@endora-commerce/mod-carts 0.100.0

package/dist/backend/routes.admin.js

@@ -0,0 +1,95 @@
+import { adminCartsListQuerySchema, adminRejectCartSchema, setCartApprovalPolicySchema, ERROR_CODES, } from '@endora-commerce/contracts';
+import { HttpError } from '@endora-commerce/platform/http';
+export async function registerCartsAdminRoutes(app, deps) {
+    const { cartAdminService, requireAdmin, resolveAdminUserId } = deps;
+    app.get('/api/v1/admin/carts', { preHandler: requireAdmin('carts:read') }, async (request) => {
+        const raw = (request.query ?? {});
+        // Fastify query parser delivers repeated keys as arrays; explicit
+        // status / approvalStatus are accepted as comma-separated strings
+        // too for ergonomic curl use.
+        const normalised = { ...raw };
+        for (const arrKey of ['status', 'approvalStatus']) {
+            const v = normalised[arrKey];
+            if (typeof v === 'string') {
+                normalised[arrKey] = v.split(',').filter((s) => s.length > 0);
+            }
+        }
+        const parsed = adminCartsListQuerySchema.parse(normalised);
+        return cartAdminService.list(parsed);
+    });
+    app.get('/api/v1/admin/carts/:id', { preHandler: requireAdmin('carts:read') }, async (request) => {
+        return cartAdminService.getById(request.params.id);
+    });
+    app.get('/api/v1/admin/carts/:id/audit', { preHandler: requireAdmin('carts:read') }, async (request) => {
+        const page = request.query.page ? Math.max(1, Number.parseInt(request.query.page, 10)) : 1;
+        const pageSize = request.query.pageSize
+            ? Math.max(1, Math.min(200, Number.parseInt(request.query.pageSize, 10)))
+            : 50;
+        return cartAdminService.getAudit(request.params.id, page, pageSize);
+    });
+    app.post('/api/v1/admin/carts/:id/reject', {
+        preHandler: requireAdmin('carts:reject'),
+        schema: { body: adminRejectCartSchema },
+    }, async (request) => {
+        const adminUserId = resolveAdminUserId(request);
+        if (!adminUserId) {
+            throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+        }
+        const body = adminRejectCartSchema.parse(request.body);
+        return cartAdminService.reject(request.params.id, adminUserId, body.reason);
+    });
+    /**
+     * Feature 027 US4 — admin proxy for the per-Organization
+     * `requires_cart_approval` policy. Same semantics as the Org-Admin
+     * self-service route under `/api/v1/organization/policies/cart-approval`
+     * but the actor is a platform admin (and consequently the audit
+     * row's actor_type is `platform_admin`).
+     */
+    if (deps.cartApprovalService) {
+        /**
+         * The read half, added by feature 091's P7b
+         * (`contracts/admin-component-contribution.md` §10.5).
+         *
+         * This module owned the `PATCH` and no `GET`, so the panel that rendered
+         * the toggle took its initial value as a prop from `organizations`' detail
+         * payload. As an `organization.detail.after` contribution it has no such
+         * prop — the other three contributors want neither it nor the request — so
+         * it reads its own state here.
+         *
+         * **`customers:manage`, the same code as the `PATCH`**, so read and write
+         * agree on one code: an operator who can see the toggle can use it, which
+         * is what a contribution's `requiredPermission` exists to guarantee. The
+         * response is the `PATCH`'s own `cartApprovalPolicyResponseSchema` shape,
+         * for the same reason one code is better than two.
+         */
+        app.get('/api/v1/admin/organizations/:id/cart-approval-policy', { preHandler: requireAdmin('customers:manage') }, async (request) => {
+            const org = await deps.cartApprovalService.getPolicyByAdmin(request.params.id);
+            return {
+                data: {
+                    organizationId: org.id,
+                    requiresCartApproval: org.requiresCartApproval,
+                    updatedAt: org.updatedAt.toISOString(),
+                },
+            };
+        });
+        app.patch('/api/v1/admin/organizations/:id/cart-approval-policy', {
+            preHandler: requireAdmin('customers:manage'),
+            schema: { body: setCartApprovalPolicySchema },
+        }, async (request) => {
+            const adminUserId = resolveAdminUserId(request);
+            if (!adminUserId) {
+                throw new HttpError(401, ERROR_CODES.UNAUTHORIZED, 'Admin session required.');
+            }
+            const body = setCartApprovalPolicySchema.parse(request.body);
+            const org = await deps.cartApprovalService.setPolicyByAdmin(request.params.id, adminUserId, body.requiresCartApproval);
+            return {
+                data: {
+                    organizationId: org.id,
+                    requiresCartApproval: org.requiresCartApproval,
+                    updatedAt: org.updatedAt.toISOString(),
+                },
+            };
+        });
+    }
+}
+//# sourceMappingURL=routes.admin.js.map

package/dist/backend/routes.admin.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.admin.js","sourceRoot":"","sources":["../../src/backend/routes.admin.ts"],"names":[],"mappings":"AACA,OAAO,EACL,yBAAyB,EACzB,qBAAqB,EACrB,2BAA2B,EAC3B,WAAW,GACZ,MAAM,4BAA4B,CAAC;AAGpC,OAAO,EAAE,SAAS,EAAE,MAAM,gCAAgC,CAAC;AA8B3D,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAC5C,GAAoB,EACpB,IAA0B;IAE1B,MAAM,EAAE,gBAAgB,EAAE,YAAY,EAAE,kBAAkB,EAAE,GAAG,IAAI,CAAC;IAEpE,GAAG,CAAC,GAAG,CACL,qBAAqB,EACrB,EAAE,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,EAC1C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,GAAG,GAAG,CAAC,OAAO,CAAC,KAAK,IAAI,EAAE,CAA4B,CAAC;QAC7D,kEAAkE;QAClE,kEAAkE;QAClE,8BAA8B;QAC9B,MAAM,UAAU,GAA4B,EAAE,GAAG,GAAG,EAAE,CAAC;QACvD,KAAK,MAAM,MAAM,IAAI,CAAC,QAAQ,EAAE,gBAAgB,CAAC,EAAE,CAAC;YAClD,MAAM,CAAC,GAAG,UAAU,CAAC,MAAM,CAAC,CAAC;YAC7B,IAAI,OAAO,CAAC,KAAK,QAAQ,EAAE,CAAC;gBAC1B,UAAU,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;YAChE,CAAC;QACH,CAAC;QACD,MAAM,MAAM,GAAG,yBAAyB,CAAC,KAAK,CAAC,UAAU,CAAC,CAAC;QAC3D,OAAO,gBAAgB,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IACvC,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,yBAAyB,EACzB,EAAE,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,EAC1C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,OAAO,gBAAgB,CAAC,OAAO,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;IACrD,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,GAAG,CACL,+BAA+B,EAC/B,EAAE,UAAU,EAAE,YAAY,CAAC,YAAY,CAAC,EAAE,EAC1C,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,IAAI,GAAG,OAAO,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC3F,MAAM,QAAQ,GAAG,OAAO,CAAC,KAAK,CAAC,QAAQ;YACrC,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,IAAI,CAAC,GAAG,CAAC,GAAG,EAAE,MAAM,CAAC,QAAQ,CAAC,OAAO,CAAC,KAAK,CAAC,QAAQ,EAAE,EAAE,CAAC,CAAC,CAAC;YACzE,CAAC,CAAC,EAAE,CAAC;QACP,OAAO,gBAAgB,CAAC,QAAQ,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,IAAI,EAAE,QAAQ,CAAC,CAAC;IACtE,CAAC,CACF,CAAC;IAEF,GAAG,CAAC,IAAI,CACN,gCAAgC,EAChC;QACE,UAAU,EAAE,YAAY,CAAC,cAAc,CAAC;QACxC,MAAM,EAAE,EAAE,IAAI,EAAE,qBAAqB,EAAE;KACxC,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;QAChB,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QAChD,IAAI,CAAC,WAAW,EAAE,CAAC;YACjB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;QAChF,CAAC;QACD,MAAM,IAAI,GAAG,qBAAqB,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvD,OAAO,gBAAgB,CAAC,MAAM,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,WAAW,EAAE,IAAI,CAAC,MAAM,CAAC,CAAC;IAC9E,CAAC,CACF,CAAC;IAEF;;;;;;OAMG;IACH,IAAI,IAAI,CAAC,mBAAmB,EAAE,CAAC;QAC7B;;;;;;;;;;;;;;;WAeG;QACH,GAAG,CAAC,GAAG,CACL,sDAAsD,EACtD,EAAE,UAAU,EAAE,YAAY,CAAC,kBAAkB,CAAC,EAAE,EAChD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAoB,CAAC,gBAAgB,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;YAChF,OAAO;gBACL,IAAI,EAAE;oBACJ,cAAc,EAAE,GAAG,CAAC,EAAE;oBACtB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;oBAC9C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;iBACvC;aACF,CAAC;QACJ,CAAC,CACF,CAAC;QAEF,GAAG,CAAC,KAAK,CACP,sDAAsD,EACtD;YACE,UAAU,EAAE,YAAY,CAAC,kBAAkB,CAAC;YAC5C,MAAM,EAAE,EAAE,IAAI,EAAE,2BAA2B,EAAE;SAC9C,EACD,KAAK,EAAE,OAAO,EAAE,EAAE;YAChB,MAAM,WAAW,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;YAChD,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,MAAM,IAAI,SAAS,CAAC,GAAG,EAAE,WAAW,CAAC,YAAY,EAAE,yBAAyB,CAAC,CAAC;YAChF,CAAC;YACD,MAAM,IAAI,GAAG,2BAA2B,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;YAC7D,MAAM,GAAG,GAAG,MAAM,IAAI,CAAC,mBAAoB,CAAC,gBAAgB,CAC1D,OAAO,CAAC,MAAM,CAAC,EAAE,EACjB,WAAW,EACX,IAAI,CAAC,oBAAoB,CAC1B,CAAC;YACF,OAAO;gBACL,IAAI,EAAE;oBACJ,cAAc,EAAE,GAAG,CAAC,EAAE;oBACtB,oBAAoB,EAAE,GAAG,CAAC,oBAAoB;oBAC9C,SAAS,EAAE,GAAG,CAAC,SAAS,CAAC,WAAW,EAAE;iBACvC;aACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/backend/routes.d.ts

@@ -0,0 +1,101 @@
+import type { FastifyInstance, FastifyRequest } from 'fastify';
+import { type CatalogProductReadPort } from '@endora-commerce/contracts';
+import type { CartService } from './services/cart-service.js';
+import type { CartUpsellService } from './services/cart-upsell-service.js';
+import type { CartCouponService } from './services/cart-coupon-service.js';
+import type { CartConversionService } from './services/cart-conversion-service.js';
+import type { CartPricingRecompute } from './services/cart-pricing-recompute.js';
+import type { EntityManager } from '@mikro-orm/postgresql';
+export interface CartsDeps {
+    cartService: CartService;
+    /**
+     * Feature 027 — Up-sell aggregator. Optional so legacy compositions
+     * that haven't yet wired the new service still build successfully;
+     * production composition (commerceModule) provides it.
+     */
+    cartUpsellService?: CartUpsellService;
+    /**
+     * Feature 027 — pushes a cart line into the buyer's named Purchase
+     * List. Cross-module call to ShoppingListService.addItem; optional
+     * for the same reason as above.
+     */
+    pushLineToShoppingList?: (input: {
+        customerAccountId: string;
+        organizationId: string | null;
+        shoppingListId: string;
+        productId: string;
+        variantId: string | null;
+        quantity: number;
+    }) => Promise<void>;
+    /**
+     * Feature 027 US2 — coupon application service. Optional so legacy
+     * compositions still build; production wires it. Also drives the
+     * `reevaluateOnRead` auto-drop in the GET handler when a previously-
+     * applied code no longer fits the cart.
+     */
+    cartCouponService?: CartCouponService;
+    /**
+     * Feature 027 US3 — three conversions (Cart→QR, QR→Cart, ShoppingList→Cart).
+     * Optional so legacy compositions still build.
+     */
+    cartConversionService?: CartConversionService;
+    /**
+     * Feature 027 §R5 — re-pricing on read. When wired, every full-cart
+     * read calls the helper to refresh `cart_items.unit_price` from the
+     * customer's currently resolved price list (Redis-cached for 30 s).
+     * The response uses the recomputed prices; the snapshotted column is
+     * kept for audit / diff.
+     */
+    cartPricingRecompute?: CartPricingRecompute;
+    /**
+     * Feature 027 US3 — ShoppingListService.convertToCart bridge for the
+     * `POST /api/v1/cart/from-shopping-list/:listId` endpoint. Returns the
+     * cart-side append result.
+     */
+    appendShoppingListToCart?: (input: {
+        customerAccountId: string;
+        organizationId: string | null;
+        shoppingListId: string;
+    }) => Promise<{
+        cartId: string;
+        appendedLineCount: number;
+        droppedLines: Array<{
+            productId: string;
+            productName: string;
+            reason: string;
+        }>;
+    }>;
+    resolveCartActor: (request: FastifyRequest) => {
+        customer?: {
+            customerAccountId: string;
+            organizationId: string | null;
+        };
+        anonymousToken?: string;
+    };
+    emFactory: () => EntityManager;
+    /**
+     * `catalog`'s product read model (feature 075, Phase C). The cart
+     * serializer resolves each line's display name, slug and sku from it; it
+     * used to `em.find(Product, …)` against `catalog`'s table, so a switched-off
+     * `catalog` still named the products on a cart it had stopped serving.
+     */
+    catalogProducts: CatalogProductReadPort;
+    /**
+     * Optional gate — when provided, signed-in customers whose Organization
+     * is not `active` (pending_verification / blocked / rejected) cannot add
+     * lines to the cart. Anonymous users are always permitted.
+     *
+     * Feature 026 (US1 / US3). Throws OrganizationCannotTransactError, which
+     * the route translates to HTTP 423 with a localized body.
+     */
+    assertOrganizationCanTransact?: (organizationId: string) => Promise<void>;
+}
+/**
+ * Cart routes — open to anonymous users too. The resolver picks the right
+ * cart based on (authenticated session, anonymous cookie, neither).
+ *
+ * Anonymous callers receive a Set-Cookie for `b2b_cart_anon` on first add so
+ * later requests target the same cart.
+ */
+export declare function registerCartRoutes(app: FastifyInstance, deps: CartsDeps): Promise<void>;
+//# sourceMappingURL=routes.d.ts.map

package/dist/backend/routes.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"routes.d.ts","sourceRoot":"","sources":["../../src/backend/routes.ts"],"names":[],"mappings":"AASA,OAAO,KAAK,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,SAAS,CAAC;AAC/D,OAAO,EASL,KAAK,sBAAsB,EAE5B,MAAM,4BAA4B,CAAC;AACpC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,mCAAmC,CAAC;AAC3E,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,uCAAuC,CAAC;AACnF,OAAO,KAAK,EAAE,oBAAoB,EAAE,MAAM,sCAAsC,CAAC;AAEjF,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,uBAAuB,CAAC;AAW3D,MAAM,WAAW,SAAS;IACxB,WAAW,EAAE,WAAW,CAAC;IACzB;;;;OAIG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;;OAIG;IACH,sBAAsB,CAAC,EAAE,CAAC,KAAK,EAAE;QAC/B,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC;QACvB,SAAS,EAAE,MAAM,CAAC;QAClB,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;QACzB,QAAQ,EAAE,MAAM,CAAC;KAClB,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;IACpB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,iBAAiB,CAAC;IACtC;;;OAGG;IACH,qBAAqB,CAAC,EAAE,qBAAqB,CAAC;IAC9C;;;;;;OAMG;IACH,oBAAoB,CAAC,EAAE,oBAAoB,CAAC;IAC5C;;;;OAIG;IACH,wBAAwB,CAAC,EAAE,CAAC,KAAK,EAAE;QACjC,iBAAiB,EAAE,MAAM,CAAC;QAC1B,cAAc,EAAE,MAAM,GAAG,IAAI,CAAC;QAC9B,cAAc,EAAE,MAAM,CAAC;KACxB,KAAK,OAAO,CAAC;QACZ,MAAM,EAAE,MAAM,CAAC;QACf,iBAAiB,EAAE,MAAM,CAAC;QAC1B,YAAY,EAAE,KAAK,CAAC;YAAE,SAAS,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;KACjF,CAAC,CAAC;IACH,gBAAgB,EAAE,CAAC,OAAO,EAAE,cAAc,KAAK;QAC7C,QAAQ,CAAC,EAAE;YAAE,iBAAiB,EAAE,MAAM,CAAC;YAAC,cAAc,EAAE,MAAM,GAAG,IAAI,CAAA;SAAE,CAAC;QACxE,cAAc,CAAC,EAAE,MAAM,CAAC;KACzB,CAAC;IACF,SAAS,EAAE,MAAM,aAAa,CAAC;IAC/B;;;;;OAKG;IACH,eAAe,EAAE,sBAAsB,CAAC;IACxC;;;;;;;OAOG;IACH,6BAA6B,CAAC,EAAE,CAAC,cAAc,EAAE,MAAM,KAAK,OAAO,CAAC,IAAI,CAAC,CAAC;CAC3E;AAED;;;;;;GAMG;AACH,wBAAsB,kBAAkB,CAAC,GAAG,EAAE,eAAe,EAAE,IAAI,EAAE,SAAS,GAAG,OAAO,CAAC,IAAI,CAAC,CAqe7F"}