Upload api-server\src\routes\clients.ts with huggingface_hub

api-server//src//routes//clients.ts

@@ -0,0 +1,409 @@
+import { Router } from "express";
+import { db } from "@workspace/db";
+import { clientsTable, tasksTable, usersTable } from "@workspace/db";
+import { eq, ilike, count, and, inArray, isNotNull } from "drizzle-orm";
+import { requireManagerOrAdmin, requireAdmin, requireAuth, AuthRequest } from "../middleware/auth.js";
+import { getTaskVisibilityFilter, User, isAdmin, isTeamLead, canAccessAllTeams, isMember } from "../lib/auth-utils.js";
+import { logAudit } from "../lib/audit-logger.js";
+import { z } from "zod";
+import { invalidateDashboardCache } from "./dashboard.js";
+
+
+const router = Router();
+
+function serializeClient(
+  client: typeof clientsTable.$inferSelect,
+  extras: Record<string, unknown> = {}
+) {
+  return {
+    ...client,
+    createdAt: client.createdAt.toISOString(),
+    updatedAt: client.updatedAt.toISOString(),
+    ...extras,
+  };
+}
+
+router.get("/clients", async (req: AuthRequest, res) => {
+  try {
+    const user = req.user as User;
+    const { search, isActive } = req.query as { search?: string; isActive?: string };
+    const conditions = [];
+    if (search) conditions.push(ilike(clientsTable.name, `%${search}%`));
+    if (isActive !== undefined) conditions.push(eq(clientsTable.isActive, isActive === "true"));
+
+    let clients: (typeof clientsTable.$inferSelect)[] = [];
+    if (canAccessAllTeams(user)) {
+      // Admins and Head of Team see all clients
+      clients = await db.select().from(clientsTable)
+        .where(conditions.length > 0 ? and(...conditions) : undefined)
+        .orderBy(clientsTable.name);
+    } else {
+      // Team Leads and Members only see clients they have tasks for (based on their visibility)
+      const visibilityFilter = getTaskVisibilityFilter(user);
+      const taskClientIds = await db.select({ clientId: tasksTable.clientId })
+        .from(tasksTable)
+        .where(and(isNotNull(tasksTable.clientId), visibilityFilter));
+      
+      const uniqueIds = [...new Set(taskClientIds.map(t => t.clientId).filter(Boolean))] as number[];
+      if (uniqueIds.length === 0) {
+        clients = [];
+      } else {
+        clients = await db.select().from(clientsTable)
+          .where(and(inArray(clientsTable.id, uniqueIds), ...conditions))
+          .orderBy(clientsTable.name);
+      }
+    }
+
+    const visibilityFilter = getTaskVisibilityFilter(user);
+
+    const taskCounts = await db.select({
+      clientId: tasksTable.clientId,
+      total: count(),
+    }).from(tasksTable)
+      .where(visibilityFilter)
+      .groupBy(tasksTable.clientId);
+
+    const activeCounts = await db.select({
+      clientId: tasksTable.clientId,
+      cnt: count(),
+    }).from(tasksTable)
+      .where(and(eq(tasksTable.status, "in_progress"), visibilityFilter))
+      .groupBy(tasksTable.clientId);
+
+    const completedCounts = await db.select({
+      clientId: tasksTable.clientId,
+      cnt: count(),
+    }).from(tasksTable)
+      .where(and(eq(tasksTable.status, "completed"), visibilityFilter))
+      .groupBy(tasksTable.clientId);
+
+    const totalMap: Record<number, number> = {};
+    const activeMap: Record<number, number> = {};
+    const completedMap: Record<number, number> = {};
+
+    taskCounts.forEach(r => { if (r.clientId) totalMap[r.clientId] = Number(r.total); });
+    activeCounts.forEach(r => { if (r.clientId) activeMap[r.clientId] = Number(r.cnt); });
+    completedCounts.forEach(r => { if (r.clientId) completedMap[r.clientId] = Number(r.cnt); });
+
+    const result = clients.map(c => serializeClient(c, {
+      totalTasks: totalMap[c.id] ?? 0,
+      activeTasks: activeMap[c.id] ?? 0,
+      completedTasks: completedMap[c.id] ?? 0,
+    }));
+
+    res.json(result);
+  } catch (err) {
+    req.log.error({ err }, "Failed to list clients");
+    res.status(500).json({ error: "Internal server error" });
+  }
+});
+
+const createClientSchema = z.object({
+  name: z.string().trim().min(1, "اسم العميل مطلوب"),
+  email: z.string().trim().email("بريد إلكتروني غير صالح").optional().or(z.literal("")),
+  phone: z.string().trim().regex(/^\+?[0-9\s\-()]{7,20}$/, "رقم هاتف غير صالح").optional().or(z.literal("")),
+  assignedTeam: z.string().trim().optional(),
+  industry: z.string().trim().optional(),
+  notes: z.string().trim().optional(),
+});
+
+router.post("/clients", requireAuth, requireManagerOrAdmin, async (req: AuthRequest, res) => {
+  try {
+    const user = req.user as User;
+    if (!user) { res.status(401).json({ error: "Unauthorized" }); return; }
+
+    if (isMember(user)) {
+      res.status(403).json({ error: "Forbidden: members cannot create clients" });
+      return;
+    }
+
+    const parseResult = createClientSchema.safeParse(req.body);
+    if (!parseResult.success) {
+      res.status(400).json({ error: parseResult.error.errors[0].message });
+      return;
+    }
+
+    const { name, email, phone, assignedTeam, industry, notes } = parseResult.data;
+
+    if (assignedTeam) {
+      const teamUsers = await db.select().from(usersTable).where(eq(usersTable.team, assignedTeam));
+      if (teamUsers.length === 0) {
+        res.status(400).json({ error: "Assigned team does not exist" });
+        return;
+      }
+
+      if (!isAdmin(user)) {
+        if (assignedTeam !== user.team) {
+          res.status(403).json({ error: "Forbidden: You can only create clients for your team" });
+          return;
+        }
+      }
+    }
+
+    const clientNotes = [
+      notes,
+      email ? `Email: ${email}` : null,
+      phone ? `Phone: ${phone}` : null,
+      assignedTeam ? `Team: ${assignedTeam}` : null,
+    ].filter(Boolean).join("\n");
+
+    const [client] = await db.insert(clientsTable).values({
+      name,
+      industry: industry ?? null,
+      notes: clientNotes,
+      isActive: true,
+      createdByUserId: user.id,
+    }).returning();
+
+    logAudit({
+      userId: user.id,
+      action: "client_created",
+      entityType: "client",
+      entityId: client.id,
+      details: {
+        clientId: client.id,
+        name: client.name,
+        email,
+        phone: phone ?? null,
+        assignedTeam,
+        industry: client.industry,
+        notes: notes ?? null,
+        isActive: client.isActive,
+      },
+      req,
+    });
+
+    invalidateDashboardCache();
+    res.status(201).json(serializeClient(client, { totalTasks: 0, activeTasks: 0, completedTasks: 0 }));
+  } catch (err) {
+    req.log.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to create client");
+    res.status(500).json({ error: "Internal server error" });
+  }
+});
+
+router.get("/clients/:id", async (req: AuthRequest, res) => {
+  try {
+    const user = req.user as User;
+    const visibilityFilter = getTaskVisibilityFilter(user);
+    const id = parseInt(req.params.id as string);
+    const [client] = await db.select().from(clientsTable).where(eq(clientsTable.id, id));
+    if (!client) { res.status(404).json({ error: "Client not found" }); return; }
+
+    const tasks = await db.select().from(tasksTable).where(
+      and(eq(tasksTable.clientId, id), visibilityFilter)
+    ).orderBy(tasksTable.createdAt);
+
+    const total = tasks.length;
+    const active = tasks.filter(t => t.status === "in_progress").length;
+    const completed = tasks.filter(t => t.status === "completed").length;
+
+    const serializedTasks = tasks.map(t => ({
+      ...t,
+      dueDate: t.dueDate ? t.dueDate.toISOString() : null,
+      completedAt: t.completedAt ? t.completedAt.toISOString() : null,
+      createdAt: t.createdAt.toISOString(),
+      updatedAt: t.updatedAt.toISOString(),
+      createdByUser: null,
+      assignedUser: null,
+      commentCount: 0,
+      clientName: client.name,
+    }));
+
+    res.json(serializeClient(client, {
+      totalTasks: total,
+      activeTasks: active,
+      completedTasks: completed,
+      tasks: serializedTasks,
+    }));
+  } catch (err) {
+    req.log.error({ err }, "Failed to get client");
+    res.status(500).json({ error: "Internal server error" });
+  }
+});
+
+const updateClientSchema = z.object({
+  name: z.string().trim().min(1, "اسم العميل مطلوب").optional(),
+  email: z.string().trim().email("بريد إلكتروني غير صالح").optional().or(z.literal("")),
+  phone: z.string().trim().regex(/^\+?[0-9\s\-()]{7,20}$/, "رقم هاتف غير صالح").optional().or(z.literal("")),
+  assignedTeam: z.string().trim().optional(),
+  industry: z.string().trim().optional(),
+  notes: z.string().trim().optional(),
+  isActive: z.boolean().optional(),
+});
+
+const updateClientParamsSchema = z.object({
+  id: z.coerce.number().int().positive("معرف العميل غير صالح"),
+});
+
+router.patch("/clients/:id", requireAuth, requireManagerOrAdmin, async (req: AuthRequest, res) => {
+  try {
+    const user = req.user as User;
+    if (!user) { res.status(401).json({ error: "Unauthorized" }); return; }
+
+    if (isMember(user)) {
+      res.status(403).json({ error: "Forbidden: members cannot update clients" });
+      return;
+    }
+
+    const paramsResult = updateClientParamsSchema.safeParse({ id: req.params.id });
+    if (!paramsResult.success) {
+      res.status(400).json({ error: paramsResult.error.errors[0].message });
+      return;
+    }
+    const { id } = paramsResult.data;
+
+    const parseResult = updateClientSchema.safeParse(req.body);
+    if (!parseResult.success) {
+      res.status(400).json({ error: parseResult.error.errors[0].message });
+      return;
+    }
+    const body = parseResult.data;
+
+    const [existingClient] = await db.select().from(clientsTable).where(eq(clientsTable.id, id));
+    if (!existingClient) { res.status(404).json({ error: "Client not found" }); return; }
+
+    const oldNotesStr = existingClient.notes ?? "";
+    let oldEmail: string | null = null;
+    let oldPhone: string | null = null;
+    let oldTeam: string | null = null;
+    const emMatch = oldNotesStr.match(/Email:\s*([^\n]+)/);
+    if (emMatch) oldEmail = emMatch[1].trim();
+    const phMatch = oldNotesStr.match(/Phone:\s*([^\n]+)/);
+    if (phMatch) oldPhone = phMatch[1].trim();
+    const tmMatch = oldNotesStr.match(/Team:\s*([^\n]+)/);
+    if (tmMatch) oldTeam = tmMatch[1].trim();
+    const oldPureNotes = oldNotesStr.split("\n").filter(l => !l.startsWith("Email:") && !l.startsWith("Phone:") && !l.startsWith("Team:")).join("\n").trim();
+
+    if (!isAdmin(user)) {
+      if (oldTeam && oldTeam !== user.team) {
+        res.status(403).json({ error: "Forbidden: You can only update clients in your team" });
+        return;
+      }
+    }
+
+    if (body.assignedTeam !== undefined) {
+      const teamUsers = await db.select().from(usersTable).where(eq(usersTable.team, body.assignedTeam));
+      if (teamUsers.length === 0) {
+        res.status(400).json({ error: "Assigned team does not exist" });
+        return;
+      }
+    }
+
+    // Track changes for audit log
+    const changes: any = {};
+    if (body.name !== undefined && body.name !== existingClient.name) changes.name = { old: existingClient.name, new: body.name };
+    if (body.email !== undefined && body.email !== oldEmail) changes.email = { old: oldEmail, new: body.email };
+    if (body.phone !== undefined && body.phone !== oldPhone) changes.phone = { old: oldPhone, new: body.phone };
+    if (body.assignedTeam !== undefined && body.assignedTeam !== oldTeam) changes.assignedTeam = { old: oldTeam, new: body.assignedTeam };
+    if (body.industry !== undefined && body.industry !== existingClient.industry) changes.industry = { old: existingClient.industry, new: body.industry };
+    if (body.notes !== undefined && body.notes.trim() !== oldPureNotes) changes.notes = { old: oldPureNotes, new: body.notes.trim() };
+    if (body.isActive !== undefined && body.isActive !== existingClient.isActive) changes.isActive = { old: existingClient.isActive, new: body.isActive };
+
+    let updatedNotes = body.notes !== undefined ? body.notes : existingClient.notes;
+    if (body.email !== undefined || body.phone !== undefined || body.assignedTeam !== undefined) {
+      const lines = oldNotesStr.split("\n").filter(l => !l.startsWith("Email:") && !l.startsWith("Phone:") && !l.startsWith("Team:"));
+      
+      let emailVal = body.email;
+      if (emailVal === undefined) emailVal = oldEmail ?? undefined;
+      let phoneVal = body.phone;
+      if (phoneVal === undefined) phoneVal = oldPhone ?? undefined;
+      let teamVal = body.assignedTeam;
+      if (teamVal === undefined) teamVal = oldTeam ?? undefined;
+
+      const newMeta = [
+        emailVal ? `Email: ${emailVal}` : null,
+        phoneVal ? `Phone: ${phoneVal}` : null,
+        teamVal ? `Team: ${teamVal}` : null,
+      ].filter(Boolean);
+
+      updatedNotes = [...lines, ...newMeta].filter(Boolean).join("\n");
+    }
+
+    const updates: Partial<typeof clientsTable.$inferInsert> = {
+      updatedAt: new Date(),
+    };
+    if (body.name !== undefined) updates.name = body.name;
+    if (body.industry !== undefined) updates.industry = body.industry ?? null;
+    if (updatedNotes !== undefined) updates.notes = updatedNotes ?? null;
+    if (body.isActive !== undefined) updates.isActive = body.isActive;
+
+    const [client] = await db.update(clientsTable).set(updates).where(eq(clientsTable.id, id)).returning();
+    if (!client) { res.status(404).json({ error: "Client not found" }); return; }
+
+    invalidateDashboardCache();
+
+    if (Object.keys(changes).length > 0) {
+      logAudit({
+        userId: user.id,
+        action: "client_updated",
+        entityType: "client",
+        entityId: client.id,
+        details: {
+          clientId: client.id,
+          name: client.name,
+          changes,
+        },
+        req,
+      });
+    }
+
+    const [{ cnt: total }] = await db.select({ cnt: count() }).from(tasksTable).where(eq(tasksTable.clientId, id));
+    const [{ cnt: active }] = await db.select({ cnt: count() }).from(tasksTable).where(and(eq(tasksTable.clientId, id), eq(tasksTable.status, "in_progress")));
+    const [{ cnt: completed }] = await db.select({ cnt: count() }).from(tasksTable).where(and(eq(tasksTable.clientId, id), eq(tasksTable.status, "completed")));
+
+    res.json(serializeClient(client, {
+      totalTasks: Number(total),
+      activeTasks: Number(active),
+      completedTasks: Number(completed),
+    }));
+  } catch (err) {
+    req.log.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to update client");
+    res.status(500).json({ error: "Internal server error" });
+  }
+});
+
+router.delete("/clients/:id", requireAuth, requireAdmin, async (req: AuthRequest, res) => {
+  try {
+    const user = req.user as User;
+    if (!user) { res.status(401).json({ error: "Unauthorized" }); return; }
+
+    const id = parseInt(req.params.id as string);
+    if (isNaN(id)) {
+      res.status(400).json({ error: "معرف العميل غير صالح" });
+      return;
+    }
+
+    const [client] = await db.select().from(clientsTable).where(eq(clientsTable.id, id));
+    if (!client) {
+      res.status(404).json({ error: "العميل غير موجود" });
+      return;
+    }
+
+    // Delete all tasks associated with this client first (satisfies foreign key constraint)
+    await db.delete(tasksTable).where(eq(tasksTable.clientId, id));
+
+    // Delete client
+    await db.delete(clientsTable).where(eq(clientsTable.id, id));
+
+    invalidateDashboardCache();
+
+    logAudit({
+      userId: user.id,
+      action: "client_deleted",
+      entityType: "client",
+      entityId: id,
+      details: {
+        clientId: id,
+        name: client.name,
+      },
+      req,
+    });
+
+    res.status(200).json({ success: true, message: "تم حذف العميل بنجاح" });
+  } catch (err) {
+    req.log.error({ err: err instanceof Error ? err.message : String(err) }, "Failed to delete client");
+    res.status(500).json({ error: "Internal server error" });
+  }
+});
+
+export default router;