Add company-scoped brand and company settings API.

brand now carries a NOT NULL company_id (unique per (company_id, name))
with brand.list/upsert/delete backed by resolveCompanyAccess. Adds
companysetting key-value store (list/get/set/delete, frontend flag).

src/store/brand/delete.js

@@ -0,0 +1,31 @@
+import { DELETE_BY_COMPANY_AND_ID } from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function del(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, id) => {
+    if (!Number.isFinite(id)) {
+      throw new Error('Brand not found');
+    }
+
+    await access(googleAuthId, companyId);
+
+    try {
+      const result = await pool
+        .request()
+        .input('id', id)
+        .input('companyId', companyId)
+        .query(DELETE_BY_COMPANY_AND_ID);
+
+      if (!result.rowsAffected[0]) {
+        throw new Error('Brand not found');
+      }
+    } catch (err) {
+      if (err.number === 547) {
+        throw new Error('Brand in use');
+      }
+      throw err;
+    }
+  };
+}

src/store/brand/list.js

@@ -0,0 +1,17 @@
+import { LIST_BY_COMPANY } from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function list(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId) => {
+    await access(googleAuthId, companyId);
+
+    const result = await pool
+      .request()
+      .input('companyId', companyId)
+      .query(LIST_BY_COMPANY);
+
+    return result.recordset;
+  };
+}

src/store/brand/upsert.js

@@ -0,0 +1,51 @@
+import {
+  CREATE,
+  GET_BY_COMPANY_AND_NAME,
+  UPDATE_BY_ID,
+} from '../../sql/brand.js';
+import resolveCompanyAccess from '../companyuser/resolveCompanyAccess.js';
+
+export default function upsert(pool) {
+  const access = resolveCompanyAccess(pool);
+
+  return async (googleAuthId, companyId, input = {}) => {
+    const name = input.name?.trim();
+    if (!name) {
+      throw new Error('Invalid brand');
+    }
+    const gsprpinfo = input.gsprpinfo ?? null;
+
+    await access(googleAuthId, companyId);
+
+    const existing = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('name', name)
+      .query(GET_BY_COMPANY_AND_NAME);
+
+    if (existing.recordset[0]) {
+      const { id } = existing.recordset[0];
+      await pool
+        .request()
+        .input('id', id)
+        .input('companyId', companyId)
+        .input('name', name)
+        .input('gsprpinfo', gsprpinfo)
+        .query(UPDATE_BY_ID);
+      return { id, name, gsprpinfo };
+    }
+
+    const created = await pool
+      .request()
+      .input('companyId', companyId)
+      .input('name', name)
+      .input('gsprpinfo', gsprpinfo)
+      .query(CREATE);
+
+    return {
+      id: created.recordset[0].id,
+      name,
+      gsprpinfo,
+    };
+  };
+}