@aglyn/plugins-crm 1.0.0-beta.143

package/src/lib/server/company-delete.d.ts

@@ -0,0 +1,59 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `POST /api/crm/company-delete` — unlink the contacts that name a company,
+ * then delete it (AGL-2804).
+ *
+ * Body: `{ hostId, companyId }` under a site, or `{ orgId, companyId }` at
+ * the organization level. Answers `CompanyDeleteResponse`.
+ *
+ * ## Why a route
+ *
+ * Firestore does not cascade. A company deleted on its own leaves every
+ * contact at it naming a record that no longer exists: their page links to
+ * nothing and the `companyIds` mirror the company list queries keeps
+ * matching a ghost. So a delete is a detach pass and then a delete, and the
+ * detach clears each holder's facet that named the company — which the rules
+ * refuse a client, because they cannot tell a company link inside a facet
+ * from an owner or a stage beside it.
+ *
+ * ## Bounded, and honest past the bound
+ *
+ * One pass unlinks at most `COMPANY_DETACH_LIMIT` contacts, a batch's worth.
+ * A company past that is left standing with a pass's worth unlinked, and the
+ * answer says more remain, so the next delete continues where this one
+ * stopped. A company is never deleted with a link still on a contact.
+ *
+ * ## Who may call it
+ *
+ * A CRM writer (`authorizeCrmWriter`) whose reach is the whole organization.
+ * The contacts are found by the mirror, and that query cannot carry a scope
+ * clause beside its `array-contains`: a member scoped to particular sites
+ * could not read them in the browser either, and the route does not unlink
+ * people on behalf of someone who may not see them.
+ *
+ * ## The plan
+ *
+ * Companies are the CRM's, and the CRM is included from Starter (AGL-2851):
+ * a workspace whose plan does not carry it is refused once the writer is
+ * known, staff included, before anything is read or unlinked
+ * (`suite-gate.ts`).
+ */
+import { type PluginApiHandler } from '@aglyn/aglyn/server';
+/** What a member scoped to particular sites is told. */
+export declare const COMPANY_DELETE_SCOPED_REFUSAL: string;
+export declare const crmCompanyDeleteHandler: PluginApiHandler;

package/src/lib/server/company-delete.js

@@ -0,0 +1,146 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /api/crm/company-delete` — unlink the contacts that name a company,
+ * then delete it (AGL-2804).
+ *
+ * Body: `{ hostId, companyId }` under a site, or `{ orgId, companyId }` at
+ * the organization level. Answers `CompanyDeleteResponse`.
+ *
+ * ## Why a route
+ *
+ * Firestore does not cascade. A company deleted on its own leaves every
+ * contact at it naming a record that no longer exists: their page links to
+ * nothing and the `companyIds` mirror the company list queries keeps
+ * matching a ghost. So a delete is a detach pass and then a delete, and the
+ * detach clears each holder's facet that named the company — which the rules
+ * refuse a client, because they cannot tell a company link inside a facet
+ * from an owner or a stage beside it.
+ *
+ * ## Bounded, and honest past the bound
+ *
+ * One pass unlinks at most `COMPANY_DETACH_LIMIT` contacts, a batch's worth.
+ * A company past that is left standing with a pass's worth unlinked, and the
+ * answer says more remain, so the next delete continues where this one
+ * stopped. A company is never deleted with a link still on a contact.
+ *
+ * ## Who may call it
+ *
+ * A CRM writer (`authorizeCrmWriter`) whose reach is the whole organization.
+ * The contacts are found by the mirror, and that query cannot carry a scope
+ * clause beside its `array-contains`: a member scoped to particular sites
+ * could not read them in the browser either, and the route does not unlink
+ * people on behalf of someone who may not see them.
+ *
+ * ## The plan
+ *
+ * Companies are the CRM's, and the CRM is included from Starter (AGL-2851):
+ * a workspace whose plan does not carry it is refused once the writer is
+ * known, staff included, before anything is read or unlinked
+ * (`suite-gate.ts`).
+ */ import { CONTACT_COMPANY_IDS_FIELD, contactFacetPath, contactGroupsNamingCompany, CRM_COLLECTIONS, isOrgWideMember } from "@aglyn/aglyn/server";
+import { firebaseAdmin } from "@aglyn/tenant-data-admin";
+import { FieldValue } from "firebase-admin/firestore";
+import { COMPANY_DETACH_LIMIT } from "../model/company-delete-route.js";
+import { typed } from "./contact-profile.js";
+import { readCrmRouteScope } from "./org-caller.js";
+import { authorizeCrmWriter, canReach } from "./task-routes.js";
+/** What a member scoped to particular sites is told. */ export const COMPANY_DELETE_SCOPED_REFUSAL = 'Your access is limited to specific sites, so the contacts at this company ' + 'could not be read to unlink them. Ask an organization administrator to delete it.';
+/**
+ * A contact's update when a company it names is deleted: the id out of the
+ * mirror, and out of every holder's facet that named it. Another holder's
+ * link to a different company is not read or written.
+ */ function companyDetachFields(contact, companyId) {
+    const update = {
+        [CONTACT_COMPANY_IDS_FIELD]: FieldValue.arrayRemove(companyId),
+        updatedAt: FieldValue.serverTimestamp()
+    };
+    for (const groupId of contactGroupsNamingCompany(contact, companyId)){
+        update[contactFacetPath(groupId, 'companyId')] = FieldValue.delete();
+    }
+    return update;
+}
+export const crmCompanyDeleteHandler = async (req, res)=>{
+    var _req_body;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const body = (_req_body = req.body) != null ? _req_body : {};
+    const scope = readCrmRouteScope(body);
+    const companyId = typed(body['companyId'], 200);
+    if (!scope || !companyId || companyId.includes('/')) {
+        res.status(400).json({
+            error: 'Missing hostId or companyId'
+        });
+        return;
+    }
+    try {
+        const writer = await authorizeCrmWriter(req, scope, {
+            suiteAct: 'Deleting a company'
+        });
+        if (writer.ok === false) {
+            res.status(writer.status).json(writer.body);
+            return;
+        }
+        if (!(writer.staff || writer.level === 'org' || isOrgWideMember(writer.member))) {
+            res.status(403).json({
+                error: COMPANY_DELETE_SCOPED_REFUSAL
+            });
+            return;
+        }
+        const firestore = firebaseAdmin.app().firestore();
+        const orgRef = firestore.collection('orgs').doc(writer.orgId);
+        const companyRef = orgRef.collection(CRM_COLLECTIONS.companies).doc(companyId);
+        const company = await companyRef.get();
+        if (!company.exists || !canReach(writer, company.get('visibleTo'))) {
+            res.status(404).json({
+                error: 'That company no longer exists.'
+            });
+            return;
+        }
+        // One past the bound, so "more remain" is a fact from the probe row
+        // rather than a guess from a full page.
+        const probe = await orgRef.collection('contacts').where(CONTACT_COMPANY_IDS_FIELD, 'array-contains', companyId).limit(COMPANY_DETACH_LIMIT + 1).get();
+        const linked = probe.docs.slice(0, COMPANY_DETACH_LIMIT);
+        const moreRemain = probe.docs.length > COMPANY_DETACH_LIMIT;
+        if (linked.length) {
+            const batch = firestore.batch();
+            for (const snapshot of linked){
+                batch.update(snapshot.ref, companyDetachFields(snapshot.data(), companyId));
+            }
+            await batch.commit();
+        }
+        if (!moreRemain) await companyRef.delete();
+        const answer = {
+            ok: true,
+            deleted: !moreRemain,
+            detached: linked.length,
+            moreRemain
+        };
+        res.status(200).json(answer);
+    } catch (error) {
+        console.error('[crm] company-delete failed', companyId, error);
+        res.status(500).json({
+            error: 'The company could not be deleted.'
+        });
+    }
+};
+
+//# sourceMappingURL=company-delete.js.map

package/src/lib/server/company-delete.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/company-delete.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/company-delete` — unlink the contacts that name a company,\n * then delete it (AGL-2804).\n *\n * Body: `{ hostId, companyId }` under a site, or `{ orgId, companyId }` at\n * the organization level. Answers `CompanyDeleteResponse`.\n *\n * ## Why a route\n *\n * Firestore does not cascade. A company deleted on its own leaves every\n * contact at it naming a record that no longer exists: their page links to\n * nothing and the `companyIds` mirror the company list queries keeps\n * matching a ghost. So a delete is a detach pass and then a delete, and the\n * detach clears each holder's facet that named the company — which the rules\n * refuse a client, because they cannot tell a company link inside a facet\n * from an owner or a stage beside it.\n *\n * ## Bounded, and honest past the bound\n *\n * One pass unlinks at most `COMPANY_DETACH_LIMIT` contacts, a batch's worth.\n * A company past that is left standing with a pass's worth unlinked, and the\n * answer says more remain, so the next delete continues where this one\n * stopped. A company is never deleted with a link still on a contact.\n *\n * ## Who may call it\n *\n * A CRM writer (`authorizeCrmWriter`) whose reach is the whole organization.\n * The contacts are found by the mirror, and that query cannot carry a scope\n * clause beside its `array-contains`: a member scoped to particular sites\n * could not read them in the browser either, and the route does not unlink\n * people on behalf of someone who may not see them.\n *\n * ## The plan\n *\n * Companies are the CRM's, and the CRM is included from Starter (AGL-2851):\n * a workspace whose plan does not carry it is refused once the writer is\n * known, staff included, before anything is read or unlinked\n * (`suite-gate.ts`).\n */\n\nimport {\n  CONTACT_COMPANY_IDS_FIELD,\n  contactFacetPath,\n  contactGroupsNamingCompany,\n  CRM_COLLECTIONS,\n  isOrgWideMember,\n  type PluginApiHandler,\n} from '@aglyn/aglyn/server'\nimport { firebaseAdmin } from '@aglyn/tenant-data-admin'\nimport { FieldValue } from 'firebase-admin/firestore'\nimport {\n  COMPANY_DETACH_LIMIT,\n  type CompanyDeleteResponse,\n} from '../model/company-delete-route'\nimport { typed } from './contact-profile'\nimport { readCrmRouteScope } from './org-caller'\nimport { authorizeCrmWriter, canReach } from './task-routes'\n\n/** What a member scoped to particular sites is told. */\nexport const COMPANY_DELETE_SCOPED_REFUSAL =\n  'Your access is limited to specific sites, so the contacts at this company ' +\n  'could not be read to unlink them. Ask an organization administrator to delete it.'\n\n/**\n * A contact's update when a company it names is deleted: the id out of the\n * mirror, and out of every holder's facet that named it. Another holder's\n * link to a different company is not read or written.\n */\nfunction companyDetachFields(\n  contact: Record<string, unknown>,\n  companyId: string,\n): Record<string, unknown> {\n  const update: Record<string, unknown> = {\n    [CONTACT_COMPANY_IDS_FIELD]: FieldValue.arrayRemove(companyId),\n    updatedAt: FieldValue.serverTimestamp(),\n  }\n  for (const groupId of contactGroupsNamingCompany(contact, companyId)) {\n    update[contactFacetPath(groupId, 'companyId')] = FieldValue.delete()\n  }\n  return update\n}\n\nexport const crmCompanyDeleteHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const body = (req.body ?? {}) as Record<string, unknown>\n  const scope = readCrmRouteScope(body)\n  const companyId = typed(body['companyId'], 200)\n  if (!scope || !companyId || companyId.includes('/')) {\n    res.status(400).json({ error: 'Missing hostId or companyId' })\n    return\n  }\n\n  try {\n    const writer = await authorizeCrmWriter(req, scope, { suiteAct: 'Deleting a company' })\n    if (writer.ok === false) {\n      res.status(writer.status).json(writer.body)\n      return\n    }\n    if (!(writer.staff || writer.level === 'org' || isOrgWideMember(writer.member))) {\n      res.status(403).json({ error: COMPANY_DELETE_SCOPED_REFUSAL })\n      return\n    }\n\n    const firestore = firebaseAdmin.app().firestore()\n    const orgRef = firestore.collection('orgs').doc(writer.orgId)\n    const companyRef = orgRef.collection(CRM_COLLECTIONS.companies).doc(companyId)\n    const company = await companyRef.get()\n    if (!company.exists || !canReach(writer, company.get('visibleTo'))) {\n      res.status(404).json({ error: 'That company no longer exists.' })\n      return\n    }\n\n    // One past the bound, so \"more remain\" is a fact from the probe row\n    // rather than a guess from a full page.\n    const probe = await orgRef\n      .collection('contacts')\n      .where(CONTACT_COMPANY_IDS_FIELD, 'array-contains', companyId)\n      .limit(COMPANY_DETACH_LIMIT + 1)\n      .get()\n    const linked = probe.docs.slice(0, COMPANY_DETACH_LIMIT)\n    const moreRemain = probe.docs.length > COMPANY_DETACH_LIMIT\n    if (linked.length) {\n      const batch = firestore.batch()\n      for (const snapshot of linked) {\n        batch.update(\n          snapshot.ref,\n          companyDetachFields(snapshot.data() as Record<string, unknown>, companyId),\n        )\n      }\n      await batch.commit()\n    }\n    if (!moreRemain) await companyRef.delete()\n\n    const answer: CompanyDeleteResponse = {\n      ok: true,\n      deleted: !moreRemain,\n      detached: linked.length,\n      moreRemain,\n    }\n    res.status(200).json(answer)\n  } catch (error) {\n    console.error('[crm] company-delete failed', companyId, error)\n    res.status(500).json({ error: 'The company could not be deleted.' })\n  }\n}\n"],"names":["CONTACT_COMPANY_IDS_FIELD","contactFacetPath","contactGroupsNamingCompany","CRM_COLLECTIONS","isOrgWideMember","firebaseAdmin","FieldValue","COMPANY_DETACH_LIMIT","typed","readCrmRouteScope","authorizeCrmWriter","canReach","COMPANY_DELETE_SCOPED_REFUSAL","companyDetachFields","contact","companyId","update","arrayRemove","updatedAt","serverTimestamp","groupId","delete","crmCompanyDeleteHandler","req","res","method","setHeader","status","json","error","body","scope","includes","writer","suiteAct","ok","staff","level","member","firestore","app","orgRef","collection","doc","orgId","companyRef","companies","company","get","exists","probe","where","limit","linked","docs","slice","moreRemain","length","batch","snapshot","ref","data","commit","answer","deleted","detached","console"],"mappings":"AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAsCC,GAED,SACEA,yBAAyB,EACzBC,gBAAgB,EAChBC,0BAA0B,EAC1BC,eAAe,EACfC,eAAe,QAEV,sBAAqB;AAC5B,SAASC,aAAa,QAAQ,2BAA0B;AACxD,SAASC,UAAU,QAAQ,2BAA0B;AACrD,SACEC,oBAAoB,QAEf,mCAA+B;AACtC,SAASC,KAAK,QAAQ,uBAAmB;AACzC,SAASC,iBAAiB,QAAQ,kBAAc;AAChD,SAASC,kBAAkB,EAAEC,QAAQ,QAAQ,mBAAe;AAE5D,sDAAsD,GACtD,OAAO,MAAMC,gCACX,+EACA,oFAAmF;AAErF;;;;CAIC,GACD,SAASC,oBACPC,OAAgC,EAChCC,SAAiB;IAEjB,MAAMC,SAAkC;QACtC,CAAChB,0BAA0B,EAAEM,WAAWW,WAAW,CAACF;QACpDG,WAAWZ,WAAWa,eAAe;IACvC;IACA,KAAK,MAAMC,WAAWlB,2BAA2BY,SAASC,WAAY;QACpEC,MAAM,CAACf,iBAAiBmB,SAAS,aAAa,GAAGd,WAAWe,MAAM;IACpE;IACA,OAAOL;AACT;AAEA,OAAO,MAAMM,0BAA4C,OAAOC,KAAKC;QAMrDD;IALd,IAAIA,IAAIE,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAqB;QACnD;IACF;IACA,MAAMC,QAAQP,YAAAA,IAAIO,IAAI,YAARP,YAAY,CAAC;IAC3B,MAAMQ,QAAQtB,kBAAkBqB;IAChC,MAAMf,YAAYP,MAAMsB,IAAI,CAAC,YAAY,EAAE;IAC3C,IAAI,CAACC,SAAS,CAAChB,aAAaA,UAAUiB,QAAQ,CAAC,MAAM;QACnDR,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAA8B;QAC5D;IACF;IAEA,IAAI;QACF,MAAMI,SAAS,MAAMvB,mBAAmBa,KAAKQ,OAAO;YAAEG,UAAU;QAAqB;QACrF,IAAID,OAAOE,EAAE,KAAK,OAAO;YACvBX,IAAIG,MAAM,CAACM,OAAON,MAAM,EAAEC,IAAI,CAACK,OAAOH,IAAI;YAC1C;QACF;QACA,IAAI,CAAEG,CAAAA,OAAOG,KAAK,IAAIH,OAAOI,KAAK,KAAK,SAASjC,gBAAgB6B,OAAOK,MAAM,CAAA,GAAI;YAC/Ed,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAOjB;YAA8B;YAC5D;QACF;QAEA,MAAM2B,YAAYlC,cAAcmC,GAAG,GAAGD,SAAS;QAC/C,MAAME,SAASF,UAAUG,UAAU,CAAC,QAAQC,GAAG,CAACV,OAAOW,KAAK;QAC5D,MAAMC,aAAaJ,OAAOC,UAAU,CAACvC,gBAAgB2C,SAAS,EAAEH,GAAG,CAAC5B;QACpE,MAAMgC,UAAU,MAAMF,WAAWG,GAAG;QACpC,IAAI,CAACD,QAAQE,MAAM,IAAI,CAACtC,SAASsB,QAAQc,QAAQC,GAAG,CAAC,eAAe;YAClExB,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;gBAAEC,OAAO;YAAiC;YAC/D;QACF;QAEA,oEAAoE;QACpE,wCAAwC;QACxC,MAAMqB,QAAQ,MAAMT,OACjBC,UAAU,CAAC,YACXS,KAAK,CAACnD,2BAA2B,kBAAkBe,WACnDqC,KAAK,CAAC7C,uBAAuB,GAC7ByC,GAAG;QACN,MAAMK,SAASH,MAAMI,IAAI,CAACC,KAAK,CAAC,GAAGhD;QACnC,MAAMiD,aAAaN,MAAMI,IAAI,CAACG,MAAM,GAAGlD;QACvC,IAAI8C,OAAOI,MAAM,EAAE;YACjB,MAAMC,QAAQnB,UAAUmB,KAAK;YAC7B,KAAK,MAAMC,YAAYN,OAAQ;gBAC7BK,MAAM1C,MAAM,CACV2C,SAASC,GAAG,EACZ/C,oBAAoB8C,SAASE,IAAI,IAA+B9C;YAEpE;YACA,MAAM2C,MAAMI,MAAM;QACpB;QACA,IAAI,CAACN,YAAY,MAAMX,WAAWxB,MAAM;QAExC,MAAM0C,SAAgC;YACpC5B,IAAI;YACJ6B,SAAS,CAACR;YACVS,UAAUZ,OAAOI,MAAM;YACvBD;QACF;QACAhC,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAACmC;IACvB,EAAE,OAAOlC,OAAO;QACdqC,QAAQrC,KAAK,CAAC,+BAA+Bd,WAAWc;QACxDL,IAAIG,MAAM,CAAC,KAAKC,IAAI,CAAC;YAAEC,OAAO;QAAoC;IACpE;AACF,EAAC"}

package/src/lib/server/contact-email-history.d.ts

@@ -0,0 +1,82 @@
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+/**
+ * `POST /api/crm/contact-email-history` (AGL-2616): the campaign mail one
+ * contact was sent, as the timeline draws it.
+ *
+ * ## Why a server route
+ *
+ * The per-recipient delivery log — `emailDeliveries/{key}/messages` — is
+ * closed to every client by the rules, and rightly: it is keyed by an
+ * address hash across every org on the platform, and a row carries the
+ * recipient's address, the provider and the links they followed. What a
+ * contact's timeline needs is one slice of it — this person, this group's
+ * campaigns — projected to the fields a timeline shows. That projection is
+ * this route, and the authorization in front of it is the contacts read
+ * rule restated for the Admin SDK, which evaluates no rules of its own.
+ *
+ * ## What one open of a contact page costs
+ *
+ * Bounded by the PERSON, never by the campaign ledger: one keyed query down
+ * the person's own message subcollection, newest first and capped at
+ * {@link EMAIL_DELIVERY_READ_LIMIT}, then one `getAll` for the names of the
+ * distinct emails those rows name. Nothing here walks a campaign's
+ * recipients — that direction is the campaign report's, and is a
+ * collection-group query this route never issues.
+ *
+ * ## Only this group's campaigns
+ *
+ * The log holds every message ever sent to the address, from every site on
+ * the platform. The rows handed back are those a campaign on one of the
+ * reading group's sites sent — the `hostId` tag `campaign-send` stamps,
+ * filtered against the consent group's `hostIds` — so a sibling business
+ * sharing the same contact row never sees the mail another business sent
+ * the person, and transactional mail (a receipt, an invite, which carry no
+ * site) is not on a CRM timeline at all. The filter runs over the newest
+ * fifty messages, so a person mailed heavily by several orgs can have this
+ * group's older campaigns fall past the window; the response says what the
+ * window was.
+ */
+import { type ContactCampaignEmail, type PluginApiHandler } from '@aglyn/aglyn/server';
+import { type EmailDeliveryRecord } from '@aglyn/tenant-data-admin/server/email-delivery-log';
+/** The route key, as `registerCrmConsoleApi` registers it. */
+export declare const CONTACT_EMAIL_HISTORY_ROUTE = "crm/contact-email-history";
+/** What the route answers with. */
+export interface ContactEmailHistoryResponse {
+    ok: true;
+    /** Newest first, by the instant each was sent. */
+    emails: ContactCampaignEmail[];
+    /**
+     * True when the log could not be read, so an empty list means "unknown"
+     * rather than "nothing was sent" — the two lead a reader to opposite
+     * conclusions about the relationship.
+     */
+    lookupFailed: boolean;
+    /** How many of the person's newest messages the campaign filter ran over. */
+    limit: number;
+}
+/**
+ * One delivery-log row as the timeline reads it.
+ *
+ * Exported for the spec, and pure: it is the projection that decides what
+ * leaves the server — the address, the provider, the followed links and the
+ * bounce detail stay behind. `sentAtMs` prefers the provider's own `sent`
+ * instant and falls back to the first event seen, which the log guarantees
+ * on every row, so an entry can always be placed.
+ */
+export declare function contactCampaignEmailFromDelivery(row: EmailDeliveryRecord, campaignName: string | null): ContactCampaignEmail | null;
+export declare const contactEmailHistoryHandler: PluginApiHandler;

package/src/lib/server/contact-email-history.js

@@ -0,0 +1,264 @@
+import { _ as _extends } from "@swc/helpers/_/_extends";
+/**
+ * @license
+ * Copyright 2026 Aglyn LLC
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *   http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */ /**
+ * `POST /api/crm/contact-email-history` (AGL-2616): the campaign mail one
+ * contact was sent, as the timeline draws it.
+ *
+ * ## Why a server route
+ *
+ * The per-recipient delivery log — `emailDeliveries/{key}/messages` — is
+ * closed to every client by the rules, and rightly: it is keyed by an
+ * address hash across every org on the platform, and a row carries the
+ * recipient's address, the provider and the links they followed. What a
+ * contact's timeline needs is one slice of it — this person, this group's
+ * campaigns — projected to the fields a timeline shows. That projection is
+ * this route, and the authorization in front of it is the contacts read
+ * rule restated for the Admin SDK, which evaluates no rules of its own.
+ *
+ * ## What one open of a contact page costs
+ *
+ * Bounded by the PERSON, never by the campaign ledger: one keyed query down
+ * the person's own message subcollection, newest first and capped at
+ * {@link EMAIL_DELIVERY_READ_LIMIT}, then one `getAll` for the names of the
+ * distinct emails those rows name. Nothing here walks a campaign's
+ * recipients — that direction is the campaign report's, and is a
+ * collection-group query this route never issues.
+ *
+ * ## Only this group's campaigns
+ *
+ * The log holds every message ever sent to the address, from every site on
+ * the platform. The rows handed back are those a campaign on one of the
+ * reading group's sites sent — the `hostId` tag `campaign-send` stamps,
+ * filtered against the consent group's `hostIds` — so a sibling business
+ * sharing the same contact row never sees the mail another business sent
+ * the person, and transactional mail (a receipt, an invite, which carry no
+ * site) is not on a CRM timeline at all. The filter runs over the newest
+ * fifty messages, so a person mailed heavily by several orgs can have this
+ * group's older campaigns fall past the window; the response says what the
+ * window was.
+ */ import { memberCanSee } from "@aglyn/aglyn/server";
+import { consentGroupForSite, firebaseAdmin, getOrgForHost, memberHasOrgPermission, orgDataCollectionForHost, resolveOrgMembership } from "@aglyn/tenant-data-admin";
+// The leaf, for the reason the webhook imports it from the leaf: a spec that
+// mocks the admin barrel wholesale must not silently replace the reader.
+import { EMAIL_DELIVERY_READ_LIMIT, readEmailDeliveryHistory } from "@aglyn/tenant-data-admin/server/email-delivery-log";
+import { isRefusedIdToken } from "@aglyn/tenant-data-admin/server/id-token-refusal";
+import { crmSuiteRefusal } from "./suite-gate.js";
+/** The route key, as `registerCrmConsoleApi` registers it. */ export const CONTACT_EMAIL_HISTORY_ROUTE = 'crm/contact-email-history';
+const refuse = (status, error)=>({
+        ok: false,
+        status,
+        error
+    });
+/**
+ * Who is asking, and whether they may read this site's CRM at all — the
+ * rules' `canReadScopedPeople` restated, minus the per-document half that
+ * the handler asks against the contact once it has it.
+ *
+ * `data.manage` is the key, because it is the key the contacts read rule
+ * gates on: an org viewer holding no grant may open no contact in the
+ * console and may not read one here. Staff pass on the claim alone, as the
+ * rules admit them.
+ */ async function authorizeCrmReader(req, hostId) {
+    var _req_headers_authorization, _ref;
+    const authorization = String((_req_headers_authorization = req.headers.authorization) != null ? _req_headers_authorization : '');
+    const idToken = authorization.startsWith('Bearer ') ? authorization.slice('Bearer '.length) : undefined;
+    if (!idToken) return refuse(401, 'Unauthenticated');
+    let decoded;
+    try {
+        decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken);
+    } catch (error) {
+        // A refused credential is the caller's 401; a failure to check one is
+        // ours and keeps a 5xx (AGL-2852).
+        if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated');
+        console.error('[crm] contact-email-history could not verify the reader', error);
+        return refuse(500, 'The sign-in could not be checked. Try again.');
+    }
+    const staff = decoded.staff === true;
+    const resolved = await getOrgForHost(hostId).catch(()=>null);
+    if (!resolved) {
+        return refuse(404, 'This site has no organization, so it has no CRM.');
+    }
+    const { orgId, org } = resolved;
+    const membership = await resolveOrgMembership(decoded.uid, orgId).catch(()=>null);
+    const member = (_ref = membership == null ? void 0 : membership.member) != null ? _ref : null;
+    if (!staff) {
+        const suspended = (member == null ? void 0 : member.orgSuspended) === true;
+        if (!member || suspended) {
+            return refuse(403, 'Your organization role does not allow reading the CRM.');
+        }
+        if (!await memberHasOrgPermission(orgId, member, 'data.manage')) {
+            return refuse(403, 'Your organization role does not allow reading the CRM.');
+        }
+    }
+    return {
+        ok: true,
+        uid: decoded.uid,
+        staff,
+        orgId,
+        org: org != null ? org : {},
+        member
+    };
+}
+/** A finite, positive instant, or nothing. */ const instant = (value)=>{
+    const parsed = Number(value);
+    return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined;
+};
+/**
+ * One delivery-log row as the timeline reads it.
+ *
+ * Exported for the spec, and pure: it is the projection that decides what
+ * leaves the server — the address, the provider, the followed links and the
+ * bounce detail stay behind. `sentAtMs` prefers the provider's own `sent`
+ * instant and falls back to the first event seen, which the log guarantees
+ * on every row, so an entry can always be placed.
+ */ export function contactCampaignEmailFromDelivery(row, campaignName) {
+    var _row_timestamps, _instant, _row_subject, _row_openCount, _row_clickCount;
+    if (!row.campaignId || !row.hostId) return null;
+    const stamps = (_row_timestamps = row.timestamps) != null ? _row_timestamps : {};
+    const sentAtMs = (_instant = instant(stamps.sent)) != null ? _instant : instant(row.firstSeenAtMs);
+    if (!sentAtMs) return null;
+    const delivered = instant(stamps.delivered);
+    const opened = instant(stamps.opened);
+    const clicked = instant(stamps.clicked);
+    const bounced = instant(stamps.bounced);
+    const complained = instant(stamps.complained);
+    return _extends({
+        messageId: row.messageId,
+        hostId: row.hostId,
+        campaignId: row.campaignId,
+        campaignName,
+        subject: (_row_subject = row.subject) != null ? _row_subject : null,
+        sentAtMs
+    }, delivered ? {
+        deliveredAtMs: delivered
+    } : {}, opened ? {
+        openedAtMs: opened
+    } : {}, clicked ? {
+        clickedAtMs: clicked
+    } : {}, bounced ? {
+        bouncedAtMs: bounced
+    } : {}, complained ? {
+        complainedAtMs: complained
+    } : {}, {
+        openCount: Number((_row_openCount = row.openCount) != null ? _row_openCount : 0),
+        clickCount: Number((_row_clickCount = row.clickCount) != null ? _row_clickCount : 0)
+    });
+}
+/**
+ * The names of the emails these rows name, in one `getAll`.
+ *
+ * Keyed reads rather than a query: the ids are known, a `getAll` is one round
+ * trip however many there are, and it needs no index. An email the team has
+ * since deleted reads as `null`, which the timeline draws as the subject the
+ * person received with no report to link to.
+ */ async function readCampaignNames(rows) {
+    const names = new Map();
+    const firestore = firebaseAdmin.app().firestore();
+    const refs = [];
+    for (const row of rows){
+        const key = `${row.hostId}/${row.campaignId}`;
+        if (names.has(key)) continue;
+        names.set(key, null);
+        refs.push(firestore.collection('hosts').doc(String(row.hostId)).collection('campaigns').doc(String(row.campaignId)));
+    }
+    if (!refs.length) return names;
+    const snapshots = await firestore.getAll(...refs);
+    for (const snapshot of snapshots){
+        var _ref, _snapshot_get, _snapshot_get1;
+        var _snapshot_ref_parent_parent;
+        if (!snapshot.exists) continue;
+        const hostId = (_ref = (_snapshot_ref_parent_parent = snapshot.ref.parent.parent) == null ? void 0 : _snapshot_ref_parent_parent.id) != null ? _ref : '';
+        const name = String((_snapshot_get = snapshot.get('displayName')) != null ? _snapshot_get : '').trim() || String((_snapshot_get1 = snapshot.get('subject')) != null ? _snapshot_get1 : '').trim();
+        names.set(`${hostId}/${snapshot.id}`, name || null);
+    }
+    return names;
+}
+export const contactEmailHistoryHandler = async (req, res)=>{
+    var _ref, _ref1;
+    var _req_body, _req_body1;
+    if (req.method !== 'POST') {
+        res.setHeader('Allow', 'POST');
+        res.status(405).json({
+            error: 'Method not allowed'
+        });
+        return;
+    }
+    const hostId = String((_ref = (_req_body = req.body) == null ? void 0 : _req_body.hostId) != null ? _ref : '').trim();
+    const contactId = String((_ref1 = (_req_body1 = req.body) == null ? void 0 : _req_body1.contactId) != null ? _ref1 : '').trim();
+    if (!hostId || !contactId) {
+        res.status(400).json({
+            error: 'Missing hostId or contactId'
+        });
+        return;
+    }
+    const reader = await authorizeCrmReader(req, hostId);
+    if (reader.ok === false) {
+        res.status(reader.status).json({
+            error: reader.error
+        });
+        return;
+    }
+    // The plan after the reader, before any contact or log is read (AGL-2851).
+    const suite = crmSuiteRefusal(reader.org, "A contact's campaign email history");
+    if (suite) {
+        res.status(suite.status).json(suite.body);
+        return;
+    }
+    try {
+        var _snapshot_get;
+        /*
+     * The contact by id, then the per-document half of the read rule: the
+     * Admin SDK evaluates no rules, so a scoped member who can guess an id
+     * must be refused here exactly as their listener would refuse the row.
+     * "Not visible" and "not there" are one answer on purpose — a 403 would
+     * confirm the id exists.
+     */ const contactsRef = await orgDataCollectionForHost(hostId, 'contacts');
+        const snapshot = await contactsRef.doc(contactId).get();
+        const visibleTo = snapshot.exists ? snapshot.get('visibleTo') : undefined;
+        if (!snapshot.exists || !(reader.staff || memberCanSee(reader.member, visibleTo))) {
+            res.status(404).json({
+                error: 'Unknown contact'
+            });
+            return;
+        }
+        const email = String((_snapshot_get = snapshot.get('email')) != null ? _snapshot_get : '');
+        const group = await consentGroupForSite(hostId, reader.org);
+        const history = await readEmailDeliveryHistory(email, {
+            limit: EMAIL_DELIVERY_READ_LIMIT
+        });
+        const rows = history.rows.filter((row)=>Boolean(row.campaignId) && Boolean(row.hostId) && group.hostIds.includes(String(row.hostId)));
+        const names = await readCampaignNames(rows);
+        const emails = rows.map((row)=>{
+            var _names_get;
+            return contactCampaignEmailFromDelivery(row, (_names_get = names.get(`${row.hostId}/${row.campaignId}`)) != null ? _names_get : null);
+        }).filter((entry)=>entry !== null).sort((a, b)=>b.sentAtMs - a.sentAtMs);
+        const body = {
+            ok: true,
+            emails,
+            lookupFailed: history.lookupFailed,
+            limit: EMAIL_DELIVERY_READ_LIMIT
+        };
+        res.status(200).json(body);
+    } catch (error) {
+        console.error('[crm] contact-email-history failed', hostId, contactId, error);
+        res.status(500).json({
+            error: 'The campaign history could not be read'
+        });
+    }
+};
+
+//# sourceMappingURL=contact-email-history.js.map

package/src/lib/server/contact-email-history.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../../../../../../../libs/plugins/crm/src/lib/server/contact-email-history.ts"],"sourcesContent":["/**\n * @license\n * Copyright 2026 Aglyn LLC\n *\n * Licensed under the Apache License, Version 2.0 (the \"License\");\n * you may not use this file except in compliance with the License.\n * You may obtain a copy of the License at\n *\n *   http://www.apache.org/licenses/LICENSE-2.0\n *\n * Unless required by applicable law or agreed to in writing, software\n * distributed under the License is distributed on an \"AS IS\" BASIS,\n * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.\n * See the License for the specific language governing permissions and\n * limitations under the License.\n */\n\n/**\n * `POST /api/crm/contact-email-history` (AGL-2616): the campaign mail one\n * contact was sent, as the timeline draws it.\n *\n * ## Why a server route\n *\n * The per-recipient delivery log — `emailDeliveries/{key}/messages` — is\n * closed to every client by the rules, and rightly: it is keyed by an\n * address hash across every org on the platform, and a row carries the\n * recipient's address, the provider and the links they followed. What a\n * contact's timeline needs is one slice of it — this person, this group's\n * campaigns — projected to the fields a timeline shows. That projection is\n * this route, and the authorization in front of it is the contacts read\n * rule restated for the Admin SDK, which evaluates no rules of its own.\n *\n * ## What one open of a contact page costs\n *\n * Bounded by the PERSON, never by the campaign ledger: one keyed query down\n * the person's own message subcollection, newest first and capped at\n * {@link EMAIL_DELIVERY_READ_LIMIT}, then one `getAll` for the names of the\n * distinct emails those rows name. Nothing here walks a campaign's\n * recipients — that direction is the campaign report's, and is a\n * collection-group query this route never issues.\n *\n * ## Only this group's campaigns\n *\n * The log holds every message ever sent to the address, from every site on\n * the platform. The rows handed back are those a campaign on one of the\n * reading group's sites sent — the `hostId` tag `campaign-send` stamps,\n * filtered against the consent group's `hostIds` — so a sibling business\n * sharing the same contact row never sees the mail another business sent\n * the person, and transactional mail (a receipt, an invite, which carry no\n * site) is not on a CRM timeline at all. The filter runs over the newest\n * fifty messages, so a person mailed heavily by several orgs can have this\n * group's older campaigns fall past the window; the response says what the\n * window was.\n */\n\nimport {\n  type AglynOrgMember,\n  type ContactCampaignEmail,\n  memberCanSee,\n  type PluginApiHandler,\n  type PluginApiRequest,\n} from '@aglyn/aglyn/server'\nimport {\n  consentGroupForSite,\n  firebaseAdmin,\n  getOrgForHost,\n  memberHasOrgPermission,\n  orgDataCollectionForHost,\n  resolveOrgMembership,\n} from '@aglyn/tenant-data-admin'\n// The leaf, for the reason the webhook imports it from the leaf: a spec that\n// mocks the admin barrel wholesale must not silently replace the reader.\nimport {\n  EMAIL_DELIVERY_READ_LIMIT,\n  type EmailDeliveryRecord,\n  readEmailDeliveryHistory,\n} from '@aglyn/tenant-data-admin/server/email-delivery-log'\nimport { isRefusedIdToken } from '@aglyn/tenant-data-admin/server/id-token-refusal'\nimport { crmSuiteRefusal } from './suite-gate'\n\n/** The route key, as `registerCrmConsoleApi` registers it. */\nexport const CONTACT_EMAIL_HISTORY_ROUTE = 'crm/contact-email-history'\n\n/** What the route answers with. */\nexport interface ContactEmailHistoryResponse {\n  ok: true\n  /** Newest first, by the instant each was sent. */\n  emails: ContactCampaignEmail[]\n  /**\n   * True when the log could not be read, so an empty list means \"unknown\"\n   * rather than \"nothing was sent\" — the two lead a reader to opposite\n   * conclusions about the relationship.\n   */\n  lookupFailed: boolean\n  /** How many of the person's newest messages the campaign filter ran over. */\n  limit: number\n}\n\ntype Refusal = { ok: false; status: number; error: string }\n\ninterface Reader {\n  ok: true\n  uid: string\n  staff: boolean\n  orgId: string\n  org: Record<string, unknown>\n  member: Partial<AglynOrgMember> | null\n}\n\nconst refuse = (status: number, error: string): Refusal => ({\n  ok: false,\n  status,\n  error,\n})\n\n/**\n * Who is asking, and whether they may read this site's CRM at all — the\n * rules' `canReadScopedPeople` restated, minus the per-document half that\n * the handler asks against the contact once it has it.\n *\n * `data.manage` is the key, because it is the key the contacts read rule\n * gates on: an org viewer holding no grant may open no contact in the\n * console and may not read one here. Staff pass on the claim alone, as the\n * rules admit them.\n */\nasync function authorizeCrmReader(\n  req: PluginApiRequest,\n  hostId: string,\n): Promise<Reader | Refusal> {\n  const authorization = String(req.headers.authorization ?? '')\n  const idToken = authorization.startsWith('Bearer ')\n    ? authorization.slice('Bearer '.length)\n    : undefined\n  if (!idToken) return refuse(401, 'Unauthenticated')\n  let decoded: { uid: string; staff?: unknown }\n  try {\n    decoded = await firebaseAdmin.app().auth().verifyIdToken(idToken)\n  } catch (error) {\n    // A refused credential is the caller's 401; a failure to check one is\n    // ours and keeps a 5xx (AGL-2852).\n    if (isRefusedIdToken(error)) return refuse(401, 'Unauthenticated')\n    console.error('[crm] contact-email-history could not verify the reader', error)\n    return refuse(500, 'The sign-in could not be checked. Try again.')\n  }\n  const staff = decoded.staff === true\n  const resolved = await getOrgForHost(hostId).catch(() => null)\n  if (!resolved) {\n    return refuse(404, 'This site has no organization, so it has no CRM.')\n  }\n  const { orgId, org } = resolved\n  const membership = await resolveOrgMembership(decoded.uid, orgId).catch(\n    () => null,\n  )\n  const member = (membership?.member ?? null) as Partial<AglynOrgMember> | null\n  if (!staff) {\n    const suspended =\n      (member as { orgSuspended?: boolean } | null)?.orgSuspended === true\n    if (!member || suspended) {\n      return refuse(403, 'Your organization role does not allow reading the CRM.')\n    }\n    if (!(await memberHasOrgPermission(orgId, member, 'data.manage'))) {\n      return refuse(403, 'Your organization role does not allow reading the CRM.')\n    }\n  }\n  return {\n    ok: true,\n    uid: decoded.uid,\n    staff,\n    orgId,\n    org: (org ?? {}) as Record<string, unknown>,\n    member,\n  }\n}\n\n/** A finite, positive instant, or nothing. */\nconst instant = (value: unknown): number | undefined => {\n  const parsed = Number(value)\n  return Number.isFinite(parsed) && parsed > 0 ? parsed : undefined\n}\n\n/**\n * One delivery-log row as the timeline reads it.\n *\n * Exported for the spec, and pure: it is the projection that decides what\n * leaves the server — the address, the provider, the followed links and the\n * bounce detail stay behind. `sentAtMs` prefers the provider's own `sent`\n * instant and falls back to the first event seen, which the log guarantees\n * on every row, so an entry can always be placed.\n */\nexport function contactCampaignEmailFromDelivery(\n  row: EmailDeliveryRecord,\n  campaignName: string | null,\n): ContactCampaignEmail | null {\n  if (!row.campaignId || !row.hostId) return null\n  const stamps = row.timestamps ?? {}\n  const sentAtMs = instant(stamps.sent) ?? instant(row.firstSeenAtMs)\n  if (!sentAtMs) return null\n  const delivered = instant(stamps.delivered)\n  const opened = instant(stamps.opened)\n  const clicked = instant(stamps.clicked)\n  const bounced = instant(stamps.bounced)\n  const complained = instant(stamps.complained)\n  return {\n    messageId: row.messageId,\n    hostId: row.hostId,\n    campaignId: row.campaignId,\n    campaignName,\n    subject: row.subject ?? null,\n    sentAtMs,\n    ...(delivered ? { deliveredAtMs: delivered } : {}),\n    ...(opened ? { openedAtMs: opened } : {}),\n    ...(clicked ? { clickedAtMs: clicked } : {}),\n    ...(bounced ? { bouncedAtMs: bounced } : {}),\n    ...(complained ? { complainedAtMs: complained } : {}),\n    openCount: Number(row.openCount ?? 0),\n    clickCount: Number(row.clickCount ?? 0),\n  }\n}\n\n/**\n * The names of the emails these rows name, in one `getAll`.\n *\n * Keyed reads rather than a query: the ids are known, a `getAll` is one round\n * trip however many there are, and it needs no index. An email the team has\n * since deleted reads as `null`, which the timeline draws as the subject the\n * person received with no report to link to.\n */\nasync function readCampaignNames(\n  rows: readonly EmailDeliveryRecord[],\n): Promise<Map<string, string | null>> {\n  const names = new Map<string, string | null>()\n  const firestore = firebaseAdmin.app().firestore()\n  const refs: FirebaseFirestore.DocumentReference[] = []\n  for (const row of rows) {\n    const key = `${row.hostId}/${row.campaignId}`\n    if (names.has(key)) continue\n    names.set(key, null)\n    refs.push(\n      firestore\n        .collection('hosts')\n        .doc(String(row.hostId))\n        .collection('campaigns')\n        .doc(String(row.campaignId)),\n    )\n  }\n  if (!refs.length) return names\n  const snapshots = await firestore.getAll(...refs)\n  for (const snapshot of snapshots) {\n    if (!snapshot.exists) continue\n    const hostId = snapshot.ref.parent.parent?.id ?? ''\n    const name =\n      String(snapshot.get('displayName') ?? '').trim() ||\n      String(snapshot.get('subject') ?? '').trim()\n    names.set(`${hostId}/${snapshot.id}`, name || null)\n  }\n  return names\n}\n\nexport const contactEmailHistoryHandler: PluginApiHandler = async (req, res) => {\n  if (req.method !== 'POST') {\n    res.setHeader('Allow', 'POST')\n    res.status(405).json({ error: 'Method not allowed' })\n    return\n  }\n  const hostId = String(req.body?.hostId ?? '').trim()\n  const contactId = String(req.body?.contactId ?? '').trim()\n  if (!hostId || !contactId) {\n    res.status(400).json({ error: 'Missing hostId or contactId' })\n    return\n  }\n  const reader = await authorizeCrmReader(req, hostId)\n  if (reader.ok === false) {\n    res.status(reader.status).json({ error: reader.error })\n    return\n  }\n  // The plan after the reader, before any contact or log is read (AGL-2851).\n  const suite = crmSuiteRefusal(reader.org, \"A contact's campaign email history\")\n  if (suite) {\n    res.status(suite.status).json(suite.body)\n    return\n  }\n  try {\n    /*\n     * The contact by id, then the per-document half of the read rule: the\n     * Admin SDK evaluates no rules, so a scoped member who can guess an id\n     * must be refused here exactly as their listener would refuse the row.\n     * \"Not visible\" and \"not there\" are one answer on purpose — a 403 would\n     * confirm the id exists.\n     */\n    const contactsRef = await orgDataCollectionForHost(hostId, 'contacts')\n    const snapshot = await contactsRef.doc(contactId).get()\n    const visibleTo = snapshot.exists\n      ? (snapshot.get('visibleTo') as string[] | undefined)\n      : undefined\n    if (!snapshot.exists || !(reader.staff || memberCanSee(reader.member, visibleTo))) {\n      res.status(404).json({ error: 'Unknown contact' })\n      return\n    }\n    const email = String(snapshot.get('email') ?? '')\n    const group = await consentGroupForSite(hostId, reader.org)\n    const history = await readEmailDeliveryHistory(email, {\n      limit: EMAIL_DELIVERY_READ_LIMIT,\n    })\n    const rows = history.rows.filter(\n      (row) =>\n        Boolean(row.campaignId) &&\n        Boolean(row.hostId) &&\n        group.hostIds.includes(String(row.hostId)),\n    )\n    const names = await readCampaignNames(rows)\n    const emails = rows\n      .map((row) =>\n        contactCampaignEmailFromDelivery(\n          row,\n          names.get(`${row.hostId}/${row.campaignId}`) ?? null,\n        ),\n      )\n      .filter((entry): entry is ContactCampaignEmail => entry !== null)\n      .sort((a, b) => b.sentAtMs - a.sentAtMs)\n    const body: ContactEmailHistoryResponse = {\n      ok: true,\n      emails,\n      lookupFailed: history.lookupFailed,\n      limit: EMAIL_DELIVERY_READ_LIMIT,\n    }\n    res.status(200).json(body)\n  } catch (error) {\n    console.error('[crm] contact-email-history failed', hostId, contactId, error)\n    res.status(500).json({ error: 'The campaign history could not be read' })\n  }\n}\n"],"names":["memberCanSee","consentGroupForSite","firebaseAdmin","getOrgForHost","memberHasOrgPermission","orgDataCollectionForHost","resolveOrgMembership","EMAIL_DELIVERY_READ_LIMIT","readEmailDeliveryHistory","isRefusedIdToken","crmSuiteRefusal","CONTACT_EMAIL_HISTORY_ROUTE","refuse","status","error","ok","authorizeCrmReader","req","hostId","authorization","String","headers","idToken","startsWith","slice","length","undefined","decoded","app","auth","verifyIdToken","console","staff","resolved","catch","orgId","org","membership","uid","member","suspended","orgSuspended","instant","value","parsed","Number","isFinite","contactCampaignEmailFromDelivery","row","campaignName","campaignId","stamps","timestamps","sentAtMs","sent","firstSeenAtMs","delivered","opened","clicked","bounced","complained","messageId","subject","deliveredAtMs","openedAtMs","clickedAtMs","bouncedAtMs","complainedAtMs","openCount","clickCount","readCampaignNames","rows","names","Map","firestore","refs","key","has","set","push","collection","doc","snapshots","getAll","snapshot","exists","ref","parent","id","name","get","trim","contactEmailHistoryHandler","res","method","setHeader","json","body","contactId","reader","suite","contactsRef","visibleTo","email","group","history","limit","filter","Boolean","hostIds","includes","emails","map","entry","sort","a","b","lookupFailed"],"mappings":";AAAA;;;;;;;;;;;;;;;CAeC,GAED;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CAoCC,GAED,SAGEA,YAAY,QAGP,sBAAqB;AAC5B,SACEC,mBAAmB,EACnBC,aAAa,EACbC,aAAa,EACbC,sBAAsB,EACtBC,wBAAwB,EACxBC,oBAAoB,QACf,2BAA0B;AACjC,6EAA6E;AAC7E,yEAAyE;AACzE,SACEC,yBAAyB,EAEzBC,wBAAwB,QACnB,qDAAoD;AAC3D,SAASC,gBAAgB,QAAQ,mDAAkD;AACnF,SAASC,eAAe,QAAQ,kBAAc;AAE9C,4DAA4D,GAC5D,OAAO,MAAMC,8BAA8B,4BAA2B;AA4BtE,MAAMC,SAAS,CAACC,QAAgBC,QAA4B,CAAA;QAC1DC,IAAI;QACJF;QACAC;IACF,CAAA;AAEA;;;;;;;;;CASC,GACD,eAAeE,mBACbC,GAAqB,EACrBC,MAAc;QAEeD;IAA7B,MAAME,gBAAgBC,QAAOH,6BAAAA,IAAII,OAAO,CAACF,aAAa,YAAzBF,6BAA6B;IAC1D,MAAMK,UAAUH,cAAcI,UAAU,CAAC,aACrCJ,cAAcK,KAAK,CAAC,UAAUC,MAAM,IACpCC;IACJ,IAAI,CAACJ,SAAS,OAAOV,OAAO,KAAK;IACjC,IAAIe;IACJ,IAAI;QACFA,UAAU,MAAMzB,cAAc0B,GAAG,GAAGC,IAAI,GAAGC,aAAa,CAACR;IAC3D,EAAE,OAAOR,OAAO;QACd,sEAAsE;QACtE,mCAAmC;QACnC,IAAIL,iBAAiBK,QAAQ,OAAOF,OAAO,KAAK;QAChDmB,QAAQjB,KAAK,CAAC,2DAA2DA;QACzE,OAAOF,OAAO,KAAK;IACrB;IACA,MAAMoB,QAAQL,QAAQK,KAAK,KAAK;IAChC,MAAMC,WAAW,MAAM9B,cAAce,QAAQgB,KAAK,CAAC,IAAM;IACzD,IAAI,CAACD,UAAU;QACb,OAAOrB,OAAO,KAAK;IACrB;IACA,MAAM,EAAEuB,KAAK,EAAEC,GAAG,EAAE,GAAGH;IACvB,MAAMI,aAAa,MAAM/B,qBAAqBqB,QAAQW,GAAG,EAAEH,OAAOD,KAAK,CACrE,IAAM;IAER,MAAMK,iBAAUF,8BAAAA,WAAYE,MAAM,mBAAI;IACtC,IAAI,CAACP,OAAO;QACV,MAAMQ,YACJ,CAACD,0BAAD,AAACA,OAA8CE,YAAY,MAAK;QAClE,IAAI,CAACF,UAAUC,WAAW;YACxB,OAAO5B,OAAO,KAAK;QACrB;QACA,IAAI,CAAE,MAAMR,uBAAuB+B,OAAOI,QAAQ,gBAAiB;YACjE,OAAO3B,OAAO,KAAK;QACrB;IACF;IACA,OAAO;QACLG,IAAI;QACJuB,KAAKX,QAAQW,GAAG;QAChBN;QACAG;QACAC,GAAG,EAAGA,cAAAA,MAAO,CAAC;QACdG;IACF;AACF;AAEA,4CAA4C,GAC5C,MAAMG,UAAU,CAACC;IACf,MAAMC,SAASC,OAAOF;IACtB,OAAOE,OAAOC,QAAQ,CAACF,WAAWA,SAAS,IAAIA,SAASlB;AAC1D;AAEA;;;;;;;;CAQC,GACD,OAAO,SAASqB,iCACdC,GAAwB,EACxBC,YAA2B;QAGZD,iBACEN,UAYNM,cAOSA,gBACCA;IAtBrB,IAAI,CAACA,IAAIE,UAAU,IAAI,CAACF,IAAI9B,MAAM,EAAE,OAAO;IAC3C,MAAMiC,UAASH,kBAAAA,IAAII,UAAU,YAAdJ,kBAAkB,CAAC;IAClC,MAAMK,YAAWX,WAAAA,QAAQS,OAAOG,IAAI,aAAnBZ,WAAwBA,QAAQM,IAAIO,aAAa;IAClE,IAAI,CAACF,UAAU,OAAO;IACtB,MAAMG,YAAYd,QAAQS,OAAOK,SAAS;IAC1C,MAAMC,SAASf,QAAQS,OAAOM,MAAM;IACpC,MAAMC,UAAUhB,QAAQS,OAAOO,OAAO;IACtC,MAAMC,UAAUjB,QAAQS,OAAOQ,OAAO;IACtC,MAAMC,aAAalB,QAAQS,OAAOS,UAAU;IAC5C,OAAO;QACLC,WAAWb,IAAIa,SAAS;QACxB3C,QAAQ8B,IAAI9B,MAAM;QAClBgC,YAAYF,IAAIE,UAAU;QAC1BD;QACAa,OAAO,GAAEd,eAAAA,IAAIc,OAAO,YAAXd,eAAe;QACxBK;OACIG,YAAY;QAAEO,eAAeP;IAAU,IAAI,CAAC,GAC5CC,SAAS;QAAEO,YAAYP;IAAO,IAAI,CAAC,GACnCC,UAAU;QAAEO,aAAaP;IAAQ,IAAI,CAAC,GACtCC,UAAU;QAAEO,aAAaP;IAAQ,IAAI,CAAC,GACtCC,aAAa;QAAEO,gBAAgBP;IAAW,IAAI,CAAC;QACnDQ,WAAWvB,QAAOG,iBAAAA,IAAIoB,SAAS,YAAbpB,iBAAiB;QACnCqB,YAAYxB,QAAOG,kBAAAA,IAAIqB,UAAU,YAAdrB,kBAAkB;;AAEzC;AAEA;;;;;;;CAOC,GACD,eAAesB,kBACbC,IAAoC;IAEpC,MAAMC,QAAQ,IAAIC;IAClB,MAAMC,YAAYxE,cAAc0B,GAAG,GAAG8C,SAAS;IAC/C,MAAMC,OAA8C,EAAE;IACtD,KAAK,MAAM3B,OAAOuB,KAAM;QACtB,MAAMK,MAAM,GAAG5B,IAAI9B,MAAM,CAAC,CAAC,EAAE8B,IAAIE,UAAU,EAAE;QAC7C,IAAIsB,MAAMK,GAAG,CAACD,MAAM;QACpBJ,MAAMM,GAAG,CAACF,KAAK;QACfD,KAAKI,IAAI,CACPL,UACGM,UAAU,CAAC,SACXC,GAAG,CAAC7D,OAAO4B,IAAI9B,MAAM,GACrB8D,UAAU,CAAC,aACXC,GAAG,CAAC7D,OAAO4B,IAAIE,UAAU;IAEhC;IACA,IAAI,CAACyB,KAAKlD,MAAM,EAAE,OAAO+C;IACzB,MAAMU,YAAY,MAAMR,UAAUS,MAAM,IAAIR;IAC5C,KAAK,MAAMS,YAAYF,UAAW;kBAIvBE,eACAA;YAHMA;QADf,IAAI,CAACA,SAASC,MAAM,EAAE;QACtB,MAAMnE,kBAASkE,8BAAAA,SAASE,GAAG,CAACC,MAAM,CAACA,MAAM,qBAA1BH,4BAA4BI,EAAE,mBAAI;QACjD,MAAMC,OACJrE,QAAOgE,gBAAAA,SAASM,GAAG,CAAC,0BAAbN,gBAA+B,IAAIO,IAAI,MAC9CvE,QAAOgE,iBAAAA,SAASM,GAAG,CAAC,sBAAbN,iBAA2B,IAAIO,IAAI;QAC5CnB,MAAMM,GAAG,CAAC,GAAG5D,OAAO,CAAC,EAAEkE,SAASI,EAAE,EAAE,EAAEC,QAAQ;IAChD;IACA,OAAOjB;AACT;AAEA,OAAO,MAAMoB,6BAA+C,OAAO3E,KAAK4E;;QAMhD5E,WACGA;IANzB,IAAIA,IAAI6E,MAAM,KAAK,QAAQ;QACzBD,IAAIE,SAAS,CAAC,SAAS;QACvBF,IAAIhF,MAAM,CAAC,KAAKmF,IAAI,CAAC;YAAElF,OAAO;QAAqB;QACnD;IACF;IACA,MAAMI,SAASE,gBAAOH,YAAAA,IAAIgF,IAAI,qBAARhF,UAAUC,MAAM,mBAAI,IAAIyE,IAAI;IAClD,MAAMO,YAAY9E,iBAAOH,aAAAA,IAAIgF,IAAI,qBAARhF,WAAUiF,SAAS,oBAAI,IAAIP,IAAI;IACxD,IAAI,CAACzE,UAAU,CAACgF,WAAW;QACzBL,IAAIhF,MAAM,CAAC,KAAKmF,IAAI,CAAC;YAAElF,OAAO;QAA8B;QAC5D;IACF;IACA,MAAMqF,SAAS,MAAMnF,mBAAmBC,KAAKC;IAC7C,IAAIiF,OAAOpF,EAAE,KAAK,OAAO;QACvB8E,IAAIhF,MAAM,CAACsF,OAAOtF,MAAM,EAAEmF,IAAI,CAAC;YAAElF,OAAOqF,OAAOrF,KAAK;QAAC;QACrD;IACF;IACA,2EAA2E;IAC3E,MAAMsF,QAAQ1F,gBAAgByF,OAAO/D,GAAG,EAAE;IAC1C,IAAIgE,OAAO;QACTP,IAAIhF,MAAM,CAACuF,MAAMvF,MAAM,EAAEmF,IAAI,CAACI,MAAMH,IAAI;QACxC;IACF;IACA,IAAI;YAiBmBb;QAhBrB;;;;;;KAMC,GACD,MAAMiB,cAAc,MAAMhG,yBAAyBa,QAAQ;QAC3D,MAAMkE,WAAW,MAAMiB,YAAYpB,GAAG,CAACiB,WAAWR,GAAG;QACrD,MAAMY,YAAYlB,SAASC,MAAM,GAC5BD,SAASM,GAAG,CAAC,eACdhE;QACJ,IAAI,CAAC0D,SAASC,MAAM,IAAI,CAAEc,CAAAA,OAAOnE,KAAK,IAAIhC,aAAamG,OAAO5D,MAAM,EAAE+D,UAAS,GAAI;YACjFT,IAAIhF,MAAM,CAAC,KAAKmF,IAAI,CAAC;gBAAElF,OAAO;YAAkB;YAChD;QACF;QACA,MAAMyF,QAAQnF,QAAOgE,gBAAAA,SAASM,GAAG,CAAC,oBAAbN,gBAAyB;QAC9C,MAAMoB,QAAQ,MAAMvG,oBAAoBiB,QAAQiF,OAAO/D,GAAG;QAC1D,MAAMqE,UAAU,MAAMjG,yBAAyB+F,OAAO;YACpDG,OAAOnG;QACT;QACA,MAAMgE,OAAOkC,QAAQlC,IAAI,CAACoC,MAAM,CAC9B,CAAC3D,MACC4D,QAAQ5D,IAAIE,UAAU,KACtB0D,QAAQ5D,IAAI9B,MAAM,KAClBsF,MAAMK,OAAO,CAACC,QAAQ,CAAC1F,OAAO4B,IAAI9B,MAAM;QAE5C,MAAMsD,QAAQ,MAAMF,kBAAkBC;QACtC,MAAMwC,SAASxC,KACZyC,GAAG,CAAC,CAAChE;gBAGFwB;mBAFFzB,iCACEC,MACAwB,aAAAA,MAAMkB,GAAG,CAAC,GAAG1C,IAAI9B,MAAM,CAAC,CAAC,EAAE8B,IAAIE,UAAU,EAAE,aAA3CsB,aAAgD;WAGnDmC,MAAM,CAAC,CAACM,QAAyCA,UAAU,MAC3DC,IAAI,CAAC,CAACC,GAAGC,IAAMA,EAAE/D,QAAQ,GAAG8D,EAAE9D,QAAQ;QACzC,MAAM4C,OAAoC;YACxClF,IAAI;YACJgG;YACAM,cAAcZ,QAAQY,YAAY;YAClCX,OAAOnG;QACT;QACAsF,IAAIhF,MAAM,CAAC,KAAKmF,IAAI,CAACC;IACvB,EAAE,OAAOnF,OAAO;QACdiB,QAAQjB,KAAK,CAAC,sCAAsCI,QAAQgF,WAAWpF;QACvE+E,IAAIhF,MAAM,CAAC,KAAKmF,IAAI,CAAC;YAAElF,OAAO;QAAyC;IACzE;AACF,EAAC"}