Phase 4 + 6

inventory-server/dashboard/routes/klaviyo/index.js

@@ -0,0 +1,48 @@
+// Klaviyo router factory. Phase 4 merge: takes the injected redis client and
+// the env-resolved API key/revision, returns the mounted /api/klaviyo router
+// (matches Caddy proxy path; no rewrite needed).
+
+import express from 'express';
+import rateLimit from 'express-rate-limit';
+import { requirePermission } from '../../../shared/auth/middleware.js';
+
+import { createEventsRouter } from './events.routes.js';
+import { createMetricsRouter } from './metrics.routes.js';
+import { createCampaignsRouter } from './campaigns.routes.js';
+import { createReportingRouter } from './reporting.routes.js';
+
+export function createKlaviyoRouter({ redis }) {
+  const apiKey = process.env.KLAVIYO_API_KEY;
+  const apiRevision = process.env.KLAVIYO_API_REVISION || '2024-02-15';
+
+  if (!apiKey) {
+    // Loud at startup; the routes themselves will 500 on every call without it.
+    console.warn('[klaviyo] KLAVIYO_API_KEY not set — Klaviyo endpoints will fail');
+  }
+
+  const router = express.Router();
+
+  // Phase 4 carryover from klaviyo-server: throttle the heavy /reporting/campaign-values-reports
+  // endpoint. authenticate() already runs upstream so we don't add a per-user limiter here.
+  const reportingLimiter = rateLimit({
+    windowMs: 10 * 60 * 1000,
+    max: 10,
+    message: 'Too many requests to reporting endpoint, please try again later',
+    keyGenerator: (req) => `${req.ip}-klaviyo-reporting`,
+    skip: (req) => !req.path.includes('campaign-values-reports'),
+    standardHeaders: true,
+    legacyHeaders: false,
+  });
+  router.use('/reporting', reportingLimiter);
+
+  router.use('/events', createEventsRouter(apiKey, apiRevision, redis));
+  router.use('/metrics', createMetricsRouter(apiKey, apiRevision));
+  router.use('/campaigns', createCampaignsRouter(apiKey, apiRevision, redis));
+  router.use('/reporting', createReportingRouter(apiKey, apiRevision, redis));
+
+  return router;
+}
+
+// Re-exported so the dashboard server / future tests can attach the
+// klaviyo_admin gate without reaching into the events router file.
+export { requirePermission };