parking_solution/apps/server/src/routes/shift.ts

import type { FastifyInstance } from "fastify";
import { requirePermission, roleHasPermissions } from "../auth.js";
import { NoOpenShiftError, ShiftAlreadyOpenError, type ShiftService } from "../shift-service.js";

interface ShiftsQuery {
  /** Filter to one operator (admin-only; non-admins are forced to themselves). */
  operator?: string;
  /** ISO window over shift START time. */
  from?: string;
  to?: string;
}

// Shift endpoints (manned mode). The operator is the logged-in user; a shift is
// opened/closed explicitly (not time-based — see wiki/concepts/shift.md and
// local-jwt-auth.md "until logout"). End Shift signs a shift_z_report + prints it.

export async function shiftRoutes(app: FastifyInstance, shift: ShiftService): Promise<void> {
  // Reading the shift state vs. opening/closing one's own shift.
  const readGuard = requirePermission("shift:read");
  const guard = requirePermission("shift:create");

  // The SITE-WIDE shift state (at most one shift open at a time). The UI uses this
  // to render the header control: no shift → "Open"; my shift → "Close" (enabled);
  // someone else's shift → disabled. Also returns the live drawer balance.
  //  - open:    the open shift { startedAt, operator } or null (site-wide)
  //  - isMine:  true iff the open shift belongs to the requesting operator
  //  - operator: the requesting user (for the UI's own identity)
  app.get("/api/shift/current", { preHandler: readGuard }, async (req) => {
    const me = req.user.username;
    const open = shift.currentOpenShift();
    const heldBy = open?.identity ?? null;
    const drawer = shift.drawerBalance();
    return {
      operator: me,
      open: open ? { startedAt: open.occurredAt, operator: heldBy } : null,
      isMine: open != null && heldBy === me,
      drawerMinor: drawer.balanceMinor,
      currency: drawer.currency,
    };
  });

  // Mid-shift X-report: a READ-ONLY "so far" snapshot of the OPEN shift's takings +
  // drawer (opening float, cash/card taken, pay-ins/outs, expected drawer), computed
  // as of now. Appends nothing — it's not an accountability mark, just a projection
  // (the Z-report at close is the signed record). 204 when no shift is open.
  app.get("/api/shift/report", { preHandler: readGuard }, async (_req, reply) => {
    const report = shift.currentReport();
    if (!report) return reply.code(204).send();
    return report;
  });

  // Completed shift history. SCOPED by permission:
  //  - `shift:read` (operators) → own shifts only; operator/from/to params ignored.
  //  - `shift:cash` (admin-grade) → all operators, optionally filtered by
  //    `operator` and a `from`/`to` time window over each shift's START.
  // This keeps one operator from reading another's takings while letting admins
  // reconcile across the site. The data is the signed shift_z_report chain.
  app.get<{ Querystring: ShiftsQuery }>("/api/shifts", { preHandler: readGuard }, async (req) => {
    const canSeeAll = roleHasPermissions(req.user.roleId, ["shift:cash"]);
    const q = req.query ?? {};
    // Non-admins are hard-scoped to themselves regardless of any operator param.
    const operator = canSeeAll ? (q.operator?.trim() || undefined) : req.user.username;
    const from = canSeeAll ? q.from?.trim() || undefined : undefined;
    const to = canSeeAll ? q.to?.trim() || undefined : undefined;
    const shifts = shift.listShifts({ operator, from, to });
    // Admins also get the distinct operator list (unfiltered) for the filter
    // dropdown — operators don't see other names, so it's scope-gated.
    if (canSeeAll) return { shifts, scope: "all", operators: shift.listOperators() };
    return { shifts, scope: "self" };
  });

  // NB: drawer cash movements (record/review) moved to routes/drawer.ts (2026-07-01) — the
  // feature is no longer part of the shift route. See wiki/concepts/shift.md.

  app.post("/api/shift/open", { preHandler: guard }, async (req, reply) => {
    try {
      return await shift.open(req.user.username);
    } catch (err) {
      if (err instanceof ShiftAlreadyOpenError) return reply.code(409).send({ error: err.message });
      return reply.code(500).send({ error: (err as Error).message });
    }
  });

  app.post("/api/shift/close", { preHandler: guard }, async (req, reply) => {
    try {
      return await shift.close(req.user.username);
    } catch (err) {
      if (err instanceof NoOpenShiftError) return reply.code(409).send({ error: err.message });
      return reply.code(500).send({ error: (err as Error).message });
    }
  });
}