@open-mercato/core 0.10.1-develop.7787.1.96c7cfc66f → 0.10.1-develop.7792.1.b0ce6289cf

package/src/modules/sales/commands/documents.ts

@@ -356,6 +356,7 @@ type QuoteAdjustmentSnapshot = {
 type OrderGraphSnapshot = {
   order: {
     id: string;
+    updatedAt?: string;
     organizationId: string;
     tenantId: string;
     orderNumber: string;
@@ -2033,6 +2034,7 @@ async function loadOrderSnapshot(
   return {
     order: {
       id: order.id,
+      updatedAt: order.updatedAt?.toISOString(),
       organizationId: order.organizationId,
       tenantId: order.tenantId,
       orderNumber: order.orderNumber,
@@ -6977,6 +6979,18 @@ const deleteOrderCommand: CommandHandler<
       em,
       [
         async () => {
+          const lockedOrder = await findOneWithDecryption(
+            em,
+            SalesOrder,
+            { id, tenantId: order.tenantId, organizationId: order.organizationId },
+            { lockMode: LockMode.PESSIMISTIC_WRITE, refresh: true },
+            { tenantId: order.tenantId, organizationId: order.organizationId },
+          );
+          if (!lockedOrder) {
+            const { translate } = await resolveTranslations();
+            throw notFound(translate("sales.documents.detail.notFound", "Document not found."));
+          }
+          await enforceSalesDocumentOptimisticLock(ctx, lockedOrder, SALES_RESOURCE_KIND_ORDER);
           if (shipmentIds.length) {
             await em.nativeDelete(SalesShipmentItem, {
               shipment: { $in: shipmentIds },
@@ -6999,7 +7013,7 @@ const deleteOrderCommand: CommandHandler<
           });
           await em.nativeDelete(SalesOrderAdjustment, { order: order.id });
           await em.nativeDelete(SalesOrderLine, { order: order.id });
-          em.remove(order);
+          em.remove(lockedOrder);
         },
       ],
       { transaction: true },

package/src/modules/warranty_claims/commands/claims.ts

@@ -11,6 +11,8 @@ import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { readSafeDecryptedString } from '../lib/decryptionSafety'
+import { isInitialReplacementOrderApproval } from '../lib/replacementOrderUndo'
+import { OPTIMISTIC_LOCK_HEADER_NAME } from '@open-mercato/shared/lib/crud/optimistic-lock-headers'
 import type { EntityId } from '@open-mercato/shared/modules/entities'
 import type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
 import { E } from '#generated/entities.ids.generated'
@@ -3062,13 +3064,20 @@ async function dispatchSalesOrderDelete(
   ctx: CommandRuntimeContext,
   scope: WarrantyClaimScope,
   replacementOrderId: string,
+  expectedUpdatedAt?: string,
 ): Promise<void> {
   const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const dispatchContext = scrubbedDispatchContext(ctx)
+  if (expectedUpdatedAt) {
+    dispatchContext.request = new Request(ctx.request?.url ?? 'http://localhost', {
+      headers: { [OPTIMISTIC_LOCK_HEADER_NAME]: expectedUpdatedAt },
+    })
+  }
   await commandBus.execute(
     'sales.orders.delete',
     {
       input: { id: replacementOrderId, tenantId: scope.tenantId, organizationId: scope.organizationId },
-      ctx: scrubbedDispatchContext(ctx),
+      ctx: dispatchContext,
     },
   )
 }
@@ -3076,6 +3085,7 @@ async function dispatchSalesOrderDelete(
 const createReplacementOrderCommand: CommandHandler<ClaimCreateReplacementOrderInput, ClaimCreateReplacementOrderResult> = {
   id: 'warranty_claims.claim.create_replacement_order',
   isUndoable: true,
+  redo: ({ input, ctx }) => createReplacementOrderCommand.execute({ ...input, updatedAt: undefined }, ctx),
   prepare: async (rawInput, ctx) => {
     const input = parseCommandInput(claimCreateReplacementOrderSchema, rawInput)
     const scope = resolveScope(ctx, input)
@@ -3336,10 +3346,13 @@ const createReplacementOrderCommand: CommandHandler<ClaimCreateReplacementOrderI
         const currentUpdatedAt = currentRow.updated_at
           ? new Date(currentRow.updated_at as string | Date).toISOString()
           : null
-        if (!replacementOrder.updatedAt || !currentUpdatedAt || currentUpdatedAt !== replacementOrder.updatedAt) {
+        if (!replacementOrder.updatedAt || !currentUpdatedAt || (
+          currentUpdatedAt !== replacementOrder.updatedAt
+          && !await isInitialReplacementOrderApproval(ctx, scope, replacementOrder.id, replacementOrder.updatedAt, currentUpdatedAt)
+        )) {
           throw new CrudHttpError(409, { error: 'warranty_claims.errors.replacementOrderChangedUndoAborted' })
         }
-        await dispatchSalesOrderDelete(ctx, scope, replacementOrder.id)
+        await dispatchSalesOrderDelete(ctx, scope, replacementOrder.id, currentUpdatedAt)
       } else {
         replacementOrderBridgeLogger.info('warranty_claims.claim.create_replacement_order undo found replacement order already absent', {
           claimId: before.id,

package/src/modules/warranty_claims/lib/replacementOrderUndo.ts

@@ -0,0 +1,67 @@
+import { isDeepStrictEqual } from 'node:util'
+import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import type { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
+import type { WarrantyClaimScope } from '../commands/shared'
+
+type OrderAuditEntry = NonNullable<Awaited<ReturnType<ActionLogService['findById']>>>
+
+function record(value: unknown): Record<string, unknown> | null {
+  return value !== null && typeof value === 'object' && !Array.isArray(value)
+    ? value as Record<string, unknown>
+    : null
+}
+
+export async function isInitialReplacementOrderApproval(
+  ctx: CommandRuntimeContext,
+  scope: WarrantyClaimScope,
+  orderId: string,
+  savedVersion: string,
+  currentVersion: string,
+): Promise<boolean> {
+  let logs: ActionLogService
+  try {
+    logs = ctx.container.resolve<ActionLogService>('actionLogService')
+  } catch {
+    return false
+  }
+  if (!logs) return false
+  const history = await logs.list({
+    ...scope,
+    resourceKind: 'sales.order',
+    resourceId: orderId,
+    includeRelated: true,
+    after: new Date(savedVersion),
+    pageSize: 3,
+  })
+  const entries: OrderAuditEntry[] = history.items
+  if (history.total > 3 || entries.length !== history.total) return false
+  const edits = entries.filter((entry) => !(entry.commandId === 'sales.orders.create'
+    && entry.resourceKind === 'sales.order' && entry.resourceId === orderId
+    && entry.tenantId === scope.tenantId && entry.organizationId === scope.organizationId))
+  if (edits.length !== 1) return false
+  const entry = edits[0]
+  if (entry.commandId !== 'sales.orders.update' || entry.executionState !== 'done') return false
+  if (entry.tenantId !== scope.tenantId || entry.organizationId !== scope.organizationId
+    || entry.resourceKind !== 'sales.order' || entry.resourceId !== orderId) return false
+  const before = record(entry.snapshotBefore)
+  const after = record(entry.snapshotAfter)
+  const beforeOrder = record(before?.order)
+  const afterOrder = record(after?.order)
+  if (!beforeOrder || !afterOrder || beforeOrder.id !== orderId || afterOrder.id !== orderId) return false
+  if (beforeOrder.updatedAt !== savedVersion || afterOrder.updatedAt !== currentVersion) return false
+  if (beforeOrder.status !== null || beforeOrder.statusEntryId !== null || afterOrder.status !== 'pending_approval') return false
+  const comparableOrder = (order: Record<string, unknown>) => Object.fromEntries(
+    Object.entries(order).filter(([key]) => !['status', 'statusEntryId', 'updatedAt'].includes(key)),
+  )
+  if (!isDeepStrictEqual(comparableOrder(beforeOrder), comparableOrder(afterOrder))) return false
+  const input = record(record(entry.commandPayload)?.__redoInput)
+  if (!input || input.id !== orderId || typeof input.statusEntryId !== 'string'
+    || input.statusEntryId !== afterOrder.statusEntryId
+    || Object.keys(input).some((key) => !['id', 'statusEntryId'].includes(key))) return false
+  const beforeNotes = before?.notes
+  const afterNotes = after?.notes
+  if (!Array.isArray(beforeNotes) || !Array.isArray(afterNotes) || afterNotes.length !== beforeNotes.length + 1) return false
+  if (!beforeNotes.every((note) => afterNotes.some((candidate) => isDeepStrictEqual(note, candidate)))) return false
+  return ['lines', 'adjustments', 'addresses', 'tags', 'shipments', 'payments']
+    .every((key) => Array.isArray(before?.[key]) && isDeepStrictEqual(before?.[key], after?.[key]))
+}