@open-mercato/core 0.6.5-develop.4384.1.ce2ec6eaaa → 0.6.5-develop.4393.1.de282b5dfd

package/src/modules/communication_channels/api/post/channels/connect/credentials/route.ts

@@ -0,0 +1,134 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID,
+  type ConnectCredentialChannelInput,
+  type ConnectCredentialChannelResult,
+} from '../../../../../commands/connect-credential-channel'
+import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
+
+export const metadata = {
+  path: '/communication_channels/channels/connect/credentials',
+  POST: {
+    requireAuth: true,
+    requireFeatures: ['communication_channels.connect_user_channel'],
+  },
+}
+
+const bodySchema = z.object({
+  providerKey: z.string().min(1).max(64),
+  displayName: z.string().min(1).max(255),
+  credentials: z.record(z.string(), z.unknown()),
+  pollIntervalSeconds: z.number().int().positive().max(86_400).optional(),
+})
+
+export async function POST(req: Request): Promise<Response> {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  let body: z.infer<typeof bodySchema>
+  try {
+    const json = await readJsonSafe(req, null)
+    body = bodySchema.parse(json)
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { status: 422 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: 'communication_channels.channel',
+      resourceId: `new:${body.providerKey}`,
+      operation: 'create',
+      mutationPayload: {
+        providerKey: body.providerKey,
+        displayName: body.displayName,
+        pollIntervalSeconds: body.pollIntervalSeconds,
+      },
+    },
+  })
+  if ('response' in guard) return guard.response
+
+  const commandBus = container.resolve('commandBus') as CommandBus
+
+  const input: ConnectCredentialChannelInput = {
+    providerKey: body.providerKey,
+    displayName: body.displayName,
+    credentials: body.credentials,
+    pollIntervalSeconds: body.pollIntervalSeconds,
+    userId: auth.sub as string,
+    scope: {
+      tenantId: auth.tenantId as string,
+      organizationId: (auth as { orgId?: string | null }).orgId ?? null,
+    },
+  }
+  const { result } = await commandBus.execute<
+    ConnectCredentialChannelInput,
+    ConnectCredentialChannelResult
+  >(COMMUNICATION_CHANNELS_CONNECT_CREDENTIAL_CHANNEL_COMMAND_ID, {
+    input,
+    ctx: {
+      container,
+      auth: auth as never,
+      organizationScope: null,
+      selectedOrganizationId: (auth as { orgId?: string | null }).orgId ?? null,
+      organizationIds: (auth as { orgId?: string | null }).orgId
+        ? [(auth as { orgId?: string | null }).orgId!]
+        : null,
+    },
+  })
+
+  if (result.status === 'no_adapter') {
+    return NextResponse.json({ error: result.reason }, { status: 404 })
+  }
+  if (result.status === 'validation_failed') {
+    return NextResponse.json({ error: 'Credential validation failed', fieldErrors: result.errors }, { status: 422 })
+  }
+  if (result.status === 'duplicate_mailbox') {
+    return NextResponse.json(
+      {
+        error: `This mailbox is already connected via "${result.existingProviderKey}". Disconnect it there before connecting it again with a different provider.`,
+        code: 'mailbox_already_connected',
+      },
+      { status: 409 },
+    )
+  }
+  await guard.afterSuccess()
+  return NextResponse.json(
+    {
+      channelId: result.channelId,
+      externalIdentifier: result.externalIdentifier,
+    },
+    { status: 201 },
+  )
+}
+
+export const openApi = {
+  tags: ['CommunicationChannels'],
+  methods: {
+    POST: {
+      summary: 'Connect a credential-based per-user channel (IMAP/SMTP)',
+      tags: ['CommunicationChannels'],
+      responses: [
+        { status: 201, description: 'Channel connected' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'Unknown provider' },
+        { status: 409, description: 'Mailbox already connected via another provider' },
+        { status: 422, description: 'Invalid body or credential validation failed' },
+      ],
+    },
+  },
+}
+export default POST

package/src/modules/communication_channels/api/post/messages/[messageId]/reactions/route.ts

@@ -0,0 +1,143 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  COMMUNICATION_CHANNELS_TOGGLE_OUTBOUND_REACTION_COMMAND_ID,
+  type ToggleOutboundReactionInput,
+  type ToggleOutboundReactionResult,
+} from '../../../../../commands/toggle-outbound-reaction'
+import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
+
+const bodySchema = z.object({
+  emoji: z.string().min(1).max(64),
+})
+
+export const metadata = {
+  path: '/communication_channels/messages/[messageId]/reactions',
+  POST: {
+    requireAuth: true,
+    requireFeatures: ['communication_channels.react'],
+  },
+}
+
+type RouteContext = {
+  params: Promise<{ messageId: string }> | { messageId: string }
+  auth?: {
+    sub?: string
+    tenantId?: string
+    /**
+     * AuthContext (`packages/shared/src/lib/auth/server.ts`) exposes the
+     * selected organization as `orgId`, not `organizationId`. Round-2 F3 fix.
+     */
+    orgId?: string | null
+  } | null
+}
+
+export async function POST(req: Request, context: RouteContext): Promise<Response> {
+  const { messageId } = await context.params
+  if (!messageId || !z.string().uuid().safeParse(messageId).success) {
+    return NextResponse.json({ error: 'Invalid messageId' }, { status: 400 })
+  }
+
+  const auth = context.auth
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  let body: z.infer<typeof bodySchema>
+  try {
+    const json = await readJsonSafe(req, null)
+    body = bodySchema.parse(json)
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { status: 422 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: 'communication_channels.message',
+      resourceId: messageId,
+      operation: 'custom',
+      mutationPayload: body,
+    },
+  })
+  if ('response' in guard) return guard.response
+
+  const commandBus = container.resolve('commandBus') as CommandBus
+
+  const input: ToggleOutboundReactionInput = {
+    messageId,
+    emoji: body.emoji,
+    action: 'add',
+    reactedByUserId: auth.sub,
+    scope: {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId ?? null,
+    },
+  }
+  const { result } = await commandBus.execute<
+    ToggleOutboundReactionInput,
+    ToggleOutboundReactionResult
+  >(COMMUNICATION_CHANNELS_TOGGLE_OUTBOUND_REACTION_COMMAND_ID, {
+    input,
+    ctx: {
+      container,
+      auth: auth as never,
+      organizationScope: null,
+      selectedOrganizationId: auth.orgId ?? null,
+      organizationIds: auth.orgId ? [auth.orgId] : null,
+    },
+  })
+
+  if (result.status === 'no_channel_link') {
+    return NextResponse.json({ error: result.reason }, { status: 409 })
+  }
+  if (result.status === 'not_owner') {
+    // Reacting would send from another user's connected account — refuse.
+    return NextResponse.json({ error: result.reason }, { status: 403 })
+  }
+  if (result.status === 'noop') {
+    return NextResponse.json({ error: result.reason }, { status: 409 })
+  }
+  if (result.status === 'added') {
+    await guard.afterSuccess()
+    return NextResponse.json(
+      {
+        id: result.reactionId,
+        messageId: result.messageId,
+        emoji: result.emoji,
+        replaced: result.replaced,
+        enqueued: result.enqueued,
+      },
+      { status: 201 },
+    )
+  }
+  return NextResponse.json({ error: 'Unexpected result' }, { status: 500 })
+}
+
+export const openApi = {
+  tags: ['CommunicationChannels'],
+  methods: {
+    POST: {
+      summary: 'Add a reaction to a channel-linked message',
+      tags: ['CommunicationChannels'],
+      responses: [
+        { status: 201, description: 'Reaction added' },
+        { status: 400, description: 'Invalid messageId' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Channel is owned by another user' },
+        { status: 409, description: 'Message not channel-linked or duplicate reaction' },
+        { status: 422, description: 'Invalid request body' },
+      ],
+    },
+  },
+}
+export default POST

package/src/modules/communication_channels/api/post/oauth/[provider]/initiate/route.ts

@@ -0,0 +1,192 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { toAbsoluteUrl } from '@open-mercato/shared/lib/url'
+import { getChannelAdapter } from '../../../../../lib/adapter-registry-singleton'
+import { resolveOAuthClientCredentials } from '../../../../../lib/oauth-client-config'
+import {
+  COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME,
+  COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS,
+  createOAuthState,
+  DEFAULT_OAUTH_RETURN_URL,
+  isSafeOAuthReturnUrl,
+  normalizeOAuthReturnUrl,
+  OAuthStateError,
+} from '../../../../../lib/oauth-state'
+
+export const metadata = {
+  path: '/communication_channels/oauth/[provider]/initiate',
+  POST: {
+    requireAuth: true,
+    requireFeatures: ['communication_channels.connect_user_channel'],
+  },
+}
+
+const initiateBodySchema = z.object({
+  channelType: z.literal('email').optional(),
+  /** Where to send the user after the callback succeeds. Defaults to the profile page. */
+  returnUrl: z.string().min(1).max(2048).refine(isSafeOAuthReturnUrl, {
+    message: 'returnUrl must be a same-origin path',
+  }).optional(),
+  /** Optional pre-filled email — Google `login_hint`. */
+  loginHint: z.string().email().optional(),
+})
+
+type RouteContext = {
+  params: Promise<{ provider: string }> | { provider: string }
+}
+
+type CredentialsServiceLike = {
+  resolve: (
+    integrationId: string,
+    scope: { organizationId: string; tenantId: string },
+  ) => Promise<Record<string, unknown> | null>
+}
+
+/**
+ * Default profile redirect — matches the per-user channels page registered by
+ * slice 3d (the `/backend/profile/communication-channels` route).
+ */
+function defaultRedirectUri(req: Request, providerKey: string): string {
+  // Derive the origin from the configured app URL / forwarded headers rather
+  // than the raw request origin, so the redirect_uri matches the value the
+  // provider has registered even when the app sits behind a reverse proxy.
+  return toAbsoluteUrl(req, `/api/communication_channels/oauth/${providerKey}/callback`)
+}
+
+export async function POST(req: Request, context: RouteContext): Promise<Response> {
+  const { provider } = await context.params
+  if (!/^[a-z0-9_-]+$/i.test(provider)) {
+    return NextResponse.json({ error: 'Invalid provider' }, { status: 400 })
+  }
+
+  const adapter = getChannelAdapter(provider)
+  if (!adapter) {
+    return NextResponse.json(
+      { error: `No ChannelAdapter for provider: ${provider}` },
+      { status: 404 },
+    )
+  }
+  if (typeof adapter.buildOAuthAuthorizeUrl !== 'function') {
+    return NextResponse.json(
+      { error: `Provider '${provider}' does not support OAuth (no buildOAuthAuthorizeUrl)` },
+      { status: 400 },
+    )
+  }
+
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  let body: z.infer<typeof initiateBodySchema>
+  try {
+    const json = await readJsonSafe(req, {})
+    body = initiateBodySchema.parse(json ?? {})
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { status: 422 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const credentialsService = (() => {
+    try {
+      return container.resolve('integrationCredentialsService') as CredentialsServiceLike
+    } catch {
+      return null
+    }
+  })()
+  // OAuth client credentials are tenant-level — the admin configures them under
+  // the `channel_<provider>` integration in the Integrations UI (stored at
+  // userId = null). A missing row means the provider has not been set up yet;
+  // we surface that as an actionable error instead of handing an empty object to
+  // the adapter (which would throw a cryptic Zod "expected string" message).
+  const credentials = await resolveOAuthClientCredentials(credentialsService, provider, {
+    tenantId: auth.tenantId as string,
+    organizationId: (auth as { orgId?: string | null }).orgId ?? null,
+  })
+  if (!credentials) {
+    return NextResponse.json(
+      {
+        error:
+          `${provider} is not configured for this workspace yet. An administrator must add the OAuth Client ID and Secret under Integrations before mailboxes can be connected.`,
+        code: 'oauth_client_not_configured',
+      },
+      { status: 409 },
+    )
+  }
+
+  const redirectUri = defaultRedirectUri(req, provider)
+  const stateEnvelope = createOAuthState({
+    userId: auth.sub as string,
+    tenantId: auth.tenantId as string,
+    organizationId: (auth as { orgId?: string | null }).orgId ?? null,
+    providerKey: provider,
+    returnUrl: normalizeOAuthReturnUrl(body.returnUrl, DEFAULT_OAUTH_RETURN_URL),
+  })
+
+  let result
+  try {
+    result = await adapter.buildOAuthAuthorizeUrl({
+      state: stateEnvelope.stateParam,
+      nonce: stateEnvelope.payload.nonce,
+      redirectUri,
+      credentials,
+      scope: {
+        tenantId: auth.tenantId as string,
+        organizationId:
+          (auth as { orgId?: string | null }).orgId ?? (auth.tenantId as string),
+      },
+      loginHint: body.loginHint,
+    })
+  } catch (err) {
+    if (err instanceof OAuthStateError) {
+      return NextResponse.json({ error: err.message, code: err.code }, { status: 500 })
+    }
+    const message = err instanceof Error ? err.message : 'Failed to build OAuth authorize URL'
+    return NextResponse.json({ error: message }, { status: 502 })
+  }
+
+  // If the adapter packed extras (PKCE verifier, scopes), bake them into the
+  // state cookie now so the callback handler can pass them to exchangeOAuthCode.
+  const finalCookie = result.extra
+    ? (await import('../../../../../lib/oauth-state')).encryptOAuthState({
+        ...stateEnvelope.payload,
+        extra: { ...(stateEnvelope.payload.extra ?? {}), ...result.extra },
+      })
+    : stateEnvelope.cookie
+
+  const response = NextResponse.json({ authorizeUrl: result.authorizeUrl })
+  response.cookies.set({
+    name: COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME,
+    value: finalCookie,
+    httpOnly: true,
+    secure: process.env.NODE_ENV === 'production',
+    sameSite: 'lax',
+    path: '/',
+    maxAge: Math.floor(COMMUNICATION_CHANNELS_OAUTH_STATE_TTL_MS / 1000),
+  })
+  return response
+}
+
+export const openApi = {
+  tags: ['CommunicationChannels'],
+  methods: {
+    POST: {
+      summary: 'Start a per-user channel OAuth flow',
+      tags: ['CommunicationChannels'],
+      responses: [
+        { status: 200, description: 'Authorize URL + state cookie set' },
+        { status: 400, description: 'Invalid provider or unsupported (no OAuth)' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 422, description: 'Invalid request body' },
+        { status: 502, description: 'Adapter failed to build authorize URL' },
+      ],
+    },
+  },
+}
+export default POST

package/src/modules/communication_channels/api/post/send-as-user/route.ts

@@ -0,0 +1,125 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { sendAsUser } from '../../../lib/send-as-user'
+import { validateRouteMutationGuard } from '../../../lib/route-mutation-guard'
+
+export const metadata = {
+  path: '/communication_channels/send-as-user',
+  POST: {
+    requireAuth: true,
+    requireFeatures: ['communication_channels.manage'],
+  },
+}
+
+const bodySchema = z.object({
+  /** ID of the user-owned channel to send from. Caller MUST own the channel. */
+  userChannelId: z.string().uuid(),
+  to: z.array(z.string().email()).min(1),
+  cc: z.array(z.string().email()).optional(),
+  bcc: z.array(z.string().email()).optional(),
+  // `.regex(/^[^\r\n]*$/)` rejects CR/LF so a caller cannot inject extra email
+  // headers (e.g. a hidden Bcc) through the subject / threading fields. The
+  // outbound MIME assembler also sanitizes these, but fail fast at the edge.
+  subject: z.string().min(1).max(500).regex(/^[^\r\n]*$/),
+  body: z.object({
+    plain: z.string().max(50_000).optional(),
+    html: z.string().max(200_000).optional(),
+  }),
+  inReplyTo: z.string().min(1).max(500).regex(/^[^\r\n]*$/).optional(),
+  references: z.array(z.string().min(1).max(500).regex(/^[^\r\n]*$/)).optional(),
+  /**
+   * Free-form metadata persisted on the resulting MessageChannelLink. Used by
+   * downstream subscribers (e.g. the customers module's link-channel-message
+   * subscriber) to anchor the sent message back to a CRM Person or honor a
+   * caller-specified visibility flag. Keys are caller-defined; the hub does
+   * not interpret them.
+   */
+  channelMetadata: z.record(z.string(), z.unknown()).optional(),
+})
+
+/**
+ * Programmatic send-as-user facade (HTTP entry point).
+ *
+ * Thin wrapper around the in-process `sendAsUser` lib facade
+ * (`../../../lib/send-as-user`), which is also resolvable via DI as
+ * `communicationChannelsSendAsUser` for in-process cross-module callers.
+ * Returns once the Message is persisted; the actual external send is async.
+ */
+export async function POST(req: Request): Promise<Response> {
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  let body: z.infer<typeof bodySchema>
+  try {
+    body = bodySchema.parse(await readJsonSafe(req, null))
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { status: 422 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const organizationId = (auth as { orgId?: string | null }).orgId ?? null
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: 'communication_channels.channel',
+      resourceId: body.userChannelId,
+      operation: 'custom',
+      mutationPayload: body as unknown as Record<string, unknown>,
+    },
+  })
+  if ('response' in guard) return guard.response
+
+  const result = await sendAsUser(
+    container,
+    { userId: auth.sub as string, tenantId: auth.tenantId as string, organizationId, auth },
+    body,
+  )
+
+  if (!result.ok) {
+    return NextResponse.json(
+      result.fieldErrors ? { error: result.error, fieldErrors: result.fieldErrors } : { error: result.error },
+      { status: result.status },
+    )
+  }
+  await guard.afterSuccess()
+
+  return NextResponse.json(
+    {
+      messageId: result.messageId,
+      threadId: result.threadId,
+      channelId: result.channelId,
+      providerKey: result.providerKey,
+      enqueuedForDelivery: true,
+    },
+    { status: 202 },
+  )
+}
+
+export const openApi = {
+  tags: ['CommunicationChannels'],
+  methods: {
+    POST: {
+      summary: 'Send a message through the current user\'s own channel',
+      tags: ['CommunicationChannels'],
+      responses: [
+        { status: 202, description: 'Message persisted; outbound delivery enqueued' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Cannot send through a channel you don\'t own' },
+        { status: 404, description: 'Channel not found' },
+        { status: 409, description: 'Channel in a non-deliverable transitional status' },
+        { status: 422, description: 'Invalid body, or channel requires_reauth / disconnected' },
+      ],
+    },
+  },
+}
+export default POST