u

src/api/index.js

@@ -74,7 +74,7 @@ function corsMiddleware(req, res, next) {
     if (req.path.startsWith('/api/public') || req.path.startsWith('/public')) {
         res.setHeader('Access-Control-Allow-Origin', origin || '*');
         res.setHeader('Access-Control-Allow-Headers', 'Content-Type, Authorization');
-        res.setHeader('Access-Control-Allow-Methods', 'GET,OPTIONS');
+        res.setHeader('Access-Control-Allow-Methods', 'GET,POST,OPTIONS');
         if (req.method === 'OPTIONS') {
             return res.sendStatus(204);
         }

src/api/openapiSpec.js

@@ -47,6 +47,7 @@ export const openApiOptions = {
             { name: 'Serper', description: 'Serper Google image search and thumbnail streaming' },
             { name: 'PublicCatalog', description: 'Public product catalog API' },
             { name: 'Vfs', description: 'Virtual filesystem file management and preview' },
+            { name: 'Telemetry', description: 'Telemetry and crash reporting' },
         ],
     },
     apis: [

src/api/routes/category.js

@@ -14,6 +14,13 @@ function emitCategorySignal(req) {
     emit('category', { companyId });
 }
 
+/** Notify SSE subscribers of the actor's selected company after an article change. */
+function emitArticlesSignal(req) {
+    const companyId = req.user?.selectedCompanyId;
+    if (companyId == null) return;
+    emit('articles', { companyId });
+}
+
 function parsePositiveInt(value, field) {
     const id = Number(value);
     if (!Number.isInteger(id) || id <= 0) {
@@ -453,10 +460,10 @@ export function register(app, basePath = '') {
      *   delete:
      *     tags: [Category]
      *     summary: Delete category
-     *     description: Deletes a category the user is authorized for (not the company root).
+     *     description: Deletes a category the user is authorized for (not the company root). When recursive=true, recursively deletes all child categories, unassigns POS terminals, and deletes articles that only exist in the deleted subtree (including their children).
      *     security:
      *       - cookieAuth: []
-     *     x-signals: [category]
+     *     x-signals: [category, articles]
      *     x-markdown: category/delete.md
      *     parameters:
      *       - in: path
@@ -465,6 +472,12 @@ export function register(app, basePath = '') {
      *         schema:
      *           type: integer
      *         description: Category id
+     *       - in: query
+     *         name: recursive
+     *         required: false
+     *         schema:
+     *           type: boolean
+     *         description: When true, recursively deletes the category subtree and articles that only exist within it.
      *     responses:
      *       204:
      *         description: Deleted
@@ -504,13 +517,18 @@ export function register(app, basePath = '') {
         if (parsed.error) {
             return res.status(400).json({ error: parsed.error });
         }
+        const recursive = req.query.recursive === 'true';
 
         try {
             await db.deleteCategory({
                 googleAuthId: req.user.id,
                 id: parsed.id,
+                recursive,
             });
             emitCategorySignal(req);
+            if (recursive) {
+                emitArticlesSignal(req);
+            }
             res.sendStatus(204);
         } catch (error) {
             const status = categoryErrorStatus(error);

src/api/routes/telemetry.js

@@ -0,0 +1,109 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+const __filename = fileURLToPath(import.meta.url);
+const __dirname = path.dirname(__filename);
+const CRASH_DUMP_DIR = process.env.CRASH_DUMP_DIR || path.resolve(__dirname, '../../../logs/crash-dumps');
+
+function telemetryErrorStatus(error) {
+    if (error.message?.includes('required')) return 400;
+    return 500;
+}
+
+/**
+ * Registers public telemetry endpoints (no session/cookie auth required).
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /public/telemetry/crash:
+     *   post:
+     *     tags: [Telemetry]
+     *     summary: Receipt crash dump
+     *     description: Public endpoint to receive crash dumps. Saves the content parameter to a file named with the epoch millisecond.
+     *     security: []
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required:
+     *               - content
+     *             properties:
+     *               content:
+     *                 description: Crash dump content to store
+     *                 oneOf:
+     *                   - type: string
+     *                   - type: object
+     *     responses:
+     *       200:
+     *         description: Crash dump saved
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 ok:
+     *                   type: boolean
+     *                   example: true
+     *                 filename:
+     *                   type: string
+     *                   example: "1728395535123"
+     *       400:
+     *         description: Missing content parameter
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 error:
+     *                   type: string
+     *                   example: content is required
+     *       500:
+     *         description: Storage failure
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 error:
+     *                   type: string
+     */
+    const routePaths = [`${basePath}/public/telemetry/crash`];
+    if (basePath && !routePaths.includes('/public/telemetry/crash')) {
+        routePaths.push('/public/telemetry/crash');
+    }
+
+    app.post(routePaths, async (req, res) => {
+        try {
+            const { content } = req.body || {};
+            if (content === undefined || content === null) {
+                return res.status(400).json({ error: 'content is required' });
+            }
+
+            await fs.promises.mkdir(CRASH_DUMP_DIR, { recursive: true });
+
+            let ts = Date.now();
+            let filePath = path.join(CRASH_DUMP_DIR, String(ts));
+            while (fs.existsSync(filePath)) {
+                ts++;
+                filePath = path.join(CRASH_DUMP_DIR, String(ts));
+            }
+
+            const data = typeof content === 'string' ? content : JSON.stringify(content, null, 2);
+            await fs.promises.writeFile(filePath, data, 'utf8');
+
+            res.status(200).json({ ok: true, filename: String(ts) });
+        } catch (error) {
+            const status = telemetryErrorStatus(error);
+            if (status === 500) {
+                console.error('Crash dump error:', error);
+            }
+            res.status(status).json({ error: error.message || 'Internal server error' });
+        }
+    });
+}

src/db/category.js

@@ -10,9 +10,9 @@ export async function createUnderParent({ googleAuthId, parentId, name }) {
     return store.category.createUnderParent({ googleAuthId, parentId, name });
 }
 
-export async function deleteCategory({ googleAuthId, id }) {
+export async function deleteCategory({ googleAuthId, id, recursive = false }) {
     const store = await getStore();
-    await store.category.delete({ googleAuthId, id });
+    await store.category.delete({ googleAuthId, id, recursive });
 }
 
 export async function getCategoryArticles(googleAuthId, categoryId) {