// server/src/schema/marketplace_listings.ts
import { pgTable, text, timestamp, integer, jsonb, boolean, index } from 'drizzle-orm/pg-core';
import { appSchema } from './base';

export const marketplaceListings = appSchema.table('marketplace_listings', {
  id: text('id').primaryKey(), // matches AVAILABLE_MODULES.key or resource-addon key
  displayName: text('display_name').notNull(),
  tagline: text('tagline').notNull(),
  iconKind: text('icon_kind').notNull(), // 'lucide' | 'upload'
  iconValue: text('icon_value').notNull(), // lucide name or R2 key
  heroColor: text('hero_color').notNull(), // tailwind token: 'indigo', 'emerald', ...
  longDescriptionMd: text('long_description_md').notNull().default(''),
  whatYouGet: jsonb('what_you_get').$type<string[]>().notNull().default([]),
  screenshots: jsonb('screenshots').$type<Array<{ key: string; alt: string }>>().notNull().default([]),
  faq: jsonb('faq').$type<Array<{ q: string; a: string }>>().notNull().default([]),
  versionLabel: text('version_label').notNull().default('v1.0.0'),
  lastUpdatedAt: timestamp('last_updated_at').defaultNow().notNull(),
  pricingSummary: text('pricing_summary').notNull().default(''),
  category: text('category').notNull(), // 'clinical' | 'admin' | 'infra' | 'comms'
  securityBadges: jsonb('security_badges').$type<string[]>().notNull().default([]),
  status: text('status').notNull().default('draft'), // 'draft' | 'published' | 'archived'
  sortOrder: integer('sort_order').notNull().default(0),
  createdAt: timestamp('created_at').defaultNow().notNull(),
  updatedAt: timestamp('updated_at').defaultNow().notNull(),
  updatedBy: text('updated_by'),
}, (t) => ({
  statusCategoryIdx: index('marketplace_listings_status_category_idx').on(t.status, t.category, t.sortOrder),
}));

export type MarketplaceListing = typeof marketplaceListings.$inferSelect;
export type NewMarketplaceListing = typeof marketplaceListings.$inferInsert;

git add server/src/schema/marketplace_listings.ts
git commit -m "feat(marketplace): listings schema"

// server/src/schema/marketplace_releases.ts
import { pgTable, text, timestamp, boolean, index } from 'drizzle-orm/pg-core';
import { appSchema } from './base';
import { marketplaceListings } from './marketplace_listings';

export const marketplaceReleases = appSchema.table('marketplace_releases', {
  id: text('id').primaryKey().$defaultFn(() => crypto.randomUUID()),
  listingId: text('listing_id').references(() => marketplaceListings.id, { onDelete: 'cascade' }).notNull(),
  versionLabel: text('version_label').notNull(),
  releasedAt: timestamp('released_at').defaultNow().notNull(),
  isMajor: boolean('is_major').default(false).notNull(),
  summary: text('summary').notNull().default(''),
  bodyMd: text('body_md').notNull().default(''),
  createdBy: text('created_by'),
}, (t) => ({
  listingReleasedIdx: index('marketplace_releases_listing_released_idx').on(t.listingId, t.releasedAt),
}));

export type MarketplaceRelease = typeof marketplaceReleases.$inferSelect;
export type NewMarketplaceRelease = typeof marketplaceReleases.$inferInsert;

git add server/src/schema/marketplace_releases.ts
git commit -m "feat(marketplace): releases schema"

  moduleAddonPricing: jsonb('module_addon_pricing').$type<Record<string, { pro: number; proPlus: number }>>()
    .notNull().default({}),

import { text, timestamp, integer, jsonb, index } from 'drizzle-orm/pg-core';

git add server/src/schema/addon_pricing.ts
git commit -m "feat(marketplace): module addon pricing column"

export const addonTypeEnum = pgEnum('addon_type', [
  'storage',
  'portal_seats',
  'dicom_imaging',
  'whatsapp_api',
  'ipd',
  'insurance',
  'marketing',
  'mrn',
]);

export const addonRequestStatusEnum = pgEnum('addon_request_status', [
  'pending',
  'invoiced',
  'paid',
  'approved',
  'rejected',
  'cancel_requested',
  'cancelled',
]);

  invoicedAt: timestamp('invoiced_at'),
  invoiceId: text('invoice_id'),                  // FK to payment_invoices.id (SQL-enforced)
  paidAt: timestamp('paid_at'),
  cancelRequestedAt: timestamp('cancel_requested_at'),
  cancelReason: text('cancel_reason'),
  lastOverdueEmailAt: timestamp('last_overdue_email_at'),
  lastIdleNudgeAt: timestamp('last_idle_nudge_at'),

git add server/src/schema/addon_requests.ts
git commit -m "feat(marketplace): widen addon request enums + lifecycle columns"

export * from './marketplace_listings';
export * from './marketplace_releases';

git add server/src/schema/index.ts
git commit -m "feat(marketplace): export new tables from schema index"

-- server/drizzle/0045_marketplace.sql

-- Widen addon_type enum
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'dicom_imaging';
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'whatsapp_api';
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'ipd';
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'insurance';
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'marketing';
ALTER TYPE addon_type ADD VALUE IF NOT EXISTS 'mrn';

-- Widen addon_request_status enum
ALTER TYPE addon_request_status ADD VALUE IF NOT EXISTS 'invoiced';
ALTER TYPE addon_request_status ADD VALUE IF NOT EXISTS 'paid';
ALTER TYPE addon_request_status ADD VALUE IF NOT EXISTS 'cancel_requested';

-- Extend addon_requests columns (cancelled_at + cancelled_by already exist)
ALTER TABLE app.addon_requests
  ADD COLUMN IF NOT EXISTS invoiced_at timestamptz,
  ADD COLUMN IF NOT EXISTS invoice_id text,
  ADD COLUMN IF NOT EXISTS paid_at timestamptz,
  ADD COLUMN IF NOT EXISTS cancel_requested_at timestamptz,
  ADD COLUMN IF NOT EXISTS cancel_reason text,
  ADD COLUMN IF NOT EXISTS last_overdue_email_at timestamptz,
  ADD COLUMN IF NOT EXISTS last_idle_nudge_at timestamptz;

-- Extend addon_pricing
ALTER TABLE app.addon_pricing
  ADD COLUMN IF NOT EXISTS module_addon_pricing jsonb NOT NULL DEFAULT '{}'::jsonb;

-- marketplace_listings
CREATE TABLE IF NOT EXISTS app.marketplace_listings (
  id text PRIMARY KEY,
  display_name text NOT NULL,
  tagline text NOT NULL,
  icon_kind text NOT NULL,
  icon_value text NOT NULL,
  hero_color text NOT NULL,
  long_description_md text NOT NULL DEFAULT '',
  what_you_get jsonb NOT NULL DEFAULT '[]'::jsonb,
  screenshots jsonb NOT NULL DEFAULT '[]'::jsonb,
  faq jsonb NOT NULL DEFAULT '[]'::jsonb,
  version_label text NOT NULL DEFAULT 'v1.0.0',
  last_updated_at timestamptz NOT NULL DEFAULT now(),
  pricing_summary text NOT NULL DEFAULT '',
  category text NOT NULL,
  security_badges jsonb NOT NULL DEFAULT '[]'::jsonb,
  status text NOT NULL DEFAULT 'draft',
  sort_order integer NOT NULL DEFAULT 0,
  created_at timestamptz NOT NULL DEFAULT now(),
  updated_at timestamptz NOT NULL DEFAULT now(),
  updated_by text
);

CREATE INDEX IF NOT EXISTS marketplace_listings_status_category_idx
  ON app.marketplace_listings (status, category, sort_order);

-- marketplace_releases
CREATE TABLE IF NOT EXISTS app.marketplace_releases (
  id text PRIMARY KEY,
  listing_id text NOT NULL REFERENCES app.marketplace_listings(id) ON DELETE CASCADE,
  version_label text NOT NULL,
  released_at timestamptz NOT NULL DEFAULT now(),
  is_major boolean NOT NULL DEFAULT false,
  summary text NOT NULL DEFAULT '',
  body_md text NOT NULL DEFAULT '',
  created_by text
);

CREATE INDEX IF NOT EXISTS marketplace_releases_listing_released_idx
  ON app.marketplace_releases (listing_id, released_at);

-- Seed initial listings (all draft — superadmin reviews before publishing)
INSERT INTO app.marketplace_listings
  (id, display_name, tagline, icon_kind, icon_value, hero_color, category, version_label, pricing_summary, sort_order)
VALUES
  ('dicom_imaging', 'DICOM Imaging',     'Upload, view and AI-analyse dental radiographs',          'lucide', 'Scan',          'clinical', 'v1.0.0', 'From PKR 8,000 / month',  10),
  ('whatsapp_api',  'WhatsApp API',      'BYOK WhatsApp Business — reminders + two-way messaging',  'lucide', 'MessageCircle', 'comms',    'v1.0.0', 'From PKR 5,000 / month',  20),
  ('ipd',           'In-Patient (IPD)',  'Admissions, bed management and discharge summaries',      'lucide', 'BedDouble',     'clinical', 'v1.0.0', 'From PKR 6,000 / month',  30),
  ('insurance',     'Insurance Management','Digital insurance claims and reimbursement tracking',   'lucide', 'ShieldCheck',   'admin',    'v1.0.0', 'From PKR 4,000 / month',  40),
  ('marketing',     'Marketing & Recalls','Patient recall automation and campaign workflows',       'lucide', 'Megaphone',     'admin',    'v1.0.0', 'From PKR 4,000 / month',  50),
  ('mrn',           'Medical Record Numbers','Manually-assigned MRN field on patient records',      'lucide', 'Hash',          'admin',    'v1.0.0', 'From PKR 1,500 / month',  60),
  ('storage',       'Extra Storage',     'Add 50GB / 200GB / 500GB / 1TB on top of your plan',      'lucide', 'HardDrive',     'infra',    'v1.0.0', 'From PKR 1,200 / month',  70),
  ('portal_seats',  'Portal Seats',      'Extra public-share seats in 3-packs',                     'lucide', 'Users',         'infra',    'v1.0.0', 'From PKR 2,500 / 3 seats', 80)
ON CONFLICT (id) DO NOTHING;

cd server && pnpm dlx tsx scripts/apply-migration.ts 0045_marketplace.sql

git add server/drizzle/0045_marketplace.sql
git commit -m "feat(marketplace): 0045 migration — enums, columns, listings, releases, seed"

'marketplace.view',
'marketplace.request',
'marketplace.cancel',

cd ui && pnpm tsc --noEmit
git add ui/src/lib/permissions-keys.ts ui/src/lib/permissions.ts server/src/lib/permissions.ts
git commit -m "feat(marketplace): add view/request/cancel permission keys"

// server/src/lib/__tests__/marketplace-state.test.ts
import { describe, it, expect } from 'vitest';
import { canTransition, nextState, TenantStatus } from '../marketplace-state';

describe('marketplace-state', () => {
  it('allows requested → invoiced', () => {
    expect(canTransition('pending', 'invoiced')).toBe(true);
  });
  it('allows invoiced → paid', () => {
    expect(canTransition('invoiced', 'paid')).toBe(true);
  });
  it('allows paid → approved', () => {
    expect(canTransition('paid', 'approved')).toBe(true);
  });
  it('blocks pending → approved (must invoice + pay first)', () => {
    expect(canTransition('pending', 'approved')).toBe(false);
  });
  it('blocks paid → cancelled (no skipping cancel_requested)', () => {
    expect(canTransition('paid', 'cancelled')).toBe(false);
  });
  it('allows approved → cancel_requested', () => {
    expect(canTransition('approved', 'cancel_requested')).toBe(true);
  });
  it('maps DB status to tenant-facing status', () => {
    expect(TenantStatus.fromDb('pending')).toBe('submitted');
    expect(TenantStatus.fromDb('invoiced')).toBe('invoice_ready');
    expect(TenantStatus.fromDb('paid')).toBe('awaiting_activation');
    expect(TenantStatus.fromDb('approved')).toBe('active');
    expect(TenantStatus.fromDb('cancel_requested')).toBe('cancellation_pending');
    expect(TenantStatus.fromDb('cancelled')).toBe('cancelled');
    expect(TenantStatus.fromDb('rejected')).toBe('rejected');
  });
});

// server/src/lib/marketplace-state.ts
export type DbStatus =
  | 'pending' | 'invoiced' | 'paid' | 'approved'
  | 'rejected' | 'cancel_requested' | 'cancelled';

const TRANSITIONS: Record<DbStatus, DbStatus[]> = {
  pending:           ['invoiced', 'rejected'],
  invoiced:          ['paid', 'rejected'],
  paid:              ['approved', 'rejected'],
  approved:          ['cancel_requested'],
  cancel_requested:  ['cancelled', 'approved'], // 'approved' = superadmin denies cancellation
  cancelled:         [],
  rejected:          [],
};

export function canTransition(from: DbStatus, to: DbStatus): boolean {
  return TRANSITIONS[from]?.includes(to) ?? false;
}

export function nextState(from: DbStatus, to: DbStatus): DbStatus {
  if (!canTransition(from, to)) throw new Error(`Invalid transition ${from} → ${to}`);
  return to;
}

export const TenantStatus = {
  fromDb(s: DbStatus): string {
    return {
      pending: 'submitted',
      invoiced: 'invoice_ready',
      paid: 'awaiting_activation',
      approved: 'active',
      cancel_requested: 'cancellation_pending',
      cancelled: 'cancelled',
      rejected: 'rejected',
    }[s];
  },
} as const;

git add server/src/lib/marketplace-state.ts server/src/lib/__tests__/marketplace-state.test.ts
git commit -m "feat(marketplace): state machine + tenant-facing status mapping"

// server/src/routes/__tests__/marketplace.test.ts
import { describe, it, expect, beforeEach } from 'vitest';
import { testApp, seedClinic, seedListing, authedRequest } from '../../test-utils';

describe('GET /marketplace/listings', () => {
  beforeEach(async () => {
    await seedListing({ id: 'mrn', status: 'published', category: 'admin' });
    await seedListing({ id: 'dicom_imaging', status: 'draft', category: 'clinical' });
  });

  it('requires auth', async () => {
    const res = await testApp.request('/marketplace/listings');
    expect(res.status).toBe(401);
  });

  it('returns only published listings to tenants', async () => {
    const clinic = await seedClinic();
    const res = await authedRequest(clinic, 'GET', '/marketplace/listings');
    expect(res.status).toBe(200);
    const json = await res.json();
    expect(json.listings).toHaveLength(1);
    expect(json.listings[0].id).toBe('mrn');
    expect(json.listings[0]).not.toHaveProperty('updatedBy'); // internal field stripped
  });

  it('attaches per-row subscriptionState', async () => {
    const clinic = await seedClinic();
    const res = await authedRequest(clinic, 'GET', '/marketplace/listings');
    const json = await res.json();
    expect(json.listings[0].subscriptionState).toBe('none');
  });
});

describe('POST /marketplace/listings/:key/subscribe', () => {
  it('rejects if perm missing', async () => {
    const clinic = await seedClinic({ role: 'doctor' }); // no marketplace.request
    await seedListing({ id: 'mrn', status: 'published' });
    const res = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/subscribe', {});
    expect(res.status).toBe(403);
  });

  it('creates addon_requests row with status pending', async () => {
    const clinic = await seedClinic({ role: 'owner' });
    await seedListing({ id: 'mrn', status: 'published' });
    const res = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/subscribe', { notes: 'please' });
    expect(res.status).toBe(201);
    const json = await res.json();
    expect(json.request.status).toBe('pending');
    expect(json.request.addonType).toBe('mrn');
  });

  it('rate-limits second subscribe within an hour', async () => {
    const clinic = await seedClinic({ role: 'owner' });
    await seedListing({ id: 'mrn', status: 'published' });
    await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/subscribe', {});
    const res2 = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/subscribe', {});
    expect(res2.status).toBe(429);
  });

  it('refuses to subscribe if already active', async () => {
    const clinic = await seedClinic({ role: 'owner' });
    await seedListing({ id: 'mrn', status: 'published' });
    // pre-existing approved request
    await seedRequest({ clinicId: clinic.clinicId, addonType: 'mrn', status: 'approved' });
    const res = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/subscribe', {});
    expect(res.status).toBe(409);
  });
});

describe('POST /marketplace/listings/:key/cancel', () => {
  it('creates a cancel_requested row only when active', async () => {
    const clinic = await seedClinic({ role: 'owner' });
    await seedListing({ id: 'mrn', status: 'published' });
    await seedRequest({ clinicId: clinic.clinicId, addonType: 'mrn', status: 'approved' });
    const res = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/cancel', { reason: 'no longer needed' });
    expect(res.status).toBe(201);
  });

  it('rejects cancel when not active', async () => {
    const clinic = await seedClinic({ role: 'owner' });
    await seedListing({ id: 'mrn', status: 'published' });
    const res = await authedRequest(clinic, 'POST', '/marketplace/listings/mrn/cancel', {});
    expect(res.status).toBe(409);
  });
});

// server/src/routes/marketplace.ts
import { Hono } from 'hono';
import { and, eq, desc, gt } from 'drizzle-orm';
import { getReadDb, getWriteDb } from '../lib/db';
import { marketplaceListings, marketplaceReleases, addonRequests, clinics, subscriptionPlans } from '../schema';
import { requirePermission } from '../middleware/permissions';
import { recordAuditLog } from '../lib/audit-helper';
import { alertNewAddonRequest } from '../lib/superadmin-alerts';
import { handleError, AppError } from '../lib/errors';
import { TenantStatus } from '../lib/marketplace-state';

const route = new Hono();

// In-memory rate limiter: 1 subscribe/cancel per (clinic, listing) per hour
const recentActions = new Map<string, number>();
function rateLimit(key: string, windowMs = 60 * 60 * 1000): boolean {
  const now = Date.now();
  const last = recentActions.get(key) ?? 0;
  if (now - last < windowMs) return false;
  recentActions.set(key, now);
  return true;
}

// Strip superadmin-internal fields from listings before returning to tenants
function publicListingShape(row: any) {
  const { updatedBy, status, ...safe } = row;
  return safe;
}

route.get('/listings', requirePermission('marketplace.view'), async (c) => {
  try {
    const db = getReadDb();
    const clinicId = c.get('clinicContext')?.currentClinicId;
    if (!clinicId) throw new AppError('No clinic context', 400);

    const listings = await db
      .select()
      .from(marketplaceListings)
      .where(eq(marketplaceListings.status, 'published'))
      .orderBy(marketplaceListings.sortOrder);

    const requests = await db
      .select()
      .from(addonRequests)
      .where(eq(addonRequests.clinicId, clinicId));

    const byType = new Map<string, string>();
    for (const r of requests) {
      // most recent terminal-or-active status wins; simple heuristic — keep last touched
      byType.set(r.addonType, r.status);
    }

    return c.json({
      listings: listings.map(l => ({
        ...publicListingShape(l),
        subscriptionState: byType.has(l.id) ? TenantStatus.fromDb(byType.get(l.id) as any) : 'none',
      })),
    });
  } catch (e) {
    return handleError(e, c);
  }
});

route.get('/listings/:key', requirePermission('marketplace.view'), async (c) => {
  try {
    const db = getReadDb();
    const key = c.req.param('key');
    const clinicId = c.get('clinicContext')?.currentClinicId;

    const [listing] = await db
      .select()
      .from(marketplaceListings)
      .where(and(eq(marketplaceListings.id, key), eq(marketplaceListings.status, 'published')))
      .limit(1);

    if (!listing) throw new AppError('Not found', 404);

    const releases = await db
      .select()
      .from(marketplaceReleases)
      .where(eq(marketplaceReleases.listingId, key))
      .orderBy(desc(marketplaceReleases.releasedAt))
      .limit(10);

    const requests = await db
      .select()
      .from(addonRequests)
      .where(and(eq(addonRequests.clinicId, clinicId), eq(addonRequests.addonType, key as any)))
      .orderBy(desc(addonRequests.createdAt))
      .limit(5);

    const latestStatus = requests[0]?.status;

    return c.json({
      listing: publicListingShape(listing),
      releases,
      requests,
      subscriptionState: latestStatus ? TenantStatus.fromDb(latestStatus) : 'none',
    });
  } catch (e) {
    return handleError(e, c);
  }
});

route.post('/listings/:key/subscribe', requirePermission('marketplace.request'), async (c) => {
  try {
    const db = getReadDb();
    const writeDb = getWriteDb();
    const key = c.req.param('key');
    const clinicId = c.get('clinicContext')?.currentClinicId;
    const userId = c.get('user')?.id;
    if (!clinicId || !userId) throw new AppError('Unauthorized', 401);

    if (!rateLimit(`subscribe:${clinicId}:${key}`)) {
      return c.json({ error: 'Too many requests' }, 429);
    }

    const [listing] = await db
      .select()
      .from(marketplaceListings)
      .where(and(eq(marketplaceListings.id, key), eq(marketplaceListings.status, 'published')))
      .limit(1);
    if (!listing) throw new AppError('Listing not available', 404);

    // Refuse if already-active or in-flight non-terminal
    const existing = await db
      .select()
      .from(addonRequests)
      .where(and(
        eq(addonRequests.clinicId, clinicId),
        eq(addonRequests.addonType, key as any),
      ))
      .orderBy(desc(addonRequests.createdAt))
      .limit(1);

    const blocking = existing[0]?.status;
    if (blocking && ['pending', 'invoiced', 'paid', 'approved', 'cancel_requested'].includes(blocking)) {
      return c.json({ error: 'Subscription already in progress or active' }, 409);
    }

    const body = await c.req.json().catch(() => ({}));
    const notes = typeof body.notes === 'string' ? body.notes.slice(0, 1000) : null;

    const [inserted] = await writeDb.insert(addonRequests).values({
      id: crypto.randomUUID(),
      clinicId,
      requestedBy: userId,
      addonType: key as any,
      quantity: 1,                       // module addons are always quantity=1
      unitPricePkr: 0,                   // pricing finalised at invoice time
      totalPricePkr: 0,
      status: 'pending',
      notes,
    }).returning();

    await recordAuditLog({
      clinicId, userId,
      action: 'marketplace.subscribe.requested',
      entityType: 'addon_request',
      entityId: inserted.id,
      changes: { addonType: key },
    });

    await alertNewAddonRequest({
      clinicId,
      clinicName: '', // filled by helper from DB
      planKey: '',
      requestId: inserted.id,
    });

    return c.json({ request: inserted }, 201);
  } catch (e) {
    return handleError(e, c);
  }
});

route.post('/listings/:key/cancel', requirePermission('marketplace.cancel'), async (c) => {
  try {
    const db = getReadDb();
    const writeDb = getWriteDb();
    const key = c.req.param('key');
    const clinicId = c.get('clinicContext')?.currentClinicId;
    const userId = c.get('user')?.id;
    if (!clinicId || !userId) throw new AppError('Unauthorized', 401);

    if (!rateLimit(`cancel:${clinicId}:${key}`)) {
      return c.json({ error: 'Too many requests' }, 429);
    }

    const [active] = await db
      .select()
      .from(addonRequests)
      .where(and(
        eq(addonRequests.clinicId, clinicId),
        eq(addonRequests.addonType, key as any),
        eq(addonRequests.status, 'approved'),
      ))
      .limit(1);

    if (!active) {
      return c.json({ error: 'No active subscription to cancel' }, 409);
    }

    const body = await c.req.json().catch(() => ({}));
    const reason = typeof body.reason === 'string' ? body.reason.slice(0, 1000) : null;

    await writeDb.update(addonRequests)
      .set({
        status: 'cancel_requested',
        cancelRequestedAt: new Date(),
        cancelReason: reason,
        updatedAt: new Date(),
      })
      .where(eq(addonRequests.id, active.id));

    await recordAuditLog({
      clinicId, userId,
      action: 'marketplace.cancel.requested',
      entityType: 'addon_request',
      entityId: active.id,
      changes: { cancelReason: reason },
    });

    return c.json({ ok: true }, 201);
  } catch (e) {
    return handleError(e, c);
  }
});

route.get('/requests', requirePermission('marketplace.view'), async (c) => {
  try {
    const db = getReadDb();
    const clinicId = c.get('clinicContext')?.currentClinicId;
    if (!clinicId) throw new AppError('No clinic context', 400);
    const rows = await db
      .select()
      .from(addonRequests)
      .where(eq(addonRequests.clinicId, clinicId))
      .orderBy(desc(addonRequests.createdAt));
    return c.json({ requests: rows });
  } catch (e) {
    return handleError(e, c);
  }
});

export { route as marketplaceRoute };

import { marketplaceRoute } from './routes/marketplace';
app.route('/marketplace', marketplaceRoute);

git add server/src/routes/marketplace.ts server/src/routes/__tests__/marketplace.test.ts server/src/api.ts
git commit -m "feat(marketplace): tenant routes + auth/perm/rate-limit guards"

// server/src/routes/__tests__/superadmin-marketplace.test.ts
import { describe, it, expect } from 'vitest';
import { testApp, superadminRequest, tenantRequest } from '../../test-utils';

describe('superadmin marketplace listings', () => {
  it('GET /superadmin/marketplace/listings requires superadmin', async () => {
    const res = await tenantRequest('GET', '/superadmin/marketplace/listings');
    expect(res.status).toBe(403);
  });

  it('GET returns draft + published rows for superadmin', async () => {
    const res = await superadminRequest('GET', '/superadmin/marketplace/listings');
    expect(res.status).toBe(200);
    const json = await res.json();
    expect(json.listings.length).toBeGreaterThanOrEqual(8);
  });

  it('PATCH updates listing metadata', async () => {
    const res = await superadminRequest('PATCH', '/superadmin/marketplace/listings/mrn', {
      tagline: 'New tagline',
      status: 'published',
    });
    expect(res.status).toBe(200);
    const after = await superadminRequest('GET', '/superadmin/marketplace/listings');
    const mrn = (await after.json()).listings.find((l: any) => l.id === 'mrn');
    expect(mrn.tagline).toBe('New tagline');
    expect(mrn.status).toBe('published');
  });

  it('POST releases creates a release row', async () => {
    const res = await superadminRequest('POST', '/superadmin/marketplace/listings/mrn/releases', {
      versionLabel: 'v1.1.0',
      summary: 'Added filters',
      bodyMd: '## What changed\n- filter chips',
      isMajor: false,
    });
    expect(res.status).toBe(201);
  });

  it('POST major release fires G1 release email', async () => {
    const { emailsSent } = await superadminRequest('POST', '/superadmin/marketplace/listings/mrn/releases', {
      versionLabel: 'v2.0.0',
      summary: 'Major rewrite',
      bodyMd: '...',
      isMajor: true,
    }, { captureEmails: true });
    expect(emailsSent.some((e: any) => e.template === 'MarketplaceReleaseEmail')).toBe(true);
  });
});

// server/src/routes/superadmin/marketplace.ts
import { Hono } from 'hono';
import { eq, desc } from 'drizzle-orm';
import { getReadDb, getWriteDb } from '../../lib/db';
import { marketplaceListings, marketplaceReleases, addonRequests, clinics } from '../../schema';
import { verifySuperAdmin } from '../../middleware/super-auth';
import { recordAuditLog } from '../../lib/audit-helper';
import { sendMarketplaceReleaseEmail, sendMarketplaceListingLaunchedEmail } from '../../lib/marketplace-emails';
import { handleError, AppError } from '../../lib/errors';

const route = new Hono();
route.use('*', verifySuperAdmin);

route.get('/listings', async (c) => {
  const db = getReadDb();
  const listings = await db.select().from(marketplaceListings).orderBy(marketplaceListings.sortOrder);
  return c.json({ listings });
});

route.patch('/listings/:id', async (c) => {
  try {
    const writeDb = getWriteDb();
    const id = c.req.param('id');
    const body = await c.req.json();
    const user = c.get('user');

    const allowed = ['displayName','tagline','iconKind','iconValue','heroColor','longDescriptionMd',
      'whatYouGet','screenshots','faq','versionLabel','pricingSummary','category','securityBadges',
      'status','sortOrder'];
    const patch: any = {};
    for (const k of allowed) if (k in body) patch[k] = body[k];
    patch.updatedAt = new Date();
    patch.updatedBy = user?.id ?? 'superadmin';

    const wasDraft = (await getReadDb().select({ s: marketplaceListings.status }).from(marketplaceListings).where(eq(marketplaceListings.id, id)).limit(1))[0]?.s === 'draft';
    const becamePublished = wasDraft && patch.status === 'published';

    await writeDb.update(marketplaceListings).set(patch).where(eq(marketplaceListings.id, id));

    if (becamePublished && body.sendLaunchEmail) {
      await sendMarketplaceListingLaunchedEmail(id);
    }

    await recordAuditLog({
      userId: user?.id ?? null,
      action: 'marketplace.listing.updated',
      entityType: 'marketplace_listing',
      entityId: id,
      changes: patch,
    });

    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

route.post('/listings/:id/releases', async (c) => {
  try {
    const writeDb = getWriteDb();
    const id = c.req.param('id');
    const body = await c.req.json();
    const user = c.get('user');
    const release = {
      id: crypto.randomUUID(),
      listingId: id,
      versionLabel: String(body.versionLabel ?? 'v1.0.0').slice(0, 30),
      summary: String(body.summary ?? '').slice(0, 200),
      bodyMd: String(body.bodyMd ?? ''),
      isMajor: Boolean(body.isMajor),
      createdBy: user?.id,
    };
    await writeDb.insert(marketplaceReleases).values(release);
    await writeDb.update(marketplaceListings)
      .set({ versionLabel: release.versionLabel, lastUpdatedAt: new Date() })
      .where(eq(marketplaceListings.id, id));
    if (release.isMajor) {
      await sendMarketplaceReleaseEmail(id, release);
    }
    return c.json({ release }, 201);
  } catch (e) { return handleError(e, c); }
});

// Screenshot routes — upload to R2 via existing helper
route.post('/listings/:id/screenshots', async (c) => {
  // delegate to existing R2 upload pattern; append { key, alt } to listing.screenshots
  // implementation mirrors server/src/routes/uploads.ts (verify path before writing)
  // ... (see Task 11 for shared upload helper)
});

export { route as superadminMarketplaceRoute };

import { superadminMarketplaceRoute } from './routes/superadmin/marketplace';
app.route('/superadmin/marketplace', superadminMarketplaceRoute);

git add server/src/routes/superadmin/marketplace.ts server/src/routes/__tests__/superadmin-marketplace.test.ts server/src/api.ts
git commit -m "feat(marketplace): superadmin listings CMS + releases"

describe('superadmin marketplace requests', () => {
  it('POST /requests/:id/invoice transitions pending → invoiced + fires G3 email', async () => {
    const req = await seedRequest({ addonType: 'mrn', status: 'pending' });
    const { res, emailsSent } = await superadminRequest('POST', `/superadmin/marketplace/requests/${req.id}/invoice`, {
      unitPricePkr: 1500, totalPricePkr: 1500, invoiceId: 'INV-2026-0001',
    }, { captureEmails: true });
    expect(res.status).toBe(200);
    expect(emailsSent.some((e: any) => e.template === 'MarketplaceInvoiceReadyEmail')).toBe(true);
  });

  it('POST /requests/:id/mark-paid transitions invoiced → paid (no email)', async () => {
    const req = await seedRequest({ addonType: 'mrn', status: 'invoiced' });
    const { res, emailsSent } = await superadminRequest('POST', `/superadmin/marketplace/requests/${req.id}/mark-paid`, {}, { captureEmails: true });
    expect(res.status).toBe(200);
    expect(emailsSent).toHaveLength(0);
  });

  it('POST /requests/:id/approve transitions paid → approved AND enables clinic_modules', async () => {
    const req = await seedRequest({ addonType: 'mrn', status: 'paid' });
    const { res, emailsSent } = await superadminRequest('POST', `/superadmin/marketplace/requests/${req.id}/approve`, {}, { captureEmails: true });
    expect(res.status).toBe(200);
    const enabled = await getClinicModule(req.clinicId, 'mrn');
    expect(enabled?.isEnabled).toBe(true);
    expect(emailsSent.some((e: any) => e.template === 'MarketplaceAddonLiveEmail')).toBe(true);
  });

  it('POST /requests/:id/approve REJECTS when status is not paid (state guard)', async () => {
    const req = await seedRequest({ addonType: 'mrn', status: 'pending' });
    const res = await superadminRequest('POST', `/superadmin/marketplace/requests/${req.id}/approve`, {});
    expect(res.status).toBe(409);
  });

  it('POST /requests/:id/confirm-cancel disables clinic_modules', async () => {
    const req = await seedRequest({ addonType: 'mrn', status: 'cancel_requested' });
    await seedClinicModule({ clinicId: req.clinicId, moduleKey: 'mrn', isEnabled: true });
    const res = await superadminRequest('POST', `/superadmin/marketplace/requests/${req.id}/confirm-cancel`, {});
    expect(res.status).toBe(200);
    const m = await getClinicModule(req.clinicId, 'mrn');
    expect(m?.isEnabled).toBe(false);
  });
});

import { canTransition } from '../../lib/marketplace-state';
import { setClinicModule } from '../../lib/modules';
import {
  sendMarketplaceInvoiceReadyEmail,
  sendMarketplaceAddonLiveEmail,
} from '../../lib/marketplace-emails';

async function loadRequest(id: string) {
  const db = getReadDb();
  const [r] = await db.select().from(addonRequests).where(eq(addonRequests.id, id)).limit(1);
  if (!r) throw new AppError('Not found', 404);
  return r;
}

async function transition(id: string, to: any, patch: Record<string, any>) {
  const writeDb = getWriteDb();
  const before = await loadRequest(id);
  if (!canTransition(before.status as any, to)) {
    throw new AppError(`Invalid state ${before.status} → ${to}`, 409);
  }
  await writeDb.update(addonRequests)
    .set({ ...patch, status: to, updatedAt: new Date() })
    .where(eq(addonRequests.id, id));
  return { before, after: { ...before, ...patch, status: to } };
}

route.get('/requests', async (c) => {
  const db = getReadDb();
  const status = c.req.query('status'); // optional filter
  const rows = await db
    .select({ request: addonRequests, clinicName: clinics.name })
    .from(addonRequests)
    .leftJoin(clinics, eq(addonRequests.clinicId, clinics.id))
    .orderBy(desc(addonRequests.createdAt));
  const filtered = status ? rows.filter(r => r.request.status === status) : rows;
  return c.json({ requests: filtered });
});

route.post('/requests/:id/invoice', async (c) => {
  try {
    const id = c.req.param('id');
    const body = await c.req.json();
    const { unitPricePkr, totalPricePkr, invoiceId } = body;
    if (!Number.isInteger(unitPricePkr) || !Number.isInteger(totalPricePkr) || !invoiceId) {
      throw new AppError('Missing pricing or invoiceId', 400);
    }
    const { after } = await transition(id, 'invoiced', {
      unitPricePkr, totalPricePkr, invoiceId, invoicedAt: new Date(),
    });
    await sendMarketplaceInvoiceReadyEmail(after);
    await recordAuditLog({ action: 'marketplace.request.invoiced', entityId: id, entityType: 'addon_request', changes: { invoiceId } });
    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

route.post('/requests/:id/mark-paid', async (c) => {
  try {
    const id = c.req.param('id');
    await transition(id, 'paid', { paidAt: new Date() });
    await recordAuditLog({ action: 'marketplace.request.paid', entityId: id, entityType: 'addon_request', changes: {} });
    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

route.post('/requests/:id/approve', async (c) => {
  try {
    const id = c.req.param('id');
    const user = c.get('user');
    const { after } = await transition(id, 'approved', { approvedAt: new Date(), approvedBy: user?.id ?? 'superadmin' });
    // Activate the module
    if (after.addonType !== 'storage' && after.addonType !== 'portal_seats') {
      await setClinicModule(after.clinicId, after.addonType, true, user?.id ?? 'superadmin');
    }
    await sendMarketplaceAddonLiveEmail(after);
    await recordAuditLog({ action: 'marketplace.request.approved', entityId: id, entityType: 'addon_request', changes: { addonType: after.addonType } });
    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

route.post('/requests/:id/reject', async (c) => {
  try {
    const id = c.req.param('id');
    const body = await c.req.json().catch(() => ({}));
    const before = await loadRequest(id);
    if (!['pending', 'invoiced', 'paid'].includes(before.status)) {
      throw new AppError(`Cannot reject from ${before.status}`, 409);
    }
    const writeDb = getWriteDb();
    await writeDb.update(addonRequests)
      .set({ status: 'rejected', rejectedReason: String(body.reason ?? '').slice(0, 1000), updatedAt: new Date() })
      .where(eq(addonRequests.id, id));
    // existing AddonRejectedEmail wiring — verify import path and call
    await recordAuditLog({ action: 'marketplace.request.rejected', entityId: id, entityType: 'addon_request', changes: { reason: body.reason } });
    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

route.post('/requests/:id/confirm-cancel', async (c) => {
  try {
    const id = c.req.param('id');
    const user = c.get('user');
    const { after } = await transition(id, 'cancelled', { cancelledAt: new Date(), cancelledBy: user?.id ?? 'superadmin' });
    if (after.addonType !== 'storage' && after.addonType !== 'portal_seats') {
      await setClinicModule(after.clinicId, after.addonType, false, user?.id ?? 'superadmin');
    }
    await recordAuditLog({ action: 'marketplace.request.cancelled', entityId: id, entityType: 'addon_request', changes: {} });
    return c.json({ ok: true });
  } catch (e) { return handleError(e, c); }
});

import { eq, and } from 'drizzle-orm';
import { clinicModules } from '../schema/clinic_modules';
import { getWriteDb } from './db';

export async function setClinicModule(clinicId: string, moduleKey: string, enabled: boolean, updatedBy: string) {
  const writeDb = getWriteDb();
  const existing = await writeDb
    .select()
    .from(clinicModules)
    .where(and(eq(clinicModules.clinicId, clinicId), eq(clinicModules.moduleKey, moduleKey)))
    .limit(1);
  if (existing.length === 0) {
    await writeDb.insert(clinicModules).values({
      clinicId, moduleKey, isEnabled: enabled, updatedBy,
    });
  } else {
    await writeDb.update(clinicModules)
      .set({ isEnabled: enabled, updatedAt: new Date(), updatedBy })
      .where(eq(clinicModules.id, existing[0].id));
  }
}

cd server && pnpm vitest run src/routes/__tests__/superadmin-marketplace.test.ts
git add server/src/routes/superadmin/marketplace.ts server/src/lib/modules.ts server/src/routes/__tests__/superadmin-marketplace.test.ts
git commit -m "feat(marketplace): superadmin request inbox + state-guarded transitions"

// server/src/emails/MarketplaceInvoiceReadyEmail.tsx
import { Html, Head, Body, Container, Section, Heading, Text, Button, Hr } from '@react-email/components';
import { EmailHeader } from './components/EmailHeader';
import { EmailFooter } from './components/EmailFooter';

interface Props {
  clinicName: string;
  listingDisplayName: string;
  invoiceId: string;
  totalPricePkr: number;
  payUrl: string;
}

export default function MarketplaceInvoiceReadyEmail({
  clinicName, listingDisplayName, invoiceId, totalPricePkr, payUrl,
}: Props) {
  return (
    <Html>
      <Head />
      <Body style={bodyStyle}>
        <Container style={containerStyle}>
          <EmailHeader />
          <Section style={sectionStyle}>
            <Heading style={h1}>Your invoice for {listingDisplayName} is ready</Heading>
            <Text style={p}>
              Hi {clinicName}, your subscription request for <strong>{listingDisplayName}</strong> has been reviewed
              and an invoice is ready for payment.
            </Text>
            <Text style={p}><strong>Invoice:</strong> {invoiceId}<br /><strong>Total:</strong> PKR {totalPricePkr.toLocaleString()}</Text>
            <Button href={payUrl} style={button}>View invoice</Button>
            <Hr />
            <Text style={pSmall}>The module will activate once payment is confirmed. Questions? Reply to this email.</Text>
          </Section>
          <EmailFooter />
        </Container>
      </Body>
    </Html>
  );
}

// styles omitted — copy pattern from WelcomeEmail.tsx
const bodyStyle = {}; const containerStyle = {}; const sectionStyle = {}; const h1 = {}; const p = {}; const button = {}; const pSmall = {};