orion/app/modules/cart/routes/api/storefront.py

# app/modules/cart/routes/api/storefront.py
"""
Cart Module - Storefront API Routes

Public endpoints for managing shopping cart in storefront.
Uses vendor from middleware context (VendorContextMiddleware).
No authentication required - uses session ID for cart tracking.

Vendor Context: require_vendor_context() - detects vendor from URL/subdomain/domain
"""

import logging

from fastapi import APIRouter, Body, Depends, Path
from sqlalchemy.orm import Session

from app.core.database import get_db
from app.modules.cart.services import cart_service
from app.modules.cart.schemas import (
    AddToCartRequest,
    CartOperationResponse,
    CartResponse,
    ClearCartResponse,
    UpdateCartItemRequest,
)
from middleware.vendor_context import require_vendor_context
from app.modules.tenancy.models import Vendor

router = APIRouter()
logger = logging.getLogger(__name__)


# ============================================================================
# CART ENDPOINTS
# ============================================================================


@router.get("/cart/{session_id}", response_model=CartResponse)  # public
def get_cart(
    session_id: str = Path(..., description="Shopping session ID"),
    vendor: Vendor = Depends(require_vendor_context()),
    db: Session = Depends(get_db),
) -> CartResponse:
    """
    Get shopping cart contents for current vendor.

    Vendor is automatically determined from request context (URL/subdomain/domain).
    No authentication required - uses session ID for cart tracking.

    Path Parameters:
    - session_id: Unique session identifier for the cart
    """
    logger.info(
        f"[CART_STOREFRONT] get_cart for session {session_id}, vendor {vendor.id}",
        extra={
            "vendor_id": vendor.id,
            "vendor_code": vendor.subdomain,
            "session_id": session_id,
        },
    )

    cart = cart_service.get_cart(db=db, vendor_id=vendor.id, session_id=session_id)

    logger.info(
        f"[CART_STOREFRONT] get_cart result: {len(cart.get('items', []))} items in cart",
        extra={
            "session_id": session_id,
            "vendor_id": vendor.id,
            "item_count": len(cart.get("items", [])),
            "total": cart.get("total", 0),
        },
    )

    return CartResponse.from_service_dict(cart)


@router.post("/cart/{session_id}/items", response_model=CartOperationResponse)  # public
def add_to_cart(
    session_id: str = Path(..., description="Shopping session ID"),
    cart_data: AddToCartRequest = Body(...),
    vendor: Vendor = Depends(require_vendor_context()),
    db: Session = Depends(get_db),
) -> CartOperationResponse:
    """
    Add product to cart for current vendor.

    Vendor is automatically determined from request context (URL/subdomain/domain).
    No authentication required - uses session ID.

    Path Parameters:
    - session_id: Unique session identifier for the cart

    Request Body:
    - product_id: ID of product to add
    - quantity: Quantity to add (default: 1)
    """
    logger.info(
        f"[CART_STOREFRONT] add_to_cart: product {cart_data.product_id}, qty {cart_data.quantity}, session {session_id}",
        extra={
            "vendor_id": vendor.id,
            "vendor_code": vendor.subdomain,
            "session_id": session_id,
            "product_id": cart_data.product_id,
            "quantity": cart_data.quantity,
        },
    )

    result = cart_service.add_to_cart(
        db=db,
        vendor_id=vendor.id,
        session_id=session_id,
        product_id=cart_data.product_id,
        quantity=cart_data.quantity,
    )
    db.commit()

    logger.info(
        f"[CART_STOREFRONT] add_to_cart result: {result}",
        extra={
            "session_id": session_id,
            "result": result,
        },
    )

    return CartOperationResponse(**result)


@router.put(
    "/cart/{session_id}/items/{product_id}", response_model=CartOperationResponse
)  # public
def update_cart_item(
    session_id: str = Path(..., description="Shopping session ID"),
    product_id: int = Path(..., description="Product ID", gt=0),
    cart_data: UpdateCartItemRequest = Body(...),
    vendor: Vendor = Depends(require_vendor_context()),
    db: Session = Depends(get_db),
) -> CartOperationResponse:
    """
    Update cart item quantity for current vendor.

    Vendor is automatically determined from request context (URL/subdomain/domain).
    No authentication required - uses session ID.

    Path Parameters:
    - session_id: Unique session identifier for the cart
    - product_id: ID of product to update

    Request Body:
    - quantity: New quantity (must be >= 1)
    """
    logger.debug(
        f"[CART_STOREFRONT] update_cart_item: product {product_id}, qty {cart_data.quantity}",
        extra={
            "vendor_id": vendor.id,
            "vendor_code": vendor.subdomain,
            "session_id": session_id,
            "product_id": product_id,
            "quantity": cart_data.quantity,
        },
    )

    result = cart_service.update_cart_item(
        db=db,
        vendor_id=vendor.id,
        session_id=session_id,
        product_id=product_id,
        quantity=cart_data.quantity,
    )
    db.commit()

    return CartOperationResponse(**result)


@router.delete(
    "/cart/{session_id}/items/{product_id}", response_model=CartOperationResponse
)  # public
def remove_from_cart(
    session_id: str = Path(..., description="Shopping session ID"),
    product_id: int = Path(..., description="Product ID", gt=0),
    vendor: Vendor = Depends(require_vendor_context()),
    db: Session = Depends(get_db),
) -> CartOperationResponse:
    """
    Remove item from cart for current vendor.

    Vendor is automatically determined from request context (URL/subdomain/domain).
    No authentication required - uses session ID.

    Path Parameters:
    - session_id: Unique session identifier for the cart
    - product_id: ID of product to remove
    """
    logger.debug(
        f"[CART_STOREFRONT] remove_from_cart: product {product_id}",
        extra={
            "vendor_id": vendor.id,
            "vendor_code": vendor.subdomain,
            "session_id": session_id,
            "product_id": product_id,
        },
    )

    result = cart_service.remove_from_cart(
        db=db, vendor_id=vendor.id, session_id=session_id, product_id=product_id
    )
    db.commit()

    return CartOperationResponse(**result)


@router.delete("/cart/{session_id}", response_model=ClearCartResponse)  # public
def clear_cart(
    session_id: str = Path(..., description="Shopping session ID"),
    vendor: Vendor = Depends(require_vendor_context()),
    db: Session = Depends(get_db),
) -> ClearCartResponse:
    """
    Clear all items from cart for current vendor.

    Vendor is automatically determined from request context (URL/subdomain/domain).
    No authentication required - uses session ID.

    Path Parameters:
    - session_id: Unique session identifier for the cart
    """
    logger.debug(
        f"[CART_STOREFRONT] clear_cart for session {session_id}",
        extra={
            "vendor_id": vendor.id,
            "vendor_code": vendor.subdomain,
            "session_id": session_id,
        },
    )

    result = cart_service.clear_cart(db=db, vendor_id=vendor.id, session_id=session_id)
    db.commit()

    return ClearCartResponse(**result)