portalCustomer.js

Go to the documentation of this file.

/**
 * @file portalCustomer.js
 * @description Customer Portal Data Routes
 * 
 * Provides data access endpoints for authenticated customer portal users.
 * All routes require valid JWT authentication token.
 * 
 * **Features:**
 * - Profile management (view/update)
 * - Invoice viewing (list/details)
 * - Ticket management (list/create/comment)
 * - Contract viewing
 * - Asset listing
 * - Document access
 * - Dashboard statistics
 * 
 * **Security:**
 * - All routes protected by authenticateCustomer middleware
 * - Tenant isolation via setCustomerContext middleware
 * - Customer data filtered by customer_id from JWT
 * - Audit logging for data modifications
 * 
 * @module routes/portalCustomer
 * @requires express
 * @requires services/db
 * @requires middleware/customerAuth
 * @author Independent Business Group
 * @since 1.0.0
 * @see module:routes/portalAuth
 * @see module:middleware/customerAuth
 */
 
const express = require('express');
const router = express.Router();
const pool = require('../services/db');
const { authenticateCustomer, setCustomerContext, logCustomerAudit } = require('../middleware/customerAuth');
 
// Apply authentication to all routes
router.use(authenticateCustomer);
router.use(setCustomerContext);
 
/**
 * @api {get} /portal/customer/profile Get Customer Profile
 * @apiName GetCustomerProfile
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns customer profile information including portal user details,
 * billing address, and account status.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Number} customer_id Customer ID
 * @apiSuccess {String} customer_name Customer business name
 * @apiSuccess {String} contact_email Customer contact email
 * @apiSuccess {String} contact_phone Customer contact phone
 * @apiSuccess {String} billing_address Billing street address
 * @apiSuccess {String} billing_city Billing city
 * @apiSuccess {String} billing_state Billing state/province
 * @apiSuccess {String} billing_postcode Billing postal code
 * @apiSuccess {String} billing_country Billing country
 * @apiSuccess {String} status Account status
 * @apiSuccess {Date} created_at Account creation date
 * @apiSuccess {String} portal_email Portal login email
 * @apiSuccess {String} first_name User first name
 * @apiSuccess {String} last_name User last name
 * @apiSuccess {String} portal_phone User phone number
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (404) {String} error Customer not found
 * @apiError (500) {String} error Failed to get profile
 */
router.get('/profile', async (req, res) => {
    try {
        const result = await pool.query(
            `SELECT 
                c.customer_id, c.name as customer_name, c.email as contact_email, c.phone as contact_phone,
                c.billing_address, c.billing_city, c.billing_state, c.billing_postcode, 
                c.billing_country, c.status, c.created_at,
                cu.email as portal_email, cu.first_name, cu.last_name, cu.phone as portal_phone
             FROM customers c
             JOIN customer_users cu ON c.customer_id = cu.customer_id
             WHERE c.customer_id = $1 AND cu.customer_user_id = $2`,
            [req.customerId, req.customerUserId]
        );
 
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Customer not found.' });
        }
 
        res.json(result.rows[0]);
    } catch (error) {
        console.error('Get customer profile error:', error);
        res.status(500).json({ error: 'Failed to get profile.', details: error.message });
    }
});
 
/**
 * @api {put} /portal/customer/profile Update Customer Profile
 * @apiName UpdateCustomerProfile
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Updates customer contact information and billing address.
 * Logs audit event for profile modifications.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} [firstName] User first name
 * @apiParam {String} [lastName] User last name
 * @apiParam {String} [phone] User phone number
 * @apiParam {String} [contactEmail] Customer contact email
 * @apiParam {String} [contactPhone] Customer contact phone
 * @apiParam {String} [billingAddress] Billing street address
 * @apiParam {String} [billingCity] Billing city
 * @apiParam {String} [billingState] Billing state/province
 * @apiParam {String} [billingPostcode] Billing postal code
 * @apiParam {String} [billingCountry] Billing country
 * 
 * @apiSuccess {String} message Success message
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to update profile
 */
router.put('/profile', async (req, res) => {
    try {
        const {
            firstName,
            lastName,
            phone,
            contactEmail,
            contactPhone,
            billingAddress,
            billingCity,
            billingState,
            billingPostcode,
            billingCountry
        } = req.body;
 
        // Update customer_users
        await pool.query(
            `UPDATE customer_users 
             SET first_name = $1, last_name = $2, phone = $3, updated_at = NOW()
             WHERE customer_user_id = $4`,
            [firstName, lastName, phone, req.customerUserId]
        );
 
        // Update customers
        await pool.query(
            `UPDATE customers 
             SET email = $1, phone = $2, 
                 billing_address = $3, billing_city = $4, billing_state = $5,
                 billing_postcode = $6, billing_country = $7
             WHERE customer_id = $8`,
            [
                contactEmail,
                contactPhone,
                billingAddress,
                billingCity,
                billingState,
                billingPostcode,
                billingCountry,
                req.customerId
            ]
        );
 
        // Log audit event
        await logCustomerAudit(
            req.customerUserId,
            req.tenantId,
            'profile_update',
            'customer',
            req.customerId,
            { fields: Object.keys(req.body) },
            req.ip || req.connection.remoteAddress
        );
 
        res.json({ message: 'Profile updated successfully.' });
    } catch (error) {
        console.error('Update customer profile error:', error);
        res.status(500).json({ error: 'Failed to update profile.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/invoices List Customer Invoices
 * @apiName ListCustomerInvoices
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns paginated list of customer invoices with optional status filtering.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiParam {String} [status] Filter by status (Paid, Unpaid, Overdue, etc.)
 * @apiParam {Number} [limit=50] Results per page
 * @apiParam {Number} [offset=0] Pagination offset
 * 
 * @apiSuccess {Object[]} invoices Array of invoices
 * @apiSuccess {Number} invoices.invoice_id Invoice ID
 * @apiSuccess {String} invoices.invoice_number Invoice number
 * @apiSuccess {Date} invoices.invoice_date Invoice date
 * @apiSuccess {Date} invoices.due_date Due date
 * @apiSuccess {Number} invoices.subtotal Subtotal amount
 * @apiSuccess {Number} invoices.tax Tax amount
 * @apiSuccess {Number} invoices.total Total amount
 * @apiSuccess {String} invoices.status Status
 * @apiSuccess {String} invoices.payment_method Payment method
 * @apiSuccess {Date} invoices.payment_date Payment date
 * @apiSuccess {Date} invoices.created_at Creation date
 * @apiSuccess {Number} total Total count of invoices
 * @apiSuccess {Number} limit Page size
 * @apiSuccess {Number} offset Current offset
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get invoices
 */
router.get('/invoices', async (req, res) => {
    try {
        const { status, limit = 50, offset = 0 } = req.query;
 
        let query = `
            SELECT 
                invoice_id, invoice_number, invoice_date, due_date, 
                subtotal, tax, total, status, payment_method, payment_date,
                created_at
            FROM invoices
            WHERE customer_id = $1 AND tenant_id = $2
        `;
 
        const params = [req.customerId, req.tenantId];
 
        if (status) {
            query += ` AND status = $${params.length + 1}`;
            params.push(status);
        }
 
        query += ` ORDER BY invoice_date DESC LIMIT $${params.length + 1} OFFSET $${params.length + 2}`;
        params.push(parseInt(limit), parseInt(offset));
 
        const result = await pool.query(query, params);
 
        // Get total count
        const countResult = await pool.query(
            'SELECT COUNT(*) FROM invoices WHERE customer_id = $1 AND tenant_id = $2',
            [req.customerId, req.tenantId]
        );
 
        res.json({
            invoices: result.rows,
            total: parseInt(countResult.rows[0].count),
            limit: parseInt(limit),
            offset: parseInt(offset)
        });
    } catch (error) {
        console.error('Get customer invoices error:', error);
        res.status(500).json({ error: 'Failed to get invoices.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/invoices/:id Get Invoice Details
 * @apiName GetInvoiceDetails
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns invoice details including line items.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiParam {Number} id Invoice ID (URL parameter)
 * 
 * @apiSuccess {Object} invoice Invoice object with line_items array
 * @apiSuccess {Number} invoice.invoice_id Invoice ID
 * @apiSuccess {String} invoice.invoice_number Invoice number
 * @apiSuccess {Object[]} invoice.line_items Array of line items
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (404) {String} error Invoice not found
 * @apiError (500) {String} error Failed to get invoice details
 */
router.get('/invoices/:id', async (req, res) => {
    try {
        const invoiceId = parseInt(req.params.id);
 
        // Get invoice
        const invoiceResult = await pool.query(
            `SELECT * FROM invoices 
             WHERE invoice_id = $1 AND customer_id = $2 AND tenant_id = $3`,
            [invoiceId, req.customerId, req.tenantId]
        );
 
        if (invoiceResult.rows.length === 0) {
            return res.status(404).json({ error: 'Invoice not found.' });
        }
 
        // Get line items
        const lineItemsResult = await pool.query(
            `SELECT * FROM invoice_line_items 
             WHERE invoice_id = $1 
             ORDER BY line_item_id`,
            [invoiceId]
        );
 
        res.json({
            ...invoiceResult.rows[0],
            line_items: lineItemsResult.rows
        });
    } catch (error) {
        console.error('Get invoice details error:', error);
        res.status(500).json({ error: 'Failed to get invoice details.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/tickets List Customer Tickets
 * @apiName ListCustomerTickets
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns paginated list of customer support tickets with optional status filtering.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiParam {String} [status] Filter by status (Open, In Progress, Resolved, Closed)
 * @apiParam {Number} [limit=50] Results per page
 * @apiParam {Number} [offset=0] Pagination offset
 * 
 * @apiSuccess {Object[]} tickets Array of tickets
 * @apiSuccess {Number} tickets.ticket_id Ticket ID
 * @apiSuccess {String} tickets.ticket_number Ticket number
 * @apiSuccess {String} tickets.subject Ticket subject
 * @apiSuccess {String} tickets.description Ticket description
 * @apiSuccess {String} tickets.status Status
 * @apiSuccess {String} tickets.priority Priority (Low, Normal, High, Critical)
 * @apiSuccess {Number} tickets.assigned_to Assigned user ID
 * @apiSuccess {Date} tickets.created_at Creation date
 * @apiSuccess {Date} tickets.updated_at Last update date
 * @apiSuccess {Date} tickets.resolved_at Resolution date
 * @apiSuccess {Number} total Total count of tickets
 * @apiSuccess {Number} limit Page size
 * @apiSuccess {Number} offset Current offset
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get tickets
 */
router.get('/tickets', async (req, res) => {
    try {
        const { status, limit = 50, offset = 0 } = req.query;
 
        let query = `
            SELECT 
                ticket_id, ticket_number, subject, description, status, priority,
                assigned_to, created_at, updated_at, resolved_at
            FROM tickets
            WHERE customer_id = $1 AND tenant_id = $2
        `;
 
        const params = [req.customerId, req.tenantId];
 
        if (status) {
            query += ` AND status = $${params.length + 1}`;
            params.push(status);
        }
 
        query += ` ORDER BY created_at DESC LIMIT $${params.length + 1} OFFSET $${params.length + 2}`;
        params.push(parseInt(limit), parseInt(offset));
 
        const result = await pool.query(query, params);
 
        // Get total count
        const countResult = await pool.query(
            'SELECT COUNT(*) FROM tickets WHERE customer_id = $1 AND tenant_id = $2',
            [req.customerId, req.tenantId]
        );
 
        res.json({
            tickets: result.rows,
            total: parseInt(countResult.rows[0].count),
            limit: parseInt(limit),
            offset: parseInt(offset)
        });
    } catch (error) {
        console.error('Get customer tickets error:', error);
        res.status(500).json({ error: 'Failed to get tickets.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/tickets/:id Get Ticket Details
 * @apiName GetTicketDetails
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns ticket details including all comments.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiParam {Number} id Ticket ID (URL parameter)
 * 
 * @apiSuccess {Object} ticket Ticket object with comments array
 * @apiSuccess {Number} ticket.ticket_id Ticket ID
 * @apiSuccess {String} ticket.ticket_number Ticket number
 * @apiSuccess {String} ticket.subject Subject
 * @apiSuccess {String} ticket.description Description
 * @apiSuccess {String} ticket.status Status
 * @apiSuccess {String} ticket.priority Priority
 * @apiSuccess {String} ticket.assigned_to_name Assigned technician name
 * @apiSuccess {Object[]} ticket.comments Array of comments
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (404) {String} error Ticket not found
 * @apiError (500) {String} error Failed to get ticket details
 */
router.get('/tickets/:id', async (req, res) => {
    try {
        const ticketId = parseInt(req.params.id);
 
        // Get ticket
        const ticketResult = await pool.query(
            `SELECT t.*, u.user_name as assigned_to_name
             FROM tickets t
             LEFT JOIN users u ON t.assigned_to = u.user_id
             WHERE t.ticket_id = $1 AND t.customer_id = $2 AND t.tenant_id = $3`,
            [ticketId, req.customerId, req.tenantId]
        );
 
        if (ticketResult.rows.length === 0) {
            return res.status(404).json({ error: 'Ticket not found.' });
        }
 
        // Get comments
        const commentsResult = await pool.query(
            `SELECT tc.*, u.user_name as author_name
             FROM ticket_comments tc
             LEFT JOIN users u ON tc.user_id = u.user_id
             WHERE tc.ticket_id = $1
             ORDER BY tc.created_at ASC`,
            [ticketId]
        );
 
        res.json({
            ...ticketResult.rows[0],
            comments: commentsResult.rows
        });
    } catch (error) {
        console.error('Get ticket details error:', error);
        res.status(500).json({ error: 'Failed to get ticket details.', details: error.message });
    }
});
 
/**
 * @api {post} /portal/customer/tickets Create Support Ticket
 * @apiName CreateSupportTicket
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Creates new support ticket. Auto-generates ticket number.
 * Logs audit event for ticket creation.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {String} subject Ticket subject (required)
 * @apiParam {String} description Ticket description (required)
 * @apiParam {String} [priority=Normal] Priority (Low, Normal, High, Critical)
 * 
 * @apiSuccess (201) {Object} ticket Created ticket object
 * @apiSuccess (201) {Number} ticket.ticket_id Ticket ID
 * @apiSuccess (201) {String} ticket.ticket_number Generated ticket number
 * @apiSuccess (201) {String} ticket.subject Subject
 * @apiSuccess (201) {String} ticket.status Status (always Open initially)
 * 
 * @apiError (400) {String} error Subject and description are required
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to create ticket
 */
router.post('/tickets', async (req, res) => {
    try {
        const { subject, description, priority = 'Normal' } = req.body;
 
        if (!subject || !description) {
            return res.status(400).json({ error: 'Subject and description are required.' });
        }
 
        // Generate ticket number
        const ticketNumberResult = await pool.query(
            `SELECT COALESCE(MAX(CAST(SUBSTRING(ticket_number FROM '[0-9]+') AS INTEGER)), 0) + 1 as next_num
             FROM tickets WHERE tenant_id = $1`,
            [req.tenantId]
        );
        const ticketNumber = `TICKET-${ticketNumberResult.rows[0].next_num}`;
 
        // Create ticket
        const result = await pool.query(
            `INSERT INTO tickets 
             (tenant_id, customer_id, ticket_number, subject, description, priority, status, created_at, updated_at)
             VALUES ($1, $2, $3, $4, $5, $6, 'Open', NOW(), NOW())
             RETURNING *`,
            [req.tenantId, req.customerId, ticketNumber, subject, description, priority]
        );
 
        // Log audit event
        await logCustomerAudit(
            req.customerUserId,
            req.tenantId,
            'ticket_create',
            'ticket',
            result.rows[0].ticket_id,
            { subject, priority },
            req.ip || req.connection.remoteAddress
        );
 
        res.status(201).json(result.rows[0]);
    } catch (error) {
        console.error('Create ticket error:', error);
        res.status(500).json({ error: 'Failed to create ticket.', details: error.message });
    }
});
 
/**
 * @api {post} /portal/customer/tickets/:id/comments Add Ticket Comment
 * @apiName AddTicketComment
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Adds comment to existing ticket. Updates ticket's updated_at timestamp.
 * Logs audit event.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * @apiHeader {String} Content-Type application/json
 * 
 * @apiParam {Number} id Ticket ID (URL parameter)
 * @apiParam {String} comment Comment text (required)
 * 
 * @apiSuccess (201) {Object} comment Created comment object
 * @apiSuccess (201) {Number} comment.comment_id Comment ID
 * @apiSuccess (201) {Number} comment.ticket_id Ticket ID
 * @apiSuccess (201) {String} comment.comment Comment text
 * @apiSuccess (201) {Boolean} comment.is_internal Internal flag (always false)
 * @apiSuccess (201) {Date} comment.created_at Creation date
 * 
 * @apiError (400) {String} error Comment is required
 * @apiError (401) {String} error Unauthorized
 * @apiError (404) {String} error Ticket not found
 * @apiError (500) {String} error Failed to add comment
 */
router.post('/tickets/:id/comments', async (req, res) => {
    try {
        const ticketId = parseInt(req.params.id);
        const { comment } = req.body;
 
        if (!comment) {
            return res.status(400).json({ error: 'Comment is required.' });
        }
 
        // Verify ticket belongs to customer
        const ticketResult = await pool.query(
            'SELECT ticket_id FROM tickets WHERE ticket_id = $1 AND customer_id = $2 AND tenant_id = $3',
            [ticketId, req.customerId, req.tenantId]
        );
 
        if (ticketResult.rows.length === 0) {
            return res.status(404).json({ error: 'Ticket not found.' });
        }
 
        // Add comment
        const result = await pool.query(
            `INSERT INTO ticket_comments 
             (ticket_id, user_id, comment, is_internal, created_at)
             VALUES ($1, NULL, $2, false, NOW())
             RETURNING *`,
            [ticketId, comment]
        );
 
        // Update ticket updated_at
        await pool.query(
            'UPDATE tickets SET updated_at = NOW() WHERE ticket_id = $1',
            [ticketId]
        );
 
        // Log audit event
        await logCustomerAudit(
            req.customerUserId,
            req.tenantId,
            'ticket_comment',
            'ticket',
            ticketId,
            {},
            req.ip || req.connection.remoteAddress
        );
 
        res.status(201).json(result.rows[0]);
    } catch (error) {
        console.error('Add ticket comment error:', error);
        res.status(500).json({ error: 'Failed to add comment.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/contracts List Customer Contracts
 * @apiName ListCustomerContracts
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns list of all customer contracts with billing information.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Object[]} contracts Array of contracts
 * @apiSuccess {Number} contracts.contract_id Contract ID
 * @apiSuccess {String} contracts.contract_name Contract name
 * @apiSuccess {String} contracts.description Description
 * @apiSuccess {String} contracts.billing_interval Billing interval (Monthly, Quarterly, Annually)
 * @apiSuccess {Number} contracts.amount Billing amount
 * @apiSuccess {Date} contracts.start_date Start date
 * @apiSuccess {Date} contracts.end_date End date
 * @apiSuccess {Date} contracts.next_billing_date Next billing date
 * @apiSuccess {String} contracts.status Status (Active, Expired, Cancelled)
 * @apiSuccess {Date} contracts.created_at Creation date
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get contracts
 */
router.get('/contracts', async (req, res) => {
    try {
        const result = await pool.query(
            `SELECT 
                contract_id, contract_name, description, billing_interval, amount,
                start_date, end_date, next_billing_date, status, created_at
             FROM contracts
             WHERE customer_id = $1 AND tenant_id = $2
             ORDER BY created_at DESC`,
            [req.customerId, req.tenantId]
        );
 
        res.json({ contracts: result.rows });
    } catch (error) {
        console.error('Get customer contracts error:', error);
        res.status(500).json({ error: 'Failed to get contracts.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/contracts/:id Get Contract Details
 * @apiName GetContractDetails
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns detailed information for specific contract.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiParam {Number} id Contract ID (URL parameter)
 * 
 * @apiSuccess {Object} contract Contract object with all fields
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (404) {String} error Contract not found
 * @apiError (500) {String} error Failed to get contract details
 */
router.get('/contracts/:id', async (req, res) => {
    try {
        const contractId = parseInt(req.params.id);
 
        const result = await pool.query(
            `SELECT * FROM contracts 
             WHERE contract_id = $1 AND customer_id = $2 AND tenant_id = $3`,
            [contractId, req.customerId, req.tenantId]
        );
 
        if (result.rows.length === 0) {
            return res.status(404).json({ error: 'Contract not found.' });
        }
 
        res.json(result.rows[0]);
    } catch (error) {
        console.error('Get contract details error:', error);
        res.status(500).json({ error: 'Failed to get contract details.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/assets List Customer Assets
 * @apiName ListCustomerAssets
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns list of all customer assets/equipment.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Object[]} assets Array of assets
 * @apiSuccess {Number} assets.asset_id Asset ID
 * @apiSuccess {String} assets.asset_name Asset name
 * @apiSuccess {String} assets.asset_type Asset type
 * @apiSuccess {String} assets.serial_number Serial number
 * @apiSuccess {String} assets.location Physical location
 * @apiSuccess {Date} assets.purchase_date Purchase date
 * @apiSuccess {Date} assets.warranty_expiry Warranty expiration date
 * @apiSuccess {String} assets.status Status (Active, Retired, etc.)
 * @apiSuccess {Date} assets.created_at Creation date
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get assets
 */
router.get('/assets', async (req, res) => {
    try {
        const result = await pool.query(
            `SELECT 
                asset_id, asset_name, asset_type, serial_number, location,
                purchase_date, warranty_expiry, status, created_at
             FROM assets
             WHERE customer_id = $1 AND tenant_id = $2
             ORDER BY created_at DESC`,
            [req.customerId, req.tenantId]
        );
 
        res.json({ assets: result.rows });
    } catch (error) {
        console.error('Get customer assets error:', error);
        res.status(500).json({ error: 'Failed to get assets.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/documents List Customer Documents
 * @apiName ListCustomerDocuments
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns list of all customer documents.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Object[]} documents Array of documents
 * @apiSuccess {Number} documents.document_id Document ID
 * @apiSuccess {String} documents.document_name Document name
 * @apiSuccess {String} documents.document_type Document type
 * @apiSuccess {String} documents.file_path File path
 * @apiSuccess {Number} documents.file_size File size (bytes)
 * @apiSuccess {String} documents.uploaded_by Uploader name
 * @apiSuccess {Date} documents.created_at Upload date
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get documents
 */
router.get('/documents', async (req, res) => {
    try {
        const result = await pool.query(
            `SELECT 
                document_id, document_name, document_type, file_path, file_size,
                uploaded_by, created_at
             FROM documents
             WHERE customer_id = $1 AND tenant_id = $2
             ORDER BY created_at DESC`,
            [req.customerId, req.tenantId]
        );
 
        res.json({ documents: result.rows });
    } catch (error) {
        console.error('Get customer documents error:', error);
        res.status(500).json({ error: 'Failed to get documents.', details: error.message });
    }
});
 
/**
 * @api {get} /portal/customer/dashboard Get Dashboard Overview
 * @apiName GetCustomerDashboard
 * @apiGroup CustomerPortalData
 * @apiVersion 1.0.0
 * 
 * @apiDescription 
 * Returns dashboard overview with statistics and recent activity.
 * Aggregates data from invoices, contracts, tickets, and assets.
 * 
 * @apiPermission customer
 * 
 * @apiHeader {String} Authorization Bearer JWT token
 * 
 * @apiSuccess {Object} stats Statistics object
 * @apiSuccess {Number} stats.outstandingBalance Total unpaid invoices
 * @apiSuccess {Number} stats.activeContracts Count of active contracts
 * @apiSuccess {Number} stats.openTickets Count of open/in-progress tickets
 * @apiSuccess {Number} stats.totalAssets Count of total assets
 * @apiSuccess {Object[]} recentInvoices 5 most recent invoices
 * @apiSuccess {Object[]} recentTickets 5 most recent tickets
 * 
 * @apiError (401) {String} error Unauthorized
 * @apiError (500) {String} error Failed to get dashboard data
 */
router.get('/dashboard', async (req, res) => {
    try {
        // Get outstanding balance
        const balanceResult = await pool.query(
            `SELECT COALESCE(SUM(total), 0) as outstanding_balance
             FROM invoices
             WHERE customer_id = $1 AND tenant_id = $2 AND status = 'Unpaid'`,
            [req.customerId, req.tenantId]
        );
 
        // Get active contracts count
        const contractsResult = await pool.query(
            `SELECT COUNT(*) as active_contracts
             FROM contracts
             WHERE customer_id = $1 AND tenant_id = $2 AND status = 'Active'`,
            [req.customerId, req.tenantId]
        );
 
        // Get open tickets count
        const ticketsResult = await pool.query(
            `SELECT COUNT(*) as open_tickets
             FROM tickets
             WHERE customer_id = $1 AND tenant_id = $2 AND status IN ('Open', 'In Progress')`,
            [req.customerId, req.tenantId]
        );
 
        // Get total assets count
        const assetsResult = await pool.query(
            `SELECT COUNT(*) as total_assets
             FROM assets
             WHERE customer_id = $1 AND tenant_id = $2`,
            [req.customerId, req.tenantId]
        );
 
        // Get recent invoices
        const recentInvoicesResult = await pool.query(
            `SELECT invoice_id, invoice_number, invoice_date, total, status
             FROM invoices
             WHERE customer_id = $1 AND tenant_id = $2
             ORDER BY invoice_date DESC
             LIMIT 5`,
            [req.customerId, req.tenantId]
        );
 
        // Get recent tickets
        const recentTicketsResult = await pool.query(
            `SELECT ticket_id, ticket_number, subject, status, created_at
             FROM tickets
             WHERE customer_id = $1 AND tenant_id = $2
             ORDER BY created_at DESC
             LIMIT 5`,
            [req.customerId, req.tenantId]
        );
 
        res.json({
            stats: {
                outstandingBalance: parseFloat(balanceResult.rows[0].outstanding_balance),
                activeContracts: parseInt(contractsResult.rows[0].active_contracts),
                openTickets: parseInt(ticketsResult.rows[0].open_tickets),
                totalAssets: parseInt(assetsResult.rows[0].total_assets)
            },
            recentInvoices: recentInvoicesResult.rows,
            recentTickets: recentTicketsResult.rows
        });
    } catch (error) {
        console.error('Get customer dashboard error:', error);
        res.status(500).json({ error: 'Failed to get dashboard data.', details: error.message });
    }
});
 
module.exports = router;