@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/dist/modules/communication_channels/api/post/test-seed/route.js

@@ -0,0 +1,238 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { readJsonSafe } from "@open-mercato/shared/lib/http/readJsonSafe";
+import { ChannelThreadMapping, ExternalConversation, MessageChannelLink } from "../../../data/entities.js";
+import {
+  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID
+} from "../../../commands/connect-credential-channel.js";
+import { emitCommunicationChannelsEvent } from "../../../events.js";
+import {
+  TEST_SEED_PROVIDER_KEY,
+  ensureTestSeedAdapterRegistered,
+  isTestChannelSeedingEnabled
+} from "../../../lib/test-seed.js";
+const metadata = {
+  path: "/communication_channels/test-seed",
+  POST: {
+    requireAuth: true,
+    requireFeatures: ["communication_channels.connect_user_channel"]
+  }
+};
+const addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() });
+const addressFieldSchema = z.union([
+  z.string(),
+  addressObjectSchema,
+  z.array(z.union([z.string(), addressObjectSchema]))
+]);
+const connectChannelSchema = z.object({
+  action: z.literal("connect-channel"),
+  displayName: z.string().min(1).max(255).optional(),
+  externalIdentifier: z.string().min(1).max(255).optional()
+});
+const emitInboundSchema = z.object({
+  action: z.literal("emit-inbound"),
+  /** Channel that owns the inbound message; controls authorUserId + default visibility. */
+  channelId: z.string().uuid(),
+  /** Provider key persisted on the link (defaults to the stub provider). */
+  providerKey: z.string().min(1).max(64).optional(),
+  /** Normalized inbound addresses (stored under channelPayload). */
+  from: addressFieldSchema.optional(),
+  to: addressFieldSchema.optional(),
+  cc: addressFieldSchema.optional(),
+  subject: z.string().max(500).optional(),
+  bodyText: z.string().max(2e5).optional(),
+  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */
+  messageId: z.string().max(500).optional(),
+  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */
+  inReplyTo: z.string().max(500).optional(),
+  references: z.array(z.string().max(500)).max(50).optional(),
+  /**
+   * Open Mercato `messages.message` thread id this inbound message belongs to.
+   * When set, a `messages.message` row is created with this `threadId` so the
+   * hub-thread inheritance join can resolve a Person from a sibling message.
+   */
+  messageThreadId: z.string().uuid().optional(),
+  /**
+   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The
+   * reaction (`/messages/[id]/reactions`) and thread-assign
+   * (`/threads/[id]/assign`) routes resolve the owning channel through this
+   * mapping and return 409/404 without it. Opt-in so the existing CRM-link
+   * seeds (which don't need a mapping) keep their current mapping-free shape.
+   */
+  createThreadMapping: z.boolean().optional()
+});
+const bodySchema = z.discriminatedUnion("action", [connectChannelSchema, emitInboundSchema]);
+async function POST(req) {
+  if (!isTestChannelSeedingEnabled()) {
+    return NextResponse.json({ error: "Not found" }, { status: 404 });
+  }
+  const auth = await getAuthFromRequest(req);
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
+  }
+  let body;
+  try {
+    body = bodySchema.parse(await readJsonSafe(req, null));
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "Invalid request body" },
+      { status: 422 }
+    );
+  }
+  const container = await createRequestContainer();
+  ensureTestSeedAdapterRegistered();
+  const tenantId = auth.tenantId;
+  const organizationId = auth.orgId ?? null;
+  const userId = auth.sub;
+  if (body.action === "connect-channel") {
+    const stamp = Date.now();
+    const commandBus = container.resolve("commandBus");
+    const input = {
+      providerKey: TEST_SEED_PROVIDER_KEY,
+      displayName: body.displayName ?? `Test Seed Channel ${stamp}`,
+      credentials: {
+        username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,
+        fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`
+      },
+      userId,
+      scope: { tenantId, organizationId }
+    };
+    const { result } = await commandBus.execute(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {
+      input,
+      ctx: {
+        container,
+        auth,
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: organizationId ? [organizationId] : null
+      }
+    });
+    if (result.status !== "connected") {
+      return NextResponse.json(
+        { error: "[internal] test-seed connect failed", detail: result },
+        { status: 500 }
+      );
+    }
+    return NextResponse.json(
+      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },
+      { status: 201 }
+    );
+  }
+  const em = container.resolve("em").fork();
+  const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY;
+  const conversation = em.create(ExternalConversation, {
+    channelId: body.channelId,
+    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,
+    subject: body.subject ?? null,
+    tenantId,
+    organizationId,
+    lastMessageAt: /* @__PURE__ */ new Date()
+  });
+  em.persist(conversation);
+  await em.flush();
+  const messageRows = await em.getConnection().execute(
+    `INSERT INTO messages
+       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,
+        is_draft, sent_at, visibility, source_entity_type, source_entity_id,
+        tenant_id, organization_id, created_at, updated_at)
+     VALUES
+       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',
+        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,
+        ?, ?, now(), now())
+     RETURNING id`,
+    [
+      `channel.${providerKey}`,
+      body.messageThreadId ?? null,
+      userId,
+      body.subject ?? "(no subject)",
+      body.bodyText ?? "",
+      body.channelId,
+      tenantId,
+      organizationId
+    ]
+  );
+  const messageId = messageRows[0]?.id;
+  if (!messageId) {
+    return NextResponse.json({ error: "[internal] failed to seed message row" }, { status: 500 });
+  }
+  const link = em.create(MessageChannelLink, {
+    messageId,
+    externalConversationId: conversation.id,
+    providerKey,
+    channelType: "email",
+    direction: "inbound",
+    deliveryStatus: "delivered",
+    channelPayload: {
+      ...body.from !== void 0 ? { from: body.from } : {},
+      ...body.to !== void 0 ? { to: body.to } : {},
+      ...body.cc !== void 0 ? { cc: body.cc } : {},
+      ...body.subject !== void 0 ? { subject: body.subject } : {},
+      ...body.bodyText !== void 0 ? { text: body.bodyText } : {},
+      ...body.inReplyTo !== void 0 ? { inReplyTo: body.inReplyTo } : {},
+      ...body.references !== void 0 ? { references: body.references } : {}
+    },
+    channelContentType: "text/plain",
+    channelMetadata: {
+      ...body.messageId !== void 0 ? { messageId: body.messageId } : {}
+    },
+    tenantId,
+    organizationId
+  });
+  em.persist(link);
+  await em.flush();
+  if (body.createThreadMapping) {
+    const mapping = em.create(ChannelThreadMapping, {
+      externalConversationId: conversation.id,
+      messageThreadId: body.messageThreadId ?? messageId,
+      channelId: body.channelId,
+      providerKey,
+      externalThreadRef: conversation.externalConversationId,
+      tenantId,
+      organizationId
+    });
+    em.persist(mapping);
+    await em.flush();
+  }
+  await emitCommunicationChannelsEvent(
+    "communication_channels.message.received",
+    {
+      channelLinkId: link.id,
+      channelId: body.channelId,
+      providerKey,
+      direction: "inbound",
+      tenantId,
+      organizationId
+    },
+    { persistent: true }
+  );
+  return NextResponse.json(
+    { channelLinkId: link.id, messageId, conversationId: conversation.id },
+    { status: 201 }
+  );
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    POST: {
+      summary: "Test-only: seed a connected channel or emit an inbound message (env-gated)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 201, description: "Channel seeded / inbound message emitted" },
+        { status: 401, description: "Unauthorized" },
+        { status: 404, description: "Test channel seeding disabled (production default)" },
+        { status: 422, description: "Invalid request body" },
+        { status: 500, description: "Seed failed" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/test-seed/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../src/modules/communication_channels/api/post/test-seed/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { CommandBus } from '@open-mercato/shared/lib/commands'\nimport { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'\nimport { ChannelThreadMapping, ExternalConversation, MessageChannelLink } from '../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,\n  type ConnectCredentialChannelInput,\n  type ConnectCredentialChannelResult,\n} from '../../../commands/connect-credential-channel'\nimport { emitCommunicationChannelsEvent } from '../../../events'\nimport {\n  TEST_SEED_PROVIDER_KEY,\n  ensureTestSeedAdapterRegistered,\n  isTestChannelSeedingEnabled,\n} from '../../../lib/test-seed'\n\n/**\n * TEST-ONLY channel seeding endpoint.\n *\n * Gated by `OM_ENABLE_TEST_CHANNEL_SEEDING` \u2014 when the flag is unset (the\n * production default) every request returns 404, so this route is invisible and\n * inert in production. See `lib/test-seed.ts` for the full rationale.\n *\n * Two actions, both scoped to the caller's tenant/org:\n *   - `connect-channel`: connect a network-free `__test_seed__` channel owned by\n *     the caller (delegates to the real connect-credential command so the channel\n *     persists credentials + lands in `status='connected'`). Enables the outbound\n *     compose \u2192 deliver \u2192 `.sent` chain to complete in CI.\n *   - `emit-inbound`: insert an inbound `MessageChannelLink` (+ a `messages.message`\n *     row for threading) and emit `communication_channels.message.received` so the\n *     customers link-channel-message subscriber runs against real Postgres. Enables\n *     the inbound auto-link tests (TC-CRM-EMAIL-002..005).\n */\nexport const metadata = {\n  path: '/communication_channels/test-seed',\n  POST: {\n    requireAuth: true,\n    requireFeatures: ['communication_channels.connect_user_channel'],\n  },\n}\n\nconst addressObjectSchema = z.object({ address: z.string(), name: z.string().optional() })\nconst addressFieldSchema = z.union([\n  z.string(),\n  addressObjectSchema,\n  z.array(z.union([z.string(), addressObjectSchema])),\n])\n\nconst connectChannelSchema = z.object({\n  action: z.literal('connect-channel'),\n  displayName: z.string().min(1).max(255).optional(),\n  externalIdentifier: z.string().min(1).max(255).optional(),\n})\n\nconst emitInboundSchema = z.object({\n  action: z.literal('emit-inbound'),\n  /** Channel that owns the inbound message; controls authorUserId + default visibility. */\n  channelId: z.string().uuid(),\n  /** Provider key persisted on the link (defaults to the stub provider). */\n  providerKey: z.string().min(1).max(64).optional(),\n  /** Normalized inbound addresses (stored under channelPayload). */\n  from: addressFieldSchema.optional(),\n  to: addressFieldSchema.optional(),\n  cc: addressFieldSchema.optional(),\n  subject: z.string().max(500).optional(),\n  bodyText: z.string().max(200_000).optional(),\n  /** RFC2822 Message-ID of this inbound message (for In-Reply-To matching). */\n  messageId: z.string().max(500).optional(),\n  /** RFC2822 In-Reply-To header (threading-inheritance fallback). */\n  inReplyTo: z.string().max(500).optional(),\n  references: z.array(z.string().max(500)).max(50).optional(),\n  /**\n   * Open Mercato `messages.message` thread id this inbound message belongs to.\n   * When set, a `messages.message` row is created with this `threadId` so the\n   * hub-thread inheritance join can resolve a Person from a sibling message.\n   */\n  messageThreadId: z.string().uuid().optional(),\n  /**\n   * Test-only: also create a `ChannelThreadMapping` for the seeded thread. The\n   * reaction (`/messages/[id]/reactions`) and thread-assign\n   * (`/threads/[id]/assign`) routes resolve the owning channel through this\n   * mapping and return 409/404 without it. Opt-in so the existing CRM-link\n   * seeds (which don't need a mapping) keep their current mapping-free shape.\n   */\n  createThreadMapping: z.boolean().optional(),\n})\n\nconst bodySchema = z.discriminatedUnion('action', [connectChannelSchema, emitInboundSchema])\n\nexport async function POST(req: Request): Promise<Response> {\n  // Fail-closed: invisible in production. Mirrors an unknown route (404) rather\n  // than 403 so the surface leaks nothing when the flag is off.\n  if (!isTestChannelSeedingEnabled()) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub || !auth?.tenantId) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: z.infer<typeof bodySchema>\n  try {\n    body = bodySchema.parse(await readJsonSafe(req, null))\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'Invalid request body' },\n      { status: 422 },\n    )\n  }\n\n  const container = await createRequestContainer()\n  // Defensive: make sure the stub adapter is registered for this process even if\n  // a worker-only node skipped module di registration.\n  ensureTestSeedAdapterRegistered()\n\n  const tenantId = auth.tenantId as string\n  const organizationId = (auth as { orgId?: string | null }).orgId ?? null\n  const userId = auth.sub as string\n\n  if (body.action === 'connect-channel') {\n    const stamp = Date.now()\n    const commandBus = container.resolve('commandBus') as CommandBus\n    const input: ConnectCredentialChannelInput = {\n      providerKey: TEST_SEED_PROVIDER_KEY,\n      displayName: body.displayName ?? `Test Seed Channel ${stamp}`,\n      credentials: {\n        username: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n        fromAddress: body.externalIdentifier ?? `test-seed-${stamp}@test-seed.local`,\n      },\n      userId,\n      scope: { tenantId, organizationId },\n    }\n    const { result } = await commandBus.execute<\n      ConnectCredentialChannelInput,\n      ConnectCredentialChannelResult\n    >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {\n      input,\n      ctx: {\n        container,\n        auth: auth as never,\n        organizationScope: null,\n        selectedOrganizationId: organizationId,\n        organizationIds: organizationId ? [organizationId] : null,\n      },\n    })\n    if (result.status !== 'connected') {\n      return NextResponse.json(\n        { error: '[internal] test-seed connect failed', detail: result },\n        { status: 500 },\n      )\n    }\n    return NextResponse.json(\n      { channelId: result.channelId, externalIdentifier: result.externalIdentifier },\n      { status: 201 },\n    )\n  }\n\n  // action === 'emit-inbound'\n  const em = (container.resolve('em') as EntityManager).fork()\n  const providerKey = body.providerKey ?? TEST_SEED_PROVIDER_KEY\n\n  // A MessageChannelLink requires a non-null external_conversation_id (FK) and\n  // message_id. Create a synthetic conversation + (optionally threaded) message\n  // so the link is shaped like a real inbound row the subscriber can consume.\n  const conversation = em.create(ExternalConversation, {\n    channelId: body.channelId,\n    externalConversationId: `inbound-seed:${Date.now()}:${Math.random().toString(16).slice(2, 8)}`,\n    subject: body.subject ?? null,\n    tenantId,\n    organizationId,\n    lastMessageAt: new Date(),\n  })\n  em.persist(conversation)\n  await em.flush()\n\n  // Insert the platform `messages.message` row via raw SQL rather than importing\n  // the messages module's entity class (cross-module ORM coupling rule). Only\n  // `thread_id` matters for the hub-thread inheritance join (TC-CRM-EMAIL-005);\n  // the rest satisfy NOT NULL constraints.\n  const messageRows = (await em.getConnection().execute(\n    `INSERT INTO messages\n       (type, thread_id, sender_user_id, subject, body, body_format, priority, status,\n        is_draft, sent_at, visibility, source_entity_type, source_entity_id,\n        tenant_id, organization_id, created_at, updated_at)\n     VALUES\n       (?, ?, ?, ?, ?, 'text', 'normal', 'sent',\n        false, now(), 'public', 'communication_channels.test_seed_inbound', ?,\n        ?, ?, now(), now())\n     RETURNING id`,\n    [\n      `channel.${providerKey}`,\n      body.messageThreadId ?? null,\n      userId,\n      body.subject ?? '(no subject)',\n      body.bodyText ?? '',\n      body.channelId,\n      tenantId,\n      organizationId,\n    ],\n  )) as Array<{ id: string }>\n  const messageId = messageRows[0]?.id\n  if (!messageId) {\n    return NextResponse.json({ error: '[internal] failed to seed message row' }, { status: 500 })\n  }\n\n  const link = em.create(MessageChannelLink, {\n    messageId,\n    externalConversationId: conversation.id,\n    providerKey,\n    channelType: 'email',\n    direction: 'inbound',\n    deliveryStatus: 'delivered',\n    channelPayload: {\n      ...(body.from !== undefined ? { from: body.from } : {}),\n      ...(body.to !== undefined ? { to: body.to } : {}),\n      ...(body.cc !== undefined ? { cc: body.cc } : {}),\n      ...(body.subject !== undefined ? { subject: body.subject } : {}),\n      ...(body.bodyText !== undefined ? { text: body.bodyText } : {}),\n      ...(body.inReplyTo !== undefined ? { inReplyTo: body.inReplyTo } : {}),\n      ...(body.references !== undefined ? { references: body.references } : {}),\n    },\n    channelContentType: 'text/plain',\n    channelMetadata: {\n      ...(body.messageId !== undefined ? { messageId: body.messageId } : {}),\n    },\n    tenantId,\n    organizationId,\n  })\n  em.persist(link)\n  await em.flush()\n\n  // Optionally mirror `ingest-inbound-message`: a real inbound message always\n  // lands a ChannelThreadMapping that the reaction + thread-assign routes use to\n  // resolve the owning channel. Seeded inbound messages skip it by default; opt\n  // in for tests that exercise those routes. Keyed by `messageThreadId ?? messageId`\n  // to match how those commands resolve the mapping (`message.threadId ?? message.id`).\n  if (body.createThreadMapping) {\n    const mapping = em.create(ChannelThreadMapping, {\n      externalConversationId: conversation.id,\n      messageThreadId: body.messageThreadId ?? messageId,\n      channelId: body.channelId,\n      providerKey,\n      externalThreadRef: conversation.externalConversationId,\n      tenantId,\n      organizationId,\n    })\n    em.persist(mapping)\n    await em.flush()\n  }\n\n  // Emit the hub event through the real event bus so the persistent customers\n  // link-channel-message-received subscriber is enqueued to the `events` queue.\n  await emitCommunicationChannelsEvent(\n    'communication_channels.message.received',\n    {\n      channelLinkId: link.id,\n      channelId: body.channelId,\n      providerKey,\n      direction: 'inbound',\n      tenantId,\n      organizationId,\n    },\n    { persistent: true },\n  )\n\n  return NextResponse.json(\n    { channelLinkId: link.id, messageId, conversationId: conversation.id },\n    { status: 201 },\n  )\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Test-only: seed a connected channel or emit an inbound message (env-gated)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 201, description: 'Channel seeded / inbound message emitted' },\n        { status: 401, description: 'Unauthorized' },\n        { status: 404, description: 'Test channel seeding disabled (production default)' },\n        { status: 422, description: 'Invalid request body' },\n        { status: 500, description: 'Seed failed' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,oBAAoB;AAC7B,SAAS,sBAAsB,sBAAsB,0BAA0B;AAC/E;AAAA,EACE;AAAA,OAGK;AACP,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAmBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA,IACb,iBAAiB,CAAC,6CAA6C;AAAA,EACjE;AACF;AAEA,MAAM,sBAAsB,EAAE,OAAO,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACzF,MAAM,qBAAqB,EAAE,MAAM;AAAA,EACjC,EAAE,OAAO;AAAA,EACT;AAAA,EACA,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,OAAO,GAAG,mBAAmB,CAAC,CAAC;AACpD,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,QAAQ,EAAE,QAAQ,iBAAiB;AAAA,EACnC,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACjD,oBAAoB,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,SAAS;AAC1D,CAAC;AAED,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,QAAQ,EAAE,QAAQ,cAAc;AAAA;AAAA,EAEhC,WAAW,EAAE,OAAO,EAAE,KAAK;AAAA;AAAA,EAE3B,aAAa,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA,EAEhD,MAAM,mBAAmB,SAAS;AAAA,EAClC,IAAI,mBAAmB,SAAS;AAAA,EAChC,IAAI,mBAAmB,SAAS;AAAA,EAChC,SAAS,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,IAAI,GAAO,EAAE,SAAS;AAAA;AAAA,EAE3C,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA;AAAA,EAExC,WAAW,EAAE,OAAO,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,EACxC,YAAY,EAAE,MAAM,EAAE,OAAO,EAAE,IAAI,GAAG,CAAC,EAAE,IAAI,EAAE,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAM1D,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,EAQ5C,qBAAqB,EAAE,QAAQ,EAAE,SAAS;AAC5C,CAAC;AAED,MAAM,aAAa,EAAE,mBAAmB,UAAU,CAAC,sBAAsB,iBAAiB,CAAC;AAE3F,eAAsB,KAAK,KAAiC;AAG1D,MAAI,CAAC,4BAA4B,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,OAAO,CAAC,MAAM,UAAU;AACjC,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,WAAW,MAAM,MAAM,aAAa,KAAK,IAAI,CAAC;AAAA,EACvD,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,uBAAuB;AAAA,MACrE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAG/C,kCAAgC;AAEhC,QAAM,WAAW,KAAK;AACtB,QAAM,iBAAkB,KAAmC,SAAS;AACpE,QAAM,SAAS,KAAK;AAEpB,MAAI,KAAK,WAAW,mBAAmB;AACrC,UAAM,QAAQ,KAAK,IAAI;AACvB,UAAM,aAAa,UAAU,QAAQ,YAAY;AACjD,UAAM,QAAuC;AAAA,MAC3C,aAAa;AAAA,MACb,aAAa,KAAK,eAAe,qBAAqB,KAAK;AAAA,MAC3D,aAAa;AAAA,QACX,UAAU,KAAK,sBAAsB,aAAa,KAAK;AAAA,QACvD,aAAa,KAAK,sBAAsB,aAAa,KAAK;AAAA,MAC5D;AAAA,MACA;AAAA,MACA,OAAO,EAAE,UAAU,eAAe;AAAA,IACpC;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW,QAGlC,8DAA8D;AAAA,MAC9D;AAAA,MACA,KAAK;AAAA,QACH;AAAA,QACA;AAAA,QACA,mBAAmB;AAAA,QACnB,wBAAwB;AAAA,QACxB,iBAAiB,iBAAiB,CAAC,cAAc,IAAI;AAAA,MACvD;AAAA,IACF,CAAC;AACD,QAAI,OAAO,WAAW,aAAa;AACjC,aAAO,aAAa;AAAA,QAClB,EAAE,OAAO,uCAAuC,QAAQ,OAAO;AAAA,QAC/D,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,WAAO,aAAa;AAAA,MAClB,EAAE,WAAW,OAAO,WAAW,oBAAoB,OAAO,mBAAmB;AAAA,MAC7E,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAGA,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,cAAc,KAAK,eAAe;AAKxC,QAAM,eAAe,GAAG,OAAO,sBAAsB;AAAA,IACnD,WAAW,KAAK;AAAA,IAChB,wBAAwB,gBAAgB,KAAK,IAAI,CAAC,IAAI,KAAK,OAAO,EAAE,SAAS,EAAE,EAAE,MAAM,GAAG,CAAC,CAAC;AAAA,IAC5F,SAAS,KAAK,WAAW;AAAA,IACzB;AAAA,IACA;AAAA,IACA,eAAe,oBAAI,KAAK;AAAA,EAC1B,CAAC;AACD,KAAG,QAAQ,YAAY;AACvB,QAAM,GAAG,MAAM;AAMf,QAAM,cAAe,MAAM,GAAG,cAAc,EAAE;AAAA,IAC5C;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA;AAAA,IASA;AAAA,MACE,WAAW,WAAW;AAAA,MACtB,KAAK,mBAAmB;AAAA,MACxB;AAAA,MACA,KAAK,WAAW;AAAA,MAChB,KAAK,YAAY;AAAA,MACjB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AACA,QAAM,YAAY,YAAY,CAAC,GAAG;AAClC,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,QAAM,OAAO,GAAG,OAAO,oBAAoB;AAAA,IACzC;AAAA,IACA,wBAAwB,aAAa;AAAA,IACrC;AAAA,IACA,aAAa;AAAA,IACb,WAAW;AAAA,IACX,gBAAgB;AAAA,IAChB,gBAAgB;AAAA,MACd,GAAI,KAAK,SAAS,SAAY,EAAE,MAAM,KAAK,KAAK,IAAI,CAAC;AAAA,MACrD,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,OAAO,SAAY,EAAE,IAAI,KAAK,GAAG,IAAI,CAAC;AAAA,MAC/C,GAAI,KAAK,YAAY,SAAY,EAAE,SAAS,KAAK,QAAQ,IAAI,CAAC;AAAA,MAC9D,GAAI,KAAK,aAAa,SAAY,EAAE,MAAM,KAAK,SAAS,IAAI,CAAC;AAAA,MAC7D,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,MACpE,GAAI,KAAK,eAAe,SAAY,EAAE,YAAY,KAAK,WAAW,IAAI,CAAC;AAAA,IACzE;AAAA,IACA,oBAAoB;AAAA,IACpB,iBAAiB;AAAA,MACf,GAAI,KAAK,cAAc,SAAY,EAAE,WAAW,KAAK,UAAU,IAAI,CAAC;AAAA,IACtE;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACD,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAOf,MAAI,KAAK,qBAAqB;AAC5B,UAAM,UAAU,GAAG,OAAO,sBAAsB;AAAA,MAC9C,wBAAwB,aAAa;AAAA,MACrC,iBAAiB,KAAK,mBAAmB;AAAA,MACzC,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,mBAAmB,aAAa;AAAA,MAChC;AAAA,MACA;AAAA,IACF,CAAC;AACD,OAAG,QAAQ,OAAO;AAClB,UAAM,GAAG,MAAM;AAAA,EACjB;AAIA,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,eAAe,KAAK;AAAA,MACpB,WAAW,KAAK;AAAA,MAChB;AAAA,MACA,WAAW;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,IACA,EAAE,YAAY,KAAK;AAAA,EACrB;AAEA,SAAO,aAAa;AAAA,IAClB,EAAE,eAAe,KAAK,IAAI,WAAW,gBAAgB,aAAa,GAAG;AAAA,IACrE,EAAE,QAAQ,IAAI;AAAA,EAChB;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,2CAA2C;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,eAAe;AAAA,QAC3C,EAAE,QAAQ,KAAK,aAAa,qDAAqD;AAAA,QACjF,EAAE,QAAQ,KAAK,aAAa,uBAAuB;AAAA,QACnD,EAAE,QAAQ,KAAK,aAAa,cAAc;AAAA,MAC5C;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js

@@ -0,0 +1,175 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../../../../data/entities.js";
+import { getChannelAdapterRegistry } from "../../../../lib/adapter-registry-singleton.js";
+import {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+} from "../../../../lib/queue.js";
+const metadata = {
+  path: "/communication_channels/webhook/[provider]",
+  POST: {
+    requireAuth: false,
+    // Unauthenticated by design (signature verification IS the auth), but the
+    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP
+    // request volume to limit abuse. Generous enough for real provider traffic;
+    // the dedicated gmail route carries its own matching limits.
+    rateLimit: { points: 120, duration: 60, keyPrefix: "cc_webhook_inbound" }
+  }
+};
+async function POST(req, { params }) {
+  const resolvedParams = await params;
+  const providerKey = resolvedParams.provider;
+  const registry = getChannelAdapterRegistry();
+  const adapter = registry?.get(providerKey);
+  if (!adapter) {
+    return NextResponse.json(
+      { error: `No ChannelAdapter for provider: ${providerKey}` },
+      { status: 404 }
+    );
+  }
+  const rawBody = await req.text();
+  const headers = {};
+  req.headers.forEach((value, key) => {
+    headers[key] = value;
+  });
+  const container = await createRequestContainer();
+  const em = container.resolve("em").fork();
+  let credentialsService = null;
+  try {
+    credentialsService = container.resolve("integrationCredentialsService");
+  } catch {
+    credentialsService = null;
+  }
+  try {
+    const candidates = await findWithDecryption(
+      em,
+      CommunicationChannel,
+      {
+        providerKey,
+        isActive: true,
+        deletedAt: null
+      },
+      { orderBy: { createdAt: "desc" } }
+    );
+    let matchedChannel = null;
+    let matchedScope = null;
+    let event = null;
+    let lastVerificationError = null;
+    for (const candidate of candidates) {
+      const candidateScope = {
+        tenantId: candidate.tenantId,
+        organizationId: candidate.organizationId ?? candidate.tenantId
+      };
+      const credentialsLookupScope = {
+        ...candidateScope,
+        userId: candidate.userId ?? null
+      };
+      let credentials = {};
+      if (candidate.credentialsRef && credentialsService) {
+        try {
+          credentials = await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope) ?? {};
+        } catch {
+          credentials = {};
+        }
+      }
+      try {
+        event = await adapter.verifyWebhook({
+          rawBody,
+          headers,
+          credentials,
+          scope: candidateScope
+        });
+        matchedChannel = candidate;
+        matchedScope = candidateScope;
+        break;
+      } catch (error) {
+        lastVerificationError = error;
+      }
+    }
+    if (!event || !matchedChannel || !matchedScope) {
+      throw lastVerificationError ?? new Error("Webhook verification failed: no matching channel");
+    }
+    if (event.eventType === "reaction") {
+      if (typeof adapter.normalizeInboundReaction !== "function") {
+        return NextResponse.json(
+          {
+            received: true,
+            queued: false,
+            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`
+          },
+          { status: 202 }
+        );
+      }
+      const reactionEvent = await adapter.normalizeInboundReaction(event);
+      const reactionJob = {
+        kind: "inbound",
+        providerKey,
+        channelId: matchedChannel.id,
+        channelType: matchedChannel.channelType,
+        event: reactionEvent,
+        // Use the channel's REAL org (null when null), matching the poll and
+        // dedicated gmail webhook path — `candidateScope` falls org
+        // back to tenantId for credential/verify lookups, which must not leak
+        // into the ingest scope (it would diverge dedup for null-org channels).
+        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },
+        attempt: 1
+      };
+      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions);
+      await reactionsQueue.enqueue(reactionJob);
+      return NextResponse.json({ received: true, queued: true, kind: "reaction" }, { status: 202 });
+    }
+    if (event.eventType && event.eventType !== "message") {
+      return NextResponse.json(
+        {
+          received: true,
+          queued: false,
+          reason: `event ${event.eventType} not yet handled`
+        },
+        { status: 202 }
+      );
+    }
+    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound);
+    const jobPayload = {
+      providerKey,
+      channelId: matchedChannel.id,
+      channelType: matchedChannel.channelType,
+      raw: event,
+      // Ingest scope uses the channel's REAL org (null when null) so dedup matches
+      // the poll + dedicated webhook paths; see the reaction branch above.
+      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null }
+    };
+    await queue.enqueue(jobPayload);
+    return NextResponse.json({ received: true, queued: true, kind: "message" }, { status: 202 });
+  } catch (error) {
+    console.warn(
+      "[communication_channels] inbound webhook verification failed:",
+      error instanceof Error ? error.message : error
+    );
+    return NextResponse.json({ error: "verification_failed" }, { status: 401 });
+  }
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  summary: "Receive a communication channel webhook",
+  methods: {
+    POST: {
+      summary: "Process an inbound channel webhook (Slack, WhatsApp, Email, ...)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 202, description: "Webhook accepted for async processing" },
+        { status: 401, description: "Signature verification failed against every candidate channel" },
+        { status: 404, description: "Unknown provider" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/webhook/[provider]/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhook/%5Bprovider%5D/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport { getChannelAdapterRegistry } from '../../../../lib/adapter-registry-singleton'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport type { InboundMessage } from '../../../../lib/adapter'\nimport type { InboundProcessorPayload } from '../../../../workers/inbound-processor'\nimport type { ReactionInboundJob } from '../../../../lib/reaction-processor-types'\n\n/**\n * Inbound webhook endpoint for the communication_channels hub.\n *\n * One endpoint per provider \u2014 provider key in the path. The hub iterates all\n * candidate `CommunicationChannel` rows for `(provider_key, is_active=true,\n * deleted_at IS NULL)` across tenants and asks each adapter to verify the\n * signature with that channel's credentials. The first successful verification\n * pins the request to that channel's tenant scope; we then enqueue an inbound\n * processor job and return 202.\n *\n * Fail-closed: if no candidate verifies, we return 401 \u2014 never 200. This mirrors\n * the per-tenant authentication model used by `shipping_carriers/api/webhook/[provider]`\n * and the security note in SPEC-045d \u00A713.\n *\n * No auth required at the route level \u2014 signature verification IS the auth.\n */\nexport const metadata = {\n  path: '/communication_channels/webhook/[provider]',\n  POST: {\n    requireAuth: false,\n    // Unauthenticated by design (signature verification IS the auth), but the\n    // handler fans out an O(N) cross-tenant candidate scan, so bound per-IP\n    // request volume to limit abuse. Generous enough for real provider traffic;\n    // the dedicated gmail route carries its own matching limits.\n    rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_inbound' },\n  },\n}\n\ntype RouteContext = {\n  params: Promise<{ provider: string }> | { provider: string }\n}\n\nexport async function POST(req: Request, { params }: RouteContext): Promise<Response> {\n  const resolvedParams = await params\n  const providerKey = resolvedParams.provider\n\n  const registry = getChannelAdapterRegistry()\n  const adapter = registry?.get(providerKey)\n  if (!adapter) {\n    return NextResponse.json(\n      { error: `No ChannelAdapter for provider: ${providerKey}` },\n      { status: 404 },\n    )\n  }\n\n  const rawBody = await req.text()\n  const headers: Record<string, string> = {}\n  req.headers.forEach((value, key) => {\n    headers[key] = value\n  })\n\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n\n  type CredentialsServiceLike = {\n    resolve: (\n      providerOrIntegrationId: string,\n      scope: { organizationId: string; tenantId: string; userId?: string | null },\n    ) => Promise<Record<string, unknown> | null>\n  }\n  let credentialsService: CredentialsServiceLike | null = null\n  try {\n    credentialsService = container.resolve<CredentialsServiceLike>('integrationCredentialsService')\n  } catch {\n    credentialsService = null\n  }\n\n  try {\n    // The webhook is unauthenticated. The TENANT MUST be derived from a channel whose\n    // per-tenant credentials successfully verify the inbound signature \u2014 NEVER from\n    // attacker-controlled payload headers or unsigned retries.\n    const candidates = await findWithDecryption(\n      em,\n      CommunicationChannel,\n      {\n        providerKey,\n        isActive: true,\n        deletedAt: null,\n      },\n      { orderBy: { createdAt: 'desc' } },\n    )\n\n    let matchedChannel: CommunicationChannel | null = null\n    let matchedScope: { tenantId: string; organizationId: string } | null = null\n    let event: InboundMessage | null = null\n    let lastVerificationError: unknown = null\n\n    for (const candidate of candidates as CommunicationChannel[]) {\n      const candidateScope = {\n        tenantId: candidate.tenantId,\n        organizationId: candidate.organizationId ?? candidate.tenantId,\n      }\n      // Per-user credential lookup: each candidate channel has its own user\n      // and therefore its own credentials row. See review R2-C1 / N1.\n      const credentialsLookupScope = {\n        ...candidateScope,\n        userId: candidate.userId ?? null,\n      }\n      let credentials: Record<string, unknown> = {}\n      if (candidate.credentialsRef && credentialsService) {\n        try {\n          credentials =\n            (await credentialsService.resolve(`channel_${providerKey}`, credentialsLookupScope)) ?? {}\n        } catch {\n          credentials = {}\n        }\n      }\n      try {\n        event = await adapter.verifyWebhook({\n          rawBody,\n          headers,\n          credentials,\n          scope: candidateScope,\n        })\n        matchedChannel = candidate\n        matchedScope = candidateScope\n        break\n      } catch (error: unknown) {\n        lastVerificationError = error\n      }\n    }\n\n    if (!event || !matchedChannel || !matchedScope) {\n      throw (\n        lastVerificationError ?? new Error('Webhook verification failed: no matching channel')\n      )\n    }\n\n    // Dispatch by event type:\n    //   - 'message' (default) \u2192 inbound-processor (slice 2b)\n    //   - 'reaction'           \u2192 reaction-processor (slice 2d)\n    //   - 'status_update' / 'other' \u2192 202 not handled (future slice)\n    if (event.eventType === 'reaction') {\n      if (typeof adapter.normalizeInboundReaction !== 'function') {\n        return NextResponse.json(\n          {\n            received: true,\n            queued: false,\n            reason: `adapter '${providerKey}' does not implement normalizeInboundReaction`,\n          },\n          { status: 202 },\n        )\n      }\n      const reactionEvent = await adapter.normalizeInboundReaction(event)\n      const reactionJob: ReactionInboundJob = {\n        kind: 'inbound',\n        providerKey,\n        channelId: matchedChannel.id,\n        channelType: matchedChannel.channelType,\n        event: reactionEvent,\n        // Use the channel's REAL org (null when null), matching the poll and\n        // dedicated gmail webhook path \u2014 `candidateScope` falls org\n        // back to tenantId for credential/verify lookups, which must not leak\n        // into the ingest scope (it would diverge dedup for null-org channels).\n        scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n        attempt: 1,\n      }\n      const reactionsQueue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.reactions)\n      await reactionsQueue.enqueue(reactionJob as unknown as Record<string, unknown>)\n      return NextResponse.json({ received: true, queued: true, kind: 'reaction' }, { status: 202 })\n    }\n\n    if (event.eventType && event.eventType !== 'message') {\n      return NextResponse.json(\n        {\n          received: true,\n          queued: false,\n          reason: `event ${event.eventType} not yet handled`,\n        },\n        { status: 202 },\n      )\n    }\n\n    const queue = getCommunicationChannelsQueue(COMMUNICATION_CHANNELS_QUEUES.inbound)\n    const jobPayload: InboundProcessorPayload = {\n      providerKey,\n      channelId: matchedChannel.id,\n      channelType: matchedChannel.channelType,\n      raw: event,\n      // Ingest scope uses the channel's REAL org (null when null) so dedup matches\n      // the poll + dedicated webhook paths; see the reaction branch above.\n      scope: { tenantId: matchedScope.tenantId, organizationId: matchedChannel.organizationId ?? null },\n    }\n    await queue.enqueue(jobPayload as unknown as Record<string, unknown>)\n\n    return NextResponse.json({ received: true, queued: true, kind: 'message' }, { status: 202 })\n  } catch (error: unknown) {\n    // Do not echo adapter/verification internals to an unauthenticated caller;\n    // log the detail server-side and return a fixed, minimal message.\n    console.warn(\n      '[communication_channels] inbound webhook verification failed:',\n      error instanceof Error ? error.message : error,\n    )\n    return NextResponse.json({ error: 'verification_failed' }, { status: 401 })\n  }\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  summary: 'Receive a communication channel webhook',\n  methods: {\n    POST: {\n      summary: 'Process an inbound channel webhook (Slack, WhatsApp, Email, ...)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 202, description: 'Webhook accepted for async processing' },\n        { status: 401, description: 'Signature verification failed against every candidate channel' },\n        { status: 404, description: 'Unknown provider' },\n      ],\n    },\n  },\n}\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC,SAAS,iCAAiC;AAC1C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAqBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA,EACN,MAAM;AAAA,IACJ,aAAa;AAAA;AAAA;AAAA;AAAA;AAAA,IAKb,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,qBAAqB;AAAA,EAC1E;AACF;AAMA,eAAsB,KAAK,KAAc,EAAE,OAAO,GAAoC;AACpF,QAAM,iBAAiB,MAAM;AAC7B,QAAM,cAAc,eAAe;AAEnC,QAAM,WAAW,0BAA0B;AAC3C,QAAM,UAAU,UAAU,IAAI,WAAW;AACzC,MAAI,CAAC,SAAS;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,mCAAmC,WAAW,GAAG;AAAA,MAC1D,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,UAAU,MAAM,IAAI,KAAK;AAC/B,QAAM,UAAkC,CAAC;AACzC,MAAI,QAAQ,QAAQ,CAAC,OAAO,QAAQ;AAClC,YAAQ,GAAG,IAAI;AAAA,EACjB,CAAC;AAED,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAQ3D,MAAI,qBAAoD;AACxD,MAAI;AACF,yBAAqB,UAAU,QAAgC,+BAA+B;AAAA,EAChG,QAAQ;AACN,yBAAqB;AAAA,EACvB;AAEA,MAAI;AAIF,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE;AAAA,QACA,UAAU;AAAA,QACV,WAAW;AAAA,MACb;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,OAAO,EAAE;AAAA,IACnC;AAEA,QAAI,iBAA8C;AAClD,QAAI,eAAoE;AACxE,QAAI,QAA+B;AACnC,QAAI,wBAAiC;AAErC,eAAW,aAAa,YAAsC;AAC5D,YAAM,iBAAiB;AAAA,QACrB,UAAU,UAAU;AAAA,QACpB,gBAAgB,UAAU,kBAAkB,UAAU;AAAA,MACxD;AAGA,YAAM,yBAAyB;AAAA,QAC7B,GAAG;AAAA,QACH,QAAQ,UAAU,UAAU;AAAA,MAC9B;AACA,UAAI,cAAuC,CAAC;AAC5C,UAAI,UAAU,kBAAkB,oBAAoB;AAClD,YAAI;AACF,wBACG,MAAM,mBAAmB,QAAQ,WAAW,WAAW,IAAI,sBAAsB,KAAM,CAAC;AAAA,QAC7F,QAAQ;AACN,wBAAc,CAAC;AAAA,QACjB;AAAA,MACF;AACA,UAAI;AACF,gBAAQ,MAAM,QAAQ,cAAc;AAAA,UAClC;AAAA,UACA;AAAA,UACA;AAAA,UACA,OAAO;AAAA,QACT,CAAC;AACD,yBAAiB;AACjB,uBAAe;AACf;AAAA,MACF,SAAS,OAAgB;AACvB,gCAAwB;AAAA,MAC1B;AAAA,IACF;AAEA,QAAI,CAAC,SAAS,CAAC,kBAAkB,CAAC,cAAc;AAC9C,YACE,yBAAyB,IAAI,MAAM,kDAAkD;AAAA,IAEzF;AAMA,QAAI,MAAM,cAAc,YAAY;AAClC,UAAI,OAAO,QAAQ,6BAA6B,YAAY;AAC1D,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,UAAU;AAAA,YACV,QAAQ;AAAA,YACR,QAAQ,YAAY,WAAW;AAAA,UACjC;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AACA,YAAM,gBAAgB,MAAM,QAAQ,yBAAyB,KAAK;AAClE,YAAM,cAAkC;AAAA,QACtC,MAAM;AAAA,QACN;AAAA,QACA,WAAW,eAAe;AAAA,QAC1B,aAAa,eAAe;AAAA,QAC5B,OAAO;AAAA;AAAA;AAAA;AAAA;AAAA,QAKP,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,QAChG,SAAS;AAAA,MACX;AACA,YAAM,iBAAiB,8BAA8B,8BAA8B,SAAS;AAC5F,YAAM,eAAe,QAAQ,WAAiD;AAC9E,aAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,WAAW,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AAEA,QAAI,MAAM,aAAa,MAAM,cAAc,WAAW;AACpD,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,UAAU;AAAA,UACV,QAAQ;AAAA,UACR,QAAQ,SAAS,MAAM,SAAS;AAAA,QAClC;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAEA,UAAM,QAAQ,8BAA8B,8BAA8B,OAAO;AACjF,UAAM,aAAsC;AAAA,MAC1C;AAAA,MACA,WAAW,eAAe;AAAA,MAC1B,aAAa,eAAe;AAAA,MAC5B,KAAK;AAAA;AAAA;AAAA,MAGL,OAAO,EAAE,UAAU,aAAa,UAAU,gBAAgB,eAAe,kBAAkB,KAAK;AAAA,IAClG;AACA,UAAM,MAAM,QAAQ,UAAgD;AAEpE,WAAO,aAAa,KAAK,EAAE,UAAU,MAAM,QAAQ,MAAM,MAAM,UAAU,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F,SAAS,OAAgB;AAGvB,YAAQ;AAAA,MACN;AAAA,MACA,iBAAiB,QAAQ,MAAM,UAAU;AAAA,IAC3C;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5E;AACF;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wCAAwC;AAAA,QACpE,EAAE,QAAQ,KAAK,aAAa,gEAAgE;AAAA,QAC5F,EAAE,QAAQ,KAAK,aAAa,mBAAmB;AAAA,MACjD;AAAA,IACF;AAAA,EACF;AACF;AACA,IAAO,gBAAQ;",
+  "names": []
+}

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js

@@ -0,0 +1,123 @@
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { CommunicationChannel } from "../../../../data/entities.js";
+import {
+  COMMUNICATION_CHANNELS_QUEUES,
+  getCommunicationChannelsQueue
+} from "../../../../lib/queue.js";
+import {
+  decodeGmailPubSubBody,
+  getGmailPubSubVerifier,
+  GmailPubSubJwtError
+} from "../../../../lib/gmail-pubsub-jwt.js";
+const metadata = {
+  path: "/communication_channels/webhooks/gmail",
+  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).
+  // Rate-limited so a caller can't drive unbounded JWT-verification +
+  // cert-fetch work before the signature gate rejects them.
+  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: "cc_webhook_gmail" } }
+};
+async function POST(req) {
+  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE;
+  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL;
+  if (!expectedAudience || !expectedEmail) {
+    console.error(
+      "[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set"
+    );
+    return NextResponse.json({ error: "webhook not configured" }, { status: 503 });
+  }
+  const verifier = getGmailPubSubVerifier();
+  try {
+    await verifier.verify({
+      authorizationHeader: req.headers.get("authorization"),
+      expectedAudience,
+      expectedEmail
+    });
+  } catch (err) {
+    if (err instanceof GmailPubSubJwtError) {
+      const status = err.code === "wrong_audience" ? 403 : err.code === "fetch_certs_failed" ? 503 : 401;
+      return NextResponse.json({ error: err.code, message: err.message }, { status });
+    }
+    throw err;
+  }
+  let rawBody;
+  try {
+    rawBody = await req.text();
+  } catch {
+    return NextResponse.json({ error: "unreadable_body" }, { status: 400 });
+  }
+  let payload;
+  try {
+    payload = decodeGmailPubSubBody(rawBody);
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : "invalid_payload" },
+      { status: 400 }
+    );
+  }
+  const container = await createRequestContainer();
+  const em = container.resolve("em").fork();
+  const channels = await findWithDecryption(
+    em,
+    CommunicationChannel,
+    {
+      providerKey: "gmail",
+      externalIdentifier: payload.emailAddress,
+      isActive: true,
+      deletedAt: null
+    }
+  );
+  if (channels.length === 0) {
+    return new NextResponse(null, { status: 204 });
+  }
+  const queue = getCommunicationChannelsQueue(
+    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync
+  );
+  for (const channel of channels) {
+    const job = {
+      channelId: channel.id,
+      scope: {
+        tenantId: channel.tenantId,
+        organizationId: channel.organizationId ?? null
+      },
+      notification: {
+        emailAddress: payload.emailAddress,
+        historyId: String(payload.historyId)
+      }
+    };
+    try {
+      await queue.enqueue(job);
+    } catch (err) {
+      console.error(
+        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,
+        err
+      );
+    }
+  }
+  return new NextResponse(null, { status: 204 });
+}
+const openApi = {
+  tags: ["CommunicationChannels"],
+  methods: {
+    POST: {
+      summary: "Gmail Pub/Sub push notification webhook (Spec C \xA7 Phase C2)",
+      tags: ["CommunicationChannels"],
+      responses: [
+        { status: 204, description: "Notification verified + history-sync job enqueued" },
+        { status: 400, description: "Body not a valid Pub/Sub envelope" },
+        { status: 401, description: "Invalid JWT or email claim" },
+        { status: 403, description: "Wrong audience" },
+        { status: 503, description: "Webhook not configured / Google certs unreachable" }
+      ]
+    }
+  }
+};
+var route_default = POST;
+export {
+  POST,
+  route_default as default,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=route.js.map

package/dist/modules/communication_channels/api/post/webhooks/gmail/route.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../src/modules/communication_channels/api/post/webhooks/gmail/route.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { CommunicationChannel } from '../../../../data/entities'\nimport {\n  COMMUNICATION_CHANNELS_QUEUES,\n  getCommunicationChannelsQueue,\n} from '../../../../lib/queue'\nimport {\n  decodeGmailPubSubBody,\n  getGmailPubSubVerifier,\n  GmailPubSubJwtError,\n} from '../../../../lib/gmail-pubsub-jwt'\n\n/**\n * Spec C \u00A7 Phase C2 \u2014 Gmail Pub/Sub push webhook.\n *\n * Auth model: NOT authenticated via the platform's session cookie. Pub/Sub\n * authenticates with a Google-signed JWT in the `Authorization: Bearer \u2026`\n * header, which we verify against Google's public certs.\n *\n * Validation pipeline:\n *   1. Verify JWT signature, audience (`OM_GMAIL_PUBSUB_AUDIENCE`), and\n *      email claim (`OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL`).\n *   2. Decode the Pub/Sub envelope \u2192 `{ emailAddress, historyId }`.\n *   3. Look up every active Gmail channel matching `emailAddress`. Multiple\n *      tenants may have the same mailbox connected \u2014 we enqueue one sync\n *      job per matching channel (each tenant sees their own data).\n *   4. Return `204 No Content` even when no channels match \u2014 returning 4xx\n *      would cause Pub/Sub to retry forever on a permanently-orphaned\n *      registration.\n */\nexport const metadata = {\n  path: '/communication_channels/webhooks/gmail',\n  // Unauthenticated at the platform layer (a Google-signed JWT is the auth).\n  // Rate-limited so a caller can't drive unbounded JWT-verification +\n  // cert-fetch work before the signature gate rejects them.\n  POST: { requireAuth: false, rateLimit: { points: 120, duration: 60, keyPrefix: 'cc_webhook_gmail' } },\n}\n\ntype GmailHistorySyncJobPayload = {\n  channelId: string\n  scope: { tenantId: string; organizationId: string | null }\n  notification: { emailAddress: string; historyId: string }\n}\n\nexport async function POST(req: Request): Promise<Response> {\n  const expectedAudience = process.env.OM_GMAIL_PUBSUB_AUDIENCE\n  const expectedEmail = process.env.OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL\n  if (!expectedAudience || !expectedEmail) {\n    // Misconfiguration is operator-facing; log and 503 so Pub/Sub retries\n    // briefly and the operator notices.\n    console.error(\n      '[gmail-webhook] OM_GMAIL_PUBSUB_AUDIENCE / OM_GMAIL_PUBSUB_SERVICE_ACCOUNT_EMAIL not set',\n    )\n    return NextResponse.json({ error: 'webhook not configured' }, { status: 503 })\n  }\n\n  const verifier = getGmailPubSubVerifier()\n  try {\n    await verifier.verify({\n      authorizationHeader: req.headers.get('authorization'),\n      expectedAudience,\n      expectedEmail,\n    })\n  } catch (err) {\n    if (err instanceof GmailPubSubJwtError) {\n      const status =\n        err.code === 'wrong_audience' ? 403 :\n        err.code === 'fetch_certs_failed' ? 503 :\n        401\n      return NextResponse.json({ error: err.code, message: err.message }, { status })\n    }\n    throw err\n  }\n\n  let rawBody: string\n  try {\n    rawBody = await req.text()\n  } catch {\n    return NextResponse.json({ error: 'unreadable_body' }, { status: 400 })\n  }\n\n  let payload: { emailAddress: string; historyId: string | number }\n  try {\n    payload = decodeGmailPubSubBody(rawBody)\n  } catch (err) {\n    return NextResponse.json(\n      { error: err instanceof Error ? err.message : 'invalid_payload' },\n      { status: 400 },\n    )\n  }\n\n  // Channel lookup is intentionally NOT tenant-scoped here \u2014 we don't have a\n  // tenant signal beyond the email address. We enumerate matching channels\n  // across all tenants and enqueue one sync job per match. Each job carries\n  // its own tenant scope, so downstream ingest stays tenant-isolated.\n  const container = await createRequestContainer()\n  const em = (container.resolve('em') as EntityManager).fork()\n  const channels = await findWithDecryption(\n    em,\n    CommunicationChannel,\n    {\n      providerKey: 'gmail',\n      externalIdentifier: payload.emailAddress,\n      isActive: true,\n      deletedAt: null,\n    },\n  )\n  if (channels.length === 0) {\n    // Return 204 anyway \u2014 see route header comment.\n    return new NextResponse(null, { status: 204 })\n  }\n\n  const queue = getCommunicationChannelsQueue(\n    COMMUNICATION_CHANNELS_QUEUES.gmailHistorySync,\n  )\n  for (const channel of channels) {\n    const job: GmailHistorySyncJobPayload = {\n      channelId: channel.id,\n      scope: {\n        tenantId: channel.tenantId,\n        organizationId: channel.organizationId ?? null,\n      },\n      notification: {\n        emailAddress: payload.emailAddress,\n        historyId: String(payload.historyId),\n      },\n    }\n    try {\n      await queue.enqueue(job as unknown as Record<string, unknown>)\n    } catch (err) {\n      console.error(\n        `[gmail-webhook] failed to enqueue history-sync for channel ${channel.id}:`,\n        err,\n      )\n    }\n  }\n\n  return new NextResponse(null, { status: 204 })\n}\n\nexport const openApi = {\n  tags: ['CommunicationChannels'],\n  methods: {\n    POST: {\n      summary: 'Gmail Pub/Sub push notification webhook (Spec C \u00A7 Phase C2)',\n      tags: ['CommunicationChannels'],\n      responses: [\n        { status: 204, description: 'Notification verified + history-sync job enqueued' },\n        { status: 400, description: 'Body not a valid Pub/Sub envelope' },\n        { status: 401, description: 'Invalid JWT or email claim' },\n        { status: 403, description: 'Wrong audience' },\n        { status: 503, description: 'Webhook not configured / Google certs unreachable' },\n      ],\n    },\n  },\n}\n\nexport default POST\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAoBA,MAAM,WAAW;AAAA,EACtB,MAAM;AAAA;AAAA;AAAA;AAAA,EAIN,MAAM,EAAE,aAAa,OAAO,WAAW,EAAE,QAAQ,KAAK,UAAU,IAAI,WAAW,mBAAmB,EAAE;AACtG;AAQA,eAAsB,KAAK,KAAiC;AAC1D,QAAM,mBAAmB,QAAQ,IAAI;AACrC,QAAM,gBAAgB,QAAQ,IAAI;AAClC,MAAI,CAAC,oBAAoB,CAAC,eAAe;AAGvC,YAAQ;AAAA,MACN;AAAA,IACF;AACA,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AAEA,QAAM,WAAW,uBAAuB;AACxC,MAAI;AACF,UAAM,SAAS,OAAO;AAAA,MACpB,qBAAqB,IAAI,QAAQ,IAAI,eAAe;AAAA,MACpD;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,eAAe,qBAAqB;AACtC,YAAM,SACJ,IAAI,SAAS,mBAAmB,MAChC,IAAI,SAAS,uBAAuB,MACpC;AACF,aAAO,aAAa,KAAK,EAAE,OAAO,IAAI,MAAM,SAAS,IAAI,QAAQ,GAAG,EAAE,OAAO,CAAC;AAAA,IAChF;AACA,UAAM;AAAA,EACR;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,sBAAsB,OAAO;AAAA,EACzC,SAAS,KAAK;AACZ,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,eAAe,QAAQ,IAAI,UAAU,kBAAkB;AAAA,MAChE,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAMA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAoB,KAAK;AAC3D,QAAM,WAAW,MAAM;AAAA,IACrB;AAAA,IACA;AAAA,IACA;AAAA,MACE,aAAa;AAAA,MACb,oBAAoB,QAAQ;AAAA,MAC5B,UAAU;AAAA,MACV,WAAW;AAAA,IACb;AAAA,EACF;AACA,MAAI,SAAS,WAAW,GAAG;AAEzB,WAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/C;AAEA,QAAM,QAAQ;AAAA,IACZ,8BAA8B;AAAA,EAChC;AACA,aAAW,WAAW,UAAU;AAC9B,UAAM,MAAkC;AAAA,MACtC,WAAW,QAAQ;AAAA,MACnB,OAAO;AAAA,QACL,UAAU,QAAQ;AAAA,QAClB,gBAAgB,QAAQ,kBAAkB;AAAA,MAC5C;AAAA,MACA,cAAc;AAAA,QACZ,cAAc,QAAQ;AAAA,QACtB,WAAW,OAAO,QAAQ,SAAS;AAAA,MACrC;AAAA,IACF;AACA,QAAI;AACF,YAAM,MAAM,QAAQ,GAAyC;AAAA,IAC/D,SAAS,KAAK;AACZ,cAAQ;AAAA,QACN,8DAA8D,QAAQ,EAAE;AAAA,QACxE;AAAA,MACF;AAAA,IACF;AAAA,EACF;AAEA,SAAO,IAAI,aAAa,MAAM,EAAE,QAAQ,IAAI,CAAC;AAC/C;AAEO,MAAM,UAAU;AAAA,EACrB,MAAM,CAAC,uBAAuB;AAAA,EAC9B,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,MAAM,CAAC,uBAAuB;AAAA,MAC9B,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,QAChF,EAAE,QAAQ,KAAK,aAAa,oCAAoC;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,6BAA6B;AAAA,QACzD,EAAE,QAAQ,KAAK,aAAa,iBAAiB;AAAA,QAC7C,EAAE,QAAQ,KAAK,aAAa,oDAAoD;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;AAEA,IAAO,gBAAQ;",
+  "names": []
+}