@unifiedcommerce/plugin-marketplace 0.0.1

package/dist/routes/vendor-portal.js

@@ -0,0 +1,255 @@
+import { router } from "@unifiedcommerce/core";
+import { vendorEntities } from "../schema";
+import { eq } from "drizzle-orm";
+import { UpdateVendorProfileBodySchema, UploadVendorDocumentBodySchema, ShipSubOrderBodySchema, CancelSubOrderBodySchema, RespondToReviewBodySchema, ApproveReturnBodySchema, RejectReturnBodySchema, } from "../schemas/vendor-portal";
+import { stripUndefined, stripVendorSecrets } from "./util";
+/** Helper to extract vendorId from actor and throw if missing. */
+function requireVendorId(actor) {
+    const vendorId = actor?.vendorId;
+    if (!vendorId)
+        throw new Error("Forbidden");
+    return vendorId;
+}
+export function buildVendorPortalRoutes(services) {
+    const r = router("Marketplace - Vendor Portal", "/marketplace/vendor/me");
+    // ─── Get my vendor profile ─────────────────────────────────────────────────
+    r.get("/")
+        .summary("Get my vendor profile")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const vendor = await services.vendor.getById(vendorId);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(vendor);
+    });
+    // ─── Update my vendor profile ──────────────────────────────────────────────
+    r.patch("/")
+        .summary("Update my vendor profile")
+        .auth()
+        .input(UpdateVendorProfileBodySchema)
+        .handler(async ({ actor, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const updated = await services.vendor.update(vendorId, stripUndefined(body));
+        if (!updated)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(updated);
+    });
+    // ─── Upload document ───────────────────────────────────────────────────────
+    r.post("/documents")
+        .summary("Upload a document for my vendor profile")
+        .auth()
+        .input(UploadVendorDocumentBodySchema)
+        .handler(async ({ actor, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        return services.vendor.uploadDocument(vendorId, {
+            type: body.type,
+            fileUrl: body.fileUrl,
+        });
+    });
+    // ─── List my documents ─────────────────────────────────────────────────────
+    r.get("/documents")
+        .summary("List my vendor documents")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.vendor.listDocuments(vendorId);
+    });
+    // ─── List my products ──────────────────────────────────────────────────────
+    r.get("/products")
+        .summary("List my products")
+        .auth()
+        .handler(async ({ actor, db }) => {
+        const vendorId = requireVendorId(actor);
+        const drizzle = db;
+        const entities = await drizzle
+            .select()
+            .from(vendorEntities)
+            .where(eq(vendorEntities.vendorId, vendorId));
+        return entities;
+    });
+    // ─── List my sub-orders ────────────────────────────────────────────────────
+    r.get("/orders")
+        .summary("List my sub-orders")
+        .auth()
+        .handler(async ({ actor, query }) => {
+        const vendorId = requireVendorId(actor);
+        const status = query.status;
+        return services.subOrder.listByVendor(vendorId, stripUndefined({ status }));
+    });
+    // ─── Get single sub-order ──────────────────────────────────────────────────
+    r.get("/orders/{subOrderId}")
+        .summary("Get a single sub-order")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return subOrder;
+    });
+    // ─── Confirm sub-order ─────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/confirm")
+        .summary("Confirm a sub-order")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.confirm(params.subOrderId);
+    });
+    // ─── Ship sub-order ────────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/ship")
+        .summary("Ship a sub-order")
+        .auth()
+        .input(ShipSubOrderBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.ship(params.subOrderId, {
+            trackingNumber: body.trackingNumber,
+            carrier: body.carrier,
+        });
+    });
+    // ─── Deliver sub-order ─────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/deliver")
+        .summary("Mark a sub-order as delivered")
+        .auth()
+        .handler(async ({ actor, params }) => {
+        const vendorId = requireVendorId(actor);
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.deliver(params.subOrderId);
+    });
+    // ─── Cancel sub-order ──────────────────────────────────────────────────────
+    r.post("/orders/{subOrderId}/cancel")
+        .summary("Cancel a sub-order")
+        .auth()
+        .input(CancelSubOrderBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        const subOrder = await services.subOrder.getById(params.subOrderId);
+        if (!subOrder)
+            throw new Error("Sub-order not found");
+        if (subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        return services.subOrder.cancel(params.subOrderId, body.reason);
+    });
+    // ─── List my payouts ───────────────────────────────────────────────────────
+    r.get("/payouts")
+        .summary("List my payouts")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.payout.listPayouts({ vendorId });
+    });
+    // ─── My balance ────────────────────────────────────────────────────────────
+    r.get("/balance")
+        .summary("Get my balance")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const balance = await services.payout.getBalance(vendorId);
+        const ledger = await services.payout.getLedger(vendorId);
+        return { balanceCents: balance, ledger };
+    });
+    // ─── My analytics ──────────────────────────────────────────────────────────
+    r.get("/analytics")
+        .summary("Get my analytics")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        const rating = await services.review.getAggregateRating(vendorId);
+        const balance = await services.payout.getBalance(vendorId);
+        return { rating, balanceCents: balance };
+    });
+    // ─── My reviews ────────────────────────────────────────────────────────────
+    r.get("/reviews")
+        .summary("List my reviews")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.review.getForVendor(vendorId, true);
+    });
+    // ─── Respond to review ─────────────────────────────────────────────────────
+    r.post("/reviews/{id}/respond")
+        .summary("Respond to a review")
+        .auth()
+        .input(RespondToReviewBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const body = input;
+        // IDOR prevention: verify the review belongs to this vendor
+        const vendorReviews = await services.review.getForVendor(vendorId, true);
+        const ownsReview = vendorReviews.some((rev) => rev.id === params.id);
+        if (!ownsReview)
+            throw new Error("Forbidden: review does not belong to this vendor");
+        const updated = await services.review.respond(params.id, body.response);
+        if (!updated)
+            throw new Error("Review not found");
+        return updated;
+    });
+    // ─── My returns ────────────────────────────────────────────────────────────
+    r.get("/returns")
+        .summary("List my returns")
+        .auth()
+        .handler(async ({ actor }) => {
+        const vendorId = requireVendorId(actor);
+        return services.return.listByVendor(vendorId);
+    });
+    // ─── Approve return ────────────────────────────────────────────────────────
+    r.post("/returns/{id}/approve")
+        .summary("Approve a return request")
+        .auth()
+        .input(ApproveReturnBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const ret = await services.return.getById(params.id);
+        if (!ret)
+            throw new Error("Return not found");
+        const subOrder = await services.subOrder.getById(ret.subOrderId);
+        if (!subOrder || subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        const body = input;
+        const updated = await services.return.vendorApprove(params.id, body.refundAmountCents);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    // ─── Reject return ─────────────────────────────────────────────────────────
+    r.post("/returns/{id}/reject")
+        .summary("Reject a return request")
+        .auth()
+        .input(RejectReturnBodySchema)
+        .handler(async ({ actor, params, input }) => {
+        const vendorId = requireVendorId(actor);
+        const ret = await services.return.getById(params.id);
+        if (!ret)
+            throw new Error("Return not found");
+        const subOrder = await services.subOrder.getById(ret.subOrderId);
+        if (!subOrder || subOrder.vendorId !== vendorId)
+            throw new Error("Forbidden");
+        const body = input;
+        const updated = await services.return.vendorReject(params.id, body.notes);
+        if (!updated)
+            throw new Error("Return not found");
+        return updated;
+    });
+    return r.routes();
+}

package/dist/routes/vendors.d.ts

@@ -0,0 +1,11 @@
+import type { PluginRouteRegistration } from "@unifiedcommerce/core";
+import type { VendorService } from "../services/vendor";
+import type { PayoutService } from "../services/payout";
+import type { ReviewService } from "../services/review";
+import type { MarketplacePluginOptions } from "../types";
+export declare function buildVendorRoutes(services: {
+    vendor: VendorService;
+    payout: PayoutService;
+    review: ReviewService;
+}, options?: MarketplacePluginOptions): PluginRouteRegistration[];
+//# sourceMappingURL=vendors.d.ts.map

package/dist/routes/vendors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"vendors.d.ts","sourceRoot":"","sources":["../../src/routes/vendors.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,uBAAuB,EAAE,MAAM,uBAAuB,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACxD,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,UAAU,CAAC;AAUzD,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE;IAC1C,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;IACtB,MAAM,EAAE,aAAa,CAAC;CACvB,EAAE,OAAO,CAAC,EAAE,wBAAwB,GAAG,uBAAuB,EAAE,CAoLhE"}

package/dist/routes/vendors.js

@@ -0,0 +1,185 @@
+import { router, resolveOrgId } from "@unifiedcommerce/core";
+import { CreateVendorBodySchema, UpdateVendorBodySchema, RejectVendorBodySchema, SuspendVendorBodySchema, UploadDocumentBodySchema, } from "../schemas/vendors";
+import { stripUndefined, stripVendorSecrets } from "./util";
+export function buildVendorRoutes(services, options) {
+    const r = router("Marketplace - Vendors", "/marketplace/vendors");
+    // ─── List vendors ──────────────────────────────────────────────────────────
+    r.get("/")
+        .summary("List all vendors")
+        .permission("marketplace:admin")
+        .handler(async ({ query }) => {
+        const vendors = await services.vendor.list(stripUndefined({
+            status: query.status,
+            tier: query.tier,
+            search: query.search,
+        }));
+        return vendors.map(stripVendorSecrets);
+    });
+    // ─── Create vendor ─────────────────────────────────────────────────────────
+    r.post("/")
+        .summary("Create a vendor")
+        .permission("marketplace:admin")
+        .input(CreateVendorBodySchema)
+        .handler(async ({ input, actor }) => {
+        const body = input;
+        const defaultBps = options?.defaultCommissionRateBps ?? 1000;
+        return services.vendor.create(resolveOrgId(actor), stripUndefined({
+            ...body,
+            commissionRateBps: body.commissionRateBps ?? defaultBps,
+        }));
+    });
+    // ─── Get vendor detail ─────────────────────────────────────────────────────
+    r.get("/{id}")
+        .summary("Get vendor detail")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(vendor);
+    });
+    // ─── Update vendor ─────────────────────────────────────────────────────────
+    r.patch("/{id}")
+        .summary("Update a vendor")
+        .permission("marketplace:admin")
+        .input(UpdateVendorBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const updated = await services.vendor.update(params.id, stripUndefined(body));
+        if (!updated)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(updated);
+    });
+    // ─── Approve vendor ────────────────────────────────────────────────────────
+    r.post("/{id}/approve")
+        .summary("Approve a vendor application")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const approved = await services.vendor.approve(params.id);
+        if (!approved)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(approved);
+    });
+    // ─── Reject vendor ─────────────────────────────────────────────────────────
+    r.post("/{id}/reject")
+        .summary("Reject a vendor application")
+        .permission("marketplace:admin")
+        .input(RejectVendorBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const rejected = await services.vendor.reject(params.id, body.reason);
+        if (!rejected)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(rejected);
+    });
+    // ─── Suspend vendor ────────────────────────────────────────────────────────
+    r.post("/{id}/suspend")
+        .summary("Suspend a vendor")
+        .permission("marketplace:admin")
+        .input(SuspendVendorBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const suspended = await services.vendor.suspend(params.id, body.reason);
+        if (!suspended)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(suspended);
+    });
+    // ─── Reinstate vendor ──────────────────────────────────────────────────────
+    r.post("/{id}/reinstate")
+        .summary("Reinstate a suspended vendor")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const reinstated = await services.vendor.reinstate(params.id);
+        if (!reinstated)
+            throw new Error("Vendor not found");
+        return stripVendorSecrets(reinstated);
+    });
+    // ─── Upload vendor document ────────────────────────────────────────────────
+    r.post("/{id}/documents")
+        .summary("Upload a vendor document")
+        .permission("marketplace:admin")
+        .input(UploadDocumentBodySchema)
+        .handler(async ({ params, input }) => {
+        const body = input;
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        return services.vendor.uploadDocument(params.id, {
+            type: body.type,
+            fileUrl: body.fileUrl,
+        });
+    });
+    // ─── List vendor documents ─────────────────────────────────────────────────
+    r.get("/{id}/documents")
+        .summary("List vendor documents")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        return services.vendor.listDocuments(params.id);
+    });
+    // ─── Approve document ──────────────────────────────────────────────────────
+    r.post("/{id}/documents/{docId}/approve")
+        .summary("Approve a vendor document")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const updated = await services.vendor.approveDocument(params.docId);
+        if (!updated)
+            throw new Error("Document not found");
+        return updated;
+    });
+    // ─── Reject document ───────────────────────────────────────────────────────
+    r.post("/{id}/documents/{docId}/reject")
+        .summary("Reject a vendor document")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const updated = await services.vendor.rejectDocument(params.docId);
+        if (!updated)
+            throw new Error("Document not found");
+        return updated;
+    });
+    // ─── Vendor balance ────────────────────────────────────────────────────────
+    r.get("/{id}/balance")
+        .summary("Get vendor balance")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const balance = await services.payout.getBalance(params.id);
+        const ledger = await services.payout.getLedger(params.id);
+        return { balanceCents: balance, ledger };
+    });
+    // ─── Vendor performance ────────────────────────────────────────────────────
+    r.get("/{id}/performance")
+        .summary("Get vendor performance metrics")
+        .permission("marketplace:admin")
+        .handler(async ({ params }) => {
+        const vendor = await services.vendor.getById(params.id);
+        if (!vendor)
+            throw new Error("Vendor not found");
+        const rating = await services.review.getAggregateRating(params.id);
+        const balance = await services.payout.getBalance(params.id);
+        return {
+            vendorId: params.id,
+            performanceScore: vendor.performanceScore,
+            tier: vendor.tier,
+            rating,
+            balanceCents: balance,
+        };
+    });
+    return r.routes();
+}