@open-mercato/core 0.10.1-develop.7717.1.2befe9c634 → 0.10.1-develop.7721.1.b5c4a00a68

package/dist/modules/staff/api/portal/support-tickets/[id]/attachments/route.js

@@ -0,0 +1,299 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { emitCrudSideEffects } from "@open-mercato/shared/lib/commands/helpers";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import {
+  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,
+  PORTAL_SUPPORT_TICKETS_VIEW_FEATURE,
+  loadPortalOwnedTicket,
+  resolveSupportPortalScope
+} from "../../../../../lib/support/portalTickets.js";
+import {
+  SUPPORT_TICKET_RESOURCE_KIND,
+  checkPortalRateLimit,
+  portalErrorResponse,
+  readPathId
+} from "../../../../../lib/support/portalRoute.js";
+import {
+  CUSTOMER_VISIBLE_ATTACHMENT_TAG,
+  SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,
+  customerUploadTag,
+  translateSupportUploadError
+} from "../../../../../lib/support/attachments.js";
+import {
+  listCustomerVisibleAttachments,
+  loadPortalAttachmentsApi,
+  portalAttachmentAuth,
+  readAttachmentTags,
+  serializePortalAttachment,
+  portalSupportAttachmentItemSchema
+} from "../../../../../lib/support/portalAttachments.js";
+import { emitSupportAttachmentActivity } from "../../../../../lib/support/supportActivity.js";
+const logger = createLogger("staff").child({ component: "api/portal/support-tickets/attachments" });
+const metadata = {
+  GET: { requireAuth: false },
+  POST: { requireAuth: false },
+  DELETE: { requireAuth: false }
+};
+const uploadGuardPayloadSchema = z.object({
+  fileName: z.string().trim().min(1).max(255),
+  fileSize: z.number().int().nonnegative(),
+  mimeType: z.string().max(255)
+});
+function unavailable() {
+  return NextResponse.json({ ok: false, error: "staff.support.errors.attachmentsUnavailable" }, { status: 503 });
+}
+function notFound() {
+  return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+}
+async function resolveDriverFactory(api, scope) {
+  try {
+    const resolved = scope.container.resolve("storageDriverFactory");
+    return resolved ?? new api.StorageDriverFactory(scope.em);
+  } catch {
+    return new api.StorageDriverFactory(scope.em);
+  }
+}
+async function loadVisibleAttachment(api, scope, taskId, attachmentId) {
+  const attachment = await findOneWithDecryption(
+    scope.em,
+    api.Attachment,
+    {
+      id: attachmentId,
+      entityId: SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,
+      recordId: taskId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId
+    },
+    {},
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  );
+  if (!attachment) return null;
+  return readAttachmentTags(api, attachment).includes(CUSTOMER_VISIBLE_ATTACHMENT_TAG) ? attachment : null;
+}
+async function GET(req) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_VIEW_FEATURE);
+    if (scope instanceof Response) return scope;
+    const taskId = readPathId(req, /\/support-tickets\/([^/]+)\/attachments/);
+    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null;
+    if (!owned) return notFound();
+    const api = await loadPortalAttachmentsApi();
+    if (!api) return unavailable();
+    const attachmentId = new URL(req.url).searchParams.get("attachmentId");
+    if (attachmentId) {
+      if (!z.string().uuid().safeParse(attachmentId).success) return notFound();
+      const attachment = await loadVisibleAttachment(api, scope, owned.task.id, attachmentId);
+      if (!attachment) return notFound();
+      const partition = await scope.em.findOne(api.AttachmentPartition, { code: attachment.partitionCode });
+      if (!partition) return notFound();
+      if (!api.checkAttachmentAccess(portalAttachmentAuth(scope), attachment, partition, { requireAuthForPublic: true }).ok) return notFound();
+      const driver = await (await resolveDriverFactory(api, scope)).resolveForPartition(attachment.partitionCode, {
+        tenantId: attachment.tenantId ?? scope.tenantId,
+        organizationId: attachment.organizationId ?? scope.organizationId
+      });
+      let buffer;
+      try {
+        buffer = (await driver.read(attachment.partitionCode, attachment.storagePath)).buffer;
+      } catch {
+        return notFound();
+      }
+      const headers = {
+        "Cache-Control": "private, max-age=60",
+        "Content-Security-Policy": "default-src 'none'; sandbox",
+        "Content-Type": "application/octet-stream",
+        "Content-Disposition": `attachment; filename="${api.slugifyAttachmentFileName(attachment.fileName)}"`,
+        "X-Content-Type-Options": "nosniff"
+      };
+      if (attachment.fileSize > 0) headers["Content-Length"] = String(attachment.fileSize);
+      return new NextResponse(new Uint8Array(buffer), { status: 200, headers });
+    }
+    const canManage = await scope.hasFeature(PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE);
+    return NextResponse.json({ items: await listCustomerVisibleAttachments(api, scope, owned.task.id, canManage) });
+  } catch (err) {
+    return portalErrorResponse(err, "staff portal support attachments GET failed");
+  }
+}
+async function POST(req) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE);
+    if (scope instanceof Response) return scope;
+    const taskId = readPathId(req, /\/support-tickets\/([^/]+)\/attachments/);
+    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null;
+    if (!owned) return notFound();
+    const limited = await checkPortalRateLimit(scope, "upload");
+    if (limited) return limited;
+    const api = await loadPortalAttachmentsApi();
+    if (!api) return unavailable();
+    const { t } = await resolveTranslations();
+    if (!(req.headers.get("content-type") || "").toLowerCase().includes("multipart/form-data")) {
+      return NextResponse.json({ ok: false, error: t("staff.errors.invalid_request", "Invalid request") }, { status: 400 });
+    }
+    if (!api.isMultipartRequestWithinUploadLimit(req.headers.get("content-length"))) {
+      return NextResponse.json({ ok: false, error: t("attachments.errors.maxUploadSize", "Attachment exceeds the maximum upload size.") }, { status: 413 });
+    }
+    const form = await req.formData();
+    const file = form.get("file");
+    if (!(file instanceof File)) {
+      return NextResponse.json({ ok: false, error: t("staff.support.errors.fileRequired", "Choose a file before uploading.") }, { status: 400 });
+    }
+    const uploadPayload = { fileName: file.name, fileSize: file.size, mimeType: file.type };
+    const guarded = await runRouteMutationGuards({
+      container: scope.container,
+      req,
+      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },
+      input: {
+        resourceKind: SUPPORT_TICKET_RESOURCE_KIND,
+        resourceId: owned.task.id,
+        operation: "update",
+        mutationPayload: uploadPayload
+      }
+    });
+    if (!guarded.ok) return guarded.response;
+    const effectiveUpload = guarded.modifiedPayload ? uploadGuardPayloadSchema.parse({ ...uploadPayload, ...guarded.modifiedPayload, fileSize: file.size }) : uploadPayload;
+    let uploadService = null;
+    try {
+      uploadService = scope.container.resolve("attachmentScopedUploadService");
+    } catch {
+      uploadService = null;
+    }
+    if (!uploadService) return unavailable();
+    let attachment;
+    try {
+      attachment = await uploadService.upload({
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        entityId: SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,
+        recordId: owned.task.id,
+        fileName: effectiveUpload.fileName,
+        buffer: Buffer.from(await file.arrayBuffer()),
+        declaredMimeType: effectiveUpload.mimeType,
+        tags: [CUSTOMER_VISIBLE_ATTACHMENT_TAG, customerUploadTag(scope.auth.sub)]
+      });
+    } catch (error) {
+      if (api.isScopedAttachmentUploadError(error)) {
+        return NextResponse.json(
+          { ok: false, error: translateSupportUploadError(error.code, t), code: error.code },
+          { status: error.status }
+        );
+      }
+      throw error;
+    }
+    await guarded.runAfterSuccess();
+    emitSupportAttachmentActivity(owned.task, owned.ticket, "attachment_added", attachment.id);
+    return NextResponse.json({ ok: true, item: serializePortalAttachment(api, attachment, owned.task.id, scope.auth.sub, true) }, { status: 201 });
+  } catch (err) {
+    return portalErrorResponse(err, "staff portal support attachments POST failed");
+  }
+}
+async function DELETE(req) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE);
+    if (scope instanceof Response) return scope;
+    const taskId = readPathId(req, /\/support-tickets\/([^/]+)\/attachments/);
+    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null;
+    if (!owned) return notFound();
+    const api = await loadPortalAttachmentsApi();
+    if (!api) return unavailable();
+    const attachmentId = new URL(req.url).searchParams.get("attachmentId");
+    if (!attachmentId || !z.string().uuid().safeParse(attachmentId).success) return notFound();
+    const attachment = await loadVisibleAttachment(api, scope, owned.task.id, attachmentId);
+    if (!attachment) return notFound();
+    if (!readAttachmentTags(api, attachment).includes(customerUploadTag(scope.auth.sub))) {
+      return NextResponse.json({ ok: false, error: "staff.support.errors.attachmentNotYours" }, { status: 403 });
+    }
+    const guarded = await runRouteMutationGuards({
+      container: scope.container,
+      req,
+      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },
+      input: { resourceKind: SUPPORT_TICKET_RESOURCE_KIND, resourceId: owned.task.id, operation: "delete", mutationPayload: { attachmentId } }
+    });
+    if (!guarded.ok) return guarded.response;
+    await scope.em.remove(attachment).flush();
+    await api.clearAttachmentThumbnailCache(attachment.partitionCode, attachment.id).catch((err) => {
+      logger.error("staff portal support attachment thumbnail cleanup failed", { err, attachmentId });
+      getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.portal_attachment_thumbnail_cleanup_failed" });
+    });
+    if (attachment.storagePath) {
+      try {
+        const driver = await (await resolveDriverFactory(api, scope)).resolveForPartition(attachment.partitionCode, {
+          tenantId: attachment.tenantId ?? scope.tenantId,
+          organizationId: attachment.organizationId ?? scope.organizationId
+        });
+        await driver.delete(attachment.partitionCode, attachment.storagePath);
+      } catch (err) {
+        logger.error("staff portal support attachment storage cleanup failed", { err, attachmentId });
+        getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.portal_attachment_storage_cleanup_failed" });
+      }
+    }
+    try {
+      const dataEngine = scope.container.resolve("dataEngine");
+      await emitCrudSideEffects({
+        dataEngine,
+        action: "deleted",
+        entity: attachment,
+        identifiers: { id: attachment.id, organizationId: attachment.organizationId ?? null, tenantId: attachment.tenantId ?? null },
+        events: api.attachmentCrudEvents,
+        indexer: api.attachmentCrudIndexer
+      });
+      await dataEngine.flushOrmEntityChanges();
+    } catch (err) {
+      logger.error("staff portal support attachment side effects failed", { err, attachmentId });
+      getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.portal_attachment_side_effects_failed" });
+    }
+    await guarded.runAfterSuccess();
+    emitSupportAttachmentActivity(owned.task, owned.ticket, "attachment_removed", attachmentId);
+    return NextResponse.json({ ok: true });
+  } catch (err) {
+    return portalErrorResponse(err, "staff portal support attachments DELETE failed");
+  }
+}
+const attachmentItemSchema = portalSupportAttachmentItemSchema;
+const openApi = {
+  tag: "Staff Portal",
+  summary: "Support ticket attachments",
+  methods: {
+    GET: {
+      summary: "List or download support ticket files",
+      description: "Lists customer-visible files of a ticket the caller owns, or streams one when `attachmentId` is given. Staff files that were not shared with the customer are never listed.",
+      responses: [{ status: 200, description: "Files", schema: z.object({ items: z.array(attachmentItemSchema) }) }],
+      errors: [
+        { status: 401, description: "No portal session" },
+        { status: 404, description: "Ticket or file not found" },
+        { status: 503, description: "Attachments module unavailable" }
+      ]
+    },
+    POST: {
+      summary: "Upload a file to a support ticket",
+      description: "Multipart upload (`file`). The file is tagged customer-visible and as uploaded by the caller. Rate limited per customer user; rejected files answer with a translated `error` and the machine `code`.",
+      responses: [{ status: 201, description: "Uploaded", schema: z.object({ ok: z.literal(true), item: attachmentItemSchema }) }],
+      errors: [
+        { status: 403, description: "Missing portal.support_tickets.manage" },
+        { status: 404, description: "Ticket not found" },
+        { status: 413, description: "File too large" },
+        { status: 429, description: "Upload rate limit exceeded (per customer user)" }
+      ]
+    },
+    DELETE: {
+      summary: "Delete a file you uploaded",
+      description: "Deletes a file the caller uploaded (`attachmentId` query). Files uploaded by staff or by other customer users answer 403.",
+      responses: [{ status: 200, description: "Deleted", schema: z.object({ ok: z.literal(true) }) }],
+      errors: [
+        { status: 403, description: "The file was not uploaded by the caller" },
+        { status: 404, description: "Ticket or file not found" }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/portal/support-tickets/[id]/attachments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/staff/api/portal/support-tickets/%5Bid%5D/attachments/route.ts"],
+  "sourcesContent": ["/**\n * `GET|POST|DELETE /api/staff/portal/support-tickets/{id}/attachments`\n *\n * Modeled on `warranty_claims/api/portal/attachments/route.ts`, with two\n * differences: the attachments module is loaded with a dynamic import (staff keeps\n * no static edge to it, and answers 503 when it is absent), and a customer may only\n * delete files they uploaded themselves \u2014 every customer upload is tagged\n * `customer-upload:<customerUserId>` because the attachment row has no uploader\n * column. Only files tagged `customer-visible` are ever listed or streamed.\n */\nimport { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { DataEngine } from '@open-mercato/shared/lib/data/engine'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { Attachment as AttachmentEntity } from '@open-mercato/core/modules/attachments/data/entities'\nimport type { ScopedAttachmentUploadService } from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'\nimport {\n  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,\n  PORTAL_SUPPORT_TICKETS_VIEW_FEATURE,\n  loadPortalOwnedTicket,\n  resolveSupportPortalScope,\n  type SupportPortalScope,\n} from '../../../../../lib/support/portalTickets'\nimport {\n  SUPPORT_TICKET_RESOURCE_KIND,\n  checkPortalRateLimit,\n  portalErrorResponse,\n  readPathId,\n} from '../../../../../lib/support/portalRoute'\nimport {\n  CUSTOMER_VISIBLE_ATTACHMENT_TAG,\n  SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,\n  customerUploadTag,\n  translateSupportUploadError,\n} from '../../../../../lib/support/attachments'\nimport {\n  listCustomerVisibleAttachments,\n  loadPortalAttachmentsApi,\n  portalAttachmentAuth,\n  readAttachmentTags,\n  serializePortalAttachment,\n  portalSupportAttachmentItemSchema,\n  type PortalAttachmentsApi,\n} from '../../../../../lib/support/portalAttachments'\nimport { emitSupportAttachmentActivity } from '../../../../../lib/support/supportActivity'\n\nconst logger = createLogger('staff').child({ component: 'api/portal/support-tickets/attachments' })\n\nexport const metadata = {\n  GET: { requireAuth: false },\n  POST: { requireAuth: false },\n  DELETE: { requireAuth: false },\n}\n\nconst uploadGuardPayloadSchema = z.object({\n  fileName: z.string().trim().min(1).max(255),\n  fileSize: z.number().int().nonnegative(),\n  mimeType: z.string().max(255),\n})\n\nfunction unavailable(): Response {\n  return NextResponse.json({ ok: false, error: 'staff.support.errors.attachmentsUnavailable' }, { status: 503 })\n}\n\nfunction notFound(): Response {\n  return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n}\n\nasync function resolveDriverFactory(api: PortalAttachmentsApi, scope: SupportPortalScope) {\n  try {\n    const resolved = scope.container.resolve('storageDriverFactory') as InstanceType<PortalAttachmentsApi['StorageDriverFactory']> | null\n    return resolved ?? new api.StorageDriverFactory(scope.em)\n  } catch {\n    return new api.StorageDriverFactory(scope.em)\n  }\n}\n\nasync function loadVisibleAttachment(\n  api: PortalAttachmentsApi,\n  scope: SupportPortalScope,\n  taskId: string,\n  attachmentId: string,\n): Promise<AttachmentEntity | null> {\n  const attachment = await findOneWithDecryption(\n    scope.em,\n    api.Attachment,\n    {\n      id: attachmentId,\n      entityId: SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,\n      recordId: taskId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n    },\n    {},\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!attachment) return null\n  return readAttachmentTags(api, attachment).includes(CUSTOMER_VISIBLE_ATTACHMENT_TAG) ? attachment : null\n}\n\nexport async function GET(req: Request) {\n  try {\n    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_VIEW_FEATURE)\n    if (scope instanceof Response) return scope\n    const taskId = readPathId(req, /\\/support-tickets\\/([^/]+)\\/attachments/)\n    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null\n    if (!owned) return notFound()\n    const api = await loadPortalAttachmentsApi()\n    if (!api) return unavailable()\n    const attachmentId = new URL(req.url).searchParams.get('attachmentId')\n    if (attachmentId) {\n      if (!z.string().uuid().safeParse(attachmentId).success) return notFound()\n      const attachment = await loadVisibleAttachment(api, scope, owned.task.id, attachmentId)\n      if (!attachment) return notFound()\n      const partition = await scope.em.findOne(api.AttachmentPartition, { code: attachment.partitionCode })\n      if (!partition) return notFound()\n      if (!api.checkAttachmentAccess(portalAttachmentAuth(scope), attachment, partition, { requireAuthForPublic: true }).ok) return notFound()\n      const driver = await (await resolveDriverFactory(api, scope)).resolveForPartition(attachment.partitionCode, {\n        tenantId: attachment.tenantId ?? scope.tenantId,\n        organizationId: attachment.organizationId ?? scope.organizationId,\n      })\n      let buffer: Buffer\n      try {\n        buffer = (await driver.read(attachment.partitionCode, attachment.storagePath)).buffer\n      } catch {\n        return notFound()\n      }\n      const headers: Record<string, string> = {\n        'Cache-Control': 'private, max-age=60',\n        'Content-Security-Policy': \"default-src 'none'; sandbox\",\n        'Content-Type': 'application/octet-stream',\n        'Content-Disposition': `attachment; filename=\"${api.slugifyAttachmentFileName(attachment.fileName)}\"`,\n        'X-Content-Type-Options': 'nosniff',\n      }\n      if (attachment.fileSize > 0) headers['Content-Length'] = String(attachment.fileSize)\n      return new NextResponse(new Uint8Array(buffer), { status: 200, headers })\n    }\n    const canManage = await scope.hasFeature(PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE)\n    return NextResponse.json({ items: await listCustomerVisibleAttachments(api, scope, owned.task.id, canManage) })\n  } catch (err) {\n    return portalErrorResponse(err, 'staff portal support attachments GET failed')\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE)\n    if (scope instanceof Response) return scope\n    const taskId = readPathId(req, /\\/support-tickets\\/([^/]+)\\/attachments/)\n    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null\n    if (!owned) return notFound()\n    const limited = await checkPortalRateLimit(scope, 'upload')\n    if (limited) return limited\n    const api = await loadPortalAttachmentsApi()\n    if (!api) return unavailable()\n    const { t } = await resolveTranslations()\n    if (!(req.headers.get('content-type') || '').toLowerCase().includes('multipart/form-data')) {\n      return NextResponse.json({ ok: false, error: t('staff.errors.invalid_request', 'Invalid request') }, { status: 400 })\n    }\n    if (!api.isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {\n      return NextResponse.json({ ok: false, error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.') }, { status: 413 })\n    }\n    const form = await req.formData()\n    const file = form.get('file')\n    if (!(file instanceof File)) {\n      return NextResponse.json({ ok: false, error: t('staff.support.errors.fileRequired', 'Choose a file before uploading.') }, { status: 400 })\n    }\n    const uploadPayload = { fileName: file.name, fileSize: file.size, mimeType: file.type }\n    const guarded = await runRouteMutationGuards({\n      container: scope.container,\n      req,\n      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },\n      input: {\n        resourceKind: SUPPORT_TICKET_RESOURCE_KIND,\n        resourceId: owned.task.id,\n        operation: 'update',\n        mutationPayload: uploadPayload,\n      },\n    })\n    if (!guarded.ok) return guarded.response\n    const effectiveUpload = guarded.modifiedPayload\n      ? uploadGuardPayloadSchema.parse({ ...uploadPayload, ...guarded.modifiedPayload, fileSize: file.size })\n      : uploadPayload\n    let uploadService: ScopedAttachmentUploadService | null = null\n    try {\n      uploadService = scope.container.resolve('attachmentScopedUploadService') as ScopedAttachmentUploadService\n    } catch {\n      uploadService = null\n    }\n    if (!uploadService) return unavailable()\n    let attachment: AttachmentEntity\n    try {\n      attachment = await uploadService.upload({\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        entityId: SUPPORT_TICKET_ATTACHMENT_ENTITY_ID,\n        recordId: owned.task.id,\n        fileName: effectiveUpload.fileName,\n        buffer: Buffer.from(await file.arrayBuffer()),\n        declaredMimeType: effectiveUpload.mimeType,\n        tags: [CUSTOMER_VISIBLE_ATTACHMENT_TAG, customerUploadTag(scope.auth.sub)],\n      })\n    } catch (error) {\n      if (api.isScopedAttachmentUploadError(error)) {\n        return NextResponse.json(\n          { ok: false, error: translateSupportUploadError(error.code, t), code: error.code },\n          { status: error.status },\n        )\n      }\n      throw error\n    }\n    await guarded.runAfterSuccess()\n    emitSupportAttachmentActivity(owned.task, owned.ticket, 'attachment_added', attachment.id)\n    return NextResponse.json({ ok: true, item: serializePortalAttachment(api, attachment, owned.task.id, scope.auth.sub, true) }, { status: 201 })\n  } catch (err) {\n    return portalErrorResponse(err, 'staff portal support attachments POST failed')\n  }\n}\n\nexport async function DELETE(req: Request) {\n  try {\n    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE)\n    if (scope instanceof Response) return scope\n    const taskId = readPathId(req, /\\/support-tickets\\/([^/]+)\\/attachments/)\n    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null\n    if (!owned) return notFound()\n    const api = await loadPortalAttachmentsApi()\n    if (!api) return unavailable()\n    const attachmentId = new URL(req.url).searchParams.get('attachmentId')\n    if (!attachmentId || !z.string().uuid().safeParse(attachmentId).success) return notFound()\n    const attachment = await loadVisibleAttachment(api, scope, owned.task.id, attachmentId)\n    if (!attachment) return notFound()\n    if (!readAttachmentTags(api, attachment).includes(customerUploadTag(scope.auth.sub))) {\n      return NextResponse.json({ ok: false, error: 'staff.support.errors.attachmentNotYours' }, { status: 403 })\n    }\n    const guarded = await runRouteMutationGuards({\n      container: scope.container,\n      req,\n      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },\n      input: { resourceKind: SUPPORT_TICKET_RESOURCE_KIND, resourceId: owned.task.id, operation: 'delete', mutationPayload: { attachmentId } },\n    })\n    if (!guarded.ok) return guarded.response\n    await scope.em.remove(attachment).flush()\n    await api.clearAttachmentThumbnailCache(attachment.partitionCode, attachment.id).catch((err) => {\n      logger.error('staff portal support attachment thumbnail cleanup failed', { err, attachmentId })\n      getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.portal_attachment_thumbnail_cleanup_failed' })\n    })\n    if (attachment.storagePath) {\n      try {\n        const driver = await (await resolveDriverFactory(api, scope)).resolveForPartition(attachment.partitionCode, {\n          tenantId: attachment.tenantId ?? scope.tenantId,\n          organizationId: attachment.organizationId ?? scope.organizationId,\n        })\n        await driver.delete(attachment.partitionCode, attachment.storagePath)\n      } catch (err) {\n        logger.error('staff portal support attachment storage cleanup failed', { err, attachmentId })\n        getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.portal_attachment_storage_cleanup_failed' })\n      }\n    }\n    try {\n      const dataEngine = scope.container.resolve('dataEngine') as DataEngine\n      await emitCrudSideEffects({\n        dataEngine,\n        action: 'deleted',\n        entity: attachment,\n        identifiers: { id: attachment.id, organizationId: attachment.organizationId ?? null, tenantId: attachment.tenantId ?? null },\n        events: api.attachmentCrudEvents,\n        indexer: api.attachmentCrudIndexer,\n      })\n      await dataEngine.flushOrmEntityChanges()\n    } catch (err) {\n      logger.error('staff portal support attachment side effects failed', { err, attachmentId })\n      getTelemetryRuntime()?.reportError(err, { module: 'staff', code: 'staff.portal_attachment_side_effects_failed' })\n    }\n    await guarded.runAfterSuccess()\n    emitSupportAttachmentActivity(owned.task, owned.ticket, 'attachment_removed', attachmentId)\n    return NextResponse.json({ ok: true })\n  } catch (err) {\n    return portalErrorResponse(err, 'staff portal support attachments DELETE failed')\n  }\n}\n\nconst attachmentItemSchema = portalSupportAttachmentItemSchema\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff Portal',\n  summary: 'Support ticket attachments',\n  methods: {\n    GET: {\n      summary: 'List or download support ticket files',\n      description:\n        'Lists customer-visible files of a ticket the caller owns, or streams one when `attachmentId` is given. Staff files that were not shared with the customer are never listed.',\n      responses: [{ status: 200, description: 'Files', schema: z.object({ items: z.array(attachmentItemSchema) }) }],\n      errors: [\n        { status: 401, description: 'No portal session' },\n        { status: 404, description: 'Ticket or file not found' },\n        { status: 503, description: 'Attachments module unavailable' },\n      ],\n    },\n    POST: {\n      summary: 'Upload a file to a support ticket',\n      description: 'Multipart upload (`file`). The file is tagged customer-visible and as uploaded by the caller. Rate limited per customer user; rejected files answer with a translated `error` and the machine `code`.',\n      responses: [{ status: 201, description: 'Uploaded', schema: z.object({ ok: z.literal(true), item: attachmentItemSchema }) }],\n      errors: [\n        { status: 403, description: 'Missing portal.support_tickets.manage' },\n        { status: 404, description: 'Ticket not found' },\n        { status: 413, description: 'File too large' },\n        { status: 429, description: 'Upload rate limit exceeded (per customer user)' },\n      ],\n    },\n    DELETE: {\n      summary: 'Delete a file you uploaded',\n      description: 'Deletes a file the caller uploaded (`attachmentId` query). Files uploaded by staff or by other customer users answer 403.',\n      responses: [{ status: 200, description: 'Deleted', schema: z.object({ ok: z.literal(true) }) }],\n      errors: [\n        { status: 403, description: 'The file was not uploaded by the caller' },\n        { status: 404, description: 'Ticket or file not found' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAUA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,6BAA6B;AACtC,SAAS,oBAAoB;AAC7B,SAAS,2BAA2B;AAIpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OAEK;AACP,SAAS,qCAAqC;AAE9C,MAAM,SAAS,aAAa,OAAO,EAAE,MAAM,EAAE,WAAW,yCAAyC,CAAC;AAE3F,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAAA,EAC1B,MAAM,EAAE,aAAa,MAAM;AAAA,EAC3B,QAAQ,EAAE,aAAa,MAAM;AAC/B;AAEA,MAAM,2BAA2B,EAAE,OAAO;AAAA,EACxC,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG;AAAA,EAC1C,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,YAAY;AAAA,EACvC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAG;AAC9B,CAAC;AAED,SAAS,cAAwB;AAC/B,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,8CAA8C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC/G;AAEA,SAAS,WAAqB;AAC5B,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF;AAEA,eAAe,qBAAqB,KAA2B,OAA2B;AACxF,MAAI;AACF,UAAM,WAAW,MAAM,UAAU,QAAQ,sBAAsB;AAC/D,WAAO,YAAY,IAAI,IAAI,qBAAqB,MAAM,EAAE;AAAA,EAC1D,QAAQ;AACN,WAAO,IAAI,IAAI,qBAAqB,MAAM,EAAE;AAAA,EAC9C;AACF;AAEA,eAAe,sBACb,KACA,OACA,QACA,cACkC;AAClC,QAAM,aAAa,MAAM;AAAA,IACvB,MAAM;AAAA,IACN,IAAI;AAAA,IACJ;AAAA,MACE,IAAI;AAAA,MACJ,UAAU;AAAA,MACV,UAAU;AAAA,MACV,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,IACxB;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,WAAY,QAAO;AACxB,SAAO,mBAAmB,KAAK,UAAU,EAAE,SAAS,+BAA+B,IAAI,aAAa;AACtG;AAEA,eAAsB,IAAI,KAAc;AACtC,MAAI;AACF,UAAM,QAAQ,MAAM,0BAA0B,KAAK,mCAAmC;AACtF,QAAI,iBAAiB,SAAU,QAAO;AACtC,UAAM,SAAS,WAAW,KAAK,yCAAyC;AACxE,UAAM,QAAQ,SAAS,MAAM,sBAAsB,OAAO,MAAM,IAAI;AACpE,QAAI,CAAC,MAAO,QAAO,SAAS;AAC5B,UAAM,MAAM,MAAM,yBAAyB;AAC3C,QAAI,CAAC,IAAK,QAAO,YAAY;AAC7B,UAAM,eAAe,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,cAAc;AACrE,QAAI,cAAc;AAChB,UAAI,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,YAAY,EAAE,QAAS,QAAO,SAAS;AACxE,YAAM,aAAa,MAAM,sBAAsB,KAAK,OAAO,MAAM,KAAK,IAAI,YAAY;AACtF,UAAI,CAAC,WAAY,QAAO,SAAS;AACjC,YAAM,YAAY,MAAM,MAAM,GAAG,QAAQ,IAAI,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AACpG,UAAI,CAAC,UAAW,QAAO,SAAS;AAChC,UAAI,CAAC,IAAI,sBAAsB,qBAAqB,KAAK,GAAG,YAAY,WAAW,EAAE,sBAAsB,KAAK,CAAC,EAAE,GAAI,QAAO,SAAS;AACvI,YAAM,SAAS,OAAO,MAAM,qBAAqB,KAAK,KAAK,GAAG,oBAAoB,WAAW,eAAe;AAAA,QAC1G,UAAU,WAAW,YAAY,MAAM;AAAA,QACvC,gBAAgB,WAAW,kBAAkB,MAAM;AAAA,MACrD,CAAC;AACD,UAAI;AACJ,UAAI;AACF,kBAAU,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW,GAAG;AAAA,MACjF,QAAQ;AACN,eAAO,SAAS;AAAA,MAClB;AACA,YAAM,UAAkC;AAAA,QACtC,iBAAiB;AAAA,QACjB,2BAA2B;AAAA,QAC3B,gBAAgB;AAAA,QAChB,uBAAuB,yBAAyB,IAAI,0BAA0B,WAAW,QAAQ,CAAC;AAAA,QAClG,0BAA0B;AAAA,MAC5B;AACA,UAAI,WAAW,WAAW,EAAG,SAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AACnF,aAAO,IAAI,aAAa,IAAI,WAAW,MAAM,GAAG,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAAA,IAC1E;AACA,UAAM,YAAY,MAAM,MAAM,WAAW,qCAAqC;AAC9E,WAAO,aAAa,KAAK,EAAE,OAAO,MAAM,+BAA+B,KAAK,OAAO,MAAM,KAAK,IAAI,SAAS,EAAE,CAAC;AAAA,EAChH,SAAS,KAAK;AACZ,WAAO,oBAAoB,KAAK,6CAA6C;AAAA,EAC/E;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,0BAA0B,KAAK,qCAAqC;AACxF,QAAI,iBAAiB,SAAU,QAAO;AACtC,UAAM,SAAS,WAAW,KAAK,yCAAyC;AACxE,UAAM,QAAQ,SAAS,MAAM,sBAAsB,OAAO,MAAM,IAAI;AACpE,QAAI,CAAC,MAAO,QAAO,SAAS;AAC5B,UAAM,UAAU,MAAM,qBAAqB,OAAO,QAAQ;AAC1D,QAAI,QAAS,QAAO;AACpB,UAAM,MAAM,MAAM,yBAAyB;AAC3C,QAAI,CAAC,IAAK,QAAO,YAAY;AAC7B,UAAM,EAAE,EAAE,IAAI,MAAM,oBAAoB;AACxC,QAAI,EAAE,IAAI,QAAQ,IAAI,cAAc,KAAK,IAAI,YAAY,EAAE,SAAS,qBAAqB,GAAG;AAC1F,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,EAAE,gCAAgC,iBAAiB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtH;AACA,QAAI,CAAC,IAAI,oCAAoC,IAAI,QAAQ,IAAI,gBAAgB,CAAC,GAAG;AAC/E,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,EAAE,oCAAoC,6CAA6C,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACtJ;AACA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,OAAO,KAAK,IAAI,MAAM;AAC5B,QAAI,EAAE,gBAAgB,OAAO;AAC3B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,EAAE,qCAAqC,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3I;AACA,UAAM,gBAAgB,EAAE,UAAU,KAAK,MAAM,UAAU,KAAK,MAAM,UAAU,KAAK,KAAK;AACtF,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,MAAM,EAAE,QAAQ,MAAM,KAAK,KAAK,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,cAAc,CAAC,EAAE;AAAA,MACjH,OAAO;AAAA,QACL,cAAc;AAAA,QACd,YAAY,MAAM,KAAK;AAAA,QACvB,WAAW;AAAA,QACX,iBAAiB;AAAA,MACnB;AAAA,IACF,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,kBAAkB,QAAQ,kBAC5B,yBAAyB,MAAM,EAAE,GAAG,eAAe,GAAG,QAAQ,iBAAiB,UAAU,KAAK,KAAK,CAAC,IACpG;AACJ,QAAI,gBAAsD;AAC1D,QAAI;AACF,sBAAgB,MAAM,UAAU,QAAQ,+BAA+B;AAAA,IACzE,QAAQ;AACN,sBAAgB;AAAA,IAClB;AACA,QAAI,CAAC,cAAe,QAAO,YAAY;AACvC,QAAI;AACJ,QAAI;AACF,mBAAa,MAAM,cAAc,OAAO;AAAA,QACtC,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,UAAU;AAAA,QACV,UAAU,MAAM,KAAK;AAAA,QACrB,UAAU,gBAAgB;AAAA,QAC1B,QAAQ,OAAO,KAAK,MAAM,KAAK,YAAY,CAAC;AAAA,QAC5C,kBAAkB,gBAAgB;AAAA,QAClC,MAAM,CAAC,iCAAiC,kBAAkB,MAAM,KAAK,GAAG,CAAC;AAAA,MAC3E,CAAC;AAAA,IACH,SAAS,OAAO;AACd,UAAI,IAAI,8BAA8B,KAAK,GAAG;AAC5C,eAAO,aAAa;AAAA,UAClB,EAAE,IAAI,OAAO,OAAO,4BAA4B,MAAM,MAAM,CAAC,GAAG,MAAM,MAAM,KAAK;AAAA,UACjF,EAAE,QAAQ,MAAM,OAAO;AAAA,QACzB;AAAA,MACF;AACA,YAAM;AAAA,IACR;AACA,UAAM,QAAQ,gBAAgB;AAC9B,kCAA8B,MAAM,MAAM,MAAM,QAAQ,oBAAoB,WAAW,EAAE;AACzF,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,0BAA0B,KAAK,YAAY,MAAM,KAAK,IAAI,MAAM,KAAK,KAAK,IAAI,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/I,SAAS,KAAK;AACZ,WAAO,oBAAoB,KAAK,8CAA8C;AAAA,EAChF;AACF;AAEA,eAAsB,OAAO,KAAc;AACzC,MAAI;AACF,UAAM,QAAQ,MAAM,0BAA0B,KAAK,qCAAqC;AACxF,QAAI,iBAAiB,SAAU,QAAO;AACtC,UAAM,SAAS,WAAW,KAAK,yCAAyC;AACxE,UAAM,QAAQ,SAAS,MAAM,sBAAsB,OAAO,MAAM,IAAI;AACpE,QAAI,CAAC,MAAO,QAAO,SAAS;AAC5B,UAAM,MAAM,MAAM,yBAAyB;AAC3C,QAAI,CAAC,IAAK,QAAO,YAAY;AAC7B,UAAM,eAAe,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,IAAI,cAAc;AACrE,QAAI,CAAC,gBAAgB,CAAC,EAAE,OAAO,EAAE,KAAK,EAAE,UAAU,YAAY,EAAE,QAAS,QAAO,SAAS;AACzF,UAAM,aAAa,MAAM,sBAAsB,KAAK,OAAO,MAAM,KAAK,IAAI,YAAY;AACtF,QAAI,CAAC,WAAY,QAAO,SAAS;AACjC,QAAI,CAAC,mBAAmB,KAAK,UAAU,EAAE,SAAS,kBAAkB,MAAM,KAAK,GAAG,CAAC,GAAG;AACpF,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0CAA0C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC3G;AACA,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,MAAM,EAAE,QAAQ,MAAM,KAAK,KAAK,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,cAAc,CAAC,EAAE;AAAA,MACjH,OAAO,EAAE,cAAc,8BAA8B,YAAY,MAAM,KAAK,IAAI,WAAW,UAAU,iBAAiB,EAAE,aAAa,EAAE;AAAA,IACzI,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,MAAM,GAAG,OAAO,UAAU,EAAE,MAAM;AACxC,UAAM,IAAI,8BAA8B,WAAW,eAAe,WAAW,EAAE,EAAE,MAAM,CAAC,QAAQ;AAC9F,aAAO,MAAM,4DAA4D,EAAE,KAAK,aAAa,CAAC;AAC9F,0BAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,mDAAmD,CAAC;AAAA,IACvH,CAAC;AACD,QAAI,WAAW,aAAa;AAC1B,UAAI;AACF,cAAM,SAAS,OAAO,MAAM,qBAAqB,KAAK,KAAK,GAAG,oBAAoB,WAAW,eAAe;AAAA,UAC1G,UAAU,WAAW,YAAY,MAAM;AAAA,UACvC,gBAAgB,WAAW,kBAAkB,MAAM;AAAA,QACrD,CAAC;AACD,cAAM,OAAO,OAAO,WAAW,eAAe,WAAW,WAAW;AAAA,MACtE,SAAS,KAAK;AACZ,eAAO,MAAM,0DAA0D,EAAE,KAAK,aAAa,CAAC;AAC5F,4BAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,iDAAiD,CAAC;AAAA,MACrH;AAAA,IACF;AACA,QAAI;AACF,YAAM,aAAa,MAAM,UAAU,QAAQ,YAAY;AACvD,YAAM,oBAAoB;AAAA,QACxB;AAAA,QACA,QAAQ;AAAA,QACR,QAAQ;AAAA,QACR,aAAa,EAAE,IAAI,WAAW,IAAI,gBAAgB,WAAW,kBAAkB,MAAM,UAAU,WAAW,YAAY,KAAK;AAAA,QAC3H,QAAQ,IAAI;AAAA,QACZ,SAAS,IAAI;AAAA,MACf,CAAC;AACD,YAAM,WAAW,sBAAsB;AAAA,IACzC,SAAS,KAAK;AACZ,aAAO,MAAM,uDAAuD,EAAE,KAAK,aAAa,CAAC;AACzF,0BAAoB,GAAG,YAAY,KAAK,EAAE,QAAQ,SAAS,MAAM,8CAA8C,CAAC;AAAA,IAClH;AACA,UAAM,QAAQ,gBAAgB;AAC9B,kCAA8B,MAAM,MAAM,MAAM,QAAQ,sBAAsB,YAAY;AAC1F,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC,SAAS,KAAK;AACZ,WAAO,oBAAoB,KAAK,gDAAgD;AAAA,EAClF;AACF;AAEA,MAAM,uBAAuB;AAEtB,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,SAAS,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,EAAE,CAAC,EAAE,CAAC;AAAA,MAC7G,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,QACvD,EAAE,QAAQ,KAAK,aAAa,iCAAiC;AAAA,MAC/D;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,YAAY,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,qBAAqB,CAAC,EAAE,CAAC;AAAA,MAC3H,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,iDAAiD;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,WAAW,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE,CAAC;AAAA,MAC9F,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,2BAA2B;AAAA,MACzD;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/portal/support-tickets/[id]/messages/route.js

@@ -0,0 +1,91 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { runRouteMutationGuards } from "@open-mercato/shared/lib/crud/route-mutation-guard";
+import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import {
+  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,
+  loadPortalOwnedTicket,
+  resolveCustomerDisplay,
+  resolveSupportPortalScope
+} from "../../../../../lib/support/portalTickets.js";
+import {
+  SUPPORT_TICKET_RESOURCE_KIND,
+  buildPortalCommandContext,
+  checkPortalRateLimit,
+  portalErrorResponse,
+  readPathId
+} from "../../../../../lib/support/portalRoute.js";
+import {
+  staffSupportTicketCommandIds
+} from "../../../../../commands/support-tickets.js";
+const metadata = { requireAuth: false };
+const bodySchema = z.object({ body: z.string().trim().min(1).max(1e4) });
+const responseSchema = z.object({ ok: z.literal(true), id: z.string().uuid(), reopened: z.boolean() });
+async function POST(req) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE);
+    if (scope instanceof Response) return scope;
+    const taskId = readPathId(req, /\/support-tickets\/([^/]+)\/messages/);
+    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null;
+    if (!owned) return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    const limited = await checkPortalRateLimit(scope, "message");
+    if (limited) return limited;
+    const body = bodySchema.parse(await readJsonSafe(req, {}));
+    const guarded = await runRouteMutationGuards({
+      container: scope.container,
+      req,
+      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },
+      input: { resourceKind: SUPPORT_TICKET_RESOURCE_KIND, resourceId: owned.task.id, operation: "update", mutationPayload: body }
+    });
+    if (!guarded.ok) return guarded.response;
+    const effectiveBody = guarded.modifiedPayload ? bodySchema.parse({ ...body, ...guarded.modifiedPayload }) : body;
+    const customer = await resolveCustomerDisplay(scope);
+    const input = {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      customerId: scope.customerId,
+      customerUserId: scope.auth.sub,
+      customerDisplayName: customer.displayName,
+      customerKind: customer.kind,
+      reporterDisplayName: scope.auth.displayName ?? null,
+      taskId: owned.task.id,
+      body: effectiveBody.body
+    };
+    const commandBus = scope.container.resolve("commandBus");
+    const { result } = await commandBus.execute(
+      staffSupportTicketCommandIds.portalMessage,
+      { input, ctx: buildPortalCommandContext(scope, req) }
+    );
+    await guarded.runAfterSuccess();
+    return NextResponse.json(responseSchema.parse({ ok: true, id: result.commentId, reopened: result.reopened }), { status: 201 });
+  } catch (err) {
+    const rejection = getCommandInterceptorHttpRejection(err);
+    if (rejection) return NextResponse.json(rejection.body, { status: rejection.status });
+    return portalErrorResponse(err, "staff portal support message POST failed");
+  }
+}
+const openApi = {
+  tag: "Staff Portal",
+  summary: "Reply on a support ticket",
+  methods: {
+    POST: {
+      summary: "Reply on a support ticket",
+      description: "Adds a customer message to a ticket the signed-in customer owns. Replying on a resolved ticket reopens it (it moves back to the project default column). Rate limited per customer user.",
+      requestBody: { contentType: "application/json", schema: bodySchema },
+      responses: [{ status: 201, description: "Message added", schema: responseSchema }],
+      errors: [
+        { status: 401, description: "No portal session" },
+        { status: 403, description: "Missing portal.support_tickets.manage" },
+        { status: 404, description: "Not found or not owned by this customer" },
+        { status: 429, description: "Rate limit exceeded" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/staff/api/portal/support-tickets/[id]/messages/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/staff/api/portal/support-tickets/%5Bid%5D/messages/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport {\n  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,\n  loadPortalOwnedTicket,\n  resolveCustomerDisplay,\n  resolveSupportPortalScope,\n} from '../../../../../lib/support/portalTickets'\nimport {\n  SUPPORT_TICKET_RESOURCE_KIND,\n  buildPortalCommandContext,\n  checkPortalRateLimit,\n  portalErrorResponse,\n  readPathId,\n} from '../../../../../lib/support/portalRoute'\nimport {\n  staffSupportTicketCommandIds,\n  type SupportTicketMessageResult,\n  type SupportTicketPortalMessageInput,\n} from '../../../../../commands/support-tickets'\n\nexport const metadata: { requireAuth?: boolean } = { requireAuth: false }\n\nconst bodySchema = z.object({ body: z.string().trim().min(1).max(10000) })\nconst responseSchema = z.object({ ok: z.literal(true), id: z.string().uuid(), reopened: z.boolean() })\n\nexport async function POST(req: Request) {\n  try {\n    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE)\n    if (scope instanceof Response) return scope\n    const taskId = readPathId(req, /\\/support-tickets\\/([^/]+)\\/messages/)\n    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null\n    if (!owned) return NextResponse.json({ ok: false, error: 'staff.errors.notFound' }, { status: 404 })\n    const limited = await checkPortalRateLimit(scope, 'message')\n    if (limited) return limited\n    const body = bodySchema.parse(await readJsonSafe<Record<string, unknown>>(req, {}))\n    const guarded = await runRouteMutationGuards({\n      container: scope.container,\n      req,\n      auth: { userId: scope.auth.sub, tenantId: scope.tenantId, organizationId: scope.organizationId, userFeatures: [] },\n      input: { resourceKind: SUPPORT_TICKET_RESOURCE_KIND, resourceId: owned.task.id, operation: 'update', mutationPayload: body },\n    })\n    if (!guarded.ok) return guarded.response\n    const effectiveBody = guarded.modifiedPayload ? bodySchema.parse({ ...body, ...guarded.modifiedPayload }) : body\n    const customer = await resolveCustomerDisplay(scope)\n    const input: SupportTicketPortalMessageInput = {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      customerId: scope.customerId,\n      customerUserId: scope.auth.sub,\n      customerDisplayName: customer.displayName,\n      customerKind: customer.kind,\n      reporterDisplayName: scope.auth.displayName ?? null,\n      taskId: owned.task.id,\n      body: effectiveBody.body,\n    }\n    const commandBus = scope.container.resolve('commandBus') as CommandBus\n    const { result } = await commandBus.execute<SupportTicketPortalMessageInput, SupportTicketMessageResult>(\n      staffSupportTicketCommandIds.portalMessage,\n      { input, ctx: buildPortalCommandContext(scope, req) },\n    )\n    await guarded.runAfterSuccess()\n    return NextResponse.json(responseSchema.parse({ ok: true, id: result.commentId, reopened: result.reopened }), { status: 201 })\n  } catch (err) {\n    const rejection = getCommandInterceptorHttpRejection(err)\n    if (rejection) return NextResponse.json(rejection.body, { status: rejection.status })\n    return portalErrorResponse(err, 'staff portal support message POST failed')\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff Portal',\n  summary: 'Reply on a support ticket',\n  methods: {\n    POST: {\n      summary: 'Reply on a support ticket',\n      description:\n        'Adds a customer message to a ticket the signed-in customer owns. Replying on a resolved ticket reopens it (it moves back to the project default column). Rate limited per customer user.',\n      requestBody: { contentType: 'application/json', schema: bodySchema },\n      responses: [{ status: 201, description: 'Message added', schema: responseSchema }],\n      errors: [\n        { status: 401, description: 'No portal session' },\n        { status: 403, description: 'Missing portal.support_tickets.manage' },\n        { status: 404, description: 'Not found or not owned by this customer' },\n        { status: 429, description: 'Rate limit exceeded' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,8BAA8B;AAEvC,SAAS,0CAA0C;AAEnD,SAAS,oBAAoB;AAC7B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAEA,MAAM,WAAsC,EAAE,aAAa,MAAM;AAExE,MAAM,aAAa,EAAE,OAAO,EAAE,MAAM,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,IAAI,GAAK,EAAE,CAAC;AACzE,MAAM,iBAAiB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,UAAU,EAAE,QAAQ,EAAE,CAAC;AAErG,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,UAAM,QAAQ,MAAM,0BAA0B,KAAK,qCAAqC;AACxF,QAAI,iBAAiB,SAAU,QAAO;AACtC,UAAM,SAAS,WAAW,KAAK,sCAAsC;AACrE,UAAM,QAAQ,SAAS,MAAM,sBAAsB,OAAO,MAAM,IAAI;AACpE,QAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACnG,UAAM,UAAU,MAAM,qBAAqB,OAAO,SAAS;AAC3D,QAAI,QAAS,QAAO;AACpB,UAAM,OAAO,WAAW,MAAM,MAAM,aAAsC,KAAK,CAAC,CAAC,CAAC;AAClF,UAAM,UAAU,MAAM,uBAAuB;AAAA,MAC3C,WAAW,MAAM;AAAA,MACjB;AAAA,MACA,MAAM,EAAE,QAAQ,MAAM,KAAK,KAAK,UAAU,MAAM,UAAU,gBAAgB,MAAM,gBAAgB,cAAc,CAAC,EAAE;AAAA,MACjH,OAAO,EAAE,cAAc,8BAA8B,YAAY,MAAM,KAAK,IAAI,WAAW,UAAU,iBAAiB,KAAK;AAAA,IAC7H,CAAC;AACD,QAAI,CAAC,QAAQ,GAAI,QAAO,QAAQ;AAChC,UAAM,gBAAgB,QAAQ,kBAAkB,WAAW,MAAM,EAAE,GAAG,MAAM,GAAG,QAAQ,gBAAgB,CAAC,IAAI;AAC5G,UAAM,WAAW,MAAM,uBAAuB,KAAK;AACnD,UAAM,QAAyC;AAAA,MAC7C,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY,MAAM;AAAA,MAClB,gBAAgB,MAAM,KAAK;AAAA,MAC3B,qBAAqB,SAAS;AAAA,MAC9B,cAAc,SAAS;AAAA,MACvB,qBAAqB,MAAM,KAAK,eAAe;AAAA,MAC/C,QAAQ,MAAM,KAAK;AAAA,MACnB,MAAM,cAAc;AAAA,IACtB;AACA,UAAM,aAAa,MAAM,UAAU,QAAQ,YAAY;AACvD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC,6BAA6B;AAAA,MAC7B,EAAE,OAAO,KAAK,0BAA0B,OAAO,GAAG,EAAE;AAAA,IACtD;AACA,UAAM,QAAQ,gBAAgB;AAC9B,WAAO,aAAa,KAAK,eAAe,MAAM,EAAE,IAAI,MAAM,IAAI,OAAO,WAAW,UAAU,OAAO,SAAS,CAAC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/H,SAAS,KAAK;AACZ,UAAM,YAAY,mCAAmC,GAAG;AACxD,QAAI,UAAW,QAAO,aAAa,KAAK,UAAU,MAAM,EAAE,QAAQ,UAAU,OAAO,CAAC;AACpF,WAAO,oBAAoB,KAAK,0CAA0C;AAAA,EAC5E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa,EAAE,aAAa,oBAAoB,QAAQ,WAAW;AAAA,MACnE,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,eAAe,CAAC;AAAA,MACjF,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,oBAAoB;AAAA,QAChD,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,0CAA0C;AAAA,QACtE,EAAE,QAAQ,KAAK,aAAa,sBAAsB;AAAA,MACpD;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/staff/api/portal/support-tickets/[id]/route.js

@@ -0,0 +1,146 @@
+import { NextResponse } from "next/server";
+import { createLogger } from "@open-mercato/shared/lib/logger";
+import { getTelemetryRuntime } from "@open-mercato/shared/lib/telemetry/runtime";
+import { z } from "zod";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { User } from "@open-mercato/core/modules/auth/data/entities";
+import { StaffTimeTaskComment, StaffTimeTaskStatus } from "../../../../data/entities.js";
+import {
+  PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE,
+  PORTAL_SUPPORT_TICKETS_VIEW_FEATURE,
+  loadPortalOwnedTicket,
+  resolveSupportPortalScope
+} from "../../../../lib/support/portalTickets.js";
+import { portalErrorResponse, readPathId } from "../../../../lib/support/portalRoute.js";
+import {
+  listCustomerVisibleAttachments,
+  loadPortalAttachmentsApi,
+  portalSupportAttachmentItemSchema
+} from "../../../../lib/support/portalAttachments.js";
+import { derivePortalStatus } from "../../../../lib/support/portalStatus.js";
+const logger = createLogger("staff").child({ component: "api/portal/support-tickets/detail" });
+const metadata = { requireAuth: false };
+const messageSchema = z.object({
+  id: z.string().uuid(),
+  authorKind: z.enum(["staff", "customer"]),
+  authorName: z.string().nullable(),
+  isSelf: z.boolean(),
+  body: z.string(),
+  createdAt: z.string().nullable()
+});
+const detailSchema = z.object({
+  id: z.string().uuid(),
+  supportReference: z.string(),
+  subject: z.string(),
+  description: z.string(),
+  category: z.object({ value: z.string(), label: z.string() }),
+  portalStatus: z.enum(["received", "in_progress", "resolved"]),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+  canReply: z.boolean(),
+  requester: z.object({ name: z.string().nullable(), isSelf: z.boolean() }),
+  messages: z.array(messageSchema),
+  attachments: z.array(portalSupportAttachmentItemSchema)
+});
+function nonEmptyName(value) {
+  return typeof value === "string" && value.trim().length > 0 ? value.trim() : null;
+}
+async function loadVisibleAttachments(scope, taskId, canManage) {
+  const api = await loadPortalAttachmentsApi();
+  if (!api) return [];
+  try {
+    return await listCustomerVisibleAttachments(api, scope, taskId, canManage);
+  } catch (err) {
+    logger.warn("staff portal support ticket attachments could not be listed", { err, taskId });
+    getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.portal_support_attachments_failed" });
+    return [];
+  }
+}
+async function GET(req) {
+  try {
+    const scope = await resolveSupportPortalScope(req, PORTAL_SUPPORT_TICKETS_VIEW_FEATURE);
+    if (scope instanceof Response) return scope;
+    const taskId = readPathId(req, /\/support-tickets\/([^/]+)/);
+    const owned = taskId ? await loadPortalOwnedTicket(scope, taskId) : null;
+    if (!owned) return NextResponse.json({ ok: false, error: "staff.errors.notFound" }, { status: 404 });
+    const { task, ticket } = owned;
+    const decryptionScope = { tenantId: scope.tenantId, organizationId: scope.organizationId };
+    const status = await scope.em.findOne(StaffTimeTaskStatus, { id: task.taskStatusId, ...decryptionScope }, { fields: ["id", "isDefault", "isDone"] });
+    const comments = await scope.em.find(
+      StaffTimeTaskComment,
+      { taskId: task.id, ...decryptionScope, visibility: "customer", deletedAt: null },
+      { orderBy: { createdAt: "asc", id: "asc" } }
+    );
+    const staffUserIds = [...new Set(comments.map((comment) => comment.authorUserId).filter((id) => typeof id === "string"))];
+    const staffNames = /* @__PURE__ */ new Map();
+    if (staffUserIds.length) {
+      try {
+        const users = await findWithDecryption(
+          scope.em,
+          User,
+          { id: { $in: staffUserIds }, tenantId: scope.tenantId },
+          void 0,
+          decryptionScope
+        );
+        for (const user of users) staffNames.set(user.id, nonEmptyName(user.name));
+      } catch (err) {
+        logger.warn("staff portal support ticket could not resolve staff names", { err, taskId: task.id });
+        getTelemetryRuntime()?.reportError(err, { module: "staff", code: "staff.portal_support_staff_names_failed" });
+        staffNames.clear();
+      }
+    }
+    const request = ticket.customerRequestSnapshot;
+    const canReply = await scope.hasFeature(PORTAL_SUPPORT_TICKETS_MANAGE_FEATURE);
+    const attachments = await loadVisibleAttachments(scope, task.id, canReply);
+    return NextResponse.json(
+      detailSchema.parse({
+        id: task.id,
+        supportReference: ticket.supportReference,
+        subject: request && typeof request.subject === "string" ? request.subject : "",
+        description: request && typeof request.body === "string" ? request.body : "",
+        category: ticket.categorySnapshot,
+        portalStatus: derivePortalStatus(status),
+        createdAt: task.createdAt ? task.createdAt.toISOString() : null,
+        updatedAt: task.updatedAt ? task.updatedAt.toISOString() : null,
+        canReply,
+        requester: {
+          name: nonEmptyName(ticket.customerSnapshot?.reporterDisplayName),
+          isSelf: ticket.reportedByCustomerUserId === scope.auth.sub
+        },
+        messages: comments.map((comment) => ({
+          id: comment.id,
+          authorKind: comment.authorKind === "customer" ? "customer" : "staff",
+          authorName: comment.authorKind === "customer" ? nonEmptyName(comment.authorDisplaySnapshot?.displayName) : comment.authorUserId ? staffNames.get(comment.authorUserId) ?? null : null,
+          isSelf: comment.authorKind === "customer" && comment.authorCustomerUserId === scope.auth.sub,
+          body: comment.body,
+          createdAt: comment.createdAt ? comment.createdAt.toISOString() : null
+        })),
+        attachments
+      })
+    );
+  } catch (err) {
+    return portalErrorResponse(err, "staff portal support ticket GET failed");
+  }
+}
+const openApi = {
+  tag: "Staff Portal",
+  summary: "Support ticket detail",
+  methods: {
+    GET: {
+      summary: "Support ticket detail",
+      description: "One ticket owned by the signed-in customer: the original request, the customer-facing status, and customer-visible messages only, and the customer-visible files (`attachments`, same items as the attachments list; an empty list when the attachments module is unavailable). Internal notes and internal files are never returned. A ticket of another customer answers 404.",
+      responses: [{ status: 200, description: "Ticket", schema: detailSchema }],
+      errors: [
+        { status: 401, description: "No portal session" },
+        { status: 403, description: "Missing portal.support_tickets.view" },
+        { status: 404, description: "Not found or not owned by this customer" }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map