Nora
fc70344dab
Deploy to route.crispygoat.com / deploy (push) Successful in 5m34s
Per-brand Smartsheet integration that pushes new water_log_entries to a
configured sheet. Config UI lives at /admin/water-log/settings.
Database (0093_water_smartsheet_sync.sql):
- water_smartsheet_config: one row per brand; AES-256-GCM encrypted API
token (BYTEA), sheet id, column mapping JSONB, sync_frequency
(realtime | every_15_minutes | hourly), enable flag, last-sync
metadata. RLS via existing current_brand_id() pattern.
- water_smartsheet_sync_queue: one row per entry awaiting sync;
tracks status / attempts / exponential backoff. UNIQUE(brand_id,
entry_id) for idempotent enqueue.
- water_smartsheet_sync_log: append-only audit of every sync attempt
(success or failure); backs the Recent Activity panel in the UI.
Server:
- src/lib/crypto.ts: AES-256-GCM encrypt/decrypt + token mask helper.
Reads SMARTSHEET_TOKEN_ENC_KEY. Throws on missing/wrong-size key.
- src/lib/smartsheet.ts: typed REST wrapper (no SDK; the official
smartsheet npm has Node 22 compat issues). getSheetMeta, addRow,
findRowByColumn + typed SmartsheetApiError.
- src/services/smartsheet-sync.ts: syncEntryToSmartsheet (one entry),
drainSyncQueue (batch with backoff), runScheduledSync (cron entry).
Sequential processing stays well under Smartsheet's 300 req/min.
Max 5 attempts, then row stays 'failed' permanently.
- src/actions/water-log/smartsheet.ts: 6 server actions. Token never
returned in plaintext — UI gets maskedToken only. Permission check
matches the rest of the water-log module (can_manage_water_log).
- src/app/api/water-log/smartsheet-sync/route.ts: POST cron route,
bearer auth via SMARTSHEET_CRON_SECRET (falls back to CRON_SECRET).
Optional {brandId} body for manual retry.
- vercel.json: added */15 * * * * cron entry. Single entry covers
both 15-min and hourly frequencies (route filters per-brand).
UI:
- src/components/admin/water-log/SmartsheetIntegrationCard.tsx:
self-contained client component with useReducer. Sections: enable
toggle, sheet URL/ID + API token + Test Connection, sync frequency
radio group, column mapping dropdowns (populated after Test),
Recent Activity panel.
- src/app/admin/water-log/settings/page.tsx: mounted the card as new
'§ 05 — Integrations' section after the existing admin-PIN settings.
Card takes brandId as a prop (CLAUDE.md 'Brand ID Threading').
Hooks:
- src/actions/water-log/field.ts::submitWaterEntry: calls
triggerSyncForEntry(brandId, entryId) in a fire-and-forget void
after the entry insert. Sync failures NEVER bubble to the field
worker.
Env vars (.env.example):
- SMARTSHEET_TOKEN_ENC_KEY (REQUIRED, 32 random bytes base64)
- SMARTSHEET_CRON_SECRET (optional bearer)
- SMARTSHEET_SYNC_TIMEOUT_MS (optional, default 8000)
Deploy:
1. openssl rand -base64 32 → SMARTSHEET_TOKEN_ENC_KEY in .env.local
AND Vercel dashboard
2. npm run migrate:one 93 (pushes 0093_water_smartsheet_sync.sql)
3. Push triggers .gitea/workflows/deploy.yml
Rollback: remove cron entry, DROP the 3 tables, revert field.ts +
settings page hooks, git revert the merge commit. See MEMORY.md
for full rollback story + sharp edges (no key rotation, slug URLs).
97 lines
5.2 KiB
Bash
97 lines
5.2 KiB
Bash
# ============================================================================
|
|
# Route Commerce — Environment variables
|
|
# ============================================================================
|
|
# Copy to `.env.local` and fill in real values for local development.
|
|
# Production: set these in your hosting dashboard (Vercel / Netlify / etc.).
|
|
# ============================================================================
|
|
|
|
# ── App ─────────────────────────────────────────────────────────────────────
|
|
NEXT_PUBLIC_BASE_URL=http://localhost:4000
|
|
NEXT_PUBLIC_SITE_URL=http://localhost:4000
|
|
|
|
# ── Database (Neon Postgres, direct pg driver) ─────────────────────────────
|
|
# Single connection string used by the pg Pool in src/lib/auth.ts and the
|
|
# admin-permissions / data-service layer. Format:
|
|
# postgresql://USER:PASS@HOST:PORT/DBNAME?sslmode=require
|
|
DATABASE_URL=postgresql://postgres:postgres@localhost:5432/route_commerce
|
|
|
|
# ── Neon Auth (Better Auth) ───────────────────────────────────────────────
|
|
# Get these from: neonctl neon-auth status
|
|
# Base URL: "Auth Base URL" field
|
|
# Cookie secret: openssl rand -base64 32 (min 32 chars)
|
|
NEON_AUTH_BASE_URL=https://your-branch.neonauth.region.aws.neon.tech/neondb/auth
|
|
NEON_AUTH_COOKIE_SECRET=replace-me-with-a-32-char-secret
|
|
|
|
# ── Stripe ─────────────────────────────────────────────────────────────────
|
|
STRIPE_SECRET_KEY=
|
|
STRIPE_WEBHOOK_SECRET=
|
|
NEXT_PUBLIC_STRIPE_PUBLISHABLE_KEY=
|
|
STRIPE_PRICE_STARTER=
|
|
STRIPE_PRICE_FARM=
|
|
STRIPE_PRICE_ENTERPRISE=
|
|
STRIPE_PRICE_HARVEST_REACH=
|
|
STRIPE_PRICE_WHOLESALE_PORTAL=
|
|
STRIPE_PRICE_WATER_LOG=
|
|
STRIPE_PRICE_AI_TOOLS=
|
|
STRIPE_PRICE_SQUARE_SYNC=
|
|
STRIPE_PRICE_SMS_CAMPAIGNS=
|
|
|
|
# ── Resend (transactional email) ────────────────────────────────────────────
|
|
RESEND_API_KEY=
|
|
RESEND_WEBHOOK_SECRET=
|
|
|
|
# ── AI providers ──────────────────────────────────────────────────────────
|
|
OPENAI_API_KEY=
|
|
ANTHROPIC_API_KEY=
|
|
GOOGLE_API_KEY=
|
|
XAI_API_KEY=
|
|
MINIMAX_API_KEY=
|
|
MINIMAX_BASE_URL=https://api.minimax.io/v1
|
|
|
|
# ── Square (optional) ─────────────────────────────────────────────────────
|
|
SQUARE_APP_SECRET=
|
|
SQUARE_ENVIRONMENT=sandbox
|
|
|
|
# ── MinIO / S3-compatible object storage ─────────────────────────────────────
|
|
# Endpoint: host:port only (no https://). Use MINIO_PUBLIC_URL for the public base.
|
|
MINIO_ENDPOINT=s3.crispygoat.com
|
|
MINIO_REGION=us-east-1
|
|
MINIO_USE_SSL=true
|
|
MINIO_ACCESS_KEY=routecommerce
|
|
MINIO_SECRET_KEY=miniochangeme123
|
|
# Override public URL if different from endpoint (e.g. Cloudflare CDN in front)
|
|
MINIO_PUBLIC_URL=https://s3.crispygoat.com
|
|
# Bucket names — create these in MinIO first (mc mb myminio/route-products, etc.)
|
|
MINIO_BUCKET_PRODUCTS=route-products
|
|
MINIO_BUCKET_BRAND_LOGOS=route-brand-logos
|
|
MINIO_BUCKET_WATER_LOGS=route-water-logs
|
|
|
|
# ── Cron / automation ───────────────────────────────────────────────────────
|
|
CRON_SECRET=replace-me-with-a-random-string
|
|
|
|
# ── Water Log ───────────────────────────────────────────────────────────────
|
|
# The Water Log module reuses the existing `DATABASE_URL` and (for photo
|
|
# uploads) the `MINIO_BUCKET_WATER_LOGS` bucket above. It also reuses the
|
|
# brand's Twilio / SMS config for high/low threshold alerts. The
|
|
# Tuxedo brand UUID is a public default used as a fallback for cold-start
|
|
# paths when the calling admin user is a platform_admin with brand_id=null.
|
|
# It does NOT need to be set as an env var — the value is hardcoded in
|
|
# the server actions — but you can override it with:
|
|
# TUXEDO_BRAND_ID=64294306-5f42-463d-a5e8-2ad6c81a96de
|
|
# See docs/water-log.md for the full module guide.
|
|
|
|
# ── Smartsheet (Water Log integration) ────────────────────────────────────
|
|
# AES-256-GCM key used to encrypt each brand's Smartsheet API token at
|
|
# rest in `water_smartsheet_config.encrypted_api_token`. 32 random bytes,
|
|
# base64-encoded. REQUIRED in production — refuses to start without it.
|
|
# Generate with: openssl rand -base64 32
|
|
SMARTSHEET_TOKEN_ENC_KEY=
|
|
|
|
# Bearer secret for /api/water-log/smartsheet-sync cron route. Falls
|
|
# back to CRON_SECRET (above) if unset. Use a unique value per env to
|
|
# avoid cross-route authorization bleed.
|
|
SMARTSHEET_CRON_SECRET=
|
|
|
|
# HTTP timeout (ms) for outbound Smartsheet API calls. Default 8000.
|
|
# SMARTSHEET_SYNC_TIMEOUT_MS=8000
|