@nuxt-customer-portal/planning 0.4.0

package/server/api/store/planning/hold.get.ts

@@ -0,0 +1,36 @@
+import { defineEventHandler, getQuery, setHeader, createError } from 'h3'
+import { rows } from '@nuxt-customer-portal/products/server/utils/database'
+import { publicLimit } from '@nuxt-customer-portal/products/server/utils/access'
+import { parseInput } from '@nuxt-customer-portal/products/server/utils/validation'
+import { holdHash } from '../../../utils/booking'
+import { holdCredentialSchema } from '../../../../shared/validation'
+
+export default defineEventHandler(async (event) => {
+  await publicLimit(event)
+  setHeader(event, 'Cache-Control', 'no-store')
+  const input = parseInput(holdCredentialSchema, getQuery(event))
+  const [hold] = await rows<{
+    product_id: string
+    start_at: Date
+    end_at: Date
+    expires_at: Date
+    name: string
+    snapshot: { unitAmount: number; currency: string; customerTimezone: string }
+  }>(
+    `SELECT r.*,u.name FROM planning.reservation r JOIN public."user" u ON u.id=r.user_id WHERE r.token_hash=$1 AND r.status='reserved' AND r.expires_at>now()`,
+    [holdHash(event, input.holdToken)]
+  )
+  if (!hold) {
+    throw createError({ statusCode: 409, message: 'Reservation expired' })
+  }
+  return {
+    productId: hold.product_id,
+    start: hold.start_at,
+    end: hold.end_at,
+    expiresAt: hold.expires_at,
+    providerName: hold.name,
+    amount: hold.snapshot.unitAmount,
+    currency: hold.snapshot.currency,
+    customerTimezone: hold.snapshot.customerTimezone
+  }
+})

package/server/api/store/planning/holds.post.ts

@@ -0,0 +1,10 @@
+import { defineEventHandler, readBody } from 'h3'
+import { reserve } from '@nuxt-customer-portal/planning/server/utils/booking'
+import { sameOrigin } from '@nuxt-customer-portal/planning/server/utils/access'
+import { publicLimit } from '@nuxt-customer-portal/products/server/utils/access'
+
+export default defineEventHandler(async (event) => {
+  await publicLimit(event)
+  sameOrigin(event)
+  return reserve(event, await readBody(event))
+})

package/server/db/schema/planning.ts

@@ -0,0 +1,213 @@
+import {
+  pgSchema,
+  text,
+  uuid,
+  boolean,
+  integer,
+  timestamp,
+  jsonb,
+  primaryKey,
+  foreignKey,
+  index,
+  uniqueIndex,
+  check,
+  type AnyPgColumn
+} from 'drizzle-orm/pg-core'
+import { sql } from 'drizzle-orm'
+import { organization, user } from '@nuxt-customer-portal/core/schema'
+import { product, orders, orderLine } from '@nuxt-customer-portal/products/schema'
+import type { AppointmentSnapshot, AvailabilityWindow, PlanningPolicy } from '../../../shared/types'
+
+const schema = pgSchema('planning')
+const instant = (name: string) => timestamp(name, { withTimezone: true })
+export const settings = schema.table('settings', {
+  storeId: text('store_id')
+    .primaryKey()
+    .references(() => organization.id),
+  policy: jsonb('policy').$type<PlanningPolicy>().notNull()
+})
+export const provider = schema.table(
+  'provider',
+  {
+    storeId: text('store_id')
+      .notNull()
+      .references(() => organization.id),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id),
+    enabled: boolean('enabled').notNull().default(false),
+    timezone: text('timezone').notNull().default('Europe/Amsterdam'),
+    graceMinutes: integer('grace_minutes').notNull().default(0),
+    availabilityCalendarTitle: text('availability_calendar_title').notNull().default('Portal availability'),
+    busyCalendarIds: text('busy_calendar_ids')
+      .array()
+      .notNull()
+      .default(sql`'{}'`),
+    writeCalendarId: text('write_calendar_id')
+  },
+  (t) => [
+    primaryKey({ columns: [t.storeId, t.userId] }),
+    check('provider_grace_minutes_check', sql`${t.graceMinutes} BETWEEN 0 AND 1440`)
+  ]
+)
+const providerFk = (t: { storeId: AnyPgColumn; userId: AnyPgColumn }) =>
+  foreignKey({ columns: [t.storeId, t.userId], foreignColumns: [provider.storeId, provider.userId] })
+export const connection = schema.table(
+  'connection',
+  {
+    storeId: text('store_id').notNull(),
+    userId: text('user_id').notNull(),
+    provider: text('provider').notNull(),
+    credentials: text('credentials').notNull(),
+    externalUserId: text('external_user_id').notNull(),
+    externalUserLabel: text('external_user_label'),
+    healthy: boolean('healthy').notNull().default(true),
+    error: text('error')
+  },
+  (t) => [
+    primaryKey({ columns: [t.storeId, t.userId, t.provider] }),
+    providerFk(t),
+    check('connection_provider_check', sql`${t.provider} IN ('google','zoom')`)
+  ]
+)
+export const oauthState = schema.table(
+  'oauth_state',
+  {
+    id: text('id').primaryKey(),
+    storeId: text('store_id').notNull(),
+    userId: text('user_id').notNull(),
+    provider: text('provider').notNull(),
+    expiresAt: instant('expires_at').notNull()
+  },
+  (t) => [providerFk(t)]
+)
+export const availability = schema.table(
+  'availability',
+  {
+    id: uuid('id').primaryKey(),
+    storeId: text('store_id').notNull(),
+    userId: text('user_id').notNull(),
+    data: jsonb('data').$type<AvailabilityWindow>().notNull(),
+    revision: integer('revision').notNull().default(1),
+    deleted: boolean('deleted').notNull().default(false),
+    calendarEventId: text('calendar_event_id'),
+    calendarId: text('calendar_id')
+  },
+  (t) => [providerFk(t)]
+)
+export const reservation = schema.table(
+  'reservation',
+  {
+    id: uuid('id').primaryKey(),
+    storeId: text('store_id').notNull(),
+    userId: text('user_id').notNull(),
+    productId: text('product_id')
+      .notNull()
+      .references(() => product.id),
+    tokenHash: text('token_hash').notNull().unique(),
+    startAt: instant('start_at').notNull(),
+    endAt: instant('end_at').notNull(),
+    blockedUntil: instant('blocked_until').notNull(),
+    expiresAt: instant('expires_at').notNull(),
+    confirmedAt: instant('confirmed_at'),
+    status: text('status').notNull(),
+    orderId: text('order_id')
+      .unique()
+      .references(() => orders.id),
+    replacesId: uuid('replaces_id'),
+    snapshot: jsonb('snapshot').$type<AppointmentSnapshot>().notNull()
+  },
+  (t) => [
+    providerFk(t),
+    foreignKey({ columns: [t.replacesId], foreignColumns: [appointment.id as AnyPgColumn] }),
+    check('reservation_status_check', sql`${t.status} IN ('reserved','confirmed','expired','cancelled','superseded')`),
+    check('reservation_check', sql`${t.startAt} < ${t.endAt} AND ${t.endAt} <= ${t.blockedUntil}`),
+    index('reservation_expiry')
+      .on(t.expiresAt)
+      .where(sql`${t.status}='reserved'`)
+  ]
+)
+// The provider/time exclusion constraint is installed by SQL migration (Drizzle has no exclusion builder).
+export const appointment = schema.table(
+  'appointment',
+  {
+    id: uuid('id').primaryKey(),
+    storeId: text('store_id').notNull(),
+    reservationId: uuid('reservation_id')
+      .notNull()
+      .unique()
+      .references((): AnyPgColumn => reservation.id),
+    orderLineId: text('order_line_id')
+      .notNull()
+      .unique()
+      .references(() => orderLine.id),
+    orderId: text('order_id')
+      .notNull()
+      .references(() => orders.id),
+    userId: text('user_id')
+      .notNull()
+      .references(() => user.id),
+    productId: text('product_id')
+      .notNull()
+      .references(() => product.id),
+    startAt: instant('start_at').notNull(),
+    endAt: instant('end_at').notNull(),
+    status: text('status').notNull(),
+    changes: integer('changes').notNull().default(0),
+    revision: integer('revision').notNull().default(1),
+    snapshot: jsonb('snapshot').$type<AppointmentSnapshot>().notNull(),
+    meetingId: text('meeting_id'),
+    meetingUrl: text('meeting_url'),
+    calendarEventId: text('calendar_event_id'),
+    calendarId: text('calendar_id'),
+    calendarUserId: text('calendar_user_id'),
+    conflict: boolean('conflict').notNull().default(false),
+    effectsError: text('effects_error')
+  },
+  (t) => [check('appointment_status_check', sql`${t.status} IN ('confirmed','cancelled')`)]
+)
+export const audit = schema.table('audit', {
+  id: uuid('id').primaryKey(),
+  appointmentId: uuid('appointment_id')
+    .notNull()
+    .references(() => appointment.id),
+  actorId: text('actor_id').references(() => user.id),
+  action: text('action').notNull(),
+  data: jsonb('data').notNull().default({}),
+  createdAt: instant('created_at').notNull().defaultNow()
+})
+export const job = schema.table(
+  'job',
+  {
+    id: text('id').primaryKey(),
+    kind: text('kind').notNull(),
+    payload: jsonb('payload').notNull(),
+    attempts: integer('attempts').notNull().default(0),
+    availableAt: instant('available_at').notNull().defaultNow(),
+    createdAt: instant('created_at').notNull().defaultNow(),
+    lastAttemptAt: instant('last_attempt_at'),
+    completedAt: instant('completed_at'),
+    error: text('error')
+  },
+  (t) => [
+    index('job_pending')
+      .on(t.availableAt)
+      .where(sql`${t.completedAt} IS NULL`),
+    uniqueIndex('job_pending_availability_target')
+      .on(sql`(${t.payload}->>'id')`)
+      .where(sql`${t.completedAt} IS NULL AND ${t.kind} = 'availability'`)
+  ]
+)
+export const watch = schema.table(
+  'watch',
+  {
+    id: uuid('id').primaryKey(),
+    storeId: text('store_id').notNull(),
+    userId: text('user_id').notNull(),
+    calendarId: text('calendar_id').notNull(),
+    tokenHash: text('token_hash').notNull(),
+    resourceId: text('resource_id'),
+    expiresAt: instant('expires_at').notNull()
+  },
+  (t) => [providerFk(t)]
+)

package/server/plugins/openapi.ts

@@ -0,0 +1,36 @@
+import { productPlanningSchema } from '@nuxt-customer-portal/products/shared/planning'
+import { registerPortalOpenApiContracts } from '@nuxt-customer-portal/core/server/utils/openapi-contracts'
+import { z } from 'zod'
+import {
+  appointmentListSchema,
+  staffRescheduleSchema,
+  availabilityQuerySchema,
+  availabilitySchema,
+  availabilityEditSchema,
+  providerSettingsSchema,
+  holdSchema,
+  holdCredentialSchema,
+  planningPolicySchema
+} from '../../shared/validation'
+
+export default defineNitroPlugin(() =>
+  registerPortalOpenApiContracts({
+    owner: 'planning',
+    query: {
+      planningAppointmentsGet: appointmentListSchema,
+      storePlanningByProductIdAvailabilityGet: availabilityQuerySchema,
+      storePlanningHoldGet: holdCredentialSchema,
+      planningAppointmentsByIdAvailabilityGet: availabilityQuerySchema
+    },
+    body: {
+      planningAppointmentsByIdReschedulePut: staffRescheduleSchema,
+      storePlanningHoldsPost: holdSchema,
+      planningAdminProductsByIdPut: productPlanningSchema,
+      planningProviderPut: providerSettingsSchema,
+      planningAvailabilityPost: availabilitySchema,
+      planningAvailabilityByIdPut: availabilityEditSchema,
+      planningAdminPolicyPut: planningPolicySchema,
+      planningAdminProvidersByUserIdPatch: z.object({ enabled: z.boolean() })
+    }
+  })
+)

package/server/plugins/planning.ts

@@ -0,0 +1,6 @@
+import { registerPlanningOrderIntegration } from '@nuxt-customer-portal/products/server/utils/contracts'
+import { prepareCheckout, bindPrepared, prepareOrder, confirm } from '../utils/booking'
+
+export default defineNitroPlugin(() =>
+  registerPlanningOrderIntegration({ prepareCheckout, bind: bindPrepared, prepareOrder, confirm })
+)

package/server/tasks/planning/reconcile.ts

@@ -0,0 +1,30 @@
+import { pool } from '@nuxt-customer-portal/core/server/utils/db'
+import { rows } from '@nuxt-customer-portal/products/server/utils/database'
+import { expireReservations, runJobs } from '../../utils/jobs'
+import { enqueue } from '../../utils/booking'
+
+export default defineTask({
+  meta: {
+    name: 'planning:reconcile',
+    description: 'Expire booking holds, synchronize calendars and retry appointment effects'
+  },
+  async run() {
+    let expiryError = false
+    try {
+      await expireReservations()
+    } catch {
+      expiryError = true
+    }
+    const users = await rows<{ store_id: string; user_id: string }>(
+      `SELECT p.store_id,p.user_id FROM planning.provider p JOIN planning.connection c ON c.store_id=p.store_id AND c.user_id=p.user_id AND c.provider='google' AND c.healthy WHERE cardinality(p.busy_calendar_ids)>0`
+    )
+    for (const u of users) {
+      await enqueue(pool, `sync:${u.store_id}:${u.user_id}:${Math.floor(Date.now() / 900000)}`, 'sync', {
+        storeId: u.store_id,
+        userId: u.user_id,
+        trigger: 'reconciliation'
+      })
+    }
+    return { result: { ...(await runJobs()), expiryError } }
+  }
+})

package/server/utils/access.ts

@@ -0,0 +1,80 @@
+import { createError, getHeader, type H3Event } from 'h3'
+import { requireActiveOrganizationRole, requireSession } from '@nuxt-customer-portal/core/server/portal'
+import { admin, getStore, baseUrl } from '@nuxt-customer-portal/products/server/utils/access'
+import { rows } from '@nuxt-customer-portal/products/server/utils/database'
+import { claimPurchases } from '@nuxt-customer-portal/products/server/utils/orders'
+import type { Appointment } from '../../shared/types'
+
+export const planningAdmin = admin
+export function sameOrigin(event: H3Event) {
+  if (getHeader(event, 'origin') !== baseUrl()) {
+    throw createError({ statusCode: 403, message: 'This action must originate from the portal' })
+  }
+}
+export async function providerAccess(event: H3Event) {
+  const context = await requireActiveOrganizationRole(event),
+    store = await getStore()
+  if (context.organizationType !== 'PROVIDER' || context.organizationId !== store.organization_id) {
+    throw createError({ statusCode: 403, message: 'Provider organization membership required' })
+  }
+  await rows(
+    `INSERT INTO planning.provider(store_id,user_id,timezone) SELECT $1,u.id,COALESCE(u.timezone,os.timezone,'Europe/Amsterdam') FROM public."user" u LEFT JOIN public.organization_settings os ON os.organization_id=$1 WHERE u.id=$2 ON CONFLICT DO NOTHING`,
+    [context.organizationId, context.session.user.id]
+  )
+  return { ...context, storeId: store.organization_id, userId: context.session.user.id }
+}
+export async function customerAppointment(event: H3Event, id: string) {
+  const userId = await claimPurchases(event)
+  const [a] = await rows<Appointment>(
+    `SELECT a.* FROM planning.appointment a JOIN products.orders o ON o.id=a.order_id WHERE a.id=$1 AND o.buyer_id=$2`,
+    [id, userId]
+  )
+  if (!a) {
+    throw createError({ statusCode: 404, message: 'Appointment not found' })
+  }
+  return { appointment: a, userId }
+}
+export async function verifiedCustomer(event: H3Event) {
+  const session = await requireSession(event)
+  if (!session.user.emailVerified) {
+    throw createError({ statusCode: 403, message: 'Verify your email' })
+  }
+  return session
+}
+
+export async function appointmentScope(event: H3Event) {
+  const session = await requireSession(event)
+  let context
+  try {
+    context = await requireActiveOrganizationRole(event)
+  } catch (error) {
+    if (![400, 403].includes((error as { statusCode?: number }).statusCode ?? 500)) {
+      throw error
+    }
+  }
+  const store = await getStore()
+  if (context?.organizationType === 'PROVIDER' && context.organizationId === store.organization_id) {
+    return {
+      staff: true,
+      canManage: ['owner', 'admin'].includes(context.role),
+      storeId: store.organization_id,
+      userId: session.user.id
+    }
+  }
+  const userId = await claimPurchases(event)
+  return { staff: false, canManage: true, storeId: store.organization_id, userId }
+}
+export async function appointmentAccess(event: H3Event, id: string, manage = false) {
+  const scope = await appointmentScope(event)
+  const [appointment] = await rows<Appointment>(
+    `SELECT a.* FROM planning.appointment a JOIN products.orders o ON o.id=a.order_id WHERE a.id=$1 AND a.store_id=$2 AND ($3::boolean OR o.buyer_id=$4)`,
+    [id, scope.storeId, scope.staff, scope.userId]
+  )
+  if (!appointment) {
+    throw createError({ statusCode: 404, message: 'Appointment not found' })
+  }
+  if (manage && !scope.canManage) {
+    throw createError({ statusCode: 403, message: 'Organization administrator access required' })
+  }
+  return { ...scope, appointment }
+}