@managemint-solutions/sdk 0.50.0 → 0.52.0

package/dist/index.d.ts

@@ -33,7 +33,7 @@ export { UpdatePermissionsDto } from './permissions';
 export type { UserEmploymentRow, UserRow } from './users';
 export { AddUserDto, GetUsersQueryDto, UpdateMyProfileDto, UpdateUserDto, UserIdDto, } from './users';
 export type { ClaimOutcome, WebhookEventRow, WebhookEventsTable } from './webhook-events';
-export { GetSupportingFilesDto, SupportingFileIdDto } from './supporting-files';
+export { GetSupportingFilesDto, SupportingFileIdDto, SupportingFileNamesDto } from './supporting-files';
 export { ClientIdDto, CreateClientDto, GetClientsDto, UpdateClientDto } from './clients';
 export { ConvertLeadDto, CreateLeadDto, GetLeadsDto, LeadIdDto, UpdateLeadDto } from './leads';
 export { CreateProjectDto, GetProjectsDto, ProjectIdDto, UpdateProjectDto } from './projects';

package/dist/index.js

@@ -8,8 +8,8 @@
 // to keep. The row and input types they produce and accept are exported for annotations.
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.UpdatePermissionsDto = exports.PermissionsResource = exports.UpdateOrganizationDto = exports.CreateOrganizationDto = exports.NotificationIdDto = exports.GetNotificationsDto = exports.NoteIdDto = exports.GetNotesDto = exports.AddNoteDto = exports.UpdateAdditionalDetailsDto = exports.IsAdditionalDetailsValueByType = exports.GetAdditionalDetailsDto = exports.AdditionalDetailsIdDto = exports.AddAdditionalDetailsDto = exports.UpdateLabelDto = exports.LabelIdDto = exports.GetLabelsDto = exports.AddLabelDto = exports.UpdateStatusDto = exports.StatusIdDto = exports.ReorderStatusesDto = exports.GetStatusesDto = exports.AddStatusDto = exports.CreateSupportRequestDto = exports.UpdateConfigDto = exports.CreateConfigDto = exports.CreateFeatureRequestDto = exports.InvoiceIdDto = exports.GetInvoicesQueryDto = exports.ReinstateSubscriptionDto = exports.PurchaseModuleDto = exports.PaymentIdDto = exports.InitialPaymentDto = exports.GetPaymentsQueryDto = exports.CancelSubscriptionDto = exports.GetAuditTrailDto = exports.IsNullable = exports.EmptyToNull = exports.SupabaseClientError = exports.createSupabaseServiceClient = exports.SupabaseServiceClient = exports.SignInDto = exports.SendPasswordResetEmailDto = exports.ResetPasswordDto = exports.ExchangeTokenHashDto = exports.ExchangeRefreshTokenDto = exports.createSupabaseAuthClient = exports.SupabaseAuthClient = exports.createSupabaseClient = exports.SupabaseClient = void 0;
-exports.proRataDays = exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = void 0;
-exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = void 0;
+exports.isWithinPeriod = exports.initialUntil = exports.cyclePeriodFor = exports.countWorkingDays = exports.completedMonths = exports.addMonths = exports.GetPublicHolidaysDto = exports.UpdateLeaveTypeDto = exports.UpdateLeaveRequestDto = exports.UpdateLeaveEntitlementDto = exports.ReviewLeaveRequestDto = exports.LeaveTypeIdDto = exports.LeaveRequestIdDto = exports.LeaveEntitlementIdDto = exports.GetLeaveTypesDto = exports.GetLeaveRequestsDto = exports.GetLeaveEntitlementsDto = exports.GetLeaveCalendarDto = exports.CreateLeaveTypeDto = exports.CreateLeaveRequestDto = exports.CreateLeaveEntitlementDto = exports.CreateLeaveAdjustmentDto = exports.BulkCreateLeaveEntitlementsDto = exports.UpdateTaskDto = exports.TaskLinkIdDto = exports.TaskIdDto = exports.GetTasksDto = exports.CreateTaskDto = exports.AddTaskLinkDto = exports.UpdateProjectDto = exports.ProjectIdDto = exports.GetProjectsDto = exports.CreateProjectDto = exports.UpdateLeadDto = exports.LeadIdDto = exports.GetLeadsDto = exports.CreateLeadDto = exports.ConvertLeadDto = exports.UpdateClientDto = exports.GetClientsDto = exports.CreateClientDto = exports.ClientIdDto = exports.SupportingFileNamesDto = exports.SupportingFileIdDto = exports.GetSupportingFilesDto = exports.UserIdDto = exports.UpdateUserDto = exports.UpdateMyProfileDto = exports.GetUsersQueryDto = exports.AddUserDto = void 0;
+exports.monthlyTotalMinor = exports.weekStartOf = exports.minutesBetween = exports.UpdateTimesheetEntryDto = exports.TimesheetIdDto = exports.TimesheetEntryIdDto = exports.ReviewTimesheetDto = exports.GetTimesheetsDto = exports.GetTimesheetReportDto = exports.CreateTimesheetEntryDto = exports.todayInJohannesburg = exports.shiftDays = exports.proRataDays = void 0;
 var client_1 = require("./client");
 Object.defineProperty(exports, "SupabaseClient", { enumerable: true, get: function () { return client_1.SupabaseClient; } });
 Object.defineProperty(exports, "createSupabaseClient", { enumerable: true, get: function () { return client_1.createSupabaseClient; } });
@@ -91,6 +91,7 @@ Object.defineProperty(exports, "UserIdDto", { enumerable: true, get: function ()
 var supporting_files_1 = require("./supporting-files");
 Object.defineProperty(exports, "GetSupportingFilesDto", { enumerable: true, get: function () { return supporting_files_1.GetSupportingFilesDto; } });
 Object.defineProperty(exports, "SupportingFileIdDto", { enumerable: true, get: function () { return supporting_files_1.SupportingFileIdDto; } });
+Object.defineProperty(exports, "SupportingFileNamesDto", { enumerable: true, get: function () { return supporting_files_1.SupportingFileNamesDto; } });
 var clients_1 = require("./clients");
 Object.defineProperty(exports, "ClientIdDto", { enumerable: true, get: function () { return clients_1.ClientIdDto; } });
 Object.defineProperty(exports, "CreateClientDto", { enumerable: true, get: function () { return clients_1.CreateClientDto; } });

package/dist/supporting-files/dto.d.ts

@@ -1,5 +1,7 @@
-import type { GetSupportingFilesDto as GetSupportingFilesDtoType, SupportingFileIdDto as SupportingFileIdDtoType } from '@managemint-solutions/entities/supporting-files/dto';
+import type { GetSupportingFilesDto as GetSupportingFilesDtoType, SupportingFileIdDto as SupportingFileIdDtoType, SupportingFileNamesDto as SupportingFileNamesDtoType } from '@managemint-solutions/entities/supporting-files/dto';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
+/** Files accepted in one upload. */
+export declare const MAX_FILES_PER_UPLOAD = 10;
 export declare class SupportingFileIdDto implements SupportingFileIdDtoType {
     readonly supportingFileId: string;
 }
@@ -7,3 +9,6 @@ export declare class GetSupportingFilesDto implements GetSupportingFilesDtoType
     readonly entity: SupportingFilesEntityTypes;
     readonly entityId: string;
 }
+export declare class SupportingFileNamesDto implements SupportingFileNamesDtoType {
+    readonly names: string[];
+}

package/dist/supporting-files/dto.js

@@ -9,12 +9,13 @@ var __metadata = (this && this.__metadata) || function (k, v) {
     if (typeof Reflect === "object" && typeof Reflect.metadata === "function") return Reflect.metadata(k, v);
 };
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.GetSupportingFilesDto = exports.SupportingFileIdDto = void 0;
+exports.SupportingFileNamesDto = exports.GetSupportingFilesDto = exports.SupportingFileIdDto = exports.MAX_FILES_PER_UPLOAD = void 0;
 const class_validator_1 = require("class-validator");
 const enum_1 = require("@managemint-solutions/entities/supporting-files/enum");
 // class-validator versions of the shared DTO types from @managemint-solutions/entities.
-// Each class `implements` its entities type so the wire contract cannot drift. There is no class
-// for the upload payload - it arrives as multipart and is not validated by class-validator.
+// Each class `implements` its entities type so the wire contract cannot drift.
+/** Files accepted in one upload. */
+exports.MAX_FILES_PER_UPLOAD = 10;
 class SupportingFileIdDto {
     supportingFileId;
 }
@@ -36,3 +37,17 @@ __decorate([
     (0, class_validator_1.IsUUID)('7', { message: 'Invalid entity ID format' }),
     __metadata("design:type", String)
 ], GetSupportingFilesDto.prototype, "entityId", void 0);
+class SupportingFileNamesDto {
+    // The names are the client's file names; the resource validates each one (characters,
+    // length, extension) when it builds the object key, which the decorators cannot.
+    names;
+}
+exports.SupportingFileNamesDto = SupportingFileNamesDto;
+__decorate([
+    (0, class_validator_1.IsArray)({ message: 'names must be an array' }),
+    (0, class_validator_1.ArrayMinSize)(1, { message: 'At least one file is required' }),
+    (0, class_validator_1.ArrayMaxSize)(exports.MAX_FILES_PER_UPLOAD, { message: `At most ${exports.MAX_FILES_PER_UPLOAD} files per upload` }),
+    (0, class_validator_1.IsString)({ each: true, message: 'Each file name must be a string' }),
+    (0, class_validator_1.IsNotEmpty)({ each: true, message: 'A file name cannot be empty' }),
+    __metadata("design:type", Array)
+], SupportingFileNamesDto.prototype, "names", void 0);

package/dist/supporting-files/index.d.ts

@@ -1,5 +1,4 @@
-import type { SupportingFileEntity, SupportingFilePresignedUrl } from '@managemint-solutions/entities/supporting-files';
-import type { UploadSupportingFilesDto } from '@managemint-solutions/entities/supporting-files/dto';
+import type { SupportingFileEntity, SupportingFilePresignedUrl, SupportingFileUploadTarget } from '@managemint-solutions/entities/supporting-files';
 import { SupportingFilesEntityTypes } from '@managemint-solutions/entities/supporting-files/enum';
 import type { AuthContext } from '../auth';
 import { type AuditResource } from '../audit';
@@ -12,7 +11,30 @@ export declare class SupportingFilesResource {
     private readonly table;
     constructor(supabase: TypedSupabaseClient, auth: AuthContext, audit: AuditResource);
     getPresignedUrl(supportingFileId: string): Promise<SupportingFilePresignedUrl>;
+    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    getParent(supportingFileId: string): Promise<{
+        entity_type: SupportingFilesEntityTypes;
+        entity_id: string;
+    }>;
     list(entity: SupportingFilesEntityTypes, entityId: string): Promise<SupportingFileEntity[]>;
-    upload(entity: SupportingFilesEntityTypes, entityId: string, input: UploadSupportingFilesDto): Promise<SupportingFileEntity[]>;
+    /**
+     * Where the caller puts each file: one signed upload URL per name, in request order, valid
+     * for two hours, into the organization's prefix. Storage checks the bucket's INSERT policy
+     * here, as the caller. An existing object of the same name is replaced - the latest version
+     * of a document wins.
+     */
+    createUploadUrls(entity: SupportingFilesEntityTypes, entityId: string, names: string[]): Promise<SupportingFileUploadTarget[]>;
+    /**
+     * Records the files the caller has put in the bucket. A name whose object is not there is
+     * refused, so no row ever points at nothing; a name already recorded keeps its row (its
+     * object was refreshed in place). Returns the record's whole list.
+     */
+    record(entity: SupportingFilesEntityTypes, entityId: string, names: string[]): Promise<SupportingFileEntity[]>;
     remove(supportingFileId: string): Promise<void>;
+    /**
+     * Each client name validated once, and the object key built from that same split - so what
+     * `createUploadUrls` mints, `record` checks and `getPresignedUrl` and `remove` rebuild later
+     * are one key. A converted lead takes no new files.
+     */
+    private prepare;
 }

package/dist/supporting-files/index.js

@@ -27,8 +27,14 @@ __exportStar(require("./paths"), exports);
 const BUCKET = 'supporting-files';
 /** How long a presigned download URL stays valid. */
 const SIGNED_URL_TTL_SECONDS = 300;
-/** Uploads run concurrently in batches of this size. */
-const UPLOAD_BATCH_SIZE = 5;
+/** Storage calls per file (minting an upload URL, checking an object) run concurrently in batches of this size. */
+const BATCH_SIZE = 5;
+/**
+ * The only extensions a supporting file may carry - what the portal offers. The bytes never
+ * pass through the api, so this check on the name is the type gate; the bucket's
+ * `file_size_limit` is the size gate.
+ */
+const ALLOWED_EXTENSIONS = new Set(Object.values(enum_1.SupportingFilesExtensions));
 /** The `name`/`extension` pair rendered back into the file name it was split from. */
 const fileNameOf = (file) => file.extension ? `${file.name}.${file.extension}` : file.name;
 // The public contract is the shared SupportingFileEntity from @managemint-solutions/entities; the
@@ -38,6 +44,10 @@ const fileNameOf = (file) => file.extension ? `${file.name}.${file.extension}` :
 // Object keys are `organizationId/entityType/entityId/file` - the organization leads so a storage
 // policy can scope by tenant. A data migration renames the pre-existing objects, which have no
 // organization segment, into that prefix.
+//
+// An upload is two calls: `createUploadUrls` hands the caller a signed upload URL per file, the
+// caller puts each file's bytes straight into the bucket, and `record` writes the rows for what
+// landed. The bytes never pass through here - a Vercel function body is capped at 4.5 MB.
 class SupportingFilesResource {
     supabase;
     auth;
@@ -66,6 +76,18 @@ class SupportingFilesResource {
             throw (0, errors_1.mapStorageError)(signedError);
         return { url: signed.signedUrl, ttl: SIGNED_URL_TTL_SECONDS };
     }
+    /** The record a file hangs off - what the api checks the caller can reach before a download or delete. */
+    async getParent(supportingFileId) {
+        const { data, error } = await this.supabase
+            .from('supporting_files')
+            .select('entity_type, entity_id')
+            .eq('mms_id', supportingFileId)
+            .eq('organization_id', this.auth.organization_id)
+            .single();
+        if (error)
+            throw (0, errors_1.mapPostgrestError)(error);
+        return data;
+    }
     async list(entity, entityId) {
         const { data, error } = await this.supabase
             .from('supporting_files')
@@ -78,9 +100,48 @@ class SupportingFilesResource {
             throw (0, errors_1.mapPostgrestError)(error);
         return data;
     }
-    async upload(entity, entityId, input) {
-        if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
-            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+    /**
+     * Where the caller puts each file: one signed upload URL per name, in request order, valid
+     * for two hours, into the organization's prefix. Storage checks the bucket's INSERT policy
+     * here, as the caller. An existing object of the same name is replaced - the latest version
+     * of a document wins.
+     */
+    async createUploadUrls(entity, entityId, names) {
+        const files = await this.prepare(entity, entityId, names);
+        const targets = [];
+        for (let index = 0; index < files.length; index += BATCH_SIZE) {
+            targets.push(...(await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
+                const { data, error } = await this.supabase.storage
+                    .from(BUCKET)
+                    .createSignedUploadUrl(path, { upsert: true });
+                if (error) {
+                    throw (0, errors_1.mapStorageError)(error, `Failed to prepare upload: ${fileNameOf({ name, extension })}`);
+                }
+                return { name, extension, url: data.signedUrl };
+            }))));
+        }
+        return targets;
+    }
+    /**
+     * Records the files the caller has put in the bucket. A name whose object is not there is
+     * refused, so no row ever points at nothing; a name already recorded keeps its row (its
+     * object was refreshed in place). Returns the record's whole list.
+     */
+    async record(entity, entityId, names) {
+        const files = await this.prepare(entity, entityId, names);
+        for (let index = 0; index < files.length; index += BATCH_SIZE) {
+            await Promise.all(files.slice(index, index + BATCH_SIZE).map(async ({ name, extension, path }) => {
+                // A missing object comes back as `data: false` (storage-js keeps the 404 in `error`);
+                // any other failure is thrown by storage-js itself.
+                const { data: present } = await this.supabase.storage.from(BUCKET).exists(path);
+                if (!present) {
+                    throw new errors_1.SupabaseClientError({
+                        status: 400,
+                        error: 'Storage Error',
+                        message: `File was not uploaded: ${fileNameOf({ name, extension })}`,
+                    });
+                }
+            }));
         }
         const { data: existing, error: existingError } = await this.supabase
             .from('supporting_files')
@@ -91,26 +152,7 @@ class SupportingFilesResource {
         if (existingError)
             throw (0, errors_1.mapPostgrestError)(existingError);
         const existingFileNames = existing.map(fileNameOf);
-        // Each client name is validated once here, and the object key, the duplicate check and the
-        // row are all built from that same split - so what is stored is what presign and remove
-        // rebuild later.
-        const uploads = input.files.map((file) => ({
-            file,
-            ...(0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(file.name)),
-        }));
-        // Every file is written to the bucket, duplicates included - an upsert refreshes the object.
-        for (let index = 0; index < uploads.length; index += UPLOAD_BATCH_SIZE) {
-            await Promise.all(uploads.slice(index, index + UPLOAD_BATCH_SIZE).map(async ({ file, name, extension }) => {
-                const { error } = await this.supabase.storage
-                    .from(BUCKET)
-                    .upload((0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension), file, { cacheControl: '3600', upsert: true });
-                if (error) {
-                    throw (0, errors_1.mapStorageError)(error, `Failed to upload file: ${fileNameOf({ name, extension })}`);
-                }
-            }));
-        }
-        // Only files without an existing row get one - the rest were refreshed in place above.
-        const newFiles = uploads.filter((file) => !existingFileNames.includes(fileNameOf(file)));
+        const newFiles = files.filter((file) => !existingFileNames.includes(fileNameOf(file)));
         if (newFiles.length > 0) {
             await this.table.insertMany(newFiles.map(({ name, extension }) => ({
                 name,
@@ -140,5 +182,30 @@ class SupportingFilesResource {
             throw (0, errors_1.mapStorageError)(storageError, `Failed to delete file: ${fileName}`);
         }
     }
+    /**
+     * Each client name validated once, and the object key built from that same split - so what
+     * `createUploadUrls` mints, `record` checks and `getPresignedUrl` and `remove` rebuild later
+     * are one key. A converted lead takes no new files.
+     */
+    async prepare(entity, entityId, names) {
+        if (entity === enum_1.SupportingFilesEntityTypes.LEAD) {
+            await (0, won_1.refuseWonLead)(this.supabase, this.auth.organization_id, entityId);
+        }
+        return names.map((fileName) => {
+            const { name, extension } = (0, paths_1.splitFileName)((0, paths_1.sanitizeFileName)(fileName));
+            if (!ALLOWED_EXTENSIONS.has(extension.toLowerCase())) {
+                throw new errors_1.SupabaseClientError({
+                    status: 400,
+                    error: 'Storage Error',
+                    message: `Unsupported file type: ${fileNameOf({ name, extension })}`,
+                });
+            }
+            return {
+                name,
+                extension: extension,
+                path: (0, paths_1.storagePath)(this.auth.organization_id, entity, entityId, name, extension),
+            };
+        });
+    }
 }
 exports.SupportingFilesResource = SupportingFilesResource;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managemint-solutions/sdk",
-  "version": "0.50.0",
+  "version": "0.52.0",
   "description": "Typed Supabase data-access SDK for ManageMint Solutions",
   "license": "UNLICENSED",
   "author": "Scott Bebington <scottbebington@gmail.com>",
@@ -51,7 +51,7 @@
     "testEnvironment": "node"
   },
   "dependencies": {
-    "@managemint-solutions/entities": "^1.33.0"
+    "@managemint-solutions/entities": "^1.34.0"
   },
   "peerDependencies": {
     "@nestjs/common": "^11.0.0",