Invoice Document Upload API

// Route Definition
interface UploadRouteParams {
  account_id: string;
}
  
interface UploadRequestBody {
  files: MultipartFile[];
  metadata?: {
    invoiceNumber?: string;
    vendorId?: string;
    clientId?: string;
    description?: string;
  };
}
  
interface UploadResponse {
  success: boolean;
  uploadId: string;
  clientId: string;
  files: UploadedFileInfo[];
  fluxxResponse?: any;
  errors?: string[];
}

// routes/invoiceUpload.ts
import { FastifyInstance, FastifyRequest, FastifyReply } from 'fastify';
import { InvoiceUploadController } from '../controllers/invoiceUploadController';
import { authGuard } from '../middleware/authGuard';
import { roleGuard } from '../middleware/roleGuard';
  
export async function invoiceUploadRoutes(fastify: FastifyInstance) {
  // Register file upload support
  await fastify.register(require('@fastify/multipart'), {
    limits: {
      fileSize: 50 * 1024 * 1024, // 50MB max file size
      files: 10, // Maximum 10 files per request
    },
  });
  
  fastify.route({
    method: 'POST',
    url: '/invoice_document/upload/:client_id',
    preHandler: [
      authGuard, // JWT validation
      roleGuard(['admin', 'manager', 'user']), // Role-based access
    ],
    schema: {
      params: {
        type: 'object',
        properties: {
          client_id: { type: 'string', pattern: '^[a-zA-Z0-9-_]+$' }
        },
        required: ['client_id']
      },
      response: {
        200: {
          type: 'object',
          properties: {
            success: { type: 'boolean' },
            uploadId: { type: 'string' },
            client_id: { type: 'string' },
            files: {
              type: 'array',
              items: {
                type: 'object',
                properties: {
                  filename: { type: 'string' },
                  size: { type: 'number' },
                  contentType: { type: 'string' },
                  uploadedAt: { type: 'string' }
                }
              }
            }
          }
        },
        400: {
          type: 'object',
          properties: {
            error: { type: 'string' },
            details: { type: 'array', items: { type: 'string' } }
          }
        }
      }
    },
    handler: async (request: FastifyRequest, reply: FastifyReply) => {
      const controller = new InvoiceUploadController();
      return controller.handleUpload(request, reply);
    },
  });
}

// controllers/invoiceUploadController.ts
import { FastifyRequest, FastifyReply } from 'fastify';
import { FluxxService } from '../services/fluxxService';
import { FileValidationService } from '../services/fileValidationService';
import { AuditService } from '../services/auditService';
  
export class InvoiceUploadController {
  private fluxxService: FluxxService;
  private fileValidator: FileValidationService;
  private auditService: AuditService;
  
  constructor() {
    this.fluxxService = new FluxxService();
    this.fileValidator = new FileValidationService();
    this.auditService = new AuditService();
  }
  
  async handleUpload(request: FastifyRequest, reply: FastifyReply) {
    try {
      const { client_id } = request.params as { client_id: string };
      const userInfo = request.user; // From JWT middleware
  
      // Log upload attempt
      await this.auditService.logUploadAttempt(client_id, userInfo);
  
      // Check if multiple files or single file
      const filesIterator = request.files();
      const first = await filesIterator.next();
  
      if (!first.done) {
        // Multiple files upload
        return await this.handleMultipleFiles(client_id, first, filesIterator, userInfo);
      } else {
        // Single file upload
        return await this.handleSingleFile(request, client_id, userInfo);
      }
    } catch (error) {
      request.log.error('Upload error:', error);
      return reply.status(500).send({
        success: false,
        error: 'Internal server error during upload',
        details: process.env.NODE_ENV === 'development' ? [error.message] : []
      });
    }
  }
  
  private async handleMultipleFiles(
    client_id: string,
    first: any,
    filesIterator: any,
    userInfo: any
  ) {
    const validatedFiles = [];
  
    // Recreate file iterator including first file
    async function* allFiles() {
      yield first.value;
      for await (const file of filesIterator) {
        yield file;
      }
    }
  
    // Validate all files
    for await (const file of allFiles()) {
      const validation = await this.fileValidator.validateInvoiceFile(file);
      if (!validation.isValid) {
        throw new Error(`Invalid file ${file.filename}: ${validation.errors.join(', ')}`);
      }
      validatedFiles.push(file);
    }
  
    // Forward to Fluxx API
    const fluxxResponse = await this.fluxxService.uploadMultipleFiles(
      client_id,
      validatedFiles,
      userInfo
    );
  
    // Log successful upload
    await this.auditService.logUploadSuccess(client_id, validatedFiles, userInfo);
  
    return {
      success: true,
      uploadId: fluxxResponse.uploadId,
      client_id,
      files: validatedFiles.map(f => ({
        filename: f.filename,
        size: f.file.bytesRead,
        contentType: f.mimetype,
        uploadedAt: new Date().toISOString()
      })),
      fluxxResponse: fluxxResponse.data
    };
  }
  
  private async handleSingleFile(request: FastifyRequest, client_id: string, userInfo: any) {
    const data = await request.file();
  
    if (!data) {
      throw new Error('No file provided');
    }
  
    // Validate file
    const validation = await this.fileValidator.validateInvoiceFile(data);
    if (!validation.isValid) {
      throw new Error(`Invalid file: ${validation.errors.join(', ')}`);
    }
  
    const buffer = await data.toBuffer();
    const filename = data.filename ?? '';
    const contentType = data.mimetype ?? 'application/octet-stream';
  
    // Forward to Fluxx API
    const fluxxResponse = await this.fluxxService.uploadSingleFile(
      client_id,
      buffer,
      filename,
      contentType,
      userInfo
    );
  
    // Log successful upload
    await this.auditService.logUploadSuccess(client_id, [data], userInfo);
  
    return {
      success: true,
      uploadId: fluxxResponse.uploadId,
      client_id,
      files: [{
        filename,
        size: buffer.length,
        contentType,
        uploadedAt: new Date().toISOString()
      }],
      fluxxResponse: fluxxResponse.data
    };
  }
}

// services/fluxxService.ts
import axios, { AxiosInstance } from 'axios';
import FormData from 'form-data';
  
export class FluxxService {
  private client: AxiosInstance;
  private basePath: string;
  
  constructor() {
    this.basePath = process.env.FLUXX_API_BASE_PATH || '/api/v1';
    this.client = axios.create({
      baseURL: process.env.FLUXX_API_URL,
      timeout: 300000, // 5 minutes for file uploads
      headers: {
        'Authorization': `Bearer ${process.env.FLUXX_API_TOKEN}`,
      },
    });
  }
  
  async uploadMultipleFiles(
    client_id: string,
    files: any[],
    userInfo: any
  ): Promise<any> {
    const formData = new FormData();
  
    // Add files to form data
    for (const file of files) {
      const buffer = await file.toBuffer();
      formData.append('files', buffer, {
        filename: file.filename,
        contentType: file.mimetype,
      });
    }
  
    // Add metadata
    formData.append('metadata', JSON.stringify({
      uploadedBy: userInfo.email,
      clientId: userInfo.selectedClient,
      timestamp: new Date().toISOString(),
    }));
  
    try {
      const response = await this.client.post(
        `${this.basePath}/upload/${client_id}`,
        formData,
        {
          headers: {
            ...formData.getHeaders(),
            'X-Uploaded-By': userInfo.email,
            'X-Client-Id': userInfo.selectedClient,
          },
        }
      );
  
      return {
        uploadId: response.data.uploadId || `upload-${Date.now()}`,
        data: response.data,
        status: response.status,
      };
    } catch (error) {
      throw new Error(`Fluxx API error: ${error.response?.data?.message || error.message}`);
    }
  }
  
  async uploadSingleFile(
    client_id: string,
    buffer: Buffer,
    filename: string,
    contentType: string,
    userInfo: any
  ): Promise<any> {
    const formData = new FormData();
    formData.append('file', buffer, {
      filename,
      contentType,
    });
  
    // Add metadata
    formData.append('metadata', JSON.stringify({
      uploadedBy: userInfo.email,
      clientId: userInfo.selectedClient,
      timestamp: new Date().toISOString(),
    }));
  
    try {
      const response = await this.client.post(
        `${this.basePath}/upload/${client_id}`,
        formData,
        {
          headers: {
            ...formData.getHeaders(),
            'X-Uploaded-By': userInfo.email,
            'X-Client-Id': userInfo.selectedClient,
          },
        }
      );
  
      return {
        uploadId: response.data.uploadId || `upload-${Date.now()}`,
        data: response.data,
        status: response.status,
      };
    } catch (error) {
      throw new Error(`Fluxx API error: ${error.response?.data?.message || error.message}`);
    }
  }
}

// services/fileValidationService.ts
export interface FileValidationResult {
  isValid: boolean;
  errors: string[];
  warnings: string[];
}
  
export class FileValidationService {
  private allowedMimeTypes = [
    'application/pdf',
    'image/jpeg',
    'image/png',
    'image/tiff',
    'application/vnd.ms-excel',
    'application/vnd.openxmlformats-officedocument.spreadsheetml.sheet',
  ];
  
  private maxFileSize = 50 * 1024 * 1024; // 50MB
  
  async validateInvoiceFile(file: any): Promise<FileValidationResult> {
    const errors: string[] = [];
    const warnings: string[] = [];
  
    // Check file size
    if (file.file.bytesRead > this.maxFileSize) {
      errors.push(`File size exceeds maximum limit of ${this.maxFileSize / 1024 / 1024}MB`);
    }
  
    // Check MIME type
    if (!this.allowedMimeTypes.includes(file.mimetype)) {
      errors.push(`File type ${file.mimetype} is not allowed for invoice uploads`);
    }
  
    // Check filename
    if (!file.filename || file.filename.length === 0) {
      errors.push('Filename is required');
    }
  
    // Check for suspicious file extensions
    const suspiciousExtensions = ['.exe', '.bat', '.cmd', '.com', '.scr', '.pif'];
    const extension = file.filename?.toLowerCase().split('.').pop();
    if (extension && suspiciousExtensions.includes(`.${extension}`)) {
      errors.push(`File extension .${extension} is not allowed`);
    }
  
    // Additional validation for PDF files
    if (file.mimetype === 'application/pdf') {
      try {
        const buffer = await file.toBuffer();
        if (!this.isPDFValid(buffer)) {
          errors.push('PDF file appears to be corrupted or invalid');
        }
      } catch (error) {
        warnings.push('Could not validate PDF file integrity');
      }
    }
  
    return {
      isValid: errors.length === 0,
      errors,
      warnings,
    };
  }
  
  private isPDFValid(buffer: Buffer): boolean {
    // Basic PDF header validation
    const pdfHeader = buffer.slice(0, 4).toString();
    return pdfHeader === '%PDF';
  }
}

// middleware/authGuard.ts
import { FastifyRequest, FastifyReply } from 'fastify';
import jwt from 'jsonwebtoken';
  
export async function authGuard(request: FastifyRequest, reply: FastifyReply) {
  try {
    const authHeader = request.headers.authorization;
  
    if (!authHeader || !authHeader.startsWith('Bearer ')) {
      return reply.status(401).send({
        error: 'Authentication required',
        details: ['Missing or invalid authorization header']
      });
    }
  
    const token = authHeader.substring(7);
    const decoded = jwt.verify(token, process.env.JWT_SECRET!) as any;
  
    // Attach user info to request
    request.user = {
      id: decoded.sub,
      email: decoded.email,
      roles: decoded.roles || [],
      selectedClient: decoded.selectedClient,
    };
  
  } catch (error) {
    return reply.status(401).send({
      error: 'Invalid token',
      details: ['Token verification failed']
    });
  }
}

// middleware/roleGuard.ts
import { FastifyRequest, FastifyReply } from 'fastify';
  
export function roleGuard(allowedRoles: string[]) {
  return async (request: FastifyRequest, reply: FastifyReply) => {
    const user = request.user as any;
  
    if (!user) {
      return reply.status(401).send({
        error: 'Authentication required',
        details: ['User not authenticated']
      });
    }
  
    const hasRequiredRole = allowedRoles.some(role =>
      user.roles.includes(role) || user.roles.includes('admin')
    );
  
    if (!hasRequiredRole) {
      return reply.status(403).send({
        error: 'Insufficient permissions',
        details: [`Required roles: ${allowedRoles.join(', ')}`]
      });
    }
  };
}

// services/auditService.ts
export class AuditService {
  async logUploadAttempt(client_id: string, userInfo: any): Promise<void> {
    console.log(`Upload attempt - Application: ${client_id}, User: ${userInfo.email}`);
  
    // In production, log to database or monitoring service
    // await this.database.audit.create({
    //   action: 'UPLOAD_ATTEMPT',
    //   client_id,
    //   userId: userInfo.id,
    //   userEmail: userInfo.email,
    //   clientId: userInfo.selectedClient,
    //   timestamp: new Date(),
    // });
  }
  
  async logUploadSuccess(client_id: string, files: any[], userInfo: any): Promise<void> {
    console.log(`Upload success - Application: ${client_id}, Files: ${files.length}, User: ${userInfo.email}`);
  
    // In production, log to database or monitoring service
    // await this.database.audit.create({
    //   action: 'UPLOAD_SUCCESS',
    //   client_id,
    //   userId: userInfo.id,
    //   userEmail: userInfo.email,
    //   clientId: userInfo.selectedClient,
    //   fileCount: files.length,
    //   filenames: files.map(f => f.filename),
    //   timestamp: new Date(),
    // });
  }
}

// tests/controllers/invoiceUploadController.test.ts
import { InvoiceUploadController } from '../../src/controllers/invoiceUploadController';
import { createMockRequest, createMockReply } from '../helpers/mockFastify';
  
describe('InvoiceUploadController', () => {
  let controller: InvoiceUploadController;
  
  beforeEach(() => {
    controller = new InvoiceUploadController();
  });
  
  describe('handleUpload', () => {
    it('should handle single file upload successfully', async () => {
      const mockRequest = createMockRequest({
        params: { client_id: 'test-app-123' },
        user: { email: 'test@example.com', roles: ['user'] },
        file: () => Promise.resolve({
          filename: 'invoice.pdf',
          mimetype: 'application/pdf',
          toBuffer: () => Buffer.from('mock pdf content'),
        }),
      });
  
      const mockReply = createMockReply();
  
      const result = await controller.handleUpload(mockRequest, mockReply);
  
      expect(result.success).toBe(true);
      expect(result.client_id).toBe('test-app-123');
      expect(result.files).toHaveLength(1);
    });
  
    it('should handle validation errors', async () => {
      const mockRequest = createMockRequest({
        params: { client_id: 'test-app-123' },
        user: { email: 'test@example.com', roles: ['user'] },
        file: () => Promise.resolve({
          filename: 'malicious.exe',
          mimetype: 'application/x-executable',
          toBuffer: () => Buffer.from('malicious content'),
        }),
      });
  
      const mockReply = createMockReply();
  
      await expect(controller.handleUpload(mockRequest, mockReply))
        .rejects.toThrow('File type application/x-executable is not allowed');
    });
  });
});

// tests/integration/invoiceUpload.test.ts
import { build } from '../helpers/app';
import FormData from 'form-data';
  
describe('Invoice Upload API', () => {
  const app = build();
  
  afterAll(async () => {
    await app.close();
  });
  
  it('should upload invoice document successfully', async () => {
    const form = new FormData();
    form.append('file', Buffer.from('mock pdf'), {
      filename: 'test-invoice.pdf',
      contentType: 'application/pdf',
    });
  
    const response = await app.inject({
      method: 'POST',
      url: '/invoice_document/upload/test-app-123',
      headers: {
        authorization: 'Bearer valid-jwt-token',
        ...form.getHeaders(),
      },
      payload: form,
    });
  
    expect(response.statusCode).toBe(200);
    const result = JSON.parse(response.payload);
    expect(result.success).toBe(true);
    expect(result.client_id).toBe('test-app-123');
  });
  
  it('should reject unauthorized requests', async () => {
    const response = await app.inject({
      method: 'POST',
      url: '/invoice_document/upload/test-app-123',
      payload: {},
    });
  
    expect(response.statusCode).toBe(401);
  });
});