${r.path}| Method | Path | Description |
|---|
${route.path}| Method | -Path | -Description | -
|---|
Hi ${admin.firstName},
Expires in ${ADMIN_RESET_TTL_MINUTES} minutes.
`, + text: `Hi ${admin.firstName},\n\nReset here: ${resetUrl}\n\nExpires in ${ADMIN_RESET_TTL_MINUTES} minutes.`, + }).catch((err) => console.error('[AdminForgotPassword]', err?.message)) +} + +export async function resetPassword(token: string, password: string) { + const admin = await repo.findAdminByResetToken(token) + if (!admin) return false + + await repo.updateAdminPassword(admin.id, await bcrypt.hash(password, 12)) + return true +} + +export async function listCompanies(query: { q?: string; status?: string; plan?: string; page: number; pageSize: number }) { + const { data, total } = await repo.listCompaniesPage(query) + return presenter.presentPaginated(data, total, query.page, query.pageSize) +} + +export function getCompany(id: string) { + return repo.getCompanyDetail(id) +} + +export async function updateCompany(id: string, body: any, adminId: string, ip?: string) { + const before = await repo.getCompanyUpdateSnapshot(id) + const updated = await repo.applyCompanyUpdate(id, body, before) + await repo.createAuditLog({ + adminUserId: adminId, + action: 'UPDATE_COMPANY', + resource: 'Company', + resourceId: id, + companyId: id, + before: toAuditJson(before), + after: toAuditJson(body), + ipAddress: ip, + }) + return updated +} + +export async function setCompanyStatus(id: string, status: string, reason: string | undefined, adminId: string, ip?: string) { + const before = await repo.getCompanyUpdateSnapshot(id) + const updated = await repo.updateCompanyStatus(id, status) + await repo.createAuditLog({ + adminUserId: adminId, + action: `SET_COMPANY_STATUS_${status}`, + resource: 'Company', + resourceId: id, + companyId: id, + before: { status: before.status }, + after: { status }, + note: reason, + ipAddress: ip, + }) + return updated +} + +export async function deleteCompany(id: string, adminId: string, ip?: string) { + await repo.deleteCompany(id) + await repo.createAuditLog({ + adminUserId: adminId, + action: 'DELETE_COMPANY', + resource: 'Company', + resourceId: id, + ipAddress: ip, + }) +} + +export async function impersonateCompany(id: string, adminId: string, ip?: string) { + const company = await repo.getCompanyForImpersonation(id) + const token = jwt.sign( + { + sub: company.employees[0]?.id, + companyId: company.id, + isImpersonation: true, + type: 'employee', + }, + process.env.JWT_SECRET!, + { expiresIn: '30m' }, + ) + + await repo.createAuditLog({ + adminUserId: adminId, + action: 'IMPERSONATE_COMPANY', + resource: 'Company', + resourceId: id, + companyId: id, + ipAddress: ip, + }) + + return { token, expiresIn: 1800 } +} + +export async function listRenters(query: { q?: string; blocked?: string; page: number; pageSize: number }) { + const { data, total } = await repo.listRentersPage(query) + return presenter.presentPaginated(data, total, query.page, query.pageSize) +} + +export function setRenterActive(id: string, isActive: boolean) { + return repo.updateRenterActive(id, isActive) +} + +export function getPlatformMetrics() { + return repo.getPlatformMetricCounts() +} + +export async function getAuditLogs(query: { adminId?: string; action?: string; companyId?: string; entityId?: string; page: number; pageSize: number }) { + const { data, total } = await repo.listAuditLogsPage(query) + return presenter.presentPaginated(data, total, query.page, query.pageSize) +} + +export async function listAdmins() { + const admins = await repo.listAdmins() + return admins.map((admin) => presenter.presentAdminUser(admin)) +} + +export async function createAdmin(body: { email: string; firstName: string; lastName: string; role: string; password: string; permissions?: any[] }) { + const admin = await repo.createAdmin({ + ...body, + passwordHash: await bcrypt.hash(body.password, 12), + }) + return presenter.presentAdminUser(admin) +} + +export function updateAdminRole(id: string, role: string) { + return repo.updateAdminRole(id, role) +} + +export async function updateAdminPermissions(id: string, permissions: any[]) { + const admin = await repo.replaceAdminPermissions(id, permissions) + return presenter.presentAdminUser(admin) +} + +export async function getBilling(query: { status?: string; plan?: string; page: number; pageSize: number }) { + const [{ data, total }, activeSubscriptions, stats] = await Promise.all([ + repo.listBillingPage(query), + repo.listActiveSubscriptionsForMrr(), + repo.getBillingStatusCounts(), + ]) + + const mrr = activeSubscriptions.reduce((acc, subscription) => { + const monthlyAmount = PLAN_MONTHLY_AMOUNT[subscription.plan] ?? 0 + return acc + (subscription.billingPeriod === 'ANNUAL' ? Math.round(monthlyAmount * 10 / 12) : monthlyAmount) + }, 0) + + return presenter.presentPaginated(data, total, query.page, query.pageSize, { + stats: { mrr, ...stats }, + }) +} + +export async function getCompanyInvoices(companyId: string, query: { page: number; pageSize: number }) { + const { data, total } = await repo.listCompanyInvoicesPage(companyId, query) + return presenter.presentPaginated(data, total, query.page, query.pageSize) +} + +export async function getInvoicePdf(invoiceId: string) { + const invoice = await repo.getInvoicePdfRecord(invoiceId) + const invoiceNumber = buildInvoiceNumber(invoice.id, invoice.createdAt) + const transactionId = invoice.amanpayTransactionId ?? invoice.paypalCaptureId ?? null + const pdfBuffer = await generateInvoicePdf({ + invoiceNumber, + issueDate: invoice.createdAt.toISOString(), + dueDate: invoice.status === 'PENDING' ? invoice.createdAt.toISOString() : null, + company: { + name: invoice.company.name, + email: invoice.company.email, + phone: invoice.company.phone, + address: invoice.company.address, + }, + subscription: { + plan: invoice.subscription.plan, + billingPeriod: invoice.subscription.billingPeriod, + currentPeriodStart: invoice.subscription.currentPeriodStart?.toISOString(), + currentPeriodEnd: invoice.subscription.currentPeriodEnd?.toISOString(), + currency: invoice.subscription.currency, + }, + amount: invoice.amount, + currency: invoice.currency, + status: invoice.status, + paymentProvider: invoice.paymentProvider, + transactionId, + paidAt: invoice.paidAt?.toISOString(), + }) + + return { pdfBuffer, invoiceNumber } +} + +export function getMarketplaceHomepage() { + return getMarketplaceHomepageContent() +} + +export async function updateMarketplaceHomepage(homepage: any, adminId: string, ip?: string) { + const saved = await saveMarketplaceHomepageContent(homepage) + await repo.createAuditLog({ + adminUserId: adminId, + action: 'UPDATE', + resource: 'MarketplaceHomepage', + after: toAuditJson(saved), + ipAddress: ip, + userAgent: undefined, + }) + return saved +} diff --git a/apps/api/src/modules/analytics/analytics.routes.ts b/apps/api/src/modules/analytics/analytics.routes.ts new file mode 100644 index 0000000..6e8fb6e --- /dev/null +++ b/apps/api/src/modules/analytics/analytics.routes.ts @@ -0,0 +1,49 @@ +import { Router } from 'express' +import { requireCompanyAuth } from '../../middleware/requireCompanyAuth' +import { requireTenant } from '../../middleware/requireTenant' +import { requireSubscription } from '../../middleware/requireSubscription' +import { requireRole } from '../../middleware/requireRole' +import { parseQuery } from '../../http/validate' +import { ok } from '../../http/respond' +import * as service from './analytics.service' +import { summaryQuerySchema, reportQuerySchema } from './analytics.schemas' + +const router = Router() + +router.use(requireCompanyAuth, requireTenant, requireSubscription) + +router.get('/summary', async (req, res, next) => { + try { + const { period } = parseQuery(summaryQuerySchema, req) + ok(res, { data: await service.getSummary(req.companyId, period) }) + } catch (err) { next(err) } +}) + +router.get('/dashboard', async (req, res, next) => { + try { + ok(res, { data: await service.getDashboard(req.companyId) }) + } catch (err) { next(err) } +}) + +router.get('/sources', async (req, res, next) => { + try { + ok(res, { data: await service.getSources(req.companyId) }) + } catch (err) { next(err) } +}) + +router.get('/report', requireRole('MANAGER'), async (req, res, next) => { + try { + const query = parseQuery(reportQuerySchema, req) + const result = await service.getReport(req.companyId, query) + if (result.format === 'CSV') { + const start = result.startDate.toISOString().slice(0, 10) + const end = result.endDate.toISOString().slice(0, 10) + res.setHeader('Content-Type', 'text/csv') + res.setHeader('Content-Disposition', `attachment; filename="report-${start}-${end}.csv"`) + return res.send(result.csv) + } + ok(res, { data: result.report }) + } catch (err) { next(err) } +}) + +export default router diff --git a/apps/api/src/modules/analytics/analytics.schemas.ts b/apps/api/src/modules/analytics/analytics.schemas.ts new file mode 100644 index 0000000..c257fb9 --- /dev/null +++ b/apps/api/src/modules/analytics/analytics.schemas.ts @@ -0,0 +1,12 @@ +import { z } from 'zod' + +export const summaryQuerySchema = z.object({ + period: z.string().default('30d'), +}) + +export const reportQuerySchema = z.object({ + from: z.string().optional(), + to: z.string().optional(), + format: z.string().default('JSON'), + period: z.string().optional(), +}) diff --git a/apps/api/src/modules/analytics/analytics.service.ts b/apps/api/src/modules/analytics/analytics.service.ts new file mode 100644 index 0000000..f7046d8 --- /dev/null +++ b/apps/api/src/modules/analytics/analytics.service.ts @@ -0,0 +1,100 @@ +import { prisma } from '../../lib/prisma' +import { generateFinancialReport, toCsv } from '../../services/financialReportService' + +function getRangeFromPeriod(period: string) { + const now = new Date() + switch (period) { + case 'WEEKLY': return { from: new Date(now.getTime() - 7 * 24 * 60 * 60 * 1000), to: now } + case 'QUARTERLY': return { from: new Date(now.getFullYear(), now.getMonth() - 2, 1), to: now } + case 'ANNUAL': return { from: new Date(now.getFullYear(), 0, 1), to: now } + default: return { from: new Date(now.getFullYear(), now.getMonth(), 1), to: now } + } +} + +function pct(current: number, previous: number) { + if (previous === 0) return current > 0 ? 100 : 0 + return Math.round(((current - previous) / previous) * 100) +} + +export async function getSummary(companyId: string, period: string) { + const days = parseInt(period.replace('d', '')) || 30 + const since = new Date(Date.now() - days * 24 * 60 * 60 * 1000) + const [totalReservations, activeVehicles, totalRevenue, totalCustomers] = await Promise.all([ + prisma.reservation.count({ where: { companyId, createdAt: { gte: since } } }), + prisma.vehicle.count({ where: { companyId, status: 'AVAILABLE' } }), + prisma.reservation.aggregate({ where: { companyId, status: { in: ['COMPLETED'] }, createdAt: { gte: since } }, _sum: { totalAmount: true } }), + prisma.customer.count({ where: { companyId } }), + ]) + return { totalReservations, activeVehicles, totalRevenue: totalRevenue._sum.totalAmount ?? 0, totalCustomers, period } +} + +export async function getDashboard(companyId: string) { + const now = new Date() + const monthStart = new Date(now.getFullYear(), now.getMonth(), 1) + const prevMonthStart = new Date(now.getFullYear(), now.getMonth() - 1, 1) + const prevMonthEnd = new Date(monthStart.getTime() - 1) + + const [ + totalBookings, previousBookings, activeVehicles, previousActiveVehicles, + totalCustomers, previousCustomers, monthlyRevenueAgg, previousRevenueAgg, + recentReservations, sourceGroups, subscription, + ] = await Promise.all([ + prisma.reservation.count({ where: { companyId, createdAt: { gte: monthStart } } }), + prisma.reservation.count({ where: { companyId, createdAt: { gte: prevMonthStart, lte: prevMonthEnd } } }), + prisma.vehicle.count({ where: { companyId, status: { in: ['AVAILABLE', 'RENTED'] } } }), + prisma.vehicle.count({ where: { companyId, createdAt: { lte: prevMonthEnd }, status: { in: ['AVAILABLE', 'RENTED'] } } }), + prisma.customer.count({ where: { companyId } }), + prisma.customer.count({ where: { companyId, createdAt: { lte: prevMonthEnd } } }), + prisma.reservation.aggregate({ where: { companyId, status: { in: ['CONFIRMED', 'ACTIVE', 'COMPLETED'] }, createdAt: { gte: monthStart } }, _sum: { totalAmount: true } }), + prisma.reservation.aggregate({ where: { companyId, status: { in: ['CONFIRMED', 'ACTIVE', 'COMPLETED'] }, createdAt: { gte: prevMonthStart, lte: prevMonthEnd } }, _sum: { totalAmount: true } }), + prisma.reservation.findMany({ where: { companyId }, include: { customer: true, vehicle: true }, orderBy: { createdAt: 'desc' }, take: 8 }), + prisma.reservation.groupBy({ by: ['source'], where: { companyId }, _count: { id: true }, _sum: { totalAmount: true } }), + prisma.subscription.findUnique({ where: { companyId } }), + ]) + + return { + kpis: { + totalBookings, + activeVehicles, + monthlyRevenue: monthlyRevenueAgg._sum.totalAmount ?? 0, + totalCustomers, + bookingsChange: pct(totalBookings, previousBookings), + vehiclesChange: pct(activeVehicles, previousActiveVehicles), + revenueChange: pct(monthlyRevenueAgg._sum.totalAmount ?? 0, previousRevenueAgg._sum.totalAmount ?? 0), + customersChange: pct(totalCustomers, previousCustomers), + }, + recentReservations: (recentReservations as any[]).map((r) => ({ + id: r.id, + bookingRef: r.contractNumber ?? r.id.slice(-8).toUpperCase(), + customerName: `${r.customer.firstName} ${r.customer.lastName}`, + vehicleName: `${r.vehicle.make} ${r.vehicle.model}`, + startDate: r.startDate, + endDate: r.endDate, + status: r.status, + totalAmount: r.totalAmount, + })), + sourceBreakdown: (sourceGroups as any[]).map((g) => ({ + source: g.source, + count: g._count.id, + revenue: g._sum.totalAmount ?? 0, + })), + subscription: subscription ? { + status: subscription.status, + planName: subscription.plan, + trialEndsAt: subscription.trialEndAt, + } : null, + } +} + +export async function getSources(companyId: string) { + return prisma.reservation.groupBy({ by: ['source'], where: { companyId }, _count: { id: true } }) +} + +export async function getReport(companyId: string, query: { from?: string; to?: string; format: string; period?: string }) { + const accountingSettings = await prisma.accountingSettings.findUnique({ where: { companyId } }) + const derivedRange = getRangeFromPeriod(query.period || accountingSettings?.reportingPeriod || 'MONTHLY') + const startDate = query.from ? new Date(query.from) : derivedRange.from + const endDate = query.to ? new Date(query.to) : derivedRange.to + const report = await generateFinancialReport(companyId, startDate, endDate) + return { report, startDate, endDate, format: query.format, csv: query.format === 'CSV' ? toCsv(report.rows) : null } +} diff --git a/apps/api/src/modules/auth/auth.company.repo.ts b/apps/api/src/modules/auth/auth.company.repo.ts new file mode 100644 index 0000000..a00f78a --- /dev/null +++ b/apps/api/src/modules/auth/auth.company.repo.ts @@ -0,0 +1,115 @@ +import { prisma } from '../../lib/prisma' + +type DbClient = PickHi ${admin.firstName},
Reset your admin password here:
This link expires in ${ADMIN_RESET_TOKEN_TTL_MINUTES} minutes.
RentalDriveGo
`, - text: `Hi ${admin.firstName},\n\nReset your admin password here: ${resetUrl}\n\nThis link expires in ${ADMIN_RESET_TOKEN_TTL_MINUTES} minutes.\n\nRentalDriveGo`, - }).catch((err) => console.error('[AdminForgotPassword] Email send failed:', err?.message)) - } - - res.json({ data: { message: 'If that email is registered, a reset link has been sent.' } }) - } catch (err) { next(err) } -}) - -router.post('/auth/reset-password', async (req, res, next) => { - try { - const { token, password } = z.object({ - token: z.string().min(1), - password: z.string().min(8).max(128), - }).parse(req.body) - - const admin = await prisma.adminUser.findFirst({ - where: { - passwordResetToken: token, - passwordResetExpiresAt: { gt: new Date() }, - }, - }) - - if (!admin) { - return res.status(400).json({ error: 'invalid_token', message: 'Reset link is invalid or has expired.', statusCode: 400 }) - } - - const passwordHash = await bcrypt.hash(password, 12) - - await prisma.adminUser.update({ - where: { id: admin.id }, - data: { - passwordHash, - passwordResetToken: null, - passwordResetExpiresAt: null, - }, - }) - - res.json({ data: { message: 'Password updated successfully. You can now sign in.' } }) - } catch (err) { next(err) } -}) - -// ─── Companies ──────────────────────────────────────────────── - -router.get('/companies', requireAdminAuth, async (req, res, next) => { - try { - const { q, status, plan, page = '1', pageSize = '20' } = req.query as Recordnpm run build in scripts/dashboard/.
+ Total Findings: 712
+For detailed findings, please view the JSON report at findings.json.