@open-mercato/core 0.9.1-develop.7473.1.de5b22888f → 0.9.1-develop.7475.1.28ca93ed97

package/src/modules/customer_groups/services/customerGroupsService.ts

@@ -62,6 +62,7 @@ const MAX_ANCESTOR_DEPTH = CUSTOMER_GROUP_MAX_ANCESTOR_DEPTH
 // tenant/organization scoping").
 export type ResolveGroupsInput = {
   customerId: string | null
+  customerIds?: string[]
   tenantId: string
   at?: Date
 }
@@ -73,6 +74,7 @@ export type ResolveGroupsInput = {
 // since `resolveGroups` never returns those.
 export type ResolveTermsInput = {
   customerId: string | null
+  customerIds?: string[]
   tenantId: string
   at?: Date
   groupIds?: string[]
@@ -100,14 +102,22 @@ export interface CustomerGroupsService {
   resolveAssortmentScope(input: ResolveAssortmentScopeInput): Promise<ResolvedAssortmentScope>
 }
 
-// Phase 1's `CustomerGroup` entity has no `assortment_scope`-shaped column yet — the spec's
-// full field list places it on `CustomerGroupTerms`, but that was deliberately withheld from
-// this PR's Step 2.1 entity (Phase 5 scope, spec §14 non-goals). Every matching group
-// therefore contributes an unrestricted (`null`) own-scope for now. Once a real column
-// exists, replace this stub's body with a read of it — `resolveAssortmentScope`'s
-// `unionScopes` composition below needs no changes to start returning real restrictions.
-function groupOwnAssortmentScope(_groupId: string): AssortmentScope | null {
-  return null
+const AUTHORED_ASSORTMENT_SCOPE_KEYS = [
+  'categoryIds',
+  'tagIds',
+  'excludeProductIds',
+  'excludeCategoryIds',
+  'excludeTagIds',
+] as const
+
+export function normalizeAuthoredAssortmentScope(scope: AssortmentScope | null | undefined): AssortmentScope | null {
+  if (!scope) return null
+  const normalized: AssortmentScope = {}
+  for (const key of AUTHORED_ASSORTMENT_SCOPE_KEYS) {
+    const ids = scope[key]
+    if (Array.isArray(ids) && ids.length > 0) normalized[key] = ids
+  }
+  return Object.keys(normalized).length > 0 ? normalized : null
 }
 
 async function loadGroupCached(
@@ -149,6 +159,26 @@ export async function loadCustomerGroupAncestorChain(
   return chain
 }
 
+export function resolveEffectiveCustomerIds(input: Pick<ResolveGroupsInput, 'customerId' | 'customerIds'>): string[] {
+  const distinctIds: string[] = []
+  for (const customerId of input.customerIds ?? []) {
+    if (typeof customerId !== 'string' || !customerId.length) continue
+    if (!distinctIds.includes(customerId)) distinctIds.push(customerId)
+  }
+  if (distinctIds.length) return distinctIds
+  return input.customerId == null ? [] : [input.customerId]
+}
+
+type RankedMembership = {
+  membership: CustomerGroupMembership
+  customerIndex: number
+}
+
+function compareRankedMemberships(left: RankedMembership, right: RankedMembership): number {
+  if (left.customerIndex !== right.customerIndex) return left.customerIndex - right.customerIndex
+  return right.membership.createdAt.getTime() - left.membership.createdAt.getTime()
+}
+
 function toGroupSummary(group: CustomerGroup): GroupResolution['groups'][number] {
   return { id: group.id, code: group.code, name: group.name, kind: group.kind, priority: group.priority }
 }
@@ -236,30 +266,36 @@ export class DefaultCustomerGroupsService implements CustomerGroupsService {
 
   async resolveGroups(input: ResolveGroupsInput): Promise<GroupResolution> {
     const at = input.at ?? new Date()
+    const customerIds = resolveEffectiveCustomerIds(input)
 
-    if (input.customerId == null) return this.resolveDefaultGroup(input.tenantId)
+    if (!customerIds.length) return this.resolveDefaultGroup(input.tenantId)
 
     const memberships = await this.em.find(CustomerGroupMembership, {
       tenantId: input.tenantId,
-      customerId: input.customerId,
+      customerId: customerIds.length === 1 ? customerIds[0] : { $in: customerIds },
       deletedAt: null,
     })
 
     const validMemberships = memberships.filter((membership) => isMembershipValidAt(membership, at))
     if (!validMemberships.length) return this.resolveDefaultGroup(input.tenantId)
 
-    // Precedence rule: when a customer has more than one membership row for the
-    // same group (e.g. re-added after a prior removal), the most recently created
-    // one is the one whose validity/attribution counts.
-    const latestMembershipByGroupId = new Map<string, CustomerGroupMembership>()
+    // Precedence rule (spec §6.0): one membership represents each group — the one of
+    // the earliest buyer identity (person before company), then the most recently
+    // created one (e.g. re-added after a prior removal).
+    const bestMembershipByGroupId = new Map<string, RankedMembership>()
     for (const membership of validMemberships) {
-      const existing = latestMembershipByGroupId.get(membership.groupId)
-      if (!existing || membership.createdAt.getTime() > existing.createdAt.getTime()) {
-        latestMembershipByGroupId.set(membership.groupId, membership)
+      const customerIndex = customerIds.indexOf(membership.customerId)
+      const candidate: RankedMembership = {
+        membership,
+        customerIndex: customerIndex === -1 ? customerIds.length : customerIndex,
+      }
+      const existing = bestMembershipByGroupId.get(membership.groupId)
+      if (!existing || compareRankedMemberships(candidate, existing) < 0) {
+        bestMembershipByGroupId.set(membership.groupId, candidate)
       }
     }
 
-    const groupIds = Array.from(latestMembershipByGroupId.keys())
+    const groupIds = Array.from(bestMembershipByGroupId.keys())
     const groups = await this.em.find(CustomerGroup, {
       id: { $in: groupIds },
       tenantId: input.tenantId,
@@ -269,9 +305,7 @@ export class DefaultCustomerGroupsService implements CustomerGroupsService {
 
     const sortedGroups = groups.slice().sort((a, b) => {
       if (b.priority !== a.priority) return b.priority - a.priority
-      const membershipA = latestMembershipByGroupId.get(a.id)!
-      const membershipB = latestMembershipByGroupId.get(b.id)!
-      return membershipB.createdAt.getTime() - membershipA.createdAt.getTime()
+      return compareRankedMemberships(bestMembershipByGroupId.get(a.id)!, bestMembershipByGroupId.get(b.id)!)
     })
 
     if (!sortedGroups.length) return this.resolveDefaultGroup(input.tenantId)
@@ -296,7 +330,12 @@ export class DefaultCustomerGroupsService implements CustomerGroupsService {
   async resolveTerms(input: ResolveTermsInput): Promise<ResolvedTerms> {
     const groupIds = input.groupIds
       ?? (
-        await this.resolveGroups({ customerId: input.customerId, tenantId: input.tenantId, at: input.at })
+        await this.resolveGroups({
+          customerId: input.customerId,
+          customerIds: input.customerIds,
+          tenantId: input.tenantId,
+          at: input.at,
+        })
       ).groupIds
 
     if (!groupIds.length) return tenantDefaultTerms()
@@ -337,7 +376,19 @@ export class DefaultCustomerGroupsService implements CustomerGroupsService {
 
   async resolveAssortmentScope(input: ResolveAssortmentScopeInput): Promise<ResolvedAssortmentScope> {
     const { groupIds } = await this.resolveGroups(input)
-    const scope = unionScopes(groupIds.map((groupId) => groupOwnAssortmentScope(groupId)))
+    const termsRows = groupIds.length
+      ? await this.em.find(CustomerGroupTerms, {
+          groupId: { $in: groupIds },
+          tenantId: input.tenantId,
+          deletedAt: null,
+        })
+      : []
+    const ownScopeByGroupId = new Map<string, AssortmentScope | null>()
+    for (const terms of termsRows) {
+      ownScopeByGroupId.set(terms.groupId, normalizeAuthoredAssortmentScope(terms.assortmentScope))
+    }
+    const groupOwnScopes = groupIds.map((groupId) => ownScopeByGroupId.get(groupId) ?? null)
+    const scope = unionScopes(groupOwnScopes)
     return { scope, sourceGroupIds: groupIds, sourceCustomerOverrideId: null }
   }
 

package/src/modules/ecommerce/acl.ts

@@ -0,0 +1,9 @@
+export const features = [
+  { id: 'ecommerce.stores.view', title: 'View stores', module: 'ecommerce' },
+  { id: 'ecommerce.stores.manage', title: 'Manage stores', module: 'ecommerce', dependsOn: ['ecommerce.stores.view'] },
+  { id: 'ecommerce.branding.manage', title: 'Manage store branding', module: 'ecommerce', dependsOn: ['ecommerce.stores.view'] },
+  { id: 'ecommerce.domains.manage', title: 'Manage store domain bindings', module: 'ecommerce', dependsOn: ['ecommerce.stores.view'] },
+  { id: 'ecommerce.channels.manage', title: 'Manage store channel bindings', module: 'ecommerce', dependsOn: ['ecommerce.stores.view'] },
+]
+
+export default features

package/src/modules/ecommerce/api/domain-mappings/route.ts

@@ -0,0 +1,76 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { loadOrganizationDomainMappings } from '../../lib/domainMappingSummaries'
+import { resolveBrandingRouteContext } from '../../lib/storeBrandingRoute'
+import { ecommerceInternalErrorBody, translateEcommerceError } from '../../lib/crudSupport'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['ecommerce.stores.view'] },
+}
+
+const logger = createLogger('ecommerce').child({ component: 'domain-mappings-route' })
+
+export async function GET(req: Request) {
+  try {
+    const context = await resolveBrandingRouteContext(req)
+    const mappings = await loadOrganizationDomainMappings(context.container, {
+      organizationId: context.organizationId,
+      tenantId: context.tenantId,
+    })
+    if (!mappings) {
+      const error = await translateEcommerceError(
+        'ecommerce.errors.domainMappingsUnavailable',
+        'Domains are unavailable right now. Try again later.',
+      )
+      return NextResponse.json({ error }, { status: 503 })
+    }
+    const items = [...mappings].sort((left, right) => left.hostname.localeCompare(right.hostname))
+    return NextResponse.json({ items, total: items.length }, { headers: { 'Cache-Control': 'no-store' } })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('ecommerce.domain-mappings.GET failed', { err })
+    return NextResponse.json(await ecommerceInternalErrorBody(), { status: 500 })
+  }
+}
+
+const domainMappingItemSchema = z.object({
+  id: z.string().uuid(),
+  hostname: z.string(),
+  status: z
+    .string()
+    .describe('customer_accounts domain status: pending, verified, active, dns_failed or tls_failed. Only active serves.'),
+  lastDnsCheckAt: z.string().nullable(),
+  dnsFailureReason: z.string().nullable(),
+  tlsFailureReason: z.string().nullable(),
+})
+
+const errorSchema = z.object({ error: z.string() }).passthrough()
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Ecommerce',
+  summary: 'Domain mappings available to store bindings',
+  methods: {
+    GET: {
+      summary: 'List the domain mappings of the selected organization',
+      description:
+        'Read-only list of the customer_accounts domain mappings (any status) of the selected organization, read through domainMappingService. Backs the domain picker of the store Domains tab, so that managing store bindings does not require the customer_accounts domain permission. Requires ecommerce.stores.view.',
+      tags: ['Ecommerce'],
+      responses: [
+        {
+          status: 200,
+          description: 'Domain mappings of the selected organization',
+          schema: z.object({ items: z.array(domainMappingItemSchema), total: z.number().int() }),
+        },
+      ],
+      errors: [
+        { status: 400, description: 'No organization is selected', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Missing ecommerce.stores.view', schema: errorSchema },
+        { status: 503, description: 'The domain mapping service is not available', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/ecommerce/api/openapi.ts

@@ -0,0 +1,28 @@
+import { type ZodTypeAny } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import {
+  createCrudOpenApiFactory,
+  createPagedListResponseSchema as createSharedPagedListResponseSchema,
+  defaultCreateResponseSchema as sharedDefaultCreateResponseSchema,
+  defaultOkResponseSchema as sharedDefaultOkResponseSchema,
+  type CrudOpenApiOptions,
+} from '@open-mercato/shared/lib/openapi/crud'
+
+export const defaultCreateResponseSchema = sharedDefaultCreateResponseSchema
+export const defaultOkResponseSchema = sharedDefaultOkResponseSchema
+
+export function createPagedListResponseSchema(itemSchema: ZodTypeAny) {
+  return createSharedPagedListResponseSchema(itemSchema, { paginationMetaOptional: true })
+}
+
+const buildEcommerceCrudOpenApi = createCrudOpenApiFactory({
+  defaultTag: 'Ecommerce',
+  defaultCreateResponseSchema,
+  defaultOkResponseSchema,
+  makeListDescription: ({ pluralLower }) =>
+    `Returns a paginated collection of ${pluralLower} scoped to the authenticated tenant and organization.`,
+})
+
+export function createEcommerceCrudOpenApi(options: CrudOpenApiOptions): OpenApiRouteDoc {
+  return buildEcommerceCrudOpenApi(options)
+}

package/src/modules/ecommerce/api/store-channel-bindings/[id]/assortment-count/route.ts

@@ -0,0 +1,141 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { EcommerceStoreChannelBinding } from '../../../../data/entities'
+import {
+  countChannelAssortment,
+  DRAFT_REQUIRE_AUTHENTICATION_PARAM,
+  DRAFT_SCOPE_PARAM,
+  parseAssortmentCountDraft,
+} from '../../../../lib/assortmentCount'
+import { resolveBrandingRouteContext, storeIdParamSchema } from '../../../../lib/storeBrandingRoute'
+import { ecommerceInternalErrorBody } from '../../../../lib/crudSupport'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['ecommerce.stores.view'] },
+}
+
+const logger = createLogger('ecommerce').child({ component: 'assortment-count-route' })
+
+type RouteParams = { params?: { id?: string } | Promise<{ id?: string }> }
+
+export async function GET(req: Request, ctx: RouteParams) {
+  try {
+    const context = await resolveBrandingRouteContext(req)
+    const { translate } = await resolveTranslations()
+    const notFound = () =>
+      NextResponse.json(
+        {
+          error: translate(
+            'ecommerce.errors.channelBindingNotFound',
+            'The selected channel binding does not exist in this organization.',
+          ),
+        },
+        { status: 404 },
+      )
+    const params = await ctx.params
+    const bindingId = storeIdParamSchema.safeParse(params?.id)
+    if (!bindingId.success) return notFound()
+
+    const em = (context.container.resolve('em') as EntityManager).fork()
+    const binding = await findOneWithDecryption(
+      em,
+      EcommerceStoreChannelBinding,
+      { id: bindingId.data, tenantId: context.tenantId, organizationId: context.organizationId, deletedAt: null },
+      undefined,
+      { tenantId: context.tenantId, organizationId: context.organizationId },
+    )
+    if (!binding) return notFound()
+
+    const parsed = parseAssortmentCountDraft(new URL(req.url).searchParams, translate)
+    if (!parsed.ok) {
+      const [message] = Object.values(parsed.fieldErrors)
+      return NextResponse.json({ error: message, fieldErrors: parsed.fieldErrors }, { status: 400 })
+    }
+    const { draft } = parsed
+
+    const response = await countChannelAssortment(context.container, {
+      tenantId: binding.tenantId,
+      organizationId: binding.organizationId,
+      channelAssortmentScope: draft.scope !== undefined ? draft.scope : (binding.assortmentScope ?? null),
+      requireAuthentication: draft.requireAuthentication ?? binding.requireAuthentication,
+      scopeSource: draft.scope !== undefined ? 'draft' : 'saved',
+    })
+    return NextResponse.json(response, { headers: { 'Cache-Control': 'no-store' } })
+  } catch (err) {
+    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    logger.error('ecommerce.store-channel-bindings.assortment-count.GET failed', { err })
+    return NextResponse.json(await ecommerceInternalErrorBody(), { status: 500 })
+  }
+}
+
+const countResponseSchema = z.object({
+  count: z
+    .number()
+    .int()
+    .describe('Products an anonymous buyer sees on this channel. 0 while require_authentication is on.'),
+  scopeSource: z
+    .enum(['saved', 'draft'])
+    .describe('draft when the count used the draftScope query parameter, saved when it used the stored assortment_scope.'),
+  requireAuthentication: z
+    .boolean()
+    .describe('The require_authentication value the count used: draftRequireAuthentication when sent, otherwise the stored value.'),
+  reducedByAuthentication: z
+    .boolean()
+    .describe('True when require_authentication brings the count to 0 although the scope matches products for a signed-in buyer.'),
+  countWithoutAuthentication: z
+    .number()
+    .int()
+    .describe('The count the same scope would give an anonymous buyer with require_authentication off.'),
+  unindexedCount: z
+    .number()
+    .int()
+    .describe('Active products with no scope index yet. They fail closed under a restricted scope, so they are excluded from count.'),
+})
+
+const errorSchema = z.object({ error: z.string() }).passthrough()
+
+const fieldErrorsSchema = z.object({
+  error: z.string(),
+  fieldErrors: z.record(z.string(), z.string()),
+})
+
+const countQuerySchema = z.object({
+  [DRAFT_SCOPE_PARAM]: z
+    .string()
+    .optional()
+    .describe(
+      'JSON-encoded assortment_scope for unsaved form state, validated like the channel binding write (allOf is rejected); null means unrestricted.',
+    ),
+  [DRAFT_REQUIRE_AUTHENTICATION_PARAM]: z
+    .string()
+    .optional()
+    .describe('true or false: the unsaved require_authentication switch. Defaults to the stored value.'),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Ecommerce',
+  summary: 'Channel binding assortment count',
+  pathParams: z.object({ id: z.string().uuid() }),
+  methods: {
+    GET: {
+      summary: 'Count the products a channel binding shows an anonymous buyer',
+      description:
+        'Backs the live product count of the Channels tab. Counts the products the storefront would list for an anonymous buyer on this channel binding, using the stored assortment_scope or, when draftScope is given, the unsaved one. The effective assortment is the channel scope intersected with the default customer group scope and counted through the same scope query as the storefront listing. A binding that requires authentication counts 0 and reports reducedByAuthentication. Requires ecommerce.stores.view.',
+      tags: ['Ecommerce'],
+      query: countQuerySchema,
+      responses: [{ status: 200, description: 'Product count', schema: countResponseSchema }],
+      errors: [
+        { status: 400, description: 'draftScope is not valid JSON or not a valid assortment scope, or draftRequireAuthentication is not a boolean', schema: fieldErrorsSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Missing ecommerce.stores.view', schema: errorSchema },
+        { status: 404, description: 'The channel binding does not exist in the selected organization', schema: errorSchema },
+      ],
+    },
+  },
+}