Feat added internal notes

Reviewed-on: #7

.github/pull_request_template.md

@@ -5,7 +5,6 @@ Describe problem and user or business impact.
 ## Ticket / Assignment
 
 - Ticket:
-- Assignment:
 
 ## What changed
 
@@ -18,7 +17,6 @@ Describe problem and user or business impact.
 List exact commands and manual checks.
 
 ```bash
-bun run check
 bun run test
 bun run build:web
 ```

.gitignore

@@ -8,3 +8,4 @@ bun.lock
 *.sqlite-wal
 dist
 coverage
+pi-session*

AGENTS.md

@@ -1,5 +1,9 @@
 # Typescript Full Stack App Agent
 
+## Coding Conventions
+- Before planning any code plan, check the `CONTRIBUTING.md` file in the root directory of the project to understand and apply coding conventions for this project
+- Instead of reading and parsing the `CONTRIBUTING.md` every time, cache the findings of `CONTRIBUTING.md` and refer to this cache'd file whenever checking the conventions is required
+
 ## Output Rules
 
 ### Response Style
@@ -176,4 +180,3 @@ Skip `discover_context` for narrow tasks with explicit file targets.
 ### Boundaries
 - Recon is read-only unless user requested implementation.
 - Do not treat scout output as complete when evidence suggests missing files.
-

apps/api/src/db/init-db.ts

@@ -90,6 +90,7 @@ export function initializeDatabase(sqlite: Database) {
       customer_id TEXT NOT NULL REFERENCES users(id),
       shipping_address_id TEXT NOT NULL REFERENCES addresses(id),
       status TEXT NOT NULL,
+      notes TEXT,
       created_at TEXT NOT NULL,
       updated_at TEXT NOT NULL
     );
@@ -119,4 +120,7 @@ export function initializeDatabase(sqlite: Database) {
       created_at TEXT NOT NULL
     );
   `);
+  if (!columnExists(sqlite, "orders", "notes")) {
+    sqlite.exec("ALTER TABLE orders ADD COLUMN notes TEXT");
+  }
 }

apps/api/src/db/schema/orders.ts

@@ -9,6 +9,7 @@ export const orders = sqliteTable("orders", {
   customerId: text("customer_id").notNull().references(() => users.id),
   shippingAddressId: text("shipping_address_id").notNull().references(() => addresses.id),
   status: text("status").notNull(),
+  notes: text("notes"),
   createdAt: text("created_at").notNull(),
   updatedAt: text("updated_at").notNull()
 });

apps/api/src/orders/order-notes-assignment-2.test.ts

@@ -0,0 +1,106 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { AppWithContext } from "../app";
+import { buildApp } from "../app";
+import { createUser } from "../users/user-repository";
+
+let app: AppWithContext;
+let employeeCookie = "";
+let customerCookie = "";
+
+function firstHeader(value: string | string[] | undefined): string {
+  return Array.isArray(value) ? value[0] ?? "" : value ?? "";
+}
+
+async function login(username: string) {
+  const response = await app.inject({ method: "POST", url: "/api/login", payload: { username } });
+  return firstHeader(response.headers["set-cookie"]);
+}
+
+beforeEach(async () => {
+  app = await buildApp(":memory:");
+
+  await createUser(app.dbContext, {
+    username: "dev-employee",
+    name: "Dev Employee",
+    email: "dev.employee@example.com",
+    role: "employee"
+  });
+
+  employeeCookie = await login("dev-employee");
+  customerCookie = await login("john-smith");
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("assignment 2 internal order notes", () => {
+  test("allows employee users to attach notes to an order", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "Follow up with warehouse before shipping." }
+    });
+
+    const order = response.json();
+
+    expect(response.statusCode).toBe(200);
+    expect(order.orderNumber).toBe("ORD-1001");
+    expect(order.notes).toBe("Follow up with warehouse before shipping.");
+    expect(order.items).toHaveLength(2);
+  });
+
+  test("returns persisted notes when the order is viewed later", async () => {
+    const updateResponse = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "Customer requested gift receipt." }
+    });
+
+    expect(updateResponse.statusCode).toBe(200);
+
+    const detailResponse = await app.inject({
+      method: "GET",
+      url: "/api/orders/order_1",
+      headers: { cookie: employeeCookie }
+    });
+
+    expect(detailResponse.statusCode).toBe(200);
+    expect(detailResponse.json().notes).toBe("Customer requested gift receipt.");
+  });
+
+  test("rejects customer users when attaching notes", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: customerCookie },
+      payload: { notes: "Customer should not be able to add this." }
+    });
+
+    expect(response.statusCode).toBe(403);
+  });
+
+  test("rejects empty notes", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "   " }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("rejects notes beyond the accepted length limit", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_1/notes",
+      headers: { cookie: employeeCookie },
+      payload: { notes: "x".repeat(1001) }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+});

apps/api/src/orders/order-repository.ts

@@ -35,13 +35,13 @@ function toOrderItemDetail(row: {
 }
 
 export async function listOrderSummaries(context: DatabaseContext, query?: string) {
-  const search = query?.trim();
+  const search = query?.trim().toLowerCase();
 
   const filters = search
     ? or(
-        sql`instr(${orders.orderNumber}, ${search}) > 0`,
+        sql`instr(lower(${orders.orderNumber}), ${search}) > 0`,
-        sql`instr(${users.name}, ${search}) > 0`,
+        sql`instr(lower(${users.name}), ${search}) > 0`,
-        sql`instr(${users.email}, ${search}) > 0`
+        sql`instr(lower(${users.email}), ${search}) > 0`
       )
     : undefined;
 
@@ -96,6 +96,7 @@ export async function findOrderDetail(context: DatabaseContext, orderId: string)
     id: header.order.id,
     orderNumber: header.order.orderNumber,
     status: header.order.status as OrderDetail["status"],
+    notes: header.order.notes,
     createdAt: header.order.createdAt,
     updatedAt: header.order.updatedAt,
     customer: {
@@ -127,6 +128,10 @@ export async function updateOrderTimestamp(context: DatabaseContext, orderId: st
   await context.db.update(orders).set({ updatedAt }).where(eq(orders.id, orderId));
 }
 
+export async function updateOrderNotes(context: DatabaseContext, orderId: string, notes: string, updatedAt: string) {
+  await context.db.update(orders).set({ notes, updatedAt }).where(eq(orders.id, orderId));
+}
+
 export async function updateOrderStatus(context: DatabaseContext, orderId: string, status: OrderDetail["status"], updatedAt: string) {
   await context.db.update(orders).set({ status, updatedAt }).where(eq(orders.id, orderId));
 }

apps/api/src/orders/order-routes.ts

@@ -7,6 +7,7 @@ import { getOrder } from "./get-order";
 import { listAuditEvents } from "./list-audit-events";
 import { listOrders } from "./list-orders";
 import { changeOrderItemQuantity } from "./update-order-item";
+import { changeOrderNotes } from "./update-order-notes";
 import { changeShippingAddress } from "./update-shipping-address";
 
 interface OrderRouteOptions {
@@ -69,6 +70,29 @@ export const registerOrderRoutes: FastifyPluginAsync<OrderRouteOptions> = async
 
   app.get<{ Params: IdParams }>("/orders/:orderId/audit-events", async (request) => listAuditEvents(options.db, request.params.orderId));
 
+  app.post<{ Params: IdParams; Body: { notes: string } }>("/orders/:orderId/notes", {
+    schema: {
+      body: {
+        type: "object",
+        required: ["notes"],
+        properties: {
+          notes: { type: "string", minLength: 1, maxLength: 1000 }
+        }
+      }
+    }
+  }, async (request, reply) => {
+    const result = await changeOrderNotes(options.db, {
+      orderId: request.params.orderId,
+      notes: request.body.notes
+    });
+
+    if (result.statusCode !== 200) {
+      return reply.code(result.statusCode).send({ message: result.message });
+    }
+
+    return result.order;
+  });
+
   app.post<{ Params: OrderItemParams; Body: QuantityBody }>("/orders/:orderId/items/:itemId/quantity", {
     schema: {
       body: {

apps/api/src/orders/order-search-assignment-1.test.ts

@@ -0,0 +1,50 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { AppWithContext } from "../app";
+import { buildApp } from "../app";
+import { createUser } from "../users/user-repository";
+
+let app: AppWithContext;
+let employeeCookie = "";
+
+function firstHeader(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value ?? "";
+}
+
+async function login(username: string) {
+  const response = await app.inject({ method: "POST", url: "/api/login", payload: { username } });
+  return firstHeader(response.headers["set-cookie"]);
+}
+
+beforeEach(async () => {
+  app = await buildApp(":memory:");
+
+  await createUser(app.dbContext, {
+    username: "dev-employee",
+    name: "Dev Employee",
+    email: "dev.employee@example.com",
+    role: "employee"
+  });
+
+  employeeCookie = await login("dev-employee");
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("assignment 1 search behavior", () => {
+  test("searches orders case-insensitively by customer name", async () => {
+    const response = await app.inject({
+      method: "GET",
+      url: "/api/orders?query=JOHN",
+      headers: { cookie: employeeCookie }
+    });
+
+    const orders = response.json();
+    const orderNumbers = orders.map((order: { orderNumber: string }) => order.orderNumber);
+
+    expect(response.statusCode).toBe(200);
+    expect(orderNumbers).toContain("ORD-1001");
+    expect(orderNumbers).toContain("ORD-1003");
+  });
+});

apps/api/src/orders/update-order-notes.ts

@@ -0,0 +1,19 @@
+import type { DatabaseContext } from "../db/database";
+import { findOrderDetail, updateOrderNotes } from "./order-repository";
+
+export async function changeOrderNotes(context: DatabaseContext, input: { orderId: string; notes: string }) {
+  const notes = input.notes.trim();
+
+  if (!notes || Array.from(input.notes).length > 1000) {
+    return { statusCode: 400, message: "Internal notes must contain between 1 and 1000 characters." } as const;
+  }
+
+  const order = await findOrderDetail(context, input.orderId);
+  if (!order) {
+    return { statusCode: 404, message: "Order not found." } as const;
+  }
+
+  await updateOrderNotes(context, input.orderId, notes, new Date().toISOString());
+
+  return { statusCode: 200, order: await findOrderDetail(context, input.orderId) } as const;
+}

apps/web/src/orders/order-api.ts

@@ -34,3 +34,10 @@ export function cancelOrder(orderId: string, reason?: string) {
     body: JSON.stringify({ reason })
   });
 }
+
+export function updateOrderNotes(orderId: string, notes: string) {
+  return apiRequest<OrderDetail>(`/api/orders/${orderId}/notes`, {
+    method: "POST",
+    body: JSON.stringify({ notes })
+  });
+}

apps/web/src/orders/order-detail-page.tsx

@@ -1,6 +1,7 @@
 import type { Address, AuditEvent, OrderDetail } from "@orderops/shared";
 import { AuditTimeline } from "./audit-timeline";
 import { OrderItemsPanel } from "./order-items-panel";
+import { OrderNotesForm } from "./order-notes-form";
 import { OrderSummaryPanel } from "./order-summary";
 import { ShippingAddressForm } from "./shipping-address-form";
 
@@ -10,6 +11,7 @@ interface OrderDetailPageProps {
   onUpdateQuantity: (itemId: string, quantity: number) => Promise<void>;
   onSaveAddress: (address: Address) => Promise<void>;
   onCancel: () => Promise<void>;
+  onSaveNotes: (notes: string) => Promise<boolean>;
 }
 
 export function OrderDetailPage({
@@ -17,12 +19,20 @@ export function OrderDetailPage({
   auditEvents,
   onUpdateQuantity,
   onSaveAddress,
-  onCancel
+  onCancel,
+  onSaveNotes
 }: OrderDetailPageProps) {
   return (
     <div className="space-y-4">
       <OrderSummaryPanel order={order} />
-      <div className="flex justify-end">
+      <div className="flex justify-end gap-3">
+        <button className="rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white" type="button" onClick={() => {
+          const input = document.getElementById("internal-order-notes");
+          input?.scrollIntoView({ block: "center" });
+          input?.focus({ preventScroll: true });
+        }}>
+          {order.notes ? "Edit internal notes" : "Add internal note"}
+        </button>
         <button className="rounded-md bg-red-600 px-4 py-2 text-sm font-medium text-white" onClick={() => void onCancel()} type="button">
           Cancel order
         </button>
@@ -30,6 +40,7 @@ export function OrderDetailPage({
       <OrderItemsPanel order={order} onUpdateQuantity={onUpdateQuantity} />
       <ShippingAddressForm order={order} onSave={onSaveAddress} />
       <AuditTimeline events={auditEvents} />
+      <OrderNotesForm key={order.id} notes={order.notes} onSave={onSaveNotes} />
     </div>
   );
 }

apps/web/src/orders/order-notes-form.tsx

@@ -0,0 +1,58 @@
+import { useState } from "react";
+
+interface OrderNotesFormProps {
+  notes: string | null;
+  onSave: (notes: string) => Promise<boolean>;
+}
+
+export function OrderNotesForm({ notes, onSave }: OrderNotesFormProps) {
+  const [draft, setDraft] = useState(notes ?? "");
+  const [isSaving, setIsSaving] = useState(false);
+  const length = Array.from(draft).length;
+
+  return (
+    <section className="rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
+      <div className="mb-3 flex items-center gap-3">
+        <h3 className="text-sm font-semibold text-slate-700">Internal notes</h3>
+        <span className="rounded-full bg-slate-100 px-3 py-1 text-xs text-slate-600">Employees only</span>
+      </div>
+      {notes ? <p className="mb-3 whitespace-pre-wrap break-words rounded-lg border border-slate-200 p-3 text-sm text-slate-700">{notes}</p> : null}
+      <form onSubmit={async (event) => {
+        event.preventDefault();
+        if (isSaving || !draft.trim() || length > 1000) return;
+        setIsSaving(true);
+        try {
+          if (await onSave(draft)) setDraft(draft.trim());
+        } finally {
+          setIsSaving(false);
+        }
+      }}>
+        <label className="mb-1 block text-sm text-slate-700" htmlFor="internal-order-notes">
+          {notes ? "Edit internal notes" : "Add a note for your teammates"}
+        </label>
+        <textarea
+          id="internal-order-notes"
+          className="w-full rounded-lg border border-slate-300 px-3 py-2 text-sm"
+          aria-describedby="internal-order-notes-help"
+          placeholder="Add a note for your teammates..."
+          rows={3}
+          value={draft}
+          disabled={isSaving}
+          onChange={(event) => setDraft(event.target.value)}
+        />
+        <div className="mt-2 flex items-center justify-between gap-3">
+          <p id="internal-order-notes-help" className="text-xs text-slate-600">
+            {length}/1000 characters. Saving replaces the current notes.
+          </p>
+          <button
+            className="rounded-md bg-blue-600 px-4 py-2 text-sm font-medium text-white disabled:opacity-50"
+            type="submit"
+            disabled={isSaving || !draft.trim() || length > 1000}
+          >
+            {isSaving ? "Saving..." : notes ? "Save notes" : "Add note"}
+          </button>
+        </div>
+      </form>
+    </section>
+  );
+}

apps/web/src/orders/order-page.tsx

@@ -2,7 +2,7 @@ import { useEffect, useState } from "react";
 import type { Address, AuditEvent, OrderDetail } from "@orderops/shared";
 import { Link, useParams } from "react-router-dom";
 import { Toast } from "../ui/toast";
-import { cancelOrder, getOrder, listAuditEvents, updateOrderItemQuantity, updateShippingAddress } from "./order-api";
+import { cancelOrder, getOrder, listAuditEvents, updateOrderItemQuantity, updateOrderNotes, updateShippingAddress } from "./order-api";
 import { OrderDetailPage } from "./order-detail-page";
 
 interface ToastState {
@@ -55,7 +55,7 @@ export function OrderPage() {
 
   async function runAction(action: () => Promise<OrderDetail>, successMessage: string) {
     if (!orderId) {
-      return;
+      return false;
     }
 
     try {
@@ -64,11 +64,13 @@ export function OrderPage() {
       setOrder(nextOrder);
       await refreshOrder(orderId);
       setToast({ message: successMessage, variant: "success" });
+      return true;
     } catch (caught) {
       setToast({
         message: caught instanceof Error ? caught.message : "Request failed.",
         variant: "error"
       });
+      return false;
     }
   }
 
@@ -84,9 +86,10 @@ export function OrderPage() {
         <OrderDetailPage
           order={order}
           auditEvents={auditEvents}
-          onUpdateQuantity={(itemId, quantity) => runAction(() => updateOrderItemQuantity(order.id, itemId, quantity), "Quantity saved.")}
+          onUpdateQuantity={async (itemId, quantity) => { await runAction(() => updateOrderItemQuantity(order.id, itemId, quantity), "Quantity saved."); }}
-          onSaveAddress={(address: Address) => runAction(() => updateShippingAddress(order.id, address), "Shipping address saved.")}
+          onSaveAddress={async (address: Address) => { await runAction(() => updateShippingAddress(order.id, address), "Shipping address saved."); }}
-          onCancel={() => runAction(() => cancelOrder(order.id), "Order cancelled.")}
+          onCancel={async () => { await runAction(() => cancelOrder(order.id), "Order cancelled."); }}
+          onSaveNotes={(notes) => runAction(() => updateOrderNotes(order.id, notes), "Internal notes saved.")}
         />
       ) : null}
     </div>

packages/shared/src/order-detail.ts

@@ -17,6 +17,7 @@ export interface OrderDetail {
   id: string;
   orderNumber: string;
   status: OrderStatus;
+  notes: string | null;
   createdAt: string;
   updatedAt: string;
   customer: CustomerSummary;