supersam/supabase/functions/confirm-delivery-choice/index.ts

import {
  getOrderUpdateForDeliveryInvitationAction,
  hashInvitationToken,
  isActiveInvitationState,
  isInvitationExpired,
} from "../_shared/delivery-invitations.ts";
import { createServiceClient } from "../_shared/chatbot.ts";
import { insertIntegrationEvent } from "../_shared/integration-events.ts";
import {
  getClientIp,
  getCorsHeaders,
  hashText,
  jsonResponse,
  preflightResponse,
  readJsonBody,
  requireRateLimit,
} from "../_shared/security.ts";

const MAX_BODY_BYTES = 8 * 1024;

type ConfirmBody = {
  token?: string;
  deliveryDate?: string;
  deliveryTime?: string;
};

const isValidDate = (value: string) => /^\d{4}-\d{2}-\d{2}$/.test(value);

const resolveRequestedSlot = (
  invitation: {
    delivery_date?: string | null;
    delivery_time?: string | null;
    available_slots?: string[] | null;
  },
  body: ConfirmBody,
) => {
  const deliveryDate = String(body.deliveryDate || invitation.delivery_date || "").trim();
  const deliveryTime = String(body.deliveryTime || invitation.delivery_time || "").trim();

  if (!deliveryDate || !deliveryTime || !isValidDate(deliveryDate)) {
    return null;
  }

  const slotLabel = `${deliveryDate}, ${deliveryTime}`;
  const availableSlots = invitation.available_slots || [];

  if (availableSlots.length > 0 && !availableSlots.includes(slotLabel)) {
    return null;
  }

  return { deliveryDate, deliveryTime };
};

Deno.serve(async (request) => {
  if (request.method === "OPTIONS") {
    return preflightResponse(request, "public");
  }

  if (request.method !== "POST") {
    return jsonResponse({ ok: false, error: "Method not allowed" }, 405);
  }

  const corsHeaders = getCorsHeaders(request, "public");
  if (!corsHeaders) {
    return jsonResponse({ ok: false, error: "Origin not allowed" }, 403);
  }

  try {
    const { body } = await readJsonBody<ConfirmBody>(request, {
      maxBytes: MAX_BODY_BYTES,
    });

    if (!body.token) {
      return jsonResponse({ ok: false, error: "token is required" }, 400, corsHeaders);
    }

    const tokenHash = await hashInvitationToken(body.token);
    const supabase = createServiceClient();
    const ipHash = await hashText(getClientIp(request));

    await requireRateLimit(supabase, {
      scope: "invitation-confirm",
      key: `${ipHash}:${tokenHash.slice(0, 16)}`,
      maxCount: 5,
      windowSeconds: 600,
      blockSeconds: 3600,
    });

    const { data: invitation, error: invitationError } = await supabase
      .from("delivery_invitations")
      .select("*")
      .eq("token_hash", tokenHash)
      .single();

    if (invitationError) {
      if (invitationError.code === "PGRST116") {
        return jsonResponse({ ok: false, error: "Invitation not found" }, 404, corsHeaders);
      }

      throw invitationError;
    }

    if (isInvitationExpired(invitation)) {
      return jsonResponse({ ok: false, error: "Invitation expired" }, 410, corsHeaders);
    }

    const { data: currentOrder, error: orderError } = await supabase
      .from("orders")
      .select("id, status, delivery_agreement_status")
      .eq("id", invitation.order_id)
      .single();

    if (orderError) {
      throw orderError;
    }

    if (!isActiveInvitationState(invitation.state) || !["Ожидает ответа клиента", "Ожидает согласования доставки"].includes(currentOrder.status)) {
      return jsonResponse(
        {
          ok: false,
          error: "Invitation is no longer active",
        },
        409,
        corsHeaders,
      );
    }

    const requestedSlot = resolveRequestedSlot(invitation, body);
    if (!requestedSlot) {
      return jsonResponse(
        {
          ok: false,
          error: "Selected slot is not available",
        },
        422,
        corsHeaders,
      );
    }

    const orderUpdate = getOrderUpdateForDeliveryInvitationAction("confirm_delivery_choice");

    const { error: invitationUpdateError } = await supabase
      .from("delivery_invitations")
      .update({
        state: "agreed",
        delivery_date: requestedSlot.deliveryDate,
        delivery_time: requestedSlot.deliveryTime,
        confirmed_at: new Date().toISOString(),
        access_count: (invitation.access_count || 0) + 1,
        last_accessed_at: new Date().toISOString(),
      })
      .eq("id", invitation.id);

    if (invitationUpdateError) {
      throw invitationUpdateError;
    }

    const { error: orderUpdateError } = await supabase
      .from("orders")
      .update({
        status: orderUpdate?.status,
        delivery_agreement_status: orderUpdate?.deliveryAgreementStatus,
      })
      .eq("id", invitation.order_id);

    if (orderUpdateError) {
      throw orderUpdateError;
    }

    const { error: slotError } = await supabase.from("delivery_slots").insert({
      order_id: invitation.order_id,
      delivery_date: requestedSlot.deliveryDate,
      delivery_time: requestedSlot.deliveryTime,
      logistician_id: null,
      status: "confirmed_by_client",
    });

    if (slotError) {
      throw slotError;
    }

    const { error: historyError } = await supabase.from("order_history").insert({
      order_id: invitation.order_id,
      action: "Подтверждение выбора доставки клиентом",
      old_status: currentOrder.status,
      new_status: orderUpdate?.status,
      metadata: {
        old_delivery_agreement_status: currentOrder.delivery_agreement_status,
        new_delivery_agreement_status: orderUpdate?.deliveryAgreementStatus,
        delivery_date: requestedSlot.deliveryDate,
        delivery_time: requestedSlot.deliveryTime,
      },
    });

    if (historyError) {
      throw historyError;
    }

    await insertIntegrationEvent(supabase, {
      order_id: invitation.order_id,
      event_type: "delivery_choice_confirmed",
      direction: "inbound",
      status: "success",
      payload: {
        delivery_date: requestedSlot.deliveryDate,
        delivery_time: requestedSlot.deliveryTime,
      },
    });

    return jsonResponse(
      {
        ok: true,
        orderId: invitation.order_id,
        status: orderUpdate?.status,
        deliveryAgreementStatus: orderUpdate?.deliveryAgreementStatus,
      },
      200,
      corsHeaders,
    );
  } catch (error) {
    if (error instanceof Error && "status" in error) {
      const httpError = error as { status: number; message: string };
      return jsonResponse({ ok: false, error: httpError.message }, httpError.status, corsHeaders);
    }

    return jsonResponse(
      {
        ok: false,
        error: error instanceof Error ? error.message : "Unexpected error",
      },
      500,
      corsHeaders,
    );
  }
});