Add quote and order HTTP APIs on manifest documents.

Expose store-backed CRUD for quotes and sales orders with shared ManifestLine shapes, entityId customers, and documented date semantics.

src/api/routes/order.js

@@ -0,0 +1,433 @@
+import * as db from '../../db/order.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function orderErrorStatus(error) {
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Order not found') return 404;
+    if (error.message === 'Entity not found') return 404;
+    if (error.message === 'Article not found') return 404;
+    if (error.message === 'Invalid order') return 400;
+    if (error.message === 'Invalid lines') return 400;
+    return 500;
+}
+
+/**
+ * Registers sales-order routes for the authenticated user's selected company.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /order:
+     *   get:
+     *     tags: [Order]
+     *     summary: List orders
+     *     description: |
+     *       Lists sales orders (`manifest` rows with `type = 'order'`)
+     *       for the authenticated user's selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: order/list.md
+     *     responses:
+     *       200:
+     *         description: Order list
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 orders:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/OrderSummary'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   post:
+     *     tags: [Order]
+     *     summary: Create order
+     *     description: |
+     *       Creates a sales order with header and lines in one transaction.
+     *       `date` is the document date (expected delivery).
+     *       `entityId` must be a company customer (not Lieferanten/POS), or null.
+     *       Each line requires `sku`, `amount`, `net`, and `tax` (rate); `rebate` defaults to `0`.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: order/create.md
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [number, date, lines]
+     *             properties:
+     *               number:
+     *                 type: string
+     *               date:
+     *                 type: string
+     *                 format: date-time
+     *                 description: Document date / expected delivery
+     *               entityId:
+     *                 type: integer
+     *                 nullable: true
+     *                 description: Customer entity (manifest.entity_id)
+     *               lines:
+     *                 type: array
+     *                 items:
+     *                   $ref: '#/components/schemas/ManifestLineInput'
+     *             example:
+     *               number: O-2026-001
+     *               date: '2026-09-15'
+     *               entityId: 1
+     *               lines:
+     *                 - sku: '1'
+     *                   amount: 10
+     *                   net: 99.5
+     *                   tax: 19
+     *     responses:
+     *       201:
+     *         description: Created order
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 order:
+     *                   $ref: '#/components/schemas/Order'
+     *       400:
+     *         description: Invalid order, invalid lines, or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company, entity, or article not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/order`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const orders = await db.list(req.user.id, selected.companyId);
+            res.status(200).json({ orders });
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('List orders failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.post(`${basePath}/order`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const { number, date, entityId, lines } = req.body ?? {};
+
+        try {
+            const order = await db.create(req.user.id, selected.companyId, {
+                number,
+                date,
+                entityId,
+                lines,
+            });
+            res.status(201).json({ order });
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('Create order failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /order/{id}:
+     *   get:
+     *     tags: [Order]
+     *     summary: Get order
+     *     description: Returns a sales order with lines for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: order/get.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Order
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 order:
+     *                   $ref: '#/components/schemas/Order'
+     *       400:
+     *         description: No company selected or invalid id
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order or company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   patch:
+     *     tags: [Order]
+     *     summary: Update order
+     *     description: |
+     *       Patches header fields that are present. If `lines` is present, replaces
+     *       all lines; if omitted, leaves lines unchanged. Returns the full order.
+     *       `date` is the document date (expected delivery).
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: order/update.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             properties:
+     *               number:
+     *                 type: string
+     *               date:
+     *                 type: string
+     *                 format: date-time
+     *                 description: Document date / expected delivery
+     *               entityId:
+     *                 type: integer
+     *                 nullable: true
+     *               lines:
+     *                 type: array
+     *                 items:
+     *                   $ref: '#/components/schemas/ManifestLineInput'
+     *             example:
+     *               number: O-2026-001b
+     *               lines: []
+     *     responses:
+     *       200:
+     *         description: Updated order
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 order:
+     *                   $ref: '#/components/schemas/Order'
+     *       400:
+     *         description: Invalid order, invalid lines, invalid id, or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order, entity, article, or company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   delete:
+     *     tags: [Order]
+     *     summary: Delete order
+     *     description: Deletes the sales order (`manifestarticle` rows cascade).
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: order/delete.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       204:
+     *         description: Deleted
+     *       400:
+     *         description: No company selected or invalid id
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Order not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/order/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        try {
+            const order = await db.getById(req.user.id, selected.companyId, id);
+            res.status(200).json({ order });
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('Get order failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.patch(`${basePath}/order/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        const body = req.body ?? {};
+        const patch = {};
+        if (Object.prototype.hasOwnProperty.call(body, 'number')) {
+            patch.number = body.number;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'date')) {
+            patch.date = body.date;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'entityId')) {
+            patch.entityId = body.entityId;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'lines')) {
+            patch.lines = body.lines;
+        }
+
+        try {
+            const order = await db.update(req.user.id, selected.companyId, id, patch);
+            res.status(200).json({ order });
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('Update order failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.delete(`${basePath}/order/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        try {
+            await db.remove(req.user.id, selected.companyId, id);
+            res.sendStatus(204);
+        } catch (error) {
+            const status = orderErrorStatus(error);
+            if (status === 500) console.error('Delete order failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}

src/api/routes/quote.js

@@ -0,0 +1,433 @@
+import * as db from '../../db/quote.js';
+
+function requireSelectedCompany(req) {
+    const companyId = req.user.selectedCompanyId;
+    if (companyId == null) {
+        return { error: 'No company selected' };
+    }
+    return { companyId };
+}
+
+function quoteErrorStatus(error) {
+    if (error.message === 'Not authorized') return 403;
+    if (error.message === 'Company not found') return 404;
+    if (error.message === 'Quote not found') return 404;
+    if (error.message === 'Entity not found') return 404;
+    if (error.message === 'Article not found') return 404;
+    if (error.message === 'Invalid quote') return 400;
+    if (error.message === 'Invalid lines') return 400;
+    return 500;
+}
+
+/**
+ * Registers quote routes for the authenticated user's selected company.
+ * @param {import('express').Application} app
+ * @param {string} [basePath='']
+ */
+export function register(app, basePath = '') {
+    /**
+     * @openapi
+     * /quote:
+     *   get:
+     *     tags: [Quote]
+     *     summary: List quotes
+     *     description: |
+     *       Lists quotes (`manifest` rows with `type = 'quote'`)
+     *       for the authenticated user's selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: quote/list.md
+     *     responses:
+     *       200:
+     *         description: Quote list
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 quotes:
+     *                   type: array
+     *                   items:
+     *                     $ref: '#/components/schemas/QuoteSummary'
+     *       400:
+     *         description: No company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   post:
+     *     tags: [Quote]
+     *     summary: Create quote
+     *     description: |
+     *       Creates a quote with header and lines in one transaction.
+     *       `date` is the document date (valid-until).
+     *       `entityId` must be a company customer (not Lieferanten/POS), or null.
+     *       Each line requires `sku`, `amount`, `net`, and `tax` (rate); `rebate` defaults to `0`.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: quote/create.md
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             required: [number, date, lines]
+     *             properties:
+     *               number:
+     *                 type: string
+     *               date:
+     *                 type: string
+     *                 format: date-time
+     *                 description: Document date / valid-until
+     *               entityId:
+     *                 type: integer
+     *                 nullable: true
+     *                 description: Customer entity (manifest.entity_id)
+     *               lines:
+     *                 type: array
+     *                 items:
+     *                   $ref: '#/components/schemas/ManifestLineInput'
+     *             example:
+     *               number: Q-2026-001
+     *               date: '2026-08-31'
+     *               entityId: 1
+     *               lines:
+     *                 - sku: '1'
+     *                   amount: 10
+     *                   net: 99.5
+     *                   tax: 19
+     *     responses:
+     *       201:
+     *         description: Created quote
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 quote:
+     *                   $ref: '#/components/schemas/Quote'
+     *       400:
+     *         description: Invalid quote, invalid lines, or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Company, entity, or article not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/quote`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        try {
+            const quotes = await db.list(req.user.id, selected.companyId);
+            res.status(200).json({ quotes });
+        } catch (error) {
+            const status = quoteErrorStatus(error);
+            if (status === 500) console.error('List quotes failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.post(`${basePath}/quote`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const { number, date, entityId, lines } = req.body ?? {};
+
+        try {
+            const quote = await db.create(req.user.id, selected.companyId, {
+                number,
+                date,
+                entityId,
+                lines,
+            });
+            res.status(201).json({ quote });
+        } catch (error) {
+            const status = quoteErrorStatus(error);
+            if (status === 500) console.error('Create quote failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    /**
+     * @openapi
+     * /quote/{id}:
+     *   get:
+     *     tags: [Quote]
+     *     summary: Get quote
+     *     description: Returns a quote with lines for the selected company.
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: quote/get.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       200:
+     *         description: Quote
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 quote:
+     *                   $ref: '#/components/schemas/Quote'
+     *       400:
+     *         description: No company selected or invalid id
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Quote or company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   patch:
+     *     tags: [Quote]
+     *     summary: Update quote
+     *     description: |
+     *       Patches header fields that are present. If `lines` is present, replaces
+     *       all lines; if omitted, leaves lines unchanged. Returns the full quote.
+     *       `date` is the document date (valid-until).
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: quote/update.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     requestBody:
+     *       required: true
+     *       content:
+     *         application/json:
+     *           schema:
+     *             type: object
+     *             properties:
+     *               number:
+     *                 type: string
+     *               date:
+     *                 type: string
+     *                 format: date-time
+     *                 description: Document date / valid-until
+     *               entityId:
+     *                 type: integer
+     *                 nullable: true
+     *               lines:
+     *                 type: array
+     *                 items:
+     *                   $ref: '#/components/schemas/ManifestLineInput'
+     *             example:
+     *               number: Q-2026-001b
+     *               lines: []
+     *     responses:
+     *       200:
+     *         description: Updated quote
+     *         content:
+     *           application/json:
+     *             schema:
+     *               type: object
+     *               properties:
+     *                 quote:
+     *                   $ref: '#/components/schemas/Quote'
+     *       400:
+     *         description: Invalid quote, invalid lines, invalid id, or no company selected
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Quote, entity, article, or company not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *   delete:
+     *     tags: [Quote]
+     *     summary: Delete quote
+     *     description: Deletes the quote (`manifestarticle` rows cascade).
+     *     security:
+     *       - cookieAuth: []
+     *     x-markdown: quote/delete.md
+     *     parameters:
+     *       - in: path
+     *         name: id
+     *         required: true
+     *         schema:
+     *           type: integer
+     *     responses:
+     *       204:
+     *         description: Deleted
+     *       400:
+     *         description: No company selected or invalid id
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       401:
+     *         description: Unauthorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       403:
+     *         description: Not authorized
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     *       404:
+     *         description: Quote not found
+     *         content:
+     *           application/json:
+     *             schema:
+     *               $ref: '#/components/schemas/Error'
+     */
+    app.get(`${basePath}/quote/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        try {
+            const quote = await db.getById(req.user.id, selected.companyId, id);
+            res.status(200).json({ quote });
+        } catch (error) {
+            const status = quoteErrorStatus(error);
+            if (status === 500) console.error('Get quote failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.patch(`${basePath}/quote/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        const body = req.body ?? {};
+        const patch = {};
+        if (Object.prototype.hasOwnProperty.call(body, 'number')) {
+            patch.number = body.number;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'date')) {
+            patch.date = body.date;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'entityId')) {
+            patch.entityId = body.entityId;
+        }
+        if (Object.prototype.hasOwnProperty.call(body, 'lines')) {
+            patch.lines = body.lines;
+        }
+
+        try {
+            const quote = await db.update(req.user.id, selected.companyId, id, patch);
+            res.status(200).json({ quote });
+        } catch (error) {
+            const status = quoteErrorStatus(error);
+            if (status === 500) console.error('Update quote failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+
+    app.delete(`${basePath}/quote/:id`, async (req, res) => {
+        const selected = requireSelectedCompany(req);
+        if (selected.error) {
+            return res.status(400).json({ error: selected.error });
+        }
+
+        const id = Number(req.params.id);
+        if (!Number.isInteger(id) || id <= 0) {
+            return res.status(400).json({ error: 'id is required' });
+        }
+
+        try {
+            await db.remove(req.user.id, selected.companyId, id);
+            res.sendStatus(204);
+        } catch (error) {
+            const status = quoteErrorStatus(error);
+            if (status === 500) console.error('Delete quote failed:', error);
+            res.status(status).json({ error: error.message });
+        }
+    });
+}