@open-mercato/core 0.4.5-develop-5191db4ef3 → 0.4.5-develop-9f9549ebc8

package/src/modules/messages/api/[id]/read/route.ts

@@ -0,0 +1,138 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import type { MessageScope } from '../../../lib/routeHelpers'
+import { errorResponseSchema, okResponseSchema } from '../../openapi'
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+type ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']
+
+async function resolveRecipientContext(
+  req: Request,
+  id: string,
+): Promise<
+  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }
+  | { response: Response }
+> {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  if (!recipient) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  return { ctx, scope, em, recipient }
+}
+
+export async function PUT(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.mark_read', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.mark_unread', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    PUT: {
+      summary: 'Mark message as read',
+      responses: [
+        { status: 200, description: 'Message marked read', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Mark message as unread',
+      responses: [
+        { status: 200, description: 'Message marked unread', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/reply/route.ts

@@ -0,0 +1,89 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { replyMessageSchema } from '../../../data/validators'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { canUseMessageEmailFeature, resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  forwardResponseSchema,
+  replyMessageSchema as replyOpenApiSchema,
+} from '../../openapi'
+import { MessageCommandExecuteResult } from '../../../commands/shared'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const body = await req.json().catch(() => ({}))
+  const input = replyMessageSchema.parse(body)
+  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {
+    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })
+  }
+
+  let commandResult
+  try {
+    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.reply', {
+      input: {
+        ...input,
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: 'Message not found' }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: 'Access denied' }, { status: 403 })
+      }
+      if (error.message === 'Reply is not allowed for this message type') {
+        return Response.json({ error: 'Reply is not allowed for this message type' }, { status: 409 })
+      }
+      if (error.message === 'No recipients available for reply') {
+        return Response.json({ error: 'No recipients available for reply' }, { status: 409 })
+      }
+    }
+    throw error
+  }
+  const messageId = commandResult.result.id
+
+  const response = Response.json({ id: messageId }, { status: 201 })
+  attachOperationMetadataHeader(response, commandResult.logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: messageId,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    POST: {
+      summary: 'Reply to message',
+      requestBody: { schema: replyOpenApiSchema },
+      responses: [
+        { status: 201, description: 'Reply created', schema: forwardResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Reply not allowed for message type', schema: errorResponseSchema },
+        { status: 409, description: 'No recipients available for reply', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/route.ts

@@ -0,0 +1,401 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { User } from '../../../auth/data/entities'
+import { Message, MessageObject, MessageRecipient } from '../../data/entities'
+import { updateDraftSchema } from '../../data/validators'
+import { buildResolvedMessageActions } from '../../lib/actions'
+import { getMessageObjectType } from '../../lib/message-objects-registry'
+import { getMessageTypeOrDefault } from '../../lib/message-types-registry'
+import { attachOperationMetadataHeader } from '../../lib/operationMetadata'
+import { hasOrganizationAccess, resolveMessageContext } from '../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  messageDetailResponseSchema,
+  okResponseSchema,
+  updateDraftSchema as updateDraftOpenApiSchema,
+} from '../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.view'] },
+  PATCH: { requireAuth: true, requireFeatures: ['messages.compose'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+type MessageObjectPreviewPayload = {
+  title: string
+  subtitle?: string
+  status?: string
+  statusColor?: string
+  metadata?: Record<string, string>
+} | null
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = ctx.container.resolve('em') as EntityManager
+  const url = new URL(req.url)
+  const skipMarkReadParam = url.searchParams.get('skipMarkRead')
+  const skipMarkRead = skipMarkReadParam === '1'
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  const isSender = message.senderUserId === scope.userId
+  const isRecipient = Boolean(recipient)
+
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!skipMarkRead && recipient && recipient.status === 'unread') {
+    const commandBus = ctx.container.resolve('commandBus') as CommandBus
+    await commandBus.execute('messages.recipients.mark_read', {
+      input: {
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+  }
+
+  const objects = await em.find(MessageObject, { messageId: params.id })
+  const objectPreviews = await Promise.all(
+    objects.map(async (item): Promise<MessageObjectPreviewPayload> => {
+      const objectType = getMessageObjectType(item.entityModule, item.entityType)
+      if (!objectType?.loadPreview) return null
+      try {
+        return await objectType.loadPreview(item.entityId, {
+          tenantId: scope.tenantId,
+          organizationId: scope.organizationId,
+        })
+      } catch (error) {
+        console.error(
+          `[messages] Failed to load preview for ${item.entityModule}:${item.entityType}:${item.entityId}`,
+          error,
+        )
+        return null
+      }
+    }),
+  )
+  const allRecipients = await em.find(MessageRecipient, { messageId: params.id, deletedAt: null })
+
+  const threadMessages = await em.find(
+    Message,
+    {
+      threadId: message.threadId ?? message.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      deletedAt: null,
+      isDraft: false,
+    },
+    { orderBy: { sentAt: 'ASC' } }
+  )
+  const threadMessageIds = threadMessages.map((item) => item.id)
+  const visibleRecipientRows = threadMessageIds.length > 0
+    ? await em.find(MessageRecipient, {
+      messageId: { $in: threadMessageIds },
+      recipientUserId: scope.userId,
+      deletedAt: null,
+    })
+    : []
+  const visibleRecipientMessageIds = new Set(visibleRecipientRows.map((item) => item.messageId))
+  const actorVisibleThreadMessages = threadMessages.filter((threadMessage) => (
+    threadMessage.senderUserId === scope.userId || visibleRecipientMessageIds.has(threadMessage.id)
+  ))
+
+  const threadSenderIds = actorVisibleThreadMessages
+    .map((threadMessage) => threadMessage.senderUserId)
+    .filter((value): value is string => typeof value === 'string' && value.length > 0)
+
+  const threadSenders = threadSenderIds.length > 0
+    ? await findWithDecryption(
+        em,
+        User,
+        { id: { $in: Array.from(new Set(threadSenderIds)) } },
+        undefined,
+        { tenantId: scope.tenantId, organizationId: scope.organizationId }
+      )
+    : []
+
+  const threadSenderMap = new Map(threadSenders.map((user) => [user.id, user]))
+
+  const senderUser = await findOneWithDecryption(
+    em,
+    User,
+    { id: message.senderUserId },
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId }
+  )
+
+  const senderName = typeof senderUser?.name === 'string' && senderUser.name.trim().length
+    ? senderUser.name.trim()
+    : null
+  const senderEmail = senderUser?.email ?? null
+
+  const messageType = getMessageTypeOrDefault(message.type)
+  const resolvedActionData = buildResolvedMessageActions(message, objects)
+
+  return Response.json({
+    id: message.id,
+    type: message.type,
+    isDraft: message.isDraft,
+    canEditDraft: message.isDraft && message.senderUserId === scope.userId,
+    visibility: message.visibility,
+    sourceEntityType: message.sourceEntityType,
+    sourceEntityId: message.sourceEntityId,
+    externalEmail: message.externalEmail,
+    externalName: message.externalName,
+    typeDefinition: {
+      labelKey: messageType.labelKey,
+      icon: messageType.icon,
+      color: messageType.color,
+      allowReply: messageType.allowReply ?? true,
+      allowForward: messageType.allowForward ?? true,
+      ui: {
+        listItemComponent: messageType.ui?.listItemComponent ?? null,
+        contentComponent: messageType.ui?.contentComponent ?? null,
+        actionsComponent: messageType.ui?.actionsComponent ?? null,
+      },
+    },
+    threadId: message.threadId,
+    parentMessageId: message.parentMessageId,
+    senderUserId: message.senderUserId,
+    senderName,
+    senderEmail,
+    subject: message.subject,
+    body: message.body,
+    bodyFormat: message.bodyFormat,
+    priority: message.priority,
+    sentAt: message.sentAt,
+    actionData: resolvedActionData,
+    actionTaken: message.actionTaken,
+    actionTakenAt: message.actionTakenAt,
+    actionTakenByUserId: message.actionTakenByUserId,
+    recipients: allRecipients.map((item) => ({
+      userId: item.recipientUserId,
+      type: item.recipientType,
+      status: item.status,
+      readAt: item.readAt,
+    })),
+    objects: objects.map((item, index) => ({
+      id: item.id,
+      entityModule: item.entityModule,
+      entityType: item.entityType,
+      entityId: item.entityId,
+      actionRequired: item.actionRequired,
+      actionType: item.actionType,
+      actionLabel: item.actionLabel,
+      snapshot: item.entitySnapshot,
+      preview: objectPreviews[index] ?? null,
+    })),
+    thread: actorVisibleThreadMessages.map((threadMessage) => {
+      const sender = threadSenderMap.get(threadMessage.senderUserId)
+      const threadSenderName = typeof sender?.name === 'string' && sender.name.trim().length
+        ? sender.name.trim()
+        : null
+
+      return {
+        id: threadMessage.id,
+        senderUserId: threadMessage.senderUserId,
+        senderName: threadSenderName,
+        senderEmail: sender?.email ?? null,
+        body: threadMessage.body,
+        bodyFormat: threadMessage.bodyFormat,
+        sentAt: threadMessage.sentAt,
+      }
+    }),
+    isRead: recipient ? recipient.status !== 'unread' : true,
+  })
+}
+
+export async function PATCH(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const body = await req.json().catch(() => ({}))
+  const input = updateDraftSchema.parse(body)
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (message.senderUserId !== scope.userId) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  if (!message.isDraft) {
+    return Response.json({ error: 'Only draft messages can be edited' }, { status: 409 })
+  }
+
+  try {
+    const { logEntry } = await commandBus.execute('messages.messages.update_draft', {
+      input: {
+        ...input,
+        messageId: message.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json({ ok: true, id: message.id })
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.message',
+      resourceId: message.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message type cannot be created by users') {
+        return Response.json({ error: error.message }, { status: 400 })
+      }
+      if (error.message === 'Only draft messages can be edited') {
+        return Response.json({ error: error.message }, { status: 409 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  try {
+    const { logEntry } = await commandBus.execute('messages.messages.delete_for_actor', {
+      input: {
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json({ ok: true })
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.message',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error && error.message === 'Access denied') {
+      return Response.json({ error: 'Access denied' }, { status: 403 })
+    }
+    throw error
+  }
+
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'Get message detail',
+      responses: [
+        {
+          status: 200,
+          description: 'Message detail with actor-visible thread items only',
+          schema: messageDetailResponseSchema,
+        },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    PATCH: {
+      summary: 'Update draft message',
+      requestBody: { schema: updateDraftOpenApiSchema },
+      responses: [
+        { status: 200, description: 'Draft updated', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Only drafts can be edited', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Delete message for current sender/recipient context',
+      responses: [
+        { status: 200, description: 'Message deleted', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/object-types/route.ts

@@ -0,0 +1,54 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { messageObjectTypesQuerySchema } from '../../data/validators'
+import { getMessageObjectTypesForMessageType } from '../../lib/message-objects-registry'
+import {
+  messageObjectTypeListResponseSchema,
+  messageObjectTypesQuerySchema as messageObjectTypesQueryOpenApiSchema,
+} from '../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function GET(req: Request) {
+  const params = Object.fromEntries(new URL(req.url).searchParams)
+  const parsed = messageObjectTypesQuerySchema.safeParse(params)
+  if (!parsed.success) {
+    return Response.json({ error: 'messageType is required' }, { status: 400 })
+  }
+  const input = parsed.data
+
+  const items = getMessageObjectTypesForMessageType(input.messageType).map((objectType) => ({
+    module: objectType.module,
+    entityType: objectType.entityType,
+    labelKey: objectType.labelKey,
+    icon: objectType.icon,
+    actions: objectType.actions.map((action) => ({
+      id: action.id,
+      labelKey: action.labelKey,
+      variant: action.variant,
+      icon: action.icon,
+      commandId: action.commandId,
+      href: action.href,
+      isTerminal: action.isTerminal,
+      confirmRequired: action.confirmRequired,
+      confirmMessage: action.confirmMessage,
+    })),
+  }))
+
+  return Response.json({ items })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'List registered message object types for a message type',
+      query: messageObjectTypesQueryOpenApiSchema,
+      responses: [
+        { status: 200, description: 'Message object types', schema: messageObjectTypeListResponseSchema },
+        { status: 400, description: 'Invalid query' },
+      ],
+    },
+  },
+}