@open-mercato/core 0.4.5-develop-754ef4d2f0 → 0.4.5-develop-9f9549ebc8

package/src/modules/messages/api/[id]/confirmation/route.ts

@@ -0,0 +1,73 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageConfirmation, MessageRecipient } from '../../../data/entities'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  messageConfirmationResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+function hasOrganizationAccess(scopeOrganizationId: string | null, messageOrganizationId: string | null | undefined): boolean {
+  if (scopeOrganizationId) {
+    return messageOrganizationId === scopeOrganizationId
+  }
+  return messageOrganizationId == null
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: message.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+  const isSender = message.senderUserId === scope.userId
+  if (!isSender && !recipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const confirmation = await em.findOne(MessageConfirmation, { messageId: message.id })
+
+  return Response.json({
+    messageId: message.id,
+    confirmed: confirmation?.confirmed ?? false,
+    confirmedAt: confirmation?.confirmedAt ? confirmation.confirmedAt.toISOString() : null,
+    confirmedByUserId: confirmation?.confirmedByUserId ?? null,
+  })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'Read message confirmation status',
+      responses: [
+        { status: 200, description: 'Confirmation status', schema: messageConfirmationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/archive/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../../openapi'
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function PUT(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.archive_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    PUT: {
+      summary: 'Archive conversation for current actor',
+      responses: [
+        { status: 200, description: 'Conversation archived', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/read/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../../openapi'
+
+export const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.mark_unread_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    DELETE: {
+      summary: 'Mark entire conversation as unread for current actor',
+      responses: [
+        { status: 200, description: 'Conversation marked unread', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/conversation/route.ts

@@ -0,0 +1,69 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  conversationMutationResponseSchema,
+  errorResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+
+  try {
+    const { result, logEntry } = await commandBus.execute('messages.conversation.delete_for_actor', {
+      input: {
+        anchorMessageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+
+    const response = Response.json(result)
+    attachOperationMetadataHeader(response, logEntry, {
+      resourceKind: 'messages.conversation',
+      resourceId: params.id,
+    })
+    return response
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: error.message }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: error.message }, { status: 403 })
+      }
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    DELETE: {
+      summary: 'Delete conversation for current actor',
+      responses: [
+        { status: 200, description: 'Conversation deleted', schema: conversationMutationResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/forward/route.ts

@@ -0,0 +1,87 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { forwardMessageSchema } from '../../../data/validators'
+import { attachOperationMetadataHeader, OperationLogEntryLike } from '../../../lib/operationMetadata'
+import { canUseMessageEmailFeature, parseRequestBodySafe, resolveMessageContext } from '../../../lib/routeHelpers'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { forwardResponseSchema, forwardMessageSchema as forwardSchema } from '../../openapi'
+import { MessageCommandExecuteResult } from '../../../commands/shared'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const body = await parseRequestBodySafe(req)
+  const input = forwardMessageSchema.parse(body)
+  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {
+    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })
+  }
+
+  let commandResult: { result: MessageCommandExecuteResult; logEntry: unknown }
+  try {
+    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.forward', {
+      input: {
+        ...input,
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: 'Message not found' }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: 'Access denied' }, { status: 403 })
+      }
+      if (error.message === 'Forward is not allowed for this message type') {
+        return Response.json({ error: 'Forward is not allowed for this message type' }, { status: 409 })
+      }
+      if (error.message === 'Forward body exceeds maximum length') {
+        return Response.json({ error: 'Forward body exceeds maximum length' }, { status: 413 })
+      }
+    }
+    throw error
+  }
+  const newMessageId = commandResult.result.id
+
+  const response = Response.json({ id: newMessageId }, { status: 201 })
+  attachOperationMetadataHeader(response, commandResult.logEntry as OperationLogEntryLike, {
+    resourceKind: 'messages.message',
+    resourceId: newMessageId,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    POST: {
+      summary: 'Forward a message and optionally include attachments from the forwarded conversation slice',
+      requestBody: { schema: forwardSchema },
+      responses: [
+        {
+          status: 201,
+          description: 'Message forwarded',
+          schema: forwardResponseSchema,
+        },
+        { status: 403, description: 'Access denied' },
+        { status: 404, description: 'Message not found' },
+        { status: 409, description: 'Forward not allowed for message type' },
+        { status: 413, description: 'Forward body exceeds maximum length' },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/forward-preview/route.ts

@@ -0,0 +1,75 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { buildForwardPreview } from '../../../lib/forwarding'
+import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  forwardPreviewResponseSchema,
+} from '../../openapi'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function GET(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id: params.id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return Response.json({ error: 'Message not found' }, { status: 404 })
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: params.id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  const isSender = message.senderUserId === scope.userId
+  const isRecipient = Boolean(recipient)
+  if (!isSender && !isRecipient) {
+    return Response.json({ error: 'Access denied' }, { status: 403 })
+  }
+
+  try {
+    const preview = await buildForwardPreview(em, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    }, message)
+    return Response.json(preview)
+  } catch (error) {
+    if (error instanceof Error && error.message === 'Forward body exceeds maximum length') {
+      return Response.json({ error: error.message }, { status: 413 })
+    }
+    throw error
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    GET: {
+      summary: 'Get forward preview for a message',
+      responses: [
+        { status: 200, description: 'Forward preview generated', schema: forwardPreviewResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 413, description: 'Forward body exceeds maximum length', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/read/route.ts

@@ -0,0 +1,138 @@
+import type { EntityManager } from '@mikro-orm/core'
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { Message, MessageRecipient } from '../../../data/entities'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { hasOrganizationAccess, resolveMessageContext } from '../../../lib/routeHelpers'
+import type { MessageScope } from '../../../lib/routeHelpers'
+import { errorResponseSchema, okResponseSchema } from '../../openapi'
+
+export const metadata = {
+  PUT: { requireAuth: true, requireFeatures: ['messages.view'] },
+  DELETE: { requireAuth: true, requireFeatures: ['messages.view'] },
+}
+
+type ResolvedCtx = Awaited<ReturnType<typeof resolveMessageContext>>['ctx']
+
+async function resolveRecipientContext(
+  req: Request,
+  id: string,
+): Promise<
+  | { ctx: ResolvedCtx; scope: MessageScope; em: EntityManager; recipient: MessageRecipient }
+  | { response: Response }
+> {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+
+  const message = await em.findOne(Message, {
+    id,
+    tenantId: scope.tenantId,
+    deletedAt: null,
+  })
+
+  if (!message) {
+    return { response: Response.json({ error: 'Message not found' }, { status: 404 }) }
+  }
+
+  if (!hasOrganizationAccess(scope.organizationId, message.organizationId)) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  const recipient = await em.findOne(MessageRecipient, {
+    messageId: id,
+    recipientUserId: scope.userId,
+    deletedAt: null,
+  })
+
+  if (!recipient) {
+    return { response: Response.json({ error: 'Access denied' }, { status: 403 }) }
+  }
+
+  return { ctx, scope, em, recipient }
+}
+
+export async function PUT(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.mark_read', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export async function DELETE(req: Request, { params }: { params: { id: string } }) {
+  const context = await resolveRecipientContext(req, params.id)
+  if ('response' in context) return context.response
+  const { ctx, scope } = context
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { logEntry } = await commandBus.execute('messages.recipients.mark_unread', {
+    input: {
+      messageId: params.id,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+    },
+    ctx: {
+      container: ctx.container,
+      auth: ctx.auth ?? null,
+      organizationScope: null,
+      selectedOrganizationId: scope.organizationId,
+      organizationIds: scope.organizationId ? [scope.organizationId] : null,
+      request: req,
+    },
+  })
+
+  const response = Response.json({ ok: true })
+  attachOperationMetadataHeader(response, logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: params.id,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    PUT: {
+      summary: 'Mark message as read',
+      responses: [
+        { status: 200, description: 'Message marked read', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Mark message as unread',
+      responses: [
+        { status: 200, description: 'Message marked unread', schema: okResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/messages/api/[id]/reply/route.ts

@@ -0,0 +1,89 @@
+import type { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { replyMessageSchema } from '../../../data/validators'
+import { attachOperationMetadataHeader } from '../../../lib/operationMetadata'
+import { canUseMessageEmailFeature, resolveMessageContext } from '../../../lib/routeHelpers'
+import {
+  errorResponseSchema,
+  forwardResponseSchema,
+  replyMessageSchema as replyOpenApiSchema,
+} from '../../openapi'
+import { MessageCommandExecuteResult } from '../../../commands/shared'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['messages.compose'] },
+}
+
+export async function POST(req: Request, { params }: { params: { id: string } }) {
+  const { ctx, scope } = await resolveMessageContext(req)
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const body = await req.json().catch(() => ({}))
+  const input = replyMessageSchema.parse(body)
+  if (input.sendViaEmail && !(await canUseMessageEmailFeature(ctx, scope))) {
+    return Response.json({ error: 'Missing feature: messages.email' }, { status: 403 })
+  }
+
+  let commandResult
+  try {
+    commandResult = await commandBus.execute<unknown, MessageCommandExecuteResult>('messages.messages.reply', {
+      input: {
+        ...input,
+        messageId: params.id,
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        userId: scope.userId,
+      },
+      ctx: {
+        container: ctx.container,
+        auth: ctx.auth ?? null,
+        organizationScope: null,
+        selectedOrganizationId: scope.organizationId,
+        organizationIds: scope.organizationId ? [scope.organizationId] : null,
+        request: req,
+      },
+    })
+  } catch (error) {
+    if (error instanceof Error) {
+      if (error.message === 'Message not found') {
+        return Response.json({ error: 'Message not found' }, { status: 404 })
+      }
+      if (error.message === 'Access denied') {
+        return Response.json({ error: 'Access denied' }, { status: 403 })
+      }
+      if (error.message === 'Reply is not allowed for this message type') {
+        return Response.json({ error: 'Reply is not allowed for this message type' }, { status: 409 })
+      }
+      if (error.message === 'No recipients available for reply') {
+        return Response.json({ error: 'No recipients available for reply' }, { status: 409 })
+      }
+    }
+    throw error
+  }
+  const messageId = commandResult.result.id
+
+  const response = Response.json({ id: messageId }, { status: 201 })
+  attachOperationMetadataHeader(response, commandResult.logEntry, {
+    resourceKind: 'messages.message',
+    resourceId: messageId,
+  })
+  return response
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Messages',
+  methods: {
+    POST: {
+      summary: 'Reply to message',
+      requestBody: { schema: replyOpenApiSchema },
+      responses: [
+        { status: 201, description: 'Reply created', schema: forwardResponseSchema },
+      ],
+      errors: [
+        { status: 403, description: 'Access denied', schema: errorResponseSchema },
+        { status: 404, description: 'Message not found', schema: errorResponseSchema },
+        { status: 409, description: 'Reply not allowed for message type', schema: errorResponseSchema },
+        { status: 409, description: 'No recipients available for reply', schema: errorResponseSchema },
+      ],
+    },
+  },
+}