@open-mercato/core 0.8.1-develop.7296.1.2111d779db → 0.9.0

package/src/modules/catalog/workers/catalog-category-bulk-create.ts

@@ -0,0 +1,48 @@
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { ProgressService } from '../../progress/lib/progressService'
+import {
+  CATALOG_CATEGORY_BULK_CREATE_QUEUE,
+  createCatalogCategoriesWithProgress,
+  type CatalogCategoryBulkCreateJobPayload,
+} from '../lib/bulkCreateCategories'
+
+type HandlerContext = JobContext & {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export const metadata: WorkerMeta = {
+  queue: CATALOG_CATEGORY_BULK_CREATE_QUEUE,
+  id: 'catalog:category-bulk-create',
+  concurrency: 1,
+}
+
+export default async function handle(
+  job: QueuedJob<CatalogCategoryBulkCreateJobPayload>,
+  _ctx: HandlerContext,
+): Promise<void> {
+  const container = await createRequestContainer()
+
+  try {
+    await createCatalogCategoriesWithProgress({
+      container,
+      progressJobId: job.payload.progressJobId,
+      items: job.payload.items,
+      scope: job.payload.scope,
+    })
+  } catch (error) {
+    const progressService = container.resolve('progressService') as ProgressService
+    await progressService.failJob(
+      job.payload.progressJobId,
+      {
+        errorMessage: error instanceof Error ? error.message : 'Bulk category creation failed',
+      },
+      {
+        tenantId: job.payload.scope.tenantId,
+        organizationId: job.payload.scope.organizationId,
+        userId: job.payload.scope.userId,
+      },
+    )
+    throw error
+  }
+}

package/src/modules/catalog/workers/catalog-product-bulk-create.ts

@@ -0,0 +1,48 @@
+import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import type { ProgressService } from '../../progress/lib/progressService'
+import {
+  CATALOG_PRODUCT_BULK_CREATE_QUEUE,
+  createCatalogProductsWithProgress,
+  type CatalogProductBulkCreateJobPayload,
+} from '../lib/bulkCreateProducts'
+
+type HandlerContext = JobContext & {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export const metadata: WorkerMeta = {
+  queue: CATALOG_PRODUCT_BULK_CREATE_QUEUE,
+  id: 'catalog:product-bulk-create',
+  concurrency: 1,
+}
+
+export default async function handle(
+  job: QueuedJob<CatalogProductBulkCreateJobPayload>,
+  _ctx: HandlerContext,
+): Promise<void> {
+  const container = await createRequestContainer()
+
+  try {
+    await createCatalogProductsWithProgress({
+      container,
+      progressJobId: job.payload.progressJobId,
+      items: job.payload.items,
+      scope: job.payload.scope,
+    })
+  } catch (error) {
+    const progressService = container.resolve('progressService') as ProgressService
+    await progressService.failJob(
+      job.payload.progressJobId,
+      {
+        errorMessage: error instanceof Error ? error.message : 'Bulk product creation failed',
+      },
+      {
+        tenantId: job.payload.scope.tenantId,
+        organizationId: job.payload.scope.organizationId,
+        userId: job.payload.scope.userId,
+      },
+    )
+    throw error
+  }
+}

package/src/modules/communication_channels/acl.ts

@@ -12,6 +12,14 @@ export const features = [
    * Default-granted to all roles in `setup.ts`.
    */
   { id: 'communication_channels.connect_user_channel', title: 'Connect own communication channel', module: 'communication_channels' },
+  /**
+   * Mark YOUR OWN personal channel as a shared team mailbox, so the CRM email it
+   * ingests becomes readable by teammates. Owner-only by construction: the route
+   * loads the channel by `userId = caller` and accepts no owner field, so holding
+   * this feature grants no access to anyone else's mailbox. Deliberately does NOT
+   * depend on `communication_channels.admin`, which stays inert.
+   */
+  { id: 'communication_channels.share_own_channel', title: 'Share own channel with the team', module: 'communication_channels' },
   /**
    * Connect a tenant-wide channel (`CommunicationChannel.user_id IS NULL`) that
    * serves every user in the tenant — used for push providers (FCM/APNs/Expo)

package/src/modules/communication_channels/api/get/me/channels/route.ts

@@ -93,6 +93,10 @@ function serialize(channel: CommunicationChannel, adapterRegistry: ChannelAdapte
     displayName: channel.displayName,
     externalIdentifier: channel.externalIdentifier ?? null,
     isPrimary: channel.isPrimary,
+    /** Shared team mailbox flag; drives the profile-page share toggle. */
+    visibility: channel.visibility === 'shared' ? 'shared' : 'private',
+    /** Required so the share toggle can send the optimistic-lock header. */
+    updatedAt: channel.updatedAt?.toISOString?.() ?? null,
     isActive: channel.isActive,
     status: channel.status,
     lastError: channel.lastError ?? null,

package/src/modules/communication_channels/api/get/oauth/[provider]/callback/route.ts

@@ -8,10 +8,12 @@ import { getChannelAdapter } from '../../../../../lib/adapter-registry-singleton
 import { resolveOAuthClientCredentials } from '../../../../../lib/oauth-client-config'
 import {
   COMMUNICATION_CHANNELS_OAUTH_STATE_COOKIE_NAME,
+  consumeOAuthStateOnce,
   DEFAULT_OAUTH_RETURN_URL,
   normalizeOAuthReturnUrl,
   OAuthStateError,
   verifyOAuthState,
+  type OAuthStateConsumeStore,
 } from '../../../../../lib/oauth-state'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -138,6 +140,27 @@ export async function GET(req: Request, context: RouteContext): Promise<Response
 
   // Exchange the code via the adapter.
   const container = await createRequestContainer()
+
+  // Single-use consume: reject a captured valid cookie replayed within the TTL.
+  const resolved = (() => { try { return container.resolve('cache') } catch { return null } })()
+  if (
+    !resolved ||
+    typeof (resolved as OAuthStateConsumeStore).has !== 'function' ||
+    typeof (resolved as OAuthStateConsumeStore).set !== 'function'
+  ) {
+    return redirectWithFlash(req, returnUrl, { type: 'error', code: 'state_store_unavailable', provider })
+  }
+  const oauthStateStore = resolved as OAuthStateConsumeStore
+  try {
+    await consumeOAuthStateOnce(oauthStateStore, statePayload)
+  } catch (err) {
+    const errCode = err instanceof OAuthStateError ? err.code : 'invalid_state'
+    return redirectWithFlash(req, returnUrl, {
+      type: 'error',
+      code: errCode,
+      provider,
+    })
+  }
   const credentialsService = (() => {
     try {
       return container.resolve('integrationCredentialsService') as CredentialsServiceLike

package/src/modules/communication_channels/api/post/channels/[id]/import-history/route.ts

@@ -10,7 +10,6 @@ import { ChannelAccessDeniedError, assertCanManageChannel } from '../../../../..
 import {
   getQueueImportHistorySchema,
   queueImportHistory,
-  queueImportHistorySchema,
 } from '../../../../../commands/queue-import-history'
 import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -49,8 +48,6 @@ type RouteContext = {
   params: Promise<{ id: string }> | { id: string }
 }
 
-const bodySchema = queueImportHistorySchema.omit({ channelId: true })
-
 function buildBodySchema() {
   return getQueueImportHistorySchema().omit({ channelId: true })
 }
@@ -194,7 +191,9 @@ export const openApi = {
       requestBody: {
         required: true,
         contentType: 'application/json',
-        schema: bodySchema,
+        get schema() {
+          return buildBodySchema()
+        },
       },
       responses: [
         { status: 202, description: 'Import job queued; returns { progressJobId }' },

package/src/modules/communication_channels/api/post/channels/[id]/test-send/route.ts

@@ -199,7 +199,15 @@ export async function POST(req: Request, context: RouteContext): Promise<Respons
   } catch {
     credentialsService = null
   }
-  if (channel.credentialsRef && credentialsService) {
+  // A tenant-wide channel keys its credentials by provider at the channel's org,
+  // so it resolves them even without a `credentialsRef`: the system email env
+  // preset (`ensureSystemEmailChannel`) creates the row with none and saves the
+  // credentials separately under `channel_<provider>`, exactly what
+  // `sendSystemEmail` reads. A user-owned channel still needs its ref — the
+  // credentials service falls back from the user's row to the org-wide one, and
+  // a mailbox must never test-send through the shared account.
+  const resolvesCredentials = Boolean(channel.credentialsRef) || !channel.userId
+  if (resolvesCredentials && credentialsService) {
     credentials =
       (await credentialsService
         .resolve(`channel_${channel.providerKey}`, {

package/src/modules/communication_channels/api/post/test-seed/route.ts

@@ -6,6 +6,9 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { CommandBus } from '@open-mercato/shared/lib/commands'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import {
   ChannelThreadMapping,
   CommunicationChannel,
@@ -190,8 +193,21 @@ const emitInboundSchema = z.object({
   createThreadMapping: z.boolean().optional(),
 })
 
+/**
+ * Read-only: report the channel-side rows a platform message carries.
+ *
+ * The threading contract lives in rows no API exposes — an integration test
+ * asserting that a composer send really was routed through the hub can only
+ * observe them here.
+ */
+const inspectMessageLinksSchema = z.object({
+  action: z.literal('inspect-message-links'),
+  messageId: z.string().uuid(),
+})
+
 const bodySchema = z.discriminatedUnion('action', [
   connectChannelSchema,
+  inspectMessageLinksSchema,
   ingestInboundSchema,
   emitInboundSchema,
   seedSystemChannelSchema,
@@ -199,6 +215,22 @@ const bodySchema = z.discriminatedUnion('action', [
   listCaptureSchema,
 ])
 
+const logger = createLogger('communication_channels').child({ component: 'test-seed' })
+
+function ingestFailureResponse(err: unknown): Response {
+  if (err instanceof z.ZodError) {
+    return NextResponse.json({ error: err.message, issues: err.issues }, { status: 422 })
+  }
+  if (isCrudHttpError(err)) {
+    return NextResponse.json(err.body, { status: err.status })
+  }
+  logger.error('ingest-inbound failed', { err })
+  return NextResponse.json(
+    { error: err instanceof Error ? err.message : '[internal] ingest-inbound failed' },
+    { status: 500 },
+  )
+}
+
 export async function POST(req: Request): Promise<Response> {
   // Fail-closed: invisible in production. Mirrors an unknown route (404) rather
   // than 403 so the surface leaks nothing when the flag is off.
@@ -259,6 +291,41 @@ export async function POST(req: Request): Promise<Response> {
   // a worker-only node skipped module di registration.
   ensureTestSeedAdapterRegistered()
 
+  if (body.action === 'inspect-message-links') {
+    const em = (container.resolve('em') as EntityManager).fork()
+    const links = await em.find(MessageChannelLink, {
+      messageId: body.messageId,
+      tenantId,
+      organizationId,
+    })
+    const conversationIds = links
+      .map((link) => link.externalConversationId)
+      .filter((id): id is string => Boolean(id))
+    const mappings = conversationIds.length
+      ? await em.find(ChannelThreadMapping, {
+          externalConversationId: { $in: conversationIds },
+          tenantId,
+          organizationId,
+        })
+      : []
+    return NextResponse.json({
+      links: links.map((link) => ({
+        id: link.id,
+        direction: link.direction,
+        providerKey: link.providerKey,
+        channelType: link.channelType,
+        deliveryStatus: link.deliveryStatus,
+        externalConversationId: link.externalConversationId,
+      })),
+      threadMappings: mappings.map((mapping) => ({
+        id: mapping.id,
+        messageThreadId: mapping.messageThreadId,
+        channelId: mapping.channelId,
+        externalConversationId: mapping.externalConversationId,
+      })),
+    })
+  }
+
   if (body.action === 'seed-system-channel') {
     const em = (container.resolve('em') as EntityManager).fork()
     const credentialsService = container.resolve('integrationCredentialsService') as {
@@ -472,17 +539,25 @@ export async function POST(req: Request): Promise<Response> {
       )
     }
 
-    const normalized = await adapter.normalizeInbound({
-      raw: {
-        externalMessageId: body.externalMessageId,
-        externalConversationId: body.externalConversationId,
-        senderIdentifier: body.senderIdentifier,
-        senderDisplayName: body.senderDisplayName,
-        body: body.body ?? '',
-      },
-      eventType: 'message',
-      metadata: {},
-    })
+    let normalized: unknown
+    try {
+      normalized = await adapter.normalizeInbound({
+        raw: {
+          externalMessageId: body.externalMessageId,
+          externalConversationId: body.externalConversationId,
+          senderIdentifier: body.senderIdentifier,
+          senderDisplayName: body.senderDisplayName,
+          body: body.body ?? '',
+        },
+        eventType: 'message',
+        metadata: {},
+      })
+    } catch (err) {
+      return NextResponse.json(
+        { error: err instanceof Error ? err.message : '[internal] adapter rejected the inbound frame' },
+        { status: 422 },
+      )
+    }
 
     const ingestInput = {
       channelId: body.channelId,
@@ -492,19 +567,29 @@ export async function POST(req: Request): Promise<Response> {
       message: normalized,
     } as IngestInboundMessageInput
 
-    const { result } = await commandBus.execute<
-      IngestInboundMessageInput,
-      IngestInboundMessageResult
-    >(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {
-      input: ingestInput,
-      ctx: {
-        container,
-        auth: auth as never,
-        organizationScope: null,
-        selectedOrganizationId: organizationId,
-        organizationIds: organizationId ? [organizationId] : null,
-      },
-    })
+    let result: IngestInboundMessageResult
+    try {
+      const execution = await commandBus.execute<
+        IngestInboundMessageInput,
+        IngestInboundMessageResult
+      >(COMMUNICATION_CHANNELS_INGEST_INBOUND_COMMAND_ID, {
+        input: ingestInput,
+        ctx: {
+          container,
+          auth: auth as never,
+          organizationScope: null,
+          selectedOrganizationId: organizationId,
+          organizationIds: organizationId ? [organizationId] : null,
+        },
+      })
+      result = execution.result
+    } catch (err) {
+      const interceptorRejection = getCommandInterceptorHttpRejection(err)
+      if (interceptorRejection) {
+        return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+      }
+      return ingestFailureResponse(err)
+    }
 
     return NextResponse.json(
       {

package/src/modules/communication_channels/api/put/channels/[id]/visibility/route.ts

@@ -0,0 +1,165 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { readOptimisticLockExpected } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
+import type { CommandBus } from '@open-mercato/shared/lib/commands'
+import {
+  CHANNEL_VISIBILITY_VALUES,
+  COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID,
+  type SetChannelVisibilityInput,
+  type SetChannelVisibilityResult,
+} from '../../../../../commands/set-channel-visibility'
+import { validateRouteMutationGuard } from '../../../../../lib/route-mutation-guard'
+
+export const metadata = {
+  path: '/communication_channels/channels/[id]/visibility',
+  PUT: {
+    // Owner self-service, exactly like set-primary: the command enforces strict
+    // ownership (`not_owner` → 404), so the dedicated share feature is the right
+    // gate. `communication_channels.admin` stays inert — there is deliberately no
+    // admin path to share someone else's mailbox.
+    requireAuth: true,
+    requireFeatures: ['communication_channels.share_own_channel'],
+  },
+}
+
+const bodySchema = z.object({ visibility: z.enum(CHANNEL_VISIBILITY_VALUES) }).strict()
+
+type RouteContext = {
+  params: Promise<{ id: string }> | { id: string }
+}
+
+export async function PUT(req: Request, context: RouteContext): Promise<Response> {
+  const { id } = await context.params
+  if (!z.string().uuid().safeParse(id).success) {
+    return NextResponse.json({ error: 'Invalid channel id' }, { status: 400 })
+  }
+
+  const auth = await getAuthFromRequest(req)
+  if (!auth?.sub || !auth?.tenantId) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+  // An API-key principal owns no mailbox, so it has nothing to share.
+  if ((auth as { isApiKey?: boolean }).isApiKey) {
+    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })
+  }
+
+  let body: z.infer<typeof bodySchema>
+  try {
+    body = bodySchema.parse(await readJsonSafe(req, null))
+  } catch (err) {
+    return NextResponse.json(
+      { error: err instanceof Error ? err.message : 'Invalid request body' },
+      { status: 422 },
+    )
+  }
+
+  const container = await createRequestContainer()
+  const guard = await validateRouteMutationGuard({
+    container,
+    req,
+    auth,
+    input: {
+      resourceKind: 'communication_channels.channel',
+      resourceId: id,
+      operation: 'update',
+      mutationPayload: { visibility: body.visibility },
+    },
+  })
+  if ('response' in guard) return guard.response
+
+  const organizationId = (auth as { orgId?: string | null }).orgId ?? null
+  const commandBus = container.resolve('commandBus') as CommandBus
+
+  const input: SetChannelVisibilityInput = {
+    channelId: id,
+    userId: auth.sub as string,
+    visibility: body.visibility,
+    // Absent header ⇒ no expectation; the shared assertion helper skips the check
+    // rather than blocking clients that never send it.
+    expectedUpdatedAt: readOptimisticLockExpected(req),
+    scope: { tenantId: auth.tenantId as string, organizationId },
+  }
+
+  let result: SetChannelVisibilityResult
+  try {
+    const executed = await commandBus.execute<
+      SetChannelVisibilityInput,
+      SetChannelVisibilityResult
+    >(COMMUNICATION_CHANNELS_SET_VISIBILITY_COMMAND_ID, {
+      input,
+      ctx: {
+        container,
+        auth: auth as never,
+        organizationScope: null,
+        selectedOrganizationId: organizationId,
+        organizationIds: organizationId ? [organizationId] : null,
+      },
+    })
+    result = executed.result
+  } catch (err) {
+    // Surfaces the 409 optimistic-lock conflict with its intended status rather
+    // than a generic 500.
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
+    throw err
+  }
+
+  // Non-ownership maps to 404 (existence masking), consistent with every other
+  // channel-scoped route.
+  if (result.status === 'not_owner') {
+    return NextResponse.json({ error: 'Channel not found' }, { status: 404 })
+  }
+  if (result.status === 'noop') {
+    return NextResponse.json(
+      { channelId: id, visibility: body.visibility, unchanged: true },
+      { status: 200 },
+    )
+  }
+
+  // A channel flip is a strictly BROADER widening than a per-conversation share —
+  // it exposes a whole mailbox — so the CRM's person-detail cache must drop the
+  // entries whose email rows this just changed. That invalidation belongs to the
+  // customers module and reaches it through the
+  // `communication_channels.channel.visibility_changed` event the command emits
+  // with the tenant/organization scope: this hub must not import customers to do
+  // its own write. See customers/subscribers/channel-visibility-changed.ts.
+  await guard.afterSuccess()
+  return NextResponse.json(
+    {
+      channelId: result.channelId,
+      visibility: body.visibility,
+      previousVisibility: result.previousVisibility,
+    },
+    { status: 200 },
+  )
+}
+
+export const openApi = {
+  tags: ['CommunicationChannels'],
+  methods: {
+    PUT: {
+      summary: 'Mark your own personal channel as a shared team mailbox (or private again)',
+      tags: ['CommunicationChannels'],
+      responses: [
+        { status: 200, description: 'Visibility updated (or already at that value)' },
+        { status: 400, description: 'Invalid channel id' },
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'Channel not found or not owned by current user' },
+        { status: 409, description: 'Optimistic lock conflict' },
+        { status: 422, description: 'Invalid body' },
+      ],
+    },
+  },
+}
+
+export default PUT