@open-mercato/core 0.6.3-develop.3651.1.d3a548a5f1 → 0.6.3-develop.3660.1.53b73d5aa4

package/src/modules/customers/api/settings/stuck-threshold/route.ts

@@ -0,0 +1,195 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import {
+  customerStuckThresholdUpsertSchema,
+  type CustomerStuckThresholdUpsertInput,
+} from '../../../data/validators'
+import { loadCustomerSettings } from '../../../commands/settings'
+import { withScopedPayload } from '../../utils'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+
+const DEFAULT_THRESHOLD = 14
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['customers.deals.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['customers.deals.manage'] },
+}
+
+type SettingsRouteContext = {
+  ctx: CommandRuntimeContext
+  tenantId: string
+  organizationId: string
+  translate: (key: string, fallback?: string) => string
+  em: EntityManager
+}
+
+async function resolveSettingsContext(req: Request): Promise<SettingsRouteContext> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, {
+      error: translate('customers.errors.unauthorized', 'Unauthorized'),
+    })
+  }
+
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const organizationId = scope?.selectedId ?? auth.orgId ?? null
+  if (!organizationId) {
+    throw new CrudHttpError(400, {
+      error: translate('customers.errors.organization_required', 'Organization context is required'),
+    })
+  }
+
+  const ctx: CommandRuntimeContext = {
+    container,
+    auth,
+    organizationScope: scope,
+    selectedOrganizationId: organizationId,
+    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+    request: req,
+  }
+
+  const em = container.resolve('em') as EntityManager
+  return {
+    ctx,
+    tenantId: auth.tenantId,
+    organizationId,
+    translate,
+    em,
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const { em, tenantId, organizationId } = await resolveSettingsContext(req)
+    const record = await loadCustomerSettings(em, { tenantId, organizationId })
+    return NextResponse.json({
+      stuckThresholdDays: record?.stuckThresholdDays ?? DEFAULT_THRESHOLD,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('customers.settings.stuck-threshold.get failed', err)
+    return NextResponse.json(
+      { error: translate('customers.errors.lookup_failed', 'Failed to load settings') },
+      { status: 400 },
+    )
+  }
+}
+
+export async function PUT(req: Request) {
+  try {
+    const { ctx, tenantId, organizationId, translate } = await resolveSettingsContext(req)
+    const payload = await readJsonSafe(req, {})
+    const scoped = withScopedPayload(payload, ctx, translate)
+    const input = customerStuckThresholdUpsertSchema.parse(scoped)
+
+    // Mutation-guard contract for custom write routes. The resource is the customer
+    // settings row scoped to the organization; we use the organizationId as the
+    // resourceId because the (tenant, organization) pair uniquely identifies it.
+    const guardResult = await validateCrudMutationGuard(ctx.container, {
+      tenantId,
+      organizationId,
+      // `resolveSettingsContext` throws 401 when auth is missing, so by the time we reach
+      // here `ctx.auth.sub` is guaranteed to be a string per `AuthContext`.
+      userId: ctx.auth!.sub,
+      resourceKind: 'customers.settings',
+      resourceId: organizationId,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    const commandBus = ctx.container.resolve('commandBus') as CommandBus
+    const { result } = await commandBus.execute<
+      CustomerStuckThresholdUpsertInput,
+      { settingsId: string; stuckThresholdDays: number }
+    >('customers.settings.save_stuck_threshold', { input, ctx })
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(ctx.container, {
+        tenantId,
+        organizationId,
+        // `resolveSettingsContext` throws 401 when auth is missing, so by the time we reach
+      // here `ctx.auth.sub` is guaranteed to be a string per `AuthContext`.
+      userId: ctx.auth!.sub,
+        resourceKind: 'customers.settings',
+        resourceId: organizationId,
+        operation: 'update',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
+    return NextResponse.json({
+      stuckThresholdDays: result?.stuckThresholdDays ?? input.stuckThresholdDays,
+    })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const { translate } = await resolveTranslations()
+    console.error('customers.settings.stuck-threshold.put failed', err)
+    return NextResponse.json(
+      { error: translate('customers.errors.save_failed', 'Failed to save settings') },
+      { status: 400 },
+    )
+  }
+}
+
+const stuckThresholdResponseSchema = z.object({
+  stuckThresholdDays: z.number(),
+})
+
+const stuckThresholdErrorSchema = z.object({
+  error: z.string(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Customers',
+  summary: 'Customer deals stuck-threshold setting',
+  methods: {
+    GET: {
+      summary: 'Retrieve stuck-threshold days',
+      description: 'Returns the current stuck-deal threshold (in days) for the selected organization.',
+      responses: [
+        { status: 200, description: 'Current threshold', schema: stuckThresholdResponseSchema },
+        { status: 401, description: 'Unauthorized', schema: stuckThresholdErrorSchema },
+        { status: 400, description: 'Organization context missing', schema: stuckThresholdErrorSchema },
+      ],
+    },
+    PUT: {
+      summary: 'Update stuck-threshold days',
+      description: 'Updates the stuck-deal threshold for the selected organization.',
+      requestBody: {
+        contentType: 'application/json',
+        schema: customerStuckThresholdUpsertSchema,
+      },
+      responses: [
+        { status: 200, description: 'Updated threshold', schema: stuckThresholdResponseSchema },
+        { status: 401, description: 'Unauthorized', schema: stuckThresholdErrorSchema },
+        { status: 400, description: 'Invalid payload', schema: stuckThresholdErrorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customers/backend/config/customers/deals/page.meta.ts

@@ -0,0 +1,36 @@
+import React from 'react'
+
+const settingsIcon = React.createElement(
+  'svg',
+  {
+    width: 16,
+    height: 16,
+    viewBox: '0 0 24 24',
+    fill: 'none',
+    stroke: 'currentColor',
+    strokeWidth: 2,
+    strokeLinecap: 'round',
+    strokeLinejoin: 'round',
+  },
+  React.createElement('circle', { cx: 12, cy: 12, r: 3 }),
+  React.createElement('path', {
+    d: 'M19.4 15a1.65 1.65 0 0 0 .33 1.82l.06.06a2 2 0 0 1 0 2.83 2 2 0 0 1-2.83 0l-.06-.06a1.65 1.65 0 0 0-1.82-.33 1.65 1.65 0 0 0-1 1.51V21a2 2 0 0 1-2 2 2 2 0 0 1-2-2v-.09A1.65 1.65 0 0 0 9 19.4a1.65 1.65 0 0 0-1.82.33l-.06.06a2 2 0 0 1-2.83 0 2 2 0 0 1 0-2.83l.06-.06a1.65 1.65 0 0 0 .33-1.82 1.65 1.65 0 0 0-1.51-1H3a2 2 0 0 1-2-2 2 2 0 0 1 2-2h.09A1.65 1.65 0 0 0 4.6 9a1.65 1.65 0 0 0-.33-1.82l-.06-.06a2 2 0 0 1 0-2.83 2 2 0 0 1 2.83 0l.06.06a1.65 1.65 0 0 0 1.82.33H9a1.65 1.65 0 0 0 1-1.51V3a2 2 0 0 1 2-2 2 2 0 0 1 2 2v.09a1.65 1.65 0 0 0 1 1.51 1.65 1.65 0 0 0 1.82-.33l.06-.06a2 2 0 0 1 2.83 0 2 2 0 0 1 0 2.83l-.06.06a1.65 1.65 0 0 0-.33 1.82V9a1.65 1.65 0 0 0 1.51 1H21a2 2 0 0 1 2 2 2 2 0 0 1-2 2h-.09a1.65 1.65 0 0 0-1.51 1z',
+  }),
+)
+
+export const metadata = {
+  requireAuth: true,
+  requireFeatures: ['customers.deals.manage'],
+  pageTitle: 'Deal settings',
+  pageTitleKey: 'customers.deals.settings.pageTitle',
+  pageGroup: 'Customers',
+  pageGroupKey: 'customers.nav.group',
+  pagePriority: 50,
+  pageOrder: 350,
+  icon: settingsIcon,
+  breadcrumb: [
+    { label: 'Settings', labelKey: 'config.nav.group' },
+    { label: 'Customers', labelKey: 'customers.nav.group' },
+    { label: 'Deal settings', labelKey: 'customers.deals.settings.pageTitle' },
+  ],
+}

package/src/modules/customers/backend/config/customers/deals/page.tsx

@@ -0,0 +1,205 @@
+"use client"
+
+import * as React from 'react'
+import { useQuery } from '@tanstack/react-query'
+import { Page, PageBody } from '@open-mercato/ui/backend/Page'
+import { Input } from '@open-mercato/ui/primitives/input'
+import { Button } from '@open-mercato/ui/primitives/button'
+import { FormField } from '@open-mercato/ui/primitives/form-field'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { apiCallOrThrow, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
+import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
+
+const SAVE_CONTEXT_ID = 'customers-deals-settings:stuck-threshold'
+const MIN_DAYS = 1
+const MAX_DAYS = 365
+
+export default function DealsSettingsPage(): React.ReactElement {
+  const t = useT()
+  const scopeVersion = useOrganizationScopeVersion()
+  const [value, setValue] = React.useState<string>('14')
+  const [validationError, setValidationError] = React.useState<string | null>(null)
+  const [isSubmitting, setIsSubmitting] = React.useState(false)
+
+  const settingsQuery = useQuery<{ stuckThresholdDays: number }>({
+    queryKey: ['customers', 'settings', 'stuck-threshold', `scope:${scopeVersion}`],
+    staleTime: 60_000,
+    queryFn: async () => {
+      const payload = await readApiResultOrThrow<{ stuckThresholdDays?: number }>(
+        '/api/customers/settings/stuck-threshold',
+        undefined,
+        {
+          errorMessage: translateWithFallback(
+            t,
+            'customers.deals.settings.loadError',
+            'Failed to load deal settings.',
+          ),
+        },
+      )
+      return { stuckThresholdDays: payload?.stuckThresholdDays ?? 14 }
+    },
+  })
+
+  React.useEffect(() => {
+    if (settingsQuery.data) {
+      setValue(String(settingsQuery.data.stuckThresholdDays))
+    }
+  }, [settingsQuery.data])
+
+  const { runMutation, retryLastMutation } = useGuardedMutation<{
+    formId: string
+    resourceKind: string
+    retryLastMutation: () => Promise<boolean>
+  }>({
+    contextId: SAVE_CONTEXT_ID,
+    blockedMessage: translateWithFallback(
+      t,
+      'ui.forms.flash.saveBlocked',
+      'Save blocked by validation',
+    ),
+  })
+
+  const handleSave = React.useCallback(async () => {
+    const parsed = Number(value)
+    if (!Number.isInteger(parsed) || parsed < MIN_DAYS || parsed > MAX_DAYS) {
+      setValidationError(
+        translateWithFallback(
+          t,
+          'customers.deals.settings.range',
+          'Enter a whole number between {min} and {max}.',
+          { min: MIN_DAYS, max: MAX_DAYS },
+        ),
+      )
+      return
+    }
+    setValidationError(null)
+    setIsSubmitting(true)
+    try {
+      await runMutation({
+        operation: async () => {
+          await apiCallOrThrow(
+            '/api/customers/settings/stuck-threshold',
+            {
+              method: 'PUT',
+              headers: { 'content-type': 'application/json' },
+              body: JSON.stringify({ stuckThresholdDays: parsed }),
+            },
+            {
+              errorMessage: translateWithFallback(
+                t,
+                'customers.deals.settings.saveError',
+                'Failed to save deal settings.',
+              ),
+            },
+          )
+        },
+        context: {
+          formId: SAVE_CONTEXT_ID,
+          resourceKind: 'customers.settings',
+          retryLastMutation,
+        },
+      })
+      flash(
+        translateWithFallback(
+          t,
+          'customers.deals.settings.saveSuccess',
+          'Deal settings saved.',
+        ),
+        'success',
+      )
+      settingsQuery.refetch().catch(() => {})
+    } catch (error) {
+      const message =
+        error instanceof Error && error.message
+          ? error.message
+          : translateWithFallback(
+              t,
+              'customers.deals.settings.saveError',
+              'Failed to save deal settings.',
+            )
+      flash(message, 'error')
+    } finally {
+      setIsSubmitting(false)
+    }
+  }, [retryLastMutation, runMutation, settingsQuery, t, value])
+
+  return (
+    <Page>
+      <PageBody>
+        <div className="flex flex-col gap-6">
+          <header className="flex flex-col gap-1">
+            <h1 className="text-2xl font-bold tracking-tight text-foreground">
+              {translateWithFallback(
+                t,
+                'customers.deals.settings.pageTitle',
+                'Deal settings',
+              )}
+            </h1>
+            <p className="text-sm text-muted-foreground">
+              {translateWithFallback(
+                t,
+                'customers.deals.settings.pageDescription',
+                'Tune how the deals kanban surfaces stale opportunities.',
+              )}
+            </p>
+          </header>
+
+          <section className="flex max-w-md flex-col gap-4 rounded-lg border border-border bg-card p-6">
+            {settingsQuery.isLoading ? (
+              <div className="flex h-24 items-center justify-center">
+                <Spinner />
+              </div>
+            ) : (
+              <>
+                <FormField
+                  label={translateWithFallback(
+                    t,
+                    'customers.deals.settings.stuckThreshold',
+                    'Stuck threshold (days)',
+                  )}
+                  description={translateWithFallback(
+                    t,
+                    'customers.deals.settings.stuckThreshold.help',
+                    'A deal is flagged as stuck after this many days in its current stage.',
+                  )}
+                  error={validationError ?? undefined}
+                  required
+                >
+                  <Input
+                    type="number"
+                    inputMode="numeric"
+                    min={MIN_DAYS}
+                    max={MAX_DAYS}
+                    value={value}
+                    onChange={(event) => {
+                      setValue(event.target.value)
+                      if (validationError) setValidationError(null)
+                    }}
+                  />
+                </FormField>
+
+                <div className="flex justify-end">
+                  <Button
+                    onClick={() => void handleSave()}
+                    type="button"
+                    disabled={isSubmitting || settingsQuery.isLoading}
+                  >
+                    {translateWithFallback(
+                      t,
+                      'customers.deals.settings.save',
+                      'Save settings',
+                    )}
+                  </Button>
+                </div>
+              </>
+            )}
+          </section>
+        </div>
+      </PageBody>
+    </Page>
+  )
+}

package/src/modules/customers/backend/customers/deals/create/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 
 import * as React from 'react'
-import { useRouter } from 'next/navigation'
+import { useRouter, useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { createCrud } from '@open-mercato/ui/backend/utils/crud'
@@ -9,15 +9,34 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { DealForm, type DealFormSubmitPayload } from '../../../../components/detail/DealForm'
 import { useCurrencyDictionary } from '../../../../components/detail/hooks/useCurrencyDictionary'
 
+const DEFAULT_RETURN_TO = '/backend/customers/deals'
+
+/**
+ * Only honor `returnTo` when it points back into the deals area of the backoffice.
+ * Without the prefix guard, this would be a textbook open-redirect: an attacker could
+ * craft `/backend/customers/deals/create?returnTo=https://evil.example.com` and the
+ * page would happily navigate the operator off-product after a successful save.
+ */
+function resolveReturnTo(value: string | null | undefined): string {
+  if (!value) return DEFAULT_RETURN_TO
+  if (!value.startsWith('/backend/customers/deals')) return DEFAULT_RETURN_TO
+  return value
+}
+
 export default function CreateDealPage() {
   const t = useT()
   const router = useRouter()
+  const searchParams = useSearchParams()
+  const returnTo = React.useMemo(
+    () => resolveReturnTo(searchParams?.get('returnTo') ?? null),
+    [searchParams],
+  )
   const [isSubmitting, setIsSubmitting] = React.useState(false)
   useCurrencyDictionary()
 
   const handleCancel = React.useCallback(() => {
-    router.push('/backend/customers/deals')
-  }, [router])
+    router.push(returnTo)
+  }, [router, returnTo])
 
   const handleSubmit = React.useCallback(
     async ({ base, custom }: DealFormSubmitPayload) => {
@@ -44,7 +63,7 @@ export default function CreateDealPage() {
           errorMessage: t('customers.deals.create.error', 'Failed to create deal.'),
         })
         flash(t('customers.people.detail.deals.success', 'Deal created.'), 'success')
-        router.push('/backend/customers/deals')
+        router.push(returnTo)
       } catch (err) {
         const message =
           err instanceof Error
@@ -56,7 +75,7 @@ export default function CreateDealPage() {
         setIsSubmitting(false)
       }
     },
-    [isSubmitting, router, t],
+    [isSubmitting, returnTo, router, t],
   )
 
   return (
@@ -70,7 +89,7 @@ export default function CreateDealPage() {
           submitLabel={t('customers.deals.create.submit', 'Create deal')}
           embedded={false}
           title={t('customers.deals.create.title', 'Create deal')}
-          backHref="/backend/customers/deals"
+          backHref={returnTo}
         />
       </PageBody>
     </Page>

package/src/modules/customers/backend/customers/deals/page.tsx

@@ -19,6 +19,7 @@ import { coalesceLastOperations } from '@open-mercato/ui/backend/operations/stor
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { ViewTabsRow } from './pipeline/components/ViewTabsRow'
 import { E } from '#generated/entities.ids.generated'
 import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -905,6 +906,7 @@ export default function CustomersDealsPage() {
   return (
     <Page>
       <PageBody>
+        <ViewTabsRow active="list" className="mb-4" />
         <DataTable<DealRow>
           stickyFirstColumn
           stickyActionsColumn