@open-mercato/core 0.10.1-develop.7709.1.046124599c → 0.10.1-develop.7714.1.9dbb8200d8

package/src/modules/wms/api/scan/receive/route.ts

@@ -0,0 +1,118 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { asnReceiveLineSchema, scanReceiveSchema } from '../../../data/validators'
+import { resolveScanReceiveCommandInput } from '../../../lib/scanResolve'
+import { executeWmsCustomPostRoute } from '../../inventory/helpers'
+
+const logger = createLogger('wms')
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['wms.receive_inventory'] },
+}
+
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementIds: z.array(z.string().uuid()),
+  putawayTaskIds: z.array(z.string().uuid()),
+  receivedQty: z.number().optional(),
+  asnUpdatedAt: z.string().datetime().optional(),
+})
+const errorSchema = z.object({ error: z.string() })
+
+export async function POST(request: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(request)
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: 'Unauthorized' })
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request,
+    })
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: 'organization_scope_required' })
+    }
+    const body = await readJsonSafe<Record<string, unknown>>(request, {})
+    const parsed = scanReceiveSchema.parse(body)
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+    // Scope organization from auth/session — never trust body organizationId for
+    // ASN/location resolve (same contract as resolve-location / resolve-lot).
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId,
+    }
+    const em = (container.resolve('em') as EntityManager).fork()
+    const commandInput = await resolveScanReceiveCommandInput(em, scoped)
+    const scopedRequest = new Request(request.url, {
+      method: 'POST',
+      headers: request.headers,
+      body: JSON.stringify(commandInput),
+    })
+    return executeWmsCustomPostRoute({
+      request: scopedRequest,
+      routePath: 'wms/scan/receive',
+      inputSchema: asnReceiveLineSchema,
+      commandId: 'wms.asns.receive-line',
+      describeResource: (input) => ({
+        resourceKind: 'wms.asn',
+        resourceId: input.asnId,
+      }),
+      mapSuccess: (result: {
+        movementIds: string[]
+        putawayTaskIds: string[]
+        receivedQty?: number
+        asnUpdatedAt?: string
+      }) => ({
+        ok: true,
+        movementIds: result.movementIds,
+        putawayTaskIds: result.putawayTaskIds,
+        receivedQty: result.receivedQty,
+        asnUpdatedAt: result.asnUpdatedAt,
+      }),
+    })
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })
+    }
+    logger.error('scan receive failed', { err: error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Scan-assisted ASN receive',
+  methods: {
+    POST: {
+      summary: 'Receive ASN line from scanned location/lot codes',
+      description:
+        'Resolves scanned location (and optional lot) codes, then executes the same command path as POST /api/wms/asns/:id/receive. Organization is taken from the authenticated session scope, not the request body. Both QC-pass and QC-fail require absolute targetReceivedQty for retry-safe attempts (optional idempotencyKey is an extra stabilizer only).',
+      requestBody: { contentType: 'application/json', schema: scanReceiveSchema },
+      responses: [{ status: 200, description: 'ASN line received', schema: successSchema }],
+      errors: [
+        { status: 400, description: 'Validation failed', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 404, description: 'ASN or location not found', schema: errorSchema },
+        { status: 409, description: 'Invalid receipt state', schema: errorSchema },
+        { status: 422, description: 'Tracking or QC transition invalid', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/wms/api/scan/resolve-location/route.ts

@@ -0,0 +1,92 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { scanResolveLocationSchema } from '../../../data/validators'
+import { resolveLocationByCode } from '../../../lib/scanResolve'
+
+const logger = createLogger('wms')
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['wms.view'] },
+}
+
+const successSchema = z.object({
+  ok: z.literal(true),
+  locationId: z.string().uuid(),
+  code: z.string(),
+  type: z.string(),
+})
+const errorSchema = z.object({ error: z.string() })
+
+export async function POST(request: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(request)
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: 'Unauthorized' })
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request,
+    })
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: 'organization_scope_required' })
+    }
+    const body = await readJsonSafe<Record<string, unknown>>(request, {})
+    const parsed = scanResolveLocationSchema.parse(body)
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+    // Scope organization from auth/session — never trust body organizationId for cross-org reads.
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId,
+    }
+    const em = (container.resolve('em') as EntityManager).fork()
+    const resolved = await resolveLocationByCode(em, scoped)
+    return NextResponse.json({
+      ok: true as const,
+      locationId: resolved.locationId,
+      code: resolved.code,
+      type: resolved.type,
+    })
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })
+    }
+    logger.error('scan resolve-location failed', { err: error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Resolve scanned location code',
+  methods: {
+    POST: {
+      summary: 'Resolve location by warehouse + barcode/code',
+      description:
+        'Returns the canonical location id and type for a scanned warehouse location code. Organization is taken from the authenticated session scope, not the request body.',
+      requestBody: { contentType: 'application/json', schema: scanResolveLocationSchema },
+      responses: [{ status: 200, description: 'Location resolved', schema: successSchema }],
+      errors: [
+        { status: 400, description: 'Validation failed', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 404, description: 'Location not found', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/wms/api/scan/resolve-lot/route.ts

@@ -0,0 +1,92 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { scanResolveLotSchema } from '../../../data/validators'
+import { resolveLotByNumber } from '../../../lib/scanResolve'
+
+const logger = createLogger('wms')
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['wms.view'] },
+}
+
+const successSchema = z.object({
+  ok: z.literal(true),
+  lotId: z.string().uuid(),
+  lotNumber: z.string(),
+  expiresAt: z.string().nullable(),
+})
+const errorSchema = z.object({ error: z.string() })
+
+export async function POST(request: Request) {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(request)
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: 'Unauthorized' })
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request,
+    })
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null
+    if (!organizationId) {
+      throw new CrudHttpError(400, { error: 'organization_scope_required' })
+    }
+    const body = await readJsonSafe<Record<string, unknown>>(request, {})
+    const parsed = scanResolveLotSchema.parse(body)
+    if (parsed.tenantId !== auth.tenantId && !auth.isSuperAdmin) {
+      throw new CrudHttpError(403, { error: 'Forbidden' })
+    }
+    // Scope organization from auth/session — never trust body organizationId for cross-org reads.
+    const scoped = {
+      ...parsed,
+      tenantId: auth.tenantId,
+      organizationId,
+    }
+    const em = (container.resolve('em') as EntityManager).fork()
+    const resolved = await resolveLotByNumber(em, scoped)
+    return NextResponse.json({
+      ok: true as const,
+      lotId: resolved.lotId,
+      lotNumber: resolved.lotNumber,
+      expiresAt: resolved.expiresAt,
+    })
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })
+    }
+    logger.error('scan resolve-lot failed', { err: error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Resolve scanned lot number',
+  methods: {
+    POST: {
+      summary: 'Resolve lot by catalog variant + lot number',
+      description:
+        'Returns the canonical lot id and expiry for a scanned lot number. Organization is taken from the authenticated session scope, not the request body.',
+      requestBody: { contentType: 'application/json', schema: scanResolveLotSchema },
+      responses: [{ status: 200, description: 'Lot resolved', schema: successSchema }],
+      errors: [
+        { status: 400, description: 'Validation failed', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 404, description: 'Lot not found', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/wms/backend/wms/asns/[id]/page.meta.ts

@@ -0,0 +1,14 @@
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['wms.view'],
+  pageTitle: 'ASN detail',
+  pageTitleKey: 'wms.backend.asns.detail.nav.title',
+  pageGroup: 'WMS',
+  pageGroupKey: 'wms.nav.group',
+  navHidden: true,
+  breadcrumb: [
+    { label: 'WMS', labelKey: 'wms.backend.nav.title', href: '/backend/wms' },
+    { label: 'ASNs', labelKey: 'wms.backend.asns.nav.title', href: '/backend/wms/asns' },
+    { label: 'ASN', labelKey: 'wms.backend.asns.detail.nav.title' },
+  ],
+} as const

package/src/modules/wms/backend/wms/asns/[id]/page.tsx

@@ -0,0 +1,5 @@
+import WmsAsnDetailPage from '../../../../components/backend/WmsAsnDetailPage'
+
+export default function WmsAsnDetailRoutePage({ params }: { params?: { id?: string } }) {
+  return <WmsAsnDetailPage asnId={params?.id ?? ''} />
+}

package/src/modules/wms/backend/wms/asns/page.meta.ts

@@ -0,0 +1,14 @@
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['wms.view'],
+  pageTitle: 'ASNs',
+  pageTitleKey: 'wms.backend.asns.nav.title',
+  pageGroup: 'WMS',
+  pageGroupKey: 'wms.nav.group',
+  pageOrder: 90,
+  breadcrumb: [
+    { label: 'WMS', labelKey: 'wms.backend.nav.title', href: '/backend/wms' },
+    { label: 'ASNs', labelKey: 'wms.backend.asns.nav.title' },
+  ],
+  icon: 'clipboard-list',
+} as const

package/src/modules/wms/backend/wms/asns/page.tsx

@@ -0,0 +1,5 @@
+import WmsAsnsListPage from '../../../components/backend/WmsAsnsListPage'
+
+export default function WmsAsnsPage() {
+  return <WmsAsnsListPage />
+}

package/src/modules/wms/backend/wms/putaway/page.meta.ts

@@ -0,0 +1,14 @@
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['wms.view'],
+  pageTitle: 'Putaway',
+  pageTitleKey: 'wms.backend.putaway.nav.title',
+  pageGroup: 'WMS',
+  pageGroupKey: 'wms.nav.group',
+  pageOrder: 95,
+  breadcrumb: [
+    { label: 'WMS', labelKey: 'wms.backend.nav.title', href: '/backend/wms' },
+    { label: 'Putaway', labelKey: 'wms.backend.putaway.nav.title' },
+  ],
+  icon: 'package',
+} as const

package/src/modules/wms/backend/wms/putaway/page.tsx

@@ -0,0 +1,5 @@
+import WmsPutawayQueuePage from '../../../components/backend/WmsPutawayQueuePage'
+
+export default function WmsPutawayPage() {
+  return <WmsPutawayQueuePage />
+}

package/src/modules/wms/backend/wms/receiving/page.meta.ts

@@ -0,0 +1,14 @@
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['wms.view'],
+  pageTitle: 'Receiving',
+  pageTitleKey: 'wms.backend.receiving.nav.title',
+  pageGroup: 'WMS',
+  pageGroupKey: 'wms.nav.group',
+  pageOrder: 92,
+  breadcrumb: [
+    { label: 'WMS', labelKey: 'wms.backend.nav.title', href: '/backend/wms' },
+    { label: 'Receiving', labelKey: 'wms.backend.receiving.nav.title' },
+  ],
+  icon: 'inbox',
+} as const

package/src/modules/wms/backend/wms/receiving/page.tsx

@@ -0,0 +1,5 @@
+import { redirect } from 'next/navigation'
+
+export default function WmsReceivingPage() {
+  redirect('/backend/wms/asns?queue=open')
+}

package/src/modules/wms/ce.ts

@@ -71,6 +71,33 @@ export const entities = [
     defaultEditor: false,
     fields: [],
   },
+  {
+    id: 'wms:asn',
+    label: 'ASN',
+    description: 'Advanced shipping notice for structured inbound receiving.',
+    labelField: 'referenceNumber',
+    showInSidebar: false,
+    defaultEditor: false,
+    fields: [],
+  },
+  {
+    id: 'wms:receiving_line',
+    label: 'Receiving Line',
+    description: 'Expected/received line against an ASN with QC outcome.',
+    labelField: 'catalogVariantId',
+    showInSidebar: false,
+    defaultEditor: false,
+    fields: [],
+  },
+  {
+    id: 'wms:putaway_task',
+    label: 'Putaway Task',
+    description: 'Directed putaway task moving accepted stock from staging into storage.',
+    labelField: 'catalogVariantId',
+    showInSidebar: false,
+    defaultEditor: false,
+    fields: [],
+  },
 ]
 
 export default entities