feat: add product provider mappings

apps/api/src/app/build-app.js

@@ -19,6 +19,7 @@ import { registerAdminSaleRoutes } from '../modules/sales/routes/admin-sale-rout
 import { registerAdminAcquisitionRoutes } from '../modules/acquisitions/routes/admin-acquisition-routes.js';
 import { registerAdminDashboardRoutes } from '../modules/dashboard/routes/admin-dashboard-routes.js';
 import { registerAdminPricingRoutes } from '../modules/pricing/routes/admin-pricing-routes.js';
+import { registerAdminProviderMappingRoutes } from '../modules/pricing/routes/admin-provider-mapping-routes.js';
 
 export function buildApp(dependencies) {
   const app = Fastify();
@@ -82,6 +83,10 @@ export function buildApp(dependencies) {
     ...dependencies,
     prefix: '/api/v1/admin',
   });
+  app.register(registerAdminProviderMappingRoutes, {
+    ...dependencies,
+    prefix: '/api/v1/admin',
+  });
   app.register(registerPublicSearchRoutes, {
     ...dependencies,
     prefix: '/api/v1',

apps/api/src/app/server.js

@@ -45,6 +45,8 @@ import { createDashboardService } from '../modules/dashboard/services/dashboard-
 import { createPricingRepository } from '../modules/pricing/repositories/pricing-repository.js';
 import { createPricingService } from '../modules/pricing/services/pricing-service.js';
 import { createPricingRefreshJobRepository } from '../modules/pricing/repositories/pricing-refresh-job-repository.js';
+import { createProviderMappingRepository } from '../modules/pricing/repositories/provider-mapping-repository.js';
+import { createProviderMappingService } from '../modules/pricing/services/provider-mapping-service.js';
 
 function parsePort(value) {
   const port = Number.parseInt(value ?? '3000', 10);
@@ -72,6 +74,7 @@ async function startServer() {
   const acquisitionRepository = createAcquisitionRepository(database.db);
   const pricingRepository = createPricingRepository(database.db);
   const pricingRefreshJobRepository = createPricingRefreshJobRepository(database.db);
+  const providerMappingRepository = createProviderMappingRepository(database.db);
   const userRepository = createUserRepository(database.db);
   const sessionRepository = createSessionRepository(database.db);
   const passwordResetRepository = createPasswordResetRepository(database.db);
@@ -137,6 +140,7 @@ async function startServer() {
       acquisitionService: createAcquisitionService({ acquisitionRepository }),
     }),
     pricingService: createPricingService({ pricingRepository, pricingRefreshJobRepository }),
+    providerMappingService: createProviderMappingService({ providerMappingRepository }),
     publicListingService: createPublicListingService({ listingRepository, publicImageService }),
     productService: createProductService({ productRepository }),
     publicProductService: createPublicProductService({ productRepository }),

apps/api/src/infrastructure/database/schema.js

@@ -299,6 +299,20 @@ export const marketValueOverrides = pgTable('market_value_overrides', {
   createdAt: timestamp('created_at', { withTimezone: true }).defaultNow().notNull(),
 });
 
+export const pricingProviderMappings = pgTable('pricing_provider_mappings', {
+  id: uuid('id').defaultRandom().primaryKey(),
+  productId: uuid('product_id').notNull().references(() => products.id),
+  providerId: text('provider_id').notNull(),
+  mappingType: text('mapping_type').notNull(),
+  externalIdentifier: text('external_identifier'),
+  searchQuery: text('search_query'),
+  sourceUrl: text('source_url'),
+  status: text('status').default('ACTIVE').notNull(),
+  metadata: jsonb('metadata').default({}).notNull(),
+  disabledAt: timestamp('disabled_at', { withTimezone: true }),
+  ...timestamps,
+});
+
 export const pricingRefreshJobs = pgTable('pricing_refresh_jobs', {
   id: uuid('id').defaultRandom().primaryKey(),
   sellerId: uuid('seller_id').notNull().references(() => sellers.id),

apps/api/src/modules/pricing/repositories/provider-mapping-repository.js

@@ -0,0 +1,42 @@
+import { and, eq } from 'drizzle-orm';
+
+import { pricingProviderMappings, products } from '../../../infrastructure/database/schema.js';
+
+export function createProviderMappingRepository(db) {
+  return {
+    async createForSeller(mapping, sellerId) {
+      const [ownedProduct] = await db.select({ id: products.id }).from(products)
+        .where(and(eq(products.id, mapping.productId), eq(products.sellerId, sellerId)));
+      if (!ownedProduct) return { status: 'NOT_FOUND' };
+      const [created] = await db.insert(pricingProviderMappings).values(mapping).returning();
+      return { status: 'CREATED', mapping: created };
+    },
+
+    async listForSeller(productId, sellerId) {
+      return db.select({ mapping: pricingProviderMappings }).from(pricingProviderMappings)
+        .innerJoin(products, eq(products.id, pricingProviderMappings.productId))
+        .where(and(
+          eq(pricingProviderMappings.productId, productId),
+          eq(products.sellerId, sellerId),
+          eq(pricingProviderMappings.status, 'ACTIVE'),
+        ))
+        .then((rows) => rows.map(({ mapping }) => mapping));
+    },
+
+    async disableForSeller(id, sellerId) {
+      const [mapping] = await db.select().from(pricingProviderMappings)
+        .innerJoin(products, eq(products.id, pricingProviderMappings.productId))
+        .where(and(
+          eq(pricingProviderMappings.id, id),
+          eq(products.sellerId, sellerId),
+          eq(pricingProviderMappings.status, 'ACTIVE'),
+        ));
+      if (!mapping) return { status: 'NOT_FOUND' };
+      const [updated] = await db.update(pricingProviderMappings)
+        .set({ status: 'DISABLED', disabledAt: new Date(), updatedAt: new Date() })
+        .where(eq(pricingProviderMappings.id, id))
+        .returning();
+      return { status: 'DISABLED', mapping: updated };
+    },
+  };
+}

apps/api/src/modules/pricing/routes/admin-provider-mapping-routes.js

@@ -0,0 +1,47 @@
+import { toAdminProviderMappingDto } from '@pokemon-inventory/contracts/provider-mapping';
+import { createProviderMappingSchema } from '@pokemon-inventory/validation/provider-mapping';
+
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+function validationError(reply, result) {
+  return reply.code(400).send({
+    error: {
+      code: 'VALIDATION_ERROR',
+      message: 'Request validation failed.',
+      details: result.error.issues.map(({ message, path }) => ({ message, path })),
+    },
+  });
+}
+
+export async function registerAdminProviderMappingRoutes(app, options) {
+  const {
+    authenticateAdmin = async () => { throw createApplicationError('UNAUTHORIZED', 'Authentication is required.', 401); },
+    authorizeUnsafeRequest,
+    sessionCookieName = 'pokemon_inventory_session',
+    providerMappingService,
+  } = options;
+
+  app.addHook('preHandler', async (request) => {
+    const admin = await authenticateAdmin(request);
+    if (!admin?.sellerId) throw createApplicationError('UNAUTHORIZED', 'Authentication is required.', 401);
+    request.admin = admin;
+  });
+
+  app.get('/products/:id/provider-mappings', async (request) => ({
+    data: (await providerMappingService.list({ productId: request.params.id, sellerId: request.admin.sellerId })).map(toAdminProviderMappingDto),
+  }));
+
+  app.post('/products/:id/provider-mappings', async (request, reply) => {
+    await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
+    const result = createProviderMappingSchema.safeParse(request.body);
+    if (!result.success) return validationError(reply, result);
+    const mapping = await providerMappingService.create({ ...result.data, productId: request.params.id, sellerId: request.admin.sellerId });
+    return reply.code(201).send({ data: toAdminProviderMappingDto(mapping) });
+  });
+
+  app.post('/provider-mappings/:id/disable', async (request, reply) => {
+    await authorizeUnsafeRequest?.(request.cookies[sessionCookieName], request.headers['x-csrf-token']);
+    const mapping = await providerMappingService.disable({ id: request.params.id, sellerId: request.admin.sellerId });
+    return reply.code(200).send({ data: toAdminProviderMappingDto(mapping) });
+  });
+}

apps/api/src/modules/pricing/services/provider-mapping-service.js

@@ -0,0 +1,19 @@
+import { createApplicationError } from '../../../shared/errors/application-error.js';
+
+export function createProviderMappingService({ providerMappingRepository }) {
+  return {
+    async create({ sellerId, ...input }) {
+      const result = await providerMappingRepository.createForSeller(input, sellerId);
+      if (result.status === 'NOT_FOUND') throw createApplicationError('PRODUCT_NOT_FOUND', 'Product was not found.', 404);
+      return result.mapping;
+    },
+    async list({ productId, sellerId }) {
+      return providerMappingRepository.listForSeller(productId, sellerId);
+    },
+    async disable({ id, sellerId }) {
+      const result = await providerMappingRepository.disableForSeller(id, sellerId);
+      if (result.status === 'NOT_FOUND') throw createApplicationError('PROVIDER_MAPPING_NOT_FOUND', 'Provider mapping was not found.', 404);
+      return result.mapping;
+    },
+  };
+}

apps/api/tests/application/provider-mapping-service.test.js

@@ -0,0 +1,21 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { createProviderMappingService } from '../../src/modules/pricing/services/provider-mapping-service.js';
+
+test('creates and disables seller-owned provider mappings', async () => {
+  const calls = [];
+  const service = createProviderMappingService({
+    providerMappingRepository: {
+      async createForSeller(input, sellerId) { calls.push(['create', input, sellerId]); return { status: 'CREATED', mapping: { id: 'mapping-1', ...input } }; },
+      async listForSeller() { return [{ id: 'mapping-1', status: 'ACTIVE' }]; },
+      async disableForSeller() { return { status: 'DISABLED', mapping: { id: 'mapping-1', status: 'DISABLED' } }; },
+    },
+  });
+
+  const created = await service.create({ sellerId: 'seller-1', productId: 'product-1', providerId: 'fixture', mappingType: 'PRODUCT', externalIdentifier: 'ext-1' });
+  assert.equal(created.id, 'mapping-1');
+  assert.equal(calls[0][2], 'seller-1');
+  assert.equal((await service.list({ sellerId: 'seller-1', productId: 'product-1' })).length, 1);
+  assert.equal((await service.disable({ sellerId: 'seller-1', id: 'mapping-1' })).status, 'DISABLED');
+});

apps/api/tests/http/provider-mapping-routes.test.js

@@ -0,0 +1,29 @@
+import assert from 'node:assert/strict';
+import test from 'node:test';
+
+import { buildApp } from '../../src/app/build-app.js';
+
+test('protects provider mapping writes and scopes mappings to the seller', async (testContext) => {
+  let received;
+  const app = buildApp({
+    authenticateAdmin: async () => ({ sellerId: 'seller-1' }),
+    authorizeUnsafeRequest: async () => {},
+    providerMappingService: {
+      async create(input) { received = input; return { id: 'mapping-1', ...input, status: 'ACTIVE' }; },
+      async list() { return []; },
+      async disable() { return { id: 'mapping-1', status: 'DISABLED' }; },
+    },
+  });
+  testContext.after(() => app.close());
+
+  const response = await app.inject({
+    method: 'POST',
+    url: '/api/v1/admin/products/product-1/provider-mappings',
+    headers: { 'x-csrf-token': 'csrf' },
+    payload: { providerId: 'fixture', mappingType: 'PRODUCT', externalIdentifier: 'ext-1' },
+  });
+
+  assert.equal(response.statusCode, 201);
+  assert.equal(received.sellerId, 'seller-1');
+  assert.equal(response.json().data.providerId, 'fixture');
+});

apps/api/tests/integration/transactions-pricing-sales.test.js

@@ -17,6 +17,7 @@ import {
 import { createAcquisitionRepository } from '../../src/modules/acquisitions/repositories/acquisition-repository.js';
 import { createPricingRepository } from '../../src/modules/pricing/repositories/pricing-repository.js';
 import { createPricingRefreshJobRepository } from '../../src/modules/pricing/repositories/pricing-refresh-job-repository.js';
+import { createProviderMappingRepository } from '../../src/modules/pricing/repositories/provider-mapping-repository.js';
 import { createSaleRepository } from '../../src/modules/sales/repositories/sale-repository.js';
 
 const connectionString = process.env.TEST_DATABASE_URL;
@@ -33,6 +34,7 @@ const database = createDatabase(connectionString);
 const acquisitionRepository = createAcquisitionRepository(database.db);
 const pricingRepository = createPricingRepository(database.db);
 const pricingRefreshJobRepository = createPricingRefreshJobRepository(database.db);
+const providerMappingRepository = createProviderMappingRepository(database.db);
 const saleRepository = createSaleRepository(database.db);
 
 async function createFixture() {
@@ -73,7 +75,7 @@ async function createFixture() {
 }
 
 beforeEach(async () => {
-  await database.db.execute(sql`TRUNCATE pricing_refresh_jobs, market_value_overrides, market_valuations, pricing_observations, sale_items, sales, acquisitions, security_audit_events, inventory_items, products, conditions, condition_profiles, categories, sellers, users CASCADE`);
+  await database.db.execute(sql`TRUNCATE pricing_provider_mappings, pricing_refresh_jobs, market_value_overrides, market_valuations, pricing_observations, sale_items, sales, acquisitions, security_audit_events, inventory_items, products, conditions, condition_profiles, categories, sellers, users CASCADE`);
 });
 
 after(async () => {
@@ -176,3 +178,18 @@ test('claims and completes a durable pricing refresh job', async () => {
   assert.deepEqual(completed.valuation, { valueMinor: 2500 });
   assert.equal(user.email, 'transactions@example.test');
 });
+
+test('persists and disables seller-owned provider mappings', async () => {
+  const { seller, product } = await createFixture();
+  const created = await providerMappingRepository.createForSeller({
+    productId: product.id,
+    providerId: 'integration',
+    mappingType: 'PRODUCT',
+    externalIdentifier: 'catalog-1',
+  }, seller.id);
+  assert.equal(created.status, 'CREATED');
+  assert.equal((await providerMappingRepository.listForSeller(product.id, seller.id)).length, 1);
+  const disabled = await providerMappingRepository.disableForSeller(created.mapping.id, seller.id);
+  assert.equal(disabled.status, 'DISABLED');
+  assert.equal((await providerMappingRepository.listForSeller(product.id, seller.id)).length, 0);
+});