koprogo_api/infrastructure/web/handlers/

budget_handlers.rs

use crate::application::dto::{
    CreateBudgetRequest, PageRequest, PageResponse, UpdateBudgetRequest,
};
use crate::domain::entities::BudgetStatus;
use crate::infrastructure::audit::{AuditEventType, AuditLogEntry};
use crate::infrastructure::web::middleware::scope_guard::verify_acp_org_access;
use crate::infrastructure::web::middleware::scope_guard::verify_building_org_access;
use crate::infrastructure::web::{AppState, AuthenticatedUser};
use actix_web::{delete, get, post, put, web, HttpResponse, Responder, ResponseError};
use uuid::Uuid;

/// Cloisonne un budget AVANT de le muter (#864).
///
/// ── Pourquoi `verify_` et pas un nom français ─────────────────────────────
///
/// Ce helper s'appelait `cloisonner_*` à sa première écriture. Le cliquet de
/// #864 est resté à 95 : son détecteur cherche les idiomes par lesquels CE
/// dépôt refuse un accès — `verify_`, `scope_guard`, `Forbidden`,
/// `require_organization` — et `cloisonner_` n'en est pas un. Dix trous
/// venaient d'être bouchés, et l'instrument ne le voyait pas.
///
/// Deux sorties possibles : allonger la liste du détecteur, ou porter le nom
/// que le dépôt emploie déjà (`verify_org_access`, `verify_acp_org_access`,
/// `verify_building_org_access`). La première aurait fait tomber le compteur
/// de dix par une modification de sa DÉFINITION, ce qui est précisément le
/// geste que la méthode interdit. La seconde corrige une incohérence de
/// nommage que je venais d'introduire, et la dette tombe à 85 parce que le
/// travail a été fait.
///
/// ── Le défaut que ce garde ferme ──────────────────────────────────────────
///
/// Les cinq transitions d'état du budget prenaient `AuthenticatedUser` et ne
/// s'en servaient que pour **journaliser après coup**. N'importe quel
/// utilisateur authentifié pouvait donc approuver, rejeter, archiver ou
/// modifier le budget de n'importe quelle copropriété — y compris d'un autre
/// cabinet — en connaissant son UUID, et le journal d'audit enregistrait la
/// transition comme régulière.
///
/// Le contrôle existait déjà dans ce fichier : `get_budget` et
/// `get_budget_variance` le font. Il manquait sur les opérations qui
/// **engagent** : un budget approuvé porte les appels de fonds de l'exercice.
///
/// ── Pourquoi un helper, et pas la ligne recopiée cinq fois ────────────────
///
/// Recopié, il se perd à la sixième transition. Nommé, il se voit dans la
/// signature de chaque handler, et son absence se lit.
///
/// Rend `Some(réponse)` quand l'appel doit être refusé, `None` quand il peut
/// continuer — le même idiome que `verify_syndic_role` ailleurs dans ce dépôt.
async fn verify_budget_org_access(
    state: &web::Data<AppState>,
    user: &AuthenticatedUser,
    id: Uuid,
) -> Option<HttpResponse> {
    match state.budget_use_cases.get_budget(id).await {
        Ok(Some(budget)) => match user.verify_org_access(budget.organization_id) {
            Ok(()) => None,
            Err(e) => Some(HttpResponse::Forbidden().json(serde_json::json!({ "error": e }))),
        },
        Ok(None) => Some(HttpResponse::NotFound().json(serde_json::json!({
            "error": "Budget not found"
        }))),
        Err(err) => Some(HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        }))),
    }
}

/// Create a new budget
#[post("/budgets")]
pub async fn create_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    mut request: web::Json<CreateBudgetRequest>,
) -> impl Responder {
    // Override organization_id from JWT token (security)
    let organization_id = match user.require_organization() {
        Ok(org_id) => org_id,
        Err(e) => {
            return HttpResponse::Unauthorized().json(serde_json::json!({
                "error": e.to_string()
            }))
        }
    };
    request.organization_id = organization_id;

    // Isolation multi-tenant à l'ÉCRITURE : l'immeuble visé doit relever d'une
    // ACP dont ce syndic a la gestion. L'affectation de `organization_id`
    // ci-dessus protège le mauvais champ — elle empêche d'estampiller
    // l'enregistrement au nom d'autrui, pas de le rattacher au patrimoine
    // d'autrui (audit du 2026-09-02).
    if let Err(err) = verify_building_org_access(
        &user,
        request.building_id,
        &state.building_use_cases,
        &state.acp_use_cases,
    )
    .await
    {
        return err.error_response();
    }

    match state
        .budget_use_cases
        .create_budget(request.into_inner())
        .await
    {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetCreated,
                Some(user.user_id),
                Some(organization_id),
            )
            .with_resource("Budget", budget.id)
            .log();

            HttpResponse::Created().json(budget)
        }
        Err(err) => {
            AuditLogEntry::new(
                AuditEventType::BudgetCreated,
                Some(user.user_id),
                Some(organization_id),
            )
            .with_error(err.to_string())
            .log();

            HttpResponse::BadRequest().json(serde_json::json!({
                "error": err.to_string()
            }))
        }
    }
}

/// Get budget by ID
#[get("/budgets/{id}")]
pub async fn get_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
) -> impl Responder {
    match state.budget_use_cases.get_budget(*id).await {
        Ok(Some(budget)) => {
            // Multi-tenant isolation: verify budget belongs to user's organization
            if let Err(e) = user.verify_org_access(budget.organization_id) {
                return HttpResponse::Forbidden().json(serde_json::json!({ "error": e }));
            }
            HttpResponse::Ok().json(budget)
        }
        Ok(None) => HttpResponse::NotFound().json(serde_json::json!({
            "error": "Budget not found"
        })),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Get budget by building and fiscal year
#[get("/buildings/{building_id}/budgets/fiscal-year/{fiscal_year}")]
pub async fn get_budget_by_building_and_fiscal_year(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    params: web::Path<(Uuid, i32)>,
) -> impl Responder {
    let (building_id, fiscal_year) = params.into_inner();

    // Hotfix #603 — multi-tenant isolation via ACP→organization resolution.
    match state.building_use_cases.get_building(building_id).await {
        Ok(Some(building)) => {
            let acp_id = match Uuid::parse_str(&building.acp_id) {
                Ok(id) => id,
                Err(_) => {
                    return HttpResponse::InternalServerError().json(serde_json::json!({
                        "error": "Invalid building.acp_id format"
                    }));
                }
            };
            if let Err(err) = verify_acp_org_access(&user, acp_id, &state.acp_use_cases).await {
                return err.error_response();
            }
        }
        Ok(None) => {
            return HttpResponse::NotFound().json(serde_json::json!({
                "error": "Building not found"
            }));
        }
        Err(err) => {
            return HttpResponse::InternalServerError().json(serde_json::json!({
                "error": err.to_string()
            }));
        }
    }

    match state
        .budget_use_cases
        .get_by_building_and_fiscal_year(building_id, fiscal_year)
        .await
    {
        Ok(Some(budget)) => HttpResponse::Ok().json(budget),
        Ok(None) => HttpResponse::NotFound().json(serde_json::json!({
            "error": "Budget not found"
        })),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Get active budget for a building
#[get("/buildings/{building_id}/budgets/active")]
pub async fn get_active_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    building_id: web::Path<Uuid>,
) -> impl Responder {
    // Hotfix #603 — multi-tenant isolation via ACP→organization resolution.
    match state.building_use_cases.get_building(*building_id).await {
        Ok(Some(building)) => {
            let acp_id = match Uuid::parse_str(&building.acp_id) {
                Ok(id) => id,
                Err(_) => {
                    return HttpResponse::InternalServerError().json(serde_json::json!({
                        "error": "Invalid building.acp_id format"
                    }));
                }
            };
            if let Err(err) = verify_acp_org_access(&user, acp_id, &state.acp_use_cases).await {
                return err.error_response();
            }
        }
        Ok(None) => {
            return HttpResponse::NotFound().json(serde_json::json!({
                "error": "Building not found"
            }));
        }
        Err(err) => {
            return HttpResponse::InternalServerError().json(serde_json::json!({
                "error": err.to_string()
            }));
        }
    }

    match state.budget_use_cases.get_active_budget(*building_id).await {
        Ok(Some(budget)) => HttpResponse::Ok().json(budget),
        Ok(None) => HttpResponse::NotFound().json(serde_json::json!({
            "error": "No active budget found for this building"
        })),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// List budgets for a building
#[get("/buildings/{building_id}/budgets")]
pub async fn list_budgets_by_building(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    building_id: web::Path<Uuid>,
) -> impl Responder {
    // Hotfix #603 — multi-tenant isolation via ACP→organization resolution.
    match state.building_use_cases.get_building(*building_id).await {
        Ok(Some(building)) => {
            let acp_id = match Uuid::parse_str(&building.acp_id) {
                Ok(id) => id,
                Err(_) => {
                    return HttpResponse::InternalServerError().json(serde_json::json!({
                        "error": "Invalid building.acp_id format"
                    }));
                }
            };
            if let Err(err) = verify_acp_org_access(&user, acp_id, &state.acp_use_cases).await {
                return err.error_response();
            }
        }
        Ok(None) => {
            return HttpResponse::NotFound().json(serde_json::json!({
                "error": "Building not found"
            }));
        }
        Err(err) => {
            return HttpResponse::InternalServerError().json(serde_json::json!({
                "error": err.to_string()
            }));
        }
    }

    match state.budget_use_cases.list_by_building(*building_id).await {
        Ok(budgets) => HttpResponse::Ok().json(budgets),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// List budgets by fiscal year
#[get("/budgets/fiscal-year/{fiscal_year}")]
pub async fn list_budgets_by_fiscal_year(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    fiscal_year: web::Path<i32>,
) -> impl Responder {
    let organization_id = match user.require_organization() {
        Ok(org_id) => org_id,
        Err(e) => {
            return HttpResponse::Unauthorized().json(serde_json::json!({
                "error": e.to_string()
            }))
        }
    };

    match state
        .budget_use_cases
        .list_by_fiscal_year(organization_id, *fiscal_year)
        .await
    {
        Ok(budgets) => HttpResponse::Ok().json(budgets),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// List budgets by status
#[get("/budgets/status/{status}")]
pub async fn list_budgets_by_status(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    status: web::Path<String>,
) -> impl Responder {
    let organization_id = match user.require_organization() {
        Ok(org_id) => org_id,
        Err(e) => {
            return HttpResponse::Unauthorized().json(serde_json::json!({
                "error": e.to_string()
            }))
        }
    };

    let budget_status = match status.as_str() {
        "draft" => BudgetStatus::Draft,
        "submitted" => BudgetStatus::Submitted,
        "approved" => BudgetStatus::Approved,
        "rejected" => BudgetStatus::Rejected,
        "archived" => BudgetStatus::Archived,
        _ => {
            return HttpResponse::BadRequest().json(serde_json::json!({
                "error": "Invalid status"
            }))
        }
    };

    match state
        .budget_use_cases
        .list_by_status(organization_id, budget_status)
        .await
    {
        Ok(budgets) => HttpResponse::Ok().json(budgets),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// List budgets paginated
#[get("/budgets")]
pub async fn list_budgets(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    page_request: web::Query<PageRequest>,
    filters: web::Query<serde_json::Value>,
) -> impl Responder {
    let organization_id = user.organization_id;

    // Parse optional filters
    let building_id = filters
        .get("building_id")
        .and_then(|v| v.as_str())
        .and_then(|s| Uuid::parse_str(s).ok());

    let status = filters
        .get("status")
        .and_then(|v| v.as_str())
        .and_then(|s| match s {
            "draft" => Some(BudgetStatus::Draft),
            "submitted" => Some(BudgetStatus::Submitted),
            "approved" => Some(BudgetStatus::Approved),
            "rejected" => Some(BudgetStatus::Rejected),
            "archived" => Some(BudgetStatus::Archived),
            _ => None,
        });

    match state
        .budget_use_cases
        .list_paginated(&page_request, organization_id, building_id, status)
        .await
    {
        Ok((budgets, total)) => {
            let response =
                PageResponse::new(budgets, page_request.page, page_request.per_page, total);
            HttpResponse::Ok().json(response)
        }
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Update budget (Draft only)
#[put("/budgets/{id}")]
pub async fn update_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
    request: web::Json<UpdateBudgetRequest>,
) -> impl Responder {
    // Cloisonnement AVANT la transition (#864).
    if let Some(refus) = verify_budget_org_access(&state, &user, *id).await {
        return refus;
    }

    match state
        .budget_use_cases
        .update_budget(*id, request.into_inner())
        .await
    {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetUpdated,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", budget.id)
            .log();

            HttpResponse::Ok().json(budget)
        }
        Err(err) => HttpResponse::BadRequest().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Submit budget for approval
#[put("/budgets/{id}/submit")]
pub async fn submit_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
) -> impl Responder {
    // Cloisonnement AVANT la transition (#864).
    if let Some(refus) = verify_budget_org_access(&state, &user, *id).await {
        return refus;
    }

    match state.budget_use_cases.submit_for_approval(*id).await {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetSubmitted,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", budget.id)
            .log();

            HttpResponse::Ok().json(budget)
        }
        Err(err) => HttpResponse::BadRequest().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Approve budget (requires meeting_id)
#[put("/budgets/{id}/approve")]
pub async fn approve_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
    payload: web::Json<serde_json::Value>,
) -> impl Responder {
    // Cloisonnement AVANT la transition (#864).
    if let Some(refus) = verify_budget_org_access(&state, &user, *id).await {
        return refus;
    }

    let meeting_id = match payload.get("meeting_id") {
        Some(serde_json::Value::String(id_str)) => match Uuid::parse_str(id_str) {
            Ok(uuid) => uuid,
            Err(_) => {
                return HttpResponse::BadRequest().json(serde_json::json!({
                    "error": "Invalid meeting_id format"
                }))
            }
        },
        _ => {
            return HttpResponse::BadRequest().json(serde_json::json!({
                "error": "meeting_id is required as a UUID string"
            }))
        }
    };

    match state.budget_use_cases.approve_budget(*id, meeting_id).await {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetApproved,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", budget.id)
            .with_metadata(serde_json::json!({"meeting_id": meeting_id}))
            .log();

            HttpResponse::Ok().json(budget)
        }
        Err(err) => HttpResponse::BadRequest().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Reject budget (with optional reason)
#[put("/budgets/{id}/reject")]
pub async fn reject_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
    payload: web::Json<serde_json::Value>,
) -> impl Responder {
    // Cloisonnement AVANT la transition (#864).
    if let Some(refus) = verify_budget_org_access(&state, &user, *id).await {
        return refus;
    }

    let reason = payload
        .get("reason")
        .and_then(|v| v.as_str())
        .map(|s| s.to_string());

    match state.budget_use_cases.reject_budget(*id, reason).await {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetRejected,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", budget.id)
            .log();

            HttpResponse::Ok().json(budget)
        }
        Err(err) => HttpResponse::BadRequest().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Archive budget
#[put("/budgets/{id}/archive")]
pub async fn archive_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
) -> impl Responder {
    // Cloisonnement AVANT la transition (#864).
    if let Some(refus) = verify_budget_org_access(&state, &user, *id).await {
        return refus;
    }

    match state.budget_use_cases.archive_budget(*id).await {
        Ok(budget) => {
            AuditLogEntry::new(
                AuditEventType::BudgetArchived,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", budget.id)
            .log();

            HttpResponse::Ok().json(budget)
        }
        Err(err) => HttpResponse::BadRequest().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Get budget statistics
#[get("/budgets/stats")]
pub async fn get_budget_stats(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
) -> impl Responder {
    let organization_id = match user.require_organization() {
        Ok(org_id) => org_id,
        Err(e) => {
            return HttpResponse::Unauthorized().json(serde_json::json!({
                "error": e.to_string()
            }))
        }
    };

    match state.budget_use_cases.get_stats(organization_id).await {
        Ok(stats) => HttpResponse::Ok().json(stats),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Get budget variance analysis (budget vs actual)
#[get("/budgets/{id}/variance")]
pub async fn get_budget_variance(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
) -> impl Responder {
    // Multi-tenant isolation: first check the budget belongs to user's org
    match state.budget_use_cases.get_budget(*id).await {
        Ok(Some(budget)) => {
            if let Err(e) = user.verify_org_access(budget.organization_id) {
                return HttpResponse::Forbidden().json(serde_json::json!({ "error": e }));
            }
        }
        Ok(None) => {
            return HttpResponse::NotFound().json(serde_json::json!({
                "error": "Budget not found"
            }));
        }
        Err(err) => {
            return HttpResponse::InternalServerError().json(serde_json::json!({
                "error": err.to_string()
            }));
        }
    }

    match state.budget_use_cases.get_variance(*id).await {
        Ok(Some(variance)) => HttpResponse::Ok().json(variance),
        Ok(None) => HttpResponse::NotFound().json(serde_json::json!({
            "error": "Budget not found"
        })),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}

/// Delete budget
#[delete("/budgets/{id}")]
pub async fn delete_budget(
    state: web::Data<AppState>,
    user: AuthenticatedUser,
    id: web::Path<Uuid>,
) -> impl Responder {
    // Cloisonnement AVANT la suppression (#864).
    //
    // `AuthenticatedUser` était pris à la signature et ne servait qu'à
    // journaliser QUI avait supprimé, après coup. N'importe quel utilisateur
    // authentifié pouvait donc effacer le budget de n'importe quelle
    // copropriété — y compris d'un autre cabinet — en connaissant son UUID, et
    // le journal d'audit enregistrait fidèlement le geste.
    //
    // Le contrôle existe dans ce fichier depuis toujours : `get_budget` le fait
    // trois cents lignes plus haut. Il manquait ici, sur l'opération
    // irréversible.
    match state.budget_use_cases.get_budget(*id).await {
        Ok(Some(budget)) => {
            if let Err(e) = user.verify_org_access(budget.organization_id) {
                return HttpResponse::Forbidden().json(serde_json::json!({ "error": e }));
            }
        }
        Ok(None) => {
            return HttpResponse::NotFound().json(serde_json::json!({
                "error": "Budget not found"
            }))
        }
        Err(err) => {
            return HttpResponse::InternalServerError().json(serde_json::json!({
                "error": err.to_string()
            }))
        }
    }

    match state.budget_use_cases.delete_budget(*id).await {
        Ok(true) => {
            AuditLogEntry::new(
                AuditEventType::BudgetDeleted,
                Some(user.user_id),
                user.organization_id,
            )
            .with_resource("Budget", *id)
            .log();

            HttpResponse::NoContent().finish()
        }
        Ok(false) => HttpResponse::NotFound().json(serde_json::json!({
            "error": "Budget not found"
        })),
        Err(err) => HttpResponse::InternalServerError().json(serde_json::json!({
            "error": err.to_string()
        })),
    }
}