fix(erp-export): strict seit format, DB clock for settle window, movement index, one scope per key

Co-Authored-By: Claude Opus 5.5 (1M context) <[email protected]>

ApiCore-Frontend/src/lib/api-keys/scopes.spec.ts

@@ -1,5 +1,10 @@
 import { describe, expect, it } from "vitest";
-import { API_KEY_SCOPES, apiKeyScopeLabel, hasReadAndWriteScopes } from "./scopes";
+import {
+  API_KEY_SCOPES,
+  apiKeyScopeLabel,
+  hasReadAndWriteScopes,
+  separationAdvice,
+} from "./scopes";
 
 describe("hasReadAndWriteScopes", () => {
   it("is true for a key that may read and book", () => {
@@ -18,6 +23,37 @@ describe("hasReadAndWriteScopes", () => {
   });
 });
 
+describe("separationAdvice", () => {
+  it("is null for a key with one scope", () => {
+    expect(separationAdvice(["shop-sync:read"])).toBeNull();
+    expect(separationAdvice(["erp-inventory:read"])).toBeNull();
+  });
+
+  it("names Wabenhain for a shop key that reads and books", () => {
+    const advice = separationAdvice(["shop-sync:read", "shop-sync:write"]);
+    expect(advice).toMatch(/darf lesen und buchen/);
+    expect(advice).toMatch(/zwei getrennte Schlüssel/);
+    expect(advice).toMatch(/in Wabenhain eintragen/);
+  });
+
+  it("names each consuming system, not only Wabenhain", () => {
+    const advice = separationAdvice(["erp-inventory:read", "shop-sync:write"]);
+    expect(advice).toMatch(/darf lesen und buchen/);
+    expect(advice).toMatch(/in ERPNext bzw. Wabenhain eintragen/);
+  });
+
+  it("advises separate keys for several read scopes too", () => {
+    const advice = separationAdvice(["shop-sync:read", "erp-inventory:read"]);
+    expect(advice).toMatch(/mehrere Rechte/);
+    expect(advice).toMatch(/je Recht ein eigener Schlüssel/);
+    expect(advice).toMatch(/in Wabenhain bzw. ERPNext eintragen/);
+  });
+
+  it("falls back to a neutral wording for unknown scopes", () => {
+    expect(separationAdvice(["future:a", "future:b"])).toMatch(/im angebundenen System eintragen/);
+  });
+});
+
 describe("API key scopes", () => {
   it("match the backend allowlist", () => {
     expect(API_KEY_SCOPES).toEqual(["shop-sync:read", "shop-sync:write", "erp-inventory:read"]);

ApiCore-Frontend/src/lib/api-keys/scopes.ts

@@ -1,5 +1,3 @@
-import type { ApiKey } from "./types";
-
 /** Berechtigungen, die ein API-Schlüssel tragen kann - wie API_KEY_SCOPES im Backend. */
 export const API_KEY_SCOPES = ["shop-sync:read", "shop-sync:write", "erp-inventory:read"] as const;
 
@@ -24,7 +22,36 @@ export function apiKeyScopeLabel(scope: string): string {
  * the server no longer creates such keys, the UI nudges towards two keys.
  * The ERP inventory scope counts as reading.
  */
-export function hasReadAndWriteScopes(apiKey: Pick<ApiKey, "scopes">): boolean {
+export function hasReadAndWriteScopes(apiKey: { scopes: readonly string[] }): boolean {
   const isWrite = (scope: string) => WRITE_SCOPES.includes(scope);
   return apiKey.scopes.some(isWrite) && apiKey.scopes.some((scope) => !isWrite(scope));
 }
+
+/** Welches System einen Schlüssel mit diesem Recht benutzt. */
+const CONSUMING_SYSTEM: Record<ApiKeyScope, string> = {
+  "shop-sync:read": "Wabenhain",
+  "shop-sync:write": "Wabenhain",
+  "erp-inventory:read": "ERPNext",
+};
+
+function consumingSystems(scopes: readonly string[]): string[] {
+  const systems = scopes
+    .map((scope) => (CONSUMING_SYSTEM as Record<string, string>)[scope])
+    .filter((system): system is string => system !== undefined);
+  return [...new Set(systems)];
+}
+
+/**
+ * Hinweis für einen älteren Schlüssel mit mehreren Rechten (der Server legt
+ * nur noch Schlüssel mit genau einem Recht an), oder null. Nennt das System,
+ * in dem die neuen Schlüssel einzutragen sind.
+ */
+export function separationAdvice(scopes: readonly string[]): string | null {
+  if (new Set(scopes).size < 2) return null;
+  const systems = consumingSystems(scopes);
+  const where = systems.length > 0 ? `in ${systems.join(" bzw. ")}` : "im angebundenen System";
+  const why = hasReadAndWriteScopes({ scopes })
+    ? "Dieser Schlüssel darf lesen und buchen. Sicherer sind zwei getrennte Schlüssel: einer zum Lesen, einer zum Buchen."
+    : "Dieser Schlüssel trägt mehrere Rechte. Sicherer ist je Recht ein eigener Schlüssel.";
+  return `${why} Neue Schlüssel anlegen, ${where} eintragen, dann diesen widerrufen.`;
+}