u

src/api/openapi.js

@@ -910,6 +910,80 @@
  *           type: array
  *           items:
  *             $ref: '#/components/schemas/LedgerEntry'
+ *     Propertyname:
+ *       type: object
+ *       required: [id, name, sort]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         name:
+ *           type: string
+ *         sort:
+ *           type: integer
+ *     ArticleProperty:
+ *       type: object
+ *       required: [id, propertyId, name, value, sort]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         articleId:
+ *           type: integer
+ *         propertyId:
+ *           type: integer
+ *         name:
+ *           type: string
+ *         value:
+ *           type: string
+ *         sort:
+ *           type: integer
+ *     AttributeValue:
+ *       type: object
+ *       required: [id, attributeId, value, sort]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         attributeId:
+ *           type: integer
+ *         value:
+ *           type: string
+ *         sort:
+ *           type: integer
+ *     Attributename:
+ *       type: object
+ *       required: [id, name, sort, exclusive, values]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         name:
+ *           type: string
+ *         sort:
+ *           type: integer
+ *         exclusive:
+ *           type: boolean
+ *         values:
+ *           type: array
+ *           items:
+ *             $ref: '#/components/schemas/AttributeValue'
+ *     ArticleAttributeValue:
+ *       type: object
+ *       required: [id, attributeId, attributeName, attributeValueId, value, sort]
+ *       properties:
+ *         id:
+ *           type: integer
+ *         articleId:
+ *           type: integer
+ *         attributeId:
+ *           type: integer
+ *         attributeName:
+ *           type: string
+ *         exclusive:
+ *           type: boolean
+ *         attributeValueId:
+ *           type: integer
+ *         value:
+ *           type: string
+ *         sort:
+ *           type: integer
  */
 
 export {};

src/api/routes/articleattributevalue.js

@@ -0,0 +1,157 @@
+import * as db from '../../db/articleattributevalue.js';
+import { emit } from '../sse.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parseSku(value) {
+    const sku = typeof value === 'string' ? value.trim() : '';
+    if (!sku) return { error: 'sku is required' };
+    return { sku: decodeURIComponent(sku) };
+}
+
+function emitArticleSignal(req, sku) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) return;
+    emit(`article-${sku}`, { companyId });
+}
+
+function articleAttributeValueErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found' || error.message === 'Article not found') return 404;
+    if (error.message?.startsWith('Attribute value not found')) return 404;
+    if (error.message?.includes('exclusive')) return 400;
+    if (error.message === 'Invalid attribute values array' || error.message === 'Invalid attributeValueId' || error.message === 'Duplicate attributeValueId') return 400;
+    return 500;
+}
+
+/**
+ * Registers articleattributevalue routes under `/article/:sku/attributevalue`.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /article/{sku}/attributevalue:
+     *   get:
+     *     tags: [Article]
+     *     summary: List article attribute values
+     *     description: Fetches all attribute values assigned to an article.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *         description: Article SKU
+     *     responses:
+     *       200:
+     *         description: List of attribute values assigned to this article
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalues:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/ArticleAttributeValue'
+     *   put:
+     *     tags: [Article]
+     *     summary: Bulk set article attribute values
+     *     description: Replaces all attribute values for an article. Enforces exclusive constraint (max one value per exclusive attribute).
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *         description: Article SKU
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [attributevalues]
+     *             properties:
+     *               attributevalues:
+     *                 type: array
+     *                 items:
+     *                   oneOf:
+     *                     - type: integer
+     *                     - type: object
+     *                       required: [attributeValueId]
+     *                       properties:
+     *                         attributeValueId:
+     *                           type: integer
+     *                         sort:
+     *                           type: integer
+     *     responses:
+     *       200:
+     *         description: Updated article attribute values
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalues:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/ArticleAttributeValue'
+     */
+    app.get(`${basePath}/article/:sku/attributevalue`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        try {
+            const attributevalues = await db.listByArticleSku(req.user.id, skuParsed.sku);
+            res.json({ attributevalues });
+        } catch (error) {
+            res.status(articleAttributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.put(`${basePath}/article/:sku/attributevalue`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        const valuesInput = req.body?.attributevalues ?? req.body;
+        if (!Array.isArray(valuesInput)) {
+            return res.status(400).json({ error: 'attributevalues array required' });
+        }
+
+        try {
+            const attributevalues = await db.setByArticleSku(req.user.id, skuParsed.sku, valuesInput);
+            emitArticleSignal(req, skuParsed.sku);
+            res.json({ attributevalues });
+        } catch (error) {
+            res.status(articleAttributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+}

src/api/routes/articleproperty.js

@@ -0,0 +1,201 @@
+import * as db from '../../db/articleproperty.js';
+import { emit } from '../sse.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function parseSku(value) {
+    const sku = typeof value === 'string' ? value.trim() : '';
+    if (!sku) return { error: 'sku is required' };
+    return { sku: decodeURIComponent(sku) };
+}
+
+function emitArticleSignal(req, sku) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) return;
+    emit(`article-${sku}`, { companyId });
+}
+
+function articlePropertyErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found' || error.message === 'Article not found') return 404;
+    if (error.message?.startsWith('Property not found')) return 404;
+    if (error.message === 'Invalid properties array' || error.message === 'Invalid propertyId' || error.message === 'Duplicate propertyId') return 400;
+    return 500;
+}
+
+/**
+ * Registers articleproperty routes under `/article/:sku/property`.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /article/{sku}/property:
+     *   get:
+     *     tags: [Article]
+     *     summary: List article properties
+     *     description: Fetches all free-form properties set on an article.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *         description: Article SKU
+     *     responses:
+     *       200:
+     *         description: List of properties for this article
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 properties:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/ArticleProperty'
+     *   put:
+     *     tags: [Article]
+     *     summary: Bulk set article properties
+     *     description: Replaces all properties for an article.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *         description: Article SKU
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [properties]
+     *             properties:
+     *               properties:
+     *                 type: array
+     *                 items:
+     *                   type: object
+     *                   required: [propertyId, value]
+     *                   properties:
+     *                     propertyId:
+     *                       type: integer
+     *                     value:
+     *                       type: string
+     *                     sort:
+     *                       type: integer
+     *     responses:
+     *       200:
+     *         description: Updated article properties
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 properties:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/ArticleProperty'
+     */
+    app.get(`${basePath}/article/:sku/property`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        try {
+            const properties = await db.listByArticleSku(req.user.id, skuParsed.sku);
+            res.json({ properties });
+        } catch (error) {
+            res.status(articlePropertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.put(`${basePath}/article/:sku/property`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        const propertiesInput = req.body?.properties ?? req.body;
+        if (!Array.isArray(propertiesInput)) {
+            return res.status(400).json({ error: 'properties array required' });
+        }
+
+        try {
+            const properties = await db.setByArticleSku(req.user.id, skuParsed.sku, propertiesInput);
+            emitArticleSignal(req, skuParsed.sku);
+            res.json({ properties });
+        } catch (error) {
+            res.status(articlePropertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /article/{sku}/property/{propertyId}:
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete article property
+     *     description: Removes a single property from an article.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: sku
+     *         required: true
+     *         schema:
+     *           type: string
+     *       - in: path
+     *         name: propertyId
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Deleted successfully
+     */
+    app.delete(`${basePath}/article/:sku/property/:propertyId`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const skuParsed = parseSku(req.params.sku);
+        if (skuParsed.error) {
+            return res.status(400).json({ error: skuParsed.error });
+        }
+
+        try {
+            const propertyId = Number(req.params.propertyId);
+            await db.remove(req.user.id, skuParsed.sku, propertyId);
+            emitArticleSignal(req, skuParsed.sku);
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(articlePropertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+}

src/api/routes/attributename.js

@@ -0,0 +1,235 @@
+import * as db from '../../db/attributename.js';
+import { emit } from '../sse.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function attributeErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Attribute name not found') return 404;
+    if (error.message === 'Name required') return 400;
+    if (error.message === 'Invalid attribute name order') return 400;
+    if (error.message === 'Invalid id') return 400;
+    return 500;
+}
+
+/**
+ * Registers attributename routes.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /attributename:
+     *   get:
+     *     tags: [Article]
+     *     summary: List attribute names
+     *     description: Lists all attribute names defined for the selected company, including nested values.
+     *     security:
+     *       - cookieAuth: []
+     *     responses:
+     *       200:
+     *         description: List of attribute names
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributenames:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Attributename'
+     *   post:
+     *     tags: [Article]
+     *     summary: Create attribute name
+     *     description: Creates an attribute name for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [name]
+     *             properties:
+     *               name:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *               exclusive:
+     *                 type: boolean
+     *     responses:
+     *       201:
+     *         description: Created attribute name
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributename:
+     *                   $ref: '#/components/schemas/Attributename'
+     */
+    app.get(`${basePath}/attributename`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const attributenames = await db.list(req.user.id);
+            res.json({ attributenames });
+        } catch (error) {
+            res.status(attributeErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.post(`${basePath}/attributename`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const attributename = await db.create(req.user.id, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.status(201).json({ attributename });
+        } catch (error) {
+            res.status(attributeErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /attributename/order:
+     *   put:
+     *     tags: [Article]
+     *     summary: Reorder attribute names
+     *     description: Updates the display sort order of attribute names for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [attributenameIds]
+     *             properties:
+     *               attributenameIds:
+     *                 type: array
+     *                 items:
+     *                   type: integer
+     *     responses:
+     *       200:
+     *         description: Reordered successfully
+     */
+    app.put(`${basePath}/attributename/order`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            await db.order(req.user.id, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(attributeErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /attributename/{id}:
+     *   patch:
+     *     tags: [Article]
+     *     summary: Update attribute name
+     *     description: Updates name, sort, and/or exclusive flag for an attribute name.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             properties:
+     *               name:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *               exclusive:
+     *                 type: boolean
+     *     responses:
+     *       200:
+     *         description: Updated attribute name
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributename:
+     *                   $ref: '#/components/schemas/Attributename'
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete attribute name
+     *     description: Deletes an attribute name and cascades to attribute values and article assignments.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Deleted successfully
+     */
+    app.patch(`${basePath}/attributename/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            const attributename = await db.update(req.user.id, id, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ attributename });
+        } catch (error) {
+            res.status(attributeErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.delete(`${basePath}/attributename/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            await db.remove(req.user.id, id);
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(attributeErrorStatus(error)).json({ error: error.message });
+        }
+    });
+}

src/api/routes/attributevalue.js

@@ -0,0 +1,251 @@
+import * as db from '../../db/attributevalue.js';
+import { emit } from '../sse.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function attributeValueErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found' || error.message === 'Attribute name not found' || error.message === 'Attribute value not found') return 404;
+    if (error.message === 'Value required') return 400;
+    if (error.message === 'Invalid attribute value order') return 400;
+    if (error.message === 'Invalid id' || error.message === 'Invalid attributeId') return 400;
+    return 500;
+}
+
+/**
+ * Registers attributevalue routes under `/attributename/:attributeId/value` and `/attributevalue/:id`.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /attributename/{attributeId}/value:
+     *   get:
+     *     tags: [Article]
+     *     summary: List values for an attribute
+     *     description: Lists all values for a specific attribute.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: attributeId
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: List of attribute values
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 values:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/AttributeValue'
+     *   post:
+     *     tags: [Article]
+     *     summary: Create value for an attribute
+     *     description: Adds a new predefined value to an attribute.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: attributeId
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [value]
+     *             properties:
+     *               value:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *     responses:
+     *       201:
+     *         description: Created attribute value
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalue:
+     *                   $ref: '#/components/schemas/AttributeValue'
+     */
+    app.get(`${basePath}/attributename/:attributeId/value`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const attributeId = Number(req.params.attributeId);
+            const values = await db.listByAttributeId(req.user.id, attributeId);
+            res.json({ values });
+        } catch (error) {
+            res.status(attributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.post(`${basePath}/attributename/:attributeId/value`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const attributeId = Number(req.params.attributeId);
+            const attributevalue = await db.create(req.user.id, attributeId, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.status(201).json({ attributevalue });
+        } catch (error) {
+            res.status(attributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /attributename/{attributeId}/value/order:
+     *   put:
+     *     tags: [Article]
+     *     summary: Reorder values of an attribute
+     *     description: Updates the display sort order of values belonging to an attribute.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: attributeId
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [attributevalueIds]
+     *             properties:
+     *               attributevalueIds:
+     *                 type: array
+     *                 items:
+     *                   type: integer
+     *     responses:
+     *       200:
+     *         description: Reordered successfully
+     */
+    app.put(`${basePath}/attributename/:attributeId/value/order`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const attributeId = Number(req.params.attributeId);
+            await db.order(req.user.id, attributeId, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(attributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /attributevalue/{id}:
+     *   patch:
+     *     tags: [Article]
+     *     summary: Update attribute value
+     *     description: Updates value text and/or sort for an attribute value.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             properties:
+     *               value:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *     responses:
+     *       200:
+     *         description: Updated attribute value
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalue:
+     *                   $ref: '#/components/schemas/AttributeValue'
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete attribute value
+     *     description: Deletes an attribute value and cascades to article assignments.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Deleted successfully
+     */
+    app.patch(`${basePath}/attributevalue/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            const attributevalue = await db.update(req.user.id, id, req.body ?? {});
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ attributevalue });
+        } catch (error) {
+            res.status(attributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.delete(`${basePath}/attributevalue/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            await db.remove(req.user.id, id);
+            emit('attributename', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(attributeValueErrorStatus(error)).json({ error: error.message });
+        }
+    });
+}

src/api/routes/propertyname.js

@@ -0,0 +1,245 @@
+import * as db from '../../db/propertyname.js';
+import { emit } from '../sse.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function propertyErrorStatus(error) {
+    if (error.message === 'No company selected') return 400;
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Property name not found') return 404;
+    if (error.message === 'Name required') return 400;
+    if (error.message === 'Invalid property name order') return 400;
+    if (error.message === 'Invalid id') return 400;
+    return 500;
+}
+
+/**
+ * Registers propertyname routes.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /propertyname:
+     *   get:
+     *     tags: [Article]
+     *     summary: List property names
+     *     description: Lists all property names defined for the selected company, ordered by sort.
+     *     security:
+     *       - cookieAuth: []
+     *     responses:
+     *       200:
+     *         description: List of property names
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 propertynames:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/Propertyname'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   post:
+     *     tags: [Article]
+     *     summary: Create property name
+     *     description: Creates a new property name for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [name]
+     *             properties:
+     *               name:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *     responses:
+     *       201:
+     *         description: Created property name
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 propertyname:
+     *                   $ref: '#/components/schemas/Propertyname'
+     *       400:
+     *         description: Bad request
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/propertyname`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const propertynames = await db.list(req.user.id);
+            res.json({ propertynames });
+        } catch (error) {
+            res.status(propertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.post(`${basePath}/propertyname`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const propertyname = await db.create(req.user.id, req.body ?? {});
+            emit('propertyname', { companyId: selected.companyId });
+            res.status(201).json({ propertyname });
+        } catch (error) {
+            res.status(propertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /propertyname/order:
+     *   put:
+     *     tags: [Article]
+     *     summary: Reorder property names
+     *     description: Updates the display sort order of property names for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [propertynameIds]
+     *             properties:
+     *               propertynameIds:
+     *                 type: array
+     *                 items:
+     *                   type: integer
+     *     responses:
+     *       200:
+     *         description: Reordered successfully
+     *       400:
+     *         description: Bad request
+     */
+    app.put(`${basePath}/propertyname/order`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            await db.order(req.user.id, req.body ?? {});
+            emit('propertyname', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(propertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /propertyname/{id}:
+     *   patch:
+     *     tags: [Article]
+     *     summary: Update property name
+     *     description: Updates name and/or sort for a property name.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             properties:
+     *               name:
+     *                 type: string
+     *               sort:
+     *                 type: integer
+     *     responses:
+     *       200:
+     *         description: Updated property name
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 propertyname:
+     *                   $ref: '#/components/schemas/Propertyname'
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete property name
+     *     description: Deletes a property name and cascades to article properties.
+     *     security:
+     *       - cookieAuth: []
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Deleted successfully
+     */
+    app.patch(`${basePath}/propertyname/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            const propertyname = await db.update(req.user.id, id, req.body ?? {});
+            emit('propertyname', { companyId: selected.companyId });
+            res.json({ propertyname });
+        } catch (error) {
+            res.status(propertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+
+    app.delete(`${basePath}/propertyname/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const id = Number(req.params.id);
+            await db.remove(req.user.id, id);
+            emit('propertyname', { companyId: selected.companyId });
+            res.json({ ok: true });
+        } catch (error) {
+            res.status(propertyErrorStatus(error)).json({ error: error.message });
+        }
+    });
+}