@harrylabsj/kiwi-merchant-cloud 0.12.0 → 0.12.1

package/app/http/merchant-management/api.js

@@ -40,6 +40,7 @@
 import { createHmac, randomBytes, timingSafeEqual } from "node:crypto";
 import { contentHash } from "../../agent/merchant/action-candidate.js";
 import { ADMIN_SESSION_COOKIE } from "../../auth/merchant-sessions.js";
+import { FileListingPublicationError, } from "../../cloud/file-listing-publication.js";
 import { parseProductTable, ProductTableError, productTableDigest, } from "../../cloud/product-source.js";
 import { convertTabularImport, renderImportTemplateCsv, renderImportTemplateXlsx, TABULAR_IMPORT_MAX_BYTES, } from "../../cloud/product-import-tabular.js";
 import { MerchantImportDraftStore } from "./draft-store.js";
@@ -67,6 +68,11 @@ import { WorkbenchEventProjectionError, } from "./event-projection.js";
 import { GRANT_ACTIONS, MerchantGrantError, } from "../../merchant/grant-store.js";
 const API_PREFIX = "/merchant/api";
 const WORKBENCH_API_PREFIX = "/merchant/api/v1";
+const CATALOG_CONNECTION_SAFE_CODES = new Set([
+    "PUBLICATION_NOT_ACTIVE", "PUBLICATION_NOT_VERIFIED", "CATALOG_UNREACHABLE",
+    "CATALOG_MISMATCH", "BINDING_MERCHANT_MISMATCH", "BINDING_CLAIM_EXPIRED",
+    "BINDING_EXPIRED", "AUTHORIZATION_PENDING", "PREVIEW_CHANGED", "RUNTIME_CARD_CHANGED",
+]);
 const MAX_BODY_BYTES = 1_048_576;
 /** 非候选写命令确认引用的有效期（BD §7.3：短时、单次）。 */
 const CONFIRMATION_TTL_MS = 5 * 60 * 1000;
@@ -189,6 +195,50 @@ export function createMerchantManagementApiHandler(options) {
     // ── 只读路由（认证即鉴权入口；业务授权在服务层逐次复核）────────────────
     /** Workbench v1 读取面复用同一应用服务；未实现路由明确失败，不返回假数据。 */
     async function routeWorkbenchV1Get(req, res, url, rest, requestId) {
+        const listingDraftMatch = /^\/products\/publication-drafts\/(flp_[a-z0-9]+_[0-9a-f]{12})$/.exec(rest);
+        if (listingDraftMatch !== null) {
+            const auth = requireActor(req);
+            authorizeOrThrow(auth.ctx, "products:import");
+            if (auth.ctx.role !== "owner")
+                throw new ManagementError("forbidden", "only owner can publish products");
+            const channel = options.fileListingPublication;
+            if (channel === undefined)
+                throw new ManagementError("unavailable", "product publication is unavailable");
+            const result = await channel.getDraft(listingDraftMatch[1]);
+            if (!result.found)
+                throw new ManagementError("not_found", "publication draft does not exist");
+            writeJson(res, 200, result, { "x-request-id": requestId });
+            return;
+        }
+        if (rest === "/catalog/connect" || rest === "/catalog/connect/pairing") {
+            const auth = requireActor(req);
+            authorizeOrThrow(auth.ctx, "onboarding:manage");
+            if (auth.ctx.role !== "owner")
+                throw new ManagementError("forbidden", "only owner can manage Catalog connection");
+            const channel = options.catalogConnection;
+            if (channel === undefined)
+                throw new ManagementError("unavailable", "Catalog connection is not configured");
+            if (rest.endsWith("/pairing")) {
+                const pairing = await channel.getPairing();
+                writeJson(res, 200, { pairing: pairing === null ? null : {
+                        user_code: pairing.user_code,
+                        verification_uri: pairing.verification_uri,
+                        expires_at: pairing.expires_at,
+                    } }, { "x-request-id": requestId });
+            }
+            else {
+                const summary = await channel.getSummary();
+                // 默认状态响应白名单：配对码与设备凭据不能混入助手可读取的摘要。
+                writeJson(res, 200, {
+                    status: summary.status, published: summary.published,
+                    agentId: summary.agentId ?? null, bindingId: summary.bindingId ?? null,
+                    bindingExpiresAt: summary.bindingExpiresAt ?? null,
+                    errorCode: summary.errorCode == null ? null : CATALOG_CONNECTION_SAFE_CODES.has(summary.errorCode)
+                        ? summary.errorCode : "CATALOG_CONNECTION_UNAVAILABLE",
+                }, { "x-request-id": requestId });
+            }
+            return;
+        }
         if (rest === "/overview") {
             const auth = requireActor(req);
             const runtime = await readService.getStatus(auth.ctx);
@@ -524,6 +574,87 @@ export function createMerchantManagementApiHandler(options) {
         writeWorkbenchProblem(res, "RESOURCE_NOT_FOUND", requestId, "资源不存在", "Workbench API 路由不存在或尚未实现。");
     }
     async function routeWorkbenchV1Post(req, res, rest, requestId, url) {
+        const publicationCommitMatch = /^\/products\/publication-drafts\/(flp_[a-z0-9]+_[0-9a-f]{12})\/commit$/.exec(rest);
+        if (rest === "/products/publication-drafts" || publicationCommitMatch !== null) {
+            const auth = requireActor(req);
+            assertWriteGuards(req, auth.sessionId);
+            authorizeOrThrow(auth.ctx, "products:import");
+            if (auth.ctx.role !== "owner")
+                throw new ManagementError("forbidden", "only owner can publish products");
+            const channel = options.fileListingPublication;
+            if (channel === undefined)
+                throw new ManagementError("unavailable", "product publication is unavailable");
+            try {
+                if (publicationCommitMatch !== null) {
+                    const fields = objectFields(await readJsonBody(req), ["expected_digest", "confirm_publication"]);
+                    if (fields["confirm_publication"] !== true)
+                        throw new ManagementError("invalid_input", "explicit publication confirmation is required");
+                    const result = await channel.commit(publicationCommitMatch[1], requireString(fields["expected_digest"], "expected_digest"));
+                    writeJson(res, result.status === "pending" ? 202 : 200, result, { "x-request-id": requestId });
+                }
+                else {
+                    const fields = objectFields(await readJsonBody(req), ["selections"]);
+                    const selections = fields["selections"];
+                    if (!Array.isArray(selections) || selections.length === 0 || selections.length > 100) {
+                        throw new ManagementError("invalid_input", "select between 1 and 100 products");
+                    }
+                    const selected = selections.map((item) => {
+                        const entry = objectFields(item, ["sku", "category"]);
+                        return { sku: requireString(entry["sku"], "sku"), category: requireString(entry["category"], "category") };
+                    });
+                    writeJson(res, 200, await channel.preview(selected), { "x-request-id": requestId });
+                }
+            }
+            catch (err) {
+                if (err instanceof FileListingPublicationError) {
+                    // Never reflect remote errors or credential-bearing URLs to the page.
+                    throw new ManagementError("precondition_changed", "商品发布条件已变化或目录暂不可用，请检查连接状态并重新预览。");
+                }
+                if (err instanceof ManagementError)
+                    throw err;
+                throw new ManagementError("unavailable", "商品发布结果暂无法确认，请查看原草稿回执后决定是否续办。");
+            }
+            return;
+        }
+        if (rest === "/catalog/connect/begin") {
+            const auth = requireActor(req);
+            assertWriteGuards(req, auth.sessionId);
+            authorizeOrThrow(auth.ctx, "onboarding:manage");
+            if (auth.ctx.role !== "owner")
+                throw new ManagementError("forbidden", "only owner can begin Catalog connection");
+            const channel = options.catalogConnection;
+            if (channel === undefined)
+                throw new ManagementError("unavailable", "Catalog connection is not configured");
+            const fields = objectFields(await readJsonBody(req), ["idempotency_key"]);
+            const begun = operations.begin({
+                merchantId: auth.ctx.merchantId, actorId: auth.ctx.actorId,
+                commandType: "catalog.connection.begin",
+                idempotencyKey: requireString(fields["idempotency_key"], "idempotency_key"),
+                requestDigest: managementRequestDigest({ generation: options.generation() }),
+            });
+            if (begun.kind === "conflict")
+                throw new ManagementError("conflict", "idempotency key was reused with another request");
+            if (begun.kind === "replay") {
+                writeJson(res, 200, begun.receipt, { "x-request-id": requestId });
+                return;
+            }
+            let status = "succeeded";
+            try {
+                await channel.begin();
+            }
+            catch {
+                // 远端创建可能已发生：保留幂等回执，先查连接状态，不盲目重复创建。
+                status = "unknown";
+                console.warn("[merchant-management] catalog.connection.begin result unknown; query connection status before retry");
+            }
+            const receipt = {
+                ...staticReceipt(begun.operationId, "catalog.connection.begin", status),
+                resource_ref: "catalog:connection", completed_at: now().toISOString(),
+            };
+            operations.complete(begun.operationId, status, receipt);
+            writeJson(res, status === "unknown" ? 202 : 200, receipt, { "x-request-id": requestId });
+            return;
+        }
         if (rest === "/runtime/safety-stops") {
             const auth = requireActor(req);
             assertWriteGuards(req, auth.sessionId);
@@ -1594,6 +1725,10 @@ export function createMerchantManagementApiHandler(options) {
     async function postOnboardingIntent(req, res) {
         const auth = requireActor(req);
         assertWriteGuards(req, auth.sessionId);
+        authorizeOrThrow(auth.ctx, "onboarding:manage");
+        if (options.catalogConnection !== undefined) {
+            throw new ManagementError("conflict", "本实例已启用目录直连，请在连接 Kiwi 目录入口继续，不能同时启动旧部署向导。");
+        }
         const body = await readJsonBody(req);
         const fields = objectFields(body, [
             "intent_id",
@@ -2171,7 +2306,7 @@ export function createMerchantManagementApiHandler(options) {
         let table;
         try {
             table = parseProductTable(fields["table"], "request body");
-            table = importChannel.prepareTable?.(table) ?? table;
+            table = await importChannel.prepareTable?.(table) ?? table;
         }
         catch (err) {
             if (err instanceof ProductTableError) {