@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7180.1.9717fbbb43

package/src/modules/staff/api/timesheets/tags/task-assignments/route.ts

@@ -0,0 +1,294 @@
+/**
+ * Task tag assignment (T3.4) — the "Dodaj tag" chip in the task drawer of screen
+ * 7 and the badges on the board cards of screen 6.
+ *
+ * `POST` adds the tags, `DELETE` removes them; both are idempotent, so the drawer
+ * can re-send its chip list without special-casing what was already there.
+ *
+ * Every call resolves the caller's project access before it touches the task —
+ * see `../access.ts` for why that lookup and the 404 are shaped the way they are.
+ */
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { emitStaffEvent } from '../../../../events'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { runTimesheetInterceptors } from '../../_shared/withTimesheetInterceptors'
+import {
+  staffTimeTaskTagAssignmentSchema,
+  type StaffTimeTaskTagAssignmentInput,
+} from '../../../../data/validators'
+import { staffTimeTagCommandIds } from '../../../../commands/timesheets-tags'
+import {
+  STAFF_TIME_TRACKING_RESOURCE_KINDS,
+  runStaffMutationGuardAfterSuccess,
+  runStaffMutationGuards,
+} from '../../../guards'
+import { loadTagProjectAccess, requireAccessibleTask, type TagAssignmentScope } from '../access'
+
+const logger = createLogger('staff').child({ component: 'api/timesheets/tags/task-assignments' })
+
+const RESOURCE_KIND = STAFF_TIME_TRACKING_RESOURCE_KINDS.taskTag
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.manage'] },
+}
+
+const assignResponseSchema = z.object({
+  taskId: z.string().uuid(),
+  tagIds: z.array(z.string().uuid()),
+  assignedTagIds: z.array(z.string().uuid()),
+  alreadyAssignedTagIds: z.array(z.string().uuid()),
+})
+
+const unassignResponseSchema = z.object({
+  taskId: z.string().uuid(),
+  tagIds: z.array(z.string().uuid()),
+  removedTagIds: z.array(z.string().uuid()),
+  notAssignedTagIds: z.array(z.string().uuid()),
+})
+
+type AssignmentResult = {
+  targetId: string
+  assignedTagIds: string[]
+  alreadyAssignedTagIds: string[]
+  tagIds: string[]
+}
+
+type UnassignmentResult = {
+  targetId: string
+  removedTagIds: string[]
+  notAssignedTagIds: string[]
+  tagIds: string[]
+}
+
+async function buildContext(
+  req: Request,
+): Promise<{ ctx: CommandRuntimeContext; translate: (key: string, fallback?: string) => string }> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  const { translate } = await resolveTranslations()
+  if (!auth) throw new CrudHttpError(401, { error: translate('staff.errors.unauthorized', 'Unauthorized') })
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const ctx: CommandRuntimeContext = {
+    container,
+    auth,
+    organizationScope: scope,
+    selectedOrganizationId: scope?.selectedId ?? auth.orgId ?? null,
+    organizationIds: scope?.filterIds ?? (auth.orgId ? [auth.orgId] : null),
+    request: req,
+  }
+  return { ctx, translate }
+}
+
+function requireAssignmentScope(
+  ctx: CommandRuntimeContext,
+  translate: (key: string, fallback?: string) => string,
+): TagAssignmentScope {
+  const tenantId = ctx.auth?.tenantId ?? null
+  const organizationId = ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null
+  const userId = ctx.auth?.sub ?? null
+  if (!tenantId || !organizationId || !userId) {
+    throw new CrudHttpError(400, {
+      error: translate('staff.errors.missingScope', 'Missing tenant or organization scope.'),
+    })
+  }
+  return { tenantId, organizationId, userId }
+}
+
+async function handle(
+  req: Request,
+  commandId: string,
+  operation: 'create' | 'delete',
+): Promise<Response> {
+  const { ctx, translate } = await buildContext(req)
+  const scope = requireAssignmentScope(ctx, translate)
+
+  const interceptors = await runTimesheetInterceptors({
+    request: req,
+    method: operation === 'create' ? 'POST' : 'DELETE',
+    scope: {
+      container: ctx.container,
+      userId: scope.userId,
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+    },
+    body: await readJsonSafe<Record<string, unknown>>(req, {}),
+  })
+  if (!interceptors.ok) return interceptors.response
+  const { session } = interceptors
+
+  const input = parseScopedCommandInput(staffTimeTaskTagAssignmentSchema, session.body, ctx, translate)
+
+  const access = await loadTagProjectAccess(ctx.container, scope)
+  const em = (ctx.container.resolve('em') as EntityManager).fork()
+  await requireAccessibleTask(em, input.taskId, scope, access, translate)
+
+  const guardResult = await runStaffMutationGuards(
+    ctx.container,
+    {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: input.taskId,
+      operation,
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: input,
+    },
+  )
+  if (!guardResult.ok) {
+    return NextResponse.json(guardResult.errorBody ?? { error: 'Operation blocked by guard' }, {
+      status: guardResult.errorStatus ?? 422,
+    })
+  }
+
+  const commandBus = ctx.container.resolve('commandBus') as CommandBus
+  const { result, logEntry } = await commandBus.execute<
+    StaffTimeTaskTagAssignmentInput,
+    AssignmentResult | UnassignmentResult
+  >(commandId, { input, ctx })
+
+  if (guardResult.afterSuccessCallbacks.length) {
+    await runStaffMutationGuardAfterSuccess(guardResult.afterSuccessCallbacks, {
+      tenantId: scope.tenantId,
+      organizationId: scope.organizationId,
+      userId: scope.userId,
+      resourceKind: RESOURCE_KIND,
+      resourceId: input.taskId,
+      operation,
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+    })
+  }
+
+  // A tag write is a change to the task itself, so it travels as the task's own
+  // `updated` event rather than an assignment-shaped one no subscriber knows about.
+  void emitStaffEvent('staff.timesheets.time_task.updated', {
+    id: input.taskId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  }, { persistent: true }).catch((err) => {
+    logger.error('staff.timesheets emit time_task.updated failed', { err })
+  })
+
+  const assignment = result as AssignmentResult | undefined
+  const unassignment = result as UnassignmentResult | undefined
+  const payload =
+    operation === 'create'
+      ? {
+          taskId: input.taskId,
+          tagIds: assignment?.tagIds ?? [],
+          assignedTagIds: assignment?.assignedTagIds ?? [],
+          alreadyAssignedTagIds: assignment?.alreadyAssignedTagIds ?? [],
+        }
+      : {
+          taskId: input.taskId,
+          tagIds: unassignment?.tagIds ?? [],
+          removedTagIds: unassignment?.removedTagIds ?? [],
+          notAssignedTagIds: unassignment?.notAssignedTagIds ?? [],
+        }
+
+  const response = await session.respond(200, payload)
+  if (logEntry?.undoToken && logEntry?.id && logEntry?.commandId) {
+    response.headers.set(
+      'x-om-operation',
+      serializeOperationMetadata({
+        id: logEntry.id,
+        undoToken: logEntry.undoToken,
+        commandId: logEntry.commandId,
+        actionLabel: logEntry.actionLabel ?? null,
+        resourceKind: logEntry.resourceKind ?? RESOURCE_KIND,
+        resourceId: logEntry.resourceId ?? input.taskId,
+        executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : undefined,
+      }),
+    )
+  }
+  return response
+}
+
+async function errorResponse(err: unknown, message: string): Promise<Response> {
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status })
+  }
+  const { translate } = await resolveTranslations()
+  if (err instanceof z.ZodError) {
+    return NextResponse.json(
+      { error: translate('staff.errors.invalid_request', 'Invalid request'), details: err.issues },
+      { status: 400 },
+    )
+  }
+  logger.error(message, { err })
+  return NextResponse.json({ error: translate('staff.errors.internal', 'Internal server error') }, { status: 500 })
+}
+
+export async function POST(req: Request) {
+  try {
+    return await handle(req, staffTimeTagCommandIds.assignTask, 'create')
+  } catch (err) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
+    return errorResponse(err, 'staff.timesheets.tags.task-assignments.POST failed')
+  }
+}
+
+export async function DELETE(req: Request) {
+  try {
+    return await handle(req, staffTimeTagCommandIds.unassignTask, 'delete')
+  } catch (err) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
+    return errorResponse(err, 'staff.timesheets.tags.task-assignments.DELETE failed')
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Staff',
+  summary: 'Task tag assignments',
+  methods: {
+    POST: {
+      summary: 'Assign tags to a task',
+      description:
+        'Adds tags to a task. Idempotent — a tag the task already carries comes back in alreadyAssignedTagIds instead of failing. Refused with 404 when the task is outside the caller\'s project access.',
+      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },
+      responses: [{ status: 200, description: 'Tags assigned', schema: assignResponseSchema }],
+      errors: [
+        { status: 400, description: 'Invalid payload or missing organization scope' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },
+        { status: 404, description: 'Task not found or not accessible' },
+        { status: 422, description: 'Unknown tag ids' },
+      ],
+    },
+    DELETE: {
+      summary: 'Unassign tags from a task',
+      description:
+        'Removes tags from a task. Idempotent — a tag the task does not carry comes back in notAssignedTagIds instead of failing.',
+      requestBody: { contentType: 'application/json', schema: staffTimeTaskTagAssignmentSchema },
+      responses: [{ status: 200, description: 'Tags unassigned', schema: unassignResponseSchema }],
+      errors: [
+        { status: 400, description: 'Invalid payload or missing organization scope' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 403, description: 'Missing staff.timesheets.tasks.manage' },
+        { status: 404, description: 'Task not found or not accessible' },
+      ],
+    },
+  },
+}

package/src/modules/staff/api/timesheets/task-statuses/route.ts

@@ -0,0 +1,232 @@
+import { z } from 'zod'
+import { makeCrudRoute, type CrudCtx } from '@open-mercato/shared/lib/crud/factory'
+import { staffTimeTaskStatusCrudEvents } from '../../../lib/crud'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveCrudRecordId, parseScopedCommandInput } from '@open-mercato/shared/lib/api/scoped'
+import { StaffTimeTaskStatus } from '../../../data/entities'
+import { staffTimeTaskStatusCreateSchema, staffTimeTaskStatusUpdateSchema } from '../../../data/validators'
+import { staffTimeTaskStatusCommandIds } from '../../../commands/timesheets-task-statuses'
+import { resolveListProjectAccess } from '../tasks/route'
+import { createStaffCrudOpenApi, createPagedListResponseSchema, defaultOkResponseSchema } from '../../openapi'
+
+const F = {
+  id: 'id',
+  tenant_id: 'tenant_id',
+  organization_id: 'organization_id',
+  time_project_id: 'time_project_id',
+  name: 'name',
+  slug: 'slug',
+  color: 'color',
+  position: 'position',
+  is_default: 'is_default',
+  is_done: 'is_done',
+  created_at: 'created_at',
+  updated_at: 'updated_at',
+} as const
+
+/**
+ * Columns are project configuration (D-1), not task content: anyone who can see the
+ * board needs to read them, but only a Team Leader who can manage the project may
+ * add, rename, recolour, reorder or remove one. Hence the asymmetric gating —
+ * `tasks.view` to read, `projects.manage` to write.
+ *
+ * `tasks.view` is granted to every employee, so it decides *what kind* of access this
+ * is, never *whose* board is being read. The list is therefore intersected with
+ * `resolveProjectAccess` exactly as the tasks routes are — a column carries its
+ * project's naming, workflow and done/default policy, which is the same thing a task
+ * title leaks about a client the caller has no route to.
+ */
+const routeMetadata = {
+  GET: { requireAuth: true, requireFeatures: ['staff.timesheets.tasks.view'] },
+  POST: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['staff.timesheets.projects.manage'] },
+}
+
+export const metadata = routeMetadata
+
+const rawBodySchema = z.object({}).passthrough()
+
+const listSchema = z
+  .object({
+    page: z.coerce.number().min(1).default(1),
+    pageSize: z.coerce.number().min(1).max(100).default(50),
+    ids: z.string().optional(),
+    timeProjectId: z.string().uuid().optional(),
+    sortField: z.string().optional(),
+    sortDir: z.enum(['asc', 'desc']).optional(),
+  })
+  .passthrough()
+
+type TaskStatusListQuery = z.infer<typeof listSchema>
+
+/** Non-UUID sentinel used as the "match nothing" filter, mirroring the tasks route. */
+const IMPOSSIBLE_ID = '00000000-0000-0000-0000-000000000000'
+
+function splitIdList(value: unknown): string[] | null {
+  if (typeof value !== 'string' || value.trim().length === 0) return null
+  const ids = value
+    .split(',')
+    .map((entry) => entry.trim())
+    .filter((entry) => entry.length > 0)
+  return ids.length > 0 ? ids : []
+}
+
+/**
+ * Every column query narrows to the projects the caller may actually see. The access
+ * decision is the tasks route's memoised resolver, so a board that loads its columns
+ * and its cards in one request pays for it once and both answers agree. Exported so
+ * the intersection is testable without standing up the CRUD factory.
+ */
+export async function buildTaskStatusListFilters(
+  query: TaskStatusListQuery,
+  ctx: CrudCtx,
+): Promise<Record<string, unknown>> {
+  const filters: Record<string, unknown> = {}
+
+  const narrowIds = splitIdList(query.ids)
+  const requestedProjectId =
+    typeof query.timeProjectId === 'string' && query.timeProjectId.trim().length > 0
+      ? query.timeProjectId.trim()
+      : null
+
+  const access = await resolveListProjectAccess(ctx)
+  if (!access.canManageAll) {
+    const projectIds = requestedProjectId
+      ? access.projectIds.filter((id) => id === requestedProjectId)
+      : [...access.projectIds]
+    if (projectIds.length === 0) {
+      // A non-member gets no row at all — not a redacted one — so a foreign board's
+      // column names and workflow never leave the server.
+      filters[F.time_project_id] = { $in: [IMPOSSIBLE_ID] }
+      return filters
+    }
+    filters[F.time_project_id] = { $in: projectIds }
+  } else if (requestedProjectId) {
+    filters[F.time_project_id] = requestedProjectId
+  }
+
+  if (narrowIds !== null) {
+    filters[F.id] = { $in: narrowIds.length > 0 ? narrowIds : [IMPOSSIBLE_ID] }
+  }
+
+  return filters
+}
+
+const crud = makeCrudRoute({
+  metadata: routeMetadata,
+  orm: {
+    entity: StaffTimeTaskStatus,
+    idField: 'id',
+    orgField: 'organizationId',
+    tenantField: 'tenantId',
+    softDeleteField: 'deletedAt',
+  },
+  events: staffTimeTaskStatusCrudEvents,
+  indexer: { entityType: 'staff:staff_time_task_status' },
+  list: {
+    schema: listSchema,
+    entityId: 'staff:staff_time_task_status',
+    fields: [
+      F.id,
+      F.organization_id,
+      F.tenant_id,
+      F.time_project_id,
+      F.name,
+      F.slug,
+      F.color,
+      F.position,
+      F.is_default,
+      F.is_done,
+      F.created_at,
+      F.updated_at,
+    ],
+    // The board renders left to right in `position` order, so that is the default
+    // sort rather than the usual created-at.
+    defaultSort: { field: F.position, dir: 'asc' },
+    sortFieldMap: {
+      position: F.position,
+      name: F.name,
+      slug: F.slug,
+      createdAt: F.created_at,
+      updatedAt: F.updated_at,
+    },
+    buildFilters: buildTaskStatusListFilters,
+  },
+  actions: {
+    create: {
+      commandId: staffTimeTaskStatusCommandIds.create,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        return parseScopedCommandInput(staffTimeTaskStatusCreateSchema, raw ?? {}, ctx, translate)
+      },
+      response: ({ result }) => ({ id: result?.taskStatusId ?? null }),
+      status: 201,
+    },
+    update: {
+      commandId: staffTimeTaskStatusCommandIds.update,
+      schema: rawBodySchema,
+      mapInput: async ({ raw, ctx }) => {
+        const { translate } = await resolveTranslations()
+        return parseScopedCommandInput(staffTimeTaskStatusUpdateSchema, raw ?? {}, ctx, translate)
+      },
+      response: () => ({ ok: true }),
+    },
+    delete: {
+      commandId: staffTimeTaskStatusCommandIds.delete,
+      schema: rawBodySchema,
+      mapInput: async ({ parsed, ctx }) => {
+        const { translate } = await resolveTranslations()
+        const id = resolveCrudRecordId(parsed, ctx, translate)
+        return { id }
+      },
+      response: () => ({ ok: true }),
+    },
+  },
+})
+
+export const GET = crud.GET
+export const POST = crud.POST
+export const PUT = crud.PUT
+export const DELETE = crud.DELETE
+
+export const taskStatusListItemSchema = z.object({
+  id: z.string().uuid().nullable().optional(),
+  organization_id: z.string().uuid().nullable().optional(),
+  tenant_id: z.string().uuid().nullable().optional(),
+  time_project_id: z.string().uuid().nullable().optional(),
+  name: z.string().nullable().optional(),
+  slug: z.string().nullable().optional(),
+  color: z.string().nullable().optional(),
+  position: z.number().int().nullable().optional(),
+  is_default: z.boolean().nullable().optional(),
+  is_done: z.boolean().nullable().optional(),
+  created_at: z.string().nullable().optional(),
+  updated_at: z.string().nullable().optional(),
+})
+
+export const openApi = createStaffCrudOpenApi({
+  resourceName: 'TimeTaskStatus',
+  pluralName: 'Time Task Statuses',
+  description:
+    'Returns the Kanban columns of the projects the caller can see. A caller without `staff.timesheets.projects.manage` is narrowed to the projects they are an active member of, so `timeProjectId` can only ever select a board they already have access to.',
+  querySchema: listSchema,
+  listResponseSchema: createPagedListResponseSchema(taskStatusListItemSchema),
+  create: {
+    schema: staffTimeTaskStatusCreateSchema,
+    description: 'Creates a Kanban column on a time project.',
+  },
+  update: {
+    schema: staffTimeTaskStatusUpdateSchema,
+    responseSchema: defaultOkResponseSchema,
+    description:
+      'Updates a Kanban column. Supplying `position` re-orders the board; the last default column cannot be unset and the last done column cannot be cleared.',
+  },
+  del: {
+    schema: z.object({ id: z.string().uuid() }),
+    responseSchema: defaultOkResponseSchema,
+    description:
+      'Soft-deletes a Kanban column. Refused with 409 when it is the project\'s last column or still holds tasks.',
+  },
+})