@open-mercato/core 0.10.1-develop.7717.1.2befe9c634 → 0.10.1-develop.7721.1.b5c4a00a68

package/src/modules/staff/api/portal/support-tickets/route.ts

@@ -0,0 +1,253 @@
+/**
+ * `GET|POST /api/staff/portal/support-tickets` — customer portal support intake.
+ *
+ * Every row is loaded with `portalOwnedTaskWhere` (tenant, organization, the
+ * signed-in portal user's own `customerEntityId` on the TASK, `source = 'portal'`,
+ * not deleted). The project's customer is never consulted, so tickets from many
+ * customers can share one project. Subject and description come from the encrypted
+ * `customer_request_snapshot`, never from the staff-editable task text, and the
+ * response carries no project, task reference, assignee, internal comment or money.
+ */
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  StaffSupportTicket,
+  StaffTimeTask,
+  StaffTimeTaskStatus,
+} from '../../../data/entities'
+import {
+  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,
+  PORTAL_SUPPORT_TICKETS_VIEW_FEATURE,
+  listPortalTicketPage,
+  portalOwnedTaskWhere,
+  resolveCustomerDisplay,
+  resolveSupportPortalScope,
+} from '../../../lib/support/portalTickets'
+import {
+  SUPPORT_TICKET_RESOURCE_KIND,
+  buildPortalCommandContext,
+  checkPortalRateLimit,
+  portalErrorResponse,
+} from '../../../lib/support/portalRoute'
+import { derivePortalStatus } from '../../../lib/support/portalStatus'
+import {
+  staffSupportTicketCommandIds,
+  type SupportTicketCreateFromPortalInput,
+  type SupportTicketCreateResult,
+} from '../../../commands/support-tickets'
+
+export const metadata: { requireAuth?: boolean } = { requireAuth: false }
+
+const portalStatusSchema = z.enum(['received', 'in_progress', 'resolved'])
+
+const listQuerySchema = z.object({
+  page: z.coerce.number().int().min(1).default(1),
+  pageSize: z.coerce.number().int().min(1).max(50).default(20),
+  status: portalStatusSchema.optional(),
+})
+
+const ticketListItemSchema = z.object({
+  id: z.string().uuid(),
+  supportReference: z.string(),
+  subject: z.string(),
+  category: z.object({ value: z.string(), label: z.string() }),
+  portalStatus: portalStatusSchema,
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+  lastActivityAt: z.string().nullable(),
+})
+
+const listResponseSchema = z.object({
+  items: z.array(ticketListItemSchema),
+  total: z.number().int(),
+  page: z.number().int(),
+  pageSize: z.number().int(),
+  totalPages: z.number().int(),
+})
+
+const createBodySchema = z.object({
+  categoryValue: z.string().trim().min(1).max(150),
+  subject: z.string().trim().min(3).max(200),
+  description: z.string().trim().min(1).max(10000),
+})
+
+const createResponseSchema = z.object({
+  ok: z.literal(true),
+  id: z.string().uuid(),
+  supportReference: z.string(),
+})
+
+function isoOrNull(value: Date | null | undefined): string | null {
+  return value ? value.toISOString() : null
+}
+
+async function statusIdsFor(
+  scope: { em: import('@mikro-orm/postgresql').EntityManager; tenantId: string; organizationId: string },
+  status: z.infer<typeof portalStatusSchema>,
+): Promise<string[]> {
+  const where: Record<string, unknown> = { tenantId: scope.tenantId, organizationId: scope.organizationId, deletedAt: null }
+  if (status === 'resolved') where.isDone = true
+  else if (status === 'received') Object.assign(where, { isDone: false, isDefault: true })
+  else Object.assign(where, { isDone: false, isDefault: false })
+  const rows = await scope.em.find(StaffTimeTaskStatus, where, { fields: ['id'] })
+  return rows.map((row) => row.id)
+}
+
+export async function GET(req: Request) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_VIEW_FEATURE)
+    if (scope instanceof Response) return scope
+    const url = new URL(req.url)
+    const query = listQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))
+    const statusIds = query.status ? await statusIdsFor(scope, query.status) : null
+    const page = await listPortalTicketPage(scope, {
+      statusIds,
+      limit: query.pageSize,
+      offset: (query.page - 1) * query.pageSize,
+    })
+    const total = page.total
+    const pageIds = page.rows.map((row) => row.id)
+    const lastActivityByTask = new Map(page.rows.map((row) => [row.id, row.lastActivityAt]))
+    const loadedTasks = pageIds.length
+      ? await scope.em.find(StaffTimeTask, { id: { $in: pageIds }, ...portalOwnedTaskWhere(scope) })
+      : []
+    const taskById = new Map(loadedTasks.map((task) => [task.id, task]))
+    const tasks = pageIds.flatMap((id) => {
+      const task = taskById.get(id)
+      return task ? [task] : []
+    })
+    const decryptionScope = { tenantId: scope.tenantId, organizationId: scope.organizationId }
+    const taskIds = tasks.map((task) => task.id)
+    const tickets = taskIds.length
+      ? await findWithDecryption(
+          scope.em,
+          StaffSupportTicket,
+          { taskId: { $in: taskIds }, ...decryptionScope, deletedAt: null },
+          undefined,
+          decryptionScope,
+        )
+      : []
+    const ticketByTask = new Map(tickets.map((ticket) => [ticket.taskId, ticket]))
+    const taskStatusIds = [...new Set(tasks.map((task) => task.taskStatusId))]
+    const statuses = taskStatusIds.length
+      ? await scope.em.find(StaffTimeTaskStatus, { id: { $in: taskStatusIds }, ...decryptionScope }, { fields: ['id', 'isDefault', 'isDone'] })
+      : []
+    const statusById = new Map(statuses.map((status) => [status.id, status]))
+    const items = tasks.flatMap((task) => {
+      const ticket = ticketByTask.get(task.id)
+      if (!ticket) return []
+      const request = ticket.customerRequestSnapshot
+      const lastActivity = lastActivityByTask.get(task.id) ?? task.createdAt
+      return [
+        {
+          id: task.id,
+          supportReference: ticket.supportReference,
+          subject: request && typeof request.subject === 'string' ? request.subject : '',
+          category: ticket.categorySnapshot,
+          portalStatus: derivePortalStatus(statusById.get(task.taskStatusId) ?? null),
+          createdAt: isoOrNull(task.createdAt),
+          updatedAt: isoOrNull(task.updatedAt),
+          lastActivityAt: isoOrNull(lastActivity),
+        },
+      ]
+    })
+    return NextResponse.json(
+      listResponseSchema.parse({
+        items,
+        total,
+        page: query.page,
+        pageSize: query.pageSize,
+        totalPages: Math.max(1, Math.ceil(total / query.pageSize)),
+      }),
+    )
+  } catch (err) {
+    return portalErrorResponse(err, 'staff portal support tickets GET failed')
+  }
+}
+
+export async function POST(req: Request) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE)
+    if (scope instanceof Response) return scope
+    const limited = await checkPortalRateLimit(scope, 'create')
+    if (limited) return limited
+    const body = createBodySchema.parse(await readJsonSafe<Record<string, unknown>>(req, {}))
+    const guarded = await runRouteMutationGuards({
+      container: scope.container,
+      req,
+      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },
+      input: { resourceKind: SUPPORT_TICKET_RESOURCE_KIND, resourceId: null, operation: 'create', mutationPayload: body },
+    })
+    if (!guarded.ok) return guarded.response
+    const effectiveBody = guarded.modifiedPayload
+      ? createBodySchema.parse({ ...body, ...guarded.modifiedPayload })
+      : body
+    const customer = await resolveCustomerDisplay(scope)
+    const input: SupportTicketCreateFromPortalInput = {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      customerId: scope.customerId,
+      customerUserId: scope.auth.sub,
+      customerDisplayName: customer.displayName,
+      customerKind: customer.kind,
+      reporterDisplayName: scope.auth.displayName ?? null,
+      categoryValue: effectiveBody.categoryValue,
+      subject: effectiveBody.subject,
+      description: effectiveBody.description,
+    }
+    const commandBus = scope.container.resolve('commandBus') as CommandBus
+    const { result } = await commandBus.execute<SupportTicketCreateFromPortalInput, SupportTicketCreateResult>(
+      staffSupportTicketCommandIds.createFromPortal,
+      { input, ctx: buildPortalCommandContext(scope, req) },
+    )
+    await guarded.runAfterSuccess()
+    return NextResponse.json(
+      createResponseSchema.parse({ ok: true, id: result.taskId, supportReference: result.supportReference }),
+      { status: 201 },
+    )
+  } catch (err) {
+    const rejection = getCommandInterceptorHttpRejection(err)
+    if (rejection) return NextResponse.json(rejection.body, { status: rejection.status })
+    return portalErrorResponse(err, 'staff portal support tickets POST failed')
+  }
+}
+
+const errorSchema = z.object({ ok: z.literal(false).optional(), error: z.string(), code: z.string().optional() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff Portal',
+  summary: 'Customer support tickets',
+  methods: {
+    GET: {
+      summary: 'List my support tickets',
+      description:
+        "Support tickets filed by the signed-in portal user's customer, newest activity first: `lastActivityAt` is the later of the filing time and the newest customer-visible message (from either side), and the list is ordered by it. Internal edits do not reorder the list. Status is the customer-facing status derived from the board column (received, in_progress, resolved).",
+      query: listQuerySchema,
+      responses: [{ status: 200, description: 'Tickets', schema: listResponseSchema }],
+      errors: [
+        { status: 401, description: 'No portal session', schema: errorSchema },
+        { status: 403, description: 'Not linked to a customer, or missing portal.support_tickets.view', schema: errorSchema },
+      ],
+    },
+    POST: {
+      summary: 'File a support ticket',
+      description:
+        'Creates a ticket in the category the customer chose. The category routes to a project (its own rule, else the organization fallback rule); the ticket lands in that project default column. Rate limited per customer user.',
+      requestBody: { contentType: 'application/json', schema: createBodySchema },
+      responses: [{ status: 201, description: 'Ticket filed', schema: createResponseSchema }],
+      errors: [
+        { status: 401, description: 'No portal session', schema: errorSchema },
+        { status: 403, description: 'Missing portal.support_tickets.manage', schema: errorSchema },
+        { status: 409, description: 'Too many tickets were filed at once; resubmit', schema: errorSchema },
+        { status: 422, description: 'The category is not available', schema: errorSchema },
+        { status: 429, description: 'Rate limit exceeded', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/settings/route.ts

@@ -18,6 +18,7 @@ import {
   runTimesheetInterceptors,
 } from '../_shared/withTimesheetInterceptors'
 import {
+  preserveOmittedSupportSettings,
   readTimeTrackingSettings,
   writeTimeTrackingSettings,
   type TimeTrackingSettings,
@@ -152,7 +153,12 @@ async function PUT(req: Request) {
     const { session } = interceptors
 
     const settingsSchema = buildTimeTrackingSettingsSchema()
-    const parsed = settingsSchema.parse(session.body)
+    const requestBody = await preserveOmittedSupportSettings(
+      resolveConfigService(context),
+      { tenantId: context.tenantId },
+      session.body,
+    )
+    const parsed = settingsSchema.parse(requestBody)
 
     const guardResult = await runRouteMutationGuards({
       container: context.container,

package/src/modules/staff/api/timesheets/support-routing-rules/fallback-project/route.ts

@@ -0,0 +1,131 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError, forbidden, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { resolveFeatureAccess } from '../../../../lib/time-tracking/featureAccess'
+import {
+  SUPPORT_ROUTING_RULE_RESOURCE_KIND,
+  staffSupportRoutingRuleCommandIds,
+  type SupportFallbackProjectResult,
+} from '../../../../commands/support-routing-rules'
+import type { StaffSupportFallbackProjectCreateInput } from '../../../../data/validators'
+
+const logger = createLogger('staff').child({ component: 'api/timesheets/support-routing-rules/fallback-project' })
+
+const SETTINGS_FEATURE = 'staff.timesheets.settings.manage'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: [SETTINGS_FEATURE] },
+}
+
+export async function POST(req: Request): Promise<Response> {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+
+    const actorId = auth.sub ?? ''
+    const access = await resolveFeatureAccess(container, actorId, [SETTINGS_FEATURE], { tenantId, organizationId })
+    if (!access.allowed) throw forbidden(translate('staff.errors.forbidden', 'Forbidden'))
+
+    const input: StaffSupportFallbackProjectCreateInput = { tenantId, organizationId }
+    const guardResult = await runRouteMutationGuards({
+      container,
+      req,
+      auth: { userId: actorId, tenantId, organizationId, userFeatures: access.grantedFeatures },
+      input: {
+        resourceKind: SUPPORT_ROUTING_RULE_RESOURCE_KIND,
+        resourceId: null,
+        operation: 'create',
+        mutationPayload: input,
+      },
+    })
+    if (!guardResult.ok) return guardResult.response
+
+    const routeCtx: CommandRuntimeContext = {
+      container,
+      auth,
+      organizationScope: scope,
+      selectedOrganizationId: organizationId,
+      organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+      request: req,
+    }
+    const commandBus = container.resolve('commandBus') as CommandBus
+    const { result, logEntry } = await commandBus.execute<StaffSupportFallbackProjectCreateInput, SupportFallbackProjectResult>(
+      staffSupportRoutingRuleCommandIds.createFallbackProject,
+      { input, ctx: routeCtx },
+    )
+    await guardResult.runAfterSuccess()
+    const response = NextResponse.json(
+      { ruleId: result?.ruleId ?? null, timeProjectId: result?.timeProjectId ?? null, created: result?.created === true },
+      { status: result?.created ? 201 : 200 },
+    )
+    if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
+      response.headers.set(
+        'x-om-operation',
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? SUPPORT_ROUTING_RULE_RESOURCE_KIND,
+          resourceId: logEntry.resourceId ?? result?.ruleId ?? null,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,
+        }),
+      )
+    }
+    return response
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    const { translate } = await resolveTranslations()
+    logger.error('staff.support.fallback-project POST failed', { err })
+    getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.support_fallback_project_failed' })
+    return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })
+  }
+}
+
+const responseSchema = z.object({
+  ruleId: z.string().uuid().nullable(),
+  timeProjectId: z.string().uuid().nullable(),
+  created: z.boolean(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Create the support fallback project',
+  methods: {
+    POST: {
+      summary: 'Create the support fallback project and rule',
+      description:
+        'Creates the "Customer support" project (no customer, standard task statuses) and the organization fallback routing rule pointing at it. Idempotent: when a fallback rule already exists nothing is created and the existing rule is returned with `created: false`.',
+      responses: [
+        { status: 201, description: 'Fallback project and rule created', schema: responseSchema },
+        { status: 200, description: 'A fallback rule already existed', schema: responseSchema },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Missing staff.timesheets.settings.manage' },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/support-routing-rules/preview/route.ts

@@ -0,0 +1,248 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { StaffTimeProject } from '../../../../data/entities'
+import { resolveAssignmentGraceDaysFromContainer } from '../../../../lib/time-tracking/projectAssignment'
+import { projectReachesRecipientBeforeManagers } from '../../../../lib/time-tracking/workRecipients'
+import { loadSupportTicketCategories } from '../../../../lib/support/dictionaries'
+import {
+  loadSupportRoutingRules,
+  loadUsableSupportProjectIds,
+  resolveSupportRouteFromRules,
+  type SupportRoutingRuleView,
+} from '../../../../lib/support/routing'
+
+const logger = createLogger('staff').child({ component: 'api/timesheets/support-routing-rules/preview' })
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.settings.manage'] },
+}
+
+type RuleProblem = 'paused' | 'project_unusable' | 'category_missing' | null
+
+type UnnotifiedCountDb = {
+  staff_support_tickets: {
+    task_id: string
+    tenant_id: string
+    organization_id: string
+    unnotified_at: Date | null
+    deleted_at: Date | null
+  }
+  staff_time_tasks: {
+    id: string
+    tenant_id: string
+    organization_id: string
+    time_project_id: string
+    source: string
+    deleted_at: Date | null
+  }
+}
+
+async function countUnnotifiedTicketsByProject(
+  em: EntityManager,
+  scope: { tenantId: string; organizationId: string },
+): Promise<Map<string, number>> {
+  const rows = await em
+    .getKysely<UnnotifiedCountDb>()
+    .selectFrom('staff_support_tickets')
+    .innerJoin('staff_time_tasks', 'staff_time_tasks.id', 'staff_support_tickets.task_id')
+    .select(['staff_time_tasks.time_project_id as time_project_id'])
+    .select((builder) => builder.fn.countAll<string | number>().as('ticket_count'))
+    .where('staff_support_tickets.tenant_id', '=', scope.tenantId)
+    .where('staff_support_tickets.organization_id', '=', scope.organizationId)
+    .where('staff_support_tickets.deleted_at', 'is', null)
+    .where('staff_support_tickets.unnotified_at', 'is not', null)
+    .where('staff_time_tasks.tenant_id', '=', scope.tenantId)
+    .where('staff_time_tasks.organization_id', '=', scope.organizationId)
+    .where('staff_time_tasks.source', '=', 'portal')
+    .where('staff_time_tasks.deleted_at', 'is', null)
+    .groupBy('staff_time_tasks.time_project_id')
+    .execute()
+  const counts = new Map<string, number>()
+  for (const row of rows) {
+    const count = Number(row.ticket_count)
+    if (Number.isFinite(count) && count > 0) counts.set(row.time_project_id, count)
+  }
+  return counts
+}
+
+export async function GET(req: Request): Promise<Response> {
+  try {
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(req)
+    const { translate } = await resolveTranslations()
+    if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const tenantId = scope?.tenantId ?? auth.tenantId ?? null
+    const organizationId = scope?.selectedId ?? auth.orgId ?? null
+    if (!tenantId || !organizationId) {
+      throw new CrudHttpError(400, { error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.') })
+    }
+    const supportScope = { tenantId, organizationId }
+    const em = (container.resolve('em') as EntityManager).fork()
+    const [categories, rules] = await Promise.all([
+      loadSupportTicketCategories(em, supportScope),
+      loadSupportRoutingRules(em, supportScope),
+    ])
+    const projectIds = rules.map((rule) => rule.timeProjectId)
+    const usable = await loadUsableSupportProjectIds(em, supportScope, projectIds)
+    const projects = projectIds.length
+      ? await em.find(
+          StaffTimeProject,
+          { id: { $in: Array.from(new Set(projectIds)) }, tenantId, organizationId },
+          { fields: ['id', 'name', 'code', 'status', 'deletedAt', 'ownerUserId', 'defaultAssigneeStaffMemberId'] },
+        )
+      : []
+    const projectById = new Map(projects.map((project) => [project.id, project]))
+    const graceDays = await resolveAssignmentGraceDaysFromContainer(container, tenantId)
+    const [unnotifiedByProject, reachability] = await Promise.all([
+      countUnnotifiedTicketsByProject(em.fork(), supportScope),
+      Promise.all(
+        projects.map(async (project) => {
+          if (project.deletedAt) return [project.id, true] as const
+          const reaches = await projectReachesRecipientBeforeManagers(em.fork(), supportScope, project, { graceDays })
+          return [project.id, reaches] as const
+        }),
+      ),
+    ])
+    const reachesById = new Map<string, boolean>(reachability)
+    let unnotifiedTicketCount = 0
+    for (const count of unnotifiedByProject.values()) unnotifiedTicketCount += count
+    const categoryValues = new Set(categories.map((category) => category.value))
+    const fallbackRule = rules.find((rule) => rule.categoryValue === null) ?? null
+
+    const describeProject = (id: string) => {
+      const project = projectById.get(id)
+      return {
+        id,
+        name: project?.name ?? null,
+        code: project?.code ?? null,
+        status: project && !project.deletedAt ? project.status : 'deleted',
+        usable: usable.has(id),
+        nobodyNotified: usable.has(id) && reachesById.get(id) === false,
+        unnotifiedTicketCount: unnotifiedByProject.get(id) ?? 0,
+      }
+    }
+
+    const ruleVersion = (rule: SupportRoutingRuleView): string | null =>
+      rule.updatedAt instanceof Date ? rule.updatedAt.toISOString() : null
+
+    const ruleViews = rules.map((rule) => {
+      let problem: RuleProblem = null
+      if (rule.categoryValue !== null) {
+        if (!categoryValues.has(rule.categoryValue)) problem = 'category_missing'
+        else if (!rule.isActive) problem = 'paused'
+        else if (!usable.has(rule.timeProjectId)) problem = 'project_unusable'
+      } else if (!usable.has(rule.timeProjectId)) {
+        problem = 'project_unusable'
+      }
+      return {
+        id: rule.id,
+        categoryValue: rule.categoryValue,
+        isActive: rule.isActive,
+        isFallback: rule.categoryValue === null,
+        project: describeProject(rule.timeProjectId),
+        problem,
+        updatedAt: ruleVersion(rule),
+      }
+    })
+
+    const categoryViews = categories.map((category) => {
+      const route = resolveSupportRouteFromRules(rules, category.value, usable)
+      return {
+        value: category.value,
+        label: category.label,
+        route: route ? { via: route.via, project: describeProject(route.timeProjectId) } : null,
+      }
+    })
+
+    return NextResponse.json({
+      fallback: fallbackRule
+        ? { ruleId: fallbackRule.id, project: describeProject(fallbackRule.timeProjectId), updatedAt: ruleVersion(fallbackRule) }
+        : null,
+      rules: ruleViews,
+      categories: categoryViews,
+      unnotifiedTicketCount,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const { translate } = await resolveTranslations()
+    logger.error('staff.support.routing preview failed', { err })
+    getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.support_routing_preview_failed' })
+    return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })
+  }
+}
+
+const projectSchema = z.object({
+  id: z.string().uuid(),
+  name: z.string().nullable(),
+  code: z.string().nullable(),
+  status: z.string(),
+  usable: z.boolean(),
+  nobodyNotified: z
+    .boolean()
+    .optional()
+    .describe('True for a usable project with no active assigner, no usable default assignee and no owner: new-ticket notifications fall through to the organization project managers'),
+  unnotifiedTicketCount: z
+    .number()
+    .int()
+    .optional()
+    .describe('Live portal tickets in this project whose support notification reached nobody (`unnotified_at` set)'),
+})
+
+const ruleVersionSchema = z
+  .string()
+  .nullable()
+  .describe('The rule `updated_at` read in the same snapshot as its values; send it as the optimistic-lock expected version when editing or deleting the rule')
+
+const previewSchema = z.object({
+  fallback: z.object({ ruleId: z.string().uuid(), project: projectSchema, updatedAt: ruleVersionSchema }).nullable(),
+  rules: z.array(
+    z.object({
+      id: z.string().uuid(),
+      categoryValue: z.string().nullable(),
+      isActive: z.boolean(),
+      isFallback: z.boolean(),
+      project: projectSchema,
+      problem: z.enum(['paused', 'project_unusable', 'category_missing']).nullable(),
+      updatedAt: ruleVersionSchema,
+    }),
+  ),
+  categories: z.array(
+    z.object({
+      value: z.string(),
+      label: z.string(),
+      route: z.object({ via: z.enum(['category', 'fallback']), project: projectSchema }).nullable(),
+    }),
+  ),
+  unnotifiedTicketCount: z
+    .number()
+    .int()
+    .optional()
+    .describe('Live portal tickets in the organization whose support notification reached nobody (`unnotified_at` set)'),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Preview support ticket routing',
+  methods: {
+    GET: {
+      summary: 'Preview support ticket routing',
+      description:
+        'Returns the fallback rule, every routing rule with the problem that makes it fall back (paused, unusable project, deleted category), the project each support category routes to right now, which routing targets would notify nobody before the organization project managers (`project.nobodyNotified`), how many live tickets were not notified to anyone (`project.unnotifiedTicketCount`, `unnotifiedTicketCount`), and each rule `updatedAt` version token read together with its values.',
+      responses: [{ status: 200, description: 'Routing preview', schema: previewSchema }],
+      errors: [
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Missing staff.timesheets.settings.manage' },
+      ],
+    },
+  },
+}