@naisys/erp 3.0.0-beta.3

package/dist/routes/admin.js

@@ -0,0 +1,147 @@
+import { createReadStream, existsSync, statSync } from "node:fs";
+import fs from "node:fs/promises";
+import { AdminAttachmentListRequestSchema, AdminAttachmentListResponseSchema, AdminInfoResponseSchema, ErrorResponseSchema, ServerLogRequestSchema, ServerLogResponseSchema, } from "@naisys/erp-shared";
+import { z } from "zod/v4";
+import { hasPermission, requirePermission } from "../auth-middleware.js";
+import { erpDbPath } from "../dbConfig.js";
+import erpDb from "../erpDb.js";
+import { notFound } from "../error-handler.js";
+import { paginationLinks } from "../hateoas.js";
+import { getErpLogPath, tailLogFile } from "../services/log-file-service.js";
+const API_PREFIX = "/api/erp";
+function adminActions(hasAdminPermission) {
+    const actions = [];
+    if (hasAdminPermission) {
+        actions.push({
+            rel: "view-logs",
+            href: `${API_PREFIX}/admin/logs`,
+            method: "GET",
+            title: "View Logs",
+        });
+        actions.push({
+            rel: "view-attachments",
+            href: `${API_PREFIX}/admin/attachments`,
+            method: "GET",
+            title: "View Attachments",
+        });
+    }
+    return actions;
+}
+export default function adminRoutes(fastify, _options) {
+    // GET / — Admin info
+    fastify.get("/", {
+        preHandler: [requirePermission("erp_admin")],
+        schema: {
+            description: "Get ERP admin system info",
+            tags: ["Admin"],
+            response: {
+                200: AdminInfoResponseSchema,
+                500: ErrorResponseSchema,
+            },
+            security: [{ cookieAuth: [] }],
+        },
+    }, async (request, _reply) => {
+        const hasAdminPerm = hasPermission(request.erpUser, "erp_admin");
+        const actions = adminActions(hasAdminPerm);
+        const dbPath = erpDbPath();
+        const erpDbSize = await fs
+            .stat(dbPath)
+            .then((s) => s.size)
+            .catch(() => undefined);
+        return {
+            erpDbPath: dbPath,
+            erpDbSize,
+            _actions: actions.length > 0 ? actions : undefined,
+        };
+    });
+    // GET /logs — Tail ERP log file
+    fastify.get("/logs", {
+        preHandler: [requirePermission("erp_admin")],
+        schema: {
+            description: "Get tail of the ERP server log file",
+            tags: ["Admin"],
+            querystring: ServerLogRequestSchema,
+            response: {
+                200: ServerLogResponseSchema,
+                500: ErrorResponseSchema,
+            },
+            security: [{ cookieAuth: [] }],
+        },
+    }, async (request, _reply) => {
+        const { lines, minLevel } = request.query;
+        const cappedLines = Math.min(lines, 1000);
+        const filePath = getErpLogPath();
+        const { entries, fileSize } = await tailLogFile(filePath, cappedLines, minLevel);
+        return {
+            entries,
+            fileName: "erp.log",
+            fileSize,
+        };
+    });
+    // GET /attachments — List all attachments
+    fastify.get("/attachments", {
+        preHandler: [requirePermission("erp_admin")],
+        schema: {
+            description: "List all uploaded attachments",
+            tags: ["Admin"],
+            querystring: AdminAttachmentListRequestSchema,
+            response: {
+                200: AdminAttachmentListResponseSchema,
+                500: ErrorResponseSchema,
+            },
+            security: [{ cookieAuth: [] }],
+        },
+    }, async (request, _reply) => {
+        const { page, pageSize } = request.query;
+        const skip = (page - 1) * pageSize;
+        const [rows, total] = await Promise.all([
+            erpDb.attachment.findMany({
+                orderBy: { createdAt: "desc" },
+                include: {
+                    uploadedBy: { select: { username: true } },
+                },
+                skip,
+                take: pageSize,
+            }),
+            erpDb.attachment.count(),
+        ]);
+        return {
+            attachments: rows.map((r) => ({
+                id: r.publicId,
+                filename: r.filename,
+                fileSize: r.fileSize,
+                fileHash: r.fileHash,
+                uploadedBy: r.uploadedBy.username,
+                createdAt: r.createdAt.toISOString(),
+            })),
+            total,
+            page,
+            pageSize,
+            _links: paginationLinks("admin/attachments", page, pageSize, total),
+        };
+    });
+    // GET /attachments/:id — Download an attachment by ID
+    fastify.get("/attachments/:id", {
+        preHandler: [requirePermission("erp_admin")],
+        schema: {
+            description: "Download an attachment file by ID",
+            tags: ["Admin"],
+            params: z.object({ id: z.string() }),
+        },
+    }, async (request, reply) => {
+        const att = await erpDb.attachment.findUnique({
+            where: { publicId: request.params.id },
+            select: { filepath: true, filename: true, fileSize: true },
+        });
+        if (!att)
+            return notFound(reply, "Attachment not found");
+        if (!existsSync(att.filepath))
+            return notFound(reply, "Attachment file missing from disk");
+        const stat = statSync(att.filepath);
+        reply.header("content-type", "application/octet-stream");
+        reply.header("content-disposition", `attachment; filename="${att.filename.replace(/"/g, '\\"')}"`);
+        reply.header("content-length", stat.size);
+        return reply.send(createReadStream(att.filepath));
+    });
+}
+//# sourceMappingURL=admin.js.map

package/dist/routes/audit.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function auditRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=audit.d.ts.map

package/dist/routes/audit.js

@@ -0,0 +1,36 @@
+import { AuditListResponseSchema, AuditQuerySchema } from "@naisys/erp-shared";
+import erpDb from "../erpDb.js";
+export default function auditRoutes(fastify) {
+    const app = fastify.withTypeProvider();
+    app.get("/", {
+        schema: {
+            description: "Get audit log entries for a given entity",
+            tags: ["Audit"],
+            querystring: AuditQuerySchema,
+            response: {
+                200: AuditListResponseSchema,
+            },
+        },
+        handler: async (request) => {
+            const { entityType, entityId } = request.query;
+            const items = await erpDb.auditLog.findMany({
+                where: { entityType, entityId },
+                orderBy: { createdAt: "desc" },
+            });
+            return {
+                items: items.map((item) => ({
+                    id: item.id,
+                    entityType: item.entityType,
+                    entityId: item.entityId,
+                    action: item.action,
+                    field: item.field,
+                    oldValue: item.oldValue,
+                    newValue: item.newValue,
+                    userId: item.userId,
+                    createdAt: item.createdAt.toISOString(),
+                })),
+            };
+        },
+    });
+}
+//# sourceMappingURL=audit.js.map

package/dist/routes/auth.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function authRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=auth.d.ts.map

package/dist/routes/auth.js

@@ -0,0 +1,112 @@
+import { hashToken, SESSION_COOKIE_NAME, sessionCookieOptions, } from "@naisys/common-node";
+import { authenticateAndCreateSession, deleteSession, } from "@naisys/supervisor-database";
+import { AuthUserSchema, ErrorResponseSchema, LoginRequestSchema, LoginResponseSchema, } from "@naisys/erp-shared";
+import bcrypt from "bcryptjs";
+import { randomUUID } from "crypto";
+import { authCache } from "../auth-middleware.js";
+import erpDb from "../erpDb.js";
+import { unauthorized } from "../error-handler.js";
+import { isSupervisorAuth } from "../supervisorAuth.js";
+const SESSION_DURATION_MS = 30 * 24 * 60 * 60 * 1000; // 30 days
+export default function authRoutes(fastify) {
+    const app = fastify.withTypeProvider();
+    // LOGIN
+    app.post("/login", {
+        config: {
+            rateLimit: {
+                max: 5,
+                timeWindow: "1 minute",
+            },
+        },
+        schema: {
+            description: "Authenticate with username and password",
+            tags: ["Auth"],
+            body: LoginRequestSchema,
+            response: {
+                200: LoginResponseSchema,
+                401: ErrorResponseSchema,
+                429: ErrorResponseSchema,
+            },
+        },
+        handler: async (request, reply) => {
+            const { username, password } = request.body;
+            // SSO mode: authenticate against supervisor DB
+            if (isSupervisorAuth()) {
+                const authResult = await authenticateAndCreateSession(username, password);
+                if (!authResult) {
+                    return unauthorized(reply, "Invalid username or password");
+                }
+                const ssoData = {
+                    username,
+                    passwordHash: authResult.user.passwordHash,
+                };
+                const user = await erpDb.user.upsert({
+                    where: { uuid: authResult.user.uuid },
+                    create: { uuid: authResult.user.uuid, ...ssoData },
+                    update: ssoData,
+                });
+                reply.setCookie(SESSION_COOKIE_NAME, authResult.token, sessionCookieOptions(authResult.expiresAt));
+                return { user: { id: user.id, username: user.username } };
+            }
+            // Standalone mode: authenticate against local DB
+            const user = await erpDb.user.findUnique({ where: { username } });
+            if (!user) {
+                return unauthorized(reply, "Invalid username or password");
+            }
+            const valid = await bcrypt.compare(password, user.passwordHash);
+            if (!valid) {
+                return unauthorized(reply, "Invalid username or password");
+            }
+            const token = randomUUID();
+            const tokenHash = hashToken(token);
+            const expiresAt = new Date(Date.now() + SESSION_DURATION_MS);
+            await erpDb.session.create({
+                data: { userId: user.id, tokenHash, expiresAt },
+            });
+            reply.setCookie(SESSION_COOKIE_NAME, token, sessionCookieOptions(expiresAt));
+            return { user: { id: user.id, username: user.username } };
+        },
+    });
+    // LOGOUT
+    app.post("/logout", {
+        schema: {
+            description: "Log out and clear session",
+            tags: ["Auth"],
+        },
+        handler: async (request, reply) => {
+            const token = request.cookies?.[SESSION_COOKIE_NAME];
+            if (token) {
+                const tokenHash = hashToken(token);
+                authCache.invalidate(`cookie:${tokenHash}`);
+                // Delete from local ERP sessions
+                await erpDb.session.deleteMany({ where: { tokenHash } });
+                // Also delete from supervisor sessions (SSO mode)
+                await deleteSession(tokenHash);
+            }
+            reply.clearCookie(SESSION_COOKIE_NAME, { path: "/" });
+            return { ok: true };
+        },
+    });
+    // ME
+    app.get("/me", {
+        schema: {
+            description: "Get current authenticated user",
+            tags: ["Auth"],
+            response: {
+                200: AuthUserSchema,
+                401: ErrorResponseSchema,
+            },
+        },
+        handler: async (request, reply) => {
+            if (!request.erpUser) {
+                return unauthorized(reply, "Not authenticated");
+            }
+            return {
+                id: request.erpUser.id,
+                username: request.erpUser.username,
+                permissions: request.erpUser.permissions,
+            };
+        },
+    });
+}
+//# sourceMappingURL=auth.js.map

package/dist/routes/dispatch.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function dispatchRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=dispatch.d.ts.map

package/dist/routes/dispatch.js

@@ -0,0 +1,174 @@
+import { DispatchListQuerySchema, DispatchListResponseSchema, OperationRunStatus, OrderRunStatus, } from "@naisys/erp-shared";
+import erpDb from "../erpDb.js";
+import { API_PREFIX, paginationLinks } from "../hateoas.js";
+import { getUserWorkCenterIds } from "../services/work-center-service.js";
+const OPEN_ORDER_STATUSES = [OrderRunStatus.released, OrderRunStatus.started];
+const DEFAULT_OP_STATUSES = [
+    OperationRunStatus.pending,
+    OperationRunStatus.in_progress,
+    OperationRunStatus.failed,
+];
+export default function dispatchRoutes(fastify) {
+    const app = fastify.withTypeProvider();
+    app.get("/", {
+        schema: {
+            description: "List operation runs across open orders (dispatch view)",
+            tags: ["Dispatch"],
+            querystring: DispatchListQuerySchema,
+            response: {
+                200: DispatchListResponseSchema,
+            },
+        },
+        handler: async (request) => {
+            const { page, pageSize, status, priority, search, viewAs, canWork, clockedIn, } = request.query;
+            // Resolve the perspective user for canWork computation
+            let perspectiveUserId = request.erpUser?.id;
+            let perspectivePerms = new Set(request.erpUser?.permissions ?? []);
+            if (viewAs) {
+                const viewAsUser = await erpDb.user.findUnique({
+                    where: { username: viewAs },
+                    select: {
+                        id: true,
+                        permissions: { select: { permission: true } },
+                    },
+                });
+                if (viewAsUser) {
+                    perspectiveUserId = viewAsUser.id;
+                    perspectivePerms = new Set(viewAsUser.permissions.map((p) => p.permission));
+                }
+            }
+            const isExecutor = perspectivePerms.has("order_executor");
+            const isManager = perspectivePerms.has("order_manager");
+            // Pre-fetch perspective user's work center IDs for canWork computation + filtering
+            const userWcIds = perspectiveUserId
+                ? await getUserWorkCenterIds(perspectiveUserId)
+                : [];
+            const userWcIdSet = new Set(userWcIds);
+            const where = {
+                status: { in: status ? [status] : DEFAULT_OP_STATUSES },
+                orderRun: {
+                    status: { in: OPEN_ORDER_STATUSES },
+                    ...(priority ? { priority } : {}),
+                },
+            };
+            // canWork filter: only show ops where the perspective user can work
+            if (canWork) {
+                // Restrict to statuses the user has permission for
+                const workableStatuses = [];
+                if (isExecutor) {
+                    workableStatuses.push(OperationRunStatus.pending, OperationRunStatus.in_progress);
+                }
+                if (isManager) {
+                    workableStatuses.push(OperationRunStatus.failed);
+                }
+                // Intersect with the requested status filter
+                const currentStatuses = status ? [status] : DEFAULT_OP_STATUSES;
+                const filteredStatuses = currentStatuses.filter((s) => workableStatuses.includes(s));
+                where.status = {
+                    in: filteredStatuses.length > 0 ? filteredStatuses : ["__none__"],
+                };
+                // Work center access
+                if (userWcIds.length > 0) {
+                    where.operation = {
+                        OR: [{ workCenterId: null }, { workCenterId: { in: userWcIds } }],
+                    };
+                }
+            }
+            if (search) {
+                where.OR = [
+                    { operation: { title: { contains: search } } },
+                    { assignedTo: { username: { contains: search } } },
+                    { orderRun: { order: { key: { contains: search } } } },
+                ];
+            }
+            if (clockedIn) {
+                where.laborTickets = { some: { clockOut: null } };
+            }
+            const [items, total] = await Promise.all([
+                erpDb.operationRun.findMany({
+                    where,
+                    include: {
+                        operation: {
+                            select: {
+                                seqNo: true,
+                                title: true,
+                                workCenter: { select: { key: true, id: true } },
+                            },
+                        },
+                        assignedTo: { select: { username: true } },
+                        orderRun: {
+                            select: {
+                                runNo: true,
+                                priority: true,
+                                dueAt: true,
+                                order: { select: { key: true } },
+                                orderRev: { select: { revNo: true } },
+                            },
+                        },
+                    },
+                    skip: (page - 1) * pageSize,
+                    take: pageSize,
+                    orderBy: { orderRun: { dueAt: "asc" } },
+                }),
+                erpDb.operationRun.count({ where }),
+            ]);
+            return {
+                items: items.map((opRun) => {
+                    const wcId = opRun.operation.workCenter?.id ?? null;
+                    const hasWcAccess = wcId === null || userWcIdSet.has(wcId);
+                    // canWork: work center access + permission for the op status
+                    const hasStatusPerm = opRun.status === OperationRunStatus.failed ? isManager : isExecutor;
+                    const itemCanWork = hasWcAccess && hasStatusPerm;
+                    return {
+                        id: opRun.id,
+                        orderKey: opRun.orderRun.order.key,
+                        revNo: opRun.orderRun.orderRev.revNo,
+                        runNo: opRun.orderRun.runNo,
+                        seqNo: opRun.operation.seqNo,
+                        title: opRun.operation.title,
+                        workCenterKey: opRun.operation.workCenter?.key ?? null,
+                        canWork: itemCanWork,
+                        status: opRun.status,
+                        priority: opRun.orderRun.priority,
+                        assignedTo: opRun.assignedTo?.username ?? null,
+                        dueAt: opRun.orderRun.dueAt,
+                        createdAt: opRun.createdAt.toISOString(),
+                    };
+                }),
+                total,
+                page,
+                pageSize,
+                _links: [
+                    ...paginationLinks("dispatch", page, pageSize, total, {
+                        status,
+                        priority,
+                        search,
+                        viewAs,
+                        canWork: canWork ? "true" : undefined,
+                        clockedIn: clockedIn ? "true" : undefined,
+                    }),
+                    {
+                        rel: "work-centers",
+                        href: `${API_PREFIX}/work-centers`,
+                        title: "Work Centers",
+                    },
+                ],
+                _linkTemplates: [
+                    {
+                        rel: "item",
+                        hrefTemplate: `${API_PREFIX}/orders/{orderKey}/runs/{runNo}/ops/{seqNo}`,
+                    },
+                ],
+                _actionTemplates: [
+                    {
+                        rel: "viewOperationRun",
+                        hrefTemplate: `${API_PREFIX}/orders/{orderKey}/runs/{runNo}/ops/{seqNo}`,
+                        method: "GET",
+                        title: "View Operation Run",
+                    },
+                ],
+            };
+        },
+    });
+}
+//# sourceMappingURL=dispatch.js.map

package/dist/routes/inventory.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function inventoryRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=inventory.d.ts.map

package/dist/routes/inventory.js

@@ -0,0 +1,70 @@
+import { InventoryListQuerySchema, InventoryListResponseSchema, } from "@naisys/erp-shared";
+import erpDb from "../erpDb.js";
+import { API_PREFIX, paginationLinks } from "../hateoas.js";
+export default function inventoryRoutes(fastify) {
+    const app = fastify.withTypeProvider();
+    app.get("/", {
+        schema: {
+            description: "List all item instances across all items (inventory view)",
+            tags: ["Inventory"],
+            querystring: InventoryListQuerySchema,
+            response: {
+                200: InventoryListResponseSchema,
+            },
+        },
+        handler: async (request) => {
+            const { page, pageSize, search } = request.query;
+            const where = {};
+            if (search) {
+                where.OR = [
+                    { key: { contains: search } },
+                    { item: { key: { contains: search } } },
+                ];
+            }
+            const [instances, total] = await Promise.all([
+                erpDb.itemInstance.findMany({
+                    where,
+                    include: {
+                        item: { select: { key: true } },
+                        orderRun: {
+                            select: {
+                                runNo: true,
+                                order: { select: { key: true } },
+                            },
+                        },
+                    },
+                    skip: (page - 1) * pageSize,
+                    take: pageSize,
+                    orderBy: { createdAt: "desc" },
+                }),
+                erpDb.itemInstance.count({ where }),
+            ]);
+            return {
+                items: instances.map((inst) => ({
+                    id: inst.id,
+                    itemKey: inst.item.key,
+                    key: inst.key,
+                    quantity: inst.quantity,
+                    orderKey: inst.orderRun?.order.key ?? null,
+                    orderRunNo: inst.orderRun?.runNo ?? null,
+                    createdAt: inst.createdAt.toISOString(),
+                })),
+                total,
+                page,
+                pageSize,
+                _links: paginationLinks("inventory", page, pageSize, total, {
+                    search,
+                }),
+                _actionTemplates: [
+                    {
+                        rel: "viewInstance",
+                        hrefTemplate: `${API_PREFIX}/items/{itemKey}/instances/{id}`,
+                        method: "GET",
+                        title: "View Instance",
+                    },
+                ],
+            };
+        },
+    });
+}
+//# sourceMappingURL=inventory.js.map

package/dist/routes/item-fields.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function itemFieldRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=item-fields.d.ts.map