SGApps IO — ERP Config Manager

SGApps Labs SRL — Hosted, versioned, browser-edited configuration store for ERPs and business backends.

<div class="cta-row">

Launch the app →
API reference

</div>

Overview

Stop hand-editing JSON files on production. Move your ERP-side configuration(pricing rules, taxonomies, user roles, environment settings) into a hostedstore with a real editor, real history, and a real API.

Property Detail
Editor Monaco (the VS Code engine), running in your browser
Storage GridFS-backed, path-scoped per user
Versioning Automatic snapshot on every save (PUT)
Rollback One-click restore of any past version (creates pre-rollback snapshot first)
API for clients GitLab v4 compatible — list branches, tree, raw files
Authentication Session cookie for the UI; PRIVATE-TOKEN for external clients

Features

How it works

Three roles: you (the operator browsing configs), the editor(this app, in your browser), and the ERP instance (your backendreading configs).

1. Create a project

From the file manager, create a folder under/apps/site-builder/user/&#x7B;you&#x7D;/. Each project is a self-contained configrepo with its own branches and history.

2. Edit configs in Monaco

Click any file — JSON gets syntax highlighting and inline validation.Save with Ctrl+S or the toolbar Save button. A snapshot iscreated automatically.

3. Issue a token, hand it to your ERP

On the project overview, click + New token, scope it to the rightrepo(s), set an expiry. The token value is shown once — paste it intoyour ERP's secret store right then.

4. Your ERP polls the read API

On boot or refresh, the ERP fetches its config tree and files.commit.short_id only changes when content changes, so polling stayscheap regardless of frequency.

Path scheme

All data lives in GridFS under predictable paths:

/apps/site-builder/user/{owner}/{repoId}/branch/{ref}/{relPath}
/apps/site-builder/user/{owner}/{repoId}/.history/{ref}/v{NNNN}-{iso-ts}/{relPath}
Why this matters. The path scheme is the source of truth — there's no separate metadata table. Listing branches is a directory listing. Listing history is a directory listing. Reading a snapshot is reading files. Operationally this means GridFS tooling (mongofiles, mongoexport) works directly on configs without going through this app.

Security model

Surface Auth Mutability
Admin API (/site-builder/api/projects/...) Session cookie Read/write — owner only
Read API (/site-builder/api/erp-config/...) PRIVATE-TOKEN header Read-only — scoped per token
Token CRUD (/site-builder/api/tokens) Session cookie Read/write — owner only

The admin API enforces &#x7B;owner&#x7D; == session.user._id so users can neveraccess another user's projects. The read API resolves the token to itsowner+repos list and refuses paths outside that scope.
For high-security deployments, enable X-Instance-Id fingerprintbinding when issuing a token — a leaked token then only works from theoriginal ERP instance (the client sends the same fingerprint header onevery request; the server compares with crypto.timingSafeEqual).

Continue reading