pelagia-portal/App/app/(portal)/po/[id]/page.tsx
Hardik 0b10ba5e54
All checks were successful
PR checks / checks (pull_request) Successful in 32s
feat(po): cancel POs (manager/superuser) + optional supersede link (#53)
Managers and superusers can cancel a PO from any state via a confirmation modal
that requires typing "cancel" and a mandatory reason. A cancelled PO becomes a
terminal CANCELLED state and drops out of every spend tracker/graph (those filter
on POST_APPROVAL_STATUSES / explicit whitelists, none of which include CANCELLED).

A cancelled PO may optionally be linked to the existing PO that supersedes it
(by PO number); the replacement shows the reciprocal "supersedes" link. No
vessel/account/vendor match is enforced and the link can be added any time.

Cancelled POs remain visible (greyed in history) and exportable, with a diagonal
"CANCELLED" watermark on both the PDF and XLSX exports.

- schema: POStatus CANCELLED; cancelledAt/cancellationReason; self-referential
  supersededById relation; ActionType CANCELLED/SUPERSEDED (+ migration)
- state machine canCancel(); cancel_po permission (MANAGER + SUPERUSER)
- cancelPo / supersedePo server actions + PO_CANCELLED notification
- cancel modal + supersede form; cancelled banner with reciprocal links
- exhaustive CANCELLED entries in all status label/variant maps
- diagonal CANCELLED watermark embedded for PDF (CSS) and XLSX (image)
- integration tests (cancel from any state, reason/role guards, supersede)

Inventory reversal on cancel is deferred to #55 (inventory is feature-flagged off).

Closes #53

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
2026-06-21 12:20:54 +05:30

65 lines
2.1 KiB
TypeScript

import { auth } from "@/auth";
import { db } from "@/lib/db";
import { notFound, redirect } from "next/navigation";
import { PoDetail } from "@/components/po/po-detail";
import { VendorIdForm } from "./vendor-id-form";
import type { Metadata } from "next";
interface Props {
params: Promise<{ id: string }>;
}
export async function generateMetadata({ params }: Props): Promise<Metadata> {
const { id } = await params;
const po = await db.purchaseOrder.findUnique({ where: { id }, select: { poNumber: true } });
return { title: po ? `PO ${po.poNumber}` : "Purchase Order" };
}
export default async function PoDetailPage({ params }: Props) {
const session = await auth();
if (!session?.user) redirect("/login");
const { id } = await params;
const po = await db.purchaseOrder.findUnique({
where: { id },
include: {
submitter: true,
vessel: true,
account: true,
vendor: true,
lineItems: { orderBy: { sortOrder: "asc" } },
documents: { orderBy: { uploadedAt: "desc" } },
actions: { include: { actor: true }, orderBy: { createdAt: "asc" } },
receipt: true,
supersededBy: { select: { id: true, poNumber: true } },
supersedes: { select: { id: true, poNumber: true } },
},
});
if (!po) notFound();
// Submitters can only view their own POs (unless they have view_all_pos)
const canViewAll = ["ACCOUNTS", "MANAGER", "SUPERUSER", "AUDITOR", "ADMIN"].includes(
session.user.role
);
if (!canViewAll && po.submitterId !== session.user.id) redirect("/dashboard");
const canProvideVendorId =
po.status === "VENDOR_ID_PENDING" &&
(
(["TECHNICAL", "MANNING"].includes(session.user.role) && po.submitterId === session.user.id) ||
["ACCOUNTS", "MANAGER", "SUPERUSER"].includes(session.user.role)
);
const vendors = canProvideVendorId
? await db.vendor.findMany({ where: { isActive: true }, orderBy: { name: "asc" } })
: [];
return (
<div className="max-w-6xl space-y-6">
<PoDetail po={po} currentUserId={session.user.id} currentRole={session.user.role} />
{canProvideVendorId && <VendorIdForm poId={po.id} vendors={vendors} />}
</div>
);
}