mrp/server/src/modules/crm/router.ts

import { permissions } from "@mrp/shared";
import { crmContactEntryTypes, crmRecordStatuses } from "@mrp/shared/dist/crm/types.js";
import { Router } from "express";
import { z } from "zod";

import { fail, ok } from "../../lib/http.js";
import { requirePermissions } from "../../lib/rbac.js";
import {
  createCustomerContactEntry,
  createCustomer,
  createVendorContactEntry,
  createVendor,
  getCustomerById,
  getVendorById,
  listCustomers,
  listVendors,
  updateCustomer,
  updateVendor,
} from "./service.js";

const crmRecordSchema = z.object({
  name: z.string().trim().min(1),
  email: z.string().trim().email(),
  phone: z.string().trim().min(1),
  addressLine1: z.string().trim().min(1),
  addressLine2: z.string(),
  city: z.string().trim().min(1),
  state: z.string().trim().min(1),
  postalCode: z.string().trim().min(1),
  country: z.string().trim().min(1),
  status: z.enum(crmRecordStatuses),
  notes: z.string(),
});

const crmListQuerySchema = z.object({
  q: z.string().optional(),
  state: z.string().optional(),
  status: z.enum(crmRecordStatuses).optional(),
});

const crmContactEntrySchema = z.object({
  type: z.enum(crmContactEntryTypes),
  summary: z.string().trim().min(1).max(160),
  body: z.string().trim().min(1).max(4000),
  contactAt: z.string().datetime(),
});

function getRouteParam(value: string | string[] | undefined) {
  return typeof value === "string" ? value : null;
}

export const crmRouter = Router();

crmRouter.get("/customers", requirePermissions([permissions.crmRead]), async (_request, response) => {
  const parsed = crmListQuerySchema.safeParse(_request.query);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "CRM filters are invalid.");
  }

  return ok(
    response,
    await listCustomers({
      query: parsed.data.q,
      status: parsed.data.status,
      state: parsed.data.state,
    })
  );
});

crmRouter.get("/customers/:customerId", requirePermissions([permissions.crmRead]), async (request, response) => {
  const customerId = getRouteParam(request.params.customerId);
  if (!customerId) {
    return fail(response, 400, "INVALID_INPUT", "Customer id is invalid.");
  }

  const customer = await getCustomerById(customerId);
  if (!customer) {
    return fail(response, 404, "CRM_CUSTOMER_NOT_FOUND", "Customer record was not found.");
  }

  return ok(response, customer);
});

crmRouter.post("/customers", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const parsed = crmRecordSchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Customer payload is invalid.");
  }

  return ok(response, await createCustomer(parsed.data), 201);
});

crmRouter.put("/customers/:customerId", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const customerId = getRouteParam(request.params.customerId);
  if (!customerId) {
    return fail(response, 400, "INVALID_INPUT", "Customer id is invalid.");
  }

  const parsed = crmRecordSchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Customer payload is invalid.");
  }

  const customer = await updateCustomer(customerId, parsed.data);
  if (!customer) {
    return fail(response, 404, "CRM_CUSTOMER_NOT_FOUND", "Customer record was not found.");
  }

  return ok(response, customer);
});

crmRouter.post("/customers/:customerId/contact-history", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const customerId = getRouteParam(request.params.customerId);
  if (!customerId) {
    return fail(response, 400, "INVALID_INPUT", "Customer id is invalid.");
  }

  const parsed = crmContactEntrySchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Contact history entry is invalid.");
  }

  const entry = await createCustomerContactEntry(customerId, parsed.data, request.authUser?.id);
  if (!entry) {
    return fail(response, 404, "CRM_CUSTOMER_NOT_FOUND", "Customer record was not found.");
  }

  return ok(response, entry, 201);
});

crmRouter.get("/vendors", requirePermissions([permissions.crmRead]), async (_request, response) => {
  const parsed = crmListQuerySchema.safeParse(_request.query);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "CRM filters are invalid.");
  }

  return ok(
    response,
    await listVendors({
      query: parsed.data.q,
      status: parsed.data.status,
      state: parsed.data.state,
    })
  );
});

crmRouter.get("/vendors/:vendorId", requirePermissions([permissions.crmRead]), async (request, response) => {
  const vendorId = getRouteParam(request.params.vendorId);
  if (!vendorId) {
    return fail(response, 400, "INVALID_INPUT", "Vendor id is invalid.");
  }

  const vendor = await getVendorById(vendorId);
  if (!vendor) {
    return fail(response, 404, "CRM_VENDOR_NOT_FOUND", "Vendor record was not found.");
  }

  return ok(response, vendor);
});

crmRouter.post("/vendors", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const parsed = crmRecordSchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Vendor payload is invalid.");
  }

  return ok(response, await createVendor(parsed.data), 201);
});

crmRouter.put("/vendors/:vendorId", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const vendorId = getRouteParam(request.params.vendorId);
  if (!vendorId) {
    return fail(response, 400, "INVALID_INPUT", "Vendor id is invalid.");
  }

  const parsed = crmRecordSchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Vendor payload is invalid.");
  }

  const vendor = await updateVendor(vendorId, parsed.data);
  if (!vendor) {
    return fail(response, 404, "CRM_VENDOR_NOT_FOUND", "Vendor record was not found.");
  }

  return ok(response, vendor);
});

crmRouter.post("/vendors/:vendorId/contact-history", requirePermissions([permissions.crmWrite]), async (request, response) => {
  const vendorId = getRouteParam(request.params.vendorId);
  if (!vendorId) {
    return fail(response, 400, "INVALID_INPUT", "Vendor id is invalid.");
  }

  const parsed = crmContactEntrySchema.safeParse(request.body);
  if (!parsed.success) {
    return fail(response, 400, "INVALID_INPUT", "Contact history entry is invalid.");
  }

  const entry = await createVendorContactEntry(vendorId, parsed.data, request.authUser?.id);
  if (!entry) {
    return fail(response, 404, "CRM_VENDOR_NOT_FOUND", "Vendor record was not found.");
  }

  return ok(response, entry, 201);
});