u

src/api/auth/meJson.js

@@ -1,5 +1,5 @@
 import env from '../../config/env.js';
 
-export function meJson(res, status, body) {
+export function respondWithAuthenticatedUser(res, status, body) {
     return res.status(status).json({ ...body, googleClientId: env.googleClientId });
 }

src/api/openapi.js

@@ -1096,6 +1096,67 @@
  *           description: Tool response content payload
  *         answer:
  *           description: Shorthand answer for ask_user response
+ *     Account:
+ *       type: object
+ *       required: [id, companyId, type, name]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         companyId:
+ *           type: integer
+ *         type:
+ *           type: string
+ *         name:
+ *           type: string
+ *     Payment:
+ *       type: object
+ *       required: [id, accountId, manifestId, type, amount]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         accountId:
+ *           type: integer
+ *         manifestId:
+ *           type: integer
+ *         type:
+ *           type: string
+ *         amount:
+ *           type: number
+ *     Shipping:
+ *       type: object
+ *       required: [id, manifestId, number, type, state]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         manifestId:
+ *           type: integer
+ *         number:
+ *           type: string
+ *           description: Shipping number from the `shipping` number sequence
+ *         type:
+ *           type: string
+ *         state:
+ *           type: string
+ *     Package:
+ *       type: object
+ *       required: [id, shippingId, entityaddressId, number, type, state]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         shippingId:
+ *           type: integer
+ *         entityaddressId:
+ *           type: integer
+ *         number:
+ *           type: string
+ *           description: Package number from the `package` number sequence
+ *         type:
+ *           type: string
+ *         state:
+ *           type: string
+ *         details:
+ *           type: string
+ *           nullable: true
  *     Printer:
  *       type: object
  *       required: [id, company_id, address, type, sort]

src/api/routes/account.js

@@ -0,0 +1,213 @@
+import * as db from '../../db/account.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(value, field) {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function accountErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message?.endsWith(' not found')) return 404;
+    if (error.message?.endsWith(' required')) return 400;
+    return 500;
+}
+
+/**
+ * Registers account routes for the authenticated user's selected company.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /account:
+     *   get:
+     *     tags: [Account]
+     *     summary: List accounts
+     *     description: Lists payment accounts for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     responses:
+     *       200:
+     *         description: List of accounts
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 accounts:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Account'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/account`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const accounts = await db.list(req.user.id);
+            res.status(200).json({ accounts });
+        } catch (error) {
+            const status = accountErrorStatus(error);
+            if (status === 500) console.error('List accounts failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /account:
+     *   post:
+     *     tags: [Account]
+     *     summary: Create account
+     *     description: Creates a payment account for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [type, name]
+     *             properties:
+     *               type:
+     *                 type: string
+     *               name:
+     *                 type: string
+     *     responses:
+     *       201:
+     *         description: Created account
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 account:
+     *                   $ref: '#/components/schemas/Account'
+     *       400:
+     *         description: Validation error or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.post(`${basePath}/account`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const account = await db.create(req.user.id, req.body ?? {});
+            res.status(201).json({ account });
+        } catch (error) {
+            const status = accountErrorStatus(error);
+            if (status === 500) console.error('Create account failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /account/{id}:
+     *   delete:
+     *     tags: [Account]
+     *     summary: Delete account
+     *     description: Deletes an account of the selected company. Its payments are removed as well.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Account ID
+     *     responses:
+     *       204:
+     *         description: Account deleted
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Account not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.delete(`${basePath}/account/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            await db.remove(req.user.id, parsedId.id);
+            res.status(204).end();
+        } catch (error) {
+            const status = accountErrorStatus(error);
+            if (status === 500) console.error('Delete account failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}

src/api/routes/package.js

@@ -0,0 +1,252 @@
+import * as db from '../../db/package.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(value, field) {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function packageErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message?.endsWith(' not found')) return 404;
+    if (error.message?.endsWith(' required')) return 400;
+    return 500;
+}
+
+/**
+ * Registers package routes (packages belong to a shipping and target an entity address).
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /shipping/{id}/package:
+     *   get:
+     *     tags: [Package]
+     *     summary: List packages of a shipping
+     *     description: Lists packages of the shipping for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Shipping ID
+     *     responses:
+     *       200:
+     *         description: List of packages
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 packages:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Package'
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Shipping not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/shipping/:id/package`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const packages = await db.listByShippingId(req.user.id, parsedId.id);
+            res.status(200).json({ packages });
+        } catch (error) {
+            const status = packageErrorStatus(error);
+            if (status === 500) console.error('List packages failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /shipping/{id}/package:
+     *   post:
+     *     tags: [Package]
+     *     summary: Create package for a shipping
+     *     description: |
+     *       Creates a package for the shipping. The package number is allocated from the
+     *       `package` number sequence. `entityaddressId` is required (target address).
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Shipping ID
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [entityaddressId, type, state]
+     *             properties:
+     *               entityaddressId:
+     *                 type: integer
+     *               type:
+     *                 type: string
+     *               state:
+     *                 type: string
+     *               details:
+     *                 type: string
+     *     responses:
+     *       201:
+     *         description: Created package
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 package:
+     *                   $ref: '#/components/schemas/Package'
+     *       400:
+     *         description: Validation error or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Shipping or entity address not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.post(`${basePath}/shipping/:id/package`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const pkg = await db.create(req.user.id, {
+                ...(req.body ?? {}),
+                shippingId: parsedId.id,
+            });
+            res.status(201).json({ package: pkg });
+        } catch (error) {
+            const status = packageErrorStatus(error);
+            if (status === 500) console.error('Create package failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /package/{id}:
+     *   delete:
+     *     tags: [Package]
+     *     summary: Delete package
+     *     description: Deletes a package of the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Package ID
+     *     responses:
+     *       204:
+     *         description: Package deleted
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.delete(`${basePath}/package/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            await db.remove(req.user.id, parsedId.id);
+            res.status(204).end();
+        } catch (error) {
+            const status = packageErrorStatus(error);
+            if (status === 500) console.error('Delete package failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}

src/api/routes/payment.js

@@ -0,0 +1,249 @@
+import * as db from '../../db/payment.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(value, field) {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function paymentErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message?.endsWith(' not found')) return 404;
+    if (error.message?.endsWith(' required')) return 400;
+    if (error.message === 'Invalid payment amount') return 400;
+    return 500;
+}
+
+/**
+ * Registers payment routes (payments belong to an order / manifest).
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /order/{id}/payment:
+     *   get:
+     *     tags: [Payment]
+     *     summary: List payments of an order
+     *     description: Lists payments of the order (manifest) for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Order ID
+     *     responses:
+     *       200:
+     *         description: List of payments
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 payments:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Payment'
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/order/:id/payment`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const payments = await db.listByManifestId(req.user.id, parsedId.id);
+            res.status(200).json({ payments });
+        } catch (error) {
+            const status = paymentErrorStatus(error);
+            if (status === 500) console.error('List payments failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /order/{id}/payment:
+     *   post:
+     *     tags: [Payment]
+     *     summary: Add payment to an order
+     *     description: Adds a payment to the order using an account of the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Order ID
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [accountId, type, amount]
+     *             properties:
+     *               accountId:
+     *                 type: integer
+     *               type:
+     *                 type: string
+     *               amount:
+     *                 type: number
+     *     responses:
+     *       201:
+     *         description: Created payment
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 payment:
+     *                   $ref: '#/components/schemas/Payment'
+     *       400:
+     *         description: Validation error or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order or account not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.post(`${basePath}/order/:id/payment`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const payment = await db.create(req.user.id, {
+                ...(req.body ?? {}),
+                manifestId: parsedId.id,
+            });
+            res.status(201).json({ payment });
+        } catch (error) {
+            const status = paymentErrorStatus(error);
+            if (status === 500) console.error('Create payment failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /payment/{id}:
+     *   delete:
+     *     tags: [Payment]
+     *     summary: Delete payment
+     *     description: Deletes a payment of an order in the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Payment ID
+     *     responses:
+     *       204:
+     *         description: Payment deleted
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.delete(`${basePath}/payment/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            await db.remove(req.user.id, parsedId.id);
+            res.status(204).end();
+        } catch (error) {
+            const status = paymentErrorStatus(error);
+            if (status === 500) console.error('Delete payment failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}

src/api/routes/shipping.js

@@ -0,0 +1,248 @@
+import * as db from '../../db/shipping.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parsePositiveInt(value, field) {
+    const id = Number(value);
+    if (!Number.isInteger(id) || id <= 0) {
+        return { error: `${field} is required` };
+    }
+    return { id };
+}
+
+function shippingErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message?.endsWith(' not found')) return 404;
+    if (error.message?.endsWith(' required')) return 400;
+    return 500;
+}
+
+/**
+ * Registers shipping routes (shippings belong to an order / manifest).
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /order/{id}/shipping:
+     *   get:
+     *     tags: [Shipping]
+     *     summary: List shippings of an order
+     *     description: Lists shippings of the order (manifest) for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Order ID
+     *     responses:
+     *       200:
+     *         description: List of shippings
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 shippings:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Shipping'
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/order/:id/shipping`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const shippings = await db.listByManifestId(req.user.id, parsedId.id);
+            res.status(200).json({ shippings });
+        } catch (error) {
+            const status = shippingErrorStatus(error);
+            if (status === 500) console.error('List shippings failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /order/{id}/shipping:
+     *   post:
+     *     tags: [Shipping]
+     *     summary: Create shipping for an order
+     *     description: |
+     *       Creates a shipping for the order. The shipping number is allocated from the
+     *       `shipping` number sequence (prefix and counter from the numbers API).
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Order ID
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [type, state]
+     *             properties:
+     *               type:
+     *                 type: string
+     *               state:
+     *                 type: string
+     *     responses:
+     *       201:
+     *         description: Created shipping
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 shipping:
+     *                   $ref: '#/components/schemas/Shipping'
+     *       400:
+     *         description: Validation error or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.post(`${basePath}/order/:id/shipping`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            const shipping = await db.create(req.user.id, {
+                ...(req.body ?? {}),
+                manifestId: parsedId.id,
+            });
+            res.status(201).json({ shipping });
+        } catch (error) {
+            const status = shippingErrorStatus(error);
+            if (status === 500) console.error('Create shipping failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /shipping/{id}:
+     *   delete:
+     *     tags: [Shipping]
+     *     summary: Delete shipping
+     *     description: Deletes a shipping of the selected company. Its packages are removed as well.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Shipping ID
+     *     responses:
+     *       204:
+     *         description: Shipping deleted
+     *       400:
+     *         description: Invalid ID or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.delete(`${basePath}/shipping/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const parsedId = parsePositiveInt(req.params.id, 'id');
+        if (parsedId.error) {
+            return res.status(400).json({ error: parsedId.error });
+        }
+
+        try {
+            await db.remove(req.user.id, parsedId.id);
+            res.status(204).end();
+        } catch (error) {
+            const status = shippingErrorStatus(error);
+            if (status === 500) console.error('Delete shipping failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}

src/db/account.js

@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function list(googleAuthId) {
+    const store = await getStore();
+    return store.account.list(googleAuthId);
+}
+
+export async function create(googleAuthId, data) {
+    const store = await getStore();
+    return store.account.create(googleAuthId, data);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.account.delete(googleAuthId, id);
+}

src/db/package.js

@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function listByShippingId(googleAuthId, shippingId) {
+    const store = await getStore();
+    return store.package.listByShippingId(googleAuthId, shippingId);
+}
+
+export async function create(googleAuthId, data) {
+    const store = await getStore();
+    return store.package.create(googleAuthId, data);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.package.delete(googleAuthId, id);
+}

src/db/payment.js

@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function listByManifestId(googleAuthId, manifestId) {
+    const store = await getStore();
+    return store.payment.listByManifestId(googleAuthId, manifestId);
+}
+
+export async function create(googleAuthId, data) {
+    const store = await getStore();
+    return store.payment.create(googleAuthId, data);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.payment.delete(googleAuthId, id);
+}

src/db/shipping.js

@@ -0,0 +1,16 @@
+import { getStore } from './store.js';
+
+export async function listByManifestId(googleAuthId, manifestId) {
+    const store = await getStore();
+    return store.shipping.listByManifestId(googleAuthId, manifestId);
+}
+
+export async function create(googleAuthId, data) {
+    const store = await getStore();
+    return store.shipping.create(googleAuthId, data);
+}
+
+export async function remove(googleAuthId, id) {
+    const store = await getStore();
+    return store.shipping.delete(googleAuthId, id);
+}

src/db/store.js

@@ -48,6 +48,10 @@ const STORE_NAMESPACES = [
     'categoryattributevalue',
     'modelconversation',
     'modelmessage',
+    'account',
+    'payment',
+    'shipping',
+    'package',
 ];
 
 /**