@open-mercato/core 0.6.8-develop.6998.1.d2bc46c56c → 0.6.8-develop.7001.1.03608ab252

package/src/modules/warranty_claims/api/portal/events/route.ts

@@ -0,0 +1,260 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import { WarrantyClaim, WarrantyClaimEvent } from '../../../data/entities'
+import type { CommentClaimInput } from '../../../data/validators'
+import { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'
+import { loadPortalOwnedClaim } from '../../../lib/portalClaimAccess'
+
+export const metadata = {
+  GET: { requireAuth: false },
+  POST: { requireAuth: false },
+}
+
+const eventQuerySchema = z.object({
+  claimId: z.string().uuid(),
+})
+
+const portalCommentSchema = z
+  .object({
+    claimId: z.string().uuid(),
+    body: z.string().trim().min(1).max(8000),
+  })
+  .strict()
+
+type PortalContext = {
+  auth: CustomerAuthContext
+  customerId: string
+  tenantId: string
+  organizationId: string
+  em: EntityManager
+  commandCtx: CommandRuntimeContext
+}
+
+function toRecord(value: unknown): Record<string, unknown> {
+  return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
+}
+
+function relationId(value: unknown): string | null {
+  if (typeof value === 'string') return value
+  const record = toRecord(value)
+  return typeof record.id === 'string' ? record.id : null
+}
+
+function toIso(value: Date | string | null | undefined): string | null {
+  if (!value) return null
+  if (value instanceof Date) return value.toISOString()
+  const date = new Date(value)
+  return Number.isNaN(date.getTime()) ? value : date.toISOString()
+}
+
+function serializeEvent(event: WarrantyClaimEvent) {
+  return {
+    id: event.id,
+    claimId: relationId(event.claim),
+    kind: event.kind,
+    visibility: event.visibility,
+    body: event.body ?? null,
+    payload: event.payload ?? null,
+    actorCustomerId: event.actorCustomerId ?? null,
+    createdAt: toIso(event.createdAt),
+  }
+}
+
+async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
+  }
+  if (!auth.customerEntityId) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
+  }
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+  const commandAuth: NonNullable<AuthContext> = {
+    sub: auth.sub,
+    sid: auth.sid,
+    tenantId: auth.tenantId,
+    orgId: auth.orgId,
+    email: auth.email,
+    customerEntityId: auth.customerEntityId ?? null,
+    personEntityId: auth.personEntityId ?? null,
+  }
+  return {
+    auth,
+    customerId: auth.customerEntityId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    em,
+    commandCtx: {
+      container,
+      auth: commandAuth,
+      organizationScope: null,
+      selectedOrganizationId: auth.orgId,
+      organizationIds: [auth.orgId],
+      request: req,
+    },
+  }
+}
+
+async function loadOwnedClaim(context: PortalContext, claimId: string): Promise<WarrantyClaim | null> {
+  return loadPortalOwnedClaim(
+    context.em,
+    {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      customerId: context.customerId,
+    },
+    claimId,
+  )
+}
+
+async function runPortalCommentGuard(
+  req: Request,
+  context: PortalContext,
+  claimId: string,
+  mutationPayload: Record<string, unknown>,
+): Promise<RouteMutationGuardResult> {
+  return runRouteMutationGuards({
+    container: context.commandCtx.container,
+    req,
+    auth: {
+      userId: context.auth.sub,
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userFeatures: [],
+    },
+    input: {
+      resourceKind: WARRANTY_CLAIM_RESOURCE_KIND,
+      resourceId: claimId,
+      operation: 'create',
+      mutationPayload,
+    },
+  })
+}
+
+export async function GET(req: Request) {
+  const contextOrResponse = await resolvePortalContext(req)
+  if (contextOrResponse instanceof Response) return contextOrResponse
+  const context = contextOrResponse
+  const url = new URL(req.url)
+  const parsed = eventQuerySchema.safeParse({ claimId: url.searchParams.get('claimId') ?? undefined })
+  if (!parsed.success) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+  }
+  const claim = await loadOwnedClaim(context, parsed.data.claimId)
+  if (!claim) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const events = await findWithDecryption(
+    context.em,
+    WarrantyClaimEvent,
+    { claim: claim.id, visibility: 'customer', tenantId: context.tenantId, organizationId: context.organizationId },
+    { orderBy: { createdAt: 'ASC' } },
+    { tenantId: context.tenantId, organizationId: context.organizationId },
+  )
+  return NextResponse.json({ items: events.map(serializeEvent) })
+}
+
+export async function POST(req: Request) {
+  const contextOrResponse = await resolvePortalContext(req)
+  if (contextOrResponse instanceof Response) return contextOrResponse
+  const context = contextOrResponse
+  let body: unknown
+  try {
+    body = await req.json()
+  } catch {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+  }
+  const parsed = portalCommentSchema.safeParse(body)
+  if (!parsed.success) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+  }
+  const claim = await loadOwnedClaim(context, parsed.data.claimId)
+  if (!claim) {
+    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+  }
+  const input: CommentClaimInput = {
+    claimId: claim.id,
+    body: parsed.data.body,
+    visibility: 'customer',
+    actorCustomerId: context.customerId,
+  }
+  const guarded = await runPortalCommentGuard(req, context, claim.id, { ...input })
+  if (!guarded.ok) {
+    return guarded.response
+  }
+  const effectiveInput: CommentClaimInput = guarded.modifiedPayload
+    ? {
+        ...input,
+        ...guarded.modifiedPayload,
+        claimId: input.claimId,
+        visibility: input.visibility,
+        actorCustomerId: input.actorCustomerId,
+      }
+    : input
+
+  const commandBus = context.commandCtx.container.resolve('commandBus') as CommandBus
+  try {
+    await commandBus.execute<CommentClaimInput, { claimId: string }>(
+      'warranty_claims.claim.comment',
+      { input: effectiveInput, ctx: context.commandCtx },
+    )
+    await guarded.runAfterSuccess()
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    throw err
+  }
+
+  return NextResponse.json({ ok: true, claimId: claim.id })
+}
+
+const eventSchema = z.object({
+  id: z.string().uuid(),
+  claimId: z.string().uuid().nullable(),
+  kind: z.string(),
+  visibility: z.literal('customer'),
+  body: z.string().nullable(),
+  payload: z.record(z.string(), z.unknown()).nullable(),
+  actorCustomerId: z.string().uuid().nullable(),
+  createdAt: z.string().nullable(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim timeline',
+  methods: {
+    GET: {
+      summary: 'List customer-visible timeline events for an owned claim',
+      query: eventQuerySchema,
+      responses: [
+        {
+          status: 200,
+          description: 'Customer-visible timeline events',
+          schema: z.object({ items: z.array(eventSchema) }),
+        },
+      ],
+    },
+    POST: {
+      summary: 'Append a customer-visible customer comment',
+      requestBody: { contentType: 'application/json', schema: portalCommentSchema },
+      responses: [
+        {
+          status: 200,
+          description: 'Comment appended',
+          schema: z.object({ ok: z.boolean(), claimId: z.string().uuid() }),
+        },
+      ],
+    },
+  },
+}

package/src/modules/warranty_claims/api/portal/options/route.ts

@@ -0,0 +1,113 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { loadWarrantyClaimDictionaryOptions } from '../../../lib/dictionaries'
+import type { WarrantyClaimDictionaryKind } from '../../../data/constants'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('warranty_claims')
+
+type PortalOptionsContext = {
+  auth: CustomerAuthContext
+  tenantId: string
+  organizationId: string
+  container: Awaited<ReturnType<typeof createRequestContainer>>
+}
+
+type PortalOption = {
+  value: string
+  label: string
+}
+
+const querySchema = z.object({}).strict()
+
+const optionSchema = z.object({
+  value: z.string(),
+  label: z.string(),
+})
+
+const responseSchema = z.object({
+  ok: z.literal(true),
+  result: z.object({
+    reasons: z.array(optionSchema),
+    faultCodes: z.array(optionSchema),
+  }),
+})
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+async function resolvePortalOptionsContext(req: Request): Promise<PortalOptionsContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  const container = await createRequestContainer()
+  return {
+    auth,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    container,
+  }
+}
+
+async function loadDictionaryOptions(
+  em: EntityManager,
+  context: PortalOptionsContext,
+  kind: WarrantyClaimDictionaryKind,
+): Promise<PortalOption[]> {
+  try {
+    return await loadWarrantyClaimDictionaryOptions(
+      em,
+      { tenantId: context.tenantId, organizationId: context.organizationId },
+      kind,
+    )
+  } catch {
+    return []
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    querySchema.parse(Object.fromEntries(url.searchParams))
+    const contextOrResponse = await resolvePortalOptionsContext(req)
+    if (contextOrResponse instanceof Response) return contextOrResponse
+    const context = contextOrResponse
+    const em = (context.container.resolve('em') as EntityManager).fork()
+    const reasons = await loadDictionaryOptions(em, context, 'warranty-claim-reason')
+    const faultCodes = await loadDictionaryOptions(em, context, 'warranty-claim-fault-code')
+    return NextResponse.json({ ok: true, result: { reasons, faultCodes } })
+  } catch (err) {
+    const { translate } = await resolveTranslations()
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
+    }
+    logger.error('warranty_claims.portal.options.get failed', { err })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim options',
+  methods: {
+    GET: {
+      summary: 'List active customer portal warranty claim options',
+      query: querySchema,
+      responses: [
+        {
+          status: 200,
+          description: 'Portal warranty claim options',
+          schema: responseSchema,
+        },
+      ],
+    },
+  },
+}

package/src/modules/warranty_claims/api/portal/orders/lines/route.ts

@@ -0,0 +1,258 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { resolveEffectiveWarrantyClaimSettings } from '../../../../lib/settings'
+import { computeWarrantyEntitlementPreview } from '../../../../lib/warrantyPreview'
+import type { WarrantyClaimWarrantyStatus } from '../../../../data/validators'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('warranty_claims')
+
+const querySchema = z
+  .object({
+    orderId: z.string().uuid(),
+  })
+  .strict()
+
+const orderSchema = z.object({
+  id: z.string().uuid(),
+  placedAt: z.string().nullable(),
+})
+
+const orderLineSchema = z.object({
+  orderLineId: z.string().uuid(),
+  productId: z.string().uuid().nullable(),
+  variantId: z.string().uuid().nullable(),
+  sku: z.string().nullable(),
+  name: z.string().nullable(),
+  quantity: z.union([z.string(), z.number()]).nullable(),
+  estimatedWarrantyStatus: z.enum(['in_warranty', 'out_of_warranty', 'unknown']),
+  // Warranty basis for the line so the claim persists real entitlement metadata (WQA-004).
+  purchaseDate: z.string().nullable(),
+  warrantyMonths: z.number().nullable(),
+})
+
+const responseSchema = z.object({
+  ok: z.literal(true),
+  order: orderSchema,
+  items: z.array(orderLineSchema),
+})
+
+type PortalOrderLinesContext = {
+  auth: CustomerAuthContext
+  customerId: string
+  tenantId: string
+  organizationId: string
+  container: Awaited<ReturnType<typeof createRequestContainer>>
+  em: EntityManager
+}
+
+type OwnedOrder = {
+  id: string
+  placedAt: string | null
+}
+
+type PortalOrderLineItem = z.infer<typeof orderLineSchema>
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+function stringField(record: Record<string, unknown>, key: string): string | null {
+  const value = record[key]
+  return typeof value === 'string' ? value : null
+}
+
+function isMissingTableError(err: unknown): boolean {
+  if (typeof err !== 'object' || err === null) return false
+  const candidate = err as { code?: unknown; message?: unknown }
+  return candidate.code === '42P01'
+    || (typeof candidate.message === 'string' && candidate.message.includes('does not exist'))
+}
+
+function amountField(record: Record<string, unknown>, key: string): string | number | null {
+  const value = record[key]
+  if (typeof value === 'string' || typeof value === 'number') return value
+  return null
+}
+
+function toIso(value: unknown): string | null {
+  if (!value) return null
+  if (value instanceof Date) return value.toISOString()
+  if (typeof value === 'string') {
+    const date = new Date(value)
+    return Number.isNaN(date.getTime()) ? value : date.toISOString()
+  }
+  return null
+}
+
+function estimateWarrantyStatus(placedAt: string | null, defaultWarrantyMonths: number | null): WarrantyClaimWarrantyStatus {
+  if (!placedAt) return 'unknown'
+  return computeWarrantyEntitlementPreview(new Date(placedAt), defaultWarrantyMonths)
+}
+
+async function resolvePortalContext(req: Request): Promise<PortalOrderLinesContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') }, { status: 401 })
+  }
+  if (!auth.customerEntityId) {
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.customerAccountNotLinked', 'Customer account is not linked to a customer record') }, { status: 403 })
+  }
+  const container = await createRequestContainer()
+  const em = (container.resolve('em') as EntityManager).fork()
+  return {
+    auth,
+    customerId: auth.customerEntityId,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+    container,
+    em,
+  }
+}
+
+type PortalOrderLinesDb = {
+  sales_orders: {
+    id: string
+    placed_at: Date | null
+    customer_entity_id: string | null
+    tenant_id: string | null
+    organization_id: string | null
+    deleted_at: Date | null
+  }
+  sales_order_lines: {
+    id: string
+    order_id: string
+    kind: string | null
+    product_id: string | null
+    product_variant_id: string | null
+    catalog_snapshot: Record<string, unknown> | null
+    name: string | null
+    quantity: string | number | null
+    tenant_id: string | null
+    organization_id: string | null
+    deleted_at: Date | null
+  }
+}
+
+async function loadOwnedOrder(
+  context: PortalOrderLinesContext,
+  orderId: string,
+): Promise<OwnedOrder | null> {
+  try {
+    const db = context.em.getKysely<PortalOrderLinesDb>()
+    const row = await db
+      .selectFrom('sales_orders')
+      .select(['id', 'placed_at'])
+      .where('id', '=', orderId)
+      .where('tenant_id', '=', context.tenantId)
+      .where('organization_id', '=', context.organizationId)
+      .where('customer_entity_id', '=', context.customerId)
+      .where('deleted_at', 'is', null)
+      .executeTakeFirst()
+    if (!row) return null
+    return { id: row.id, placedAt: toIso(row.placed_at) }
+  } catch (err) {
+    if (isMissingTableError(err)) return null
+    throw err
+  }
+}
+
+function serializeOrderLine(
+  row: Record<string, unknown>,
+  estimatedWarrantyStatus: WarrantyClaimWarrantyStatus,
+  purchaseDate: string | null,
+  warrantyMonths: number | null,
+): PortalOrderLineItem | null {
+  if (stringField(row, 'kind') !== 'product') return null
+  const id = stringField(row, 'id')
+  if (!id) return null
+  const snapshot = row.catalog_snapshot && typeof row.catalog_snapshot === 'object' && !Array.isArray(row.catalog_snapshot)
+    ? row.catalog_snapshot as Record<string, unknown>
+    : {}
+  return {
+    orderLineId: id,
+    productId: stringField(row, 'product_id'),
+    variantId: stringField(row, 'product_variant_id'),
+    sku: stringField(row, 'sku') ?? stringField(snapshot, 'sku') ?? stringField(snapshot, 'variantSku') ?? stringField(snapshot, 'variant_sku'),
+    name: stringField(row, 'name') ?? stringField(snapshot, 'title') ?? stringField(snapshot, 'name'),
+    quantity: amountField(row, 'quantity'),
+    estimatedWarrantyStatus,
+    purchaseDate,
+    warrantyMonths,
+  }
+}
+
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const query = querySchema.parse(Object.fromEntries(url.searchParams))
+    const contextOrResponse = await resolvePortalContext(req)
+    if (contextOrResponse instanceof Response) return contextOrResponse
+    const context = contextOrResponse
+    const { translate } = await resolveTranslations()
+    const order = await loadOwnedOrder(context, query.orderId)
+    if (!order) {
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderNotOwned', 'Order not found') }, { status: 404 })
+    }
+
+    const settings = await resolveEffectiveWarrantyClaimSettings(context.em, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+    })
+    const estimatedWarrantyStatus = estimateWarrantyStatus(order.placedAt, settings.defaultWarrantyMonths)
+    const db = context.em.getKysely<PortalOrderLinesDb>()
+    let rows: Array<Record<string, unknown>> = []
+    try {
+      rows = await db
+        .selectFrom('sales_order_lines')
+        .select(['id', 'order_id', 'kind', 'product_id', 'product_variant_id', 'catalog_snapshot', 'name', 'quantity'])
+        .where('order_id', '=', order.id)
+        .where('tenant_id', '=', context.tenantId)
+        .where('organization_id', '=', context.organizationId)
+        .where('deleted_at', 'is', null)
+        .limit(100)
+        .execute() as Array<Record<string, unknown>>
+    } catch (err) {
+      if (!isMissingTableError(err)) throw err
+    }
+
+    return NextResponse.json({
+      ok: true,
+      order,
+      items: rows
+        .map((row) => serializeOrderLine(row, estimatedWarrantyStatus, order.placedAt, settings.defaultWarrantyMonths))
+        .filter((item): item is PortalOrderLineItem => item !== null),
+    })
+  } catch (err) {
+    const { translate } = await resolveTranslations()
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
+    }
+    logger.error('warranty_claims.portal.order_lines.get failed', { err })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data') }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Warranty Claims Portal',
+  summary: 'Customer portal warranty claim order line picker',
+  methods: {
+    GET: {
+      summary: 'List product lines for an authenticated customer-owned order',
+      query: querySchema,
+      responses: [
+        {
+          status: 200,
+          description: 'Customer-owned sales order product lines',
+          schema: responseSchema,
+        },
+      ],
+    },
+  },
+}