@open-mercato/core 0.4.5-develop-5191db4ef3 → 0.4.5-develop-033a719bf2

package/src/modules/messages/api/[id]/attachments/route.ts

@@ -0,0 +1,217 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { parseUnlinkAttachmentIds } from '../../../commands/attachments'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'
+import { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
+  errorResponseSchema,
+  messageAttachmentResponseSchema,
+  okResponseSchema,
+  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.view'] },
+  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },
+}
+
+function hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId
+  }
+  return messageOrganizationId == null
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = ctx.container.resolve('em') as EntityManager
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  if (message.senderUserId !== scope.userId && !recipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const attachments = await getMessageAttachments(
+    em,
+    params.id,
+    scope.organizationId,
+    scope.tenantId
+  )
+
+  return Response.json({ attachments })
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const body = await req.json().catch(() => ({}))
+  const input = attachmentIdsPayloadSchema.parse(body)
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!message.isDraft) {
+    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })
+  }
+
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: input.attachmentIds,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const body = await req.json().catch(() => ({}))
+  const input = unlinkAttachmentPayloadSchema.parse(body)
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!message.isDraft) {
+    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })
+  }
+
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: parseUnlinkAttachmentIds(input),
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'List message attachments',
+      responses: [
+        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    POST: {
+      summary: 'Link attachments to draft message',
+      requestBody: { schema: attachmentIdsOpenApiSchema },
+      responses: [
+        { status: 200, description: 'Attachments linked', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Unlink attachments from draft message',
+      requestBody: { schema: unlinkAttachmentOpenApiSchema },
+      responses: [
+        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/confirmation/route.ts

@@ -0,0 +1,73 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageConfirmation, MessageRecipient } from '../../../data/entities'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  messageConfirmationResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+function hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId
+  }
+  return messageOrganizationId == null
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: message.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+  const isSender = message.senderUserId === scope.userId
+  if (!isSender && !recipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const confirmation = await em.findOne(MessageConfirmation, { messageId: message.id })
+
+  return Response.json({
+    messageId: message.id,
+    confirmed: confirmation?.confirmed ?? false,
+    confirmedAt: confirmation?.confirmedAt ? confirmation.confirmedAt.toISOString() : null,
+    confirmedByUserId: confirmation?.confirmedByUserId ?? null,
+  })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'Read message confirmation status',
+      responses: [
+        { status: 200, description: 'Confirmation status', schema: messageConfirmationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/archive/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../../openapi'
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function PUT(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.archive_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    PUT: {
+      summary: 'Archive conversation for current actor',
+      responses: [
+        { status: 200, description: 'Conversation archived', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/read/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../../openapi'
+
+export const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.mark_unread_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    DELETE: {
+      summary: 'Mark entire conversation as unread for current actor',
+      responses: [
+        { status: 200, description: 'Conversation marked unread', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.delete_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    DELETE: {
+      summary: 'Delete conversation for current actor',
+      responses: [
+        { status: 200, description: 'Conversation deleted', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/forward/route.ts

@@ -0,0 +1,87 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { forwardMessageSchema } from '../../../data/validators'
+import { attachOperationMetadataHeader, OperationLogEntryLike } from '../../../lib/operationMetadata'
+import { canUseMessageEmailFeature, parseRequestBodySafe, resolveMessageContext } from '../../../lib/routeHelpers'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { forwardResponseSchema, forwardMessageSchema as forwardSchema } from '../../openapi'
+import { MessageCommandExecuteResult } from '../../../commands/shared'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const body = await parseRequestBodySafe(req)
+  const input = forwardMessageSchema.parse(body)
+  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {
+    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })
+  }
+
+  let commandResult: { result: MessageCommandExecuteResult; logEntry: unknown }
+  try {
+    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.forward', {
+      input: {
+        ...input,
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: 'Message not found' }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: 'Access denied' }, { status: 403 })
+      }
+      if (error.message === 'Forward is not allowed for this message type') {
+        return Response.json({ error: 'Forward is not allowed for this message type' }, { status: 409 })
+      }
+      if (error.message === 'Forward body exceeds maximum length') {
+        return Response.json({ error: 'Forward body exceeds maximum length' }, { status: 413 })
+      }
+    }
+    throw error
+  }
+  const newMessageId = commandResult.result.id
+
+  const response = Response.json({ id: newMessageId }, { status: 201 })
+  attachOperationMetadataHeader(response, commandResult.logEntry as OperationLogEntryLike, {
+    resourceKind: 'messages.message',
+    resourceId: newMessageId,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    POST: {
+      summary: 'Forward a message and optionally include attachments from the forwarded conversation slice',
+      requestBody: { schema: forwardSchema },
+      responses: [
+        {
+          status: 201,
+          description: 'Message forwarded',
+          schema: forwardResponseSchema,
+        },
+        { status: 403, description: 'Access denied' },
+        { status: 404, description: 'Message not found' },
+        { status: 409, description: 'Forward not allowed for message type' },
+        { status: 413, description: 'Forward body exceeds maximum length' },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/forward-preview/route.ts

@@ -0,0 +1,75 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { buildForwardPreview } from '../../../lib/forwarding'
+import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  forwardPreviewResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  const isSender = message.senderUserId === scope.userId
+  const isRecipient = Boolean(recipient)
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  try {
+    const preview = await buildForwardPreview(em, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    }, message)
+    return Response.json(preview)
+  } catch (error) {
+    if (error instanceof Error && error.message === 'Forward body exceeds maximum length') {
+      return Response.json({ error: error.message }, { status: 413 })
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'Get forward preview for a message',
+      responses: [
+        { status: 200, description: 'Forward preview generated', schema: forwardPreviewResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 413, description: 'Forward body exceeds maximum length', schema: errorResponseSchema },
+      ],
+    },
+  },
+}