CRM

server/src/modules/crm/router.ts

@@ -1,17 +1,158 @@
-import { permissions } from "@mrp/shared";
+import { crmRecordStatuses, permissions } from "@mrp/shared";
 import { Router } from "express";
+import { z } from "zod";
 
-import { ok } from "../../lib/http.js";
+import { fail, ok } from "../../lib/http.js";
 import { requirePermissions } from "../../lib/rbac.js";
-import { listCustomers, listVendors } from "./service.js";
+import {
+  createCustomer,
+  createVendor,
+  getCustomerById,
+  getVendorById,
+  listCustomers,
+  listVendors,
+  updateCustomer,
+  updateVendor,
+} from "./service.js";
+
+const crmRecordSchema = z.object({
+  name: z.string().trim().min(1),
+  email: z.string().trim().email(),
+  phone: z.string().trim().min(1),
+  addressLine1: z.string().trim().min(1),
+  addressLine2: z.string(),
+  city: z.string().trim().min(1),
+  state: z.string().trim().min(1),
+  postalCode: z.string().trim().min(1),
+  country: z.string().trim().min(1),
+  status: z.enum(crmRecordStatuses),
+  notes: z.string(),
+});
+
+const crmListQuerySchema = z.object({
+  q: z.string().optional(),
+  state: z.string().optional(),
+  status: z.enum(crmRecordStatuses).optional(),
+});
+
+function getRouteParam(value: string | string[] | undefined) {
+  return typeof value === "string" ? value : null;
+}
 
 export const crmRouter = Router();
 
 crmRouter.get("/customers", requirePermissions([permissions.crmRead]), async (_request, response) => {
-  return ok(response, await listCustomers());
+  const parsed = crmListQuerySchema.safeParse(_request.query);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "CRM filters are invalid.");
+  }
+
+  return ok(
+    response,
+    await listCustomers({
+      query: parsed.data.q,
+      status: parsed.data.status,
+      state: parsed.data.state,
+    })
+  );
+});
+
+crmRouter.get("/customers/:customerId", requirePermissions([permissions.crmRead]), async (request, response) => {
+  const customerId = getRouteParam(request.params.customerId);
+  if (!customerId) {
+    return fail(response, 400, "INVALID_INPUT", "Customer id is invalid.");
+  }
+
+  const customer = await getCustomerById(customerId);
+  if (!customer) {
+    return fail(response, 404, "CRM_CUSTOMER_NOT_FOUND", "Customer record was not found.");
+  }
+
+  return ok(response, customer);
+});
+
+crmRouter.post("/customers", requirePermissions([permissions.crmWrite]), async (request, response) => {
+  const parsed = crmRecordSchema.safeParse(request.body);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "Customer payload is invalid.");
+  }
+
+  return ok(response, await createCustomer(parsed.data), 201);
+});
+
+crmRouter.put("/customers/:customerId", requirePermissions([permissions.crmWrite]), async (request, response) => {
+  const customerId = getRouteParam(request.params.customerId);
+  if (!customerId) {
+    return fail(response, 400, "INVALID_INPUT", "Customer id is invalid.");
+  }
+
+  const parsed = crmRecordSchema.safeParse(request.body);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "Customer payload is invalid.");
+  }
+
+  const customer = await updateCustomer(customerId, parsed.data);
+  if (!customer) {
+    return fail(response, 404, "CRM_CUSTOMER_NOT_FOUND", "Customer record was not found.");
+  }
+
+  return ok(response, customer);
 });
 
 crmRouter.get("/vendors", requirePermissions([permissions.crmRead]), async (_request, response) => {
-  return ok(response, await listVendors());
+  const parsed = crmListQuerySchema.safeParse(_request.query);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "CRM filters are invalid.");
+  }
+
+  return ok(
+    response,
+    await listVendors({
+      query: parsed.data.q,
+      status: parsed.data.status,
+      state: parsed.data.state,
+    })
+  );
 });
 
+crmRouter.get("/vendors/:vendorId", requirePermissions([permissions.crmRead]), async (request, response) => {
+  const vendorId = getRouteParam(request.params.vendorId);
+  if (!vendorId) {
+    return fail(response, 400, "INVALID_INPUT", "Vendor id is invalid.");
+  }
+
+  const vendor = await getVendorById(vendorId);
+  if (!vendor) {
+    return fail(response, 404, "CRM_VENDOR_NOT_FOUND", "Vendor record was not found.");
+  }
+
+  return ok(response, vendor);
+});
+
+crmRouter.post("/vendors", requirePermissions([permissions.crmWrite]), async (request, response) => {
+  const parsed = crmRecordSchema.safeParse(request.body);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "Vendor payload is invalid.");
+  }
+
+  return ok(response, await createVendor(parsed.data), 201);
+});
+
+crmRouter.put("/vendors/:vendorId", requirePermissions([permissions.crmWrite]), async (request, response) => {
+  const vendorId = getRouteParam(request.params.vendorId);
+  if (!vendorId) {
+    return fail(response, 400, "INVALID_INPUT", "Vendor id is invalid.");
+  }
+
+  const parsed = crmRecordSchema.safeParse(request.body);
+  if (!parsed.success) {
+    return fail(response, 400, "INVALID_INPUT", "Vendor payload is invalid.");
+  }
+
+  const vendor = await updateVendor(vendorId, parsed.data);
+  if (!vendor) {
+    return fail(response, 404, "CRM_VENDOR_NOT_FOUND", "Vendor record was not found.");
+  }
+
+  return ok(response, vendor);
+});