f325299d-c1a0-4376-98ae-ddb747d23da5

src/lib/seed.ts

@@ -669,10 +669,53 @@ async function main() {
 
   // audit entries for accounting
   await db.auditLog.create({ data: { actor: 'nora@nordlicht.digital', action: 'vat.compute', entity: 'VatReturn', entityId: 'seed', after: '{"period":"2026-10","payable":94800}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
-  await db.auditLog.create({ data: { actor: 'nora@nordlicht.digital', action: 'vat.submit:elster', entity: 'VatReturn', entityId: 'seed', after: '{"elsterRef":"ERiC-2026-09","status":"accepted"}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
+  await db.auditLog.create({ data: { actor: 'nora@nordlicht.digital', action: 'vat.prepare:xml', entity: 'VatReturn', entityId: 'seed', after: '{"status":"prepared","xmlBytes":993}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
   await db.auditLog.create({ data: { actor: 'nora@nordlicht.digital', action: 'bank.import:camt053', entity: 'BankTransaction', entityId: 'seed', after: '{"count":10,"batch":"camt-2026-10"}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
   await db.auditLog.create({ data: { actor: 'nora@nordlicht.digital', action: 'bank.match:invoice', entity: 'BankTransaction', entityId: 'seed', after: '{"invoiceId":"matched","status":"matched"}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
 
+  // --- API Tokens + Webhooks (real crypto, hashed at rest) -----------------
+  const crypto = await import('crypto')
+  const apiTokens = [
+    { name: 'ZeroClaw Agent (read-only)', scopes: ['crm.company:read', 'finance.invoice:read', 'licenses.license:read'] },
+    { name: 'DATEV Export-Skript', scopes: ['finance.invoice:read'] },
+    { name: 'WordPress Update-Server', scopes: ['licenses.license:read'] },
+  ]
+  for (const t of apiTokens) {
+    const plaintext = 'aos_' + crypto.randomBytes(32).toString('hex')
+    const tokenHash = crypto.createHash('sha256').update(plaintext).digest('hex')
+    const tokenPrefix = 'aos_' + plaintext.slice(4, 11)
+    await db.apiToken.create({
+      data: { name: t.name, tokenHash, tokenPrefix, scopes: JSON.stringify(t.scopes), lastUsedAt: daysFromNow(-2) },
+    })
+  }
+  // one revoked token
+  const revokedPlain = 'aos_' + crypto.randomBytes(32).toString('hex')
+  await db.apiToken.create({
+    data: {
+      name: 'Altes Backup-Skript (widerrufen)',
+      tokenHash: crypto.createHash('sha256').update(revokedPlain).digest('hex'),
+      tokenPrefix: 'aos_' + revokedPlain.slice(4, 11),
+      scopes: JSON.stringify(['finance.invoice:read']),
+      revokedAt: daysFromNow(-30),
+      lastUsedAt: daysFromNow(-32),
+    },
+  })
+
+  // Webhooks with real HMAC secrets
+  const webhooks = [
+    { url: 'https://make.nordlicht.digital/webhooks/aos', events: ['invoice.paid', 'contract.signed', 'lead.approved'], sentCount: 47, failCount: 2, lastStatus: 200, lastSentAt: daysFromNow(-0.2) },
+    { url: 'https://hooks.slack.com/services/T0/B0/xxxx', events: ['ticket.created', 'invoice.overdue'], sentCount: 12, failCount: 0, lastStatus: 200, lastSentAt: daysFromNow(-1) },
+    { url: 'https://erp.hansemoebel.de/api/aos-events', events: ['license.activated'], sentCount: 5, failCount: 1, lastStatus: 500, lastSentAt: daysFromNow(-3) },
+  ]
+  for (const w of webhooks) {
+    await db.webhook.create({
+      data: { ...w, events: JSON.stringify(w.events), secret: 'whsec_' + crypto.randomBytes(24).toString('hex') },
+    })
+  }
+
+  await db.auditLog.create({ data: { actor: 'max@nordlicht.digital', action: 'api.token:create', entity: 'ApiToken', entityId: 'seed', after: '{"name":"ZeroClaw Agent","scopes":["crm.company:read"]}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
+  await db.auditLog.create({ data: { actor: 'max@nordlicht.digital', action: 'webhook.create', entity: 'Webhook', entityId: 'seed', after: '{"url":"make.nordlicht.digital","events":["invoice.paid"]}', hash: 'sha256:' + Math.random().toString(36).slice(2) } })
+
   console.log('Seed complete.')
 }