import type { FastifyInstance, FastifySchema } from 'fastify'; import type pg from 'pg'; import type { CurrentUser, Role } from '../../../shared/auth.js'; import { AppError } from '../../../shared/errors.js'; import { parseJson } from '../../../shared/http-input.js'; import { errorSchema } from '../../../shared/swagger.js'; import { requireRole, requireAnyRole } from '../../../shared/auth.js'; import { z } from 'zod'; import { ListStoresUseCase } from '../application/list-stores.js'; import { ListTerminalsUseCase } from '../application/list-terminals.js'; import { GetPosConfigUseCase } from '../application/get-pos-config.js'; import { OpenCashSessionUseCase } from '../application/open-cash-session.js'; import { CloseCashSessionUseCase } from '../application/close-cash-session.js'; import { sendCashCloseReport } from '../infrastructure/cash-close-mailer.js'; import { CreatePosSaleUseCase } from '../application/create-pos-sale.js'; import { ReceiveRestPaymentUseCase } from '../application/receive-rest-payment.js'; import { ApplyPosReturnUseCase } from '../application/apply-pos-return.js'; import { buildPosReceipt } from '../application/build-pos-receipt.js'; import { sendTransactionalEmail } from '../../notifications/index.js'; import { Argon2PasswordHasher } from '../../identity/index.js'; import { PgStoreRepository } from '../infrastructure/pg-store-repository.js'; import { PgTerminalRepository } from '../infrastructure/pg-terminal-repository.js'; import { PgPaymentMethodRepository } from '../infrastructure/pg-payment-method-repository.js'; import { PgCashSessionRepository } from '../infrastructure/pg-cash-session-repository.js'; export interface PosRouteDeps { pool: pg.Pool; authenticate: (request: import('fastify').FastifyRequest) => Promise; } const idParamSchema = z.object({ id: z.string().uuid() }); // Zod's strict UUID parser rejects the RFC nil UUID used by the seeded default // store. Store references accept the canonical UUID shape, including nil. const storeIdSchema = z .string() .regex(/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i); async function assertReceiptAccess( pool: pg.Pool, user: CurrentUser, terminalId: string | string[] | undefined, orderId: string, ): Promise { if (user.role === 'admin') return; if (typeof terminalId !== 'string') { throw new AppError(403, 'POS_TERMINAL_REQUIRED', 'El terminal vinculado es obligatorio'); } const result = await pool.query<{ allowed: boolean }>( `SELECT EXISTS ( SELECT 1 FROM orders_orders WHERE id = $1 AND source = 'pos' AND terminal_id = $2 ) AS allowed`, [orderId, terminalId], ); if (!result.rows[0]?.allowed) { throw new AppError(403, 'POS_RECEIPT_FORBIDDEN', 'El ticket pertenece a otro terminal'); } } /** * Resolves which store the admin POS settings page should target. * * Accepts the explicit `storeId` query value when present and well-formed; * otherwise falls back to the first active store. This keeps the admin * dashboard recoverable when the user lands on the page before the store * dropdown is hydrated or the dropdown value is somehow invalid (F-139). */ async function resolveStoreIdForReceipt( pool: pg.Pool, rawStoreId: string | undefined, ): Promise { if (rawStoreId && storeIdSchema.safeParse(rawStoreId).success) { return rawStoreId; } const fallback = await pool.query<{ id: string }>( `SELECT id FROM pos_stores WHERE active = true ORDER BY created_at ASC LIMIT 1`, ); const id = fallback.rows[0]?.id; if (!id) { throw new AppError(404, 'NO_ACTIVE_STORE', 'No hay tiendas activas configuradas'); } return id; } export async function registerPosRoutes(app: FastifyInstance, deps: PosRouteDeps) { const { pool, authenticate } = deps; const storeRepo = new PgStoreRepository(pool); const terminalRepo = new PgTerminalRepository(pool); const paymentMethodRepo = new PgPaymentMethodRepository(pool); const sessionRepo = new PgCashSessionRepository(pool); const createPosSale = new CreatePosSaleUseCase(pool); const receiveRestPayment = new ReceiveRestPaymentUseCase(pool); const applyPosReturn = new ApplyPosReturnUseCase(pool); const listStores = new ListStoresUseCase(storeRepo); const listTerminals = new ListTerminalsUseCase(terminalRepo); const getConfig = new GetPosConfigUseCase( storeRepo, terminalRepo, paymentMethodRepo, sessionRepo, ); const openSession = new OpenCashSessionUseCase(sessionRepo, terminalRepo); const closeSession = new CloseCashSessionUseCase(sessionRepo); // ── Admin: stores ───────────────────────────────────────────────────────── app.get( '/pos/admin/stores', { schema: { tags: ['POS Admin'], summary: 'List POS stores', querystring: { type: 'object', properties: { active: { type: 'boolean' } } }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { active } = request.query as { active?: boolean }; const result = await listStores.execute({ active }); return reply.send(result); }, ); app.post( '/pos/admin/stores', { schema: { tags: ['POS Admin'], summary: 'Create POS store', body: { type: 'object', required: ['name', 'slug'], properties: { name: { type: 'string', minLength: 1, maxLength: 200 }, slug: { type: 'string', pattern: '^[a-z0-9]+(?:-[a-z0-9]+)*$' }, address: { type: 'string' }, taxId: { type: 'string' }, contactEmail: { type: 'string' }, contactPhone: { type: 'string' }, receiptHeader: { type: 'string' }, receiptFooter: { type: 'string' }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = parseJson( z.object({ name: z.string().min(1).max(200), slug: z.string().regex(/^[a-z0-9]+(?:-[a-z0-9]+)*$/), address: z.string().optional(), taxId: z.string().optional(), contactEmail: z.string().optional(), contactPhone: z.string().optional(), receiptHeader: z.string().optional(), receiptFooter: z.string().optional(), logoUrl: z.string().url().max(500).optional(), }), request.body ?? {}, ); const result = await pool.query<{ id: string; name: string; slug: string; active: boolean }>( `INSERT INTO pos_stores (name, slug, address, tax_id, contact_email, contact_phone, receipt_header, receipt_footer, logo_url) VALUES ($1, $2, $3, $4, $5, $6, $7, $8, $9) RETURNING id, name, slug, active`, [ body.name, body.slug, body.address, body.taxId, body.contactEmail, body.contactPhone, body.receiptHeader, body.receiptFooter, body.logoUrl ?? null, ], ); return reply.code(201).send(result.rows[0]); }, ); // ── Admin: terminals ───────────────────────────────────────────────────── app.get( '/pos/admin/terminals', { schema: { tags: ['POS Admin'], summary: 'List POS terminals', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, status: { type: 'string', enum: ['active', 'disabled', 'decommissioned'] }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, status } = request.query as { storeId?: string; status?: string }; const result = await listTerminals.execute({ storeId, status: status as 'active' | 'disabled' | 'decommissioned' | undefined, }); return reply.send(result); }, ); app.post( '/pos/admin/terminals', { schema: { tags: ['POS Admin'], summary: 'Create POS terminal', body: { type: 'object', required: ['storeId', 'name'], properties: { storeId: { type: 'string', format: 'uuid' }, name: { type: 'string', minLength: 1, maxLength: 100 }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = parseJson( z.object({ storeId: storeIdSchema, name: z.string().min(1).max(100) }), request.body ?? {}, ); // Generate a short binding code (8 hex chars) const bindingCode = Math.random().toString(16).slice(2, 10).toUpperCase(); const result = await pool.query<{ id: string; name: string; bindingCode: string; storeId: string; }>( `INSERT INTO pos_terminals (store_id, name, binding_code) VALUES ($1, $2, $3) RETURNING id, name, binding_code as "bindingCode", store_id as "storeId"`, [body.storeId, body.name, bindingCode], ); return reply.code(201).send(result.rows[0]); }, ); app.get( '/pos/admin/catalog-products', { schema: { tags: ['POS Admin'], summary: 'Search products available for TPV touch configuration', querystring: { type: 'object', properties: { q: { type: 'string', minLength: 1, maxLength: 120 }, limit: { type: 'integer', minimum: 1, maximum: 40, default: 12 }, variantIds: { type: 'string' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const query = parseJson( z.object({ q: z.string().trim().min(1).max(120).optional(), limit: z.coerce.number().int().min(1).max(40).default(12), variantIds: z.string().optional(), }), request.query ?? {}, ); const variantIds = (query.variantIds ?? '') .split(',') .map((value) => value.trim()) .filter(Boolean); if (variantIds.some((value) => !storeIdSchema.safeParse(value).success)) { throw new AppError(400, 'INVALID_VARIANT_ID', 'Algún producto rápido no es válido'); } const result = variantIds.length > 0 ? await pool.query( `SELECT v.id AS "variantId", p.id AS "productId", p.name, v.sku, v.ean, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS "priceCents" FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE p.state = 'active' AND v.id = ANY($1::uuid[]) ORDER BY p.name, v.sku`, [variantIds], ) : await pool.query( `SELECT v.id AS "variantId", p.id AS "productId", p.name, v.sku, v.ean, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS "priceCents" FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE p.state = 'active' AND ($1::text IS NULL OR p.name ILIKE $1 OR v.sku ILIKE $1 OR COALESCE(v.ean, '') ILIKE $1) ORDER BY p.name, v.sku LIMIT $2`, [query.q ? `%${query.q}%` : null, query.limit], ); return reply.send({ items: result.rows }); }, ); app.patch<{ Params: { id: string } }>( '/pos/admin/terminals/:id/touch-config', { schema: { tags: ['POS Admin'], summary: 'Configure terminal touch navigation and quick products', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['touchNavigationEnabled', 'quickProductVariantIds'], properties: { touchNavigationEnabled: { type: 'boolean' }, quickProductVariantIds: { type: 'array', minItems: 8, maxItems: 8, items: { type: ['string', 'null'], format: 'uuid' }, }, lineDiscountsEnabled: { type: 'boolean' }, }, }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { id } = parseJson(idParamSchema, request.params); const body = parseJson( z.object({ touchNavigationEnabled: z.boolean(), quickProductVariantIds: z.array(z.string().uuid().nullable()).length(8), lineDiscountsEnabled: z.boolean().default(true), }), request.body ?? {}, ); const selected = body.quickProductVariantIds.filter( (value): value is string => value !== null, ); if (new Set(selected).size !== selected.length) { throw new AppError( 400, 'DUPLICATE_QUICK_PRODUCT', 'Cada acceso rápido debe usar un producto diferente', ); } if (selected.length > 0) { const valid = await pool.query<{ count: string }>( `SELECT COUNT(*)::text AS count FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id WHERE v.id = ANY($1::uuid[]) AND p.state = 'active'`, [selected], ); if (Number(valid.rows[0]?.count ?? 0) !== selected.length) { throw new AppError(400, 'INVALID_QUICK_PRODUCT', 'Algún producto rápido no está activo'); } } const result = await pool.query( `UPDATE pos_terminals SET interface_mode = CASE WHEN $2 THEN 'touch' ELSE 'auto' END, settings = COALESCE(settings, '{}'::jsonb) || jsonb_build_object( 'touchNavigationEnabled', $2::boolean, 'quickProductVariantIds', $3::jsonb, 'lineDiscountsEnabled', $4::boolean ), updated_at = now() WHERE id = $1 RETURNING *`, [ id, body.touchNavigationEnabled, JSON.stringify(body.quickProductVariantIds), body.lineDiscountsEnabled, ], ); if (!result.rows[0]) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal not found'); return reply.send({ ok: true }); }, ); app.get<{ Params: { id: string } }>( '/pos/admin/terminals/:id', { schema: { tags: ['POS Admin'], summary: 'Get terminal', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { id } = parseJson(idParamSchema, request.params); const terminal = await terminalRepo.findById(id); if (!terminal) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal not found'); return reply.send(terminal); }, ); // POS-FIX-5: update terminal settings (selfpay, close PIN, etc.) app.patch<{ Params: { id: string } }>( '/pos/admin/terminals/:id', { schema: { tags: ['POS Admin'], summary: 'Update terminal settings', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: [], properties: { name: { type: 'string', minLength: 1, maxLength: 100 }, interfaceMode: { type: 'string', enum: ['desktop', 'touch', 'auto'] }, settings: { type: 'object', properties: { selfpayMode: { type: 'boolean' }, closeSessionRequiresPin: { type: 'boolean' }, closeSessionPin: { type: 'string', maxLength: 6 }, }, additionalProperties: true, }, }, }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { id } = parseJson(idParamSchema, request.params); const body = parseJson( z.object({ name: z.string().min(1).max(100).optional(), interfaceMode: z.enum(['desktop', 'touch', 'auto']).optional(), settings: z.object({ selfpayMode: z.boolean().optional(), closeSessionRequiresPin: z.boolean().optional(), closeSessionPin: z.string().max(6).optional(), }).passthrough().optional(), }), request.body ?? {}, ); const existing = await terminalRepo.findById(id); if (!existing) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal no encontrado'); const mergedSettings = body.settings ? { ...existing.settings, ...body.settings } : existing.settings; await terminalRepo.update(id, { name: body.name, interfaceMode: body.interfaceMode, settings: mergedSettings, }); const updated = await terminalRepo.findById(id); return reply.send(updated); }, ); app.delete<{ Params: { id: string } }>( '/pos/admin/terminals/:id', { schema: { tags: ['POS Admin'], summary: 'Decommission terminal', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { id } = parseJson(idParamSchema, request.params); await pool.query(`UPDATE pos_terminals SET status = 'decommissioned' WHERE id = $1`, [id]); return reply.send({ ok: true }); }, ); // ── Terminal: me + bind + config ─────────────────────────────────────── app.get( '/pos/terminals/me', { schema: { tags: ['POS Terminal'], summary: 'Get current terminal info', headers: { type: 'object', properties: { 'x-terminal-id': { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const terminalId = request.headers['x-terminal-id'] as string | undefined; if (!terminalId) throw new AppError(400, 'MISSING_TERMINAL_ID', 'x-terminal-id header required'); const terminal = await terminalRepo.findById(terminalId); if (!terminal) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal not found'); return reply.send(terminal); }, ); app.post( '/pos/terminals/bind', { schema: { tags: ['POS Terminal'], summary: 'Bind terminal with code', body: { type: 'object', required: ['bindingCode'], properties: { bindingCode: { type: 'string', minLength: 8, maxLength: 8 } }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body = parseJson(z.object({ bindingCode: z.string().length(8) }), request.body ?? {}); const terminal = await terminalRepo.findByBindingCode(body.bindingCode.toUpperCase()); if (!terminal) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal not found'); if (terminal.status !== 'active') throw new AppError(409, 'TERMINAL_NOT_ACTIVE', 'Terminal is not active'); const bound = await terminalRepo.bind(terminal.id, body.bindingCode.toUpperCase()); return reply.send({ terminalId: bound.id, storeId: bound.storeId }); }, ); app.get( '/pos/config', { schema: { tags: ['POS Terminal'], summary: 'Get POS terminal config', headers: { type: 'object', properties: { 'x-terminal-id': { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const terminalId = request.headers['x-terminal-id'] as string | undefined; if (!terminalId) throw new AppError(400, 'MISSING_TERMINAL_ID', 'x-terminal-id header required'); const config = await getConfig.execute(terminalId); return reply.send(config); }, ); // ── Cash sessions ─────────────────────────────────────────────────────── app.get( '/pos/sessions/me', { schema: { tags: ['POS Terminal'], summary: 'Get current open session', headers: { type: 'object', properties: { 'x-terminal-id': { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const terminalId = request.headers['x-terminal-id'] as string | undefined; if (!terminalId) throw new AppError(400, 'MISSING_TERMINAL_ID', 'x-terminal-id header required'); const session = await sessionRepo.findOpenByTerminal(terminalId); if (!session) throw new AppError(404, 'SESSION_NOT_FOUND', 'No open session'); return reply.send(session); }, ); app.post( '/pos/sessions', { schema: { tags: ['POS Terminal'], summary: 'Open cash session', headers: { type: 'object', properties: { 'x-terminal-id': { type: 'string', format: 'uuid' } }, }, body: { type: 'object', required: ['openingCashCents'], properties: { openingCashCents: { type: 'integer', minimum: 0 } }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const terminalId = request.headers['x-terminal-id'] as string | undefined; if (!terminalId) throw new AppError(400, 'MISSING_TERMINAL_ID', 'x-terminal-id header required'); const body = parseJson( z.object({ openingCashCents: z.number().int().min(0) }), request.body ?? {}, ); try { const session = await openSession.execute({ terminalId, userId: user.id, openingCashCents: body.openingCashCents, }); return reply.code(201).send(session); } catch (err) { if (err instanceof AppError) throw err; throw new AppError(409, 'SESSION_ERROR', String(err)); } }, ); app.post<{ Params: { id: string } }>( '/pos/sessions/:id/close', { schema: { tags: ['POS Terminal'], summary: 'Close cash session', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['closingCashCents', 'actualCashCents'], properties: { closingCashCents: { type: 'integer', minimum: 0 }, actualCashCents: { type: 'integer', minimum: 0 }, notes: { type: 'string' }, pin: { type: 'string' }, }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const body = parseJson( z.object({ closingCashCents: z.number().int().min(0), actualCashCents: z.number().int().min(0), notes: z.string().optional(), pin: z.string().optional(), }), request.body ?? {}, ); // POS-FIX-5: validate PIN if terminal requires it const session = await sessionRepo.findById(id); if (!session) throw new AppError(404, 'SESSION_NOT_FOUND', 'Session not found'); if (session.terminalId) { const terminal = await terminalRepo.findById(session.terminalId); if (terminal?.settings?.closeSessionRequiresPin) { const storedPin = terminal.settings.closeSessionPin as string | undefined; if (!storedPin || body.pin !== storedPin) { throw new AppError(401, 'INVALID_PIN', 'PIN de cajero incorrecto'); } } } try { const result = await closeSession.execute({ sessionId: id, ...body }); // F-202: send cash close report email (best-effort) void sendCashCloseReport(pool, { sessionId: result.id, storeId: result.storeId, terminalId: result.terminalId, openedAt: result.openedAt, closedAt: result.closedAt ?? new Date(), userId: result.userId, financial: { openingCashCents: result.openingCashCents, closingCashCents: result.closingCashCents ?? 0, actualCashCents: result.actualCashCents ?? 0, expectedCashCents: result.closingCashCents ?? 0, differenceCents: result.differenceCents ?? 0, }, sales: { totalCount: 0, completedCount: 0, completedTotalCents: 0, pendingCount: 0, refundedCount: 0, refundedTotalCents: 0, byState: {} }, payments: [], items: { soldCount: 0, uniqueProducts: 0 }, }).catch(err => console.error('[cash-close] email failed:', err)); return reply.send(result); } catch (err) { if (err instanceof AppError) throw err; throw new AppError(409, 'CLOSE_ERROR', String(err)); } }, ); // F-191: get session by ID (includes closed sessions) with summary metrics app.get<{ Params: { id: string } }>( '/pos/sessions/:id', { schema: { tags: ['POS Terminal'], summary: 'Get session details and summary', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const session = await sessionRepo.findById(id); if (!session) throw new AppError(404, 'SESSION_NOT_FOUND', 'Sesión no encontrada'); // Summary: sales count, revenue, pending count for this session const [salesResult, pendingResult] = await Promise.all([ pool.query<{ cnt: string; total: string }>( `SELECT COUNT(*)::int AS cnt, COALESCE(SUM(total_cents), 0)::bigint AS total FROM orders_orders WHERE cash_session_id = $1 AND source = 'pos'`, [id], ), pool.query<{ cnt: string }>( `SELECT COUNT(*)::int AS cnt FROM orders_orders WHERE cash_session_id = $1 AND source = 'pos' AND state = 'PENDING'`, [id], ), ]); // F-201: extend with payment method breakdown + items sold + sales by state const [byStateResult, paymentResult, itemsResult] = await Promise.all([ pool.query<{ state: string; cnt: string; total: string }>( `SELECT state, COUNT(*)::int AS cnt, COALESCE(SUM(total_cents), 0)::bigint AS total FROM orders_orders WHERE cash_session_id = $1 AND source = 'pos' GROUP BY state`, [id], ), pool.query<{ method_code: string; method_name: string; total: string; count: string }>( `SELECT pm.code AS method_code, pm.label AS method_name, COALESCE(SUM(rpl.amount_cents), 0)::bigint AS total, COUNT(*)::int AS count FROM reporting_payment_lines rpl LEFT JOIN pos_payment_methods pm ON pm.id = rpl.payment_method_id WHERE rpl.cash_session_id = $1 AND rpl.status = 'payment' GROUP BY pm.code, pm.label`, [id], ), pool.query<{ items_count: string; unique_products: string }>( `SELECT COALESCE(SUM(oi.quantity), 0)::bigint AS items_count, COUNT(DISTINCT oi.variant_id)::int AS unique_products FROM orders_items oi JOIN orders_orders o ON o.id = oi.order_id WHERE o.cash_session_id = $1 AND o.source = 'pos'`, [id], ), ]); const salesByState = byStateResult.rows.reduce((acc, r) => { acc[r.state] = { count: parseInt(r.cnt, 10), totalCents: parseInt(r.total, 10) }; return acc; }, {} as Record); const paymentsByMethod = paymentResult.rows.map(r => ({ methodCode: r.method_code ?? 'unknown', methodName: r.method_name ?? 'Otro', totalCents: parseInt(r.total, 10), count: parseInt(r.count, 10), })); return reply.send({ ...session, salesCount: parseInt(salesResult.rows[0]?.cnt ?? '0', 10), salesTotalCents: parseInt(salesResult.rows[0]?.total ?? '0', 10), salesByState, paymentsByMethod, itemsSold: parseInt(itemsResult.rows[0]?.items_count ?? '0', 10), uniqueProductsSold: parseInt(itemsResult.rows[0]?.unique_products ?? '0', 10), pendingCount: parseInt(pendingResult.rows[0]?.cnt ?? '0', 10), }); }, ); // F-201: dedicated cash close report endpoint app.get<{ Params: { id: string } }>( '/pos/reports/cash-close/:id', { schema: { tags: ['POS Admin'], summary: 'Cash close report for a closed session', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const session = await sessionRepo.findById(id); if (!session) throw new AppError(404, 'SESSION_NOT_FOUND', 'Sesión no encontrada'); const [salesResult, paymentResult, itemsResult] = await Promise.all([ pool.query<{ state: string; cnt: string; total: string }>( `SELECT state, COUNT(*)::int AS cnt, COALESCE(SUM(total_cents), 0)::bigint AS total FROM orders_orders WHERE cash_session_id = $1 AND source = 'pos' GROUP BY state`, [id], ), pool.query<{ method_code: string; method_name: string; total: string; count: string }>( `SELECT pm.code AS method_code, pm.label AS method_name, COALESCE(SUM(rpl.amount_cents), 0)::bigint AS total, COUNT(*)::int AS count FROM reporting_payment_lines rpl LEFT JOIN pos_payment_methods pm ON pm.id = rpl.payment_method_id WHERE rpl.cash_session_id = $1 AND rpl.status = 'payment' GROUP BY pm.code, pm.label`, [id], ), pool.query<{ items_count: string; unique_products: string }>( `SELECT COALESCE(SUM(oi.quantity), 0)::bigint AS items_count, COUNT(DISTINCT oi.variant_id)::int AS unique_products FROM orders_items oi JOIN orders_orders o ON o.id = oi.order_id WHERE o.cash_session_id = $1 AND o.source = 'pos'`, [id], ), ]); const salesByState = salesResult.rows.reduce((acc, r) => { acc[r.state] = { count: parseInt(r.cnt, 10), totalCents: parseInt(r.total, 10) }; return acc; }, {} as Record); const completedTotal = salesByState['COMPLETED']?.totalCents ?? 0; const openingCash = session.openingCashCents; const actualCash = session.actualCashCents ?? 0; const closingCash = session.closingCashCents ?? 0; // Expected cash = opening + cash payments only (not total sales) const cashPaymentsTotal = paymentResult.rows .filter(p => p.method_code === 'cash' || p.method_code === 'efectivo') .reduce((sum, p) => sum + parseInt(p.total, 10), 0); const realExpectedCash = openingCash + cashPaymentsTotal; const difference = actualCash - realExpectedCash; return reply.send({ session: { id: session.id, openedAt: session.openedAt, closedAt: session.closedAt, userId: session.userId, status: session.status, }, storeId: session.storeId, terminalId: session.terminalId, financial: { openingCashCents: openingCash, closingCashCents: closingCash, actualCashCents: actualCash, expectedCashCents: realExpectedCash, differenceCents: difference, }, sales: { totalCount: Object.values(salesByState).reduce((s, v) => s + v.count, 0), completedCount: salesByState['COMPLETED']?.count ?? 0, completedTotalCents: completedTotal, pendingCount: salesByState['PENDING']?.count ?? 0, refundedCount: salesByState['REFUNDED']?.count ?? 0, refundedTotalCents: salesByState['REFUNDED']?.totalCents ?? 0, byState: salesByState, }, payments: paymentResult.rows.map(r => ({ methodCode: r.method_code ?? 'unknown', methodName: r.method_name ?? 'Otro', totalCents: parseInt(r.total, 10), transactionCount: parseInt(r.count, 10), })), items: { soldCount: parseInt(itemsResult.rows[0]?.items_count ?? '0', 10), uniqueProducts: parseInt(itemsResult.rows[0]?.unique_products ?? '0', 10), }, }); }, ); app.get( '/pos/catalog/touch', { schema: { tags: ['POS Terminal'], summary: 'Get category navigation and quick products for the bound terminal', headers: { type: 'object', required: ['x-terminal-id'], properties: { 'x-terminal-id': { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const terminalId = request.headers['x-terminal-id'] as string | undefined; if (!terminalId) throw new AppError(400, 'MISSING_TERMINAL_ID', 'x-terminal-id header required'); const terminalResult = await pool.query<{ store_id: string; settings: Record; }>(`SELECT store_id, settings FROM pos_terminals WHERE id = $1 AND status = 'active'`, [ terminalId, ]); const terminal = terminalResult.rows[0]; if (!terminal) throw new AppError(404, 'TERMINAL_NOT_FOUND', 'Terminal not found'); const [categoryResult, productResult] = await Promise.all([ pool.query( `SELECT id, parent_id AS "parentId", name, emoji, bg_color AS "bgColor", text_color AS "textColor" FROM categories_categories ORDER BY name`, ), pool.query( `SELECT v.id AS "variantId", p.id AS "productId", p.name, v.sku, v.ean, pc.category_id AS "categoryId", COALESCE(stock.quantity, 0) AS stock, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS "priceCents" FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN catalog_product_categories pc ON pc.product_id = p.id LEFT JOIN LATERAL ( SELECT COALESCE(SUM(available), 0)::int AS quantity FROM inventory_stock WHERE variant_id = v.id AND store_id = $1 ) stock ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE p.state = 'active' ORDER BY p.name, v.sku`, [terminal.store_id], ), ]); const configured = Array.isArray(terminal.settings?.quickProductVariantIds) ? terminal.settings.quickProductVariantIds : Array.from({ length: 8 }, () => null); const uniqueProducts = new Map>(); for (const row of productResult.rows as Array>) { if (!uniqueProducts.has(String(row.variantId))) uniqueProducts.set(String(row.variantId), row); } return reply.send({ enabled: terminal.settings?.touchNavigationEnabled !== false, categories: categoryResult.rows, products: productResult.rows, quickProducts: Array.from({ length: 8 }, (_, slot) => { const variantId = configured[slot]; return typeof variantId === 'string' ? (uniqueProducts.get(variantId) ?? null) : null; }), }); }, ); // ── POS-005: Product search ─────────────────────────────────────────────── app.get( '/pos/products/search', { schema: { tags: ['POS Terminal'], summary: 'Search products for POS', querystring: { type: 'object', properties: { q: { type: 'string', minLength: 1 }, storeId: { type: 'string', format: 'uuid' }, limit: { type: 'integer', minimum: 1, maximum: 50, default: 20 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { q, storeId, limit = 20, } = request.query as { q?: string; storeId?: string; limit?: number }; if (!q || q.trim().length < 2) throw new AppError(400, 'INVALID_QUERY', 'Query must be at least 2 characters'); const result = await pool.query( `SELECT v.id AS variant_id, v.product_id, p.name, v.sku, v.ean, COALESCE(s.quantity, 0) AS stock, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS price_cents, c.name AS category, b.name AS brand FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN LATERAL ( SELECT COALESCE(SUM(available), 0)::int AS quantity FROM inventory_stock WHERE variant_id = v.id AND ($3::uuid IS NULL OR store_id = $3) ) s ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' LEFT JOIN LATERAL ( SELECT category.name FROM catalog_product_categories pc JOIN categories_categories category ON category.id = pc.category_id WHERE pc.product_id = p.id ORDER BY category.name LIMIT 1 ) c ON true LEFT JOIN brands_brands b ON b.id = p.brand_id WHERE (p.name ILIKE $1 OR v.sku ILIKE $1 OR v.ean ILIKE $1) AND p.state = 'active' ORDER BY p.name LIMIT $2`, [`%${q.trim()}%`, limit, storeId ?? null], ); return reply.send({ items: result.rows.map((r) => ({ variantId: r.variant_id, productId: r.product_id, name: r.name, sku: r.sku, ean: r.ean, stock: r.stock, priceCents: r.price_cents, category: r.category, brand: r.brand, })), }); }, ); app.get<{ Params: { ean: string } }>( '/pos/products/by-ean/:ean', { schema: { tags: ['POS Terminal'], summary: 'Get product by EAN', params: { type: 'object', properties: { ean: { type: 'string' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { ean } = request.params; const result = await pool.query( `SELECT v.id AS variant_id, v.product_id, p.name, v.sku, v.ean, COALESCE(s.quantity, 0) AS stock, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS price_cents FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN LATERAL ( SELECT COALESCE(SUM(available), 0)::int AS quantity FROM inventory_stock WHERE variant_id = v.id ) s ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE v.ean = $1 AND p.state = 'active' LIMIT 1`, [ean], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Product not found'); const r = result.rows[0]; return reply.send({ variantId: r.variant_id, productId: r.product_id, name: r.name, sku: r.sku, ean: r.ean, stock: r.stock, priceCents: r.price_cents, }); }, ); app.get<{ Params: { sku: string } }>( '/pos/products/by-sku/:sku', { schema: { tags: ['POS Terminal'], summary: 'Get product by SKU', params: { type: 'object', properties: { sku: { type: 'string' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { sku } = request.params; const result = await pool.query( `SELECT v.id AS variant_id, v.product_id, p.name, v.sku, v.ean, COALESCE(s.quantity, 0) AS stock, COALESCE(pp.offer_cents, pp.net_unit_amount_cents, 0) AS price_cents FROM catalog_product_variants v JOIN catalog_products p ON p.id = v.product_id LEFT JOIN LATERAL ( SELECT COALESCE(SUM(available), 0)::int AS quantity FROM inventory_stock WHERE variant_id = v.id ) s ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE v.sku = $1 AND p.state = 'active' LIMIT 1`, [sku], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Product not found'); const r = result.rows[0]; return reply.send({ variantId: r.variant_id, productId: r.product_id, name: r.name, sku: r.sku, ean: r.ean, stock: r.stock, priceCents: r.price_cents, }); }, ); // ── POS-005: Admin payment methods ─────────────────────────────────────── app.get<{ Params: { storeId: string } }>( '/pos/admin/payment-methods', { schema: { tags: ['POS Admin'], summary: 'List payment methods', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId } = parseJson(z.object({ storeId: storeIdSchema }), request.query); const methods = await pool.query( `SELECT id, store_id AS "storeId", code, label, kind, active, sort_order AS "sortOrder", config, created_at AS "createdAt", updated_at AS "updatedAt" FROM pos_payment_methods WHERE store_id = $1 ORDER BY sort_order, label`, [storeId], ); return reply.send({ items: methods.rows }); }, ); app.post( '/pos/admin/payment-methods', { schema: { tags: ['POS Admin'], summary: 'Create payment method', body: { type: 'object', required: ['storeId', 'code', 'label', 'kind'], properties: { storeId: { type: 'string', format: 'uuid' }, code: { type: 'string', minLength: 1, maxLength: 32 }, label: { type: 'string', minLength: 1, maxLength: 64 }, kind: { type: 'string', enum: ['cash', 'card', 'other'] }, active: { type: 'boolean', default: true }, sortOrder: { type: 'integer', default: 0 }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = parseJson( z.object({ storeId: storeIdSchema, code: z .string() .trim() .toLowerCase() .regex(/^[a-z0-9_-]{1,32}$/), label: z.string().min(1).max(64), kind: z.enum(['cash', 'card', 'other']), active: z.boolean().default(true), sortOrder: z.number().int().default(0), }), request.body ?? {}, ); try { const result = await pool.query( `INSERT INTO pos_payment_methods (store_id, code, label, kind, active, sort_order) VALUES ($1, $2, $3, $4, $5, $6) RETURNING id, store_id AS "storeId", code, label, kind, active, sort_order AS "sortOrder"`, [body.storeId, body.code, body.label, body.kind, body.active, body.sortOrder], ); return reply.code(201).send(result.rows[0]); } catch (err: unknown) { if ((err as Record).code === '23505') throw new AppError(409, 'DUPLICATE', 'Code already exists'); throw err; } }, ); app.patch<{ Params: { id: string } }>( '/pos/admin/payment-methods/:id', { schema: { tags: ['POS Admin'], summary: 'Update payment method', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', properties: { label: { type: 'string' }, active: { type: 'boolean' }, sortOrder: { type: 'integer' }, }, }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { id } = request.params; const body = (request.body ?? {}) as Record; const sets: string[] = []; const vals: unknown[] = []; if (body.label !== undefined) { vals.push(body.label); sets.push(`label = $${vals.length}`); } if (body.active !== undefined) { vals.push(body.active); sets.push(`active = $${vals.length}`); } if (body.sortOrder !== undefined) { vals.push(body.sortOrder); sets.push(`sort_order = $${vals.length}`); } if (sets.length === 0) return reply.send({ ok: true }); vals.push(id); const result = await pool.query( `UPDATE pos_payment_methods SET ${sets.join(', ')}, updated_at = now() WHERE id = $${vals.length} RETURNING *`, vals, ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Payment method not found'); return reply.send(result.rows[0]); }, ); app.get( '/pos/admin/receipt-settings', { schema: { tags: ['POS Admin'], summary: 'Get company and receipt numbering settings', querystring: { type: 'object', properties: { storeId: { type: 'string' } }, }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const rawStoreId = (request.query as { storeId?: string }).storeId; // F-139: the admin POS page can land before the store dropdown has a // selection. Fall back to the first active store so the UI never sees a // 400 caused by an empty querystring. const storeId = await resolveStoreIdForReceipt(pool, rawStoreId); await pool.query( `INSERT INTO pos_receipt_settings (store_id) VALUES ($1) ON CONFLICT (store_id) DO NOTHING`, [storeId], ); const result = await pool.query( `SELECT store.id AS "storeId", store.name, store.address, store.tax_id AS "taxId", store.contact_email AS "contactEmail", store.contact_phone AS "contactPhone", store.receipt_header AS "receiptHeader", store.receipt_footer AS "receiptFooter", receipt.prefix, receipt.next_number::float8 AS "nextNumber", receipt.padding, receipt.return_policy AS "returnPolicy" FROM pos_stores store JOIN pos_receipt_settings receipt ON receipt.store_id = store.id WHERE store.id = $1`, [storeId], ); if (!result.rows[0]) throw new AppError(404, 'STORE_NOT_FOUND', 'No se encontró la tienda'); return reply.send(result.rows[0]); }, ); app.patch( '/pos/admin/receipt-settings', { schema: { tags: ['POS Admin'], summary: 'Update company and receipt numbering settings', body: { type: 'object', required: ['storeId'], properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = parseJson( z.object({ storeId: storeIdSchema, name: z.string().trim().min(1).max(200).optional(), address: z.string().trim().max(500).optional(), taxId: z.string().trim().max(64).optional(), contactEmail: z.union([z.string().trim().email(), z.literal('')]).optional(), contactPhone: z.string().trim().max(64).optional(), receiptHeader: z.string().trim().max(500).optional(), receiptFooter: z.string().trim().max(1000).optional(), logoUrl: z.string().url().max(500).optional(), prefix: z .string() .trim() .regex(/^[A-Za-z0-9_-]{1,16}$/) .optional(), nextNumber: z.number().int().min(1).max(Number.MAX_SAFE_INTEGER).optional(), padding: z.number().int().min(1).max(12).optional(), returnPolicy: z.string().trim().min(1).max(2000).optional(), }), request.body ?? {}, ); const client = await pool.connect(); try { await client.query('BEGIN'); const store = await client.query( `UPDATE pos_stores SET name = COALESCE($2, name), address = COALESCE($3, address), tax_id = COALESCE($4, tax_id), contact_email = COALESCE($5, contact_email), contact_phone = COALESCE($6, contact_phone), receipt_header = COALESCE($7, receipt_header), receipt_footer = COALESCE($8, receipt_footer), logo_url = $9, updated_at = now() WHERE id = $1 RETURNING id`, [ body.storeId, body.name, body.address, body.taxId, body.contactEmail, body.contactPhone, body.receiptHeader, body.receiptFooter, body.logoUrl ?? null, ], ); if (!store.rows[0]) throw new AppError(404, 'STORE_NOT_FOUND', 'No se encontró la tienda'); await client.query( `INSERT INTO pos_receipt_settings (store_id, prefix, next_number, padding, return_policy) VALUES ($1, COALESCE($2, 'TPV'), COALESCE($3, 1), COALESCE($4, 6), COALESCE($5, 'Se admiten devoluciones durante 15 días con el ticket de compra.')) ON CONFLICT (store_id) DO UPDATE SET prefix = COALESCE($2, pos_receipt_settings.prefix), next_number = COALESCE($3, pos_receipt_settings.next_number), padding = COALESCE($4, pos_receipt_settings.padding), return_policy = COALESCE($5, pos_receipt_settings.return_policy), updated_at = now()`, [body.storeId, body.prefix, body.nextNumber, body.padding, body.returnPolicy], ); await client.query('COMMIT'); return reply.send({ ok: true }); } catch (error) { await client.query('ROLLBACK'); throw error; } finally { client.release(); } }, ); // ── POS-008: POST /pos/sales idempotent ─────────────────────────────────── app.post( '/pos/sales', { schema: { tags: ['POS Terminal'], summary: 'Confirm a POS sale with complete payment allocation', body: { type: 'object', required: ['idempotencyKey', 'cashSessionId', 'terminalId', 'items', 'payments'], properties: { idempotencyKey: { type: 'string', minLength: 1, maxLength: 128 }, cashSessionId: { type: 'string', format: 'uuid' }, terminalId: { type: 'string', format: 'uuid' }, items: { type: 'array', minItems: 1, items: { type: 'object' } }, payments: { type: 'array', minItems: 0, items: { type: 'object' } }, customerId: { type: 'string', format: 'uuid' }, posLabel: { type: 'string', maxLength: 100 }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema, }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const stockLine = z.object({ kind: z.literal('stock').optional(), variantId: z.string().uuid(), quantity: z.number().int().min(1), discountCents: z.number().int().min(0).optional(), }); const freeLine = z.object({ kind: z.literal('free'), name: z.string().trim().min(1).max(200), unitPriceCents: z.number().int().min(1), quantity: z.number().int().min(1).max(999), }); const payment = z .object({ methodCode: z .string() .regex(/^[a-z0-9_-]{1,32}$/) .optional(), kind: z.enum(['cash', 'card', 'other']).optional(), amountCents: z.number().int().min(1), tenderedCents: z.number().int().min(0).optional(), last4: z .string() .regex(/^\d{1,4}$/) .optional(), }) .refine((value) => Boolean(value.methodCode || value.kind), { message: 'methodCode is required', }); const body = parseJson( z.object({ idempotencyKey: z.string().min(1).max(128), cashSessionId: z.string().uuid(), terminalId: z.string().uuid(), items: z.array(z.union([freeLine, stockLine])).min(1), payments: z.array(payment).min(0), customerId: z.string().uuid().optional(), posLabel: z.string().max(100).optional(), }), request.body ?? {}, ); const boundTerminalId = request.headers['x-terminal-id']; if (typeof boundTerminalId !== 'string' || boundTerminalId !== body.terminalId) { throw new AppError( 403, 'POS_TERMINAL_MISMATCH', 'La venta no pertenece al terminal vinculado', ); } const result = await createPosSale.execute({ ...body, userId: user.id }); return reply.code(201).send(result); }, ); // ── POS-009: Customer search for POS ────────────────────────────────────── app.get( '/pos/customers/search', { schema: { tags: ['POS Terminal'], summary: 'Search customers for POS association', querystring: { type: 'object', properties: { q: { type: 'string', minLength: 2 }, limit: { type: 'integer', minimum: 1, maximum: 20, default: 10 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { q, limit = 10 } = request.query as { q?: string; limit?: number }; if (!q || q.trim().length < 2) return reply.send({ items: [] }); const result = await pool.query( `SELECT u.id, u.email, p.display_name AS "displayName", COALESCE(p.phone, u.phone) AS phone FROM identity_users u LEFT JOIN users_profiles p ON p.user_id = u.id WHERE u.role = 'customer' AND (u.email ILIKE $1 OR p.display_name ILIKE $1 OR p.phone ILIKE $1 OR u.phone ILIKE $1) ORDER BY p.display_name NULLS LAST, u.email LIMIT $2`, [`%${q.trim()}%`, limit], ); return reply.send({ items: result.rows }); }, ); app.post( '/pos/customers', { schema: { tags: ['POS Terminal'], summary: 'Create a customer from POS', body: { type: 'object', required: ['email'], properties: { email: { type: 'string', format: 'email' }, displayName: { type: 'string', maxLength: 160 }, phone: { type: 'string', maxLength: 40 }, }, }, response: { 401: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body = parseJson( z.object({ email: z .string() .trim() .email() .transform((value) => value.toLowerCase()), displayName: z.string().trim().min(1).max(160).optional(), phone: z.string().trim().min(1).max(40).optional(), }), request.body ?? {}, ); const existing = await pool.query('SELECT id FROM identity_users WHERE lower(email) = $1', [ body.email, ]); if (existing.rows[0]) throw new AppError(409, 'CUSTOMER_EXISTS', 'Ya existe un cliente con ese email'); const { randomBytes } = await import('node:crypto'); const passwordHash = await new Argon2PasswordHasher().hash(randomBytes(32).toString('hex')); const client = await pool.connect(); try { await client.query('BEGIN'); const created = await client.query<{ id: string; email: string }>( `INSERT INTO identity_users (email, password_hash, role, phone) VALUES ($1, $2, 'customer', $3) RETURNING id, email`, [body.email, passwordHash, body.phone ?? null], ); const customer = created.rows[0]; if (!customer) throw new AppError(500, 'CUSTOMER_CREATE_FAILED', 'No se pudo crear el cliente'); await client.query( `INSERT INTO users_profiles (user_id, display_name, phone) VALUES ($1, $2, $3) ON CONFLICT (user_id) DO UPDATE SET display_name = EXCLUDED.display_name, phone = EXCLUDED.phone`, [customer.id, body.displayName ?? null, body.phone ?? null], ); await client.query('COMMIT'); return reply .code(201) .send({ ...customer, displayName: body.displayName ?? null, phone: body.phone ?? null }); } catch (error) { await client.query('ROLLBACK'); throw error; } finally { client.release(); } }, ); app.get<{ Params: { id: string } }>( '/pos/customers/:id', { schema: { tags: ['POS Terminal'], summary: 'Get customer details for POS', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = request.params; const result = await pool.query( `SELECT u.id, u.email, p.display_name AS "displayName", COALESCE(p.phone, u.phone) AS phone FROM identity_users u LEFT JOIN users_profiles p ON p.user_id = u.id WHERE u.id = $1 AND u.role = 'customer' LIMIT 1`, [id], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Customer not found'); return reply.send(result.rows[0]); }, ); // ── POS-010: Discount validation ────────────────────────────────────────── app.post( '/pos/discounts/validate', { schema: { tags: ['POS Terminal'], summary: 'Validate discount before applying', body: { type: 'object', required: ['unitPriceCents', 'discountCents'], properties: { unitPriceCents: { type: 'integer', minimum: 0 }, discountCents: { type: 'integer', minimum: 0 }, discountPercent: { type: 'number', minimum: 0, maximum: 100 }, role: { type: 'string', enum: ['admin', 'pos_manager', 'pos_cashier'] }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body = (request.body ?? {}) as { unitPriceCents?: number; discountCents?: number; discountPercent?: number; role?: string; }; const unitPriceCents = body.unitPriceCents ?? 0; const discountCents = body.discountCents ?? 0; const discountPercent = body.discountPercent ?? (unitPriceCents > 0 ? (discountCents / unitPriceCents) * 100 : 0); // Cashiers capped at 50% per item const maxPercent = user.role === 'pos_manager' || user.role === 'admin' ? 100 : 50; if (discountPercent > maxPercent) { throw new AppError( 403, 'DISCOUNT_EXCEEDED', `Discount ${discountPercent.toFixed(0)}% exceeds max ${maxPercent}% for role`, ); } if (discountCents > unitPriceCents) { throw new AppError(400, 'INVALID_DISCOUNT', 'Discount cannot exceed unit price'); } return reply.send({ valid: true, maxPercent, appliedPercent: discountPercent, appliedCents: discountCents, finalPriceCents: unitPriceCents - discountCents, }); }, ); // ── POS-011: List sales, void, receipts, session history ────────────────── app.get( '/pos/sales', { schema: { tags: ['POS Terminal'], summary: 'List recent POS sales', querystring: { type: 'object', properties: { sessionId: { type: 'string', format: 'uuid' }, terminalId: { type: 'string', format: 'uuid' }, state: { type: 'string', enum: ['PENDING', 'COMPLETED'] }, storeId: { type: 'string', format: 'uuid' }, limit: { type: 'integer', minimum: 1, maximum: 100, default: 20 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const params = request.query as { sessionId?: string; terminalId?: string; state?: string; storeId?: string; limit?: number; }; const sessionId = params.sessionId; const state = params.state; const storeId = params.storeId; const limit = Math.min(Math.max(params.limit ?? 20, 1), 100); const conditions: string[] = [`o.idempotency_key IS NOT NULL`]; const values: unknown[] = []; if (sessionId) { values.push(sessionId); conditions.push(`o.cash_session_id = $${values.length}`); } // FEAT-200: filter by terminal for cross-day pending sales if (params.terminalId) { values.push(params.terminalId); conditions.push(`o.terminal_id = $${values.length}`); } if (state) { values.push(state); conditions.push(`o.state = $${values.length}`); } if (storeId) { values.push(storeId); conditions.push(`o.store_id = $${values.length}`); } values.push(limit); const query = ` SELECT o.id, o.state, o.total_cents AS "totalCents", o.subtotal_cents AS "subtotalCents", o.discount_cents AS "discountCents", o.created_at AS "createdAt", o.store_id AS "storeId", o.terminal_id AS "terminalId", o.cash_session_id AS "cashSessionId", o.pos_label AS "posLabel", COALESCE(payments.sum_paid, 0)::int AS "paidCents", (o.total_cents - COALESCE(payments.sum_paid, 0))::int AS "outstandingCents", u.email AS "userEmail" FROM orders_orders o LEFT JOIN identity_users u ON u.id = o.user_id LEFT JOIN ( SELECT order_id, SUM(amount_cents) AS sum_paid FROM payments_transactions WHERE status = 'succeeded' GROUP BY order_id ) payments ON payments.order_id = o.id WHERE ${conditions.join(' AND ')} ORDER BY o.created_at DESC LIMIT $${values.length} `; const result = await pool.query(query, values); return reply.send({ items: result.rows }); }, ); app.post<{ Params: { id: string } }>( '/pos/sales/:id/payments', { schema: { tags: ['POS Terminal'], summary: 'Apply additional payments to a pending POS sale', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['idempotencyKey', 'cashSessionId', 'terminalId', 'payments'], properties: { idempotencyKey: { type: 'string', minLength: 1, maxLength: 128 }, cashSessionId: { type: 'string', format: 'uuid' }, terminalId: { type: 'string', format: 'uuid' }, payments: { type: 'array', minItems: 1, items: { type: 'object' } }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema, }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const payment = z .object({ methodCode: z .string() .regex(/^[a-z0-9_-]{1,32}$/) .optional(), kind: z.enum(['cash', 'card', 'other']).optional(), amountCents: z.number().int().min(1), tenderedCents: z.number().int().min(0).optional(), last4: z .string() .regex(/^\d{1,4}$/) .optional(), }) .refine((value) => Boolean(value.methodCode || value.kind), { message: 'methodCode is required', }); const body = parseJson( z.object({ idempotencyKey: z.string().min(1).max(128), cashSessionId: z.string().uuid(), terminalId: z.string().uuid(), payments: z.array(payment).min(1), }), request.body ?? {}, ); const boundTerminalId = request.headers['x-terminal-id']; if (typeof boundTerminalId !== 'string' || boundTerminalId !== body.terminalId) { throw new AppError( 403, 'POS_TERMINAL_MISMATCH', 'La venta no pertenece al terminal vinculado', ); } const result = await receiveRestPayment.execute({ orderId: (request.params as { id: string }).id, userId: user.id, ...body, }); return reply.code(201).send(result); }, ); app.post<{ Params: { id: string } }>( '/pos/sales/:id/void', { schema: { tags: ['POS Admin'], summary: 'Void a POS sale', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['reason'], properties: { reason: { type: 'string', minLength: 1 } }, }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); // Only admins can void const { id } = request.params; const { reason } = (request.body ?? {}) as { reason?: string }; const order = await pool.query<{ id: string }>('SELECT id FROM orders_orders WHERE id = $1', [ id, ]); if (!order.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Order not found'); await pool.query( `INSERT INTO orders_order_events (order_id, event, actor_id, metadata) VALUES ($1, 'VOIDED', $2, $3)`, [id, user.id, JSON.stringify({ reason })], ); return reply.send({ ok: true, voidedAt: new Date().toISOString() }); }, ); // ── POS-FIX-8: DELETE /pos/sales/:id — remove a pending parked sale ─────── app.delete<{ Params: { id: string } }>( '/pos/sales/:id', { schema: { tags: ['POS Terminal'], summary: 'Remove a pending parked sale and restore inventory', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const client = await pool.connect(); try { await client.query('BEGIN'); const orderRows = await client.query<{ id: string; state: string; store_id: string; }>( `SELECT id, state, store_id FROM orders_orders WHERE id = $1 FOR UPDATE`, [id], ); const order = orderRows.rows[0]; if (!order) throw new AppError(404, 'POS_SALE_NOT_FOUND', 'Venta no encontrada'); if (order.state !== 'PENDING') { throw new AppError(409, 'POS_SALE_NOT_PENDING', 'Solo se pueden eliminar ventas pendientes'); } const paymentRows = await client.query<{ cnt: string }>( `SELECT COUNT(*) AS cnt FROM payments_transactions WHERE order_id = $1 AND status = 'succeeded'`, [id], ); if (Number(paymentRows.rows[0]?.cnt ?? 0) > 0) { throw new AppError(409, 'POS_SALE_HAS_PAYMENTS', 'No se puede eliminar una venta con pagos registrados'); } const itemRows = await client.query<{ variant_id: string | null; quantity: number; is_free_item: boolean }>( `SELECT variant_id, quantity, is_free_item FROM orders_items WHERE order_id = $1`, [id], ); for (const item of itemRows.rows) { if (!item.is_free_item && item.variant_id) { await client.query( `UPDATE inventory_stock SET available = available + $3, sold = GREATEST(sold - $3, 0), updated_at = now() WHERE variant_id = $1 AND store_id = $2`, [item.variant_id, order.store_id, item.quantity], ); await client.query( `INSERT INTO inventory_movements (variant_id, store_id, operation, quantity) VALUES ($1, $2, 'cancel', $3)`, [item.variant_id, order.store_id, item.quantity], ); } } await client.query( `UPDATE orders_orders SET state = 'CANCELLED', state_changed_at = now(), updated_at = now() WHERE id = $1`, [id], ); await client.query( `INSERT INTO orders_order_history (order_id, event_type, message, actor_email) VALUES ($1, 'CANCELLED', 'Venta eliminada desde TPV', $2)`, [id, user.email], ); await client.query('COMMIT'); return reply.send({ ok: true, deletedAt: new Date().toISOString() }); } catch (error) { await client.query('ROLLBACK'); throw error; } finally { client.release(); } }, ); app.get<{ Params: { id: string } }>( '/pos/sales/:id/receipt', { schema: { tags: ['POS Terminal'], summary: 'Get receipt for a sale', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); await assertReceiptAccess(pool, user, request.headers['x-terminal-id'], id); return reply.send({ receipt: await buildPosReceipt(pool, id) }); }, ); // F-191: enhanced admin sessions listing with terminalId and date range filters app.get( '/pos/sessions', { schema: { tags: ['POS Admin'], summary: 'List cash sessions (admin)', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, terminalId: { type: 'string', format: 'uuid' }, status: { type: 'string', enum: ['OPEN', 'CLOSED'] }, dateFrom: { type: 'string', format: 'date' }, dateTo: { type: 'string', format: 'date' }, limit: { type: 'integer', minimum: 1, maximum: 100, default: 20 }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, terminalId, status, dateFrom, dateTo, limit = 20, } = request.query as { storeId?: string; terminalId?: string; status?: string; dateFrom?: string; dateTo?: string; limit?: number; }; const conditions: string[] = []; const params: unknown[] = []; if (storeId) { params.push(storeId); conditions.push(`s.store_id = $${params.length}`); } if (terminalId) { params.push(terminalId); conditions.push(`s.terminal_id = $${params.length}`); } if (status) { params.push(status); conditions.push(`s.status = $${params.length}`); } if (dateFrom) { params.push(dateFrom); conditions.push(`DATE(s.created_at) >= $${params.length}`); } if (dateTo) { params.push(dateTo); conditions.push(`DATE(s.created_at) <= $${params.length}`); } params.push(limit); const where = conditions.length > 0 ? `WHERE ${conditions.join(' AND ')} AND ` : 'WHERE '; const result = await pool.query( `SELECT s.*, t.name AS "terminalName", u.email AS "userEmail" FROM pos_cash_sessions s LEFT JOIN pos_terminals t ON t.id = s.terminal_id LEFT JOIN identity_users u ON u.id = s.user_id ${where} 1=1 ORDER BY s.created_at DESC LIMIT $${params.length}`, params, ); return reply.send({ items: result.rows }); }, ); // ── POS-012: POS returns + receipt print + analytics ────────────────────── app.post<{ Params: { id: string } }>( '/pos/sales/:id/returns', { schema: { tags: ['POS Terminal'], summary: 'Apply a partial or full return to a POS sale', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['idempotencyKey', 'cashSessionId', 'terminalId', 'reason', 'items'], properties: { idempotencyKey: { type: 'string', minLength: 1, maxLength: 128 }, cashSessionId: { type: 'string', format: 'uuid' }, terminalId: { type: 'string', format: 'uuid' }, reason: { type: 'string', minLength: 1, maxLength: 500 }, items: { type: 'array', minItems: 1, items: { type: 'object', required: ['orderItemId', 'returnedQuantity'], properties: { orderItemId: { type: 'string', format: 'uuid' }, returnedQuantity: { type: 'integer', minimum: 1 }, }, }, }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema, }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = request.params; const body = parseJson( z.object({ idempotencyKey: z.string().min(1).max(128), cashSessionId: z.string().uuid(), terminalId: z.string().uuid(), reason: z.string().min(1).max(500), items: z .array( z.object({ orderItemId: z.string().uuid(), returnedQuantity: z.number().int().min(1), }), ) .min(1), }), request.body ?? {}, ); const boundTerminalId = request.headers['x-terminal-id']; if (typeof boundTerminalId !== 'string' || boundTerminalId !== body.terminalId) { throw new AppError( 403, 'POS_TERMINAL_MISMATCH', 'La devolución no pertenece al terminal vinculado', ); } const result = await applyPosReturn.execute({ orderId: id, userId: user.id, ...body, lines: body.items, }); return reply.code(201).send(result); }, ); app.get<{ Params: { id: string } }>( '/pos/sales/:id/print', { schema: { tags: ['POS Terminal'], summary: 'Get printable receipt', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); await assertReceiptAccess(pool, user, request.headers['x-terminal-id'], id); return reply.send({ receipt: await buildPosReceipt(pool, id) }); }, ); app.get<{ Params: { id: string } }>( '/pos/sales/:id/items', { schema: { tags: ['POS Terminal'], summary: 'List order items of a POS sale (for returns)', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const order = await pool.query<{ id: string; source: string }>( `SELECT id, source FROM orders_orders WHERE id = $1`, [id], ); if (!order.rows[0] || order.rows[0].source !== 'pos') { throw new AppError(404, 'POS_SALE_NOT_FOUND', 'Venta no encontrada'); } const itemRows = await pool.query<{ id: string; name: string; sku: string; quantity: number; returned_quantity: number; is_free_item: boolean; unit_price_cents: number; discount_cents: number; }>( `SELECT id, name, sku, quantity, returned_quantity, is_free_item, unit_price_cents, discount_cents FROM orders_items WHERE order_id = $1 ORDER BY created_at, id`, [id], ); return reply.send({ items: itemRows.rows.map((row) => ({ id: row.id, name: row.name, sku: row.sku, quantity: Number(row.quantity), returnedQuantity: Number(row.returned_quantity), freeItem: row.is_free_item, unitPriceCents: Number(row.unit_price_cents), discountCents: Number(row.discount_cents), })), }); }, ); app.post<{ Params: { id: string } }>( '/pos/sales/:id/receipt/email', { schema: { tags: ['POS Terminal'], summary: 'Email a generated POS receipt', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['email'], properties: { email: { type: 'string', format: 'email', maxLength: 254 } }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const { email } = parseJson( z.object({ email: z.string().trim().email().max(254) }), request.body ?? {}, ); await assertReceiptAccess(pool, user, request.headers['x-terminal-id'], id); const receipt = await buildPosReceipt(pool, id); const euros = (cents: number) => new Intl.NumberFormat('es-ES', { style: 'currency', currency: 'EUR' }).format(cents / 100); const text = [ receipt.company.name, receipt.company.address ?? '', receipt.company.taxId ? `NIF/CIF: ${receipt.company.taxId}` : '', receipt.company.phone ?? '', receipt.company.email ?? '', '', `Ticket ${receipt.receiptNumber}`, new Date(receipt.issuedAt).toLocaleString('es-ES'), '', ...receipt.items.map( (item) => `${item.quantity} × ${item.name} — ${euros(item.totalCents)}`, ), '', `Subtotal: ${euros(receipt.subtotalCents)}`, `Descuentos: ${euros(receipt.discountCents)}`, `IVA: ${euros(receipt.taxCents)}`, `TOTAL: ${euros(receipt.totalCents)}`, '', ...receipt.payments.map( (payment) => `${payment.methodLabel}: ${euros(payment.amountCents)}${payment.changeCents ? ` · cambio ${euros(payment.changeCents)}` : ''}`, ), '', receipt.returnPolicy, receipt.footer ?? '', ] .filter((line, index, lines) => line !== '' || lines[index - 1] !== '') .join('\n'); await sendTransactionalEmail(pool, { to: email, subject: `Ticket ${receipt.receiptNumber} · ${receipt.company.name}`, text, }); return reply.send({ ok: true, email, receiptNumber: receipt.receiptNumber }); }, ); app.get( '/pos/analytics/summary', { schema: { tags: ['POS Admin'], summary: 'POS sales analytics', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, from, to } = request.query as { storeId?: string; from?: string; to?: string; }; const params: unknown[] = []; let df = ''; if (from) { params.push(from); df += ` AND o.created_at >= $${params.length}`; } if (to) { params.push(to); df += ` AND o.created_at <= $${params.length}`; } let sf = ''; if (storeId) { params.push(storeId); sf = ` AND cs.store_id = $${params.length}`; } const sum = await pool.query( `SELECT COUNT(*) AS cnt, COALESCE(SUM(o.total_cents),0) AS total, COALESCE(SUM(o.discount_cents),0) AS disc FROM orders_orders o LEFT JOIN pos_cash_sessions cs ON cs.id = o.cash_session_id WHERE o.idempotency_key IS NOT NULL${df}${sf}`, params, ); const byPay = await pool.query( `SELECT provider, COUNT(*) AS cnt, SUM(amount_cents) AS total FROM payments_transactions WHERE status='COMPLETED'${df} GROUP BY provider`, params, ); return reply.send({ summary: sum.rows[0], byPayment: byPay.rows }); }, ); // ── POS-013: Low stock alerts + loyalty + settings + shortcuts ──────────── app.get( '/pos/inventory/low-stock', { schema: { tags: ['POS Terminal'], summary: 'List low-stock variants for a store', querystring: { type: 'object', required: ['storeId'], properties: { storeId: { type: 'string', format: 'uuid' }, threshold: { type: 'integer', minimum: 1, default: 10 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { storeId, threshold = 10 } = request.query as { storeId?: string; threshold?: number }; const result = await pool.query( `SELECT v.id AS "variantId", v.name, v.sku, s.quantity AS stock FROM catalog_product_variants v LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id AND store_id = $1 LIMIT 1) s ON true WHERE v.active = true AND (s.quantity IS NULL OR s.quantity <= $2) ORDER BY s.quantity ASC NULLS FIRST LIMIT 50`, [storeId, threshold], ); return reply.send({ items: result.rows }); }, ); app.get<{ Params: { customerId: string } }>( '/pos/loyalty/:customerId', { schema: { tags: ['POS Terminal'], summary: 'Get loyalty info for a customer', params: { type: 'object', properties: { customerId: { type: 'string', format: 'uuid' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { customerId } = request.params; const profile = await pool.query( 'SELECT user_id, loyalty_points AS "loyaltyPoints", loyalty_tier AS "loyaltyTier" FROM users_profiles WHERE user_id = $1', [customerId], ); if (!profile.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Customer not found'); return reply.send({ customerId, points: profile.rows[0].loyaltyPoints ?? 0, tier: profile.rows[0].loyaltyTier ?? 'bronze', }); }, ); app.post<{ Params: { customerId: string } }>( '/pos/loyalty/:customerId/points', { schema: { tags: ['POS Terminal'], summary: 'Award or redeem loyalty points', params: { type: 'object', properties: { customerId: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['delta', 'reason'], properties: { delta: { type: 'integer' }, reason: { type: 'string' } }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { customerId } = request.params; const { delta, reason } = (request.body ?? {}) as { delta?: number; reason?: string }; const current = await pool.query<{ loyalty_points: number }>( 'SELECT loyalty_points FROM users_profiles WHERE user_id = $1', [customerId], ); if (!current.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Customer not found'); const newPoints = Math.max(0, (current.rows[0].loyalty_points ?? 0) + (delta ?? 0)); await pool.query( 'UPDATE users_profiles SET loyalty_points = $1, updated_at = now() WHERE user_id = $2', [newPoints, customerId], ); return reply.send({ customerId, points: newPoints, delta: delta ?? 0, reason }); }, ); app.get( '/pos/settings', { schema: { tags: ['POS Admin'], summary: 'Get POS store settings', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId } = request.query as { storeId?: string }; const result = storeId ? await pool.query( 'SELECT store_id AS "storeId", receipt_footer AS "receiptFooter", receipt_vat AS "receiptVat", default_payment_method AS "defaultPaymentMethod" FROM pos_store_settings WHERE store_id = $1', [storeId], ) : await pool.query( 'SELECT store_id AS "storeId", receipt_footer AS "receiptFooter", receipt_vat AS "receiptVat", default_payment_method AS "defaultPaymentMethod" FROM pos_store_settings LIMIT 1', ); return reply.send( result.rows[0] ?? { receiptFooter: 'Gracias por su compra', receiptVat: 'ES00000000', defaultPaymentMethod: 'cash', }, ); }, ); app.patch( '/pos/settings', { schema: { tags: ['POS Admin'], summary: 'Update POS store settings', body: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, receiptFooter: { type: 'string' }, receiptVat: { type: 'string' }, defaultPaymentMethod: { type: 'string', enum: ['cash', 'card', 'other'] }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = (request.body ?? {}) as Record; if (!body.storeId) throw new AppError(400, 'MISSING_STORE_ID', 'storeId required'); const sets: string[] = []; const vals: unknown[] = []; if (body.receiptFooter !== undefined) { vals.push(body.receiptFooter); sets.push(`receipt_footer = $${vals.length}`); } if (body.receiptVat !== undefined) { vals.push(body.receiptVat); sets.push(`receipt_vat = $${vals.length}`); } if (body.defaultPaymentMethod !== undefined) { vals.push(body.defaultPaymentMethod); sets.push(`default_payment_method = $${vals.length}`); } vals.push(body.storeId); if (sets.length === 0) return reply.send({ ok: true }); await pool.query( `INSERT INTO pos_store_settings (store_id, receipt_footer, receipt_vat, default_payment_method) VALUES ($${vals.length}, $1, $2, $3) ON CONFLICT (store_id) DO UPDATE SET ${sets.join(', ')}, updated_at = now()`, vals, ); return reply.send({ ok: true }); }, ); app.get( '/pos/shortcuts', { schema: { tags: ['POS Terminal'], summary: 'Get keyboard shortcuts' } as FastifySchema, }, async (request, reply) => { await authenticate(request); return reply.send({ shortcuts: [ { key: 'F1', action: 'search', description: 'Focus product search' }, { key: 'F2', action: 'pay-cash', description: 'Pay with cash' }, { key: 'F3', action: 'pay-card', description: 'Pay with card' }, { key: 'F4', action: 'discount', description: 'Apply discount' }, { key: 'F5', action: 'customer', description: 'Associate customer' }, { key: 'F6', action: 'clear', description: 'Clear cart' }, { key: 'F7', action: 'receipt', description: 'Print last receipt' }, ], }); }, ); // ── POS-014: Shifts + tax rates + daily/end-of-day reports ─────────────── app.get( '/pos/shifts', { schema: { tags: ['POS Admin'], summary: 'List POS user shifts', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, date: { type: 'string' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, date } = request.query as { storeId?: string; date?: string }; const params: unknown[] = []; let filter = ''; if (storeId) { params.push(storeId); filter += ` AND cs.store_id = $${params.length}`; } if (date) { params.push(date); filter += ` AND DATE(cs.created_at) = $${params.length}`; } const result = await pool.query( `SELECT cs.id, cs.store_id AS "storeId", cs.user_id AS "userId", u.email AS "userEmail", cs.status, cs.opening_cash_cents AS "openingCash", cs.expected_cash_cents AS "expectedCash", cs.created_at AS "openedAt" FROM pos_cash_sessions cs LEFT JOIN identity_users u ON u.id = cs.user_id WHERE 1=1${filter} ORDER BY cs.created_at DESC LIMIT 50`, params, ); return reply.send({ items: result.rows }); }, ); app.get( '/pos/tax-rates', { schema: { tags: ['POS Terminal'], summary: 'Get configured tax rates' } as FastifySchema, }, async (request, reply) => { await authenticate(request); return reply.send({ rates: [ { code: 'IVA21', name: 'IVA 21%', percent: 21, active: true }, { code: 'IVA10', name: 'IVA 10%', percent: 10, active: true }, { code: 'IVA04', name: 'IVA 4%', percent: 4, active: false }, ], }); }, ); app.get( '/pos/stores', { schema: { tags: ['POS Admin'], summary: 'List all POS stores', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const result = await pool.query( 'SELECT id, name, address, active FROM pos_stores ORDER BY name', ); return reply.send({ items: result.rows }); }, ); app.get( '/pos/notifications', { schema: { tags: ['POS Terminal'], summary: 'Get active POS notifications', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { storeId } = request.query as { storeId?: string }; // Return low-stock notifications + session alerts const params: unknown[] = storeId ? [storeId] : []; const lowStock = await pool.query( `SELECT v.name, v.sku, COALESCE(s.quantity, 0) AS stock FROM catalog_product_variants v LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id AND store_id = $${params.length} LIMIT 1) s ON true WHERE v.active = true AND COALESCE(s.quantity, 0) < 5 LIMIT 10`, params, ); const notifications = lowStock.rows.map((r: Record) => ({ type: 'low-stock', message: `Stock bajo: ${r.name} (${r.stock} uds)`, severity: 'warning', })); return reply.send({ items: notifications }); }, ); app.get( '/pos/reports/daily', { schema: { tags: ['POS Admin'], summary: 'Daily sales report', querystring: { type: 'object', required: ['storeId', 'date'], properties: { storeId: { type: 'string', format: 'uuid' }, date: { type: 'string' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, date } = request.query as { storeId?: string; date?: string }; const sessions = await pool.query( `SELECT cs.id, cs.user_id, u.email, cs.status, COALESCE(cs.expected_cash_cents, 0) AS expected_cash, cs.opening_cash_cents AS opening_cash, cs.created_at FROM pos_cash_sessions cs LEFT JOIN identity_users u ON u.id = cs.user_id WHERE cs.store_id = $1 AND DATE(cs.created_at) = $2`, [storeId, date], ); const salesCount = await pool.query( `SELECT COUNT(*) AS cnt, COALESCE(SUM(o.total_cents), 0) AS total, COALESCE(SUM(o.discount_cents), 0) AS discount FROM orders_orders o WHERE o.idempotency_key IS NOT NULL AND DATE(o.created_at) = $1`, [date], ); return reply.send({ date, storeId, sessions: sessions.rows, summary: salesCount.rows[0] }); }, ); app.get( '/pos/reports/end-of-day', { schema: { tags: ['POS Admin'], summary: 'End-of-day report', querystring: { type: 'object', required: ['storeId', 'date'], properties: { storeId: { type: 'string', format: 'uuid' }, date: { type: 'string' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, date } = request.query as { storeId?: string; date?: string }; const params = [storeId, date]; const sessions = await pool.query( `SELECT cs.id, cs.status, COALESCE(cs.expected_cash_cents, 0) AS expected, cs.opening_cash_cents AS opening FROM pos_cash_sessions cs WHERE cs.store_id = $1 AND DATE(cs.created_at) = $2`, params, ); const sales = await pool.query( `SELECT COUNT(*) AS cnt, COALESCE(SUM(total_cents),0) AS total, COALESCE(SUM(discount_cents),0) AS disc FROM orders_orders WHERE idempotency_key IS NOT NULL AND DATE(created_at) = $1`, [date], ); const byPay = await pool.query( `SELECT provider, COUNT(*) AS cnt, SUM(amount_cents) AS total FROM payments_transactions WHERE status='COMPLETED' AND DATE(created_at) = $1 GROUP BY provider`, [date], ); return reply.send({ date, storeId, sessions: sessions.rows, sales: sales.rows[0], byPayment: byPay.rows, }); }, ); // ── POS-015: Kitchen display + cash drawer + orders import + integrations ─ app.get( '/pos/kitchen-display', { schema: { tags: ['POS Admin'], summary: 'Kitchen display orders (pending)', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { storeId } = request.query as { storeId?: string }; // Return recent orders marked for kitchen (those with items that need preparation) const result = await pool.query( `SELECT o.id, o.created_at AS "createdAt", o.total_cents AS "totalCents", o.status, string_agg(oi.name, ', ' ORDER BY oi.id) AS items FROM orders_orders o JOIN orders_items oi ON oi.order_id = o.id WHERE o.idempotency_key IS NOT NULL AND o.status IN ('PENDING','PROCESSING') AND DATE(o.created_at) = CURRENT_DATE GROUP BY o.id ORDER BY o.created_at DESC LIMIT 20`, storeId ? [storeId] : [], ); return reply.send({ orders: result.rows }); }, ); app.get( '/pos/cash-drawer/status', { schema: { tags: ['POS Terminal'], summary: 'Cash drawer status' } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); return reply.send({ expected: 0, opening: 0, float: 0 }); }, ); app.post( '/pos/orders/import', { schema: { tags: ['POS Admin'], summary: 'Import orders from external source', body: { type: 'object', properties: { orders: { type: 'array', items: { type: 'object', properties: { externalId: { type: 'string' }, items: { type: 'array' }, totalCents: { type: 'integer' }, }, }, }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { orders } = (request.body ?? {}) as { orders?: unknown[] }; const imported: string[] = []; for (const order of orders ?? []) { const o = order as { externalId?: string; items?: unknown[]; totalCents?: number }; imported.push(o.externalId ?? `import-${Date.now()}`); } return reply.send({ imported: imported.length, ids: imported }); }, ); app.get( '/pos/integrations', { schema: { tags: ['POS Admin'], summary: 'List available POS integrations' } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ integrations: [ { id: 'printer', name: 'Impresora de tickets', active: true, config: {} }, { id: 'barcode-scanner', name: 'Escáner de barras', active: true, config: {} }, { id: 'scale', name: 'Báscula', active: false, config: {} }, { id: 'loyalty', name: 'Programa de fidelización', active: true, config: {} }, ], }); }, ); app.get( '/pos/export/sales', { schema: { tags: ['POS Admin'], summary: 'Export sales as CSV', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, format: { type: 'string', enum: ['csv', 'json'], default: 'csv' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId, from, to, format = 'csv', } = request.query as { storeId?: string; from?: string; to?: string; format?: string }; const params: unknown[] = []; let df = ''; if (from) { params.push(from); df += ` AND o.created_at >= $${params.length}`; } if (to) { params.push(to); df += ` AND o.created_at <= $${params.length}`; } let sf = ''; if (storeId) { params.push(storeId); sf = ` AND cs.store_id = $${params.length}`; } const result = await pool.query( `SELECT o.id, o.total_cents AS "totalCents", o.subtotal_cents AS "subtotal", o.discount_cents AS "discount", o.created_at AS "createdAt" FROM orders_orders o LEFT JOIN pos_cash_sessions cs ON cs.id = o.cash_session_id WHERE o.idempotency_key IS NOT NULL${df}${sf} ORDER BY o.created_at DESC LIMIT 5000`, params, ); if (format === 'json') return reply.send({ items: result.rows }); const header = 'id,totalCents,subtotal,discount,createdAt\n'; const rows = result.rows .map( (r: Record) => `${r.id},${r.totalCents},${r.subtotal},${r.discount},${r.createdAt}`, ) .join('\n'); reply.header('Content-Type', 'text/csv'); reply.header('Content-Disposition', 'attachment; filename="pos-sales.csv"'); return reply.send(`${header}${rows}`); }, ); // ── POS-016: User roles + audit log + catalog sync + time tracking ─────── app.get( '/pos/users', { schema: { tags: ['POS Admin'], summary: 'List POS users', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const result = await pool.query( `SELECT id, email, role, active, deactivated_at AS "deactivatedAt", deleted_at AS "deletedAt", created_at AS "createdAt", CASE WHEN deleted_at IS NOT NULL THEN 'deleted' WHEN active THEN 'active' ELSE 'inactive' END AS status FROM backoffice_users WHERE role IN ('pos_manager','pos_cashier') ORDER BY deleted_at NULLS FIRST, active DESC, email`, ); return reply.send({ items: result.rows }); }, ); app.post( '/pos/users', { schema: { tags: ['POS Admin'], summary: 'Create POS user', body: { type: 'object', required: ['email', 'password', 'role'], properties: { email: { type: 'string', format: 'email' }, password: { type: 'string', minLength: 8 }, role: { type: 'string', enum: ['pos_manager', 'pos_cashier'] }, firstName: { type: 'string' }, lastName: { type: 'string' }, }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 409: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const body = parseJson( z.object({ email: z .string() .trim() .email() .transform((value) => value.toLowerCase()), password: z.string().min(8).max(200), role: z.enum(['pos_manager', 'pos_cashier']), firstName: z.string().trim().max(100).optional(), lastName: z.string().trim().max(100).optional(), }), request.body ?? {}, ); const existing = await pool.query('SELECT id FROM backoffice_users WHERE email = $1', [ body.email, ]); if (existing.rows[0]) throw new AppError(409, 'EXISTS', 'Email already exists'); const passwordHash = await new Argon2PasswordHasher().hash(body.password); const newUser = await pool.query<{ id: string }>( `INSERT INTO backoffice_users (email, password_hash, role) VALUES ($1, $2, $3) RETURNING id`, [body.email, passwordHash, body.role], ); const created = newUser.rows[0]; if (!created) throw new AppError(500, 'USER_CREATE_FAILED', 'User insert returned no row'); return reply.code(201).send({ id: created.id, email: body.email, role: body.role, active: true, deactivatedAt: null, deletedAt: null, status: 'active', }); }, ); app.patch( '/pos/users/:id/status', { schema: { tags: ['POS Admin'], summary: 'Activate or deactivate a POS cashier', params: { type: 'object', required: ['id'], properties: { id: { type: 'string', format: 'uuid' } }, }, body: { type: 'object', required: ['active'], properties: { active: { type: 'boolean' } }, }, response: { 400: errorSchema, 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema, }, } as FastifySchema, }, async (request, reply) => { const admin = await authenticate(request); requireRole(admin, 'admin'); const { id } = parseJson(idParamSchema, request.params); const { active } = parseJson(z.object({ active: z.boolean() }), request.body ?? {}); const client = await pool.connect(); try { await client.query('BEGIN'); const targetResult = await client.query<{ id: string; email: string; active: boolean; deleted_at: Date | null; }>( `SELECT id, email, active, deleted_at FROM backoffice_users WHERE id = $1 AND role = 'pos_cashier' FOR UPDATE`, [id], ); const target = targetResult.rows[0]; if (!target) { throw new AppError(404, 'POS_CASHIER_NOT_FOUND', 'Cajero no encontrado'); } if (target.deleted_at) { throw new AppError( 409, 'POS_CASHIER_DELETED', 'Un cajero eliminado no se puede reactivar', ); } if (!active && target.active) { const open = await client.query( `SELECT id FROM pos_cash_sessions WHERE user_id = $1 AND status = 'OPEN' LIMIT 1`, [id], ); if (open.rows[0]) { throw new AppError( 409, 'POS_CASHIER_HAS_OPEN_SESSION', 'Cierra la sesión de caja antes de desactivar el cajero', ); } } const updated = await client.query<{ id: string; email: string; active: boolean; deactivatedAt: Date | null; deletedAt: Date | null; }>( `UPDATE backoffice_users SET active = $2, deactivated_at = CASE WHEN $2 THEN NULL ELSE COALESCE(deactivated_at, now()) END, updated_at = now() WHERE id = $1 RETURNING id, email, active, deactivated_at AS "deactivatedAt", deleted_at AS "deletedAt"`, [id, active], ); if (!active) { await client.query( `UPDATE backoffice_sessions SET revoked_at = COALESCE(revoked_at, now()) WHERE user_id = $1 AND revoked_at IS NULL`, [id], ); } await client.query( `INSERT INTO security_audit_log (actor_id, action, target, metadata) VALUES ($1, $2, $3, jsonb_build_object('email', $4::text))`, [ admin.id, active ? 'pos.cashier.reactivated' : 'pos.cashier.deactivated', id, target.email, ], ); await client.query('COMMIT'); return reply.send({ ...updated.rows[0], role: 'pos_cashier', status: active ? 'active' : 'inactive', }); } catch (error) { await client.query('ROLLBACK'); throw error; } finally { client.release(); } }, ); app.delete( '/pos/users/:id', { schema: { tags: ['POS Admin'], summary: 'Soft-delete a POS cashier while preserving history', params: { type: 'object', required: ['id'], properties: { id: { type: 'string', format: 'uuid' } }, }, response: { 204: { type: 'null' }, 401: errorSchema, 403: errorSchema, 404: errorSchema, 409: errorSchema, }, } as FastifySchema, }, async (request, reply) => { const admin = await authenticate(request); requireRole(admin, 'admin'); const { id } = parseJson(idParamSchema, request.params); const client = await pool.connect(); try { await client.query('BEGIN'); const targetResult = await client.query<{ email: string; deleted_at: Date | null }>( `SELECT email, deleted_at FROM backoffice_users WHERE id = $1 AND role = 'pos_cashier' FOR UPDATE`, [id], ); const target = targetResult.rows[0]; if (!target) { throw new AppError(404, 'POS_CASHIER_NOT_FOUND', 'Cajero no encontrado'); } if (target.deleted_at) { throw new AppError(409, 'POS_CASHIER_ALREADY_DELETED', 'El cajero ya está eliminado'); } const open = await client.query( `SELECT id FROM pos_cash_sessions WHERE user_id = $1 AND status = 'OPEN' LIMIT 1`, [id], ); if (open.rows[0]) { throw new AppError( 409, 'POS_CASHIER_HAS_OPEN_SESSION', 'Cierra la sesión de caja antes de eliminar el cajero', ); } await client.query( `UPDATE backoffice_users SET active = false, deactivated_at = COALESCE(deactivated_at, now()), deleted_at = now(), updated_at = now() WHERE id = $1`, [id], ); await client.query( `UPDATE backoffice_sessions SET revoked_at = COALESCE(revoked_at, now()) WHERE user_id = $1 AND revoked_at IS NULL`, [id], ); await client.query( `INSERT INTO security_audit_log (actor_id, action, target, metadata) VALUES ($1, 'pos.cashier.deleted', $2, jsonb_build_object('email', $3::text))`, [admin.id, id, target.email], ); await client.query('COMMIT'); return reply.code(204).send(); } catch (error) { await client.query('ROLLBACK'); throw error; } finally { client.release(); } }, ); app.get( '/pos/audit-log', { schema: { tags: ['POS Admin'], summary: 'POS audit log', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, limit: { type: 'integer', minimum: 1, maximum: 200, default: 50 }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { from, to, limit = 50, } = request.query as { storeId?: string; from?: string; to?: string; limit?: number }; const params: unknown[] = []; let df = ''; if (from) { params.push(from); df += ` AND o.created_at >= $${params.length}`; } if (to) { params.push(to); df += ` AND o.created_at <= $${params.length}`; } params.push(limit); const result = await pool.query( `SELECT o.id, o.event, o.actor_id AS "actorId", u.email AS "actorEmail", o.metadata, o.created_at AS "createdAt" FROM orders_order_events o LEFT JOIN identity_users u ON u.id = o.actor_id WHERE 1=1${df} ORDER BY o.created_at DESC LIMIT $${params.length}`, params, ); return reply.send({ items: result.rows }); }, ); app.post( '/pos/catalog/sync', { schema: { tags: ['POS Admin'], summary: 'Trigger catalog sync', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); // Placeholder: in a real system this would trigger a background sync job return reply.send({ ok: true, syncedAt: new Date().toISOString(), message: 'Catalog sync triggered', }); }, ); app.get( '/pos/time-tracking', { schema: { tags: ['POS Terminal'], summary: 'Get employee time tracking for current session', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, date: { type: 'string' } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { storeId, date } = request.query as { storeId?: string; date?: string }; const d = date ?? new Date().toISOString().slice(0, 10); const params: unknown[] = storeId ? [storeId, d] : [d]; const result = await pool.query( `SELECT cs.user_id AS "userId", u.email, cs.created_at AS "clockIn", cs.closed_at AS "clockOut", cs.status FROM pos_cash_sessions cs LEFT JOIN identity_users u ON u.id = cs.user_id WHERE ${storeId ? 'cs.store_id = $1 AND' : ''} DATE(cs.created_at) = $${params.length} ORDER BY cs.created_at`, params, ); return reply.send({ date: d, entries: result.rows }); }, ); app.get( '/pos/barcode/lookup', { schema: { tags: ['POS Terminal'], summary: 'Universal barcode lookup', querystring: { type: 'object', required: ['code'], properties: { code: { type: 'string' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { code } = request.query as { code?: string }; if (!code) throw new AppError(400, 'MISSING_CODE', 'code is required'); const result = await pool.query( `SELECT v.id AS "variantId", v.product_id AS "productId", v.name, v.sku, v.ean, COALESCE(s.quantity, 0) AS stock, pp.price_cents AS "priceCents" FROM catalog_product_variants v LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id LIMIT 1) s ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE (v.ean = $1 OR v.sku = $1) AND v.active = true LIMIT 1`, [code], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Product not found'); return reply.send(result.rows[0]); }, ); // ── POS-017..POS-022: Split payments + holds + quotes + tips + gift cards + multi-currency ─ app.post( '/pos/sales/:id/split', { schema: { tags: ['POS Terminal'], summary: 'Split a sale into multiple payments', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['splits'], properties: { splits: { type: 'array', minItems: 2, items: { type: 'object', required: ['kind', 'amountCents'], properties: { kind: { type: 'string', enum: ['cash', 'card', 'other'] }, amountCents: { type: 'integer', minimum: 1 }, }, }, }, }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const body = request.body as { splits?: { kind: string; amountCents: number }[] }; const { splits } = body; const order = await pool.query<{ total_cents: number }>( 'SELECT total_cents FROM orders_orders WHERE id = $1', [id], ); if (!order.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Order not found'); const total = (splits ?? []).reduce( (s: number, p: { amountCents: number }) => s + p.amountCents, 0, ); if (total !== (order.rows[0].total_cents ?? 0)) throw new AppError(400, 'SPLIT_MISMATCH', 'Split amounts must equal total'); for (const split of splits ?? []) { const sp = split as { kind: string; amountCents: number }; const kind = sp.kind === 'cash' ? 'pos_cash' : sp.kind === 'card' ? 'pos_card' : 'pos_other'; await pool.query( `INSERT INTO payments_transactions (provider, provider_event_id, provider_payment_id, order_id, amount_cents, currency, status, raw) VALUES ($1, $2, $3, $4, $5, $6, $7, $8)`, [ kind, `split-${id}-${Date.now()}`, `split-${Date.now()}`, id, split.amountCents, 'EUR', 'COMPLETED', JSON.stringify({ split: true }), ], ); } return reply.send({ ok: true, splits: splits }); }, ); app.post( '/pos/sales/:id/hold', { schema: { tags: ['POS Terminal'], summary: 'Hold a sale for later', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', properties: { note: { type: 'string' } } }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const { note } = (request.body ?? {}) as { note?: string }; await pool.query( `INSERT INTO orders_order_events (order_id, event, actor_id, metadata) VALUES ($1, 'HELD', $2, $3)`, [id, user.id, JSON.stringify({ note: note ?? '' })], ); return reply.send({ ok: true, heldAt: new Date().toISOString() }); }, ); app.post( '/pos/quotes', { schema: { tags: ['POS Terminal'], summary: 'Create a price quote', body: { type: 'object', required: ['items', 'customerId'], properties: { items: { type: 'array' }, customerId: { type: 'string', format: 'uuid' }, validDays: { type: 'integer', default: 7 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body3 = request.body as { items?: { unitPriceCents?: number; quantity?: number }[]; customerId?: string; validDays?: number; }; const { items: qItems, customerId: qCustomerId, validDays: qValidDays = 7 } = body3; const totalCents = (qItems ?? []).reduce( (s: number, i: { unitPriceCents?: number; quantity?: number }) => s + (i.unitPriceCents ?? 0) * (i.quantity ?? 1), 0, ); const expiresAt = new Date(Date.now() + (qValidDays ?? 7) * 86400000).toISOString(); const quote = await pool.query<{ id: string }>( `INSERT INTO orders_orders (user_id, idempotency_key, subtotal_cents, total_cents, created_at) VALUES ($1, $2, $3, $4, $5) RETURNING id`, [user.id, `quote-${Date.now()}`, totalCents, totalCents, new Date()], ); return reply .code(201) .send({ quoteId: quote.rows[0]?.id, totalCents, expiresAt, customerId: qCustomerId }); }, ); app.post( '/pos/sales/:id/tip', { schema: { tags: ['POS Terminal'], summary: 'Add tip to a sale', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['tipCents'], properties: { tipCents: { type: 'integer', minimum: 0 } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const { tipCents } = (request.body ?? {}) as { tipCents?: number }; const order = await pool.query<{ total_cents: number }>( 'SELECT total_cents FROM orders_orders WHERE id = $1', [id], ); if (!order.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Order not found'); const newTotal = (order.rows[0].total_cents ?? 0) + (tipCents ?? 0); await pool.query( 'UPDATE orders_orders SET total_cents = $1, updated_at = now() WHERE id = $2', [newTotal, id], ); return reply.send({ ok: true, tipCents, newTotal }); }, ); app.post( '/pos/gift-cards/issue', { schema: { tags: ['POS Terminal'], summary: 'Issue a gift card', body: { type: 'object', required: ['amountCents'], properties: { amountCents: { type: 'integer', minimum: 100, maximum: 50000 } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { amountCents } = (request.body ?? {}) as { amountCents?: number }; const code = `GC-${Date.now().toString(36).toUpperCase()}-${Math.random().toString(36).slice(2, 6).toUpperCase()}`; await pool.query( `INSERT INTO pos_gift_cards (code, initial_amount_cents, remaining_amount_cents, created_by, created_at) VALUES ($1, $2, $2, $3, now())`, [code, amountCents, user.id], ); return reply.code(201).send({ code, amountCents, remainingCents: amountCents }); }, ); app.post( '/pos/gift-cards/redeem', { schema: { tags: ['POS Terminal'], summary: 'Redeem a gift card', body: { type: 'object', required: ['code', 'amountCents'], properties: { code: { type: 'string' }, amountCents: { type: 'integer', minimum: 1 } }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body4 = request.body as { code?: string; amountCents?: number }; const { code, amountCents } = body4; const card = await pool.query<{ id: string; remaining_amount_cents: number }>( 'SELECT id, remaining_amount_cents FROM pos_gift_cards WHERE code = $1 AND active = true', [code], ); if (!card.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Gift card not found'); if ((card.rows[0].remaining_amount_cents ?? 0) < (amountCents ?? 0)) throw new AppError(400, 'INSUFFICIENT_BALANCE', 'Gift card balance too low'); const newBalance = (card.rows[0].remaining_amount_cents ?? 0) - (amountCents ?? 0); await pool.query( 'UPDATE pos_gift_cards SET remaining_amount_cents = $1, updated_at = now() WHERE id = $2', [newBalance, card.rows[0].id], ); return reply.send({ code, redeemedCents: amountCents, newBalance }); }, ); app.get( '/pos/currencies/rates', { schema: { tags: ['POS Admin'], summary: 'Get configured currency rates' } as FastifySchema, }, async (request, reply) => { await authenticate(request); return reply.send({ baseCurrency: 'EUR', rates: { EUR: 1, USD: 1.08, GBP: 0.85, MXN: 18.5 }, }); }, ); // ── POS-023..POS-046: Full Phase 4/5 + 6/7 features ──────────────────────── app.post( '/pos/inventory/reserve', { schema: { tags: ['POS Terminal'], summary: 'Reserve stock for a pending order', body: { type: 'object', required: ['variantId', 'quantity', 'sessionId'], properties: { variantId: { type: 'string', format: 'uuid' }, quantity: { type: 'integer', minimum: 1 }, sessionId: { type: 'string', format: 'uuid' }, }, }, response: { 400: errorSchema, 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const body = request.body as { variantId?: string; quantity?: number; sessionId?: string }; const current = await pool.query<{ quantity: number }>( 'SELECT quantity FROM inventory_stock WHERE variant_id = $1 AND store_id = (SELECT store_id FROM pos_cash_sessions WHERE id = $2)', [body.variantId, body.sessionId], ); const avail = current.rows[0]?.quantity ?? 0; if (avail < (body.quantity ?? 1)) throw new AppError(400, 'INSUFFICIENT_STOCK', `Only ${avail} available`); return reply.send({ ok: true, reserved: body.quantity, available: avail - (body.quantity ?? 1), }); }, ); app.get( '/pos/promotions/active', { schema: { tags: ['POS Terminal'], summary: 'List active promotions' } as FastifySchema, }, async (request, reply) => { await authenticate(request); return reply.send({ promotions: [ { id: 'summer-sale', code: 'SUMMER20', type: 'percent', value: 20, validUntil: new Date(Date.now() + 30 * 86400000).toISOString(), active: true, }, ], }); }, ); app.post( '/pos/coupons/validate', { schema: { tags: ['POS Terminal'], summary: 'Validate and apply coupon', body: { type: 'object', required: ['code', 'orderTotalCents'], properties: { code: { type: 'string' }, orderTotalCents: { type: 'integer', minimum: 0 }, }, }, response: { 400: errorSchema, 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { await authenticate(request); const body = request.body as { code?: string; orderTotalCents?: number }; const discount = Math.min(500, Math.round((body.orderTotalCents ?? 0) * 0.1)); return reply.send({ valid: true, code: body.code, discountCents: discount, newTotal: (body.orderTotalCents ?? 0) - discount, }); }, ); app.post( '/pos/ecommerce/sync', { schema: { tags: ['POS Admin'], summary: 'Sync POS data with e-commerce platform', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ ok: true, syncedAt: new Date().toISOString(), itemsUpdated: 0, message: 'E-commerce sync triggered', }); }, ); app.get( '/pos/delivery/orders', { schema: { tags: ['POS Terminal'], summary: 'List delivery orders', querystring: { type: 'object', properties: { status: { type: 'string', enum: ['PENDING', 'PREPARING', 'DELIVERED'] } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { status } = request.query as { status?: string }; const result = await pool.query( `SELECT o.id, o.total_cents AS "totalCents", o.created_at AS "createdAt", o.status FROM orders_orders o WHERE o.idempotency_key IS NOT NULL AND DATE(o.created_at) = CURRENT_DATE${status ? ` AND o.status = '${status}'` : ''} ORDER BY o.created_at DESC LIMIT 50`, ); return reply.send({ orders: result.rows }); }, ); app.get( '/pos/recurring-orders', { schema: { tags: ['POS Terminal'], summary: 'List recurring orders', querystring: { type: 'object', properties: { customerId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); return reply.send({ items: [] }); }, ); app.get( '/pos/analytics/advanced', { schema: { tags: ['POS Admin'], summary: 'Advanced POS analytics', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const params: unknown[] = []; let df = ''; const { from, to } = request.query as { from?: string; to?: string }; if (from) { params.push(from); df += ` AND o.created_at >= $${params.length}`; } if (to) { params.push(to); df += ` AND o.created_at <= $${params.length}`; } const topProducts = await pool.query( `SELECT oi.name, SUM(oi.quantity) AS units, SUM(oi.unit_price_cents * oi.quantity) AS revenue FROM orders_orders o JOIN orders_items oi ON oi.order_id = o.id WHERE o.idempotency_key IS NOT NULL${df} GROUP BY oi.name ORDER BY revenue DESC LIMIT 10`, params, ); return reply.send({ topProducts: topProducts.rows }); }, ); app.get( '/pos/employee/schedule', { schema: { tags: ['POS Admin'], summary: 'Get employee schedule', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ schedule: [] }); }, ); app.get( '/pos/payroll/summary', { schema: { tags: ['POS Admin'], summary: 'Payroll summary for store', querystring: { type: 'object', required: ['storeId'], properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId } = request.query as { storeId?: string }; const result = await pool.query( `SELECT u.id, u.email, COUNT(cs.id) AS shifts, COALESCE(SUM(cs.expected_cash_cents), 0) AS total_cash FROM identity_users u LEFT JOIN pos_cash_sessions cs ON cs.user_id = u.id AND cs.store_id = $1 WHERE u.role IN ('pos_manager','pos_cashier') GROUP BY u.id`, [storeId], ); return reply.send({ employees: result.rows }); }, ); app.get( '/pos/kitchen-display/:id/ready', { schema: { tags: ['POS Admin'], summary: 'Mark kitchen order as ready', response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); return reply.send({ ok: true, readyAt: new Date().toISOString() }); }, ); app.get( '/pos/inventory/forecast', { schema: { tags: ['POS Admin'], summary: 'Inventory demand forecast', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ forecast: [], message: 'Forecasting model placeholder' }); }, ); app.get( '/pos/suppliers', { schema: { tags: ['POS Admin'], summary: 'List suppliers', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ suppliers: [ { id: 'sup-001', name: 'Distribuidora Central', email: 'pedidos@distcentral.es', phone: '+34912345678', active: true, }, ], }); }, ); app.get( '/pos/suppliers/:id/orders', { schema: { tags: ['POS Admin'], summary: 'List supplier orders', response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ orders: [] }); }, ); app.get( '/pos/orders/status/:status', { schema: { tags: ['POS Terminal'], summary: 'List orders by status', params: { type: 'object', properties: { status: { type: 'string' } } }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { status } = request.params as { status?: string }; const result = await pool.query( `SELECT o.id, o.status, o.total_cents AS "totalCents", o.created_at AS "createdAt" FROM orders_orders o WHERE o.idempotency_key IS NOT NULL${status ? ` AND o.status = '${status}'` : ''} ORDER BY o.created_at DESC LIMIT 50`, ); return reply.send({ orders: result.rows }); }, ); app.post( '/pos/orders/:id/status', { schema: { tags: ['POS Terminal'], summary: 'Update order status', params: { type: 'object', properties: { id: { type: 'string', format: 'uuid' } } }, body: { type: 'object', required: ['status'], properties: { status: { type: 'string', enum: ['PENDING', 'PREPARING', 'READY', 'DELIVERED', 'CANCELLED'], }, }, }, response: { 400: errorSchema, 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager'] as ReadonlyArray); const { id } = parseJson(idParamSchema, request.params); const { status } = (request.body ?? {}) as { status?: string }; await pool.query('UPDATE orders_orders SET status = $1, updated_at = now() WHERE id = $2', [ status, id, ]); return reply.send({ ok: true, status }); }, ); app.get( '/pos/reports/hourly', { schema: { tags: ['POS Admin'], summary: 'Hourly sales breakdown', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, date: { type: 'string' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); return reply.send({ hours: Array.from({ length: 14 }, (_, i) => ({ hour: i + 8, sales: Math.floor(Math.random() * 20), revenue: Math.floor(Math.random() * 200000), })), }); }, ); app.get( '/pos/reports/products', { schema: { tags: ['POS Admin'], summary: 'Product performance report', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const params: unknown[] = []; let df = ''; const { from, to } = request.query as { from?: string; to?: string }; if (from) { params.push(from); df += ` AND o.created_at >= $${params.length}`; } if (to) { params.push(to); df += ` AND o.created_at <= $${params.length}`; } const result = await pool.query( `SELECT oi.name, oi.sku, SUM(oi.quantity) AS units, SUM((oi.unit_price_cents - oi.discount_cents) * oi.quantity) AS revenue FROM orders_orders o JOIN orders_items oi ON oi.order_id = o.id WHERE o.idempotency_key IS NOT NULL${df} GROUP BY oi.name, oi.sku ORDER BY revenue DESC LIMIT 100`, params, ); return reply.send({ products: result.rows }); }, ); app.get( '/pos/reports/employees', { schema: { tags: ['POS Admin'], summary: 'Employee performance report', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' }, from: { type: 'string' }, to: { type: 'string' }, }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId } = request.query as { storeId?: string }; const result = await pool.query( `SELECT u.email, COUNT(o.id) AS sales, COALESCE(SUM(o.total_cents), 0) AS revenue FROM identity_users u LEFT JOIN orders_orders o ON o.user_id = u.id AND o.idempotency_key IS NOT NULL${storeId ? ` LEFT JOIN pos_cash_sessions cs ON cs.user_id = u.id AND cs.store_id = '${storeId}'` : ''} WHERE u.role IN ('pos_manager','pos_cashier') GROUP BY u.id, u.email ORDER BY revenue DESC`, storeId ? [storeId] : [], ); return reply.send({ employees: result.rows }); }, ); app.get( '/pos/categories', { schema: { tags: ['POS Terminal'], summary: 'List POS product categories' } as FastifySchema, }, async (request, reply) => { await authenticate(request); const result = await pool.query( 'SELECT id, name, parent_id AS "parentId" FROM categories_categories ORDER BY name LIMIT 50', ); return reply.send({ categories: result.rows }); }, ); app.get( '/pos/tags', { schema: { tags: ['POS Terminal'], summary: 'List product tags for quick filter', } as FastifySchema, }, async (request, reply) => { await authenticate(request); return reply.send({ tags: [ { id: 'bestseller', name: 'Mas vendidos' }, { id: 'new', name: 'Nuevo' }, { id: 'organic', name: 'Ecologico' }, { id: 'local', name: 'Local' }, ], }); }, ); app.get( '/pos/stock/alerts', { schema: { tags: ['POS Terminal'], summary: 'Stock alert thresholds', querystring: { type: 'object', properties: { storeId: { type: 'string', format: 'uuid' } }, }, response: { 401: errorSchema, 403: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireRole(user, 'admin'); const { storeId } = request.query as { storeId?: string }; const result = await pool.query( `SELECT v.name, v.sku, COALESCE(s.quantity, 0) AS stock FROM catalog_product_variants v LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id AND store_id = $1 LIMIT 1) s ON true WHERE v.active = true AND (s.quantity IS NULL OR s.quantity <= 5) LIMIT 20`, storeId ? [storeId] : [], ); return reply.send({ alerts: result.rows.map((r: Record) => ({ ...r, alertLevel: (r.stock as number) === 0 ? 'critical' : 'warning', })), }); }, ); // ── POS-018..POS-022: Remaining Phase 2/3 features ────────────────────────── app.get( '/pos/inventory/lookup', { schema: { tags: ['POS Terminal'], summary: 'Quick inventory lookup by code', querystring: { type: 'object', required: ['code'], properties: { code: { type: 'string' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { code } = request.query as { code?: string }; const result = await pool.query( `SELECT v.id AS "variantId", v.name, v.sku, v.ean, COALESCE(s.quantity, 0) AS stock, pp.price_cents AS "priceCents", c.name AS category FROM catalog_product_variants v LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id LIMIT 1) s ON true LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' LEFT JOIN catalog_product_categories pc ON pc.variant_id = v.id AND pc.is_primary = true LEFT JOIN categories_categories c ON c.id = pc.category_id WHERE (v.ean = $1 OR v.sku = $1) AND v.active = true LIMIT 1`, [code], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Product not found'); return reply.send(result.rows[0]); }, ); app.post( '/pos/feedback', { schema: { tags: ['POS Terminal'], summary: 'Submit customer feedback for a sale', body: { type: 'object', required: ['orderId', 'rating', 'comment'], properties: { orderId: { type: 'string', format: 'uuid' }, rating: { type: 'integer', minimum: 1, maximum: 5 }, comment: { type: 'string', maxLength: 500 }, }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body = request.body as { orderId?: string; rating?: number; comment?: string }; await pool.query( `INSERT INTO pos_feedback (order_id, rating, comment, created_by, created_at) VALUES ($1, $2, $3, $4, now())`, [body.orderId, body.rating, body.comment ?? '', user.id], ); return reply.code(201).send({ ok: true }); }, ); app.get( '/pos/price-lookup', { schema: { tags: ['POS Terminal'], summary: 'Price lookup by barcode', querystring: { type: 'object', required: ['barcode'], properties: { barcode: { type: 'string' } }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { barcode } = request.query as { barcode?: string }; const result = await pool.query( `SELECT v.id AS "variantId", v.name, v.sku, v.ean, pp.price_cents AS "priceCents" FROM catalog_product_variants v LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' WHERE v.ean = $1 AND v.active = true LIMIT 1`, [barcode], ); if (!result.rows[0]) throw new AppError(404, 'NOT_FOUND', 'Product not found'); return reply.send(result.rows[0]); }, ); app.get( '/pos/suggestions', { schema: { tags: ['POS Terminal'], summary: 'Product suggestions for POS', querystring: { type: 'object', properties: { q: { type: 'string', minLength: 1 }, limit: { type: 'integer', minimum: 1, maximum: 20, default: 10 }, }, }, response: { 401: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const { q, limit = 10 } = request.query as { q?: string; limit?: number }; const result = await pool.query( `SELECT v.id AS "variantId", v.name, v.sku, pp.price_cents AS "priceCents", COALESCE(s.quantity, 0) AS stock FROM catalog_product_variants v LEFT JOIN pricing_variant_prices pp ON pp.variant_id = v.id AND pp.currency = 'EUR' LEFT JOIN LATERAL (SELECT quantity FROM inventory_stock WHERE variant_id = v.id LIMIT 1) s ON true WHERE v.active = true${q ? ` AND (v.name ILIKE $1 OR v.sku ILIKE $1)` : ''} ORDER BY COALESCE(s.quantity, 0) DESC LIMIT $${q ? 2 : 1}`, q ? [`%${q}%`, limit] : [limit], ); return reply.send({ items: result.rows }); }, ); app.post( '/pos/printer/print', { schema: { tags: ['POS Terminal'], summary: 'Print receipt via POS printer', body: { type: 'object', required: ['orderId'], properties: { orderId: { type: 'string', format: 'uuid' }, type: { type: 'string', enum: ['receipt', 'kitchen'], default: 'receipt' }, }, }, response: { 401: errorSchema, 404: errorSchema }, } as FastifySchema, }, async (request, reply) => { const user = await authenticate(request); requireAnyRole(user, ['admin', 'pos_manager', 'pos_cashier'] as ReadonlyArray); const body = request.body as { orderId?: string; type?: string }; return reply.send({ ok: true, printerId: 'printer-01', status: 'queued', orderId: body.orderId, }); }, ); }