Add company-scoped brand and company settings API.

brand now carries a NOT NULL company_id (unique per (company_id, name))
with brand.list/upsert/delete backed by resolveCompanyAccess. Adds
companysetting key-value store (list/get/set/delete, frontend flag).

README.md

@@ -149,6 +149,39 @@ Deletes the unit for `(companyId, si)`. Blocked by FK if any article still refer
 
 ---
 
+## `companysetting`
+
+Company-scoped key/value settings. Auth via `resolveCompanyAccess`.
+
+| Method | Signature | Returns |
+| --- | --- | --- |
+| `list` | `(googleAuthId, companyId, { frontendOnly? })` | `{ key, value, frontend }[]` |
+| `get` | `(googleAuthId, companyId, key, { frontendOnly? })` | `{ key, value, frontend } \| undefined` |
+| `set` | `(googleAuthId, companyId, { key, value, frontend? })` | `{ key, value, frontend }` |
+| `delete` | `(googleAuthId, companyId, key)` | `void` |
+
+- `value` is always a string (`NVARCHAR(MAX)`).
+- `frontend: true` → readable by frontend routes (`frontendOnly: true`). Default on `set` is `false` (backend-only).
+- With `frontendOnly: true`, backend-only keys are omitted / `get` returns `undefined` (no leak via error type beyond missing).
+
+Errors: `Company not found`, `Not authorized`, `Invalid setting`, `Setting not found`.
+
+---
+
+## `brand`
+
+Company-scoped brands. Auth via `resolveCompanyAccess`.
+
+| Method | Signature | Returns |
+| --- | --- | --- |
+| `list` | `(googleAuthId, companyId)` | `{ id, name, gsprpinfo }[]` |
+| `upsert` | `(googleAuthId, companyId, { name, gsprpinfo? })` | `{ id, name, gsprpinfo }` |
+| `delete` | `(googleAuthId, companyId, id)` | `void` |
+
+`brand.company_id` **NOT NULL**, unique `(company_id, name)`. `upsert` matches by `(companyId, name)`. `delete` blocked by FK if any article references it (`Brand in use`). Errors: `Company not found`, `Not authorized`, `Invalid brand`, `Brand not found`, `Brand in use`.
+
+---
+
 ## `category`
 
 | Method | Signature | Returns |
@@ -272,6 +305,12 @@ res.set('Content-Type', thumb.contentType).send(thumb.buffer);
 | `GET /api/unit?companyId=` | `unit.list(googleAuthId, companyId)` |
 | `PUT /api/unit` | `unit.upsert(googleAuthId, companyId, { si, basesi, basesifactor, symbol, name })` |
 | `DELETE /api/unit` | `unit.delete(googleAuthId, companyId, si)` |
+| `GET /api/company/:id/settings` | `companysetting.list(googleAuthId, companyId, { frontendOnly: true })` |
+| `PUT /api/company/:id/settings` | `companysetting.set(googleAuthId, companyId, { key, value, frontend? })` |
+| `DELETE /api/company/:id/settings/:key` | `companysetting.delete(googleAuthId, companyId, key)` |
+| `GET /api/brand?companyId=` | `brand.list(googleAuthId, companyId)` |
+| `PUT /api/brand` | `brand.upsert(googleAuthId, companyId, { name, gsprpinfo? })` |
+| `DELETE /api/brand/:id` | `brand.delete(googleAuthId, companyId, id)` |
 | `POST /api/article` | `article.createUnderParent({ googleAuthId, parentId, name })` |
 | `GET /api/article/:sku` | `article.getBySku(googleAuthId, sku)` |
 | `PATCH /api/article/:sku` | `article.updateBySku(googleAuthId, sku, { name?, unitamount?, unitSi? })` |

generate-schema-graph.js

@@ -271,6 +271,7 @@ const CLUSTERS = [
       'companyuser',
       'syncpos',
       'company',
+      'companysetting',
       'customergroup',
       'entity',
       'numbers',

scripts/test-api.js

@@ -113,6 +113,51 @@ const MENU = {
       },
     ],
   },
+  companysetting: {
+    label: 'companysetting',
+    items: [
+      {
+        value: 'companysetting.list',
+        label: 'list',
+        hint: 'googleAuthId, companyId, frontendOnly? → rows',
+      },
+      {
+        value: 'companysetting.get',
+        label: 'get',
+        hint: 'googleAuthId, companyId, key → row',
+      },
+      {
+        value: 'companysetting.set',
+        label: 'set',
+        hint: 'googleAuthId, companyId, JSON setting → row',
+      },
+      {
+        value: 'companysetting.delete',
+        label: 'delete',
+        hint: 'googleAuthId, companyId, key',
+      },
+    ],
+  },
+  brand: {
+    label: 'brand',
+    items: [
+      {
+        value: 'brand.list',
+        label: 'list',
+        hint: 'googleAuthId, companyId → rows',
+      },
+      {
+        value: 'brand.upsert',
+        label: 'upsert',
+        hint: 'googleAuthId, companyId, JSON brand → row',
+      },
+      {
+        value: 'brand.delete',
+        label: 'delete',
+        hint: 'googleAuthId, companyId, id',
+      },
+    ],
+  },
   category: {
     label: 'category',
     items: [
@@ -418,6 +463,139 @@ async function runMethod(client, action) {
       await client.unit.delete(Number(googleAuthId), Number(companyId), si);
       return ['ok', true];
     }
+    case 'companysetting.list': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const frontendOnly = await askText('frontendOnly (true/false)', {
+        placeholder: 'false',
+      });
+      if (frontendOnly == null) return;
+      return [
+        'result[]',
+        await client.companysetting.list(Number(googleAuthId), Number(companyId), {
+          frontendOnly: frontendOnly.trim().toLowerCase() === 'true',
+        }),
+      ];
+    }
+    case 'companysetting.get': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const key = await askText('key', {
+        validate: (v) => (!v?.trim() ? 'Required' : undefined),
+      });
+      if (key == null) return;
+      const frontendOnly = await askText('frontendOnly (true/false)', {
+        placeholder: 'false',
+      });
+      if (frontendOnly == null) return;
+      return [
+        'result',
+        await client.companysetting.get(
+          Number(googleAuthId),
+          Number(companyId),
+          key,
+          { frontendOnly: frontendOnly.trim().toLowerCase() === 'true' },
+        ),
+      ];
+    }
+    case 'companysetting.set': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const settingJson = await askText('setting JSON', {
+        placeholder: '{"key":"theme","value":"dark","frontend":true}',
+        validate: (v) => {
+          if (!v?.trim()) return 'Required';
+          try {
+            const parsed = JSON.parse(v);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+              return 'Must be a JSON object';
+            }
+          } catch {
+            return 'Invalid JSON';
+          }
+        },
+      });
+      if (settingJson == null) return;
+      return [
+        'result',
+        await client.companysetting.set(
+          Number(googleAuthId),
+          Number(companyId),
+          JSON.parse(settingJson),
+        ),
+      ];
+    }
+    case 'companysetting.delete': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const key = await askText('key', {
+        validate: (v) => (!v?.trim() ? 'Required' : undefined),
+      });
+      if (key == null) return;
+      await client.companysetting.delete(
+        Number(googleAuthId),
+        Number(companyId),
+        key,
+      );
+      return ['ok', true];
+    }
+    case 'brand.list': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      return [
+        'result[]',
+        await client.brand.list(Number(googleAuthId), Number(companyId)),
+      ];
+    }
+    case 'brand.upsert': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const brandJson = await askText('brand JSON', {
+        placeholder: '{"name":"Nike","gsprpinfo":"..."}',
+        validate: (v) => {
+          if (!v?.trim()) return 'Required';
+          try {
+            const parsed = JSON.parse(v);
+            if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed)) {
+              return 'Must be a JSON object';
+            }
+          } catch {
+            return 'Invalid JSON';
+          }
+        },
+      });
+      if (brandJson == null) return;
+      return [
+        'result',
+        await client.brand.upsert(
+          Number(googleAuthId),
+          Number(companyId),
+          JSON.parse(brandJson),
+        ),
+      ];
+    }
+    case 'brand.delete': {
+      const googleAuthId = await askInt('google_auth id');
+      if (googleAuthId == null) return;
+      const companyId = await askInt('company id');
+      if (companyId == null) return;
+      const id = await askInt('brand id');
+      if (id == null) return;
+      await client.brand.delete(Number(googleAuthId), Number(companyId), id);
+      return ['ok', true];
+    }
     case 'lang.create': {
       const iso639 = await askText('ISO 639', {
         placeholder: 'de',

src/index.js

@@ -20,6 +20,13 @@ import articleSetPricesBySku from './store/article/setPricesBySku.js';
 import unitList from './store/unit/list.js';
 import unitUpsert from './store/unit/upsert.js';
 import unitDelete from './store/unit/delete.js';
+import companysettingList from './store/companysetting/list.js';
+import companysettingGet from './store/companysetting/get.js';
+import companysettingSet from './store/companysetting/set.js';
+import companysettingDelete from './store/companysetting/delete.js';
+import brandList from './store/brand/list.js';
+import brandUpsert from './store/brand/upsert.js';
+import brandDelete from './store/brand/delete.js';
 import langCreate from './store/lang/create.js';
 import langDelete from './store/lang/delete.js';
 import langList from './store/lang/list.js';
@@ -95,6 +102,19 @@ export default class LibDashStore {
       delete: unitDelete(pool),
     };
 
+    this.companysetting = {
+      list: companysettingList(pool),
+      get: companysettingGet(pool),
+      set: companysettingSet(pool),
+      delete: companysettingDelete(pool),
+    };
+
+    this.brand = {
+      list: brandList(pool),
+      upsert: brandUpsert(pool),
+      delete: brandDelete(pool),
+    };
+
     this.google_auth = {
       add: googleAuthAdd(pool),
       getByEmail: googleAuthGetByEmail(pool),

src/schema.js

@@ -212,8 +212,11 @@ IF NOT EXISTS (SELECT * FROM sys.tables WHERE name = 'brand')
 BEGIN
     CREATE TABLE brand (
         id INT IDENTITY(1,1) PRIMARY KEY,
+        company_id INT NOT NULL,
         name NVARCHAR(255) NOT NULL,
-        gsprpinfo NVARCHAR(MAX) NULL
+        gsprpinfo NVARCHAR(MAX) NULL,
+        CONSTRAINT UQ_brand_company_name UNIQUE (company_id, name),
+        CONSTRAINT FK_brand_company FOREIGN KEY (company_id) REFERENCES company(id) ON DELETE NO ACTION
     );
 END
 `;
@@ -550,6 +553,21 @@ BEGIN
 END
 `;
 
+export const INIT_COMPANYSETTING = `
+IF NOT EXISTS (SELECT * FROM sys.tables WHERE name = 'companysetting')
+BEGIN
+    CREATE TABLE companysetting (
+        id INT IDENTITY(1,1) PRIMARY KEY,
+        company_id INT NOT NULL,
+        [key] NVARCHAR(255) NOT NULL,
+        value NVARCHAR(MAX) NOT NULL,
+        frontend BIT NOT NULL CONSTRAINT DF_companysetting_frontend DEFAULT 0,
+        CONSTRAINT UQ_companysetting_company_key UNIQUE (company_id, [key]),
+        CONSTRAINT FK_companysetting_company FOREIGN KEY (company_id) REFERENCES company(id) ON DELETE CASCADE
+    );
+END
+`;
+
 /** DDL scripts in dependency order for schema init. */
 export const SCHEMA_SCRIPTS = [
   INIT_META,
@@ -585,4 +603,5 @@ export const SCHEMA_SCRIPTS = [
   INIT_GET_NEXT_NUMBER_WITH_PREFIX_AND_PADDING,
   INIT_COMPANYUSER,
   INIT_SYNCPOS,
+  INIT_COMPANYSETTING,
 ];

src/sql/brand.js

@@ -0,0 +1,36 @@
+export const LIST_BY_COMPANY = `
+SELECT
+    id,
+    name,
+    gsprpinfo
+FROM brand
+WHERE company_id = @companyId
+ORDER BY name
+`;
+
+export const GET_BY_COMPANY_AND_NAME = `
+SELECT
+    id,
+    name,
+    gsprpinfo
+FROM brand
+WHERE company_id = @companyId
+  AND name = @name
+`;
+
+export const CREATE = `
+INSERT INTO brand (company_id, name, gsprpinfo)
+OUTPUT INSERTED.id
+VALUES (@companyId, @name, @gsprpinfo)
+`;
+
+export const UPDATE_BY_ID = `
+UPDATE brand
+SET name = @name, gsprpinfo = @gsprpinfo
+WHERE id = @id AND company_id = @companyId
+`;
+
+export const DELETE_BY_COMPANY_AND_ID = `
+DELETE FROM brand
+WHERE id = @id AND company_id = @companyId
+`;

src/sql/companysetting.js

@@ -0,0 +1,47 @@
+export const LIST_BY_COMPANY = `
+SELECT
+    [key],
+    value,
+    CAST(frontend AS INT) AS frontend
+FROM companysetting
+WHERE company_id = @companyId
+ORDER BY [key]
+`;
+
+export const LIST_BY_COMPANY_FRONTEND = `
+SELECT
+    [key],
+    value,
+    CAST(frontend AS INT) AS frontend
+FROM companysetting
+WHERE company_id = @companyId
+  AND frontend = 1
+ORDER BY [key]
+`;
+
+export const GET_BY_COMPANY_AND_KEY = `
+SELECT
+    [key],
+    value,
+    CAST(frontend AS INT) AS frontend
+FROM companysetting
+WHERE company_id = @companyId
+  AND [key] = @key
+`;
+
+export const UPSERT = `
+MERGE companysetting AS target
+USING (SELECT @companyId AS company_id, @key AS [key]) AS src
+    ON target.company_id = src.company_id AND target.[key] = src.[key]
+WHEN MATCHED THEN
+    UPDATE SET value = @value, frontend = @frontend
+WHEN NOT MATCHED THEN
+    INSERT (company_id, [key], value, frontend)
+    VALUES (@companyId, @key, @value, @frontend);
+`;
+
+export const DELETE_BY_COMPANY_AND_KEY = `
+DELETE FROM companysetting
+WHERE company_id = @companyId
+  AND [key] = @key
+`;

src/sql/purge.js

@@ -2,6 +2,7 @@
 export const TABLES = [
   'companyuser',
   'syncpos',
+  'companysetting',
   'numbers',
   'manifestarticle',
   'manifest',

src/store/brand/delete.js

@@ -0,0 +1,31 @@
+import { DELETE_BY_COMPANY_AND_ID } from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function del(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, id) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Brand not found');
+    }
+
+    await access(googleAuthId, companyId);
+
+    try {
+      const result = await pool
+        .request()
+        .input('id', id)
+        .input('companyId', companyId)
+        .query(DELETE_BY_COMPANY_AND_ID);
+
+      if (!result.rowsAffected[0]) {
+        throw new Error('Brand not found');
+      }
+    } catch (err) {
+      if (err.number === 547) {
+        throw new Error('Brand in use');
+      }
+      throw err;
+    }
+  };
+}

src/store/brand/list.js

@@ -0,0 +1,17 @@
+import { LIST_BY_COMPANY } from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function list(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId) => {
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .query(LIST_BY_COMPANY);
+
+    return result.recordset;
+  };
+}

src/store/brand/upsert.js

@@ -0,0 +1,51 @@
+import {
+  CREATE,
+  GET_BY_COMPANY_AND_NAME,
+  UPDATE_BY_ID,
+} from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function upsert(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, input = {}) => {
+    const name = input.name?.trim();
+    if (!name) {
+      throw new Error('Invalid brand');
+    }
+    const gsprpinfo = input.gsprpinfo ?? null;
+
+    await access(googleAuthId, companyId);
+
+    const existing = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('name', name)
+      .query(GET_BY_COMPANY_AND_NAME);
+
+    if (existing.recordset[0]) {
+      const { id } = existing.recordset[0];
+      await pool
+        .request()
+        .input('id', id)
+        .input('companyId', companyId)
+        .input('name', name)
+        .input('gsprpinfo', gsprpinfo)
+        .query(UPDATE_BY_ID);
+      return { id, name, gsprpinfo };
+    }
+
+    const created = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('name', name)
+      .input('gsprpinfo', gsprpinfo)
+      .query(CREATE);
+
+    return {
+      id: created.recordset[0].id,
+      name,
+      gsprpinfo,
+    };
+  };
+}

src/store/companysetting/delete.js

@@ -0,0 +1,24 @@
+import { DELETE_BY_COMPANY_AND_KEY } from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function del(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, key) => {
+    if (!key?.trim()) {
+      throw new Error('Setting not found');
+    }
+
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key.trim())
+      .query(DELETE_BY_COMPANY_AND_KEY);
+
+    if (!result.rowsAffected[0]) {
+      throw new Error('Setting not found');
+    }
+  };
+}

src/store/companysetting/get.js

@@ -0,0 +1,31 @@
+import { GET_BY_COMPANY_AND_KEY } from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import shapeSetting from './shapeSetting.js';
+
+export default function get(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, key, { frontendOnly = false } = {}) => {
+    if (!key?.trim()) {
+      return undefined;
+    }
+
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key.trim())
+      .query(GET_BY_COMPANY_AND_KEY);
+
+    const row = result.recordset[0];
+    if (!row) {
+      return undefined;
+    }
+    if (frontendOnly && !row.frontend) {
+      return undefined;
+    }
+
+    return shapeSetting(row);
+  };
+}

src/store/companysetting/list.js

@@ -0,0 +1,21 @@
+import {
+  LIST_BY_COMPANY,
+  LIST_BY_COMPANY_FRONTEND,
+} from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import shapeSetting from './shapeSetting.js';
+
+export default function list(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, { frontendOnly = false } = {}) => {
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .query(frontendOnly ? LIST_BY_COMPANY_FRONTEND : LIST_BY_COMPANY);
+
+    return result.recordset.map(shapeSetting);
+  };
+}

src/store/companysetting/set.js

@@ -0,0 +1,36 @@
+import { GET_BY_COMPANY_AND_KEY, UPSERT } from '../../sql/companysetting.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+import shapeSetting from './shapeSetting.js';
+
+export default function set(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, input = {}) => {
+    const key = input.key?.trim();
+    if (!key) {
+      throw new Error('Invalid setting');
+    }
+    if (typeof input.value !== 'string') {
+      throw new Error('Invalid setting');
+    }
+
+    const frontend = Boolean(input.frontend);
+    await access(googleAuthId, companyId);
+
+    await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key)
+      .input('value', input.value)
+      .input('frontend', frontend)
+      .query(UPSERT);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('key', key)
+      .query(GET_BY_COMPANY_AND_KEY);
+
+    return shapeSetting(result.recordset[0]);
+  };
+}

src/store/companysetting/shapeSetting.js

@@ -0,0 +1,9 @@
+function shapeSetting(row) {
+  return {
+    key: row.key,
+    value: row.value,
+    frontend: Boolean(row.frontend),
+  };
+}
+
+export default shapeSetting;