refactor:centralize order status rules in shared package

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

apps/api/src/orders/cancel-order.ts

@@ -1,5 +1,5 @@
+import { canCancelOrder, orderCancellationBlockedMessage } from "@orderops/shared/order-status";
 import type { DatabaseContext } from "../db/database";
-import { canCancelOrder } from "./order-status";
 import { appendAuditEvent, findOrderDetail, updateOrderStatus } from "./order-repository";
 
 export async function cancelOrder(
@@ -17,7 +17,7 @@ export async function cancelOrder(
   }
 
   if (!canCancelOrder(order.status)) {
-    return { statusCode: 400, message: "Order cannot be cancelled for this order status." } as const;
+    return { statusCode: 400, message: orderCancellationBlockedMessage } as const;
   }
 
   const updatedAt = new Date().toISOString();

apps/api/src/orders/order-repository.ts

@@ -117,7 +117,14 @@ export async function findOrderItemRecord(context: DatabaseContext, orderId: str
     .leftJoin(inventory, eq(orderItems.productId, inventory.productId))
     .where(and(eq(orderItems.id, itemId), eq(orderItems.orderId, orderId)));
 
-  return row ?? null;
+  if (!row) {
+    return null;
+  }
+
+  return {
+    ...row,
+    order: { ...row.order, status: row.order.status as OrderDetail["status"] }
+  };
 }
 
 export async function updateOrderItemQuantity(context: DatabaseContext, itemId: string, quantity: number) {

apps/api/src/orders/order-status-rules-assignment-4.test.ts

@@ -0,0 +1,108 @@
+import { afterEach, beforeEach, describe, expect, test } from "bun:test";
+import type { AppWithContext } from "../app";
+import { buildApp } from "../app";
+import { createUser } from "../users/user-repository";
+
+let app: AppWithContext;
+let employeeCookie = "";
+
+function firstHeader(value: string | string[] | undefined) {
+  return Array.isArray(value) ? value[0] : value ?? "";
+}
+
+async function login(username: string) {
+  const response = await app.inject({ method: "POST", url: "/api/login", payload: { username } });
+  return firstHeader(response.headers["set-cookie"]);
+}
+
+beforeEach(async () => {
+  app = await buildApp(":memory:");
+
+  await createUser(app.dbContext, {
+    username: "dev-employee",
+    name: "Dev Employee",
+    email: "dev.employee@example.com",
+    role: "employee"
+  });
+
+  employeeCookie = await login("dev-employee");
+});
+
+afterEach(async () => {
+  await app.close();
+});
+
+describe("assignment 4 order lifecycle rules", () => {
+  test("keeps quantity editing blocked for processing orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_2/items/item_3/quantity",
+      headers: { cookie: employeeCookie },
+      payload: { quantity: 2 }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("allows address editing for processing orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_2/shipping-address",
+      headers: { cookie: employeeCookie },
+      payload: {
+        fullName: "Jane Doe",
+        line1: "50 New Street",
+        line2: null,
+        city: "Oakland",
+        state: "CA",
+        postalCode: "94607",
+        country: "US"
+      }
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().shippingAddress.city).toBe("Oakland");
+  });
+
+  test("allows cancellation for processing orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_2/cancel",
+      headers: { cookie: employeeCookie },
+      payload: { reason: "Customer request" }
+    });
+
+    expect(response.statusCode).toBe(200);
+    expect(response.json().status).toBe("cancelled");
+  });
+
+  test("blocks address editing for shipped orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_3/shipping-address",
+      headers: { cookie: employeeCookie },
+      payload: {
+        fullName: "John Smith",
+        line1: "77 Final Mile Road",
+        line2: null,
+        city: "Denver",
+        state: "CO",
+        postalCode: "80202",
+        country: "US"
+      }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+
+  test("blocks cancellation for shipped orders", async () => {
+    const response = await app.inject({
+      method: "POST",
+      url: "/api/orders/order_3/cancel",
+      headers: { cookie: employeeCookie },
+      payload: { reason: "Late request" }
+    });
+
+    expect(response.statusCode).toBe(400);
+  });
+});

apps/api/src/orders/order-status.ts

@@ -1,11 +0,0 @@
-import type { OrderStatus } from "@orderops/shared/order-status";
-
-export { canEditOrderItems } from "@orderops/shared/order-status";
-
-export function canEditShippingAddress(status: OrderStatus) {
-  return status === "pending" || status === "processing";
-}
-
-export function canCancelOrder(status: OrderStatus) {
-  return status === "pending" || status === "processing";
-}

apps/api/src/orders/update-order-item.ts

@@ -1,5 +1,5 @@
+import { canEditOrderItems, orderItemsLockedMessage } from "@orderops/shared/order-status";
 import type { DatabaseContext } from "../db/database";
-import { canEditOrderItems } from "./order-status";
 import { appendAuditEvent, findOrderDetail, findOrderItemRecord, updateOrderItemQuantity, updateOrderNotes as saveOrderNotes, updateOrderTimestamp } from "./order-repository";
 
 export async function changeOrderItemQuantity(
@@ -17,8 +17,8 @@ export async function changeOrderItemQuantity(
     return { statusCode: 404, message: "Order item not found." } as const;
   }
 
-  if (!canEditOrderItems(row.order.status as never)) {
-    return { statusCode: 400, message: "Order items cannot be changed for this order status." } as const;
+  if (!canEditOrderItems(row.order.status)) {
+    return { statusCode: 400, message: orderItemsLockedMessage } as const;
   }
 
   if (input.quantity < 1 || input.quantity > 10) {

apps/api/src/orders/update-shipping-address.ts

@@ -1,6 +1,6 @@
 import type { Address } from "@orderops/shared/address";
+import { canEditShippingAddress, shippingAddressLockedMessage } from "@orderops/shared/order-status";
 import type { DatabaseContext } from "../db/database";
-import { canEditShippingAddress } from "./order-status";
 import { appendAuditEvent, findOrderDetail, updateOrderAddress, updateOrderTimestamp } from "./order-repository";
 
 export async function changeShippingAddress(
@@ -18,7 +18,7 @@ export async function changeShippingAddress(
   }
 
   if (!canEditShippingAddress(order.status)) {
-    return { statusCode: 400, message: "Shipping address cannot be changed for this order status." } as const;
+    return { statusCode: 400, message: shippingAddressLockedMessage } as const;
   }
 
   const updatedAt = new Date().toISOString();

apps/web/src/orders/order-items-panel.tsx

@@ -1,5 +1,5 @@
 import { useState } from "react";
-import { canEditOrderItems, type OrderDetail } from "@orderops/shared";
+import type { OrderDetail } from "@orderops/shared";
 
 interface OrderItemsPanelProps {
   order: OrderDetail;
@@ -9,12 +9,10 @@ interface OrderItemsPanelProps {
 function QuantityForm({
   itemId,
   quantity,
-  isEditable,
   onSave
 }: {
   itemId: string;
   quantity: number;
-  isEditable: boolean;
   onSave: (itemId: string, quantity: number) => Promise<void>;
 }) {
   const [value, setValue] = useState(String(quantity));
@@ -28,17 +26,12 @@ function QuantityForm({
       }}
     >
       <input
-        className="w-16 rounded-md border border-slate-300 px-2 py-1 text-sm disabled:bg-slate-100 disabled:text-slate-500"
-        disabled={!isEditable}
+        className="w-16 rounded-md border border-slate-300 px-2 py-1 text-sm"
         inputMode="numeric"
         value={value}
         onChange={(event) => setValue(event.target.value)}
       />
-      <button
-        className="rounded-md bg-blue-600 px-3 py-1 text-sm font-medium text-white disabled:cursor-not-allowed disabled:bg-slate-300"
-        disabled={!isEditable}
-        type="submit"
-      >
+      <button className="rounded-md bg-blue-600 px-3 py-1 text-sm font-medium text-white" type="submit">
         Save
       </button>
     </form>
@@ -46,12 +39,9 @@ function QuantityForm({
 }
 
 export function OrderItemsPanel({ order, onUpdateQuantity }: OrderItemsPanelProps) {
-  const isEditable = canEditOrderItems(order.status);
-
   return (
     <section className="rounded-xl border border-slate-200 bg-white p-4 shadow-sm">
       <h3 className="mb-3 text-sm font-semibold text-slate-700">Items</h3>
-      {isEditable ? null : <p className="mb-3 text-sm text-slate-500">Quantities can only be changed while the order is pending.</p>}
       <div className="space-y-3">
         {order.items.map((item) => (
           <div key={item.id} className="rounded-lg border border-slate-200 p-3">
@@ -61,7 +51,7 @@ export function OrderItemsPanel({ order, onUpdateQuantity }: OrderItemsPanelProp
                 <div className="text-sm text-slate-600">{item.sku}</div>
                 <div className="text-sm text-slate-500">Available: {item.availableQuantity}</div>
               </div>
-              <QuantityForm itemId={item.id} quantity={item.quantity} isEditable={isEditable} onSave={onUpdateQuantity} />
+              <QuantityForm itemId={item.id} quantity={item.quantity} onSave={onUpdateQuantity} />
             </div>
           </div>
         ))}

apps/web/src/orders/order-page.tsx

@@ -1,5 +1,5 @@
 import { useEffect, useState } from "react";
-import type { Address, AuditEvent, OrderDetail } from "@orderops/shared";
+import { canEditOrderItems, orderItemsLockedMessage, type Address, type AuditEvent, type OrderDetail } from "@orderops/shared";
 import { Link, useParams } from "react-router-dom";
 import { Toast } from "../ui/toast";
 import { cancelOrder, getOrder, listAuditEvents, updateOrderItemQuantity, updateOrderNotes, updateShippingAddress } from "./order-api";
@@ -72,6 +72,19 @@ export function OrderPage() {
     }
   }
 
+  async function handleUpdateQuantity(itemId: string, quantity: number) {
+    if (!order) {
+      return;
+    }
+
+    if (!canEditOrderItems(order.status)) {
+      setToast({ message: orderItemsLockedMessage, variant: "error" });
+      return;
+    }
+
+    await runAction(() => updateOrderItemQuantity(order.id, itemId, quantity), "Quantity saved.");
+  }
+
   return (
     <div className="space-y-4">
       <Link className="inline-flex text-sm font-medium text-blue-600 hover:text-blue-700" to="/orders">
@@ -84,7 +97,7 @@ export function OrderPage() {
         <OrderDetailPage
           order={order}
           auditEvents={auditEvents}
-          onUpdateQuantity={(itemId, quantity) => runAction(() => updateOrderItemQuantity(order.id, itemId, quantity), "Quantity saved.")}
+          onUpdateQuantity={handleUpdateQuantity}
           onSaveAddress={(address: Address) => runAction(() => updateShippingAddress(order.id, address), "Shipping address saved.")}
           onSaveNotes={(notes) => runAction(() => updateOrderNotes(order.id, notes), "Notes saved.")}
           onCancel={() => runAction(() => cancelOrder(order.id), "Order cancelled.")}

packages/shared/src/order-status.ts

@@ -2,8 +2,22 @@ export const orderStatuses = ["pending", "processing", "shipped", "cancelled", "
 
 export type OrderStatus = (typeof orderStatuses)[number];
 
-// Item quantities can only be adjusted before fulfillment starts. Shared so the UI
-// matches the API rule; the API stays the authoritative check.
+const orderItemsEditableStatuses: readonly OrderStatus[] = ["pending"];
+const shippingAddressEditableStatuses: readonly OrderStatus[] = ["pending", "processing"];
+const orderCancellableStatuses: readonly OrderStatus[] = ["pending", "processing"];
+
+export const orderItemsLockedMessage = "Order items cannot be changed for this order status.";
+export const shippingAddressLockedMessage = "Shipping address cannot be changed for this order status.";
+export const orderCancellationBlockedMessage = "Order cannot be cancelled for this order status.";
+
 export function canEditOrderItems(status: OrderStatus) {
-  return status === "pending";
+  return orderItemsEditableStatuses.includes(status);
+}
+
+export function canEditShippingAddress(status: OrderStatus) {
+  return shippingAddressEditableStatuses.includes(status);
+}
+
+export function canCancelOrder(status: OrderStatus) {
+  return orderCancellableStatuses.includes(status);
 }