@open-mercato/core 0.6.8-develop.6998.1.d2bc46c56c → 0.6.8-develop.7001.1.03608ab252

package/src/modules/warranty_claims/api/portal/claims/[id]/route.ts

@@ -0,0 +1,195 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { WarrantyClaim, WarrantyClaimLine } from '../../../../data/entities'
+import { loadPortalOwnedClaim } from '../../../../lib/portalClaimAccess'
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+type RouteParams = { id: string }
+type RouteContext = { params: Promise<RouteParams> }
+
+type PortalContext = {
+  auth: CustomerAuthContext
+  customerId: string
+  tenantId: string
+  organizationId: string
+  em: EntityManager
+}
+
+function toIso(value: Date | string | null | undefined): string | null {
+  if (!value) return null
+  if (value instanceof Date) return value.toISOString()
+  const date = new Date(value)
+  return Number.isNaN(date.getTime()) ? value : date.toISOString()
+}
+
+async function resolveClaimId(ctx: RouteContext): Promise<string | null> {
+  try {
+    const params = await ctx.params
+    return typeof params.id === 'string' && params.id.trim().length ? params.id.trim() : null
+  } catch {
+    return null
+  }
+}
+
+async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
+  }
+  if (!auth.customerEntityId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
+  }
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  return {
+    auth,
+    customerId: auth.customerEntityId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    em,
+  }
+}
+
+function serializeLine(line: WarrantyClaimLine) {
+  return {
+    id: line.id,
+    lineNo: line.lineNo,
+    productId: line.productId ?? null,
+    sku: line.sku ?? null,
+    productName: line.productName ?? null,
+    orderLineId: line.orderLineId ?? null,
+    serialNumber: line.serialNumber ?? null,
+    faultCode: line.faultCode ?? null,
+    faultDescription: line.faultDescription ?? null,
+    qtyClaimed: line.qtyClaimed,
+    qtyApproved: line.qtyApproved ?? null,
+    disposition: line.disposition ?? null,
+    lineStatus: line.lineStatus,
+    creditAmount: line.creditAmount ?? null,
+    createdAt: toIso(line.createdAt),
+    updatedAt: toIso(line.updatedAt),
+  }
+}
+
+function serializeClaim(claim: WarrantyClaim, lines: WarrantyClaimLine[]) {
+  return {
+    id: claim.id,
+    claimNumber: claim.claimNumber,
+    claimType: claim.claimType,
+    status: claim.status,
+    channel: claim.channel,
+    priority: claim.priority,
+    customerId: claim.customerId ?? null,
+    customerName: claim.customerName ?? null,
+    orderId: claim.orderId ?? null,
+    orderNumber: claim.orderNumber ?? null,
+    reasonCode: claim.reasonCode ?? null,
+    rejectionReasonCode: claim.rejectionReasonCode ?? null,
+    resolutionSummary: claim.resolutionSummary ?? null,
+    slaDueAt: toIso(claim.slaDueAt),
+    submittedAt: toIso(claim.submittedAt),
+    resolvedAt: toIso(claim.resolvedAt),
+    closedAt: toIso(claim.closedAt),
+    createdAt: toIso(claim.createdAt),
+    updatedAt: toIso(claim.updatedAt),
+    lines: lines.map(serializeLine),
+  }
+}
+
+export async function GET(req: Request, ctx: RouteContext) {
+  const contextOrResponse = await resolvePortalContext(req)
+  if (contextOrResponse instanceof Response) return contextOrResponse
+  const context = contextOrResponse
+  const claimId = await resolveClaimId(ctx)
+  if (!claimId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const scope = { tenantId: context.tenantId, organizationId: context.organizationId }
+  const claim = await loadPortalOwnedClaim(
+    context.em,
+    {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      customerId: context.customerId,
+    },
+    claimId,
+  )
+  if (!claim) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const lines = await findWithDecryption(
+    context.em,
+    WarrantyClaimLine,
+    { claim: claim.id, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },
+    { orderBy: { lineNo: 'ASC' } },
+    scope,
+  )
+  return NextResponse.json({ item: serializeClaim(claim, lines) })
+}
+
+const lineSchema = z.object({
+  id: z.string().uuid(),
+  lineNo: z.number().int(),
+  productId: z.string().uuid().nullable(),
+  sku: z.string().nullable(),
+  productName: z.string().nullable(),
+  orderLineId: z.string().uuid().nullable(),
+  serialNumber: z.string().nullable(),
+  faultCode: z.string().nullable(),
+  faultDescription: z.string().nullable(),
+  qtyClaimed: z.string(),
+  qtyApproved: z.string().nullable(),
+  disposition: z.string().nullable(),
+  lineStatus: z.string(),
+  creditAmount: z.string().nullable(),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+})
+
+const claimSchema = z.object({
+  id: z.string().uuid(),
+  claimNumber: z.string(),
+  claimType: z.string(),
+  status: z.string(),
+  channel: z.string(),
+  priority: z.string(),
+  customerId: z.string().uuid().nullable(),
+  customerName: z.string().nullable(),
+  orderId: z.string().uuid().nullable(),
+  orderNumber: z.string().nullable(),
+  reasonCode: z.string().nullable(),
+  rejectionReasonCode: z.string().nullable(),
+  resolutionSummary: z.string().nullable(),
+  slaDueAt: z.string().nullable(),
+  submittedAt: z.string().nullable(),
+  resolvedAt: z.string().nullable(),
+  closedAt: z.string().nullable(),
+  createdAt: z.string().nullable(),
+  updatedAt: z.string().nullable(),
+  lines: z.array(lineSchema),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim detail',
+  methods: {
+    GET: {
+      summary: 'Read one authenticated customer claim',
+      responses: [
+        {
+          status: 200,
+          description: 'Customer claim detail',
+          schema: z.object({ item: claimSchema }),
+        },
+      ],
+    },
+  },
+}

package/src/modules/warranty_claims/api/portal/claims/[id]/shared.ts

@@ -0,0 +1,125 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import { WarrantyClaim } from '../../../../data/entities'
+import { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../../commands/shared'
+import { loadPortalOwnedClaim } from '../../../../lib/portalClaimAccess'
+
+export type PortalClaimActionRouteContext = { params: Promise<{ id: string }> }
+
+export type PortalClaimActionContext = {
+  auth: CustomerAuthContext
+  customerId: string
+  tenantId: string
+  organizationId: string
+  em: EntityManager
+  commandCtx: CommandRuntimeContext
+}
+
+const claimIdParamSchema = z.string().uuid()
+
+export async function resolvePortalClaimId(ctx: PortalClaimActionRouteContext): Promise<string | null> {
+  try {
+    const params = await ctx.params
+    const parsed = claimIdParamSchema.safeParse(typeof params.id === 'string' ? params.id.trim() : params.id)
+    return parsed.success ? parsed.data : null
+  } catch {
+    return null
+  }
+}
+
+export async function resolvePortalActionContext(req: Request): Promise<PortalClaimActionContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
+  }
+  if (!auth.customerEntityId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
+  }
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const commandAuth: NonNullable<AuthContext> = {
+    sub: auth.sub,
+    sid: auth.sid,
+    tenantId: auth.tenantId,
+    orgId: auth.orgId,
+    email: auth.email,
+    customerEntityId: auth.customerEntityId ?? null,
+    personEntityId: auth.personEntityId ?? null,
+  }
+  return {
+    auth,
+    customerId: auth.customerEntityId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    em,
+    commandCtx: {
+      container,
+      auth: commandAuth,
+      organizationScope: null,
+      selectedOrganizationId: auth.orgId,
+      organizationIds: [auth.orgId],
+      request: req,
+    },
+  }
+}
+
+export async function loadOwnedClaim(
+  context: PortalClaimActionContext,
+  claimId: string,
+): Promise<WarrantyClaim | null> {
+  return loadPortalOwnedClaim(
+    context.em,
+    {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      customerId: context.customerId,
+    },
+    claimId,
+  )
+}
+
+export async function loadOwnedClaimFresh(
+  context: PortalClaimActionContext,
+  claimId: string,
+): Promise<WarrantyClaim | null> {
+  const em = context.em.fork()
+  return loadPortalOwnedClaim(
+    em,
+    {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      customerId: context.customerId,
+    },
+    claimId,
+  )
+}
+
+export async function runPortalClaimActionGuard(
+  req: Request,
+  context: PortalClaimActionContext,
+  claimId: string,
+  mutationPayload: Record<string, unknown>,
+): Promise<RouteMutationGuardResult> {
+  return runRouteMutationGuards({
+    container: context.commandCtx.container,
+    req,
+    auth: {
+      userId: context.auth.sub,
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userFeatures: [],
+    },
+    input: {
+      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,
+      resourceId: claimId,
+      operation: 'custom',
+      mutationPayload,
+    },
+  })
+}

package/src/modules/warranty_claims/api/portal/claims/[id]/submit/route.ts

@@ -0,0 +1,82 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import {
+  loadOwnedClaim,
+  loadOwnedClaimFresh,
+  resolvePortalActionContext,
+  resolvePortalClaimId,
+  runPortalClaimActionGuard,
+  type PortalClaimActionRouteContext,
+} from '../shared'
+
+export const metadata = {
+  POST: { requireAuth: false },
+}
+
+export async function POST(req: Request, ctx: PortalClaimActionRouteContext) {
+  const contextOrResponse = await resolvePortalActionContext(req)
+  if (contextOrResponse instanceof Response) return contextOrResponse
+  const context = contextOrResponse
+  const claimId = await resolvePortalClaimId(ctx)
+  if (!claimId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const claim = await loadOwnedClaim(context, claimId)
+  if (!claim) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  if (claim.status !== 'draft') {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      { ok: false, error: translate('warranty_claims.errors.invalidTransition', 'That status change is not allowed.') },
+      { status: 400 },
+    )
+  }
+
+  const guarded = await runPortalClaimActionGuard(req, context, claim.id, {
+    id: claim.id,
+    action: 'submit',
+  })
+  if (!guarded.ok) {
+    return guarded.response
+  }
+
+  const commandBus = context.commandCtx.container.resolve('commandBus') as CommandBus
+  try {
+    await commandBus.execute<{ id: string; actorCustomerId: string }, { claimId: string }>(
+      'warranty_claims.claim.submit',
+      { input: { id: claim.id, actorCustomerId: context.customerId }, ctx: context.commandCtx },
+    )
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
+
+  await guarded.runAfterSuccess()
+
+  const updated = await loadOwnedClaimFresh(context, claim.id)
+  return NextResponse.json({ ok: true, claimId: claim.id, status: updated?.status ?? 'submitted' })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim submit action',
+  methods: {
+    POST: {
+      summary: 'Submit an owned draft claim from the customer portal',
+      responses: [
+        {
+          status: 200,
+          description: 'Claim submitted',
+          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid(), status: z.string() }),
+        },
+      ],
+    },
+  },
+}

package/src/modules/warranty_claims/api/portal/claims/[id]/withdraw/route.ts

@@ -0,0 +1,87 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { TransitionClaimInput, WarrantyClaimStatus } from '../../../../../data/validators'
+import {
+  loadOwnedClaim,
+  resolvePortalActionContext,
+  resolvePortalClaimId,
+  runPortalClaimActionGuard,
+  type PortalClaimActionRouteContext,
+} from '../shared'
+
+export const metadata = {
+  POST: { requireAuth: false },
+}
+
+const PORTAL_WITHDRAWABLE_STATUSES = new Set<WarrantyClaimStatus>(['draft', 'submitted'])
+
+export async function POST(req: Request, ctx: PortalClaimActionRouteContext) {
+  const contextOrResponse = await resolvePortalActionContext(req)
+  if (contextOrResponse instanceof Response) return contextOrResponse
+  const context = contextOrResponse
+  const claimId = await resolvePortalClaimId(ctx)
+  if (!claimId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const claim = await loadOwnedClaim(context, claimId)
+  if (!claim) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  if (!PORTAL_WITHDRAWABLE_STATUSES.has(claim.status)) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      { ok: false, error: translate('warranty_claims.errors.invalidTransition', 'That status change is not allowed.') },
+      { status: 400 },
+    )
+  }
+
+  const guarded = await runPortalClaimActionGuard(req, context, claim.id, {
+    id: claim.id,
+    action: 'withdraw',
+    toStatus: 'cancelled',
+  })
+  if (!guarded.ok) {
+    return guarded.response
+  }
+
+  const commandBus = context.commandCtx.container.resolve('commandBus') as CommandBus
+  try {
+    await commandBus.execute<TransitionClaimInput, { claimId: string }>(
+      'warranty_claims.claim.transition',
+      {
+        input: { id: claim.id, toStatus: 'cancelled', actorCustomerId: context.customerId },
+        ctx: context.commandCtx,
+      },
+    )
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
+
+  await guarded.runAfterSuccess()
+
+  return NextResponse.json({ ok: true, claimId: claim.id, status: 'cancelled' })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim withdraw action',
+  methods: {
+    POST: {
+      summary: 'Withdraw (cancel) an owned claim while it is draft or submitted',
+      responses: [
+        {
+          status: 200,
+          description: 'Claim withdrawn',
+          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid(), status: z.literal('cancelled') }),
+        },
+      ],
+    },
+  },
+}