Upload api/routes/routes.ts

api/routes/routes.ts

@@ -0,0 +1,110 @@
+// API Routes — Express/Fastify
+// Modular backend: separate service layers for identity, vendor, booking, contract, admin
+
+import { requirePermission, requireRole, requireContractAccess, Permission, Role } from './middleware/rbac'
+
+// ── Auth Routes ──
+// POST   /api/v1/auth/register         — Create account (bcrypt hash)
+// POST   /api/v1/auth/login             — Email + password, returns session cookie
+// POST   /api/v1/auth/oidc/callback     — OIDC callback (Cognito/Keycloak)
+// POST   /api/v1/auth/oidc/google       — Google OAuth
+// POST   /api/v1/auth/oidc/apple        — Apple OAuth
+// POST   /api/v1/auth/logout            — Revoke session
+// POST   /api/v1/auth/refresh           — Refresh session
+// POST   /api/v1/auth/mfa/verify        — MFA verification
+// POST   /api/v1/auth/impersonate       — Admin impersonation (requires IMPERSONATE_USERS, reason field, TTL)
+// POST   /api/v1/auth/switch-role       — Switch active role (if user has multiple)
+// POST   /api/v1/auth/password-reset    — Email password reset link
+// POST   /api/v1/auth/verify-email      — Email verification
+// GET    /api/v1/auth/session           — Get current session
+
+// ── Client Routes ──
+// requireRole(CLIENT) on all
+// GET    /api/v1/client/profile         — Get profile
+// PUT    /api/v1/client/profile         — Update profile
+// GET    /api/v1/client/bookings         — List bookings
+// POST   /api/v1/client/bookings         — Create booking (idempotency key required)
+// GET    /api/v1/client/bookings/:id     — Booking detail
+// PUT    /api/v1/client/bookings/:id     — Update booking
+// DELETE /api/v1/client/bookings/:id     — Cancel booking
+// GET    /api/v1/client/shortlist        — List shortlisted vendors
+// POST   /api/v1/client/shortlist/:vendorId — Shortlist vendor
+// DELETE /api/v1/client/shortlist/:vendorId — Remove from shortlist
+// GET    /api/v1/client/workspaces       — List workspaces
+// POST   /api/v1/client/workspaces       — Create workspace
+// PUT    /api/v1/client/workspaces/:id   — Update workspace
+// GET    /api/v1/client/notifications    — List notifications
+// PUT    /api/v1/client/notifications/:id/read — Mark as read
+
+// ── Vendor Routes ──
+// requireRole(VENDOR) on protected routes
+// POST   /api/v1/vendors/onboard         — Vendor onboarding (KYC submission)
+// GET    /api/v1/vendors/:id              — Public vendor profile
+// PUT    /api/v1/vendors/profile          — Update own profile (requires MANAGE_PROFILE)
+// POST   /api/v1/vendors/packages         — Create package
+// PUT    /api/v1/vendors/packages/:id     — Update package
+// DELETE /api/v1/vendors/packages/:id     — Delete package
+// GET    /api/v1/vendors/leads            — List leads (requires VIEW_LEADS)
+// PUT    /api/v1/vendors/leads/:id        — Update lead status
+// GET    /api/v1/vendors/analytics        — KPI dashboard
+// GET    /api/v1/vendors/availability     — List availability
+// POST   /api/v1/vendors/availability     — Set availability
+// DELETE /api/v1/vendors/availability/:id — Remove availability
+
+// ── Contract Routes ──
+// Each route has contract-scoped access control
+// POST   /api/v1/contracts                       — Create contract (vendor only, CREATE_CONTRACT)
+// GET    /api/v1/contracts                        — List contracts (scoped to user)
+// GET    /api/v1/contracts/:id                    — Get contract (requireContractAccess)
+// PUT    /api/v1/contracts/:id                    — Update contract (vendor owner only)
+// POST   /api/v1/contracts/:id/send               — Send to client (vendor, SEND_CONTRACT)
+// POST   /api/v1/contracts/:id/sign               — Client e-sign (client signer only, SIGN_CONTRACT)
+// POST   /api/v1/contracts/:id/decline            — Client decline
+// POST   /api/v1/contracts/:id/amend              — Request amendment (client: REQUEST_AMENDMENT)
+// POST   /api/v1/contracts/:id/amend/:versionId/accept — Vendor accepts amendment
+// GET    /api/v1/contracts/:id/audit               — Get audit trail
+// GET    /api/v1/contracts/:id/versions            — List all versions
+// GET    /api/v1/contracts/:id/versions/:versionId — Get specific version snapshot
+// POST   /api/v1/contracts/:id/dispute             — Client disputes contract
+// POST   /api/v1/contracts/:id/resolve             — Admin resolves dispute (MEDIATE_DISPUTES)
+// GET    /api/v1/contracts/:id/export/pdf          — Export signed contract as PDF
+// GET    /api/v1/contracts/:id/export/audit/pdf    — Export audit trail as PDF
+// GET    /api/v1/contracts/:id/export/audit/csv    — Export audit trail as CSV
+// POST   /api/v1/contracts/:id/deliverables          — Add deliverable
+// PUT    /api/v1/contracts/:id/deliverables/:did     — Update deliverable
+// PUT    /api/v1/contracts/:id/deliverables/:did/complete — Mark deliverable complete
+
+// ── Admin Routes ──
+// requireRole(ADMIN) with specific permissions
+// GET    /api/v1/admin/dashboard           — Operations dashboard
+// GET    /api/v1/admin/moderation           — Moderation queue
+// POST   /api/v1/admin/moderation/:id/approve — Approve item
+// POST   /api/v1/admin/moderation/:id/reject  — Reject item
+// GET    /api/v1/admin/vendors              — All vendors (require MODERATE_VENDORS)
+// PUT    /api/v1/admin/vendors/:id/verify   — Verify vendor
+// GET    /api/v1/admin/categories           — List categories
+// POST   /api/v1/admin/categories           — Create category (require MANAGE_CATEGORIES)
+// PUT    /api/v1/admin/categories/:id       — Update category
+// GET    /api/v1/admin/contracts             — All contracts (require OVERSEE_CONTRACTS)
+// POST   /api/v1/admin/contracts/:id/mediate — Mediate contract
+// GET    /api/v1/admin/users                 — List users (require MANAGE_USERS)
+// POST   /api/v1/admin/users/:id/impersonate — Impersonate (require IMPERSONATE_USERS)
+// GET    /api/v1/admin/audit-logs            — View admin audit logs
+// POST   /api/v1/admin/schema/publish        — Publish schema/config changes (require MANAGE_CATEGORIES)
+// GET    /api/v1/admin/schema/diff           — View schema diff before publish
+// PUT    /api/v1/admin/templates/:id/approve — Approve contract template
+// PUT    /api/v1/admin/templates/:id/reject  — Reject contract template
+
+// ── Search Routes (public) ──
+// GET    /api/v1/search                      — Faceted vendor search
+// Query params: q, category, district, priceMin, priceMax, rating, sort, page, limit
+
+// ── Payment Routes ──
+// POST   /api/v1/payments/create-checkout     — Create Stripe checkout session
+// POST   /api/v1/payments/webhook             — Stripe webhook (HMAC verified)
+// GET    /api/v1/payments/history             — Payment history
+
+// ── Notification Routes ──
+// GET    /api/v1/notifications                — List notifications (scoped to user)
+// PUT    /api/v1/notifications/:id/read       — Mark as read
+// POST   /api/v1/notifications/send           — Admin: send notification (require MANAGE_USERS)