@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/src/modules/customers/api/companies/route.ts

@@ -1,12 +1,18 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { CustomerCompanyProfile, CustomerEntity } from '../../data/entities'
+import {
+  CustomerCompanyProfile,
+  CustomerDealCompanyLink,
+  CustomerEntity,
+  CustomerPersonCompanyLink,
+} from '../../data/entities'
 import { E } from '#generated/entities.ids.generated'
 import { companyCreateSchema, companyUpdateSchema } from '../../data/validators'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import {
+  applyEntityIdExclusion,
   applyEntityIdRestriction,
   consumeAdvancedFilterState,
   findMatchingEntityIdsWithQueryEngine,
@@ -27,6 +33,7 @@ import {
   createPagedListResponseSchema,
   defaultOkResponseSchema,
 } from '../openapi'
+import { withActiveCustomerPersonCompanyLinkFilter } from '../../lib/personCompanyLinkTable'
 import { normalizeCompanyProfilePayload } from './payload'
 
 const rawBodySchema = z.object({}).passthrough()
@@ -52,6 +59,10 @@ const listSchema = z
     id: z.string().uuid().optional(),
     tagIds: z.string().optional(),
     tagIdsEmpty: z.string().optional(),
+    excludeIds: z.string().optional(),
+    excludeLinkedPersonId: z.string().uuid().optional(),
+    excludeLinkedCompanyId: z.string().uuid().optional(),
+    excludeLinkedDealId: z.string().uuid().optional(),
   })
   .passthrough()
 
@@ -73,6 +84,9 @@ const crud = makeCrudRoute({
     tenantField: 'tenantId',
     softDeleteField: 'deletedAt',
   },
+  indexer: {
+    entityType: E.customers.customer_entity,
+  },
   list: {
     schema: listSchema,
     entityId: E.customers.customer_entity,
@@ -101,10 +115,10 @@ const crud = makeCrudRoute({
       createdAt: 'created_at',
       updatedAt: 'updated_at',
     },
-    buildFilters: async (query: any, ctx) => {
+    buildFilters: async (query, ctx) => {
       const advancedQuery = { ...query }
       const advancedFilterState = consumeAdvancedFilterState(query)
-      const filters: Record<string, any> = { kind: { $eq: 'company' } }
+      const filters: Record<string, unknown> = { kind: { $eq: 'company' } }
       if (query.id) filters.id = { $eq: query.id }
       if (query.search) {
         const matchingIds = ctx
@@ -184,6 +198,68 @@ const crud = makeCrudRoute({
       } else if (tagIds.length > 0) {
         filters['tag_assignments.tag_id'] = { $in: tagIds }
       }
+      const excludedIds = new Set<string>()
+      const excludeIdsRaw = typeof query.excludeIds === 'string' ? query.excludeIds : ''
+      excludeIdsRaw
+        .split(',')
+        .map((value: string) => value.trim())
+        .filter((value: string) => value.length > 0)
+        .forEach((value: string) => excludedIds.add(value))
+      if (ctx && query.excludeLinkedPersonId) {
+        try {
+          const em = ctx.container.resolve('em') as EntityManager
+          const decryptionScope = {
+            tenantId: ctx.auth?.tenantId ?? null,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
+          }
+          const linkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+            em,
+            { person: query.excludeLinkedPersonId },
+            'customers.companies.GET',
+          )
+          const links = await findWithDecryption(
+            em,
+            CustomerPersonCompanyLink,
+            linkWhere,
+            { populate: ['company'] },
+            decryptionScope,
+          )
+          links.forEach((link) => {
+            const companyId = link.company?.id
+            if (typeof companyId === 'string' && companyId.length > 0) excludedIds.add(companyId)
+          })
+        } catch (err) {
+          console.warn('[customers.companies.list] exclusion lookup failed; falling back to base result set', err)
+        }
+      }
+      if (typeof query.excludeLinkedCompanyId === 'string' && query.excludeLinkedCompanyId.length > 0) {
+        excludedIds.add(query.excludeLinkedCompanyId)
+      }
+      if (ctx && query.excludeLinkedDealId) {
+        try {
+          const em = ctx.container.resolve('em') as EntityManager
+          const decryptionScope = {
+            tenantId: ctx.auth?.tenantId ?? null,
+            organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
+          }
+          const links = await findWithDecryption(
+            em,
+            CustomerDealCompanyLink,
+            {
+              deal: query.excludeLinkedDealId,
+            },
+            { populate: ['company'] },
+            decryptionScope,
+          )
+          links.forEach((link) => {
+            const companyId = link.company?.id
+            if (typeof companyId === 'string' && companyId.length > 0) excludedIds.add(companyId)
+          })
+        } catch (err) {
+          console.warn('[customers.companies.list] exclusion lookup failed; falling back to base result set', err)
+        }
+      }
+      applyEntityIdExclusion(filters, Array.from(excludedIds))
       const email = typeof query.email === 'string' ? query.email.trim().toLowerCase() : ''
       const emailStartsWith = typeof query.emailStartsWith === 'string' ? query.emailStartsWith.trim().toLowerCase() : ''
       const emailContains = typeof query.emailContains === 'string' ? query.emailContains.trim().toLowerCase() : ''
@@ -220,7 +296,7 @@ const crud = makeCrudRoute({
       }
       if (ctx) {
         try {
-          const em = ctx.container.resolve('em') as any
+          const em = ctx.container.resolve('em') as EntityManager
           const cfFilters = await buildCustomFieldFiltersFromQuery({
             entityIds: [E.customers.customer_entity, E.customers.customer_company_profile],
             query,
@@ -228,8 +304,8 @@ const crud = makeCrudRoute({
             tenantId: ctx.auth?.tenantId ?? null,
           })
           Object.assign(filters, cfFilters)
-        } catch {
-          // ignore custom field filter errors; fall back to base filters
+        } catch (err) {
+          console.warn('[customers.companies.list] custom field filter resolution failed; falling back to base filters', err)
         }
       }
       if (ctx && advancedFilterState) {
@@ -282,11 +358,12 @@ const crud = makeCrudRoute({
         type: 'left',
       },
     ],
-    transformItem: (item: any) => {
-      if (!item) return item
-      const normalized = { ...item }
+    transformItem: (item) => {
+      if (!item || typeof item !== 'object') return item
+      const record = item as Record<string, unknown>
+      const normalized: Record<string, unknown> = { ...record }
       delete normalized.kind
-      const cfEntries = extractAllCustomFieldEntries(item)
+      const cfEntries = extractAllCustomFieldEntries(record)
       for (const key of Object.keys(normalized)) {
         if (key.startsWith('cf:')) {
           delete normalized[key]
@@ -360,10 +437,10 @@ const crud = makeCrudRoute({
       }
 
       const profiles = await findWithDecryption(
-        ctx.container.resolve('em') as any,
+        ctx.container.resolve('em') as EntityManager,
         CustomerCompanyProfile,
-        where as any,
-        { populate: ['entity'] } as any,
+        where as FilterQuery<CustomerCompanyProfile>,
+        { populate: ['entity'] },
         {
           tenantId: ctx.auth?.tenantId ?? null,
           organizationId: ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null,
@@ -372,7 +449,8 @@ const crud = makeCrudRoute({
 
       const profilesByEntityId = new Map<string, CustomerCompanyProfile>()
       for (const profile of profiles) {
-        const entityId = typeof (profile as any)?.entity?.id === 'string' ? (profile as any).entity.id : null
+        const profileEntity = (profile as { entity?: { id?: unknown } }).entity
+        const entityId = typeof profileEntity?.id === 'string' ? profileEntity.id : null
         if (entityId) profilesByEntityId.set(entityId, profile)
       }
 

package/src/modules/customers/api/deals/[id]/companies/route.ts

@@ -0,0 +1,203 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CustomerCompanyProfile, CustomerDeal, CustomerDealCompanyLink, CustomerEntity } from '../../../../data/entities'
+
+const paramsSchema = z.object({
+  id: z.string().uuid(),
+})
+
+const querySchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(20),
+  search: z.string().optional(),
+  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),
+})
+
+type DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'
+
+function normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {
+  if (sort === 'name-asc') return 'label-asc'
+  if (sort === 'name-desc') return 'label-desc'
+  return sort
+}
+
+type DealCompanyItem = {
+  id: string
+  label: string
+  subtitle: string | null
+  kind: 'company'
+  linkedAt: string
+}
+
+function matchesSearch(item: DealCompanyItem, query: string): boolean {
+  const normalized = query.trim().toLowerCase()
+  if (!normalized.length) return true
+  return [item.label, item.subtitle]
+    .filter((value): value is string => typeof value === 'string' && value.length > 0)
+    .some((value) => value.toLowerCase().includes(normalized))
+}
+
+function sortItems(items: DealCompanyItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealCompanyItem[] {
+  if (sort === 'recent') {
+    return [...items].sort((left, right) => {
+      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()
+      if (compare !== 0) return compare
+      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })
+    })
+  }
+  return [...items].sort((left, right) => {
+    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })
+    return sort === 'label-asc' ? compare : -compare
+  })
+}
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },
+}
+
+export async function GET(req: Request, ctx: { params?: { id?: string } }) {
+  const { translate } = await resolveTranslations()
+  try {
+    const { id } = paramsSchema.parse({ id: ctx.params?.id })
+    const auth = await getAuthFromRequest(req)
+    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })
+
+    const url = new URL(req.url)
+    const query = querySchema.parse({
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+      search: url.searchParams.get('search') ?? undefined,
+      sort: url.searchParams.get('sort') ?? undefined,
+    })
+
+    const container = await createRequestContainer()
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const em = (container.resolve('em') as EntityManager).fork()
+    const decryptionScope = {
+      tenantId: auth.tenantId,
+      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+    }
+
+    const deal = await findOneWithDecryption(
+      em,
+      CustomerDeal,
+      { id, tenantId: auth.tenantId, deletedAt: null },
+      {},
+      decryptionScope,
+    )
+    if (!deal) {
+      throw new CrudHttpError(404, { error: translate('customers.errors.deal_not_found', 'Deal not found') })
+    }
+
+    const allowedOrgIds = new Set<string>()
+    if (scope?.filterIds?.length) scope.filterIds.forEach((entry) => allowedOrgIds.add(entry))
+    else if (auth.orgId) allowedOrgIds.add(auth.orgId)
+    if (allowedOrgIds.size > 0 && deal.organizationId && !allowedOrgIds.has(deal.organizationId)) {
+      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    }
+
+    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }
+    const links = await findWithDecryption(
+      em,
+      CustomerDealCompanyLink,
+      { deal: deal.id },
+      { populate: ['company'] },
+      entityScope,
+    )
+
+    const companyIds = links
+      .map((link) => link.company?.id)
+      .filter((companyId): companyId is string => typeof companyId === 'string' && companyId.length > 0)
+    const profiles = companyIds.length > 0
+      ? await findWithDecryption(
+          em,
+          CustomerCompanyProfile,
+          {
+            entity: { $in: companyIds },
+            tenantId: deal.tenantId,
+            organizationId: deal.organizationId,
+          },
+          {},
+          entityScope,
+        )
+      : []
+    const profileByCompanyId = new Map(
+      profiles.map((profile) => [(profile.entity as { id: string }).id, profile]),
+    )
+
+    const items = links
+      .map((link) => {
+        const company = link.company as CustomerEntity | null
+        if (!company?.id) return null
+        const profile = profileByCompanyId.get(company.id) ?? null
+        return {
+          id: company.id,
+          label: company.displayName ?? profile?.domain ?? company.id,
+          subtitle: profile?.domain ?? company.primaryEmail ?? company.primaryPhone ?? null,
+          kind: 'company',
+          linkedAt: link.createdAt.toISOString(),
+        } satisfies DealCompanyItem
+      })
+      .filter((item): item is DealCompanyItem => item !== null)
+
+    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items
+    const sorted = sortItems(filtered, normalizeSort(query.sort))
+    const total = sorted.length
+    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))
+    const page = Math.min(query.page, totalPages)
+    const start = (page - 1) * query.pageSize
+
+    return NextResponse.json({
+      items: sorted.slice(start, start + query.pageSize),
+      total,
+      page,
+      pageSize: query.pageSize,
+      totalPages,
+    })
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    console.error('[customers.deals.companies.GET]', error)
+    return NextResponse.json({ error: translate('customers.errors.deal_companies_load_failed', 'Failed to load linked companies') }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  methods: {
+    GET: {
+      summary: 'List linked companies for a deal',
+      query: querySchema,
+      responses: [
+        {
+          status: 200,
+          description: 'Paginated linked companies',
+          schema: z.object({
+            items: z.array(
+              z.object({
+                id: z.string().uuid(),
+                label: z.string(),
+                subtitle: z.string().nullable(),
+                kind: z.literal('company'),
+                linkedAt: z.string(),
+              }),
+            ),
+            total: z.number().int().nonnegative(),
+            page: z.number().int().min(1),
+            pageSize: z.number().int().min(1),
+            totalPages: z.number().int().min(1),
+          }),
+        },
+      ],
+    },
+  },
+}

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -0,0 +1,182 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { CustomerDeal, CustomerDealPersonLink, CustomerEntity } from '../../../../data/entities'
+
+const paramsSchema = z.object({
+  id: z.string().uuid(),
+})
+
+const querySchema = z.object({
+  page: z.coerce.number().min(1).default(1),
+  pageSize: z.coerce.number().min(1).max(100).default(20),
+  search: z.string().optional(),
+  sort: z.enum(['label-asc', 'label-desc', 'name-asc', 'name-desc', 'recent']).default('label-asc'),
+})
+
+type DealLinkedEntitySort = 'label-asc' | 'label-desc' | 'recent'
+
+function normalizeSort(sort: z.infer<typeof querySchema>['sort']): DealLinkedEntitySort {
+  if (sort === 'name-asc') return 'label-asc'
+  if (sort === 'name-desc') return 'label-desc'
+  return sort
+}
+
+type DealPersonItem = {
+  id: string
+  label: string
+  subtitle: string | null
+  kind: 'person'
+  linkedAt: string
+}
+
+function matchesSearch(item: DealPersonItem, query: string): boolean {
+  const normalized = query.trim().toLowerCase()
+  if (!normalized.length) return true
+  return [item.label, item.subtitle]
+    .filter((value): value is string => typeof value === 'string' && value.length > 0)
+    .some((value) => value.toLowerCase().includes(normalized))
+}
+
+function sortItems(items: DealPersonItem[], sort: 'label-asc' | 'label-desc' | 'recent'): DealPersonItem[] {
+  if (sort === 'recent') {
+    return [...items].sort((left, right) => {
+      const compare = new Date(right.linkedAt).getTime() - new Date(left.linkedAt).getTime()
+      if (compare !== 0) return compare
+      return left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })
+    })
+  }
+  return [...items].sort((left, right) => {
+    const compare = left.label.localeCompare(right.label, undefined, { sensitivity: 'base' })
+    return sort === 'label-asc' ? compare : -compare
+  })
+}
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },
+}
+
+export async function GET(req: Request, ctx: { params?: { id?: string } }) {
+  const { translate } = await resolveTranslations()
+  try {
+    const { id } = paramsSchema.parse({ id: ctx.params?.id })
+    const auth = await getAuthFromRequest(req)
+    if (!auth?.tenantId) throw new CrudHttpError(401, { error: 'Unauthorized' })
+
+    const url = new URL(req.url)
+    const query = querySchema.parse({
+      page: url.searchParams.get('page') ?? undefined,
+      pageSize: url.searchParams.get('pageSize') ?? undefined,
+      search: url.searchParams.get('search') ?? undefined,
+      sort: url.searchParams.get('sort') ?? undefined,
+    })
+
+    const container = await createRequestContainer()
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    const em = (container.resolve('em') as EntityManager).fork()
+    const decryptionScope = {
+      tenantId: auth.tenantId,
+      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+    }
+
+    const deal = await findOneWithDecryption(
+      em,
+      CustomerDeal,
+      { id, tenantId: auth.tenantId, deletedAt: null },
+      {},
+      decryptionScope,
+    )
+    if (!deal) {
+      throw new CrudHttpError(404, { error: translate('customers.errors.deal_not_found', 'Deal not found') })
+    }
+
+    const allowedOrgIds = new Set<string>()
+    if (scope?.filterIds?.length) scope.filterIds.forEach((entry) => allowedOrgIds.add(entry))
+    else if (auth.orgId) allowedOrgIds.add(auth.orgId)
+    if (allowedOrgIds.size > 0 && deal.organizationId && !allowedOrgIds.has(deal.organizationId)) {
+      throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+    }
+
+    const entityScope = { tenantId: deal.tenantId, organizationId: deal.organizationId }
+    const links = await findWithDecryption(
+      em,
+      CustomerDealPersonLink,
+      { deal: deal.id },
+      { populate: ['person'] },
+      entityScope,
+    )
+
+    const items = links
+      .map((link) => {
+        const person = link.person as CustomerEntity | null
+        if (!person?.id) return null
+        return {
+          id: person.id,
+          label: person.displayName ?? person.primaryEmail ?? person.id,
+          subtitle: person.primaryEmail ?? person.primaryPhone ?? null,
+          kind: 'person',
+          linkedAt: link.createdAt.toISOString(),
+        } satisfies DealPersonItem
+      })
+      .filter((item): item is DealPersonItem => item !== null)
+
+    const filtered = query.search?.trim().length ? items.filter((item) => matchesSearch(item, query.search ?? '')) : items
+    const sorted = sortItems(filtered, normalizeSort(query.sort))
+    const total = sorted.length
+    const totalPages = Math.max(1, Math.ceil(total / query.pageSize))
+    const page = Math.min(query.page, totalPages)
+    const start = (page - 1) * query.pageSize
+
+    return NextResponse.json({
+      items: sorted.slice(start, start + query.pageSize),
+      total,
+      page,
+      pageSize: query.pageSize,
+      totalPages,
+    })
+  } catch (error) {
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    console.error('[customers.deals.people.GET]', error)
+    return NextResponse.json({ error: translate('customers.errors.deal_people_load_failed', 'Failed to load linked people') }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  methods: {
+    GET: {
+      summary: 'List linked people for a deal',
+      query: querySchema,
+      responses: [
+        {
+          status: 200,
+          description: 'Paginated linked people',
+          schema: z.object({
+            items: z.array(
+              z.object({
+                id: z.string().uuid(),
+                label: z.string(),
+                subtitle: z.string().nullable(),
+                kind: z.literal('person'),
+                linkedAt: z.string(),
+              }),
+            ),
+            total: z.number().int().nonnegative(),
+            page: z.number().int().min(1),
+            pageSize: z.number().int().min(1),
+            totalPages: z.number().int().min(1),
+          }),
+        },
+      ],
+    },
+  },
+}