@open-mercato/core 0.5.1-develop.2663.2c29774b5b → 0.5.1-develop.2681.c559bb2bc3

package/src/modules/customers/api/people/[id]/companies/[linkId]/route.ts

@@ -0,0 +1,331 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveAuthActorId } from '@open-mercato/core/modules/customers/lib/interactionRequestContext'
+import { CustomerPersonCompanyLink } from '@open-mercato/core/modules/customers/data/entities'
+import {
+  personCompanyLinkDeleteSchema,
+  personCompanyLinkUpdateSchema,
+  type PersonCompanyLinkDeleteInput,
+  type PersonCompanyLinkUpdateInput,
+} from '@open-mercato/core/modules/customers/data/validators'
+import { loadPersonContext } from '../context'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
+
+const paramsSchema = z.object({
+  id: z.string().uuid(),
+  linkId: z.string().uuid(),
+})
+
+/**
+ * Resolve the second path segment to a concrete `customer_person_company_links` row id.
+ * The UI on company/person detail pages calls this route with the company entity id as
+ * the last segment (symmetric with the other company-centric endpoints); older callers
+ * may pass the actual link row id. We try a direct id lookup first, then fall back to
+ * resolving via `(person, company)` pair.
+ */
+async function resolveLinkId(
+  em: EntityManager,
+  rawLinkId: string,
+  personEntityId: string,
+  tenantId: string,
+  organizationId: string | null,
+): Promise<string | null> {
+  const decryptionScope = { tenantId, organizationId }
+  const directFilter: FilterQuery<CustomerPersonCompanyLink> = organizationId
+    ? { id: rawLinkId, tenantId, organizationId, deletedAt: null }
+    : { id: rawLinkId, tenantId, deletedAt: null }
+  const direct = await findOneWithDecryption(
+    em,
+    CustomerPersonCompanyLink,
+    directFilter,
+    undefined,
+    decryptionScope,
+  )
+  if (direct) return direct.id
+
+  const companyFilter: FilterQuery<CustomerPersonCompanyLink> = organizationId
+    ? {
+        person: personEntityId,
+        company: rawLinkId,
+        tenantId,
+        organizationId,
+        deletedAt: null,
+      }
+    : { person: personEntityId, company: rawLinkId, tenantId, deletedAt: null }
+  const viaCompany = await findOneWithDecryption(
+    em,
+    CustomerPersonCompanyLink,
+    companyFilter,
+    undefined,
+    decryptionScope,
+  )
+  return viaCompany?.id ?? null
+}
+
+const updateSchema = z.object({
+  isPrimary: z.boolean().optional(),
+})
+
+const updateResponseSchema = z.object({
+  ok: z.literal(true),
+  result: z
+    .object({
+      id: z.string().uuid(),
+      companyId: z.string().uuid(),
+      displayName: z.string(),
+      isPrimary: z.boolean(),
+    })
+    .nullable(),
+})
+
+export const metadata = {
+  PATCH: { requireAuth: true, requireFeatures: ['customers.people.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['customers.people.manage'] },
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  methods: {
+    PATCH: {
+      summary: 'Update a linked company for a person',
+      requestBody: { schema: updateSchema },
+      responses: [{ status: 200, description: 'Updated company link', schema: updateResponseSchema }],
+    },
+    DELETE: {
+      summary: 'Remove a linked company from a person',
+      responses: [{ status: 200, description: 'Deletion result', schema: z.object({ ok: z.literal(true) }) }],
+    },
+  },
+}
+
+export async function PATCH(req: Request, ctx: { params?: { id?: string; linkId?: string } }) {
+  const { translate } = await resolveTranslations()
+  try {
+    const { id, linkId } = paramsSchema.parse({ id: ctx.params?.id, linkId: ctx.params?.linkId })
+    const payload = updateSchema.parse(await readJsonSafe(req, {}))
+    const { container, auth, selectedOrganizationId, person } = await loadPersonContext(req, id)
+    if (!selectedOrganizationId) {
+      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })
+    }
+    const guardUserId = resolveAuthActorId(auth)
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: auth.tenantId,
+      organizationId: selectedOrganizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.person',
+      resourceId: person.id,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: payload,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    if (payload.isPrimary === undefined) {
+      return NextResponse.json({ ok: true as const, result: null })
+    }
+
+    const resolveEm = (container.resolve('em') as EntityManager).fork()
+    const resolvedLinkId = await resolveLinkId(
+      resolveEm,
+      linkId,
+      person.id,
+      auth.tenantId,
+      selectedOrganizationId,
+    )
+    if (!resolvedLinkId) {
+      throw new CrudHttpError(404, {
+        error: translate('customers.errors.person_company_link_not_found', 'Person-company link not found'),
+      })
+    }
+
+    const commandInput = personCompanyLinkUpdateSchema.parse({
+      linkId: resolvedLinkId,
+      isPrimary: payload.isPrimary,
+      tenantId: auth.tenantId,
+      organizationId: selectedOrganizationId,
+    } satisfies PersonCompanyLinkUpdateInput)
+
+    const commandBus = container.resolve('commandBus') as CommandBus
+    const { result, logEntry } = await commandBus.execute<PersonCompanyLinkUpdateInput, { linkId: string }>(
+      'customers.personCompanyLinks.update',
+      {
+        input: commandInput,
+        ctx: {
+          container,
+          auth,
+          organizationScope: null,
+          selectedOrganizationId,
+          organizationIds: [selectedOrganizationId],
+          request: req,
+        },
+      },
+    )
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId: selectedOrganizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.person',
+        resourceId: person.id,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
+    const freshEm = (container.resolve('em') as EntityManager).fork()
+    const linkRecord = await findOneWithDecryption(
+      freshEm,
+      CustomerPersonCompanyLink,
+      { id: result.linkId, tenantId: auth.tenantId, organizationId: selectedOrganizationId },
+      { populate: ['company'] },
+      { tenantId: auth.tenantId, organizationId: selectedOrganizationId },
+    )
+    const company = linkRecord && typeof linkRecord.company !== 'string' ? linkRecord.company : null
+    const response = NextResponse.json({
+      ok: true as const,
+      result: linkRecord
+        ? {
+            id: linkRecord.id,
+            companyId: company?.id ?? '',
+            displayName: company?.displayName ?? '',
+            isPrimary: Boolean(linkRecord.isPrimary),
+          }
+        : null,
+    })
+    if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+      response.headers.set(
+        'x-om-operation',
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? 'customers.personCompanyLink',
+          resourceId: logEntry.resourceId ?? result.linkId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),
+        }),
+      )
+    }
+    return response
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    return NextResponse.json({ error: translate('customers.errors.internal', 'Internal server error') }, { status: 500 })
+  }
+}
+
+export async function DELETE(req: Request, ctx: { params?: { id?: string; linkId?: string } }) {
+  const { translate } = await resolveTranslations()
+  try {
+    const { id, linkId } = paramsSchema.parse({ id: ctx.params?.id, linkId: ctx.params?.linkId })
+    const { container, auth, selectedOrganizationId, person } = await loadPersonContext(req, id)
+    if (!selectedOrganizationId) {
+      throw new CrudHttpError(400, { error: translate('customers.errors.organization_required', 'Organization context is required') })
+    }
+    const guardUserId = resolveAuthActorId(auth)
+    const guardResult = await validateCrudMutationGuard(container, {
+      tenantId: auth.tenantId,
+      organizationId: selectedOrganizationId,
+      userId: guardUserId,
+      resourceKind: 'customers.person',
+      resourceId: person.id,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: { id: linkId },
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    const resolveEm = (container.resolve('em') as EntityManager).fork()
+    const resolvedLinkId = await resolveLinkId(
+      resolveEm,
+      linkId,
+      person.id,
+      auth.tenantId,
+      selectedOrganizationId,
+    )
+    if (!resolvedLinkId) {
+      throw new CrudHttpError(404, {
+        error: translate('customers.errors.person_company_link_not_found', 'Person-company link not found'),
+      })
+    }
+
+    const commandInput = personCompanyLinkDeleteSchema.parse({
+      linkId: resolvedLinkId,
+      tenantId: auth.tenantId,
+      organizationId: selectedOrganizationId,
+    } satisfies PersonCompanyLinkDeleteInput)
+
+    const commandBus = container.resolve('commandBus') as CommandBus
+    const { result, logEntry } = await commandBus.execute<PersonCompanyLinkDeleteInput, { linkId: string }>(
+      'customers.personCompanyLinks.delete',
+      {
+        input: commandInput,
+        ctx: {
+          container,
+          auth,
+          organizationScope: null,
+          selectedOrganizationId,
+          organizationIds: [selectedOrganizationId],
+          request: req,
+        },
+      },
+    )
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(container, {
+        tenantId: auth.tenantId,
+        organizationId: selectedOrganizationId,
+        userId: guardUserId,
+        resourceKind: 'customers.person',
+        resourceId: person.id,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
+    const response = NextResponse.json({ ok: true as const })
+    if (logEntry?.undoToken && logEntry.id && logEntry.commandId) {
+      response.headers.set(
+        'x-om-operation',
+        serializeOperationMetadata({
+          id: logEntry.id,
+          undoToken: logEntry.undoToken,
+          commandId: logEntry.commandId,
+          actionLabel: logEntry.actionLabel ?? null,
+          resourceKind: logEntry.resourceKind ?? 'customers.personCompanyLink',
+          resourceId: logEntry.resourceId ?? result.linkId,
+          executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),
+        }),
+      )
+    }
+    return response
+  } catch (err) {
+    if (err instanceof CrudHttpError) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    return NextResponse.json({ error: translate('customers.errors.internal', 'Internal server error') }, { status: 500 })
+  }
+}

package/src/modules/customers/api/people/[id]/companies/context.ts

@@ -0,0 +1,70 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import {
+  CustomerEntity,
+  CustomerPersonProfile,
+} from '@open-mercato/core/modules/customers/data/entities'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export async function loadPersonContext(req: Request, personId: string) {
+  const { translate } = await resolveTranslations()
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.tenantId) {
+    throw new CrudHttpError(401, { error: translate('customers.errors.unauthorized', 'Unauthorized') })
+  }
+  const authenticatedAuth = auth as typeof auth & { tenantId: string }
+
+  const container = await createRequestContainer()
+  const scope = await resolveOrganizationScopeForRequest({ container, auth: authenticatedAuth, request: req })
+  const em = (container.resolve('em') as EntityManager).fork()
+  const decryptionScope = {
+    tenantId: authenticatedAuth.tenantId,
+    organizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null,
+  }
+  const person = await findOneWithDecryption(
+    em,
+    CustomerEntity,
+    { id: personId, kind: 'person', tenantId: authenticatedAuth.tenantId, deletedAt: null },
+    {},
+    decryptionScope,
+  )
+
+  if (!person) {
+    throw new CrudHttpError(404, { error: translate('customers.errors.person_not_found', 'Person not found') })
+  }
+
+  const allowedOrgIds = new Set<string>()
+  if (scope?.filterIds?.length) scope.filterIds.forEach((entry) => allowedOrgIds.add(entry))
+  else if (authenticatedAuth.orgId) allowedOrgIds.add(authenticatedAuth.orgId)
+
+  if (allowedOrgIds.size > 0 && !allowedOrgIds.has(person.organizationId)) {
+    throw new CrudHttpError(403, { error: translate('customers.errors.access_denied', 'Access denied') })
+  }
+
+  const profile = await findOneWithDecryption(
+    em,
+    CustomerPersonProfile,
+    { entity: person, tenantId: person.tenantId, organizationId: person.organizationId },
+    { populate: ['company'] },
+    {
+      tenantId: person.tenantId,
+      organizationId: person.organizationId,
+    },
+  )
+  if (!profile) {
+    throw new CrudHttpError(404, { error: translate('customers.errors.person_profile_not_found', 'Person profile not found') })
+  }
+
+  return {
+    container,
+    auth: authenticatedAuth,
+    selectedOrganizationId: scope?.selectedId ?? authenticatedAuth.orgId ?? null,
+    em,
+    person,
+    profile,
+  }
+}