Webklar-Kundenbereich/server/routes/customerData.js

import { Router } from 'express'
import { config } from '../config.js'
import { getSessionCustomerId, requireSession } from '../middleware/session.js'
import { getDocument } from '../services/appwriteAdmin.js'
import { getCustomerActivity } from '../services/customerActivity.js'
import { fetchInvoicePdf, getInvoiceRaw, listInvoicesForClient } from '../services/invoiceNinja.js'

const router = Router()

/** Rechnungen des eingeloggten Kunden (InvoiceNinja, sofern verknuepft). */
router.get('/invoices', requireSession, async (req, res) => {
  try {
    const customer = await getDocument(
      config.collections.customers,
      getSessionCustomerId(req)
    ).catch(() => null)
    if (!customer) {
      return res.status(404).json({ error: 'Kunde nicht gefunden' })
    }
    if (!customer.invoiceNinjaClientId) {
      return res.json({ linked: false, invoices: [] })
    }
    const invoices = await listInvoicesForClient(customer.invoiceNinjaClientId)
    return res.json({ linked: true, invoices })
  } catch (err) {
    return res.status(500).json({ error: err.message || 'Rechnungen konnten nicht geladen werden' })
  }
})

/** Rechnungs-PDF des eingeloggten Kunden (Download ueber Server-Proxy). */
router.get('/invoices/:invoiceId/pdf', requireSession, async (req, res) => {
  try {
    const customer = await getDocument(
      config.collections.customers,
      getSessionCustomerId(req)
    ).catch(() => null)
    if (!customer?.invoiceNinjaClientId) {
      return res.status(404).json({ error: 'Rechnung nicht gefunden' })
    }

    const invoice = await getInvoiceRaw(req.params.invoiceId).catch(() => null)
    // Ownership-Pruefung: Rechnung muss zum InvoiceNinja-Client des Kunden gehoeren
    if (!invoice || invoice.client_id !== customer.invoiceNinjaClientId) {
      return res.status(404).json({ error: 'Rechnung nicht gefunden' })
    }

    const invitationKey = invoice.invitations?.[0]?.key
    if (!invitationKey) {
      return res.status(404).json({ error: 'Kein PDF verfuegbar' })
    }

    const pdf = await fetchInvoicePdf(invitationKey)
    res.writeHead(200, {
      'Content-Type': 'application/pdf',
      'Content-Disposition': `attachment; filename="Rechnung-${invoice.number || invoice.id}.pdf"`,
      'Cache-Control': 'no-store',
    })
    return res.end(pdf)
  } catch (err) {
    return res.status(err.status || 500).json({ error: err.message || 'PDF konnte nicht geladen werden' })
  }
})

/** Ticket-/Arbeitshistorie des eingeloggten Kunden ("was wurde gemacht"). */
router.get('/activity', requireSession, async (req, res) => {
  try {
    const tickets = await getCustomerActivity(getSessionCustomerId(req), {
      ticketLimit: 25,
      // Interne Akquise-Tickets gehoeren nicht in die Kundenansicht
      excludeTypes: ['Akquise'],
    })
    return res.json({ tickets })
  } catch (err) {
    return res.status(500).json({ error: err.message || 'Aktivität konnte nicht geladen werden' })
  }
})

export default router