deploy: add /chefsys routes (foods, drinks, add-on, order)

server.js

@@ -8,6 +8,7 @@ import swaggerUi from 'swagger-ui-express';
 import projectsRouter from './src/routes/projects.js';
 import ticketsRouter from './src/routes/tickets.js';
 import flowRouter from './src/routes/flow.js';
+import chefsysRouter from './src/routes/chefsys.js';
 import { openapiSpec } from './src/openapi.js';
 
 dotenv.config();
@@ -18,6 +19,49 @@ const __dirname = path.dirname(__filename);
 const app = express();
 const PORT = process.env.PORT || 3000;
 
+// Derive the Supabase storage origin so images can be whitelisted explicitly
+// (instead of using a wildcard) in the Content-Security-Policy.
+let supabaseOrigin = '';
+try {
+  if (process.env.SUPABASE_URL) supabaseOrigin = new URL(process.env.SUPABASE_URL).origin;
+} catch {
+  supabaseOrigin = '';
+}
+
+const baseCsp = [
+  "default-src 'self'",
+  "script-src 'self'",
+  "style-src 'self' 'unsafe-inline' https://fonts.googleapis.com",
+  "font-src 'self' https://fonts.gstatic.com",
+  `img-src 'self' data: blob:${supabaseOrigin ? ' ' + supabaseOrigin : ''}`,
+  `connect-src 'self'${supabaseOrigin ? ' ' + supabaseOrigin : ''}`,
+  "object-src 'none'",
+  "base-uri 'self'",
+  "form-action 'self'",
+  "frame-ancestors 'none'"
+].join('; ');
+
+// Swagger UI ships inline scripts/styles, so it needs a slightly relaxed policy.
+const swaggerCsp = [
+  "default-src 'self'",
+  "script-src 'self' 'unsafe-inline'",
+  "style-src 'self' 'unsafe-inline'",
+  "img-src 'self' data:",
+  "object-src 'none'",
+  "base-uri 'self'",
+  "frame-ancestors 'none'"
+].join('; ');
+
+app.use((req, res, next) => {
+  res.setHeader(
+    'Content-Security-Policy',
+    req.path.startsWith('/api-docs') ? swaggerCsp : baseCsp
+  );
+  res.setHeader('X-Content-Type-Options', 'nosniff');
+  res.setHeader('Referrer-Policy', 'no-referrer');
+  next();
+});
+
 app.use(cors());
 app.use(express.json({ limit: '5mb' }));
 
@@ -25,6 +69,7 @@ app.use(express.json({ limit: '5mb' }));
 app.use('/api/projects', projectsRouter);
 app.use('/api/tickets', ticketsRouter);
 app.use('/flow/tickets', flowRouter);
+app.use('/chefsys', chefsysRouter);
 
 app.get('/api/health', (req, res) => res.json({ ok: true }));
 

src/openapi.js

@@ -13,7 +13,8 @@ export const openapiSpec = {
     { name: 'Health', description: 'Service health' },
     { name: 'Projects', description: 'Project management' },
     { name: 'Tickets', description: 'Ticket management (board)' },
-    { name: 'Flow', description: 'Lightweight ticket flow API for agents' }
+    { name: 'Flow', description: 'Lightweight ticket flow API for agents' },
+    { name: 'ChefSys', description: 'Chef system: menu items (foods/drinks/add-ons) & orders' }
   ],
   components: {
     schemas: {
@@ -93,6 +94,65 @@ export const openapiSpec = {
           message: { type: 'string' },
           detail: { type: 'string' }
         }
+      },
+      ChefMenuItem: {
+        type: 'object',
+        properties: {
+          id: { type: 'integer', readOnly: true },
+          name: { type: 'string' },
+          price: { type: 'number' },
+          description: { type: 'string', nullable: true },
+          creatid: { type: 'string', format: 'date-time', readOnly: true }
+        }
+      },
+      ChefAddon: {
+        type: 'object',
+        properties: {
+          id: { type: 'integer', readOnly: true },
+          name: { type: 'string' },
+          price: { type: 'number' },
+          creatid: { type: 'string', format: 'date-time', readOnly: true }
+        }
+      },
+      ChefOrderItem: {
+        type: 'object',
+        properties: {
+          type: { type: 'string', enum: ['food', 'drink', 'addon'] },
+          id: { type: 'integer' },
+          name: { type: 'string', readOnly: true },
+          price: { type: 'number', readOnly: true },
+          qty: { type: 'integer' }
+        }
+      },
+      ChefOrder: {
+        type: 'object',
+        properties: {
+          id: { type: 'integer', readOnly: true },
+          client: { type: 'integer' },
+          total_item: { type: 'integer', readOnly: true },
+          total_price: { type: 'integer', readOnly: true },
+          detail: { type: 'array', items: { $ref: '#/components/schemas/ChefOrderItem' } },
+          created_at: { type: 'string', format: 'date-time', readOnly: true }
+        }
+      },
+      ChefOrderInput: {
+        type: 'object',
+        required: ['client', 'items'],
+        properties: {
+          client: { type: 'integer' },
+          items: {
+            type: 'array',
+            items: {
+              type: 'object',
+              required: ['type', 'id', 'qty'],
+              properties: {
+                type: { type: 'string', enum: ['food', 'drink', 'addon'] },
+                id: { type: 'integer' },
+                qty: { type: 'integer', minimum: 1 }
+              }
+            }
+          }
+        }
       }
     },
     responses: {
@@ -429,6 +489,91 @@ export const openapiSpec = {
           404: { $ref: '#/components/responses/NotFound' }
         }
       }
+    },
+    '/chefsys/foods': {
+      get: {
+        tags: ['ChefSys'],
+        summary: 'List foods',
+        responses: {
+          200: {
+            description: 'Array of foods',
+            content: {
+              'application/json': {
+                schema: { type: 'array', items: { $ref: '#/components/schemas/ChefMenuItem' } }
+              }
+            }
+          },
+          500: { $ref: '#/components/responses/ServerError' }
+        }
+      }
+    },
+    '/chefsys/drinks': {
+      get: {
+        tags: ['ChefSys'],
+        summary: 'List drinks',
+        responses: {
+          200: {
+            description: 'Array of drinks',
+            content: {
+              'application/json': {
+                schema: { type: 'array', items: { $ref: '#/components/schemas/ChefMenuItem' } }
+              }
+            }
+          },
+          500: { $ref: '#/components/responses/ServerError' }
+        }
+      }
+    },
+    '/chefsys/add-on': {
+      get: {
+        tags: ['ChefSys'],
+        summary: 'List add-ons',
+        responses: {
+          200: {
+            description: 'Array of add-ons',
+            content: {
+              'application/json': {
+                schema: { type: 'array', items: { $ref: '#/components/schemas/ChefAddon' } }
+              }
+            }
+          },
+          500: { $ref: '#/components/responses/ServerError' }
+        }
+      }
+    },
+    '/chefsys/order': {
+      get: {
+        tags: ['ChefSys'],
+        summary: 'List all orders',
+        responses: {
+          200: {
+            description: 'Array of orders',
+            content: {
+              'application/json': {
+                schema: { type: 'array', items: { $ref: '#/components/schemas/ChefOrder' } }
+              }
+            }
+          },
+          500: { $ref: '#/components/responses/ServerError' }
+        }
+      },
+      post: {
+        tags: ['ChefSys'],
+        summary: 'Create an order',
+        description: 'Item name/price are re-resolved server-side from foods/drinks/add-ons; total is computed from them.',
+        requestBody: {
+          required: true,
+          content: { 'application/json': { schema: { $ref: '#/components/schemas/ChefOrderInput' } } }
+        },
+        responses: {
+          201: {
+            description: 'Created',
+            content: { 'application/json': { schema: { $ref: '#/components/schemas/ChefOrder' } } }
+          },
+          400: { $ref: '#/components/responses/BadRequest' },
+          500: { $ref: '#/components/responses/ServerError' }
+        }
+      }
     }
   }
 };

src/routes/chefsys.js

@@ -0,0 +1,125 @@
+import { Router } from 'express';
+import { supabase } from '../supabase.js';
+
+// ChefSys API: menu (foods/drinks/add-ons) + orders. Mounted at /chefsys.
+const router = Router();
+
+const FOOD_TABLE = 'chef_food';
+const DRINK_TABLE = 'chef_drink';
+const ADDON_TABLE = 'chef_addon';
+const ORDER_TABLE = 'chef_order';
+
+const ITEM_TABLES = {
+  food: FOOD_TABLE,
+  drink: DRINK_TABLE,
+  addon: ADDON_TABLE
+};
+
+const SMALLINT_MAX = 32767; // chef_order.total_item / total_price are smallint columns
+
+// GET /chefsys/foods
+router.get('/foods', async (req, res) => {
+  const { data, error } = await supabase
+    .from(FOOD_TABLE)
+    .select('*')
+    .order('id', { ascending: true });
+  if (error) return res.status(500).json({ error: error.message });
+  res.json(data);
+});
+
+// GET /chefsys/drinks
+router.get('/drinks', async (req, res) => {
+  const { data, error } = await supabase
+    .from(DRINK_TABLE)
+    .select('*')
+    .order('id', { ascending: true });
+  if (error) return res.status(500).json({ error: error.message });
+  res.json(data);
+});
+
+// GET /chefsys/add-on
+router.get('/add-on', async (req, res) => {
+  const { data, error } = await supabase
+    .from(ADDON_TABLE)
+    .select('*')
+    .order('id', { ascending: true });
+  if (error) return res.status(500).json({ error: error.message });
+  res.json(data);
+});
+
+// GET /chefsys/order — all orders
+router.get('/order', async (req, res) => {
+  const { data, error } = await supabase
+    .from(ORDER_TABLE)
+    .select('*')
+    .order('id', { ascending: true });
+  if (error) return res.status(500).json({ error: error.message });
+  res.json(data);
+});
+
+// POST /chefsys/order  body: { client, items: [{ type: 'food'|'drink'|'addon', id, qty }] }
+router.post('/order', async (req, res) => {
+  const { client, items } = req.body;
+  if (client == null || !Number.isInteger(Number(client))) {
+    return res.status(400).json({ error: 'client is required and must be an integer' });
+  }
+  if (!Array.isArray(items) || items.length === 0) {
+    return res.status(400).json({ error: 'items is required and must be a non-empty array' });
+  }
+  for (const it of items) {
+    if (!it || !ITEM_TABLES[it.type]) {
+      return res.status(400).json({ error: `item type must be one of ${Object.keys(ITEM_TABLES).join(', ')}` });
+    }
+    if (it.id == null) return res.status(400).json({ error: 'item id is required' });
+    if (!Number.isInteger(Number(it.qty)) || Number(it.qty) < 1) {
+      return res.status(400).json({ error: 'item qty must be a positive integer' });
+    }
+  }
+
+  let resolved;
+  try {
+    resolved = await resolveItems(items);
+  } catch (err) {
+    return res.status(400).json({ error: err.message });
+  }
+
+  const total_item = resolved.reduce((sum, it) => sum + it.qty, 0);
+  const total_price = resolved.reduce((sum, it) => sum + it.price * it.qty, 0);
+  if (total_item > SMALLINT_MAX || total_price > SMALLINT_MAX) {
+    return res.status(400).json({ error: `order total exceeds the maximum allowed value (${SMALLINT_MAX})` });
+  }
+
+  const { data, error } = await supabase
+    .from(ORDER_TABLE)
+    .insert({ client: Number(client), total_item, total_price, detail: resolved })
+    .select('*')
+    .single();
+  if (error) return res.status(500).json({ error: error.message });
+  res.status(201).json(data);
+});
+
+// Re-resolve name/price for each ordered item server-side (never trust client-supplied prices).
+async function resolveItems(items) {
+  const idsByType = {};
+  for (const it of items) {
+    (idsByType[it.type] ??= new Set()).add(it.id);
+  }
+
+  const rowsByType = {};
+  for (const [type, ids] of Object.entries(idsByType)) {
+    const { data, error } = await supabase
+      .from(ITEM_TABLES[type])
+      .select('id, name, price')
+      .in('id', [...ids]);
+    if (error) throw new Error(error.message);
+    rowsByType[type] = new Map(data.map((row) => [row.id, row]));
+  }
+
+  return items.map((it) => {
+    const row = rowsByType[it.type].get(it.id);
+    if (!row) throw new Error(`${it.type} not found: ${it.id}`);
+    return { type: it.type, id: row.id, name: row.name, price: Number(row.price), qty: Number(it.qty) };
+  });
+}
+
+export default router;