|
'GET /api/v1/companies/:companyId/journal-entries': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/journal-entries/:id': 'reports:read',
|
|
'POST /api/v1/companies/:companyId/journal-entries': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/journal-entries/:id/commit': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/journal-entries/:id/reverse': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/journal-entries/:id/correct': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/journal-entries/batch-create': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/voucher-gap-explanations': 'bookkeeping:write',
|
|
// Fiscal-periods async ops.
|
|
'POST /api/v1/companies/:companyId/fiscal-periods/:id/lock': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/fiscal-periods/:id/close': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/fiscal-periods/:id/year-end': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/fiscal-periods/:id/opening-balances': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/fiscal-periods/:id/currency-revaluation': 'bookkeeping:write',
|
|
// Compliance check (Accounted's defensible edge).
|
|
'GET /api/v1/companies/:companyId/compliance/check': 'compliance:read',
|
|
// #1663: filed momsdeklaration read (SKV inlamnat/beslutat). Rides
|
|
// compliance:read, mirroring the MCP gnubok_vat_declaration_status mapping.
|
|
'GET /api/v1/companies/:companyId/skatteverket/vat-declarations': 'compliance:read',
|
|
// Phase 4 PR-3: Documents (multipart).
|
|
'POST /api/v1/companies/:companyId/documents': 'documents:write',
|
|
'GET /api/v1/companies/:companyId/documents/:id/download': 'documents:read',
|
|
'POST /api/v1/companies/:companyId/documents/:id/link': 'documents:write',
|
|
|
|
// Phase 3: transactions + reconciliation vertical.
|
|
// Reads
|
|
'GET /api/v1/companies/:companyId/transactions': 'transactions:read',
|
|
'GET /api/v1/companies/:companyId/transactions/:id': 'transactions:read',
|
|
'GET /api/v1/companies/:companyId/accounts': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/fiscal-periods': 'reports:read',
|
|
// Writes: single transaction verbs
|
|
'POST /api/v1/companies/:companyId/transactions/:id/categorize': 'transactions:write',
|
|
'POST /api/v1/companies/:companyId/transactions/:id/uncategorize': 'transactions:write',
|
|
'POST /api/v1/companies/:companyId/transactions/:id/match-invoice': 'transactions:write',
|
|
'POST /api/v1/companies/:companyId/transactions/:id/match-supplier-invoice': 'transactions:write',
|
|
// Writes: bulk
|
|
'POST /api/v1/companies/:companyId/transactions/ingest': 'transactions:write',
|
|
'POST /api/v1/companies/:companyId/transactions/batch-categorize': 'transactions:write',
|
|
// Reconciliation (legacy bank-only routes; kept as aliases of the
|
|
// account-keyed routes below, with their original scopes)
|
|
'POST /api/v1/companies/:companyId/reconciliation/bank/run': 'transactions:write',
|
|
'GET /api/v1/companies/:companyId/reconciliation/bank/status': 'transactions:read',
|
|
// Reconciliation, account-keyed (bank:<cash_account_id> | skattekonto):
|
|
// the account list, the bridge, the item buckets, links and ignore flags.
|
|
'GET /api/v1/companies/:companyId/reconciliation/accounts': 'reconciliation:read',
|
|
'GET /api/v1/companies/:companyId/reconciliation/accounts/:accountKey': 'reconciliation:read',
|
|
'GET /api/v1/companies/:companyId/reconciliation/accounts/:accountKey/items': 'reconciliation:read',
|
|
'POST /api/v1/companies/:companyId/reconciliation/accounts/:accountKey/links': 'reconciliation:write',
|
|
'DELETE /api/v1/companies/:companyId/reconciliation/accounts/:accountKey/links/:linkId': 'reconciliation:write',
|
|
'POST /api/v1/companies/:companyId/reconciliation/accounts/:accountKey/items/:itemId/ignore': 'reconciliation:write',
|
|
|
|
// Phase 5 PR-3: Reports + import async. Reports are read-only over
|
|
// existing lib/reports/* generators; imports are async over the Phase 4
|
|
// PR-2 operations substrate.
|
|
// JSON reports: all share `reports:read` (or `payroll:read` for the
|
|
// salary-scoped ones). kpi, audit-trail, periodisk-sammanstallning,
|
|
// ne-bilaga, and ink2 are deferred to a follow-up PR: kpi composes
|
|
// multiple lib generators rather than wrapping one; audit-trail lives in
|
|
// lib/core/audit/ rather than lib/reports/; ne-bilaga + ink2 + periodisk
|
|
// each have their own lib subdir structure that needs more care.
|
|
'GET /api/v1/companies/:companyId/reports/trial-balance': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/balance-sheet': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/income-statement': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/general-ledger': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/journal-register': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/vat-declaration': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/monthly-breakdown': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/ar-ledger': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/supplier-ledger': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/continuity-check': 'reports:read',
|
|
'GET /api/v1/companies/:companyId/reports/salary-journal': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/reports/avgifter-basis': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/reports/vacation-liability': 'payroll:read',
|
|
// Binary report: SIE4 text/plain export. JSON variants of INK2 / NE-bilaga
|
|
// are deferred (see above).
|
|
'GET /api/v1/companies/:companyId/reports/sie-export': 'reports:read',
|
|
// Imports: async via the Phase 4 PR-2 operations substrate. Multipart
|
|
// uploads (the file is the request body).
|
|
'POST /api/v1/companies/:companyId/imports/sie': 'bookkeeping:write',
|
|
'POST /api/v1/companies/:companyId/imports/bank': 'transactions:write',
|
|
|
|
// Phase 5 PR-1: Payroll vertical (employees + salary-runs + lifecycle verbs).
|
|
// Reuses the pre-existing `payroll:read` / `payroll:write` scopes already
|
|
// defined for the MCP tool surface (gnubok_list_employees, gnubok_create_salary_run, ...).
|
|
// Employees (soft-delete via is_active: no archived_at column).
|
|
'GET /api/v1/companies/:companyId/employees': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/employees/:id': 'payroll:read',
|
|
'POST /api/v1/companies/:companyId/employees': 'payroll:write',
|
|
'PATCH /api/v1/companies/:companyId/employees/:id': 'payroll:write',
|
|
'DELETE /api/v1/companies/:companyId/employees/:id': 'payroll:write',
|
|
// Salary runs (state machine: draft → review → approved → paid → booked).
|
|
'GET /api/v1/companies/:companyId/salary-runs': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/salary-runs/:id': 'payroll:read',
|
|
'POST /api/v1/companies/:companyId/salary-runs': 'payroll:write',
|
|
'PATCH /api/v1/companies/:companyId/salary-runs/:id': 'payroll:write',
|
|
'DELETE /api/v1/companies/:companyId/salary-runs/:id': 'payroll:write',
|
|
// Salary-run lifecycle verbs: v1 :calculate collapses internal /calculate
|
|
// (math) + /review (state advance) so an agent has one verb per logical step.
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/calculate': 'payroll:write',
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/approve': 'payroll:write',
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/mark-paid': 'payroll:write',
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/book': 'payroll:write',
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/generate-agi': 'payroll:write',
|
|
// Payroll gap-closure 1.1: per-employee payslip reads. Personnummer is
|
|
// masked on all payslip-shaped responses (GDPR Art.5(1)(c)); the employee
|
|
// detail endpoint is the identity drill-in.
|
|
'GET /api/v1/companies/:companyId/salary-runs/:id/employees': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/salary-runs/:id/employees/:employeeId': 'payroll:read',
|
|
'GET /api/v1/companies/:companyId/salary-runs/:id/payslips/:employeeId/pdf': 'payroll:read',
|
|
// Payroll gap-closure 1.2: payslip line writes (draft runs only).
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/employees/:employeeId/lines': 'payroll:write',
|
|
'PATCH /api/v1/companies/:companyId/salary-runs/:id/lines/:lineId': 'payroll:write',
|
|
'DELETE /api/v1/companies/:companyId/salary-runs/:id/lines/:lineId': 'payroll:write',
|
|
// Payroll gap-closure 1.3: run roster attach/remove (draft runs only).
|
|
'POST /api/v1/companies/:companyId/salary-runs/:id/employees': 'payroll:write',
|
|
'DELETE /api/v1/companies/:companyId/salary-runs/:id/employees/:employeeId': 'payroll:write',
|
|
// Payroll gap-closure 1.4: absence (frånvaro) per-day register via ranges.
|
|
'GET /api/v1/companies/:companyId/employees/:id/absence': 'payroll:read',
|
|
'PUT /api/v1/companies/:companyId/employees/:id/absence': 'payroll:write',
|
|
'DELETE /api/v1/companies/:companyId/employees/:id/absence': 'payroll:write',
|
|
// Payroll gap-closure 2.3: cutover opening balances (mid-year migration).
|
|
'GET /api/v1/companies/:companyId/employees/:id/opening-balances': 'payroll:read',
|
|
'PUT /api/v1/companies/:companyId/employees/:id/opening-balances': 'payroll:write',
|
|
'PUT /api/v1/companies/:companyId/employees/opening-balances': 'payroll:write',
|
|
// Payroll gap-closure 3.4: vacation ledger + year close.
|
|
'GET /api/v1/companies/:companyId/employees/:id/vacation-balance': 'payroll:read',
|
|
'POST /api/v1/companies/:companyId/salary/vacation-year-close': 'payroll:write',
|
|
|
|
// Dimensions (kostnadsställe/projekt): dimensions PR2. Reads ride
|
|
// reports:read (registry data feeds report filters/pickers); value creation
|
|
// is bookkeeping:write (it mints codes that journal lines reference).
|
|
'GET /api/v1/companies/:companyId/dimensions': 'reports:read',
|
|
'POST /api/v1/companies/:companyId/dimensions/:id/values': 'bookkeeping:write',
|
|
// Value lifecycle (#895): rename/archive/end-date via PATCH; DELETE only
|
|
// succeeds for unreferenced values (BFL retention trigger guards the rest).
|
|
'PATCH /api/v1/companies/:companyId/dimensions/:id/values/:valueId': 'bookkeeping:write',
|
|
'DELETE /api/v1/companies/:companyId/dimensions/:id/values/:valueId': 'bookkeeping:write',
|
|
|
|
// Articles (artikelregister, #895): read-only list so invoice items can
|
|
// link article_id / copy housework_type + revenue_account. Rides
|
|
// invoices:read (the register exists to serve invoicing).
|
|
'GET /api/v1/companies/:companyId/articles': 'invoices:read',
|
|
|
|
// Webhooks (Phase 6 PR-1)
|
|
'GET /api/v1/companies/:companyId/webhooks': 'webhooks:manage',
|
|
'POST /api/v1/companies/:companyId/webhooks': 'webhooks:manage',
|
|
'GET /api/v1/companies/:companyId/webhooks/:id': 'webhooks:manage',
|
|
'PATCH /api/v1/companies/:companyId/webhooks/:id': 'webhooks:manage',
|
|
'DELETE /api/v1/companies/:companyId/webhooks/:id': 'webhooks:manage',
|
|
'POST /api/v1/companies/:companyId/webhooks/:id/test': 'webhooks:manage',
|
|
'GET /api/v1/companies/:companyId/webhooks/:id/deliveries': 'webhooks:manage',
|
|
'POST /api/v1/companies/:companyId/webhooks/:id/rotate-secret': 'webhooks:manage',
|
|
'POST /api/v1/webhook-deliveries/:id/retry': 'webhooks:manage',
|
|
}
|
|
|
|
interface CompiledRoute {
|
|
method: string
|
|
regex: RegExp
|
|
scope: ApiKeyScope
|
|
}
|
|
|
|
let compiledCache: CompiledRoute[] | null = null
|
|
|
|
function compileAll(): CompiledRoute[] {
|
|
if (compiledCache) return compiledCache
|
|
compiledCache = Object.entries(V1_ENDPOINT_SCOPES).map(([pattern, scope]) => {
|
|
const [method, path] = pattern.split(' ', 2)
|
|
const regexStr = '^' + path.replace(/:[^/]+/g, '[^/]+') + '$'
|
|
return { method, regex: new RegExp(regexStr), scope }
|
|
})
|
|
return compiledCache
|
|
}
|
|
|
|
/**
|
|
* Resolve the required scope for a given (method, path) request.
|
|
*
|
|
* - Returns the scope when a registered v1 endpoint matches.
|
|
* - Returns 'public' for paths in V1_PUBLIC_ENDPOINTS (no scope check needed,
|
|
* but the wrapper may still want to log the key id).
|
|
* - Returns null when the path is unknown: the wrapper should treat this as
|
|
* a 404 NOT_FOUND rather than letting the request through unauthenticated.
|
|
*/
|
|
export function resolveRequiredScope(method: string, path: string): ApiKeyScope | 'public' | null {
|
|
const key = `${method} ${path}`
|
|
|
|
if (V1_PUBLIC_ENDPOINTS.includes(key)) return 'public'
|
|
|
|
const compiled = compileAll()
|
|
for (const route of compiled) {
|
|
if (route.method === method && route.regex.test(path)) {
|
|
return route.scope
|
|
}
|
|
}
|
|
|
|
return null
|
|
}
|