u

docs/api/README.md

@@ -80,6 +80,8 @@ Generated from `@openapi` annotations in [`src/api/routes/`](../../src/api/route
 | [`routes/attributename/_id.patch.md`](routes/attributename/_id.patch.md) | `PATCH /attributename/{id}` |
 | [`routes/attributevalue/_id.delete.md`](routes/attributevalue/_id.delete.md) | `DELETE /attributevalue/{id}` |
 | [`routes/attributevalue/_id.patch.md`](routes/attributevalue/_id.patch.md) | `PATCH /attributevalue/{id}` |
+| [`routes/attributevalue/_id/image.delete.md`](routes/attributevalue/_id/image.delete.md) | `DELETE /attributevalue/{id}/image` |
+| [`routes/attributevalue/_id/image.post.md`](routes/attributevalue/_id/image.post.md) | `POST /attributevalue/{id}/image` |
 | [`routes/auth/login.md`](routes/auth/login.md) | `POST /auth/login` |
 | [`routes/auth/logout.md`](routes/auth/logout.md) | `POST /auth/logout` |
 | [`routes/auth/me.md`](routes/auth/me.md) | `GET /auth/me` |
@@ -250,7 +252,7 @@ Clients subscribe via [`GET /events`](routes/events.md) (`text/event-stream`). A
 |--------|------------|
 | `article-<sku>` | `PUT /article/{sku}/brand`, `PUT /article/{sku}/categories`, `PUT /article/{sku}/eans`, `POST /article/{sku}/image`, `DELETE /article/{sku}/image/{fullHash}`, `PUT /article/{sku}/images/order`, `PUT /article/{sku}/prices`, `POST /article/{sku}/supplier`, `PUT /article/{sku}/supplier/order`, `DELETE /article/{sku}/supplier/{id}`, `PATCH /article/{sku}/supplier/{id}`, `PUT /article/{sku}/track_stock`, `PUT /article/{sku}/weight`, `POST /stock/adjust` |
 | `articles` | `POST /article`, `DELETE /article/{sku}`, `PATCH /article/{sku}`, `DELETE /category/{id}`, `POST /stock/adjust` |
-| `attributename` | `POST /attributename`, `PUT /attributename/order`, `DELETE /attributename/{id}`, `PATCH /attributename/{id}` |
+| `attributename` | `POST /attributename`, `PUT /attributename/order`, `DELETE /attributename/{id}`, `PATCH /attributename/{id}`, `DELETE /attributevalue/{id}/image`, `POST /attributevalue/{id}/image` |
 | `brand` | `POST /brand`, `DELETE /brand/{id}`, `PATCH /brand/{id}`, `DELETE /brand/{id}/image`, `POST /brand/{id}/image` |
 | `category` | `POST /category`, `PUT /category/order`, `DELETE /category/{id}`, `PATCH /category/{id}`, `DELETE /category/{id}/image`, `POST /category/{id}/image` |
 | `labeltemplate` | `POST /labeltemplate`, `DELETE /labeltemplate/{id}`, `PATCH /labeltemplate/{id}`, `PUT /labeltemplate/{id}` |

docs/api/routes-all.md

@@ -1,6 +1,6 @@
 # Dash API Routes Overview (All)
 
-Overview of all 207 API endpoints across all modules.
+Overview of all 209 API endpoints across all modules.
 
 ### Notation
 
@@ -213,6 +213,12 @@ _none_
 #### Update attribute value — `PATCH /attributevalue/{id}`
 - Params: `id: int, body: { value?: str, sort?: int }`
 - Returns: `200 { attributevalue: T38 }`
+#### Delete attribute value image — `DELETE /attributevalue/{id}/image`
+- Params: `id: int`
+- Returns: `200 { attributevalue: { id: int, thumbW: int|null, thumbH: int|null, thumbHash: str|null, pics: T36[] } }`
+#### Add or replace attribute value image — `POST /attributevalue/{id}/image`
+- Params: `id: int, image/avif`
+- Returns: `201 { attributevalue: { id: int, fullHash: str, thumbW: int, thumbH: int, thumbHash: str, pics: T36[] } }`
 
 ### Section: /auth
 

docs/api/routes.md

@@ -1,6 +1,6 @@
 # Dash API Routes Overview
 
-Overview of all 160 API endpoints across all modules.
+Overview of all 162 API endpoints across all modules.
 
 ### Notation
 
@@ -202,6 +202,12 @@ _none_
 #### Update attribute value — `PATCH /attributevalue/{id}`
 - Params: `id: int, body: { value?: str, sort?: int }`
 - Returns: `200 { attributevalue: T34 }`
+#### Delete attribute value image — `DELETE /attributevalue/{id}/image`
+- Params: `id: int`
+- Returns: `200 { attributevalue: { id: int, thumbW: int|null, thumbH: int|null, thumbHash: str|null, pics: T32[] } }`
+#### Add or replace attribute value image — `POST /attributevalue/{id}/image`
+- Params: `id: int, image/avif`
+- Returns: `201 { attributevalue: { id: int, fullHash: str, thumbW: int, thumbH: int, thumbHash: str, pics: T32[] } }`
 
 ### Section: /auth
 

docs/api/routes/attributevalue/_id/image.delete.md

@@ -0,0 +1,53 @@
+# `DELETE /attributevalue/{id}/image`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Delete attribute value image
+
+Removes the attribute value's image. Sets thumbW, thumbH, thumbHash back to null. Emits SSE signal `attributename`.
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer | Attribute value id |
+
+## Signals
+
+On success, emits SSE signal: `attributename` (see [`GET /events`](../events.md)).
+
+## Response `200`
+
+Image removed
+
+```json
+{
+  "attributevalue": {
+    "id": 1,
+    "thumbW": 1,
+    "thumbH": 1,
+    "thumbHash": "…",
+    "pics": [
+      {
+        "fullHash": "…",
+        "thumbW": 1,
+        "thumbH": 1,
+        "thumbHash": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | No company selected or invalid id — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Attribute value or image not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

docs/api/routes/attributevalue/_id/image.post.md

@@ -0,0 +1,64 @@
+# `POST /attributevalue/{id}/image`
+
+Protected. Requires a valid session cookie (`credentials: 'include'`).
+
+Add or replace attribute value image
+
+Uploads an image for the attribute value (AVIF, WebP, or octet-stream). Converted to AVIF full and thumbnail.
+Replaces any existing image for this attribute value. Emits SSE signal `attributename`.
+
+
+## Path parameters
+
+| Param | Required | Type | Description |
+|-------|----------|------|-------------|
+| `id` | yes | integer | Attribute value id |
+
+## Body
+
+Raw binary (`image/avif`).
+
+Raw binary (`image/webp`).
+
+Raw binary (`application/octet-stream`).
+
+## Signals
+
+On success, emits SSE signal: `attributename` (see [`GET /events`](../events.md)).
+
+## Response `201`
+
+Image stored and linked
+
+```json
+{
+  "attributevalue": {
+    "id": 1,
+    "fullHash": "…",
+    "thumbW": 1,
+    "thumbH": 1,
+    "thumbHash": "…",
+    "pics": [
+      {
+        "fullHash": "…",
+        "thumbW": 1,
+        "thumbH": 1,
+        "thumbHash": "…"
+      }
+    ]
+  }
+}
+```
+
+## Errors
+
+| Status | Description |
+|--------|-------------|
+| 400 | Missing body or invalid image — `{"error":"…"}` |
+| 401 | Unauthorized — `{"error":"…"}` |
+| 403 | Not authorized — `{"error":"…"}` |
+| 404 | Attribute value not found — `{"error":"…"}` |
+
+---
+
+_Generated from `@openapi` JSDoc. Do not edit by hand — run `npm run docs:api`._

src/api/openapi.js

@@ -1556,6 +1556,18 @@
  *           type: string
  *         sort:
  *           type: integer
+ *     AttributeValuePic:
+ *       type: object
+ *       required: [fullHash, thumbW, thumbH, thumbHash]
+ *       properties:
+ *         fullHash:
+ *           type: string
+ *         thumbW:
+ *           type: integer
+ *         thumbH:
+ *           type: integer
+ *         thumbHash:
+ *           type: string
  *     Attributename:
  *       type: object
  *       required: [id, name, sort, exclusive, values]

src/api/routes/attributevalue.js

@@ -1,6 +1,9 @@
+import express from 'express';
 import * as db from '../../db/attributevalue.js';
 import { emit } from '../sse.js';
 
+const AVIF_BODY_LIMIT = 10 * 1024 * 1024;
+
 function requireSelectedCompany(req) {
     const companyId = req.user?.selectedCompanyId;
     if (companyId == null) {
@@ -11,8 +14,10 @@ function requireSelectedCompany(req) {
 
 function attributeValueErrorStatus(error) {
     if (error.message === 'No company selected') return 400;
+    if (error.message === 'Unsupported image format' || error.message?.includes('unsupported image format')) return 400;
     if (error.message === 'Not authorized') return 403;
     if (error.message === 'Company not found' || error.message === 'Attribute name not found' || error.message === 'Attribute value not found') return 404;
+    if (error.message === 'Image not found') return 404;
     if (error.message === 'Value required') return 400;
     if (error.message === 'Invalid attribute value order') return 400;
     if (error.message === 'Invalid id' || error.message === 'Invalid attributeId') return 400;
@@ -301,4 +306,215 @@ export function register(app, basePath = '') {
             res.status(status).json({ error: message });
         }
     });
+
+    /**
+     * @openapi
+     * /attributevalue/{id}/image:
+     *   post:
+     *     tags: [Article]
+     *     summary: Add or replace attribute value image
+     *     description: |
+     *       Uploads an image for the attribute value (AVIF, WebP, or octet-stream). Converted to AVIF full and thumbnail.
+     *       Replaces any existing image for this attribute value. Emits SSE signal `attributename`.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [attributename]
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Attribute value id
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         image/avif:
+     *           schema:
+     *             type: string
+     *             format: binary
+     *         image/webp:
+     *           schema:
+     *             type: string
+     *             format: binary
+     *         application/octet-stream:
+     *           schema:
+     *             type: string
+     *             format: binary
+     *     responses:
+     *       201:
+     *         description: Image stored and linked
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalue:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     fullHash:
+     *                       type: string
+     *                     thumbW:
+     *                       type: integer
+     *                     thumbH:
+     *                       type: integer
+     *                     thumbHash:
+     *                       type: string
+     *                     pics:
+     *                       type: array
+     *                       items:
+     *                         $ref: '#/components/schemas/AttributeValuePic'
+     *       400:
+     *         description: Missing body or invalid image
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Attribute value not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   delete:
+     *     tags: [Article]
+     *     summary: Delete attribute value image
+     *     description: Removes the attribute value's image. Sets thumbW, thumbH, thumbHash back to null. Emits SSE signal `attributename`.
+     *     security:
+     *       - cookieAuth: []
+     *     x-signals: [attributename]
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *         description: Attribute value id
+     *     responses:
+     *       200:
+     *         description: Image removed
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 attributevalue:
+     *                   type: object
+     *                   properties:
+     *                     id:
+     *                       type: integer
+     *                     thumbW:
+     *                       type: integer
+     *                       nullable: true
+     *                     thumbH:
+     *                       type: integer
+     *                       nullable: true
+     *                     thumbHash:
+     *                       type: string
+     *                       nullable: true
+     *                     pics:
+     *                       type: array
+     *                       items:
+     *                         $ref: '#/components/schemas/AttributeValuePic'
+     *       400:
+     *         description: No company selected or invalid id
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Attribute value or image not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+
+    // #region POST /attributevalue/:id/image
+
+    app.post(
+        `${basePath}/attributevalue/:id/image`,
+        express.raw({ type: ['image/avif', 'image/webp', 'application/octet-stream'], limit: AVIF_BODY_LIMIT }),
+        async (req, res) => {
+            const selected = requireSelectedCompany(req);
+            if (selected.error) {
+                return res.status(400).json({ error: selected.error });
+            }
+
+            const id = Number(req.params.id);
+            if (!Number.isInteger(id) || id <= 0) {
+                return res.status(400).json({ error: 'id is required' });
+            }
+
+            const imageBuffer = Buffer.isBuffer(req.body) ? req.body : null;
+            if (!imageBuffer?.length) {
+                return res.status(400).json({ error: 'AVIF or WebP image body is required' });
+            }
+
+            try {
+                const attributevalue = await db.addImage(req.user.id, id, imageBuffer);
+                emit('attributename', { companyId: selected.companyId });
+                res.status(201).json({ attributevalue });
+            } catch (error) {
+                const status = attributeValueErrorStatus(error);
+                if (status === 500) console.error('Add attribute value image failed:', error);
+                res.status(status).json({ error: error.message });
+            }
+        }
+    );
+
+    // #endregion
+
+    // #region DELETE /attributevalue/:id/image
+
+    app.delete(`${basePath}/attributevalue/:id/image`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        try {
+            const attributevalue = await db.deleteImage(req.user.id, id);
+            emit('attributename', { companyId: selected.companyId });
+            res.status(200).json({ attributevalue });
+        } catch (error) {
+            const status = attributeValueErrorStatus(error);
+            if (status === 500) console.error('Delete attribute value image failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    // #endregion
 }
+

src/db/attributevalue.js

@@ -24,3 +24,14 @@ export async function remove(googleAuthId, id) {
     const store = await getStore();
     return store.attributevalue.delete(googleAuthId, id);
 }
+
+export async function addImage(googleAuthId, attributeValueId, image) {
+    const store = await getStore();
+    return store.attributevalue.addImage(googleAuthId, attributeValueId, image);
+}
+
+export async function deleteImage(googleAuthId, attributeValueId) {
+    const store = await getStore();
+    return store.attributevalue.deleteImage(googleAuthId, attributeValueId);
+}
+