@flowselections/actie-mail-kwekers-erp-mathot 1.0.0

package/dist-lib/lib/public-offer.functions.js

@@ -0,0 +1,116 @@
+import { createServerFn } from "@tanstack/react-start";
+import { createClient } from "@supabase/supabase-js";
+import { z } from "zod";
+// Publieke endpoint: gebruikt anon-key (RLS / SECURITY DEFINER beschermt de data).
+// Bewust GEEN service-role client — die secret is hier niet nodig en is in
+// veel omgevingen niet beschikbaar.
+function getPublicClient() {
+    const url = process.env.SUPABASE_URL ?? process.env.VITE_SUPABASE_URL;
+    const key = process.env.SUPABASE_PUBLISHABLE_KEY ??
+        process.env.SUPABASE_ANON_KEY ??
+        process.env.VITE_SUPABASE_PUBLISHABLE_KEY;
+    if (!url || !key) {
+        throw new Error("Supabase publieke configuratie ontbreekt (SUPABASE_URL / SUPABASE_PUBLISHABLE_KEY).");
+    }
+    return createClient(url, key, {
+        auth: { persistSession: false, autoRefreshToken: false },
+    });
+}
+export const getOfferByLinkCode = createServerFn({ method: "GET" })
+    .inputValidator((d) => z.object({ code: z.string().min(8).max(64).regex(/^[a-f0-9]+$/) }).parse(d))
+    .handler(async ({ data }) => {
+    const client = getPublicClient();
+    const { data: result, error } = await client.rpc("get_offer_by_link_code", {
+        p_code: data.code,
+    });
+    if (error)
+        throw new Error(error.message);
+    return result;
+});
+export const trackOfferClick = createServerFn({ method: "POST" })
+    .inputValidator((d) => z.object({ code: z.string().min(8).max(64).regex(/^[a-f0-9]+$/) }).parse(d))
+    .handler(async ({ data }) => {
+    const client = getPublicClient();
+    const { data: rec } = await client
+        .from("offer_recipients")
+        .select("id, campaign_id, clicked_at")
+        .eq("link_code", data.code)
+        .maybeSingle();
+    if (!rec)
+        return { ok: false };
+    if (!rec.clicked_at) {
+        await client.from("offer_recipients").update({ clicked_at: new Date().toISOString() }).eq("id", rec.id);
+    }
+    await client.from("offer_events").insert({
+        recipient_id: rec.id,
+        campaign_id: rec.campaign_id,
+        event_type: "click",
+    });
+    return { ok: true };
+});
+const orderItemSchema = z.object({
+    product_id: z.string().uuid(),
+    product_name: z.string().min(1).max(255),
+    quantity: z.number().int().min(1).max(100000),
+    unit_price: z.number().min(0).max(1000000),
+    sticker: z.boolean().optional().default(false),
+    sticker_unit_price: z.number().min(0).max(1000000).optional().default(0),
+});
+export const placeOfferOrder = createServerFn({ method: "POST" })
+    .inputValidator((d) => z.object({
+    code: z.string().min(8).max(64).regex(/^[a-f0-9]+$/),
+    customer_name: z.string().min(1).max(255),
+    customer_email: z.string().email().max(255),
+    customer_phone: z.string().max(50).optional(),
+    notes: z.string().max(2000).optional(),
+    items: z.array(orderItemSchema).min(1).max(100),
+}).parse(d))
+    .handler(async ({ data }) => {
+    const client = getPublicClient();
+    const { data: rec } = await client
+        .from("offer_recipients")
+        .select("id, campaign_id, customer_id")
+        .eq("link_code", data.code)
+        .maybeSingle();
+    if (!rec)
+        throw new Error("Ongeldige link");
+    // Realtime voorraadcontrole: haal actuele voorraad op via RPC
+    const { data: offerSnapshot } = await client.rpc("get_offer_by_link_code", { p_code: data.code });
+    const liveProducts = Array.isArray(offerSnapshot?.products) ? offerSnapshot.products : [];
+    for (const it of data.items) {
+        const lp = liveProducts.find((p) => p.id === it.product_id);
+        const stock = Number(lp?.live_stock ?? lp?.available_stock ?? 0);
+        if (!lp)
+            throw new Error(`Product niet meer beschikbaar: ${it.product_name}`);
+        if (stock <= 0)
+            throw new Error(`${it.product_name} is uitverkocht`);
+        if (it.quantity > stock)
+            throw new Error(`${it.product_name}: slechts ${stock} op voorraad`);
+    }
+    const total = data.items.reduce((s, i) => s + i.quantity * (i.unit_price + (i.sticker ? i.sticker_unit_price : 0)), 0);
+    const orderId = crypto.randomUUID();
+    const { error } = await client
+        .from("offer_orders")
+        .insert({
+        id: orderId,
+        recipient_id: rec.id,
+        campaign_id: rec.campaign_id,
+        customer_id: rec.customer_id,
+        customer_name: data.customer_name,
+        customer_email: data.customer_email,
+        customer_phone: data.customer_phone ?? null,
+        notes: data.notes ?? null,
+        items: data.items,
+        total_amount: total,
+    });
+    if (error)
+        throw new Error(error.message);
+    await client.from("offer_recipients").update({ ordered_at: new Date().toISOString() }).eq("id", rec.id);
+    await client.from("offer_events").insert({
+        recipient_id: rec.id,
+        campaign_id: rec.campaign_id,
+        event_type: "order",
+        metadata: { order_id: orderId, total },
+    });
+    return { ok: true, orderId, total };
+});