[PK-36] BE-7 Admin API: products/categories/promotions, stock, orders, inbox #15

Merged

forge-admin merged 1 commit from feature/PK-36-admin-api into main

2026-05-16 22:45:40 +00:00

forge-admin commented

2026-05-16 22:45:35 +00:00

Owner

Closes PK-36.

Admin API pre MASOX:

CRUD: products, categories, promotions
stock: prehľad + úprava skladu
orders: list, detail, mark-paid (potvrdiť pay-by-square platbu), mark-shipped, cancel (vráti sklad)
inbox: lokálne notifikácie pre admin (read/mark-all)

Auth: každý handler chránený admin guard-om (adminGuard cez session → role=admin). Autorizácia + validácia vstupov na hranici (UUID parse, rozsahy, slug regex), explicitný error handling, audit log v inbox-e.

Closes PK-36. Admin API pre MASOX: - CRUD: products, categories, promotions - stock: prehľad + úprava skladu - orders: list, detail, mark-paid (potvrdiť pay-by-square platbu), mark-shipped, cancel (vráti sklad) - inbox: lokálne notifikácie pre admin (read/mark-all) Auth: každý handler chránený admin guard-om (`adminGuard` cez session → role=admin). Autorizácia + validácia vstupov na hranici (UUID parse, rozsahy, slug regex), explicitný error handling, audit log v inbox-e.

forge-admin added 1 commit

2026-05-16 22:45:35 +00:00

[PK-36] BE-7 Admin API: products/categories/promotions, stock, orders, inbox 9480f932c3

Pridava /api/admin/* endpointy chranene `requireAdmin` z BE-2:

- Products: GET/POST/list, GET/PUT/DELETE/:id (DELETE = soft, active=false)
- Categories: GET/POST/list, PUT/DELETE/:id (hard delete blokovany ak ma produkty/sub-kategorie)
- Promotions: GET/POST/list, PUT/DELETE/:id + linkovanie POST/DELETE /products/:id/promotions[/:promo_id] (link idempotentny — 200 pri opakovani)
- Stock: GET zoznam, PUT /:product_id absolutne nastavenie + audit cez InboxNotification typu `stock_adjusted`
- Orders: GET list (status filter comma-separated, limit/offset paging), GET detail, mark-paid (idempotent — 409 already_paid), mark-shipped (len `paid` -> `shipped`), cancel (povolene z `pending|paid`, restock cez `lib/stock.restoreStock`, 409 zo `shipped`)
- Inbox: GET ?unread=true, POST /:id/read (idempotent), POST /read-all
- Vsetky write akcie atomicky cez `prisma.$transaction`, audit pole (paid_by_id, cancelled_by_id, admin_id v stock payload-e)
- Konzistentny error shape `{error, message, fields?}` na vsetkych endpointoch
- Validacia hand-rolled v `lib/adminValidation.ts` (rovnaky styl ako lib/auth.ts / lib/checkoutValidation.ts)
- Vytahnute `lib/stock.ts` (decrementStock + restoreStock primitives), `lib/orderService.ts` to teraz reusi-uje

Testy (37 noviadanych, vsetky 164 v repe prejdu):
- adminGuard: 401/403/200 triplet pre vsetky resource list endpointy
- adminCrud: CRUD happy path pre products, categories, promotions + idempotentny link/unlink + 409 na duplicit slug a kategoriu s produktami
- adminOrders: mark-paid idempotent (2. volanie 409 + ziadna druha notifikacia), mark-shipped state machine, cancel restocknuti overene DB read-om, cancel `shipped` -> 409, stock PUT audit log
- adminInbox: unread->read flow + read-all bulk + idempotencia /:id/read

Co-authored-by: multica-agent <github@multica.ai>