1083 lines
42 KiB
TypeScript
1083 lines
42 KiB
TypeScript
import { FastifyInstance } from "fastify"
|
|
import {
|
|
eq,
|
|
ilike,
|
|
asc,
|
|
desc,
|
|
and,
|
|
count,
|
|
inArray,
|
|
or,
|
|
sql,
|
|
} from "drizzle-orm"
|
|
|
|
import { authProfiles, costcentres, customers, entitybankaccounts } from "../../../db/schema";
|
|
import { resourceConfig } from "../../utils/resource.config";
|
|
import { useNextNumberRangeNumber } from "../../utils/functions";
|
|
import { getHistoryEntityLabel, insertHistoryItem } from "../../utils/history";
|
|
import { diffObjects } from "../../utils/diff";
|
|
import { recalculateServicePricesForTenant } from "../../modules/service-price-recalculation.service";
|
|
import { decrypt, encrypt } from "../../utils/crypt";
|
|
|
|
const PORTAL_ALLOWED_RESOURCES = new Set(["customers", "contracts", "createddocuments", "contracttypes"])
|
|
const PORTAL_VISIBLE_DOCUMENT_TYPES = ["invoices", "advanceInvoices", "cancellationInvoices"]
|
|
const OUTGOING_SEPA_MANDATE_STATUSES = new Set(["Entwurf", "Aktiv", "Widerrufen", "Abgelaufen"])
|
|
const OUTGOING_SEPA_MANDATE_TYPES = new Set(["CORE", "B2B"])
|
|
const OUTGOING_SEPA_SEQUENCE_TYPES = new Set(["RCUR", "OOFF", "FRST", "FNAL"])
|
|
|
|
// -------------------------------------------------------------
|
|
// SQL Suche auf mehreren Feldern (Haupttabelle + Relationen)
|
|
// -------------------------------------------------------------
|
|
function buildSearchCondition(columns: any[], search: string) {
|
|
if (!search || !columns.length) return null
|
|
|
|
const normalizeForSearch = (value: string) =>
|
|
value
|
|
.toLowerCase()
|
|
.normalize("NFD")
|
|
.replace(/[\u0300-\u036f]/g, "")
|
|
.replace(/ß/g, "ss")
|
|
|
|
const searchTermsRaw = search
|
|
.trim()
|
|
.toLowerCase()
|
|
.split(/\s+/)
|
|
.filter(Boolean)
|
|
|
|
const searchTermsNormalized = searchTermsRaw.map(normalizeForSearch)
|
|
|
|
const normalizeSqlExpr = (valueExpr: any) => sql`
|
|
lower(
|
|
replace(
|
|
replace(
|
|
replace(
|
|
replace(
|
|
replace(
|
|
replace(
|
|
replace(cast(${valueExpr} as text), 'Ä', 'A'),
|
|
'Ö', 'O'
|
|
),
|
|
'Ü', 'U'
|
|
),
|
|
'ä', 'a'
|
|
),
|
|
'ö', 'o'
|
|
),
|
|
'ü', 'u'
|
|
),
|
|
'ß', 'ss'
|
|
)
|
|
)
|
|
`
|
|
|
|
const validColumns = columns.filter(Boolean)
|
|
if (validColumns.length === 0) return null
|
|
|
|
// Alle Suchspalten zu einem String zusammenführen, damit Vor-/Nachname zuverlässig
|
|
// gemeinsam durchsuchbar sind (auch wenn in getrennten Feldern gespeichert).
|
|
const combinedRawExpr = sql`concat_ws(' ', ${sql.join(validColumns.map((col) => sql`coalesce(cast(${col} as text), '')`), sql`, `)})`
|
|
const combinedNormalizedExpr = normalizeSqlExpr(combinedRawExpr)
|
|
|
|
const perTermConditions = searchTermsRaw.map((rawTerm, idx) => {
|
|
const normalizedTerm = searchTermsNormalized[idx]
|
|
const rawLike = `%${rawTerm}%`
|
|
const normalizedLike = `%${normalizedTerm}%`
|
|
|
|
const rawCondition = ilike(combinedRawExpr, rawLike)
|
|
const normalizedCondition = sql`${combinedNormalizedExpr} like ${normalizedLike}`
|
|
|
|
return or(rawCondition, normalizedCondition)
|
|
})
|
|
|
|
if (perTermConditions.length === 0) return null
|
|
return and(...perTermConditions)
|
|
}
|
|
|
|
function formatDiffValue(value: any): string {
|
|
if (value === null || value === undefined) return "-"
|
|
if (typeof value === "boolean") return value ? "Ja" : "Nein"
|
|
if (typeof value === "object") {
|
|
try {
|
|
return JSON.stringify(value)
|
|
} catch {
|
|
return "[Objekt]"
|
|
}
|
|
}
|
|
return String(value)
|
|
}
|
|
|
|
const TECHNICAL_HISTORY_KEYS = new Set([
|
|
"id",
|
|
"tenant",
|
|
"tenant_id",
|
|
"createdAt",
|
|
"created_at",
|
|
"createdBy",
|
|
"created_by",
|
|
"updatedAt",
|
|
"updated_at",
|
|
"updatedBy",
|
|
"updated_by",
|
|
"archived",
|
|
])
|
|
|
|
function getUserVisibleChanges(oldRecord: Record<string, any>, updated: Record<string, any>) {
|
|
return diffObjects(oldRecord, updated).filter((c) => !TECHNICAL_HISTORY_KEYS.has(c.key))
|
|
}
|
|
|
|
function buildFieldUpdateHistoryText(resource: string, label: string, oldValue: any, newValue: any) {
|
|
const resourceLabel = getHistoryEntityLabel(resource)
|
|
return `${resourceLabel}: ${label} geändert von "${formatDiffValue(oldValue)}" zu "${formatDiffValue(newValue)}"`
|
|
}
|
|
|
|
function applyResourceWhereFilters(resource: string, table: any, whereCond: any) {
|
|
if (resource === "members") {
|
|
return and(whereCond, eq(table.type, "Mitglied"))
|
|
}
|
|
return whereCond
|
|
}
|
|
|
|
async function getPortalCustomerId(server: FastifyInstance, req: any) {
|
|
const tenantId = req.user?.tenant_id
|
|
const userId = req.user?.user_id
|
|
|
|
if (!tenantId || !userId) return null
|
|
|
|
const [profile] = await server.db
|
|
.select({ customer_for_portal: authProfiles.customer_for_portal })
|
|
.from(authProfiles)
|
|
.where(and(
|
|
eq(authProfiles.tenant_id, tenantId),
|
|
eq(authProfiles.user_id, userId)
|
|
))
|
|
.limit(1)
|
|
|
|
return profile?.customer_for_portal || null
|
|
}
|
|
|
|
function applyPortalScope(resource: string, table: any, whereCond: any, portalCustomerId: number | null) {
|
|
if (!portalCustomerId) return whereCond
|
|
|
|
if (!PORTAL_ALLOWED_RESOURCES.has(resource)) {
|
|
return null
|
|
}
|
|
|
|
if (resource === "customers") {
|
|
return and(whereCond, eq(table.id, portalCustomerId))
|
|
}
|
|
|
|
if (resource === "contracts") {
|
|
return and(whereCond, eq(table.customer, portalCustomerId))
|
|
}
|
|
|
|
if (resource === "createddocuments") {
|
|
return and(
|
|
whereCond,
|
|
eq(table.customer, portalCustomerId),
|
|
eq(table.availableInPortal, true),
|
|
inArray(table.type, PORTAL_VISIBLE_DOCUMENT_TYPES)
|
|
)
|
|
}
|
|
|
|
return whereCond
|
|
}
|
|
|
|
function sanitizePortalCustomerUpdate(payload: Record<string, any>) {
|
|
const nextInfoData = payload.infoData && typeof payload.infoData === "object" ? payload.infoData : {}
|
|
|
|
return {
|
|
name: payload.name,
|
|
firstname: payload.firstname,
|
|
lastname: payload.lastname,
|
|
salutation: payload.salutation,
|
|
title: payload.title,
|
|
nameAddition: payload.nameAddition,
|
|
infoData: nextInfoData,
|
|
}
|
|
}
|
|
|
|
function getTenantColumn(resource: string, table: any) {
|
|
const config = resourceConfig[resource]
|
|
const tenantKey = config?.tenantKey || "tenant"
|
|
return table[tenantKey]
|
|
}
|
|
|
|
function getRelationConfig(relation: string) {
|
|
const candidateKeys = [
|
|
relation,
|
|
`${relation}s`,
|
|
]
|
|
|
|
if (relation.endsWith("y")) {
|
|
candidateKeys.push(`${relation.slice(0, -1)}ies`)
|
|
}
|
|
|
|
if (/(s|x|z|ch|sh)$/.test(relation)) {
|
|
candidateKeys.push(`${relation}es`)
|
|
}
|
|
|
|
for (const key of candidateKeys) {
|
|
if (resourceConfig[key]) return resourceConfig[key]
|
|
}
|
|
|
|
return null
|
|
}
|
|
|
|
function isDateLikeField(key: string) {
|
|
if (key === "deliveryDateType") return false
|
|
if (key.includes("_at") || key.endsWith("At")) return true
|
|
if (/Date$/.test(key)) return true
|
|
return /(^|_|-)date($|_|-)/i.test(key)
|
|
}
|
|
|
|
function normalizeMemberPayload(payload: Record<string, any>) {
|
|
const infoData = payload.infoData && typeof payload.infoData === "object" ? payload.infoData : {}
|
|
const normalized = {
|
|
...payload,
|
|
type: "Mitglied",
|
|
isCompany: false,
|
|
infoData,
|
|
}
|
|
|
|
return normalized
|
|
}
|
|
|
|
function validateMemberPayload(payload: Record<string, any>) {
|
|
const infoData = payload.infoData && typeof payload.infoData === "object" ? payload.infoData : {}
|
|
const bankAccountIds = Array.isArray(infoData.bankAccountIds) ? infoData.bankAccountIds.filter(Boolean) : []
|
|
const firstname = typeof payload.firstname === "string" ? payload.firstname.trim() : ""
|
|
const lastname = typeof payload.lastname === "string" ? payload.lastname.trim() : ""
|
|
|
|
if (!firstname || !lastname) {
|
|
return "Für Mitglieder sind Vorname und Nachname erforderlich."
|
|
}
|
|
|
|
if (!bankAccountIds.length) {
|
|
return "Für Mitglieder muss mindestens ein Bankkonto hinterlegt werden."
|
|
}
|
|
|
|
if (infoData.hasSEPA && !infoData.sepaSignedAt) {
|
|
return "Wenn ein SEPA-Mandat hinterlegt ist, muss ein Unterschriftsdatum gesetzt werden."
|
|
}
|
|
|
|
return null
|
|
}
|
|
|
|
async function validateCostCentreParent(
|
|
server: FastifyInstance,
|
|
tenantId: number,
|
|
costCentreId: string | null,
|
|
parentCostcentreId: string | null
|
|
) {
|
|
if (!parentCostcentreId) {
|
|
return null
|
|
}
|
|
|
|
const hierarchyRows = await server.db
|
|
.select({
|
|
id: costcentres.id,
|
|
parentCostcentre: costcentres.parentCostcentre,
|
|
})
|
|
.from(costcentres)
|
|
.where(eq(costcentres.tenant, tenantId))
|
|
|
|
const hierarchyMap = new Map(
|
|
hierarchyRows.map((row) => [row.id, row.parentCostcentre || null])
|
|
)
|
|
|
|
if (!hierarchyMap.has(parentCostcentreId)) {
|
|
return "Die übergeordnete Kostenstelle wurde nicht gefunden."
|
|
}
|
|
|
|
if (costCentreId && parentCostcentreId === costCentreId) {
|
|
return "Eine Kostenstelle kann nicht sich selbst als übergeordnete Kostenstelle haben."
|
|
}
|
|
|
|
if (!costCentreId) {
|
|
return null
|
|
}
|
|
|
|
let currentParentId: string | null = parentCostcentreId
|
|
const visited = new Set<string>()
|
|
|
|
while (currentParentId) {
|
|
if (currentParentId === costCentreId) {
|
|
return "Die ausgewählte übergeordnete Kostenstelle würde einen Zyklus erzeugen."
|
|
}
|
|
|
|
if (visited.has(currentParentId)) {
|
|
break
|
|
}
|
|
|
|
visited.add(currentParentId)
|
|
currentParentId = hierarchyMap.get(currentParentId) || null
|
|
}
|
|
|
|
return null
|
|
}
|
|
|
|
function maskIban(iban: string) {
|
|
if (!iban) return ""
|
|
const cleaned = iban.replace(/\s+/g, "")
|
|
if (cleaned.length <= 8) return cleaned
|
|
return `${cleaned.slice(0, 4)} **** **** ${cleaned.slice(-4)}`
|
|
}
|
|
|
|
function decryptEntityBankAccount(row: Record<string, any>) {
|
|
const iban = row.ibanEncrypted ? decrypt(row.ibanEncrypted as any) : null
|
|
const bic = row.bicEncrypted ? decrypt(row.bicEncrypted as any) : null
|
|
const bankName = row.bankNameEncrypted ? decrypt(row.bankNameEncrypted as any) : null
|
|
|
|
return {
|
|
...row,
|
|
iban,
|
|
bic,
|
|
bankName,
|
|
displayLabel: `${maskIban(iban || "")}${bankName ? ` | ${bankName}` : ""}${row.description ? ` (${row.description})` : ""}`.trim(),
|
|
}
|
|
}
|
|
|
|
function prepareEntityBankAccountPayload(payload: Record<string, any>, requireAll: boolean) {
|
|
const iban = typeof payload.iban === "string" ? payload.iban.trim() : ""
|
|
const bic = typeof payload.bic === "string" ? payload.bic.trim() : ""
|
|
const bankName = typeof payload.bankName === "string" ? payload.bankName.trim() : ""
|
|
|
|
const hasAnyPlainField = Object.prototype.hasOwnProperty.call(payload, "iban")
|
|
|| Object.prototype.hasOwnProperty.call(payload, "bic")
|
|
|| Object.prototype.hasOwnProperty.call(payload, "bankName")
|
|
|
|
if (!hasAnyPlainField && !requireAll) {
|
|
return { data: payload }
|
|
}
|
|
|
|
if (!iban || !bic || !bankName) {
|
|
return { error: "IBAN, BIC und Bankinstitut sind Pflichtfelder." }
|
|
}
|
|
|
|
const result: Record<string, any> = {
|
|
...payload,
|
|
ibanEncrypted: encrypt(iban),
|
|
bicEncrypted: encrypt(bic),
|
|
bankNameEncrypted: encrypt(bankName),
|
|
}
|
|
|
|
delete result.iban
|
|
delete result.bic
|
|
delete result.bankName
|
|
|
|
return { data: result }
|
|
}
|
|
|
|
async function validateOutgoingSepaMandatePayload(
|
|
server: FastifyInstance,
|
|
tenantId: number,
|
|
payload: Record<string, any>,
|
|
existing: Record<string, any> | null = null
|
|
) {
|
|
const customerId = Number(payload.customer ?? existing?.customer)
|
|
const bankaccountId = Number(payload.bankaccount ?? existing?.bankaccount)
|
|
|
|
if (!customerId || !bankaccountId) {
|
|
return "Kunde und Bankverbindung sind Pflichtfelder."
|
|
}
|
|
|
|
const status = payload.status ?? existing?.status ?? "Entwurf"
|
|
if (!OUTGOING_SEPA_MANDATE_STATUSES.has(status)) {
|
|
return "Ungültiger Mandatsstatus."
|
|
}
|
|
|
|
const mandateType = payload.mandateType ?? existing?.mandateType ?? "CORE"
|
|
if (!OUTGOING_SEPA_MANDATE_TYPES.has(mandateType)) {
|
|
return "Ungültiger Mandatstyp."
|
|
}
|
|
|
|
const sequenceType = payload.sequenceType ?? existing?.sequenceType ?? "RCUR"
|
|
if (!OUTGOING_SEPA_SEQUENCE_TYPES.has(sequenceType)) {
|
|
return "Ungültige Mandatssequenz."
|
|
}
|
|
|
|
const [customer] = await server.db
|
|
.select()
|
|
.from(customers)
|
|
.where(and(eq(customers.id, customerId), eq(customers.tenant, tenantId)))
|
|
.limit(1)
|
|
|
|
if (!customer) {
|
|
return "Kunde nicht gefunden."
|
|
}
|
|
|
|
const [bankaccount] = await server.db
|
|
.select()
|
|
.from(entitybankaccounts)
|
|
.where(and(eq(entitybankaccounts.id, bankaccountId), eq(entitybankaccounts.tenant, tenantId)))
|
|
.limit(1)
|
|
|
|
if (!bankaccount) {
|
|
return "Bankverbindung nicht gefunden."
|
|
}
|
|
|
|
const assignedBankAccountIds = Array.isArray((customer.infoData as any)?.bankAccountIds)
|
|
? (customer.infoData as any).bankAccountIds.map((id: any) => Number(id))
|
|
: []
|
|
|
|
if (!assignedBankAccountIds.includes(bankaccountId)) {
|
|
return "Die Bankverbindung ist dem ausgewählten Kunden nicht zugeordnet."
|
|
}
|
|
|
|
return null
|
|
}
|
|
|
|
export default async function resourceRoutes(server: FastifyInstance) {
|
|
|
|
// -------------------------------------------------------------
|
|
// LIST
|
|
// -------------------------------------------------------------
|
|
server.get("/resource/:resource", async (req, reply) => {
|
|
try {
|
|
const tenantId = req.user?.tenant_id
|
|
if (!tenantId)
|
|
return reply.code(400).send({ error: "No tenant selected" })
|
|
|
|
const { search, sort, asc: ascQuery } = req.query as {
|
|
search?: string
|
|
sort?: string
|
|
asc?: string
|
|
}
|
|
|
|
const { resource } = req.params as { resource: string }
|
|
const config = resourceConfig[resource]
|
|
if (!config) {
|
|
return reply.code(404).send({ error: "Unknown resource" })
|
|
}
|
|
const portalCustomerId = await getPortalCustomerId(server, req)
|
|
if (portalCustomerId && !PORTAL_ALLOWED_RESOURCES.has(resource)) {
|
|
return reply.code(403).send({ error: "Forbidden" })
|
|
}
|
|
const table = config.table
|
|
|
|
const tenantColumn = getTenantColumn(resource, table)
|
|
let whereCond: any = tenantColumn ? eq(tenantColumn, tenantId) : undefined
|
|
whereCond = applyResourceWhereFilters(resource, table, whereCond)
|
|
whereCond = applyPortalScope(resource, table, whereCond, portalCustomerId)
|
|
let q = server.db.select().from(table).$dynamic()
|
|
|
|
const searchCols: any[] = (config.searchColumns || []).map(c => table[c])
|
|
|
|
if (config.mtoLoad) {
|
|
config.mtoLoad.forEach(rel => {
|
|
const relConfig = getRelationConfig(rel)
|
|
if (relConfig) {
|
|
const relTable = relConfig.table
|
|
|
|
// FIX: Nur joinen, wenn es keine Self-Reference ist (verhindert ERROR 42712)
|
|
if (relTable !== table) {
|
|
// @ts-ignore
|
|
q = q.leftJoin(relTable, eq(table[rel], relTable.id))
|
|
if (relConfig.searchColumns) {
|
|
relConfig.searchColumns.forEach(c => {
|
|
if (relTable[c]) searchCols.push(relTable[c])
|
|
})
|
|
}
|
|
}
|
|
}
|
|
})
|
|
}
|
|
|
|
if (search) {
|
|
const searchCond = buildSearchCondition(searchCols, search.trim())
|
|
if (searchCond) whereCond = and(whereCond, searchCond)
|
|
}
|
|
|
|
q = q.where(whereCond)
|
|
|
|
if (sort) {
|
|
const col = (table as any)[sort]
|
|
if (col) {
|
|
q = ascQuery === "true" ? q.orderBy(asc(col)) : q.orderBy(desc(col))
|
|
}
|
|
}
|
|
|
|
const queryData = await q
|
|
// Transformation: Falls Joins genutzt wurden, das Hauptobjekt extrahieren
|
|
const rows = queryData.map(r => r[resource] || r.table || r);
|
|
|
|
// RELATION LOADING
|
|
let data = [...rows]
|
|
if(config.mtoLoad) {
|
|
let ids: any = {}
|
|
let lists: any = {}
|
|
let maps: any = {}
|
|
config.mtoLoad.forEach(rel => {
|
|
ids[rel] = [...new Set(rows.map(r => r[rel]).filter(Boolean))];
|
|
})
|
|
for await (const rel of config.mtoLoad) {
|
|
const relConf = getRelationConfig(rel)
|
|
if (!relConf) continue
|
|
const relTab = relConf.table
|
|
lists[rel] = ids[rel].length ? await server.db.select().from(relTab).where(inArray(relTab.id, ids[rel])) : []
|
|
maps[rel] = Object.fromEntries(lists[rel].map((i: any) => [i.id, i]));
|
|
}
|
|
data = rows.map(row => {
|
|
let toReturn = { ...row }
|
|
config.mtoLoad.forEach(rel => {
|
|
toReturn[rel] = row[rel] ? maps[rel][row[rel]] : null
|
|
})
|
|
return toReturn
|
|
});
|
|
}
|
|
|
|
if(config.mtmListLoad) {
|
|
for await (const relation of config.mtmListLoad) {
|
|
const relTable = resourceConfig[relation].table
|
|
const parentKey = config.relationKey || resource.substring(0, resource.length - 1)
|
|
const relationRows = await server.db.select().from(relTable).where(inArray(relTable[parentKey], data.map(i => i.id)))
|
|
data = data.map(row => ({
|
|
...row,
|
|
[relation]: relationRows.filter(i => i[parentKey] === row.id)
|
|
}))
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
return data.map((row) => decryptEntityBankAccount(row))
|
|
}
|
|
|
|
return data
|
|
|
|
} catch (err) {
|
|
console.error("ERROR /resource/:resource", err)
|
|
return reply.code(500).send({ error: "Internal Server Error" })
|
|
}
|
|
})
|
|
|
|
// -------------------------------------------------------------
|
|
// PAGINATED LIST
|
|
// -------------------------------------------------------------
|
|
server.get("/resource/:resource/paginated", async (req, reply) => {
|
|
try {
|
|
const tenantId = req.user?.tenant_id;
|
|
if (!tenantId) return reply.code(400).send({ error: "No tenant selected" });
|
|
|
|
const { resource } = req.params as { resource: string };
|
|
const config = resourceConfig[resource];
|
|
if (!config) {
|
|
return reply.code(404).send({ error: "Unknown resource" });
|
|
}
|
|
const portalCustomerId = await getPortalCustomerId(server, req)
|
|
if (portalCustomerId && !PORTAL_ALLOWED_RESOURCES.has(resource)) {
|
|
return reply.code(403).send({ error: "Forbidden" })
|
|
}
|
|
const table = config.table;
|
|
|
|
const { queryConfig } = req;
|
|
const { pagination, sort, filters } = queryConfig;
|
|
const { search, distinctColumns } = req.query as { search?: string; distinctColumns?: string; };
|
|
|
|
const tenantColumn = getTenantColumn(resource, table);
|
|
let whereCond: any = tenantColumn ? eq(tenantColumn, tenantId) : undefined;
|
|
whereCond = applyResourceWhereFilters(resource, table, whereCond)
|
|
whereCond = applyPortalScope(resource, table, whereCond, portalCustomerId)
|
|
const searchCols: any[] = (config.searchColumns || []).map(c => table[c]);
|
|
const debugSearchColumnNames: string[] = [...(config.searchColumns || [])];
|
|
const parsedFilters: Array<{ key: string; value: any }> = []
|
|
|
|
let countQuery = server.db.select({ value: count(table.id) }).from(table).$dynamic();
|
|
let mainQuery = server.db.select().from(table).$dynamic();
|
|
|
|
if (config.mtoLoad) {
|
|
config.mtoLoad.forEach(rel => {
|
|
const relConfig = getRelationConfig(rel)
|
|
if (relConfig) {
|
|
const relTable = relConfig.table;
|
|
|
|
// FIX: Self-Reference Check
|
|
if (relTable !== table) {
|
|
countQuery = countQuery.leftJoin(relTable, eq(table[rel], relTable.id));
|
|
// @ts-ignore
|
|
mainQuery = mainQuery.leftJoin(relTable, eq(table[rel], relTable.id));
|
|
if (relConfig.searchColumns) {
|
|
relConfig.searchColumns.forEach(c => {
|
|
if (relTable[c]) {
|
|
searchCols.push(relTable[c]);
|
|
debugSearchColumnNames.push(`${rel}.${c}`);
|
|
}
|
|
});
|
|
}
|
|
}
|
|
}
|
|
});
|
|
}
|
|
|
|
if (search) {
|
|
if (resource === "customers") {
|
|
const rawSearch = search.trim()
|
|
const terms = rawSearch.toLowerCase().split(/\s+/).filter(Boolean)
|
|
const normalizedTerms = terms
|
|
.map((t) => t.normalize("NFD").replace(/[\u0300-\u036f]/g, "").replace(/ß/g, "ss"))
|
|
|
|
server.log.info({
|
|
tag: "customer-search-debug",
|
|
search: rawSearch,
|
|
terms,
|
|
normalizedTerms,
|
|
searchColumns: debugSearchColumnNames,
|
|
page: pagination?.page ?? 1,
|
|
limit: pagination?.limit ?? 100,
|
|
}, "Paginated customer search request")
|
|
}
|
|
|
|
const searchCond = buildSearchCondition(searchCols, search.trim());
|
|
if (searchCond) whereCond = and(whereCond, searchCond);
|
|
}
|
|
|
|
if (filters) {
|
|
for (const [key, val] of Object.entries(filters)) {
|
|
const col = (table as any)[key];
|
|
if (!col) continue;
|
|
parsedFilters.push({ key, value: val })
|
|
whereCond = Array.isArray(val) ? and(whereCond, inArray(col, val)) : and(whereCond, eq(col, val as any));
|
|
}
|
|
}
|
|
|
|
const totalRes = await countQuery.where(whereCond);
|
|
const total = Number(totalRes[0]?.value ?? 0);
|
|
|
|
const offset = pagination?.offset ?? 0;
|
|
const limit = pagination?.limit ?? 100;
|
|
|
|
mainQuery = mainQuery.where(whereCond).offset(offset).limit(limit);
|
|
|
|
if (sort?.length > 0) {
|
|
const s = sort[0];
|
|
const col = (table as any)[s.field];
|
|
if (col) {
|
|
mainQuery = s.direction === "asc" ? mainQuery.orderBy(asc(col)) : mainQuery.orderBy(desc(col));
|
|
}
|
|
}
|
|
|
|
const rawRows = await mainQuery;
|
|
// Transformation für Drizzle Joins
|
|
let rows = rawRows.map(r => r[resource] || r.table || r);
|
|
|
|
const distinctValues: Record<string, any[]> = {};
|
|
if (distinctColumns) {
|
|
for (const colName of distinctColumns.split(",").map(c => c.trim())) {
|
|
const col = (table as any)[colName];
|
|
if (!col) continue;
|
|
let distinctQuery = server.db.select({ v: col }).from(table).$dynamic();
|
|
if (config.mtoLoad) {
|
|
config.mtoLoad.forEach(rel => {
|
|
const relConfig = getRelationConfig(rel)
|
|
if (!relConfig) return;
|
|
const relTable = relConfig.table;
|
|
if (relTable !== table) {
|
|
distinctQuery = distinctQuery.leftJoin(relTable, eq(table[rel], relTable.id));
|
|
}
|
|
});
|
|
}
|
|
let distinctWhereCond: any = tenantColumn ? eq(tenantColumn, tenantId) : undefined
|
|
distinctWhereCond = applyResourceWhereFilters(resource, table, distinctWhereCond)
|
|
distinctWhereCond = applyPortalScope(resource, table, distinctWhereCond, portalCustomerId)
|
|
|
|
if (search) {
|
|
const searchCond = buildSearchCondition(searchCols, search.trim())
|
|
if (searchCond) distinctWhereCond = and(distinctWhereCond, searchCond)
|
|
}
|
|
|
|
for (const f of parsedFilters) {
|
|
if (f.key === colName) continue
|
|
const filterCol = (table as any)[f.key]
|
|
if (!filterCol) continue
|
|
distinctWhereCond = Array.isArray(f.value)
|
|
? and(distinctWhereCond, inArray(filterCol, f.value))
|
|
: and(distinctWhereCond, eq(filterCol, f.value as any))
|
|
}
|
|
|
|
const dRows = await distinctQuery.where(distinctWhereCond);
|
|
distinctValues[colName] = [...new Set(dRows.map(r => r.v).filter(v => v != null && v !== ""))].sort();
|
|
}
|
|
}
|
|
|
|
let data = [...rows];
|
|
if (config.mtoLoad) {
|
|
let ids: any = {};
|
|
let lists: any = {};
|
|
let maps: any = {};
|
|
config.mtoLoad.forEach(rel => {
|
|
ids[rel] = [...new Set(rows.map(r => r[rel]).filter(Boolean))];
|
|
});
|
|
for await (const rel of config.mtoLoad) {
|
|
const relConf = getRelationConfig(rel)
|
|
if (!relConf) continue
|
|
const relTab = relConf.table;
|
|
lists[rel] = ids[rel].length ? await server.db.select().from(relTab).where(inArray(relTab.id, ids[rel])) : [];
|
|
maps[rel] = Object.fromEntries(lists[rel].map((i: any) => [i.id, i]));
|
|
}
|
|
data = rows.map(row => {
|
|
let toReturn = { ...row };
|
|
config.mtoLoad.forEach(rel => {
|
|
toReturn[rel] = row[rel] ? maps[rel][row[rel]] : null;
|
|
});
|
|
return toReturn;
|
|
});
|
|
}
|
|
|
|
if (config.mtmListLoad) {
|
|
for await (const relation of config.mtmListLoad) {
|
|
const relTable = resourceConfig[relation].table;
|
|
const parentKey = config.relationKey || resource.substring(0, resource.length - 1);
|
|
const relationRows = await server.db.select().from(relTable).where(inArray(relTable[parentKey], data.map(i => i.id)));
|
|
data = data.map(row => ({
|
|
...row,
|
|
[relation]: relationRows.filter(i => i[parentKey] === row.id)
|
|
}));
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
data = data.map((row) => decryptEntityBankAccount(row))
|
|
}
|
|
|
|
return {
|
|
data,
|
|
queryConfig: { ...queryConfig, total, totalPages: Math.ceil(total / limit), distinctValues }
|
|
};
|
|
|
|
} catch (err) {
|
|
console.error(`ERROR /resource/:resource/paginated:`, err);
|
|
return reply.code(500).send({ error: "Internal Server Error" });
|
|
}
|
|
});
|
|
|
|
// -------------------------------------------------------------
|
|
// DETAIL
|
|
// -------------------------------------------------------------
|
|
server.get("/resource/:resource/:id/:no_relations?", async (req, reply) => {
|
|
try {
|
|
const { id } = req.params as { id: string }
|
|
const tenantId = req.user?.tenant_id
|
|
if (!tenantId) return reply.code(400).send({ error: "No tenant selected" })
|
|
|
|
const { resource, no_relations } = req.params as { resource: string, no_relations?: boolean }
|
|
const portalCustomerId = await getPortalCustomerId(server, req)
|
|
if (portalCustomerId && !PORTAL_ALLOWED_RESOURCES.has(resource)) {
|
|
return reply.code(403).send({ error: "Forbidden" })
|
|
}
|
|
const table = resourceConfig[resource].table
|
|
|
|
let whereCond: any = and(eq(table.id, id), eq(table.tenant, tenantId))
|
|
whereCond = applyResourceWhereFilters(resource, table, whereCond)
|
|
whereCond = applyPortalScope(resource, table, whereCond, portalCustomerId)
|
|
|
|
const projRows = await server.db
|
|
.select()
|
|
.from(table)
|
|
.where(whereCond)
|
|
.limit(1)
|
|
|
|
if (!projRows.length)
|
|
return reply.code(404).send({ error: "Resource not found" })
|
|
|
|
let data = { ...projRows[0] }
|
|
|
|
if (!no_relations) {
|
|
if (resourceConfig[resource].mtoLoad) {
|
|
for await (const relation of resourceConfig[resource].mtoLoad) {
|
|
if (data[relation]) {
|
|
const relConf = getRelationConfig(relation)
|
|
if (!relConf) continue
|
|
const relTable = relConf.table
|
|
const relData = await server.db.select().from(relTable).where(eq(relTable.id, data[relation]))
|
|
data[relation] = relData[0] || null
|
|
}
|
|
}
|
|
}
|
|
|
|
if (resourceConfig[resource].mtmLoad) {
|
|
for await (const relation of resourceConfig[resource].mtmLoad) {
|
|
const relTable = resourceConfig[relation].table
|
|
const parentKey = resourceConfig[resource].relationKey || resource.substring(0, resource.length - 1)
|
|
data[relation] = await server.db.select().from(relTable).where(eq(relTable[parentKey], id))
|
|
}
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
return decryptEntityBankAccount(data)
|
|
}
|
|
|
|
return data
|
|
} catch (err) {
|
|
console.error("ERROR /resource/:resource/:id", err)
|
|
return reply.code(500).send({ error: "Internal Server Error" })
|
|
}
|
|
})
|
|
|
|
// Create
|
|
server.post("/resource/:resource", async (req, reply) => {
|
|
try {
|
|
if (!req.user?.tenant_id) return reply.code(400).send({ error: "No tenant selected" });
|
|
const { resource } = req.params as { resource: string };
|
|
const portalCustomerId = await getPortalCustomerId(server, req)
|
|
if (portalCustomerId) {
|
|
return reply.code(403).send({ error: "Forbidden" })
|
|
}
|
|
if (resource === "accounts") {
|
|
return reply.code(403).send({ error: "Accounts are read-only" })
|
|
}
|
|
const body = req.body as Record<string, any>;
|
|
const config = resourceConfig[resource];
|
|
const table = config.table;
|
|
|
|
let createData: Record<string, any> = { ...body, tenant: req.user.tenant_id, archived: false };
|
|
|
|
if (resource === "members") {
|
|
createData = normalizeMemberPayload(createData)
|
|
const validationError = validateMemberPayload(createData)
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
const prepared = prepareEntityBankAccountPayload(createData, true)
|
|
if (prepared.error) return reply.code(400).send({ error: prepared.error })
|
|
createData = prepared.data!
|
|
}
|
|
|
|
if (resource === "costcentres") {
|
|
const validationError = await validateCostCentreParent(
|
|
server,
|
|
req.user.tenant_id,
|
|
null,
|
|
createData.parentCostcentre || null
|
|
)
|
|
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
if (resource === "outgoingsepamandates") {
|
|
const validationError = await validateOutgoingSepaMandatePayload(server, req.user.tenant_id, createData)
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
if (config.numberRangeHolder && !body[config.numberRangeHolder]) {
|
|
const numberRangeResource = resource === "members" ? "customers" : resource
|
|
const result = await useNextNumberRangeNumber(server, req.user.tenant_id, numberRangeResource)
|
|
createData[config.numberRangeHolder] = result.usedNumber
|
|
}
|
|
|
|
const normalizeDate = (val: any) => { const d = new Date(val); return isNaN(d.getTime()) ? null : d; }
|
|
Object.keys(createData).forEach((key) => {
|
|
if (key.toLowerCase().includes("date") && key !== "deliveryDateType") createData[key] = normalizeDate(createData[key])
|
|
})
|
|
|
|
const [created] = await server.db.insert(table).values(createData).returning()
|
|
|
|
if (resource === "outgoingsepamandates" && created?.defaultMandate) {
|
|
await server.db
|
|
.update(table)
|
|
.set({ defaultMandate: false })
|
|
.where(and(
|
|
eq(table.tenant, req.user.tenant_id),
|
|
eq(table.customer, created.customer),
|
|
sql`${table.id} <> ${created.id}`
|
|
))
|
|
}
|
|
|
|
if (["products", "services", "hourrates"].includes(resource)) {
|
|
await recalculateServicePricesForTenant(server, req.user.tenant_id, req.user?.user_id || null);
|
|
}
|
|
|
|
if (created) {
|
|
try {
|
|
const resourceLabel = getHistoryEntityLabel(resource)
|
|
await insertHistoryItem(server, {
|
|
tenant_id: req.user.tenant_id,
|
|
created_by: req.user?.user_id || null,
|
|
entity: resource,
|
|
entityId: created.id,
|
|
action: "created",
|
|
oldVal: null,
|
|
newVal: created,
|
|
text: `Neuer Eintrag in ${resourceLabel} erstellt`,
|
|
})
|
|
} catch (historyError) {
|
|
server.log.warn({ err: historyError, resource }, "Failed to write create history entry")
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
return decryptEntityBankAccount(created as Record<string, any>)
|
|
}
|
|
|
|
return created;
|
|
} catch (error) {
|
|
console.error(error);
|
|
reply.status(500);
|
|
}
|
|
});
|
|
|
|
// Update
|
|
server.put("/resource/:resource/:id", async (req, reply) => {
|
|
try {
|
|
const { resource, id } = req.params as { resource: string; id: string }
|
|
if (resource === "accounts") {
|
|
return reply.code(403).send({ error: "Accounts are read-only" })
|
|
}
|
|
const body = req.body as Record<string, any>
|
|
const tenantId = req.user?.tenant_id
|
|
const userId = req.user?.user_id
|
|
const portalCustomerId = await getPortalCustomerId(server, req)
|
|
|
|
if (!tenantId || !userId) return reply.code(401).send({ error: "Unauthorized" })
|
|
if (portalCustomerId && resource !== "customers") {
|
|
return reply.code(403).send({ error: "Forbidden" })
|
|
}
|
|
|
|
const table = resourceConfig[resource].table
|
|
const normalizeDate = (val: any) => { const d = new Date(val); return isNaN(d.getTime()) ? null : d; }
|
|
|
|
const [oldRecord] = await server.db
|
|
.select()
|
|
.from(table)
|
|
.where(applyPortalScope(resource, table, and(eq(table.id, id), eq(table.tenant, tenantId)), portalCustomerId))
|
|
.limit(1)
|
|
|
|
if (!oldRecord) {
|
|
return reply.code(404).send({ error: "Resource not found" })
|
|
}
|
|
|
|
let data: Record<string, any> = { ...body, updated_at: new Date().toISOString(), updated_by: userId }
|
|
//@ts-ignore
|
|
delete data.updatedBy; delete data.updatedAt;
|
|
|
|
if (portalCustomerId) {
|
|
data = {
|
|
...sanitizePortalCustomerUpdate(data),
|
|
updated_at: data.updated_at,
|
|
updated_by: data.updated_by,
|
|
}
|
|
}
|
|
|
|
if (resource === "members") {
|
|
data = normalizeMemberPayload(data)
|
|
const validationError = validateMemberPayload(data)
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
const prepared = prepareEntityBankAccountPayload(data, false)
|
|
if (prepared.error) return reply.code(400).send({ error: prepared.error })
|
|
data = {
|
|
...prepared.data,
|
|
updated_at: data.updated_at,
|
|
updated_by: data.updated_by,
|
|
}
|
|
}
|
|
|
|
if (resource === "costcentres") {
|
|
const validationError = await validateCostCentreParent(
|
|
server,
|
|
tenantId,
|
|
oldRecord.id,
|
|
Object.prototype.hasOwnProperty.call(data, "parentCostcentre")
|
|
? data.parentCostcentre || null
|
|
: oldRecord.parentCostcentre || null
|
|
)
|
|
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
if (resource === "outgoingsepamandates") {
|
|
const validationError = await validateOutgoingSepaMandatePayload(server, tenantId, data, oldRecord)
|
|
if (validationError) {
|
|
return reply.code(400).send({ error: validationError })
|
|
}
|
|
}
|
|
|
|
Object.keys(data).forEach((key) => {
|
|
const value = data[key]
|
|
const shouldNormalize =
|
|
isDateLikeField(key) &&
|
|
value !== null &&
|
|
value !== undefined &&
|
|
(typeof value === "string" || typeof value === "number" || value instanceof Date)
|
|
|
|
if (shouldNormalize) {
|
|
data[key] = normalizeDate(value)
|
|
}
|
|
})
|
|
|
|
let updateWhereCond: any = and(eq(table.id, id), eq(table.tenant, tenantId))
|
|
updateWhereCond = applyResourceWhereFilters(resource, table, updateWhereCond)
|
|
const [updated] = await server.db.update(table).set(data).where(updateWhereCond).returning()
|
|
|
|
if (resource === "outgoingsepamandates" && updated?.defaultMandate) {
|
|
await server.db
|
|
.update(table)
|
|
.set({ defaultMandate: false })
|
|
.where(and(
|
|
eq(table.tenant, tenantId),
|
|
eq(table.customer, updated.customer),
|
|
sql`${table.id} <> ${updated.id}`
|
|
))
|
|
}
|
|
|
|
if (["products", "services", "hourrates"].includes(resource)) {
|
|
await recalculateServicePricesForTenant(server, tenantId, userId);
|
|
}
|
|
|
|
if (updated) {
|
|
try {
|
|
const resourceLabel = getHistoryEntityLabel(resource)
|
|
const changes = oldRecord ? getUserVisibleChanges(oldRecord, updated) : []
|
|
if (!changes.length) {
|
|
await insertHistoryItem(server, {
|
|
tenant_id: tenantId,
|
|
created_by: userId,
|
|
entity: resource,
|
|
entityId: updated.id,
|
|
action: "updated",
|
|
oldVal: oldRecord || null,
|
|
newVal: updated,
|
|
text: `Eintrag in ${resourceLabel} geändert`,
|
|
})
|
|
} else {
|
|
for (const change of changes) {
|
|
await insertHistoryItem(server, {
|
|
tenant_id: tenantId,
|
|
created_by: userId,
|
|
entity: resource,
|
|
entityId: updated.id,
|
|
action: "updated",
|
|
oldVal: change.oldValue,
|
|
newVal: change.newValue,
|
|
text: buildFieldUpdateHistoryText(resource, change.label, change.oldValue, change.newValue),
|
|
})
|
|
}
|
|
}
|
|
} catch (historyError) {
|
|
server.log.warn({ err: historyError, resource, id }, "Failed to write update history entry")
|
|
}
|
|
}
|
|
|
|
if (resource === "entitybankaccounts") {
|
|
return decryptEntityBankAccount(updated as Record<string, any>)
|
|
}
|
|
|
|
return updated
|
|
} catch (err) {
|
|
console.error(err)
|
|
}
|
|
})
|
|
}
|