@open-mercato/core 0.4.5-develop-5191db4ef3 → 0.4.5-develop-9f9549ebc8

package/dist/modules/messages/api/[id]/actions/[actionId]/route.js

@@ -0,0 +1,92 @@
+import { z } from "zod";
+import { attachOperationMetadataHeader } from "../../../../lib/operationMetadata.js";
+import { resolveMessageContext } from "../../../../lib/routeHelpers.js";
+import { actionResultResponseSchema } from "../../../openapi.js";
+const metadata = {
+  POST: { requireAuth: true, requireFeatures: ["messages.actions"] }
+};
+async function POST(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const commandBus = ctx.container.resolve("commandBus");
+  const rawBody = await req.json().catch(() => ({}));
+  const body = typeof rawBody === "object" && rawBody && !Array.isArray(rawBody) ? rawBody : {};
+  try {
+    const commandResult = await commandBus.execute("messages.actions.execute", {
+      input: {
+        messageId: params.id,
+        actionId: params.actionId,
+        payload: body,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req
+      }
+    });
+    const result = commandResult.result;
+    const response = Response.json({
+      ok: result.ok,
+      actionId: result.actionId,
+      result: result.result
+    });
+    attachOperationMetadataHeader(response, result.operationLogEntry ?? null, {
+      resourceKind: "messages.message",
+      resourceId: params.id
+    });
+    return response;
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Message not found") {
+        return Response.json({ error: "Message not found" }, { status: 404 });
+      }
+      if (error.message === "Access denied") {
+        return Response.json({ error: "Access denied" }, { status: 403 });
+      }
+      if (error.message === "Action not found") {
+        return Response.json({ error: "Action not found" }, { status: 404 });
+      }
+      if (error.message === "Action already taken") {
+        const actionTaken = error.actionTaken ?? null;
+        return Response.json({ error: "Action already taken", actionTaken }, { status: 409 });
+      }
+      if (error.message === "Actions have expired") {
+        return Response.json({ error: "Actions have expired" }, { status: 410 });
+      }
+      if (error.message === "Action has no executable target") {
+        return Response.json({ error: "Action has no executable target" }, { status: 409 });
+      }
+      if (error.message === "Action failed") {
+        return Response.json({ error: "Action failed" }, { status: 500 });
+      }
+    }
+    throw error;
+  }
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    POST: {
+      summary: "Execute message action",
+      requestBody: { schema: z.record(z.string(), z.unknown()).optional() },
+      responses: [
+        { status: 200, description: "Action executed", schema: actionResultResponseSchema },
+        { status: 403, description: "Access denied" },
+        { status: 404, description: "Action not found" },
+        { status: 409, description: "Action already taken" },
+        { status: 410, description: "Action expired" }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/actions/[actionId]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/messages/api/%5Bid%5D/actions/%5BactionId%5D/route.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { attachOperationMetadataHeader, type OperationLogEntryLike } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { actionResultResponseSchema } from '../../../openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['messages.actions'] },\n}\n\nexport async function POST(\n  req: Request,\n  { params }: { params: { id: string; actionId: string } }\n) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  const rawBody = await req.json().catch(() => ({}))\n  const body = (typeof rawBody === 'object' && rawBody && !Array.isArray(rawBody)\n    ? rawBody\n    : {}) as Record<string, unknown>\n  try {\n    const commandResult = await commandBus.execute('messages.actions.execute', {\n      input: {\n        messageId: params.id,\n        actionId: params.actionId,\n        payload: body,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const result = commandResult.result as {\n      ok: boolean\n      actionId: string\n      result: Record<string, unknown>\n      operationLogEntry?: OperationLogEntryLike | null\n    }\n    const response = Response.json({\n      ok: result.ok,\n      actionId: result.actionId,\n      result: result.result,\n    })\n    attachOperationMetadataHeader(response, result.operationLogEntry ?? null, {\n      resourceKind: 'messages.message',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: 'Message not found' }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: 'Access denied' }, { status: 403 })\n      }\n      if (error.message === 'Action not found') {\n        return Response.json({ error: 'Action not found' }, { status: 404 })\n      }\n      if (error.message === 'Action already taken') {\n        const actionTaken = (error as Error & { actionTaken?: string }).actionTaken ?? null\n        return Response.json({ error: 'Action already taken', actionTaken }, { status: 409 })\n      }\n      if (error.message === 'Actions have expired') {\n        return Response.json({ error: 'Actions have expired' }, { status: 410 })\n      }\n      if (error.message === 'Action has no executable target') {\n        return Response.json({ error: 'Action has no executable target' }, { status: 409 })\n      }\n      if (error.message === 'Action failed') {\n        return Response.json({ error: 'Action failed' }, { status: 500 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    POST: {\n      summary: 'Execute message action',\n      requestBody: { schema: z.record(z.string(), z.unknown()).optional() },\n      responses: [\n        { status: 200, description: 'Action executed', schema: actionResultResponseSchema },\n        { status: 403, description: 'Access denied' },\n        { status: 404, description: 'Action not found' },\n        { status: 409, description: 'Action already taken' },\n        { status: 410, description: 'Action expired' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAElB,SAAS,qCAAiE;AAC1E,SAAS,6BAA6B;AAEtC,SAAS,kCAAkC;AAEpC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AACnE;AAEA,eAAsB,KACpB,KACA,EAAE,OAAO,GACT;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,QAAM,UAAU,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AACjD,QAAM,OAAQ,OAAO,YAAY,YAAY,WAAW,CAAC,MAAM,QAAQ,OAAO,IAC1E,UACA,CAAC;AACL,MAAI;AACF,UAAM,gBAAgB,MAAM,WAAW,QAAQ,4BAA4B;AAAA,MACzE,OAAO;AAAA,QACL,WAAW,OAAO;AAAA,QAClB,UAAU,OAAO;AAAA,QACjB,SAAS;AAAA,QACT,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,SAAS,cAAc;AAM7B,UAAM,WAAW,SAAS,KAAK;AAAA,MAC7B,IAAI,OAAO;AAAA,MACX,UAAU,OAAO;AAAA,MACjB,QAAQ,OAAO;AAAA,IACjB,CAAC;AACD,kCAA8B,UAAU,OAAO,qBAAqB,MAAM;AAAA,MACxE,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AACA,UAAI,MAAM,YAAY,oBAAoB;AACxC,eAAO,SAAS,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrE;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,cAAM,cAAe,MAA2C,eAAe;AAC/E,eAAO,SAAS,KAAK,EAAE,OAAO,wBAAwB,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACtF;AACA,UAAI,MAAM,YAAY,wBAAwB;AAC5C,eAAO,SAAS,KAAK,EAAE,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACzE;AACA,UAAI,MAAM,YAAY,mCAAmC;AACvD,eAAO,SAAS,KAAK,EAAE,OAAO,kCAAkC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACpF;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAClE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,EAAE,OAAO,EAAE,OAAO,GAAG,EAAE,QAAQ,CAAC,EAAE,SAAS,EAAE;AAAA,MACpE,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,2BAA2B;AAAA,QAClF,EAAE,QAAQ,KAAK,aAAa,gBAAgB;AAAA,QAC5C,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,QAC/C,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,MAC/C;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/messages/api/[id]/archive/route.js

@@ -0,0 +1,120 @@
+import { Message, MessageRecipient } from "../../../data/entities.js";
+import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
+import { hasOrganizationAccess, resolveMessageContext } from "../../../lib/routeHelpers.js";
+import { errorResponseSchema, okResponseSchema } from "../../openapi.js";
+const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ["messages.view"] },
+  DELETE: { requireAuth: true, requireFeatures: ["messages.view"] }
+};
+async function resolveRecipientContext(req, id) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const message = await em.findOne(Message, {
+    id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return { response: Response.json({ error: "Message not found" }, { status: 404 }) };
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return { response: Response.json({ error: "Access denied" }, { status: 403 }) };
+  }
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: id,
+    recipientUserId: scope.userId,
+    deletedAt: null
+  });
+  if (!recipient) {
+    return { response: Response.json({ error: "Access denied" }, { status: 403 }) };
+  }
+  return { ctx, scope, em, recipient };
+}
+async function PUT(req, { params }) {
+  const context = await resolveRecipientContext(req, params.id);
+  if ("response" in context) return context.response;
+  const { ctx, scope } = context;
+  const commandBus = ctx.container.resolve("commandBus");
+  const { logEntry } = await commandBus.execute("messages.recipients.archive", {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req
+    }
+  });
+  const response = Response.json({ ok: true });
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: "messages.message",
+    resourceId: params.id
+  });
+  return response;
+}
+async function DELETE(req, { params }) {
+  const context = await resolveRecipientContext(req, params.id);
+  if ("response" in context) return context.response;
+  const { ctx, scope } = context;
+  const commandBus = ctx.container.resolve("commandBus");
+  const { logEntry } = await commandBus.execute("messages.recipients.unarchive", {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req
+    }
+  });
+  const response = Response.json({ ok: true });
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: "messages.message",
+    resourceId: params.id
+  });
+  return response;
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    PUT: {
+      summary: "Archive message",
+      responses: [
+        { status: 200, description: "Message archived", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Unarchive message",
+      responses: [
+        { status: 200, description: "Message unarchived", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/archive/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/archive/route.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'\nimport type { MessageScope } from '../../../lib/routeHelpers'\nimport { errorResponseSchema, okResponseSchema } from '../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\ntype ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']\n\nasync function resolveRecipientContext(\n  req: Request,\n  id: string,\n): Promise<\n  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }\n  | { response: Response }\n> {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (!recipient) {\n    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }\n  }\n\n  return { ctx, scope, em, recipient }\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.archive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const context = await resolveRecipientContext(req, params.id)\n  if ('response' in context) return context.response\n  const { ctx, scope } = context\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.recipients.unarchive', {\n    input: {\n      messageId: params.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive message',\n      responses: [\n        { status: 200, description: 'Message archived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unarchive message',\n      responses: [\n        { status: 200, description: 'Message unarchived', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,SAAS,wBAAwB;AAC1C,SAAS,qCAAqC;AAC9C,SAAS,uBAAuB,6BAA6B;AAE7D,SAAS,qBAAqB,wBAAwB;AAE/C,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAClE;AAIA,eAAe,wBACb,KACA,IAIA;AACA,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC;AAAA,IACA,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EACpF;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW;AAAA,IACX,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,WAAW;AACd,WAAO,EAAE,UAAU,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC,EAAE;AAAA,EAChF;AAEA,SAAO,EAAE,KAAK,OAAO,IAAI,UAAU;AACrC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,+BAA+B;AAAA,IAC3E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,UAAU,MAAM,wBAAwB,KAAK,OAAO,EAAE;AAC5D,MAAI,cAAc,QAAS,QAAO,QAAQ;AAC1C,QAAM,EAAE,KAAK,MAAM,IAAI;AACvB,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,iCAAiC;AAAA,IAC7E,OAAO;AAAA,MACL,WAAW,OAAO;AAAA,MAClB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,IAChB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,iBAAiB;AAAA,MAC3E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/messages/api/[id]/attachments/route.js

@@ -0,0 +1,195 @@
+import { parseUnlinkAttachmentIds } from "../../../commands/attachments.js";
+import { Message, MessageRecipient } from "../../../data/entities.js";
+import { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from "../../../data/validators.js";
+import { getMessageAttachments } from "../../../lib/attachments.js";
+import { attachOperationMetadataHeader } from "../../../lib/operationMetadata.js";
+import { resolveMessageContext } from "../../../lib/routeHelpers.js";
+import {
+  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,
+  errorResponseSchema,
+  messageAttachmentResponseSchema,
+  okResponseSchema,
+  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema
+} from "../../openapi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["messages.view"] },
+  POST: { requireAuth: true, requireFeatures: ["messages.attach_files"] },
+  DELETE: { requireAuth: true, requireFeatures: ["messages.attach_files"] }
+};
+function hasOrganizationAccess(scopeOrganizationId, messageOrganizationId) {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId;
+  }
+  return messageOrganizationId == null;
+}
+async function GET(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em");
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null
+  });
+  if (message.senderUserId !== scope.userId && !recipient) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  const attachments = await getMessageAttachments(
+    em,
+    params.id,
+    scope.organizationId,
+    scope.tenantId
+  );
+  return Response.json({ attachments });
+}
+async function POST(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const body = await req.json().catch(() => ({}));
+  const input = attachmentIdsPayloadSchema.parse(body);
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (!message.isDraft) {
+    return Response.json({ error: "Attachments can only be modified on drafts" }, { status: 409 });
+  }
+  const commandBus = ctx.container.resolve("commandBus");
+  const { logEntry } = await commandBus.execute("messages.attachments.link_to_draft", {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: input.attachmentIds
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req
+    }
+  });
+  const response = Response.json({ ok: true });
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: "messages.message",
+    resourceId: params.id
+  });
+  return response;
+}
+async function DELETE(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const body = await req.json().catch(() => ({}));
+  const input = unlinkAttachmentPayloadSchema.parse(body);
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  if (!message.isDraft) {
+    return Response.json({ error: "Attachments can only be modified on drafts" }, { status: 409 });
+  }
+  const commandBus = ctx.container.resolve("commandBus");
+  const { logEntry } = await commandBus.execute("messages.attachments.unlink_from_draft", {
+    input: {
+      messageId: message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      attachmentIds: parseUnlinkAttachmentIds(input)
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req
+    }
+  });
+  const response = Response.json({ ok: true });
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: "messages.message",
+    resourceId: params.id
+  });
+  return response;
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    GET: {
+      summary: "List message attachments",
+      responses: [
+        { status: 200, description: "Attachments", schema: messageAttachmentResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    },
+    POST: {
+      summary: "Link attachments to draft message",
+      requestBody: { schema: attachmentIdsOpenApiSchema },
+      responses: [
+        { status: 200, description: "Attachments linked", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema },
+        { status: 409, description: "Only draft messages can be edited", schema: errorResponseSchema }
+      ]
+    },
+    DELETE: {
+      summary: "Unlink attachments from draft message",
+      requestBody: { schema: unlinkAttachmentOpenApiSchema },
+      responses: [
+        { status: 200, description: "Attachments unlinked", schema: okResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema },
+        { status: 409, description: "Only draft messages can be edited", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  DELETE,
+  GET,
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/attachments/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/attachments/route.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/core'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { parseUnlinkAttachmentIds } from '../../../commands/attachments'\nimport { Message, MessageRecipient } from '../../../data/entities'\nimport { attachmentIdsPayloadSchema, unlinkAttachmentPayloadSchema } from '../../../data/validators'\nimport { getMessageAttachments, linkAttachmentsToMessage } from '../../../lib/attachments'\nimport { attachOperationMetadataHeader } from '../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  attachmentIdsPayloadSchema as attachmentIdsOpenApiSchema,\n  errorResponseSchema,\n  messageAttachmentResponseSchema,\n  okResponseSchema,\n  unlinkAttachmentPayloadSchema as unlinkAttachmentOpenApiSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.view'] },\n  POST: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n  DELETE: { requireAuth: true, requireFeatures: ['messages.attach_files'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = ctx.container.resolve('em') as EntityManager\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: params.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n\n  if (message.senderUserId !== scope.userId && !recipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const attachments = await getMessageAttachments(\n    em,\n    params.id,\n    scope.organizationId,\n    scope.tenantId\n  )\n\n  return Response.json({ attachments })\n}\n\nexport async function POST(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = attachmentIdsPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.attachments.link_to_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: input.attachmentIds,\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n  const body = await req.json().catch(() => ({}))\n  const input = unlinkAttachmentPayloadSchema.parse(body)\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (message.senderUserId !== scope.userId) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  if (!message.isDraft) {\n    return Response.json({ error: 'Attachments can only be modified on drafts' }, { status: 409 })\n  }\n\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n  const { logEntry } = await commandBus.execute('messages.attachments.unlink_from_draft', {\n    input: {\n      messageId: message.id,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      attachmentIds: parseUnlinkAttachmentIds(input),\n    },\n    ctx: {\n      container: ctx.container,\n      auth: ctx.auth ?? null,\n      organizationScope: null,\n      selectedOrganizationId: scope.organizationId,\n      organizationIds: scope.organizationId ? [scope.organizationId] : null,\n      request: req,\n    },\n  })\n\n  const response = Response.json({ ok: true })\n  attachOperationMetadataHeader(response, logEntry, {\n    resourceKind: 'messages.message',\n    resourceId: params.id,\n  })\n  return response\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'List message attachments',\n      responses: [\n        { status: 200, description: 'Attachments', schema: messageAttachmentResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n    POST: {\n      summary: 'Link attachments to draft message',\n      requestBody: { schema: attachmentIdsOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments linked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n    DELETE: {\n      summary: 'Unlink attachments from draft message',\n      requestBody: { schema: unlinkAttachmentOpenApiSchema },\n      responses: [\n        { status: 200, description: 'Attachments unlinked', schema: okResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n        { status: 409, description: 'Only draft messages can be edited', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAGA,SAAS,gCAAgC;AACzC,SAAS,SAAS,wBAAwB;AAC1C,SAAS,4BAA4B,qCAAqC;AAC1E,SAAS,6BAAuD;AAChE,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE,8BAA8B;AAAA,EAC9B;AAAA,EACA;AAAA,EACA;AAAA,EACA,iCAAiC;AAAA,OAC5B;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAAA,EAC7D,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAAA,EACtE,QAAQ,EAAE,aAAa,MAAM,iBAAiB,CAAC,uBAAuB,EAAE;AAC1E;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAK,IAAI,UAAU,QAAQ,IAAI;AAErC,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,OAAO;AAAA,IAClB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,QAAQ,iBAAiB,MAAM,UAAU,CAAC,WAAW;AACvD,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM;AAAA,IACxB;AAAA,IACA,OAAO;AAAA,IACP,MAAM;AAAA,IACN,MAAM;AAAA,EACR;AAEA,SAAO,SAAS,KAAK,EAAE,YAAY,CAAC;AACtC;AAEA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAA+B;AAC/E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,2BAA2B,MAAM,IAAI;AAEnD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,MAAM;AAAA,IACvB;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC/D,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,QAAQ,8BAA8B,MAAM,IAAI;AAEtD,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,QAAQ,iBAAiB,MAAM,QAAQ;AACzC,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,QAAQ,SAAS;AACpB,WAAO,SAAS,KAAK,EAAE,OAAO,6CAA6C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/F;AAEA,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AACrD,QAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,0CAA0C;AAAA,IACtF,OAAO;AAAA,MACL,WAAW,QAAQ;AAAA,MACnB,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,eAAe,yBAAyB,KAAK;AAAA,IAC/C;AAAA,IACA,KAAK;AAAA,MACH,WAAW,IAAI;AAAA,MACf,MAAM,IAAI,QAAQ;AAAA,MAClB,mBAAmB;AAAA,MACnB,wBAAwB,MAAM;AAAA,MAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,MACjE,SAAS;AAAA,IACX;AAAA,EACF,CAAC;AAED,QAAM,WAAW,SAAS,KAAK,EAAE,IAAI,KAAK,CAAC;AAC3C,gCAA8B,UAAU,UAAU;AAAA,IAChD,cAAc;AAAA,IACd,YAAY,OAAO;AAAA,EACrB,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,gCAAgC;AAAA,MACrF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,IACA,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,2BAA2B;AAAA,MAClD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,iBAAiB;AAAA,MAC7E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,IACA,QAAQ;AAAA,MACN,SAAS;AAAA,MACT,aAAa,EAAE,QAAQ,8BAA8B;AAAA,MACrD,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,iBAAiB;AAAA,MAC/E;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,oBAAoB;AAAA,MAC/F;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/messages/api/[id]/confirmation/route.js

@@ -0,0 +1,67 @@
+import { Message, MessageConfirmation, MessageRecipient } from "../../../data/entities.js";
+import { resolveMessageContext } from "../../../lib/routeHelpers.js";
+import {
+  errorResponseSchema,
+  messageConfirmationResponseSchema
+} from "../../openapi.js";
+const metadata = {
+  GET: { requireAuth: true, requireFeatures: ["messages.view"] }
+};
+function hasOrganizationAccess(scopeOrganizationId, messageOrganizationId) {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId;
+  }
+  return messageOrganizationId == null;
+}
+async function GET(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const em = ctx.container.resolve("em").fork();
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null
+  });
+  if (!message) {
+    return Response.json({ error: "Message not found" }, { status: 404 });
+  }
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: message.id,
+    recipientUserId: scope.userId,
+    deletedAt: null
+  });
+  const isSender = message.senderUserId === scope.userId;
+  if (!isSender && !recipient) {
+    return Response.json({ error: "Access denied" }, { status: 403 });
+  }
+  const confirmation = await em.findOne(MessageConfirmation, { messageId: message.id });
+  return Response.json({
+    messageId: message.id,
+    confirmed: confirmation?.confirmed ?? false,
+    confirmedAt: confirmation?.confirmedAt ? confirmation.confirmedAt.toISOString() : null,
+    confirmedByUserId: confirmation?.confirmedByUserId ?? null
+  });
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    GET: {
+      summary: "Read message confirmation status",
+      responses: [
+        { status: 200, description: "Confirmation status", schema: messageConfirmationResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/confirmation/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/messages/api/%5Bid%5D/confirmation/route.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { Message, MessageConfirmation, MessageRecipient } from '../../../data/entities'\nimport { resolveMessageContext } from '../../../lib/routeHelpers'\nimport {\n  errorResponseSchema,\n  messageConfirmationResponseSchema,\n} from '../../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nfunction hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {\n  if (scopeOrganizationId) {\n    return messageOrganizationId === scopeOrganizationId\n  }\n  return messageOrganizationId == null\n}\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const em = (ctx.container.resolve('em') as EntityManager).fork()\n\n  const message = await em.findOne(Message, {\n    id: params.id,\n    tenantId: scope.tenantId,\n    deletedAt: null,\n  })\n\n  if (!message) {\n    return Response.json({ error: 'Message not found' }, { status: 404 })\n  }\n\n  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const recipient = await em.findOne(MessageRecipient, {\n    messageId: message.id,\n    recipientUserId: scope.userId,\n    deletedAt: null,\n  })\n  const isSender = message.senderUserId === scope.userId\n  if (!isSender && !recipient) {\n    return Response.json({ error: 'Access denied' }, { status: 403 })\n  }\n\n  const confirmation = await em.findOne(MessageConfirmation, { messageId: message.id })\n\n  return Response.json({\n    messageId: message.id,\n    confirmed: confirmation?.confirmed ?? false,\n    confirmedAt: confirmation?.confirmedAt ? confirmation.confirmedAt.toISOString() : null,\n    confirmedByUserId: confirmation?.confirmedByUserId ?? null,\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    GET: {\n      summary: 'Read message confirmation status',\n      responses: [\n        { status: 200, description: 'Confirmation status', schema: messageConfirmationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,SAAS,qBAAqB,wBAAwB;AAC/D,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAC/D;AAEA,SAAS,sBAAsB,qBAAoC,uBAA2D;AAC5H,MAAI,qBAAqB;AACvB,WAAO,0BAA0B;AAAA,EACnC;AACA,SAAO,yBAAyB;AAClC;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,KAAM,IAAI,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAE/D,QAAM,UAAU,MAAM,GAAG,QAAQ,SAAS;AAAA,IACxC,IAAI,OAAO;AAAA,IACX,UAAU,MAAM;AAAA,IAChB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,SAAS;AACZ,WAAO,SAAS,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,MAAI,CAAC,sBAAsB,MAAM,gBAAgB,QAAQ,cAAc,GAAG;AACxE,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,YAAY,MAAM,GAAG,QAAQ,kBAAkB;AAAA,IACnD,WAAW,QAAQ;AAAA,IACnB,iBAAiB,MAAM;AAAA,IACvB,WAAW;AAAA,EACb,CAAC;AACD,QAAM,WAAW,QAAQ,iBAAiB,MAAM;AAChD,MAAI,CAAC,YAAY,CAAC,WAAW;AAC3B,WAAO,SAAS,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,eAAe,MAAM,GAAG,QAAQ,qBAAqB,EAAE,WAAW,QAAQ,GAAG,CAAC;AAEpF,SAAO,SAAS,KAAK;AAAA,IACnB,WAAW,QAAQ;AAAA,IACnB,WAAW,cAAc,aAAa;AAAA,IACtC,aAAa,cAAc,cAAc,aAAa,YAAY,YAAY,IAAI;AAAA,IAClF,mBAAmB,cAAc,qBAAqB;AAAA,EACxD,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,kCAAkC;AAAA,MAC/F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/messages/api/[id]/conversation/archive/route.js

@@ -0,0 +1,68 @@
+import { attachOperationMetadataHeader } from "../../../../lib/operationMetadata.js";
+import { resolveMessageContext } from "../../../../lib/routeHelpers.js";
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema
+} from "../../../openapi.js";
+const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ["messages.view"] }
+};
+async function PUT(req, { params }) {
+  const { ctx, scope } = await resolveMessageContext(req);
+  const commandBus = ctx.container.resolve("commandBus");
+  try {
+    const { result, logEntry } = await commandBus.execute("messages.conversation.archive_for_actor", {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req
+      }
+    });
+    const response = Response.json(result);
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: "messages.conversation",
+      resourceId: params.id
+    });
+    return response;
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === "Message not found") {
+        return Response.json({ error: error.message }, { status: 404 });
+      }
+      if (error.message === "Access denied") {
+        return Response.json({ error: error.message }, { status: 403 });
+      }
+    }
+    throw error;
+  }
+}
+const openApi = {
+  tag: "Messages",
+  methods: {
+    PUT: {
+      summary: "Archive conversation for current actor",
+      responses: [
+        { status: 200, description: "Conversation archived", schema: conversationMutationResponseSchema }
+      ],
+      errors: [
+        { status: 403, description: "Access denied", schema: errorResponseSchema },
+        { status: 404, description: "Message not found", schema: errorResponseSchema }
+      ]
+    }
+  }
+};
+export {
+  PUT,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/messages/api/[id]/conversation/archive/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/messages/api/%5Bid%5D/conversation/archive/route.ts"],
+  "sourcesContent": ["import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'\nimport { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'\nimport { resolveMessageContext } from '../../../../lib/routeHelpers'\nimport {\n  conversationMutationResponseSchema,\n  errorResponseSchema,\n} from '../../../openapi'\n\nexport const metadata = {\n  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const { ctx, scope } = await resolveMessageContext(req)\n  const commandBus = ctx.container.resolve('commandBus') as CommandBus\n\n  try {\n    const { result, logEntry } = await commandBus.execute('messages.conversation.archive_for_actor', {\n      input: {\n        anchorMessageId: params.id,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        userId: scope.userId,\n      },\n      ctx: {\n        container: ctx.container,\n        auth: ctx.auth ?? null,\n        organizationScope: null,\n        selectedOrganizationId: scope.organizationId,\n        organizationIds: scope.organizationId ? [scope.organizationId] : null,\n        request: req,\n      },\n    })\n\n    const response = Response.json(result)\n    attachOperationMetadataHeader(response, logEntry, {\n      resourceKind: 'messages.conversation',\n      resourceId: params.id,\n    })\n    return response\n  } catch (error) {\n    if (error instanceof Error) {\n      if (error.message === 'Message not found') {\n        return Response.json({ error: error.message }, { status: 404 })\n      }\n      if (error.message === 'Access denied') {\n        return Response.json({ error: error.message }, { status: 403 })\n      }\n    }\n    throw error\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Messages',\n  methods: {\n    PUT: {\n      summary: 'Archive conversation for current actor',\n      responses: [\n        { status: 200, description: 'Conversation archived', schema: conversationMutationResponseSchema },\n      ],\n      errors: [\n        { status: 403, description: 'Access denied', schema: errorResponseSchema },\n        { status: 404, description: 'Message not found', schema: errorResponseSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAEA,SAAS,qCAAqC;AAC9C,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,eAAe,EAAE;AAC/D;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,EAAE,KAAK,MAAM,IAAI,MAAM,sBAAsB,GAAG;AACtD,QAAM,aAAa,IAAI,UAAU,QAAQ,YAAY;AAErD,MAAI;AACF,UAAM,EAAE,QAAQ,SAAS,IAAI,MAAM,WAAW,QAAQ,2CAA2C;AAAA,MAC/F,OAAO;AAAA,QACL,iBAAiB,OAAO;AAAA,QACxB,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,QAAQ,MAAM;AAAA,MAChB;AAAA,MACA,KAAK;AAAA,QACH,WAAW,IAAI;AAAA,QACf,MAAM,IAAI,QAAQ;AAAA,QAClB,mBAAmB;AAAA,QACnB,wBAAwB,MAAM;AAAA,QAC9B,iBAAiB,MAAM,iBAAiB,CAAC,MAAM,cAAc,IAAI;AAAA,QACjE,SAAS;AAAA,MACX;AAAA,IACF,CAAC;AAED,UAAM,WAAW,SAAS,KAAK,MAAM;AACrC,kCAA8B,UAAU,UAAU;AAAA,MAChD,cAAc;AAAA,MACd,YAAY,OAAO;AAAA,IACrB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,OAAO;AACd,QAAI,iBAAiB,OAAO;AAC1B,UAAI,MAAM,YAAY,qBAAqB;AACzC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AACA,UAAI,MAAM,YAAY,iBAAiB;AACrC,eAAO,SAAS,KAAK,EAAE,OAAO,MAAM,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MAChE;AAAA,IACF;AACA,UAAM;AAAA,EACR;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,mCAAmC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,oBAAoB;AAAA,QACzE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,oBAAoB;AAAA,MAC/E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}