@routebot/constants 0.3.73 → 0.3.74

package/constants/access-control.constants.js

@@ -1,5 +1,6 @@
 const { PERMISSION_TYPES } = require("./permission.constants");
 const { COMPANY_FEATURES } = require("./company.constants");
+const { CLIENT_ROLES } = require("./constants");
 
 const FEATURE_PERMISSION_DEPENDENCIES = {
   [PERMISSION_TYPES.ACCESS_TO_ACCOUNTING]: [COMPANY_FEATURES.ACCOUNTING],
@@ -11,8 +12,28 @@ const FEATURE_PERMISSION_DEPENDENCIES = {
   [PERMISSION_TYPES.ACCESS_TO_TRANSFERS]: [COMPANY_FEATURES.TRANSFERS],
   [PERMISSION_TYPES.ACCESS_TO_SHIFTS]: [COMPANY_FEATURES.SHIFT_MANAGEMENT],
   [PERMISSION_TYPES.ACCESS_TO_BILLING]: [COMPANY_FEATURES.BILLING],
+  [PERMISSION_TYPES.ACCESS_TO_CUSTOMER_PORTAL]: [COMPANY_FEATURES.CUSTOMER_PORTAL],
 };
 
+// List endpoints (`addAccessFilter`): these roles only see documents in `client.schools`.
+// Unknown roles fall through to company-wide — always add new school-bounded roles here.
+const SCHOOL_SCOPED_CLIENT_ROLES = [
+  CLIENT_ROLES.EDITOR,
+  CLIENT_ROLES.VIEWER,
+  CLIENT_ROLES.DEMO,
+  CLIENT_ROLES.CUSTOMER_CONTACT,
+];
+
+// Owner/admin ignore school assignment on lists. billing_admin currently falls through
+// to company-wide as well (existing behavior; not listed here on purpose).
+const COMPANY_WIDE_CLIENT_ROLES = [CLIENT_ROLES.OWNER, CLIENT_ROLES.ADMIN];
+
+const isSchoolScopedClientRole = (role) => SCHOOL_SCOPED_CLIENT_ROLES.includes(role);
+
+const isCompanyWideClientRole = (role) => COMPANY_WIDE_CLIENT_ROLES.includes(role);
+
+const isCustomerContactRole = (role) => role === CLIENT_ROLES.CUSTOMER_CONTACT;
+
 const isPermissionAvailableForCompanyFeature = (companyFeatures = {}, permissionType) => {
   const featureKeys = FEATURE_PERMISSION_DEPENDENCIES[permissionType];
 
@@ -33,6 +54,11 @@ const isPermissionAvailableForCompany = (company = {}, permissionType) => {
 
 module.exports = {
   FEATURE_PERMISSION_DEPENDENCIES,
+  SCHOOL_SCOPED_CLIENT_ROLES,
+  COMPANY_WIDE_CLIENT_ROLES,
+  isSchoolScopedClientRole,
+  isCompanyWideClientRole,
+  isCustomerContactRole,
   isPermissionAvailableForCompanyFeature,
   isTelemetryEnabledForCompany,
   isPermissionAvailableForCompany,

package/constants/company.constants.js

@@ -20,6 +20,10 @@ const COMPANY_FEATURES = {
   // Opt-in "bundled" student routes (students from multiple schools in one route). Default OFF
   // for every plan; enabled per-company via company.features override. See: bundled-route module.
   BUNDLED_STUDENT_ROUTES: "bundledStudentRoutes",
+  // Opt-in customer-contact portal (school/site officials file change requests; operators
+  // handle them). Default OFF for every plan; enabled per-company via company.features.
+  // See: customer-portal.constants.js (backend module lands after this package is released).
+  CUSTOMER_PORTAL: "customerPortal",
 };
 
 module.exports = {

package/constants/constants.js

@@ -25,6 +25,10 @@ const CLIENT_ROLES = {
   EDITOR: "editor",
   VIEWER: "viewer",
   DEMO: "demo",
+  // School/site official at the *transport company's customer* (a School). Invite-only,
+  // company-feature gated. Files change requests; never writes students/routes/accounting.
+  // NOT a teammate — do not create via invite-teammate. See customer-portal.constants.js.
+  CUSTOMER_CONTACT: "customer_contact",
 };
 
 const CLIENT_STATUSES = {

package/constants/customer-portal.constants.js

@@ -0,0 +1,163 @@
+// Customer portal — shared enums + pure helpers for FE/BE.
+//
+// Product (locked):
+//   The transport company (our Client's Company) no longer wants a clerk sitting at the
+//   school for trickle registrations. A school/site official is INVITED (no self-signup)
+//   as CLIENT_ROLES.CUSTOMER_CONTACT. They file structured change REQUESTS. Operators in
+//   the existing admin panel fulfil them (student/route/accounting writes stay with the
+//   operator). The official does NOT get a student/service directory, does NOT create or
+//   delete students, does NOT touch accounting.
+//
+//   Company-wide opt-in: COMPANY_FEATURES.CUSTOMER_PORTAL (PLAN_FEATURES all false).
+//   Operator queue + inviting contacts: PERMISSION_TYPES.ACCESS_TO_CUSTOMER_PORTAL
+//   (never grant that permission to CUSTOMER_CONTACT — they would see every school).
+//   Owner may operate the queue by role even without the flag (backend decision).
+//
+//   Identity for remove/change requests: typeahead search (narrow DTO), not a list page.
+//   Files: private tenant storage first; do not dump into the existing inventory Drive.
+//
+// Backend module (after this package is released): backend/modules/customer-portal/
+// Frontend (after): frontend/src/features/customer-portal/  + restricted App.js shell
+//   (same pattern as ACCESS_TO_TRACK_VEHICLE_ONLY).
+//
+// This file is the enum/contract source of truth. Behavioral middleware stays in backend.
+
+const { PERMISSION_TYPES } = require("./permission.constants");
+
+const CUSTOMER_PORTAL_API_SEGMENT = "customer-portal";
+
+const CUSTOMER_PORTAL_INVITE_EXPIRATION_DAYS = 7;
+
+const CUSTOMER_PORTAL_STUDENT_SEARCH_MIN_LENGTH = 2;
+
+const CUSTOMER_REQUEST_TYPES = {
+  STUDENT_ADD: "student_add",
+  STUDENT_ADD_BULK: "student_add_bulk",
+  STUDENT_REMOVE: "student_remove",
+  STUDENT_CHANGE: "student_change",
+  DOCUMENT: "document",
+  OTHER: "other",
+};
+
+const CUSTOMER_REQUEST_CHANGE_KINDS = {
+  ADDRESS: "address",
+  SERVICE: "service",
+  GRADE: "grade",
+  PARENT: "parent",
+  OTHER: "other",
+};
+
+const CUSTOMER_REQUEST_STATUSES = {
+  OPEN: "open",
+  IN_PROGRESS: "in_progress",
+  WAITING_CUSTOMER: "waiting_customer",
+  RESOLVED: "resolved",
+  CANCELLED: "cancelled",
+};
+
+// Statuses that still need operator attention (nav badge).
+const CUSTOMER_REQUEST_OPEN_STATUSES = [
+  CUSTOMER_REQUEST_STATUSES.OPEN,
+  CUSTOMER_REQUEST_STATUSES.IN_PROGRESS,
+  CUSTOMER_REQUEST_STATUSES.WAITING_CUSTOMER,
+];
+
+// Allowed next statuses. Who may fire a transition is enforced in backend (operator vs contact).
+const CUSTOMER_REQUEST_STATUS_TRANSITIONS = {
+  [CUSTOMER_REQUEST_STATUSES.OPEN]: [
+    CUSTOMER_REQUEST_STATUSES.IN_PROGRESS,
+    CUSTOMER_REQUEST_STATUSES.CANCELLED,
+    CUSTOMER_REQUEST_STATUSES.RESOLVED,
+  ],
+  [CUSTOMER_REQUEST_STATUSES.IN_PROGRESS]: [
+    CUSTOMER_REQUEST_STATUSES.WAITING_CUSTOMER,
+    CUSTOMER_REQUEST_STATUSES.RESOLVED,
+    CUSTOMER_REQUEST_STATUSES.CANCELLED,
+    CUSTOMER_REQUEST_STATUSES.OPEN,
+  ],
+  [CUSTOMER_REQUEST_STATUSES.WAITING_CUSTOMER]: [
+    CUSTOMER_REQUEST_STATUSES.IN_PROGRESS,
+    CUSTOMER_REQUEST_STATUSES.RESOLVED,
+    CUSTOMER_REQUEST_STATUSES.CANCELLED,
+  ],
+  [CUSTOMER_REQUEST_STATUSES.RESOLVED]: [CUSTOMER_REQUEST_STATUSES.OPEN],
+  [CUSTOMER_REQUEST_STATUSES.CANCELLED]: [CUSTOMER_REQUEST_STATUSES.OPEN],
+};
+
+const CUSTOMER_REQUEST_COMMENT_VISIBILITY = {
+  CUSTOMER: "customer",
+  INTERNAL: "internal",
+};
+
+const CUSTOMER_PORTAL_UPLOAD = {
+  MAX_FILE_BYTES: 10 * 1024 * 1024,
+  MAX_FILES_PER_REQUEST: 10,
+  ALLOWED_MIME_TYPES: {
+    "application/pdf": ["pdf"],
+    "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet": ["xlsx"],
+    "application/vnd.ms-excel": ["xls"],
+    "text/csv": ["csv"],
+    "application/vnd.openxmlformats-officedocument.wordprocessingml.document": ["docx"],
+    "application/msword": ["doc"],
+    "image/jpeg": ["jpg", "jpeg"],
+    "image/png": ["png"],
+  },
+};
+
+const getCustomerPortalAllowedExtensions = () => {
+  const seen = new Set();
+  const extensions = [];
+  Object.values(CUSTOMER_PORTAL_UPLOAD.ALLOWED_MIME_TYPES).forEach((list) => {
+    list.forEach((ext) => {
+      if (!seen.has(ext)) {
+        seen.add(ext);
+        extensions.push(ext);
+      }
+    });
+  });
+  return extensions;
+};
+
+const isAllowedCustomerPortalUpload = ({ mimeType, fileName } = {}) => {
+  const allowed = CUSTOMER_PORTAL_UPLOAD.ALLOWED_MIME_TYPES;
+  if (mimeType && Object.prototype.hasOwnProperty.call(allowed, mimeType)) {
+    return true;
+  }
+  if (typeof fileName !== "string" || !fileName.includes(".")) {
+    return false;
+  }
+  const ext = fileName.split(".").pop().toLowerCase();
+  return getCustomerPortalAllowedExtensions().includes(ext);
+};
+
+const isCustomerRequestStatusTransitionAllowed = (fromStatus, toStatus) => {
+  const next = CUSTOMER_REQUEST_STATUS_TRANSITIONS[fromStatus] || [];
+  return next.includes(toStatus);
+};
+
+// Invite payload: every permission flag false. CUSTOMER_CONTACT is authorized by role,
+// not by ACCESS_TO_STUDENTS / ACCESS_TO_CUSTOMER_PORTAL.
+const getCustomerContactPermissions = () => {
+  const permissions = {};
+  Object.values(PERMISSION_TYPES).forEach((key) => {
+    permissions[key] = false;
+  });
+  return permissions;
+};
+
+module.exports = {
+  CUSTOMER_PORTAL_API_SEGMENT,
+  CUSTOMER_PORTAL_INVITE_EXPIRATION_DAYS,
+  CUSTOMER_PORTAL_STUDENT_SEARCH_MIN_LENGTH,
+  CUSTOMER_REQUEST_TYPES,
+  CUSTOMER_REQUEST_CHANGE_KINDS,
+  CUSTOMER_REQUEST_STATUSES,
+  CUSTOMER_REQUEST_OPEN_STATUSES,
+  CUSTOMER_REQUEST_STATUS_TRANSITIONS,
+  CUSTOMER_REQUEST_COMMENT_VISIBILITY,
+  CUSTOMER_PORTAL_UPLOAD,
+  getCustomerPortalAllowedExtensions,
+  isAllowedCustomerPortalUpload,
+  isCustomerRequestStatusTransitionAllowed,
+  getCustomerContactPermissions,
+};

package/constants/permission.constants.js

@@ -14,6 +14,7 @@ const PERMISSION_TYPES = {
   ACCESS_TO_SERVISTESIN: "accessToServistesin", // feature based
   ACCESS_TO_TRACK_VEHICLE_ONLY: "accessToTrackVehicleOnly", // manual integration
   ACCESS_TO_TELEMETRY: "accessToTelemetry", // feature based - Arvento integration. See backend/docs/arvento-telemetry.md
+  ACCESS_TO_CUSTOMER_PORTAL: "accessToCustomerPortal", // feature based - operator queue + invite school contacts. NEVER grant to CUSTOMER_CONTACT.
   ACCESS_TO_SCHOOLS: "accessToSchools", // Navigation level - always true for now
   ACCESS_TO_USERS: "accessToUsers", // Navigation level - always true for now
   ACCESS_TO_STOPS: "accessToStops", // should be always false for now

package/constants/plan.constants.js

@@ -167,6 +167,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
 
   [PLANS.FREE]: {
@@ -181,6 +182,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
   [PLANS.STARTER]: {
     [COMPANY_FEATURES.ACCOUNTING]: false,
@@ -194,6 +196,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
   [PLANS.PRO]: {
     [COMPANY_FEATURES.ACCOUNTING]: false,
@@ -207,6 +210,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
   [PLANS.BUSINESS]: {
     [COMPANY_FEATURES.ACCOUNTING]: false,
@@ -220,6 +224,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
   [PLANS.ENTERPRISE]: {
     [COMPANY_FEATURES.ACCOUNTING]: false,
@@ -233,6 +238,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
   [PLANS.UNLIMITED]: {
     [COMPANY_FEATURES.ACCOUNTING]: false,
@@ -246,6 +252,7 @@ const PLAN_FEATURES = {
     [COMPANY_FEATURES.BILLING]: false,
     [COMPANY_FEATURES.UETDS]: false,
     [COMPANY_FEATURES.BUNDLED_STUDENT_ROUTES]: false,
+    [COMPANY_FEATURES.CUSTOMER_PORTAL]: false,
   },
 };
 

package/index.js

@@ -15,4 +15,5 @@ module.exports = {
   ...require("./constants/plan.constants.js"),
   ...require("./constants/telemetry.constants.js"),
   ...require("./constants/login-code.constants.js"),
+  ...require("./constants/customer-portal.constants.js"),
 };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@routebot/constants",
-  "version": "0.3.73",
+  "version": "0.3.74",
   "description": "Shared constants for RouteBot FE/BE",
   "main": "index.js",
   "files": [
@@ -21,6 +21,6 @@
     "release:minor": "npm version minor -m \"chore(release): %s\" && npm publish --access public && git push && git push --tags",
     "release:major": "npm version major -m \"chore(release): %s\" && npm publish --access public && git push && git push --tags",
     "prepublishOnly": "npm test",
-    "test": "node -e \"require('./index.js'); console.log('ok')\""
+    "test": "node ./scripts/check-exports.js"
   }
 }