a6c0f3de-eeb0-4d76-a57f-f600dd133c06

src/app/api/aos/clients/route.ts

@@ -0,0 +1,87 @@
+import { NextResponse } from 'next/server'
+import { db } from '@/lib/db'
+import { z } from 'zod'
+
+export const dynamic = 'force-dynamic'
+
+const createSchema = z.object({
+  name: z.string().min(1).max(200),
+  legalForm: z.string().max(50).optional(),
+  vatId: z.string().max(50).optional(),
+  website: z.string().max(200).optional(),
+  email: z.string().email().optional(),
+  phone: z.string().max(50).optional(),
+  city: z.string().max(100).optional(),
+  zip: z.string().max(20).optional(),
+  street: z.string().max(200).optional(),
+  // The agency creating this client. Required. The new client will have
+  // parentAgencyId set to this, so their tickets route to the agency.
+  parentAgencyId: z.string().min(1),
+})
+
+// GET /api/aos/clients?agencyId=X
+// Returns clients belonging to an agency (or all clients if no agencyId).
+export async function GET(req: Request) {
+  try {
+    const url = new URL(req.url)
+    const agencyId = url.searchParams.get('agencyId')
+    const where = agencyId ? { parentAgencyId: agencyId } : {}
+    const clients = await db.company.findMany({
+      where,
+      orderBy: { createdAt: 'desc' },
+      include: {
+        _count: { select: { licenses: true, tickets: true } },
+      },
+    })
+    return NextResponse.json({ clients })
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : 'internal server error'
+    return NextResponse.json({ error: msg }, { status: 500 })
+  }
+}
+
+// POST /api/aos/clients
+// An agency onboards a new client. The client is created with parentAgencyId
+// set to the agency's company id, so all future tickets auto-route to agency.
+export async function POST(req: Request) {
+  try {
+    const parsed = createSchema.safeParse(await req.json())
+    if (!parsed.success) {
+      return NextResponse.json({ error: 'validation failed', details: parsed.error.flatten() }, { status: 400 })
+    }
+    const { parentAgencyId, ...clientData } = parsed.data
+
+    // Verify the agency exists and is approved.
+    const agency = await db.company.findUnique({ where: { id: parentAgencyId } })
+    if (!agency) {
+      return NextResponse.json({ error: 'agency not found' }, { status: 404 })
+    }
+    if (!agency.isAgency || agency.agencyStatus !== 'approved') {
+      return NextResponse.json({ error: 'company is not an approved agency' }, { status: 403 })
+    }
+
+    const client = await db.company.create({
+      data: {
+        ...clientData,
+        source: 'agency',
+        parentAgencyId,
+      },
+    })
+
+    await db.auditLog.create({
+      data: {
+        actor: `agency:${agency.name}`,
+        action: 'client.create',
+        entity: 'Company',
+        entityId: client.id,
+        after: JSON.stringify({ name: client.name, parentAgencyId, agencyDiscountPct: agency.agencyDiscountPct }),
+        hash: 'sha256:' + Math.random().toString(36).slice(2),
+      },
+    })
+
+    return NextResponse.json({ client }, { status: 201 })
+  } catch (err) {
+    const msg = err instanceof Error ? err.message : 'internal server error'
+    return NextResponse.json({ error: msg }, { status: 500 })
+  }
+}