Capstone: resilient e-commerce API

// src/app.ts (updated)
import { setup, route } from "@hectoday/http";
import { z } from "zod/v4";
import db from "./db.js";
import { handleError } from "./error-handler.js";
import { notFound, validationFailed, conflict, serviceUnavailable } from "./errors.js";
import { chargeCard } from "./services/payment.js";
import { sendEmail } from "./services/email.js";
import { reserveStock } from "./services/inventory.js";
import { paymentCircuit } from "./circuits.js";
import { withRetry } from "./retry.js";
import { withTimeout } from "./timeout.js";
import { enqueue } from "./queue.js";
import { checkHealth } from "./health.js";

const OrderBody = z.object({
  userId: z.string(),
  productId: z.string(),
  quantity: z.number().int().positive(),
  paymentToken: z.string(),
});

export const app = setup({
  onError: ({ error, request }) => handleError(error, request),
  routes: [
    route.get("/health", {
      resolve: () => {
        const health = checkHealth();
        const statusCode = health.status === "unhealthy" ? 503 : 200;
        return Response.json(health, { status: statusCode });
      },
    }),

    route.get("/products", {
      resolve: () => {
        const products = db.prepare("SELECT * FROM products").all();
        return Response.json(products);
      },
    }),

    route.get("/products/:id", {
      request: { params: z.object({ id: z.string() }) },
      resolve: (c) => {
        if (!c.input.ok)
          return validationFailed(
            c.input.issues.map((i) => ({ field: i.path.join("."), message: i.message })),
          );

        const product = db.prepare("SELECT * FROM products WHERE id = ?").get(c.input.params.id);
        if (!product) return notFound("Product");

        return Response.json(product);
      },
    }),

    route.post("/orders", {
      request: { body: OrderBody },
      resolve: async (c) => {
        // Validation: return error directly
        if (!c.input.ok) {
          return validationFailed(
            c.input.issues.map((i) => ({ field: i.path.join("."), message: i.message })),
          );
        }

        const { userId, productId, quantity, paymentToken } = c.input.body;

        // Resource lookup: return 404 if missing
        const product = db.prepare("SELECT * FROM products WHERE id = ?").get(productId) as any;
        if (!product) return notFound("Product");

        // Stock check: return 409 if insufficient
        if (product.stock < quantity) {
          return conflict(`${product.name} has only ${product.stock} in stock`);
        }

        // CRITICAL: create order in database (no fallback, must succeed)
        const orderId = `ord_${crypto.randomUUID().slice(0, 8)}`;
        const total = product.price * quantity;

        db.prepare("INSERT INTO orders (id, user_id, status, total) VALUES (?, ?, ?, ?)").run(
          orderId,
          userId,
          "pending",
          total,
        );
        db.prepare(
          "INSERT INTO order_items (order_id, product_id, quantity, price) VALUES (?, ?, ?, ?)",
        ).run(orderId, productId, quantity, product.price);

        // IMPORTANT: deduct stock
        db.prepare("UPDATE products SET stock = stock - ? WHERE id = ?").run(quantity, productId);

        // IMPORTANT: charge payment (retry, timeout, circuit breaker, then queue)
        try {
          await paymentCircuit.call(() =>
            withTimeout(
              () =>
                withRetry(() => chargeCard(total, paymentToken), {
                  maxRetries: 3,
                  baseDelayMs: 500,
                }),
              10_000,
              "Payment",
            ),
          );
          db.prepare("UPDATE orders SET status = ? WHERE id = ?").run("paid", orderId);
        } catch {
          enqueue("charge_card", { orderId, amount: total, token: paymentToken });
          db.prepare("UPDATE orders SET status = ? WHERE id = ?").run("payment_pending", orderId);
        }

        // NICE-TO-HAVE: send confirmation email (fire-and-forget)
        sendEmail(userId, "Order Confirmed", `Your order ${orderId} has been placed.`).catch(() => {
          enqueue("send_email", { to: userId, orderId });
        });

        const order = db.prepare("SELECT * FROM orders WHERE id = ?").get(orderId);
        return Response.json(order, { status: 201 });
      },
    }),
  ],
});