feat: implement customer task self-completion in portal

- Add customerOwned boolean to tasks table schema (migration 001)
- Portal GET /api/portal/:token — returns customer + tasks for a portal token
- Portal POST /api/portal/:token/tasks/:taskId/complete — validates token,
  verifies customerOwned===true, marks task complete, notifies CSM (idempotent)
- Frontend: /portal/:token — interactive checkboxes for customer-owned tasks
  with optimistic updates, revert on error, success toast, and progress bar
- CSM dashboard: /dashboard — customer list + unread notification feed
- Task editor: toggle customerOwned per task, add new tasks
- Notifications: in-app notification to CSM when customer completes a task
- DB schema: customers, portal_tokens, tasks, notifications, csm_users

Co-Authored-By: Paperclip <noreply@paperclip.ing>

Author: scotttong

.gitignore

@@ -0,0 +1,19 @@
+# dependencies
+/node_modules
+
+# next.js
+/.next/
+/out/
+
+# env files
+.env
+.env.local
+.env.development.local
+.env.test.local
+.env.production.local
+
+# typescript
+tsconfig.tsbuildinfo
+
+# misc
+.DS_Store

app/api/notifications/route.ts

@@ -0,0 +1,40 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createServerClient } from "@/lib/supabase";
+
+export async function GET(request: NextRequest) {
+  const supabase = createServerClient();
+  const { searchParams } = new URL(request.url);
+  const csmId = searchParams.get("csm_id");
+
+  const query = supabase
+    .from("notifications")
+    .select("*")
+    .order("created_at", { ascending: false })
+    .limit(50);
+
+  if (csmId) query.eq("recipient_csm_id", csmId);
+
+  const { data, error } = await query;
+  if (error) return NextResponse.json({ error: "Failed to fetch notifications" }, { status: 500 });
+
+  return NextResponse.json(data ?? []);
+}
+
+// Mark notification(s) as read
+export async function PATCH(request: NextRequest) {
+  const supabase = createServerClient();
+  const body = await request.json() as { ids?: string[] };
+
+  if (!body.ids?.length) {
+    return NextResponse.json({ error: "ids required" }, { status: 400 });
+  }
+
+  const { error } = await supabase
+    .from("notifications")
+    .update({ read: true })
+    .in("id", body.ids);
+
+  if (error) return NextResponse.json({ error: "Failed to update notifications" }, { status: 500 });
+
+  return NextResponse.json({ success: true });
+}

app/api/portal/[token]/route.ts

@@ -0,0 +1,39 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createServerClient } from "@/lib/supabase";
+
+interface RouteParams {
+  params: Promise<{ token: string }>;
+}
+
+export async function GET(_request: NextRequest, { params }: RouteParams) {
+  const { token } = await params;
+  const supabase = createServerClient();
+
+  const { data: portalToken, error: tokenError } = await supabase
+    .from("portal_tokens")
+    .select("*, customers(*)")
+    .eq("token", token)
+    .single();
+
+  if (tokenError || !portalToken) {
+    return NextResponse.json({ error: "Invalid portal token" }, { status: 401 });
+  }
+
+  if (portalToken.expires_at && new Date(portalToken.expires_at) < new Date()) {
+    return NextResponse.json({ error: "Portal token has expired" }, { status: 401 });
+  }
+
+  const customer = portalToken.customers as { id: string; name: string; company: string | null };
+
+  const { data: tasks, error: tasksError } = await supabase
+    .from("tasks")
+    .select("*")
+    .eq("customer_id", customer.id)
+    .order("created_at", { ascending: true });
+
+  if (tasksError) {
+    return NextResponse.json({ error: "Failed to fetch tasks" }, { status: 500 });
+  }
+
+  return NextResponse.json({ customer, tasks: tasks ?? [], token });
+}

app/api/portal/[token]/tasks/[taskId]/complete/route.ts

@@ -0,0 +1,90 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createServerClient } from "@/lib/supabase";
+
+interface RouteParams {
+  params: Promise<{ token: string; taskId: string }>;
+}
+
+export async function POST(request: NextRequest, { params }: RouteParams) {
+  const { token, taskId } = await params;
+  const supabase = createServerClient();
+
+  // 1. Validate portal token
+  const { data: portalToken, error: tokenError } = await supabase
+    .from("portal_tokens")
+    .select("*, customers(*)")
+    .eq("token", token)
+    .single();
+
+  if (tokenError || !portalToken) {
+    return NextResponse.json({ error: "Invalid portal token" }, { status: 401 });
+  }
+
+  // Check expiry
+  if (portalToken.expires_at && new Date(portalToken.expires_at) < new Date()) {
+    return NextResponse.json({ error: "Portal token has expired" }, { status: 401 });
+  }
+
+  const customer = portalToken.customers as { id: string; name: string; csm_id: string | null };
+
+  // 2. Fetch the task and verify ownership
+  const { data: task, error: taskError } = await supabase
+    .from("tasks")
+    .select("*")
+    .eq("id", taskId)
+    .eq("customer_id", customer.id)
+    .single();
+
+  if (taskError || !task) {
+    return NextResponse.json({ error: "Task not found" }, { status: 404 });
+  }
+
+  // 3. Verify task is customer-owned
+  if (!task.customer_owned) {
+    return NextResponse.json(
+      { error: "This task cannot be completed by the customer" },
+      { status: 403 }
+    );
+  }
+
+  // 4. Idempotent: already complete → return 200 without notifying
+  if (task.completed) {
+    return NextResponse.json({ success: true, already_complete: true });
+  }
+
+  // 5. Mark task complete
+  const now = new Date().toISOString();
+  const { error: updateError } = await supabase
+    .from("tasks")
+    .update({
+      completed: true,
+      completed_by: "customer",
+      completed_at: now,
+      updated_at: now,
+    })
+    .eq("id", taskId);
+
+  if (updateError) {
+    console.error("Failed to update task:", updateError);
+    return NextResponse.json({ error: "Failed to complete task" }, { status: 500 });
+  }
+
+  // 6. Trigger CSM notification
+  if (customer.csm_id) {
+    const portalLink = `${process.env.NEXT_PUBLIC_APP_URL}/portal/${token}`;
+    const message = `${customer.name} completed '${task.title}'`;
+
+    const { error: notifError } = await supabase.from("notifications").insert({
+      recipient_csm_id: customer.csm_id,
+      message,
+      link: portalLink,
+    });
+
+    if (notifError) {
+      // Non-fatal: log but don't fail the request
+      console.error("Failed to create CSM notification:", notifError);
+    }
+  }
+
+  return NextResponse.json({ success: true });
+}

app/api/tasks/[taskId]/route.ts

@@ -0,0 +1,33 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createServerClient } from "@/lib/supabase";
+
+interface RouteParams {
+  params: Promise<{ taskId: string }>;
+}
+
+export async function PATCH(request: NextRequest, { params }: RouteParams) {
+  const { taskId } = await params;
+  const supabase = createServerClient();
+
+  const body = await request.json() as Record<string, unknown>;
+
+  // Only allow updating specific fields from the dashboard
+  const allowed = ["title", "description", "customer_owned"] as const;
+  const updates: Record<string, unknown> = { updated_at: new Date().toISOString() };
+  for (const key of allowed) {
+    if (key in body) updates[key] = body[key];
+  }
+
+  const { data, error } = await supabase
+    .from("tasks")
+    .update(updates)
+    .eq("id", taskId)
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: "Failed to update task" }, { status: 500 });
+  }
+
+  return NextResponse.json(data);
+}

app/api/tasks/route.ts

@@ -0,0 +1,30 @@
+import { NextRequest, NextResponse } from "next/server";
+import { createServerClient } from "@/lib/supabase";
+
+export async function POST(request: NextRequest) {
+  const supabase = createServerClient();
+  const body = await request.json();
+
+  const { customer_id, title, description, customer_owned } = body as {
+    customer_id?: string;
+    title?: string;
+    description?: string;
+    customer_owned?: boolean;
+  };
+
+  if (!customer_id || !title) {
+    return NextResponse.json({ error: "customer_id and title are required" }, { status: 400 });
+  }
+
+  const { data, error } = await supabase
+    .from("tasks")
+    .insert({ customer_id, title, description: description ?? null, customer_owned: !!customer_owned })
+    .select()
+    .single();
+
+  if (error) {
+    return NextResponse.json({ error: "Failed to create task" }, { status: 500 });
+  }
+
+  return NextResponse.json(data, { status: 201 });
+}