Document storage and archive

Document data is stored in the invoiceR database, but the PDF files are not. For the files, invoiceR connects a storage: a folder on the server, cloud storage, SharePoint or a compliant archive system.

Configuring storages

Each storage is an entry in the table conf.DocumentRepositories. Several storages can exist side by side, for example one for invoices and one for attachments.

Column	Meaning
Id	Assigned by the database. Other configurations refer to it.
TenantId	Tenant.
Name	Free label, for notes only.
AssemblyName	Full class name of the storage plugin, for example enio.storage.Plugin.SharePoint.SharePointStorage. The plugin must be in the PLUGINS folder of the backend.
Connection	JSON with the plugin settings (address, credentials, mapping of document fields to archive attributes).
EnvironmentFilter	Empty: the entry always applies. Otherwise only in the named environments, for example Production. Separate several values with commas.
DocumentType	Document type the storage applies to: 1 invoice, 2 attachment, 3 report, 4 document. This lets you store invoices and attachments in different archives.

Plugins are available for the file system, Azure Storage, Amazon S3, SFTP, SharePoint Online and various archive systems, among others. Clarify with enio which plugin and settings suit you.

Caution

The Connection column often contains credentials. Only pass on extracts of this table securely.

SharePoint as storage

With SharePoint Online as storage, a document library can serve as the archive. With suitable retention policies in Microsoft 365 you prevent documents from being deleted before a deadline. On request, enio provides a guide for setting up the library.

Preparing the app registration

1. Create an app registration and note the Tenant ID and the Application (client) ID.
2. Under API permissions > Add a permission > SharePoint, add the application permission Sites.Selected and grant consent with Grant admin consent.
3. Create a certificate (for example with the PowerShell script from the Microsoft guide “Granting access via Azure AD App-Only”). Upload the .cer file to the app under Certificates & secrets.
4. Hand over the .pfx file with its password to enio through a secure channel. For this kind of access SharePoint only accepts a certificate; a client secret is not enough (requests are rejected with status 401).

Granting access to the library

Sites.Selected initially gives the app access to no site at all. You grant access specifically for the site containing the library. You need at least site collection administrator rights.

With the CLI for Microsoft 365 (requires Node.js):

npm i -g @pnp/cli-microsoft365
m365 login
m365 spo site apppermission add --permission write --appId <application-id> --siteUrl https://contoso.sharepoint.com/sites/Creditors
m365 spo site apppermission list --appId <application-id> --siteUrl https://contoso.sharepoint.com/sites/Creditors

Or with PnP PowerShell (PowerShell 7.2 or later):

Install-Module PnP.PowerShell -Scope CurrentUser
Connect-PnPOnline contoso.sharepoint.com -Interactive
Grant-PnPAzureADAppSitePermission -Permissions Write -DisplayName "invoiceR" -AppId <application-id> -Site https://contoso.sharepoint.com/sites/Creditors
Get-PnPAzureADAppSitePermission -AppIdentity <application-id> -Site https://contoso.sharepoint.com/sites/Creditors

Possible permissions are read, write, manage and fullcontrol. write is enough for storage.

Settings in the Connection JSON

Key	Meaning	Example
url	Address of the SharePoint tenant	https://contoso.sharepoint.com
ContentSite	Site name; empty or / for the root site	Creditors
ContentFolder	Name of the document library	Shared Documents
OAuthTenantId	Tenant ID	<tenant-id>
OAuthClientId	Application ID of the app	<application-id>
OAuthCertificatePath	Path to the .pfx file on the server, absolute or relative	Certificates/invoicer.pfx
OAuthCertificatePassword	Password of the .pfx file	<password>

Tip

Note the expiry date of the certificate. Once it expires, invoiceR can no longer store or display files.

Opening a document from another program

Other programs (for example an ERP) can open a document directly in invoiceR. The link leads to the archive and opens the document:

• By document number: https://<invoicer-address>/app/main/archive?external=<document-number>#external
• By internal ID: https://<invoicer-address>/app/main/archive?case=<ID>#case

The user must be logged in and allowed to see the document.