WIP: feat(api): endpoint for posibility of connections for ERP systems

[JanKolo04]

Summary

Adds a standardized, ERP-agnostic REST API under /api/v1/erp/* for synchronizing with external ERPs (SAP, Comarch,
enova365, Microsoft Dynamics / Business Central). One canonical JSON contract; per-ERP field-mapping connectors are a documented
follow-up.
enova365, Microsoft Dynamics / Business Central). One canonical JSON contract; per-ERP field-mapping connectors are a documented
follow-up.

Endpoints

• POST /erp/work-orders/import — bulk import work orders (canonical JSON). Reuses the existing WorkOrderImportService, so
  CSV and ERP share one create/validate path. Orders resolve line + product type by code. A malformed payload is rejected
  wholesale (422); a bad reference in one order does not fail the batch — a well-formed batch always returns a per-order
  report, 207 Multi-Status when some rows errored, each carrying {row, field, message}.
• GET /erp/production/completions — produced quantities + completion timestamps per work order.
• GET /erp/quality/issues — non-conformance / issue reports.
• GET /erp/work-orders/{id} — single-order state confirmation.

Exports are cursor-paginated with a since filter for incremental polling.

Auth & limits

• New user-independent API key (X-Api-Key or Authorization: Bearer) with configurable per-endpoint scopes
  (erp:orders:import, erp:production:read, erp:quality:read), optional IP allowlist and expiry. Only the SHA-256
  hash of the secret is stored; the plaintext is shown once at creation.
• Keys managed under Admin → API keys (role:Admin, API CRUD; a React admin page is a follow-up).
• Per-key rate limiting: erp-import (30/min) throttled tighter than erp-read (120/min).

Tenant isolation for headless requests
ERP requests carry no logged-in user, so a new request-scoped TenantContext feeds the existing TenantScope / HasTenant
as a fallback — every ERP query stays correctly tenant-scoped. Change is backward-compatible (the user-auth path is unchanged).
Issue has no tenant_id, so it's isolated through its work order (whereHas('workOrder')).

Feasibility validated — all four ERP families can integrate with this contract (SAP via ABAP/CPI, enova365 via a C# add-on,
Dynamics BC via api/v2.0/AL, Comarch via a .NET connector). Two follow-ups surfaced: OAuth2 client-credentials (for SAP/MS
cloud) alongside the API key, and a production.completed webhook (push for cloud ERPs that can't reach an on-prem endpoint).

Type of change

• Bug fix
• New feature
• Refactor / cleanup
• Documentation
• Other:

Related issue

Closes #

Testing

Added 17 feature tests (tests/Feature/Api/V1/Erp/*, ApiKeyManagementTest) covering the happy path, 422 malformed payload,
207 partial import with structured row errors, 401 (missing/invalid/expired key), 403 (missing scope), per-tenant
isolation on both exports, and one-time plaintext exposure on key creation. Ran alongside existing tenant-isolation and
CSV-import suites — no regressions.

• Tested manually in browser
• php artisan test passes
• Tested as Operator / Supervisor / Admin role (if UI change)

Checklist

• No .env secrets committed
• Migration added if schema changed
• $fillable updated if new model columns added
• No raw SQL with user input (use Eloquent / Query Builder)
• CSRF protection in place for any new forms
• composer audit clean

[coderabbitai]

Important

Review skipped

Auto reviews are disabled on base/target branches other than the default branch.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro Plus

Run ID: d77025fd-b9d6-4ae1-a05f-e0fec3eb8ecf

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch feat/erp-rest-api

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[jakub-przepiora]

@JanKolo04 conflicts