@teamscala/service-boot 0.23.284

package/src/fn-routers/persist-chat-messages.test.ts

@@ -0,0 +1,86 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * Locks the shared chat-message write surface used by BOTH the authed and
+ * public session routers: a re-save of the same turn (same SDK ids) upserts in
+ * place instead of inserting duplicate rows (chat-message-ids-server-stable),
+ * and the conversation's last_message_at is bumped once per save.
+ */
+
+import { describe, expect, test } from "bun:test";
+import { persistChatMessages, type ChatMessageInput } from "./persist-chat-messages.ts";
+
+interface Row {
+	id?: string;
+	role: string;
+	content: string;
+	channel_data: Record<string, unknown>;
+}
+
+function makeFakePrisma() {
+	const rows: Row[] = [];
+	let convUpdates = 0;
+	let n = 0;
+	const prisma = {
+		messages: {
+			create: async ({ data }: { data: Row }) => {
+				rows.push({ ...data, id: data.id ?? `m${++n}` });
+			},
+			upsert: async ({
+				where,
+				create,
+				update,
+			}: {
+				where: { id: string };
+				create: Row;
+				update: Partial<Row>;
+			}) => {
+				const existing = rows.find((r) => r.id === where.id);
+				if (existing) Object.assign(existing, update);
+				else rows.push({ ...create, id: where.id });
+			},
+		},
+		conversations: {
+			update: async () => {
+				convUpdates++;
+			},
+		},
+	};
+	return { prisma, rows, getConvUpdates: () => convUpdates };
+}
+
+const turn: ChatMessageInput[] = [
+	{ id: "user-1", role: "user", content: "Hi", parts: [{ type: "text", text: "Hi" }] },
+	{ id: "assistant-1", role: "assistant", content: "Hello", parts: [{ type: "text", text: "Hello" }] },
+];
+
+describe("persistChatMessages — shared write surface", () => {
+	test("re-saving the same turn upserts — one row per message, never duplicates", async () => {
+		const { prisma, rows, getConvUpdates } = makeFakePrisma();
+		const run = () =>
+			persistChatMessages(prisma as never, {
+				conversationId: "conv-1",
+				organisationId: "org-1",
+				messages: turn,
+			});
+
+		await run();
+		await run();
+
+		expect(rows.map((r) => r.id).sort()).toEqual(["assistant-1", "user-1"]);
+		expect(getConvUpdates()).toBe(2); // once per save
+	});
+
+	test("id-less messages fall back to insert (legacy)", async () => {
+		const { prisma, rows } = makeFakePrisma();
+		await persistChatMessages(prisma as never, {
+			conversationId: "conv-1",
+			organisationId: null,
+			messages: [{ role: "user", content: "no id" }],
+		});
+		expect(rows).toHaveLength(1);
+		expect(rows[0]?.role).toBe("user");
+	});
+});

package/src/fn-routers/persist-chat-messages.ts

@@ -0,0 +1,96 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The ONE chat-message write surface for the session routers. Both the authed
+ * (chatSession) and public (publicGptSession) saveMessages procedures persist
+ * turns through here — they differ only in IDENTITY/ownership (user_id vs
+ * contact_email, resolved in the router before calling this), never in the
+ * write itself. Keeping the write in two routers was literal duplication
+ * (no-duplicate-canonical-units) and is why the stable-id fix had to be applied
+ * twice.
+ *
+ * Upserts each message on its SDK UIMessage id so a re-save of a turn (a retry,
+ * a reconnect after a network drop, or a stray dual-write) updates the one row
+ * in place instead of inserting a duplicate (chat-message-ids-server-stable);
+ * falls back to create only for legacy id-less callers. occurred_at is stamped
+ * with a 1ms step preserving array order so same-second saves restore in order.
+ */
+
+export interface ChatMessageInput {
+	id?: string;
+	role: string;
+	content: string;
+	parts?: unknown[];
+	/** The SDK UIMessage `metadata` — carries per-message token usage
+	 * (`inputTokens`/`outputTokens`/`contextWindow`/`model`) the stream attaches
+	 * via `messageMetadata`. Persisted so the context-usage gauge can rehydrate
+	 * on reload and budget-enforcement can read per-message token counts; without
+	 * it the save dropped the usage and the gauge came back blank on refresh. */
+	metadata?: Record<string, unknown> | null;
+}
+
+export async function persistChatMessages(
+	prisma: any,
+	opts: {
+		conversationId: string;
+		organisationId: string | null;
+		messages: ChatMessageInput[];
+	},
+): Promise<void> {
+	const { conversationId, organisationId, messages } = opts;
+	const base = Date.now();
+	for (const [i, msg] of messages.entries()) {
+		const channelData: Record<string, unknown> = msg.parts ? { parts: msg.parts } : {};
+		// Persist the UIMessage metadata (token usage) so it survives reload — the
+		// stream attaches {inputTokens, outputTokens, contextWindow, model} via
+		// messageMetadata, but the client save previously kept only `parts`,
+		// clobbering it. Flatten the token counts onto channel_data too so the
+		// context gauge + budget-enforcement read channel_data.input_tokens.
+		if (msg.metadata && typeof msg.metadata === "object") {
+			channelData.metadata = msg.metadata;
+			const meta = msg.metadata as Record<string, unknown>;
+			if (typeof meta.inputTokens === "number") channelData.input_tokens = meta.inputTokens;
+			if (typeof meta.outputTokens === "number") channelData.output_tokens = meta.outputTokens;
+			if (typeof meta.contextWindow === "number") channelData.context_window = meta.contextWindow;
+		}
+		const occurred_at = new Date(base + i);
+		const direction = msg.role === "user" ? "inbound" : "outbound";
+		if (msg.id) {
+			await prisma.messages.upsert({
+				where: { id: msg.id },
+				create: {
+					id: msg.id,
+					conversation_id: conversationId,
+					channel: "ai",
+					organisation_id: organisationId,
+					role: msg.role,
+					direction,
+					content: msg.content,
+					occurred_at,
+					channel_data: channelData,
+				},
+				update: { content: msg.content, channel_data: channelData },
+			});
+		} else {
+			await prisma.messages.create({
+				data: {
+					conversation_id: conversationId,
+					channel: "ai",
+					organisation_id: organisationId,
+					role: msg.role,
+					direction,
+					content: msg.content,
+					occurred_at,
+					channel_data: channelData,
+				},
+			});
+		}
+	}
+
+	await prisma.conversations.update({
+		where: { id: conversationId },
+		data: { last_message_at: new Date() },
+	});
+}

package/src/fn-routers/plans-router.ts

@@ -0,0 +1,141 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * ORPC procedures for plan creation with tasks and subtasks.
+ * Extracted from @teamscala/orpc/fn-router — primitives tier must not
+ * contain application-specific work_items logic.
+ */
+
+import { authed, type Context } from "./auth-router.ts";
+
+function toSession(ctx: Context): { userId: string; orgId: string | null } {
+	const user = ctx.user as { id: string; organisationId?: string | null };
+	return {
+		userId: user.id,
+		orgId: ctx.orgId || user.organisationId || null,
+	};
+}
+
+export const plansRouter = {
+	save: authed.handler(async ({ input, context }) => {
+		const data = input as {
+			project_id?: string;
+			initiative_id?: string;
+			title: string;
+			description?: string;
+			status?: string;
+			due_date?: string;
+			start_date?: string;
+			tasks?: Array<{
+				title: string;
+				description?: string;
+				status?: string;
+				position?: number;
+				depends_on?: Array<string | number>;
+				subtasks?: Array<{
+					title: string;
+					completed?: boolean;
+					position?: number;
+				}>;
+			}>;
+		};
+
+		if (!data.title) throw new Error("title is required");
+		if (!data.initiative_id && !data.project_id)
+			throw new Error("initiative_id is required when creating a new plan");
+
+		const userId = toSession(context).userId;
+		const result = await (context.prisma as any).$transaction(
+			async (tx: any) => {
+				let pid = data.project_id;
+				if (!pid) {
+					const project = await tx.work_items.create({
+						data: {
+							kind: "project",
+							initiative_id: data.initiative_id!,
+							title: data.title,
+							description: data.description || null,
+							status: data.status || "active",
+							due_date: data.due_date || null,
+							start_date: data.start_date || null,
+							created_by: userId,
+							updated_by: userId,
+						},
+						select: { id: true },
+					});
+					pid = project.id;
+				} else {
+					await tx.work_items.update({
+						where: { kind: "project", id: pid },
+						data: {
+							title: data.title,
+							description: data.description || undefined,
+							status: data.status || undefined,
+							due_date: data.due_date || undefined,
+							start_date: data.start_date || undefined,
+							updated_by: userId,
+						},
+					});
+				}
+
+				const createdTaskIds: string[] = [];
+				const createdTasks: any[] = [];
+
+				if (data.tasks && data.tasks.length > 0) {
+					for (let i = 0; i < data.tasks.length; i++) {
+						const t = data.tasks[i]!;
+						const resolvedDeps = (t.depends_on || []).map((dep) => {
+							if (typeof dep === "number") {
+								const resolved = createdTaskIds[dep];
+								if (!resolved)
+									throw new Error(
+										`depends_on index ${dep} is out of range (only ${createdTaskIds.length} tasks created so far)`,
+									);
+								return resolved;
+							}
+							return dep;
+						});
+						const task = await tx.work_items.create({
+							data: {
+								kind: "task",
+								project_id: pid!,
+								title: t.title,
+								description: t.description || null,
+								status: t.status || "todo",
+								position: String(t.position ?? i),
+								depends_on: resolvedDeps,
+								assignee_type: "agent",
+								automation_type: "manual",
+								responsible_party: "team",
+								created_by: userId,
+								updated_by: userId,
+							},
+							select: { id: true },
+						});
+						createdTaskIds.push(task.id);
+						createdTasks.push({ ...t, id: task.id, _tempIndex: i });
+
+						if (t.subtasks && t.subtasks.length > 0) {
+							for (let j = 0; j < t.subtasks.length; j++) {
+								const st = t.subtasks[j]!;
+								await tx.work_items.create({
+									data: {
+										kind: "subtask",
+										task_id: task.id,
+										title: st.title,
+										completed: st.completed ?? false,
+										position: st.position ?? j,
+									},
+								});
+							}
+						}
+					}
+				}
+				return { project_id: pid, tasks_created: createdTasks.length };
+			},
+		);
+		return { success: true, data: result };
+	}),
+};

package/src/fn-routers/proposal-send-router.ts

@@ -0,0 +1,207 @@
+/**
+ * @system service-boot
+ * @status handwritten
+ * @edit edit directly
+ *
+ * The proposal SEND router — the proposal twin of agreement-send-router. An
+ * authed portal caller POSTs {proposalId, baseUrl} to email the proposal's CRM
+ * contact a per-recipient magic-link (no email gate, no OTP — see
+ * attach-proposal-magic.ts) to view their proposal. Resend-backed.
+ */
+
+import { os } from "@orpc/server";
+import * as v from "valibot";
+import { decryptSecretConfig } from "@teamscala/encryption/crypto/secret-config";
+import { sendEmail, initResendClient } from "@teamscala/api-resend/send-email";
+import { applyTemplateVars, lookupTemplate } from "@teamscala/email/templates/lookup";
+import { loadRegistryConfig } from "@teamscala/db/registry/load-config";
+import { getAppLogger } from "@teamscala/logger/app-loggers";
+import { signAccessToken } from "../content-gate/token.ts";
+import { resetRlsContext, setRlsContext } from "@teamscala/db/rls-context";
+import { getDefaultEmailSender } from "./email-defaults.ts";
+import { getEmailLinkTtlMs } from "./email-link-ttl.ts";
+
+const PROP_COOKIE = "prop_token";
+// Emailed links are opened hours/days later — they must outlive the gate's
+// in-session window, else the recipient lands on the unauthed gate ("white page").
+
+interface User {
+	id: string;
+	organisationId: string | null;
+}
+interface Context {
+	user: User | null | undefined;
+	headers: Headers;
+	// matches agreement-send-router Context
+	resolveUser?: (headers: Headers, prisma: any) => Promise<User | null>;
+	// prisma client type is service-injected
+	prisma: any;
+}
+
+const authed = os.$context<Context>().use(async (opt) => {
+	const { context } = opt;
+	let user = context.user;
+	if (!user && context.headers && context.resolveUser) {
+		user = await context.resolveUser(context.headers, context.prisma);
+	}
+	if (!user) {
+		const { ORPCError } = await import("@orpc/server");
+		throw new ORPCError("UNAUTHORIZED", { message: "Authentication required" });
+	}
+	// Audit attribution: set the audit session context so writes record the actor
+	// (app.current_user_name) — see auth-router.ts for the rationale.
+	const u = user as { id: string; name?: string | null; email?: string };
+	await setRlsContext(context.prisma, {
+		userId: u.id,
+		userName: u.name || u.email,
+		organisationId: user.organisationId,
+	});
+	try {
+		return await opt.next({ context: { ...context, user } });
+	} finally {
+		await resetRlsContext(context.prisma);
+	}
+});
+
+function bareAddress(sender: string): string {
+	const m = sender.match(/<([^>]+)>/);
+	return (m?.[1] ?? sender).trim();
+}
+
+async function resolveSender(
+	// prisma client type is service-injected
+	prisma: any,
+	organisationId: string,
+): Promise<{ from: string; replyTo?: string; orgName: string }> {
+	const templates = await loadRegistryConfig(
+		"config",
+		"email-templates",
+		v.looseObject({ sender: v.optional(v.string()) }),
+	).catch(() => ({ sender: undefined }) as { sender?: string });
+	const verifiedAddr = bareAddress(
+		templates.sender ?? (await getDefaultEmailSender()),
+	);
+	const profile = await prisma.organisation_profile.findFirst({
+		where: { id: organisationId },
+		select: {
+			company_friendly_name: true,
+			company_name: true,
+			contact_email: true,
+		},
+	});
+	const orgName = (profile?.company_friendly_name ||
+		profile?.company_name ||
+		"") as string;
+	return {
+		from: `${orgName || "Proposal"} <${verifiedAddr}>`,
+		replyTo: (profile?.contact_email as string) || undefined,
+		orgName: orgName || "the sender",
+	};
+}
+
+
+const sendSchema = v.object({
+	proposalId: v.string(),
+	/** Public base URL of the proposals site, e.g. https://proposals-dev.scala.business (no trailing slash). */
+	baseUrl: v.string(),
+});
+
+export const proposalSendRouter = {
+	send: authed.input(sendSchema).handler(async ({ input, context }) => {
+		const log = getAppLogger();
+		const prisma = context.prisma;
+		const proposalId = input.proposalId.trim();
+		const baseUrl = input.baseUrl.trim().replace(/\/+$/, "");
+		if (!proposalId || !baseUrl) {
+			return {
+				ok: false as const,
+				error: "proposalId and baseUrl are required",
+			};
+		}
+		try {
+			const proposal = await prisma.proposals.findFirst({
+				where: { id: proposalId },
+				select: { name: true, organisation_id: true, contact_id: true },
+			});
+			if (!proposal) return { ok: false as const, error: "Proposal not found" };
+			if (!proposal.contact_id) {
+				return {
+					ok: false as const,
+					error: "Proposal has no contact to send to",
+				};
+			}
+
+			const contact = await prisma.client_database.findFirst({
+				where: { id: proposal.contact_id },
+				select: { primary_email: true, first_name: true, last_name: true },
+			});
+			const email = String(contact?.primary_email ?? "").trim();
+			if (!email) {
+				return { ok: false as const, error: "Contact has no email address" };
+			}
+			const name = [contact?.first_name, contact?.last_name]
+				.filter(Boolean)
+				.join(" ")
+				.trim();
+
+			const rawSecret = await loadRegistryConfig(
+				"secret",
+				"resend-api-key",
+				v.looseObject({ token: v.optional(v.string()) }),
+			).catch(() => null);
+			const decrypted = rawSecret
+				? (decryptSecretConfig(rawSecret as never) as { token?: string })
+				: null;
+			if (!decrypted?.token) {
+				return { ok: false as const, error: "Resend API key not configured" };
+			}
+			initResendClient(decrypted.token);
+
+			const sender = await resolveSender(prisma, proposal.organisation_id);
+			const token = signAccessToken(
+				PROP_COOKIE,
+				proposalId,
+				email,
+				Date.now(),
+				await getEmailLinkTtlMs(),
+			);
+			const url = token
+				? `${baseUrl}/api/proposal-magic?p=${encodeURIComponent(proposalId)}&t=${encodeURIComponent(token)}&to=${encodeURIComponent(`/${proposalId}`)}`
+				: `${baseUrl}/${proposalId}`;
+
+			// Subject + body come from the `proposal-send` email_template row, never
+			// from literals here (email-template-registry-type): changing the copy is
+			// a registry_edit, not a deploy, and an org can override the row per
+			// tenant. The `from` stays computed — it is the verified sender identity,
+			// not copy.
+			const tpl = applyTemplateVars(await lookupTemplate("proposal-send"), {
+				hello: name ? `Hi ${name},` : "Hello,",
+				orgName: sender.orgName,
+				proposalName: proposal.name,
+				url,
+			});
+			const res = await sendEmail({
+				from: sender.from,
+				to: email,
+				reply_to: sender.replyTo,
+				subject: tpl.subject,
+				html: tpl.bodyHtml,
+				text: tpl.bodyText,
+			});
+			if (!res.success) {
+				log.error(
+					`[proposalSend] failed to ${email}: ${res.error ?? "unknown"}`,
+				);
+				return { ok: false as const, error: res.error ?? "send failed" };
+			}
+			log.info(
+				`[proposalSend] ${proposalId} sent to ${email}${res.id ? ` (id ${res.id})` : ""}`,
+			);
+			return { ok: true as const, sentAt: new Date().toISOString(), url, email };
+		} catch (err) {
+			const message = err instanceof Error ? err.message : String(err);
+			log.error(`[proposalSend] ${proposalId}: ${message}`);
+			return { ok: false as const, error: message };
+		}
+	}),
+};