Bariki cashback, order edit, and current work in progress

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>

apps/api/src/server.ts

@@ -4,7 +4,7 @@ import multipart, { type MultipartFile } from '@fastify/multipart';
 import * as Sentry from '@sentry/node';
 import { fastifyTRPCPlugin, type FastifyTRPCPluginOptions } from '@trpc/server/adapters/fastify';
 import { getFlow } from '@barev/core';
-import { DomainError, getClientByTelegramId, proIdentity, receiveMessage, setChecklistItem, staffSend, startTextOverrides } from '@barev/services';
+import { DomainError, getClientByTelegramId, proIdentity, receiveMessage, setChecklistItem, staffChecklistItem, staffSend, startTextOverrides } from '@barev/services';
 import { getFile, putFile } from '@barev/services/storage';
 import { TelegramSender } from '@barev/services/telegram';
 import Fastify, { type FastifyReply, type FastifyRequest } from 'fastify';
@@ -187,6 +187,29 @@ app.post<{ Params: { providerId: string } }>('/files/bo/provider-doc/:providerId
   return { id: doc.id };
 });
 
+/** Команда загружает фото к пункту чек-листа за исполнителя и отмечает пункт */
+app.post<{ Params: { orderId: string } }>('/files/bo/checklist-photo/:orderId', async (req, reply) => {
+  const staff = await staffFromCookie(req);
+  if (!staff || !canDispatch(staff)) return reply.code(staff ? 403 : 401).send({ error: staff ? 'ROLE_FORBIDDEN' : 'ADMIN_LOGIN_REQUIRED' });
+  const order = await db.order.findUnique({ where: { id: req.params.orderId } });
+  if (!order) return reply.code(404).send({ error: 'NOT_FOUND' });
+  const part = await req.file();
+  if (!part) return reply.code(400).send({ error: 'NO_FILE' });
+  const code = multipartField(part, 'code');
+  if (!code) return reply.code(400).send({ error: 'BAD_INPUT' });
+  if (!IMAGE_TYPES.has(part.mimetype)) return reply.code(400).send({ error: 'BAD_FILE_TYPE' });
+  const body = await part.toBuffer();
+  const key = await putObject(`orders/${order.id}`, body, part.mimetype);
+  const file = await db.orderFile.create({ data: { orderId: order.id, kind: 'PHOTO_REPORT', storageKey: key, mime: part.mimetype, size: body.length, uploadedBy: 'ADMIN', uploadedById: staff.admin.id } });
+  try {
+    await staffChecklistItem(svc, { orderId: order.id, adminId: staff.admin.id, code, checked: true, fileId: file.id });
+  } catch (e) {
+    if (e instanceof DomainError) return reply.code(400).send({ error: e.code });
+    throw e;
+  }
+  return { fileId: file.id };
+});
+
 app.get<{ Params: { docId: string } }>('/files/bo/provider-doc-file/:docId', async (req, reply) => {
   const staff = await staffFromCookie(req);
   if (!staff || !canDispatch(staff)) return reply.code(404).send({ error: 'NOT_FOUND' });