@critical-path/server 0.13.4 → 0.14.0

package/src/router.ts

@@ -1,14 +1,49 @@
 import { CriticalPathEngine, type CriticalPathConfig } from '@critical-path/core';
 
+const CORS_HEADERS = {
+  'Access-Control-Allow-Origin': '*',
+  'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
+  'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+};
+
+class BadRequestError extends Error {
+  constructor(message: string) {
+    super(message);
+    this.name = 'BadRequestError';
+  }
+}
+
+export interface CriticalPathRouterOptions {
+  /**
+   * Called for unexpected errors (those that would produce a 500), e.g. to report to Sentry.
+   * Return a `Response` to replace the default 500 response. When omitted, errors are logged
+   * with `console.error`.
+   */
+  onError?: (error: unknown, request: Request) => void | Response | Promise<void | Response>;
+  /**
+   * Include the real error message in 500 responses. Defaults to `true` only when
+   * `NODE_ENV === 'development'`, so production deployments never leak internals.
+   */
+  exposeErrors?: boolean;
+}
+
+function isDevelopment(): boolean {
+  return (globalThis as any).process?.env?.NODE_ENV === 'development';
+}
+
 export class CriticalPathRouter {
   public engine: CriticalPathEngine;
+  private readonly onError?: CriticalPathRouterOptions['onError'];
+  private readonly exposeErrors: boolean;
 
-  constructor(configOrEngine?: CriticalPathConfig | CriticalPathEngine) {
+  constructor(configOrEngine?: CriticalPathConfig | CriticalPathEngine, options: CriticalPathRouterOptions = {}) {
     if (configOrEngine instanceof CriticalPathEngine) {
       this.engine = configOrEngine;
     } else {
       this.engine = new CriticalPathEngine(configOrEngine);
     }
+    this.onError = options.onError;
+    this.exposeErrors = options.exposeErrors ?? isDevelopment();
   }
 
   async handleRequest(request: Request): Promise<Response> {
@@ -20,6 +55,11 @@ export class CriticalPathRouter {
     const subpath = pathname.replace(/^.*?\/critical-path\/?/, '').replace(/^\/+/, '');
     const segments = subpath.split('/').filter(Boolean);
 
+    // CORS preflight
+    if (method === 'OPTIONS') {
+      return new Response(null, { status: 204, headers: CORS_HEADERS });
+    }
+
     try {
       // Workflows API
       if (segments[0] === 'workflows') {
@@ -30,7 +70,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ workflows });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const workflow = await this.engine.createWorkflow(body);
             return this.jsonResponse({ workflow }, 201);
           }
@@ -41,14 +81,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ workflow });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateWorkflow(workflowId, body);
             if (!updated) return this.jsonResponse({ error: 'Workflow not found' }, 404);
             return this.jsonResponse({ workflow: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteWorkflow(workflowId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -63,7 +104,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ projects });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const project = await this.engine.createProject(body);
             return this.jsonResponse({ project }, 201);
           }
@@ -107,9 +148,16 @@ export class CriticalPathRouter {
             if (!project) return this.jsonResponse({ error: 'Project not found' }, 404);
             return this.jsonResponse({ project });
           }
+          if (method === 'PATCH' || method === 'PUT') {
+            const { id: _id, createdAt: _createdAt, updatedAt: _updatedAt, ...updates } = await this.readJson(request);
+            const project = await this.engine.updateProject(projectId, updates);
+            if (!project) return this.jsonResponse({ error: 'Project not found' }, 404);
+            return this.jsonResponse({ project });
+          }
           if (method === 'DELETE') {
-            const deleted = await this.engine.store.deleteProject(projectId);
-            return this.jsonResponse({ success: deleted });
+            const deleted = await this.engine.deleteProject(projectId);
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -126,7 +174,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ tasks });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const task = await this.engine.createTask(body);
             return this.jsonResponse({ task }, 201);
           }
@@ -136,7 +184,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comments });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const comment = await this.engine.addComment({ ...body, taskId });
             return this.jsonResponse({ comment }, 201);
           }
@@ -146,7 +194,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ attachments });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const attachment = await this.engine.createAttachment({ ...body, taskId });
             return this.jsonResponse({ attachment }, 201);
           }
@@ -156,8 +204,11 @@ export class CriticalPathRouter {
             return this.jsonResponse({ graph });
           }
           if (method === 'POST') {
-            const body = await request.json();
-            const dep = await this.engine.store.addDependency({
+            const body = await this.readJson(request);
+            if (typeof body.dependsOnTaskId !== 'string' || !body.dependsOnTaskId) {
+              return this.jsonResponse({ error: 'dependsOnTaskId is required' }, 400);
+            }
+            const dep = await this.engine.addDependency({
               taskId,
               dependsOnTaskId: body.dependsOnTaskId,
               type: body.type || 'blocking'
@@ -201,14 +252,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ task });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateTask(taskId, body);
             if (!updated) return this.jsonResponse({ error: 'Task not found' }, 404);
             return this.jsonResponse({ task: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteTask(taskId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -222,7 +274,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ teams });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const team = await this.engine.createTeam(body);
             return this.jsonResponse({ team }, 201);
           }
@@ -233,14 +285,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ team });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateTeam(teamId, body);
             if (!updated) return this.jsonResponse({ error: 'Team not found' }, 404);
             return this.jsonResponse({ team: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteTeam(teamId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -256,7 +309,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ containers });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const container = await this.engine.createContainer(body);
             return this.jsonResponse({ container }, 201);
           }
@@ -267,14 +320,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ container });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateContainer(containerId, body);
             if (!updated) return this.jsonResponse({ error: 'Container not found' }, 404);
             return this.jsonResponse({ container: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteContainer(containerId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -290,7 +344,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ deliverables });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const deliverable = await this.engine.createDeliverable(body);
             return this.jsonResponse({ deliverable }, 201);
           }
@@ -307,14 +361,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ deliverable });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateDeliverable(deliverableId, body);
             if (!updated) return this.jsonResponse({ error: 'Deliverable not found' }, 404);
             return this.jsonResponse({ deliverable: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteDeliverable(deliverableId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -330,7 +385,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ iterations });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const iteration = await this.engine.createIteration(body);
             return this.jsonResponse({ iteration }, 201);
           }
@@ -341,14 +396,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ iteration });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateIteration(iterationId, body);
             if (!updated) return this.jsonResponse({ error: 'Iteration not found' }, 404);
             return this.jsonResponse({ iteration: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteIteration(iterationId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -369,7 +425,7 @@ export class CriticalPathRouter {
         const subResource = segments[2];
         if (commentId && subResource === 'reactions') {
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             if (!body.emoji || !body.userId) {
               return this.jsonResponse({ error: 'emoji and userId are required' }, 400);
             }
@@ -380,7 +436,7 @@ export class CriticalPathRouter {
           if (method === 'DELETE') {
             let body: any = {};
             try {
-              body = await request.json();
+              body = await this.readJson(request);
             } catch {
               // Body may be empty on DELETE, fallback to searchParams
             }
@@ -401,7 +457,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comments });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const comment = await this.engine.addComment(body);
             return this.jsonResponse({ comment }, 201);
           }
@@ -412,14 +468,15 @@ export class CriticalPathRouter {
             return this.jsonResponse({ comment });
           }
           if (method === 'PATCH' || method === 'PUT') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const updated = await this.engine.updateComment(commentId, body);
             if (!updated) return this.jsonResponse({ error: 'Comment not found' }, 404);
             return this.jsonResponse({ comment: updated });
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteComment(commentId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -429,13 +486,13 @@ export class CriticalPathRouter {
         const attachmentId = segments[1];
         if (attachmentId === 'presign') {
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const presigned = await this.engine.getPresignedAttachmentUploadUrl(body);
             return this.jsonResponse({ presigned });
           }
         } else if (attachmentId === 'upload') {
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const attachment = await this.engine.uploadAttachmentFile(body);
             return this.jsonResponse({ attachment }, 201);
           }
@@ -448,7 +505,7 @@ export class CriticalPathRouter {
             return this.jsonResponse({ attachments });
           }
           if (method === 'POST') {
-            const body = await request.json();
+            const body = await this.readJson(request);
             const attachment = await this.engine.createAttachment(body);
             return this.jsonResponse({ attachment }, 201);
           }
@@ -460,7 +517,8 @@ export class CriticalPathRouter {
           }
           if (method === 'DELETE') {
             const deleted = await this.engine.deleteAttachment(attachmentId);
-            return this.jsonResponse({ success: deleted });
+            if (!deleted) return this.jsonResponse({ error: 'Not found' }, 404);
+            return this.jsonResponse({ success: true });
           }
         }
       }
@@ -474,8 +532,8 @@ export class CriticalPathRouter {
           return this.jsonResponse({ timeEntries: entries });
         }
         if (method === 'POST') {
-          const body = await request.json();
-          const entry = await this.engine.store.logTime(body);
+          const body = await this.readJson(request);
+          const entry = await this.engine.logTime(body);
           return this.jsonResponse({ timeEntry: entry }, 201);
         }
       }
@@ -508,7 +566,7 @@ export class CriticalPathRouter {
       // Agent Status / Telemetry API
       if (segments[0] === 'status') {
         if (method === 'POST') {
-          const body = await request.json();
+          const body = await this.readJson(request);
           const status = typeof body.status === 'string' ? body.status : 'active';
           if (this.engine.events) {
             this.engine.events.publish({
@@ -534,19 +592,52 @@ export class CriticalPathRouter {
 
       return this.jsonResponse({ error: `Route not found: ${method} ${pathname}` }, 404);
     } catch (err: unknown) {
-      if (err && typeof err === 'object' && 'name' in err) {
-        if (err.name === 'WorkflowValidationError') {
-          const wfErr = err as unknown as { message: string; fromStatus?: string; toStatus?: string };
-          return this.jsonResponse({ error: wfErr.message, fromStatus: wfErr.fromStatus, toStatus: wfErr.toStatus }, 400);
-        }
-        if (err.name === 'AttachmentValidationError') {
-          const attErr = err as unknown as { message: string };
-          return this.jsonResponse({ error: attErr.message }, 400);
-        }
+      return this.errorResponse(err, request);
+    }
+  }
+
+  private async readJson(request: Request): Promise<any> {
+    try {
+      return await request.json();
+    } catch {
+      throw new BadRequestError('Request body must be valid JSON.');
+    }
+  }
+
+  private async errorResponse(err: unknown, request: Request): Promise<Response> {
+    const name = err && typeof err === 'object' && 'name' in err ? (err as Error).name : undefined;
+    const e = err as Record<string, any>;
+
+    switch (name) {
+      case 'BadRequestError':
+      case 'ValidationError':
+      case 'AttachmentValidationError':
+        return this.jsonResponse({ error: e.message }, 400);
+      case 'WorkflowValidationError':
+        return this.jsonResponse({ error: e.message, fromStatus: e.fromStatus, toStatus: e.toStatus }, 400);
+      case 'CustomFieldValidationError':
+        return this.jsonResponse({ error: e.message, fieldKey: e.fieldKey }, 400);
+      case 'CircularDependencyError':
+        return this.jsonResponse({ error: e.message, cyclePath: e.cyclePath }, 409);
+      case 'NotFoundError':
+        return this.jsonResponse({ error: e.message }, 404);
+    }
+
+    // Unexpected errors may carry internals (SQL, URLs, config details), so they are only
+    // exposed to callers when explicitly enabled.
+    if (this.onError) {
+      try {
+        const custom = await this.onError(err, request);
+        if (custom instanceof Response) return custom;
+      } catch (hookErr) {
+        console.error('[CriticalPathRouter] onError hook threw:', hookErr);
       }
-      const message = err instanceof Error ? err.message : 'Internal Server Error';
-      return this.jsonResponse({ error: message }, 500);
+    } else {
+      console.error('[CriticalPathRouter] Unhandled error:', err);
     }
+
+    const message = this.exposeErrors && err instanceof Error ? err.message : 'Internal Server Error';
+    return this.jsonResponse({ error: message }, 500);
   }
 
   private jsonResponse(data: unknown, status = 200): Response {
@@ -554,9 +645,7 @@ export class CriticalPathRouter {
       status,
       headers: {
         'Content-Type': 'application/json',
-        'Access-Control-Allow-Origin': '*',
-        'Access-Control-Allow-Methods': 'GET, POST, PUT, PATCH, DELETE, OPTIONS',
-        'Access-Control-Allow-Headers': 'Content-Type, Authorization'
+        ...CORS_HEADERS
       }
     });
   }