@fonderie/customers 6.1.6 → 6.2.0

package/dist/index.js

@@ -1028,47 +1028,69 @@ var CustomerEmailModel = class {
 };
 
 // src/models/customer-label.model.ts
+var SELECT = `id, type, value, created_at AS "createdAt"`;
 var CustomerLabelModel = class {
   constructor(store) {
     this.store = store;
   }
   store;
-  list(type) {
+  /**
+   * List the labels a workspace may use: the shared/system defaults
+   * (workspace_id IS NULL) plus its OWN private labels. Never another
+   * workspace's — so listing can't enumerate other tenants' custom
+   * vocabulary.
+   */
+  list(type, workspaceId) {
     return this.store.query(
-      `SELECT id, type, value, created_at AS "createdAt"
+      `SELECT ${SELECT}
 			 FROM fonderie_customer_labels
-			 WHERE type = $1
+			 WHERE type = $1 AND (workspace_id IS NULL OR workspace_id = $2)
 			 ORDER BY value ASC`,
-      [type]
+      [type, workspaceId]
     );
   }
   /**
-   * Returns false when the label is still referenced. Labels are a SHARED
-   * table (no workspace column), so an unconditional delete would let one
-   * tenant destroy a label other tenants' emails/phones/addresses point at.
-   * Until labels are workspace-scoped, only an unreferenced label may go.
+   * Delete a label. Only a label OWNED BY this workspace and UNREFERENCED can
+   * go: shared defaults (workspace_id IS NULL) and other workspaces' labels
+   * are untouchable, and an in-use label (still pointed at by an email/phone/
+   * address) is refused so it can't be destroyed out from under a record.
+   * Returns false when nothing was deleted.
    */
-  async remove(id) {
+  async remove(id, workspaceId) {
     const rows = await this.store.query(
       `DELETE FROM fonderie_customer_labels l
 			 WHERE l.id = $1
+			   AND l.workspace_id = $2
 			   AND NOT EXISTS (SELECT 1 FROM fonderie_customer_emails    WHERE label_id = l.id)
 			   AND NOT EXISTS (SELECT 1 FROM fonderie_customer_phones    WHERE label_id = l.id)
 			   AND NOT EXISTS (SELECT 1 FROM fonderie_customer_addresses WHERE label_id = l.id)
 			 RETURNING l.id`,
-      [id]
+      [id, workspaceId]
     );
     return rows.length > 0;
   }
-  async findOrCreate(type, raw) {
+  /**
+   * Resolve a (type, value) to a label id for this workspace: reuse a shared
+   * default when one exists (so common labels like 'work' stay canonical),
+   * otherwise create/reuse a label PRIVATE to this workspace.
+   */
+  async findOrCreate(type, raw, workspaceId) {
     const value = raw.trim().toLowerCase();
-    const [row] = await this.store.query(
-      `INSERT INTO fonderie_customer_labels (type, value)
-			 VALUES ($1, $2)
-			 ON CONFLICT (type, value) DO UPDATE SET value = EXCLUDED.value
-			 RETURNING id, type, value, created_at AS "createdAt"`,
+    const [shared] = await this.store.query(
+      `SELECT ${SELECT} FROM fonderie_customer_labels
+			 WHERE type = $1 AND value = $2 AND workspace_id IS NULL
+			 LIMIT 1`,
       [type, value]
     );
+    if (shared) return shared;
+    const [row] = await this.store.query(
+      `INSERT INTO fonderie_customer_labels (type, value, workspace_id)
+			 VALUES ($1, $2, $3)
+			 ON CONFLICT (type, value, workspace_id) WHERE workspace_id IS NOT NULL
+			 DO UPDATE SET value = EXCLUDED.value
+			 RETURNING ${SELECT}`,
+      [type, value, workspaceId]
+    );
     if (!row) throw new Error("Failed to find or create label");
     return row;
   }
@@ -1675,7 +1697,7 @@ function customerAddressController(store) {
         return setApiResponse2(HTTP2.UNPROCESSABLE, "INVALID_PARAMETER", "zipPostalCode is required");
       }
       const rawLabel = typeof body?.["label"] === "string" ? body["label"] : "service";
-      const { id: labelId } = await labels.findOrCreate("address", rawLabel);
+      const { id: labelId } = await labels.findOrCreate("address", rawLabel, r.workspaceId);
       let created;
       try {
         created = await addresses.add({
@@ -1713,7 +1735,7 @@ function customerAddressController(store) {
         return setApiResponse2(HTTP2.UNPROCESSABLE, "INVALID_PARAMETER", "label is required");
       }
       try {
-        const { id: labelId } = await labels.findOrCreate("address", body["label"].trim());
+        const { id: labelId } = await labels.findOrCreate("address", body["label"].trim(), r.workspaceId);
         const updated = await addresses.updateLabel(addrId, r.customer.id, labelId);
         return setApiResponse2(HTTP2.OK, "ADDRESS_UPDATED", "Address updated successfully.", {
           address: toCustomerAddressDTO(updated)
@@ -1808,7 +1830,7 @@ function customerEmailController(store) {
       }
       const rawLabel = typeof body?.["label"] === "string" ? body["label"] : "work";
       const isPrimary2 = body?.["isPrimary"] === true;
-      const { id: labelId } = await labels.findOrCreate("email", rawLabel);
+      const { id: labelId } = await labels.findOrCreate("email", rawLabel, r.workspaceId);
       let created;
       try {
         created = await emails.add({
@@ -1840,7 +1862,7 @@ function customerEmailController(store) {
         return setApiResponse3(HTTP3.UNPROCESSABLE, "INVALID_PARAMETER", "label is required");
       }
       try {
-        const { id: labelId } = await labels.findOrCreate("email", body["label"].trim());
+        const { id: labelId } = await labels.findOrCreate("email", body["label"].trim(), r.workspaceId);
         const updated = await emails.updateLabel(emailId, r.customer.id, labelId);
         return setApiResponse3(HTTP3.OK, "EMAIL_UPDATED", "Email updated successfully.", {
           email: toCustomerEmailDTO(updated)
@@ -2017,7 +2039,7 @@ function customerPhoneController(store) {
       }
       const rawLabel = typeof body?.["label"] === "string" ? body["label"] : "mobile";
       const isPrimary2 = body?.["isPrimary"] === true;
-      const { id: labelId } = await labels.findOrCreate("phone", rawLabel);
+      const { id: labelId } = await labels.findOrCreate("phone", rawLabel, r.workspaceId);
       let created;
       try {
         created = await phones.add({
@@ -2049,7 +2071,7 @@ function customerPhoneController(store) {
         return setApiResponse5(HTTP5.UNPROCESSABLE, "INVALID_PARAMETER", "label is required");
       }
       try {
-        const { id: labelId } = await labels.findOrCreate("phone", body["label"].trim());
+        const { id: labelId } = await labels.findOrCreate("phone", body["label"].trim(), r.workspaceId);
         const updated = await phones.updateLabel(phoneId, r.customer.id, labelId);
         return setApiResponse5(HTTP5.OK, "PHONE_UPDATED", "Phone updated successfully.", {
           phone: toCustomerPhoneDTO(updated)
@@ -2160,7 +2182,8 @@ function customerLabelController(store) {
       if (!type || !VALID_TYPES.includes(type)) {
         return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "type must be phone, email, or address");
       }
-      const rows = await labels.list(type);
+      if (!ctx.workspace) return setApiResponse7(HTTP7.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const rows = await labels.list(type, ctx.workspace.id);
       return setApiResponse7(HTTP7.OK, "LABELS_FETCHED", "Labels retrieved successfully.", {
         labels: rows.map(toCustomerLabelDTO)
       });
@@ -2171,12 +2194,13 @@ function customerLabelController(store) {
       if (!isUuid(labelId)) {
         return setApiResponse7(HTTP7.UNPROCESSABLE, "INVALID_PARAMETER", "labelId must be a valid UUID");
       }
-      const removed = await labels.remove(labelId);
+      if (!ctx.workspace) return setApiResponse7(HTTP7.NOT_FOUND, "NOT_FOUND", "Workspace not found");
+      const removed = await labels.remove(labelId, ctx.workspace.id);
       if (!removed) {
         return setApiResponse7(
           HTTP7.CONFLICT,
           "LABEL_IN_USE",
-          "Label is still referenced by customer records and cannot be deleted."
+          "Label cannot be deleted \u2014 it is a shared default, not owned by this workspace, or still referenced."
         );
       }
       return setApiResponse7(HTTP7.OK, "LABEL_DELETED", "Label deleted successfully.");