@naisys/erp 3.0.0-beta.3

package/dist/routes/root.js

@@ -0,0 +1,123 @@
+import { hasPermission } from "../auth-middleware.js";
+export default function rootRoute(fastify) {
+    fastify.get("/", {
+        schema: {
+            description: "API discovery root - lists all available resources and actions",
+            tags: ["Discovery"],
+        },
+        handler: (request) => {
+            const publicRead = process.env.PUBLIC_READ === "true";
+            const base = {
+                name: "NAISYS ERP API",
+                version: "1.0.0",
+                description: "AI-first ERP system",
+            };
+            const readLinks = [
+                {
+                    rel: "orders",
+                    href: "/api/erp/orders",
+                    title: "Orders",
+                    method: "GET",
+                },
+                {
+                    rel: "items",
+                    href: "/api/erp/items",
+                    title: "Items",
+                    method: "GET",
+                },
+                {
+                    rel: "dispatch",
+                    href: "/api/erp/dispatch",
+                    title: "Dispatch (open order runs)",
+                    method: "GET",
+                },
+                {
+                    rel: "schemas",
+                    href: "/api/erp/schemas/",
+                    title: "Schema Catalog",
+                },
+                {
+                    rel: "api-reference",
+                    href: "/erp/api-reference",
+                    title: "Interactive API Reference (Scalar)",
+                },
+            ];
+            if (request.erpUser) {
+                const authLinks = [
+                    {
+                        rel: "self",
+                        href: "/api/erp/",
+                        title: "API Root",
+                    },
+                    {
+                        rel: "me",
+                        href: "/api/erp/auth/me",
+                        title: "Current User",
+                    },
+                    ...readLinks,
+                ];
+                authLinks.push({
+                    rel: "work-centers",
+                    href: "/api/erp/work-centers",
+                    title: "Work Centers",
+                    method: "GET",
+                });
+                if (hasPermission(request.erpUser, "erp_admin")) {
+                    authLinks.push({
+                        rel: "users",
+                        href: "/api/erp/users",
+                        title: "Users",
+                        method: "GET",
+                    }, {
+                        rel: "admin",
+                        href: "/api/erp/admin",
+                        title: "Admin",
+                        method: "GET",
+                    });
+                }
+                return {
+                    ...base,
+                    _links: authLinks,
+                    _actions: [
+                        {
+                            rel: "logout",
+                            href: "/api/erp/auth/logout",
+                            method: "POST",
+                            title: "Logout",
+                        },
+                    ],
+                };
+            }
+            return {
+                ...base,
+                _links: [
+                    {
+                        rel: "self",
+                        href: "/api/erp/",
+                        title: "API Root",
+                    },
+                    ...(publicRead
+                        ? readLinks
+                        : [
+                            {
+                                rel: "schemas",
+                                href: "/api/erp/schemas/",
+                                title: "Schema Catalog",
+                            },
+                        ]),
+                ],
+                _actions: [
+                    {
+                        rel: "login",
+                        href: "/api/erp/auth/login",
+                        method: "POST",
+                        title: "Login",
+                        schema: "/api/erp/schemas/LoginRequest",
+                        body: { username: "", password: "" },
+                    },
+                ],
+            };
+        },
+    });
+}
+//# sourceMappingURL=root.js.map

package/dist/routes/schemas.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function schemaRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=schemas.d.ts.map

package/dist/routes/schemas.js

@@ -0,0 +1,31 @@
+import { z } from "zod/v4";
+import { schemaRegistry } from "../schema-registry.js";
+export default function schemaRoutes(fastify) {
+    // List all available schema names
+    fastify.get("/", {
+        schema: {
+            description: "List all available schema names",
+            tags: ["Discovery"],
+        },
+        handler: () => {
+            return { schemas: Object.keys(schemaRegistry) };
+        },
+    });
+    // Get a single schema by name
+    fastify.get("/:schemaName", {
+        schema: {
+            description: "Get a JSON Schema by name",
+            tags: ["Discovery"],
+        },
+        handler: (request, reply) => {
+            const { schemaName } = request.params;
+            const zodSchema = schemaRegistry[schemaName];
+            if (!zodSchema) {
+                reply.code(404);
+                return { error: "Schema not found", schemaName };
+            }
+            return z.toJSONSchema(zodSchema);
+        },
+    });
+}
+//# sourceMappingURL=schemas.js.map

package/dist/routes/step-field-attachments.d.ts

@@ -0,0 +1,3 @@
+import type { FastifyInstance } from "fastify";
+export default function stepFieldAttachmentRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=step-field-attachments.d.ts.map

package/dist/routes/step-field-attachments.js

@@ -0,0 +1,231 @@
+import { mimeFromFilename } from "@naisys/common";
+import { ErrorResponseSchema, UploadAttachmentResponseSchema, } from "@naisys/erp-shared";
+import { createReadStream, existsSync, statSync } from "fs";
+import { z } from "zod/v4";
+import { requirePermission } from "../auth-middleware.js";
+import erpDb from "../erpDb.js";
+import { conflict, notFound } from "../error-handler.js";
+import { checkOpRunInProgress, checkOrderRunStarted, checkWorkCenterAccess, resolveStepRun, } from "../route-helpers.js";
+import { deleteFieldAttachment, getAttachmentFilePath, uploadAttachment, } from "../services/attachment-service.js";
+import { ensureStepRunFieldRecord } from "../services/field-service.js";
+import { findStepRunWithField, rebuildAttachmentFieldValue, upsertFieldValue, } from "../services/field-value-service.js";
+import { isUserClockedIn } from "../services/labor-ticket-service.js";
+const FieldSeqNoParamsSchema = z.object({
+    orderKey: z.string(),
+    runNo: z.coerce.number().int(),
+    seqNo: z.coerce.number().int(),
+    stepSeqNo: z.coerce.number().int(),
+    setIndex: z.coerce.number().int().optional(),
+    fieldSeqNo: z.coerce.number().int(),
+});
+const AttachmentIdParamsSchema = z.object({
+    orderKey: z.string(),
+    runNo: z.coerce.number().int(),
+    seqNo: z.coerce.number().int(),
+    stepSeqNo: z.coerce.number().int(),
+    setIndex: z.coerce.number().int().optional(),
+    fieldSeqNo: z.coerce.number().int(),
+    attachmentId: z.string(),
+});
+export default function stepFieldAttachmentRoutes(fastify) {
+    const app = fastify.withTypeProvider();
+    // UPLOAD attachment for a field value
+    app.post("/", {
+        schema: {
+            description: "Upload a file attachment for an attachment-type field (multipart/form-data)",
+            tags: ["Attachments"],
+            params: FieldSeqNoParamsSchema,
+            // No body schema — multipart parsed manually
+            response: {
+                200: UploadAttachmentResponseSchema,
+                400: ErrorResponseSchema,
+                404: ErrorResponseSchema,
+                409: ErrorResponseSchema,
+            },
+        },
+        preHandler: requirePermission("order_executor"),
+        handler: async (request, reply) => {
+            const { orderKey, runNo, seqNo, stepSeqNo, fieldSeqNo } = request.params;
+            const userId = request.erpUser.id;
+            const resolved = await resolveStepRun(orderKey, runNo, seqNo, stepSeqNo);
+            if (!resolved) {
+                return notFound(reply, `Step run not found`);
+            }
+            const wcErr = await checkWorkCenterAccess(resolved.opRun.operationId, request.erpUser);
+            if (wcErr)
+                return conflict(reply, wcErr);
+            const orderErr = checkOrderRunStarted(resolved.run.status);
+            if (orderErr)
+                return conflict(reply, orderErr);
+            const opErr = checkOpRunInProgress(resolved.opRun.status);
+            if (opErr)
+                return conflict(reply, opErr);
+            const clockedIn = await isUserClockedIn(resolved.opRun.id, userId);
+            if (!clockedIn)
+                return conflict(reply, `You must be clocked in to upload attachments`);
+            const stepRun = await findStepRunWithField(resolved.stepRun.id, resolved.opRun.id, fieldSeqNo);
+            if (!stepRun)
+                return notFound(reply, `Step run not found`);
+            if (stepRun.completed) {
+                return conflict(reply, `Cannot upload: step run is completed`);
+            }
+            const field = stepRun.step.fieldSet?.fields[0];
+            if (!field) {
+                return notFound(reply, `Step field not found`);
+            }
+            if (field.type !== "attachment") {
+                return reply.code(400).send({
+                    statusCode: 400,
+                    error: "Bad Request",
+                    message: "Field is not an attachment type",
+                });
+            }
+            // Parse multipart — expect a single file field named "file"
+            const data = await request.file();
+            if (!data) {
+                return reply.code(400).send({
+                    statusCode: 400,
+                    error: "Bad Request",
+                    message: "No file uploaded",
+                });
+            }
+            const fileBuffer = await data.toBuffer();
+            const filename = data.filename || "unnamed_file";
+            // setIndex comes from URL params (via /sets/:setIndex/ path), default 0
+            const setIndex = request.params.setIndex ?? 0;
+            const fieldRecordId = await ensureStepRunFieldRecord(resolved.stepRun.id, userId);
+            if (!fieldRecordId) {
+                return notFound(reply, "Step has no field set");
+            }
+            // For non-isArray fields, reject if an attachment already exists
+            if (!field.isArray) {
+                const existing = await erpDb.fieldValue.findUnique({
+                    where: {
+                        fieldRecordId_fieldId_setIndex: {
+                            fieldRecordId,
+                            fieldId: field.id,
+                            setIndex,
+                        },
+                    },
+                    select: { _count: { select: { fieldAttachments: true } } },
+                });
+                if (existing && existing._count.fieldAttachments > 0) {
+                    return reply.code(400).send({
+                        statusCode: 400,
+                        error: "Bad Request",
+                        message: "Field already has an attachment. Delete the existing attachment before uploading a new one, or enable multi-value on the field.",
+                    });
+                }
+            }
+            // Ensure a FieldValue row exists for this field+set
+            await upsertFieldValue(fieldRecordId, field.id, setIndex, "", userId);
+            // Find the field value ID
+            const fieldValueRow = await erpDb.fieldValue.findUnique({
+                where: {
+                    fieldRecordId_fieldId_setIndex: {
+                        fieldRecordId,
+                        fieldId: field.id,
+                        setIndex,
+                    },
+                },
+                select: { id: true },
+            });
+            if (!fieldValueRow) {
+                return notFound(reply, `Step field value not found`);
+            }
+            const result = await uploadAttachment(fileBuffer, filename, userId, fieldValueRow.id);
+            // Auto-set the field value to reflect all current attachments
+            await rebuildAttachmentFieldValue(fieldRecordId, field.id, setIndex, field.isArray, userId);
+            return {
+                attachmentId: result.attachmentId,
+                filename: result.filename,
+                fileSize: result.fileSize,
+            };
+        },
+    });
+    // DOWNLOAD attachment
+    fastify.get("/:attachmentId", {
+        schema: {
+            description: "Download an attachment file",
+            tags: ["Attachments"],
+            params: AttachmentIdParamsSchema,
+        },
+    }, async (request, reply) => {
+        const att = await getAttachmentFilePath(request.params.attachmentId);
+        if (!att) {
+            return notFound(reply, `Attachment not found`);
+        }
+        if (!existsSync(att.filepath)) {
+            return notFound(reply, `Attachment file missing from disk`);
+        }
+        const stat = statSync(att.filepath);
+        const mimeType = mimeFromFilename(att.filename);
+        const isImage = mimeType.startsWith("image/");
+        reply.header("content-type", mimeType);
+        reply.header("content-disposition", `${isImage ? "inline" : "attachment"}; filename="${att.filename.replace(/"/g, '\\"')}"`);
+        reply.header("content-length", stat.size);
+        return reply.send(createReadStream(att.filepath));
+    });
+    // DELETE attachment from a field value
+    app.delete("/:attachmentId", {
+        schema: {
+            description: "Delete an attachment from a field (also updates the field value)",
+            tags: ["Attachments"],
+            params: AttachmentIdParamsSchema,
+            response: {
+                200: z.object({ deleted: z.literal(true) }),
+                404: ErrorResponseSchema,
+                409: ErrorResponseSchema,
+            },
+        },
+        preHandler: requirePermission("order_executor"),
+        handler: async (request, reply) => {
+            const { orderKey, runNo, seqNo, stepSeqNo, fieldSeqNo, attachmentId } = request.params;
+            const userId = request.erpUser.id;
+            const resolved = await resolveStepRun(orderKey, runNo, seqNo, stepSeqNo);
+            if (!resolved)
+                return notFound(reply, "Step run not found");
+            const wcErr = await checkWorkCenterAccess(resolved.opRun.operationId, request.erpUser);
+            if (wcErr)
+                return conflict(reply, wcErr);
+            const orderErr = checkOrderRunStarted(resolved.run.status);
+            if (orderErr)
+                return conflict(reply, orderErr);
+            const opErr = checkOpRunInProgress(resolved.opRun.status);
+            if (opErr)
+                return conflict(reply, opErr);
+            const clockedIn = await isUserClockedIn(resolved.opRun.id, userId);
+            if (!clockedIn)
+                return conflict(reply, "You must be clocked in to delete attachments");
+            const stepRun = await findStepRunWithField(resolved.stepRun.id, resolved.opRun.id, fieldSeqNo);
+            if (!stepRun)
+                return notFound(reply, "Step run not found");
+            if (stepRun.completed)
+                return conflict(reply, "Cannot delete: step run is completed");
+            const field = stepRun.step.fieldSet?.fields[0];
+            if (!field)
+                return notFound(reply, "Step field not found");
+            const setIndex = request.params.setIndex ?? 0;
+            const fieldRecordId = await ensureStepRunFieldRecord(resolved.stepRun.id, userId);
+            if (!fieldRecordId)
+                return notFound(reply, "Step has no field set");
+            const fieldValueRow = await erpDb.fieldValue.findUnique({
+                where: {
+                    fieldRecordId_fieldId_setIndex: {
+                        fieldRecordId,
+                        fieldId: field.id,
+                        setIndex,
+                    },
+                },
+                select: { id: true },
+            });
+            if (!fieldValueRow)
+                return notFound(reply, "Field value not found");
+            await deleteFieldAttachment(fieldValueRow.id, attachmentId);
+            // Rebuild field value to reflect remaining attachments
+            await rebuildAttachmentFieldValue(fieldRecordId, field.id, setIndex, field.isArray, userId);
+            return { deleted: true };
+        },
+    });
+}
+//# sourceMappingURL=step-field-attachments.js.map

package/dist/routes/step-fields.d.ts

@@ -0,0 +1,100 @@
+import type { FastifyInstance } from "fastify";
+import type { ErpUser } from "../auth-middleware.js";
+import { type FieldWithUsers } from "../services/field-service.js";
+export { type FieldWithUsers } from "../services/field-service.js";
+export declare function formatFieldListResponse(orderKey: string, revNo: number, opSeqNo: number, stepSeqNo: number, revStatus: string, user: ErpUser | undefined, items: FieldWithUsers[]): {
+    items: {
+        _actions: {
+            rel: string;
+            href: string;
+            method: string;
+            title?: string | undefined;
+            schema?: string | undefined;
+            body?: Record<string, unknown> | undefined;
+            alternateEncoding?: {
+                contentType: string;
+                fileFields: string[];
+                description?: string | undefined;
+            } | undefined;
+            disabled?: boolean | undefined;
+            disabledReason?: string | string[] | undefined;
+        }[];
+        createdAt: string;
+        createdBy: string;
+        updatedAt: string;
+        updatedBy: string;
+        id: number;
+        fieldSetId: number;
+        seqNo: number;
+        label: string;
+        type: import("../generated/prisma/enums.js").FieldType;
+        isArray: boolean;
+        required: boolean;
+    }[];
+    total: number;
+    nextSeqNo: number;
+    _links: {
+        rel: string;
+        href: string;
+        method?: string | undefined;
+        title?: string | undefined;
+        schema?: string | undefined;
+    }[];
+    _linkTemplates: {
+        rel: string;
+        hrefTemplate: string;
+    }[];
+    _actions: {
+        rel: string;
+        href: string;
+        method: string;
+        title?: string | undefined;
+        schema?: string | undefined;
+        body?: Record<string, unknown> | undefined;
+        alternateEncoding?: {
+            contentType: string;
+            fileFields: string[];
+            description?: string | undefined;
+        } | undefined;
+        disabled?: boolean | undefined;
+        disabledReason?: string | string[] | undefined;
+    }[];
+};
+export declare function fieldBasePath(orderKey: string, revNo: number, opSeqNo: number, stepSeqNo: number): string;
+export declare function formatField(orderKey: string, revNo: number, opSeqNo: number, stepSeqNo: number, revStatus: string, user: ErpUser | undefined, field: FieldWithUsers): {
+    _links: {
+        rel: string;
+        href: string;
+        method?: string | undefined;
+        title?: string | undefined;
+        schema?: string | undefined;
+    }[];
+    _actions: {
+        rel: string;
+        href: string;
+        method: string;
+        title?: string | undefined;
+        schema?: string | undefined;
+        body?: Record<string, unknown> | undefined;
+        alternateEncoding?: {
+            contentType: string;
+            fileFields: string[];
+            description?: string | undefined;
+        } | undefined;
+        disabled?: boolean | undefined;
+        disabledReason?: string | string[] | undefined;
+    }[];
+    createdAt: string;
+    createdBy: string;
+    updatedAt: string;
+    updatedBy: string;
+    id: number;
+    fieldSetId: number;
+    seqNo: number;
+    label: string;
+    type: import("../generated/prisma/enums.js").FieldType;
+    isArray: boolean;
+    required: boolean;
+};
+export default function stepFieldRoutes(fastify: FastifyInstance): void;
+//# sourceMappingURL=step-fields.d.ts.map