@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/src/modules/customers/api/deals/[id]/stats/route.ts

@@ -0,0 +1,221 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { CustomerDeal, CustomerPipeline } from '../../../../data/entities'
+import { DictionaryEntry } from '@open-mercato/core/modules/dictionaries/data/entities'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.deals.view'] },
+}
+
+const paramsSchema = z.object({
+  id: z.string().uuid(),
+})
+
+function notFound(message: string) {
+  return NextResponse.json({ error: message }, { status: 404 })
+}
+
+function forbidden(message: string) {
+  return NextResponse.json({ error: message }, { status: 403 })
+}
+
+function badRequest(message: string, code?: string) {
+  return NextResponse.json(
+    code ? { error: message, code } : { error: message },
+    { status: 400 },
+  )
+}
+
+function startOfIsoWeek(date: Date): Date {
+  const value = new Date(date)
+  const day = value.getDay()
+  const diff = day === 0 ? -6 : 1 - day
+  value.setHours(0, 0, 0, 0)
+  value.setDate(value.getDate() + diff)
+  return value
+}
+
+function startOfQuarter(date: Date): Date {
+  return new Date(date.getFullYear(), Math.floor(date.getMonth() / 3) * 3, 1)
+}
+
+function calculateSalesCycleDays(createdAt: Date, closedAt: Date): number {
+  const diffMs = closedAt.getTime() - createdAt.getTime()
+  if (diffMs <= 0) return 0
+  return Math.floor(diffMs / 86400000)
+}
+
+export async function GET(request: Request, context: { params?: Record<string, unknown> }) {
+  const { translate } = await resolveTranslations()
+  const parsedParams = paramsSchema.safeParse(context.params)
+  if (!parsedParams.success) {
+    return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
+  }
+
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(request)
+  if (!auth?.sub && !auth?.isApiKey) {
+    return NextResponse.json({ error: translate('customers.errors.authentication_required', 'Authentication required') }, { status: 401 })
+  }
+
+  let rbac: RbacService | null = null
+  try {
+    rbac = (container.resolve('rbacService') as RbacService)
+  } catch {
+    rbac = null
+  }
+
+  if (!rbac || !auth?.sub) {
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+  }
+  const hasFeature = await rbac.userHasAllFeatures(auth.sub, ['customers.deals.view'], {
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+  })
+  if (!hasFeature) {
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+  }
+
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })
+  const em = (container.resolve('em') as EntityManager)
+  const deal = await findOneWithDecryption(
+    em,
+    CustomerDeal,
+    { id: parsedParams.data.id, tenantId: auth.tenantId ?? null, deletedAt: null },
+    {},
+    { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
+  )
+  if (!deal) {
+    return notFound(translate('customers.errors.deal_not_found', 'Deal not found'))
+  }
+
+  const allowedOrgIds = new Set<string>()
+  if (Array.isArray(scope?.filterIds)) {
+    scope.filterIds.forEach((id) => {
+      if (typeof id === 'string' && id.trim().length) allowedOrgIds.add(id)
+    })
+  } else if (auth.orgId) {
+    allowedOrgIds.add(auth.orgId)
+  }
+  if (allowedOrgIds.size && deal.organizationId && !allowedOrgIds.has(deal.organizationId)) {
+    return forbidden(translate('customers.errors.access_denied', 'Access denied'))
+  }
+
+  if (!deal.closureOutcome) {
+    return badRequest(translate('customers.errors.deal_not_closed', 'Deal is not closed'), 'DEAL_NOT_CLOSED')
+  }
+
+  const now = new Date()
+  const weekStart = startOfIsoWeek(now)
+  const quarterStart = startOfQuarter(now)
+  const dealsClosedThisPeriod = await em.count(CustomerDeal, {
+    organizationId: deal.organizationId,
+    tenantId: deal.tenantId,
+    closureOutcome: deal.closureOutcome,
+    deletedAt: null,
+    updatedAt: { $gte: weekStart },
+  })
+
+  let dealRankInQuarter: number | null = null
+  if (deal.closureOutcome === 'won' && deal.valueAmount !== null) {
+    const higherValueDeals = await em.count(CustomerDeal, {
+      organizationId: deal.organizationId,
+      tenantId: deal.tenantId,
+      closureOutcome: 'won',
+      deletedAt: null,
+      updatedAt: { $gte: quarterStart },
+      valueAmount: { $gt: deal.valueAmount },
+    })
+    dealRankInQuarter = higherValueDeals + 1
+  }
+
+  const pipeline = deal.pipelineId
+    ? await findOneWithDecryption(
+      em,
+      CustomerPipeline,
+      { id: deal.pipelineId, tenantId: deal.tenantId, organizationId: deal.organizationId },
+      {},
+      { tenantId: deal.tenantId, organizationId: deal.organizationId },
+    )
+    : null
+
+  let lossReasonLabel: string | null = null
+  if (deal.lossReasonId) {
+    const dictionaryEntry = await findOneWithDecryption(
+      em,
+      DictionaryEntry,
+      {
+        id: deal.lossReasonId,
+        organizationId: deal.organizationId,
+        tenantId: deal.tenantId,
+      },
+      { populate: ['dictionary'] },
+      { tenantId: deal.tenantId, organizationId: deal.organizationId },
+    )
+    const dictionaryKey =
+      dictionaryEntry?.dictionary &&
+      typeof (dictionaryEntry.dictionary as { key?: unknown }).key === 'string'
+        ? (dictionaryEntry.dictionary as { key: string }).key
+        : null
+    if (dictionaryKey === 'sales.deal_loss_reason') {
+      lossReasonLabel = dictionaryEntry?.label ?? dictionaryEntry?.value ?? null
+    }
+  }
+
+  return NextResponse.json({
+    dealValue: deal.valueAmount !== null ? Number(deal.valueAmount) : null,
+    dealCurrency: deal.valueCurrency ?? null,
+    closureOutcome: deal.closureOutcome,
+    closedAt: deal.updatedAt.toISOString(),
+    pipelineName: pipeline?.name ?? null,
+    dealsClosedThisPeriod,
+    salesCycleDays: calculateSalesCycleDays(deal.createdAt, deal.updatedAt),
+    dealRankInQuarter,
+    lossReason: lossReasonLabel,
+  })
+}
+
+const dealStatsResponseSchema = z.object({
+  dealValue: z.number().nullable(),
+  dealCurrency: z.string().nullable(),
+  closureOutcome: z.enum(['won', 'lost']),
+  closedAt: z.string(),
+  pipelineName: z.string().nullable(),
+  dealsClosedThisPeriod: z.number().int(),
+  salesCycleDays: z.number().int().nullable(),
+  dealRankInQuarter: z.number().int().nullable(),
+  lossReason: z.string().nullable(),
+})
+
+const dealStatsErrorSchema = z.object({
+  error: z.string(),
+  code: z.string().optional(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Fetch deal closure stats',
+  methods: {
+    GET: {
+      summary: 'Fetch analytics for a closed deal',
+      description: 'Returns week-to-date closure counts, sales cycle length, quarter ranking, and loss reason context for a closed deal.',
+      responses: [
+        { status: 200, description: 'Deal closure stats payload', schema: dealStatsResponseSchema },
+      ],
+      errors: [
+        { status: 400, description: 'Deal is not closed', schema: dealStatsErrorSchema },
+        { status: 401, description: 'Unauthorized', schema: dealStatsErrorSchema },
+        { status: 403, description: 'Forbidden for tenant/organization scope', schema: dealStatsErrorSchema },
+        { status: 404, description: 'Deal not found', schema: dealStatsErrorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customers/api/deals/route.ts

@@ -1,4 +1,3 @@
-/* eslint-disable @typescript-eslint/no-explicit-any */
 import { z } from 'zod'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
@@ -115,6 +114,9 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
       'expected_close_at',
       'owner_user_id',
       'source',
+      'closure_outcome',
+      'loss_reason_id',
+      'loss_notes',
       'organization_id',
       'tenant_id',
       'created_at',
@@ -129,9 +131,11 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
       title: 'title',
       value: 'value_amount',
     },
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
     buildFilters: async (query: any, ctx) => {
       const advancedQuery = { ...query }
       const advancedFilterState = consumeAdvancedFilterState(query)
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const filters: Record<string, any> = {}
       if (query.search) {
         const matchingIds = ctx
@@ -250,12 +254,14 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
       }
       const personIds = normalizeUuidList(allPersonCandidates)
       const companyIds = normalizeUuidList(allCompanyCandidates)
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       ;(ctx as any).__dealsFilters = {
         personIds,
         companyIds,
       }
     },
     afterList: async (payload, ctx) => {
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
       const filters = ((ctx as any).__dealsFilters || {}) as {
         personIds?: string[]
         companyIds?: string[]
@@ -266,19 +272,12 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
       const items = Array.isArray(payload.items) ? payload.items : []
       if (!items.length) return
       const scopeSource = (items[0] ?? {}) as Record<string, unknown>
-      const fallbackTenantId =
-        (typeof scopeSource.tenantId === 'string' && scopeSource.tenantId.trim().length
-          ? scopeSource.tenantId
-          : typeof (scopeSource as any).tenant_id === 'string' && (scopeSource as any).tenant_id.trim().length
-            ? (scopeSource as any).tenant_id
-            : null) ?? (ctx as any)?.auth?.tenantId ?? null
-      const fallbackOrganizationId =
-        (typeof scopeSource.organizationId === 'string' && scopeSource.organizationId.trim().length
-          ? scopeSource.organizationId
-          : typeof (scopeSource as any).organization_id === 'string' &&
-              (scopeSource as any).organization_id.trim().length
-            ? (scopeSource as any).organization_id
-            : null) ?? (ctx as any)?.auth?.orgId ?? null
+      const tenantIdRaw = scopeSource.tenantId ?? scopeSource.tenant_id
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const fallbackTenantId = (typeof tenantIdRaw === 'string' && tenantIdRaw.trim().length ? tenantIdRaw : null) ?? (ctx as any)?.auth?.tenantId ?? null
+      const orgIdRaw = scopeSource.organizationId ?? scopeSource.organization_id
+      // eslint-disable-next-line @typescript-eslint/no-explicit-any
+      const fallbackOrganizationId = (typeof orgIdRaw === 'string' && orgIdRaw.trim().length ? orgIdRaw : null) ?? (ctx as any)?.auth?.orgId ?? null
       const ids = items
         .map((item: unknown) => {
           if (!item || typeof item !== 'object') return null
@@ -314,25 +313,20 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
         const personMemberships = new Map<string, Set<string>>()
         allPersonLinks.forEach((link) => {
           const deal = link.deal
-          const dealId =
-            typeof deal === 'string'
-              ? deal
-              : deal && typeof deal === 'object' && 'id' in deal && typeof (deal as any).id === 'string'
-                ? (deal as any).id
-                : null
+          const dealRecord = deal && typeof deal === 'object' ? deal as unknown as Record<string, unknown> : null
+          const dealId = typeof deal === 'string' ? deal
+            : dealRecord && typeof dealRecord.id === 'string' ? dealRecord.id
+            : null
           if (!dealId) return
           const personRef = link.person
-          const personId =
-            typeof personRef === 'string'
-              ? personRef
-              : personRef && typeof personRef === 'object' && 'id' in personRef && typeof (personRef as any).id === 'string'
-                ? (personRef as any).id
-                : null
+          const personRecord = personRef && typeof personRef === 'object' ? personRef as unknown as Record<string, unknown> : null
+          const personId = typeof personRef === 'string' ? personRef
+            : personRecord && typeof personRecord.id === 'string' ? personRecord.id
+            : null
           if (!personId) return
-          const label =
-            personRef && typeof personRef === 'object' && 'displayName' in personRef && typeof (personRef as any).displayName === 'string'
-              ? (personRef as any).displayName
-              : ''
+          const label = personRecord && typeof personRecord.displayName === 'string'
+            ? personRecord.displayName
+            : ''
           const bucket = personAssignments.get(dealId) ?? []
           if (!bucket.some((entry) => entry.id === personId)) {
             bucket.push({ id: personId, label })
@@ -347,25 +341,20 @@ const crud = makeCrudRoute<unknown, unknown, DealListQuery>({
         const companyMemberships = new Map<string, Set<string>>()
         allCompanyLinks.forEach((link) => {
           const deal = link.deal
-          const dealId =
-            typeof deal === 'string'
-              ? deal
-              : deal && typeof deal === 'object' && 'id' in deal && typeof (deal as any).id === 'string'
-                ? (deal as any).id
-                : null
+          const dealRecord = deal && typeof deal === 'object' ? deal as unknown as Record<string, unknown> : null
+          const dealId = typeof deal === 'string' ? deal
+            : dealRecord && typeof dealRecord.id === 'string' ? dealRecord.id
+            : null
           if (!dealId) return
           const companyRef = link.company
-          const companyId =
-            typeof companyRef === 'string'
-              ? companyRef
-              : companyRef && typeof companyRef === 'object' && 'id' in companyRef && typeof (companyRef as any).id === 'string'
-                ? (companyRef as any).id
-                : null
+          const companyRecord = companyRef && typeof companyRef === 'object' ? companyRef as unknown as Record<string, unknown> : null
+          const companyId = typeof companyRef === 'string' ? companyRef
+            : companyRecord && typeof companyRecord.id === 'string' ? companyRecord.id
+            : null
           if (!companyId) return
-          const label =
-            companyRef && typeof companyRef === 'object' && 'displayName' in companyRef && typeof (companyRef as any).displayName === 'string'
-              ? (companyRef as any).displayName
-              : ''
+          const label = companyRecord && typeof companyRecord.displayName === 'string'
+            ? companyRecord.displayName
+            : ''
           const bucket = companyAssignments.get(dealId) ?? []
           if (!bucket.some((entry) => entry.id === companyId)) {
             bucket.push({ id: companyId, label })

package/src/modules/customers/api/dictionaries/[kind]/[id]/route.ts

@@ -6,9 +6,15 @@ import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
 import type { CommandExecuteResult } from '@open-mercato/shared/lib/commands/types'
 import { CustomerDictionaryEntry } from '../../../../data/entities'
-import { mapDictionaryKind, resolveDictionaryRouteContext } from '../../context'
+import { mapDictionaryKind, resolveDictionaryActorId, resolveDictionaryRouteContext } from '../../context'
 import { invalidateDictionaryCache } from '../../cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
 
 const paramsSchema = z.object({
   id: z.string().uuid(),
@@ -30,6 +36,10 @@ export const metadata = {
   DELETE: { requireAuth: true, requireFeatures: ['customers.settings.manage'] },
 }
 
+function formatCountMessage(template: string, count: number) {
+  return template.replace('{{count}}', String(count))
+}
+
 export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?: string } }) {
   try {
     const routeContext = await resolveDictionaryRouteContext(req)
@@ -38,7 +48,22 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
     }
     const { mappedKind } = mapDictionaryKind(ctx.params?.kind)
     const { id } = paramsSchema.parse({ id: ctx.params?.id })
-    const payload = patchSchema.parse(await req.json().catch(() => ({})))
+    const payload = patchSchema.parse(await readJsonSafe(req, {}))
+    const guardUserId = resolveDictionaryActorId(routeContext.auth)
+    const guardResult = await validateCrudMutationGuard(routeContext.container, {
+      tenantId: routeContext.tenantId,
+      organizationId: routeContext.organizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.dictionary_entry',
+      resourceId: id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)
     let commandResult: CommandExecuteResult<{ entryId: string; changed: boolean }>
     try {
@@ -61,6 +86,19 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
           throw new CrudHttpError(404, { error: routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found') })
         }
         if (err.status === 409) {
+          if ((err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {
+            const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)
+            throw new CrudHttpError(409, {
+              ...(err.body as Record<string, unknown> | undefined),
+              error: formatCountMessage(
+                routeContext.translate(
+                  'customers.config.dictionaries.errors.roleTypeValueInUse',
+                  'This role type is assigned to {{count}} records. Remove or replace those assignments before changing its value.',
+                ),
+                usageCount,
+              ),
+            })
+          }
           throw new CrudHttpError(409, { error: routeContext.translate('customers.config.dictionaries.errors.duplicate', 'An entry with this value already exists') })
         }
         if (err.status === 400) {
@@ -71,7 +109,16 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
     }
     const { result, logEntry } = commandResult
 
-    const entry = await routeContext.em.fork().findOne(CustomerDictionaryEntry, id)
+    const entry = await findOneWithDecryption(
+      routeContext.em.fork(),
+      CustomerDictionaryEntry,
+      { id },
+      {},
+      {
+        tenantId: routeContext.tenantId,
+        organizationId: routeContext.organizationId,
+      },
+    )
     if (!entry) {
       throw new CrudHttpError(404, { error: routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found') })
     }
@@ -107,6 +154,19 @@ export async function PATCH(req: Request, ctx: { params?: { kind?: string; id?:
         })
       )
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(routeContext.container, {
+        tenantId: routeContext.tenantId,
+        organizationId: routeContext.organizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.dictionary_entry',
+        resourceId: entry.id,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return response
   } catch (err) {
     if (err instanceof CrudHttpError) {
@@ -126,6 +186,21 @@ export async function DELETE(req: Request, ctx: { params?: { kind?: string; id?:
     }
     const { mappedKind } = mapDictionaryKind(ctx.params?.kind)
     const { id } = paramsSchema.parse({ id: ctx.params?.id })
+    const guardUserId = resolveDictionaryActorId(routeContext.auth)
+    const guardResult = await validateCrudMutationGuard(routeContext.container, {
+      tenantId: routeContext.tenantId,
+      organizationId: routeContext.organizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.dictionary_entry',
+      resourceId: id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: null,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
     const commandBus = (routeContext.container.resolve('commandBus') as CommandBus)
     let deleteResult: CommandExecuteResult<{ entryId: string }>
     try {
@@ -142,6 +217,19 @@ export async function DELETE(req: Request, ctx: { params?: { kind?: string; id?:
       if (err instanceof CrudHttpError && err.status === 404) {
         throw new CrudHttpError(404, { error: routeContext.translate('customers.errors.lookup_failed', 'Dictionary entry not found') })
       }
+      if (err instanceof CrudHttpError && err.status === 409 && (err.body as Record<string, unknown> | undefined)?.code === 'role_type_in_use') {
+        const usageCount = Number((err.body as Record<string, unknown> | undefined)?.usageCount ?? 0)
+        throw new CrudHttpError(409, {
+          ...(err.body as Record<string, unknown> | undefined),
+          error: formatCountMessage(
+            routeContext.translate(
+              'customers.config.dictionaries.errors.roleTypeDeleteInUse',
+              'This role type is assigned to {{count}} records. Remove or replace those assignments before deleting it.',
+            ),
+            usageCount,
+          ),
+        })
+      }
       throw err
     }
     const { logEntry } = deleteResult
@@ -167,6 +255,19 @@ export async function DELETE(req: Request, ctx: { params?: { kind?: string; id?:
         })
       )
     }
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(routeContext.container, {
+        tenantId: routeContext.tenantId,
+        organizationId: routeContext.organizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.dictionary_entry',
+        resourceId: id,
+        operation: 'delete',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
     return response
   } catch (err) {
     if (err instanceof CrudHttpError) {
@@ -226,6 +327,7 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 401, description: 'Unauthorized', schema: dictionaryErrorSchema },
         { status: 404, description: 'Entry not found', schema: dictionaryErrorSchema },
+        { status: 409, description: 'Entry is in use and cannot be deleted', schema: dictionaryErrorSchema },
       ],
     },
   },