6 Commits

Author	SHA1	Message	Date
Ho Ngoc Hai	33a5ff407b	feat(auth): add DEVELOPER + PARK_OPERATOR roles with owner scoping (B2B accounts) ... Two new B2B roles for CĐT (project developers) and KCN operators, provisioned by admin. Each account owns a subset of ProjectDevelopment / IndustrialPark records and can CRUD them from the dashboard; admin retains full access. Phase 1 — Schema - Extend UserRole enum with DEVELOPER + PARK_OPERATOR (before ADMIN) - ProjectDevelopment.ownerId FK (User, ON DELETE SET NULL) + index - IndustrialPark.ownerId FK + index - Migration 20260420030000 Phase 2a — Backend authorization - CreateProjectCommand + CreateIndustrialParkCommand accept ownerId; controllers auto-set it to the caller's user id when role=DEVELOPER / PARK_OPERATOR - Update + Delete commands gain (requesterUserId, requesterRole) and enforce ADMIN-or-owner via ForbiddenException; reassigning ownerId is admin-only - Search params gain optional ownerId filter wired through Prisma repos - New endpoints: GET /projects/mine/list, GET /industrial/parks/mine/list - user-rate-limit guard: add DEVELOPER + PARK_OPERATOR entries (300/window) Phase 2b — Admin provision - ProvisionDeveloperCommand/Handler: create user (role=DEVELOPER), pre-validate target projects have no existing owner, batch-assign ownerId - ProvisionParkOperatorCommand/Handler: same for PARK_OPERATOR + IndustrialPark - POST /admin/accounts/developers, POST /admin/accounts/park-operators (admin-only) - DTOs with phone/password/fullName/email + optional {project,park}Ids[] Phase 2c — Project stats for developer dashboard - GetProjectStatsQuery + handler: aggregates linkedListingCount, activeListingCount, totalInquiries, unreadInquiries, savedByUsers via Property → Listing → Inquiry chain - GET /projects/:id/stats — admin sees all, DEVELOPER only their own (403 otherwise) Phase 3 — Frontend - Dashboard layout role-aware: DEVELOPER sees "Dự án của tôi" + CRM + Profile (hides listings/analytics/subscription); PARK_OPERATOR sees "KCN của tôi" equivalent - /projects dashboard page switches to duAnApi.searchMine() when role=DEVELOPER - /industrial-parks page switches to industrialApi.searchMine() when role=PARK_OPERATOR - Admin nav gains "Tài khoản CĐT" + "Tài khoản KCN" entries - New pages /admin/accounts/developers + /admin/accounts/park-operators with checkbox-based multi-select for linking entities - adminApi.provisionDeveloper + provisionParkOperator + types - duAnApi.searchMine + getStats; industrialApi.searchMine - Login demo accounts list includes CĐT Vingroup + KCN VSIP Phase 4 — Seed (prisma/seed-b2b-accounts.ts) - DEVELOPER "CĐT Vingroup" (+84912000001) owns 4 projects - DEVELOPER "CĐT Masterise Homes" (+84912000003) owns 2 projects - PARK_OPERATOR "Vận hành KCN VSIP" (+84912000002) owns 2 seeded KCN - Password Velik@2026 for all Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-20 22:12:16 +07:00
Ho Ngoc Hai	ba0bf97426	feat: dashboard CRUD for Projects + Industrial Parks, listings delete, BĐS homepage card ... Backend — DELETE endpoints (hard delete, ADMIN or owner): - DELETE /projects/:id (Admin) — new DeleteProjectCommand/Handler, repository.delete() adapter, module wiring. - DELETE /industrial/parks/:id (Admin) — same pattern. - DELETE /listings/:id (JWT + owner-or-Admin check in handler). Frontend — API clients: - lib/du-an-api.ts: add create/update/delete + CreateProjectPayload, UpdateProjectPayload types. - lib/khu-cong-nghiep-api.ts: add createPark/updatePark/deletePark + Create/Update payload types. - lib/listings-api.ts: add delete(). Dashboard pages — new: - /projects (Quản lý dự án): list with filters + edit/delete actions, /projects/new form (sectioned Cards, zod-validated), /projects/[id]/edit with danger-zone delete. - /industrial-parks (Quản lý KCN): same triad. Fix occupancy-rate display (percentage already 0-100, no need to *100). Dashboard listings page: - Add Edit/Delete row actions with confirm + useMutation; error banner on mutation failure. Table view gains a "Thao tác" column; list view gains a footer action bar below each card. Dashboard nav: - Catalog group: /du-an → /projects (Quản lý dự án), /khu-cong-nghiep → /industrial-parks (Quản lý KCN). Desktop primaryNav updated too. Public homepage: - Add "Bất động sản" as a 5th feature card/tab → /search, using listingsApi for the "Featured listings" section. - Bump grid to lg:grid-cols-5, update features subtitle copy ("Năm/Five core services"). Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-19 10:37:33 +07:00
Ho Ngoc Hai	3be106074d	feat: add P0/P1/P2 features + Swagger enrichment for MVP completeness ... Closes four gaps the Swagger audit flagged as blocking a full MVP demo, plus a general documentation pass. P0 — Forgot/Reset password (auth) - POST /auth/forgot-password (anti-enumeration: always 200) - POST /auth/reset-password - Reuses the Redis-OTP pattern from email/phone change; new key prefix auth:password_reset_otp with 15-min TTL. - Emits PasswordResetRequestedEvent; new listener in notifications dispatches the existing password.reset email template (otp + expiryMinutes variables already in template.service.ts). - UserEntity gains changePassword(HashedPassword) domain method; reset also revokes all refresh tokens for the user. P0 — Favorites module - New SavedListing Prisma model (unique(userId, listingId)) with User and Listing back-relations; schema pushed via db push since the remote DB was out of sync with migration history. - New apps/api/src/modules/favorites/ module following the reviews module's shape (DDD/CQRS: domain repo + Prisma impl + 2 commands + 2 queries + controller). - POST /favorites/:listingId, DELETE /favorites/:listingId, GET /favorites (paginated), GET /favorites/:listingId/check. All guarded by JwtAuthGuard. - FavoritesModule wired into AppModule. P1 — Resend OTP (auth) - POST /auth/resend-otp for EMAIL_CHANGE | PHONE_CHANGE. Reads the pending OTP payload out of Redis and re-emits the original event without minting a new code, so TTL semantics stay intact. Password reset resend is done by re-POSTing /auth/forgot-password and is deliberately not in this enum. P1 — Agent self-upgrade (agents) - POST /agents/me/upgrade lets a BUYER/SELLER convert to AGENT. Creates an Agent row (isVerified=false) and flips User.role in one $transaction. Rejects if already AGENT/ADMIN or if an Agent row already exists. P2 — Swagger enrichment - @ApiConsumes('multipart/form-data') + body schema on listings media upload. - GET /subscriptions/quota/:metric now enumerates the real metric values from METRIC_TO_PLAN_FIELD. - POST /avm/batch and /analytics/valuation/batch document the max=50 batch size from their DTO's @ArrayMaxSize. - GET /admin/dashboard gains a realistic response example schema. - Admin-gated endpoints in projects/transfer/industrial gain concrete 400/401/403/404 responses. Swagger endpoint count: 170 → 178. Typecheck clean. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-19 00:19:37 +07:00
Ho Ngoc Hai	312532b1cb	fix(api): resolve NestJS DI + ValidationPipe bugs from type-only imports ... - Remove `type` modifier from imports used as DI constructor params across ~235 files (@Injectable, @Controller, @Module, @Catch, @CommandHandler, @QueryHandler, @EventsHandler, @WebSocketGateway). TypeScript emitDecoratorMetadata strips type-only imports, leaving Reflect.metadata with Function placeholder and breaking Nest DI. - Fix controllers: DTOs used with @Body/@Query/@Param must be runtime imports so ValidationPipe can whitelist properties. Previously returned 400 "property X should not exist" on every request. - Register ProjectsModule in AppModule (was defined but never wired). - Add approve()/reject() methods to TransferListingEntity referenced by ModerateTransferListingHandler. - Export BankTransferConfirmedEvent from payments barrel for subscription activation handler. Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-04-18 21:50:30 +07:00
Ho Ngoc Hai	ac4191cdf0	test(reports): add E2E pipeline integration tests for report generation ... 26 tests covering: full pipeline flow for 3 report types + generic fallback, status polling (GENERATING → READY/FAILED transitions), quota enforcement and user scoping, error handling (PDF failure, AI failure, auth checks), delete cleanup flow, and temp file lifecycle. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-16 17:24:52 +07:00
Ho Ngoc Hai	deb04989de	feat(api): add industrial, transfer, and reports backend modules ... Add three new NestJS modules following DDD/CQRS architecture: - Industrial: KCN (industrial park) management with PostGIS geo queries, Typesense search, and market statistics - Transfer: Furniture/premises transfer listings with AI-powered price estimation and depreciation modeling - Reports: Async AI report generation via BullMQ with Claude narrative service, PDF generation, and macro data integration Includes Prisma schema models, migrations, seed scripts, and app.module wiring with BullMQ Redis config. Co-Authored-By: Paperclip <noreply@paperclip.ing>	2026-04-16 09:11:16 +07:00