feat: make every field of a bottling batch correctable and deletable

A bottling batch could only be corrected in four of its seven fields after
creation: honey batch, jar size and jar count were frozen at creation time,
an assigned product could not be cleared again, and there was no way to
remove a record entered by mistake at all. A mistyped jar count is a
data-entry error, not a fact of production, so it has to stay correctable.

Backend:
- UpdateBottlingBatchDto now covers every field. `productId: null`
  explicitly clears the product assignment; omitting it leaves it alone.
- BottlingService.update rebalances the affected honey batch amounts:
  the previously bottled amount is given back before the corrected amount
  is taken again, so a correction never double-charges the source batch.
  Moving a batch to a different honey batch credits the old one and debits
  the new one in the same transaction.
- New DELETE /bottling-batches/:id gives the bottled amount back to the
  honey batch and keeps the full record in the audit log (action DELETE,
  beforeData). The honey batch status is deliberately left untouched - the
  status it held before being bottled is not recoverable here.
- New permission bottling:delete, checked server-side. The catalog sync
  grants it to system roles on the next boot.

Frontend:
- The edit dialog exposes all fields, offers "Kein Produkt" to clear the
  assignment, keeps a discontinued product selectable so opening the dialog
  cannot silently drop it, and shows backend errors inline.
- The form is mounted only while the dialog is open, so a cancelled edit
  never leaks its values into the next one.
- New delete button behind a confirmation that names the amount credited
  back and warns that the public origin page for the lot number stops
  resolving.
- Edit and delete are additionally hidden without the matching permission.

Co-Authored-By: Claude Opus 5 (1M context) <[email protected]>

ApiCore-Backend/src/auth/permissions/permission-catalog.ts

@@ -191,6 +191,7 @@ export const PERMISSION_CATALOG = [
       ['read', 'Ansehen'],
       ['create', 'Anlegen'],
       ['update', 'Bearbeiten'],
+      ['delete', 'Löschen'],
     ],
     1600,
   ),

ApiCore-Backend/src/bottling/bottling.controller.ts

@@ -1,6 +1,7 @@
 import {
   Body,
   Controller,
+  Delete,
   Get,
   Param,
   Patch,
@@ -51,4 +52,10 @@ export class BottlingController {
   ) {
     return this.bottlingService.update(id, dto, actor.id);
   }
+
+  @RequirePermission('bottling:delete')
+  @Delete(':id')
+  remove(@Param('id') id: string, @CurrentUser() actor: AuthenticatedUser) {
+    return this.bottlingService.remove(id, actor.id);
+  }
 }

ApiCore-Backend/src/bottling/bottling.service.spec.ts

@@ -20,13 +20,18 @@ describe('BottlingService', () => {
   };
   let auditLog: { record: jest.Mock };
   let tx: {
-    bottlingBatch: { create: jest.Mock };
+    bottlingBatch: { create: jest.Mock; update: jest.Mock; delete: jest.Mock };
     honeyBatch: { update: jest.Mock };
   };
+  let webhooks: { dispatch: jest.Mock };
 
   beforeEach(() => {
     tx = {
-      bottlingBatch: { create: jest.fn() },
+      bottlingBatch: {
+        create: jest.fn(),
+        update: jest.fn(),
+        delete: jest.fn(),
+      },
       honeyBatch: { update: jest.fn() },
     };
     prisma = {
@@ -43,7 +48,7 @@ describe('BottlingService', () => {
       ),
     };
     auditLog = { record: jest.fn() };
-    const webhooks = { dispatch: jest.fn().mockResolvedValue(undefined) };
+    webhooks = { dispatch: jest.fn().mockResolvedValue(undefined) };
     const automation = { generateNumber: jest.fn().mockResolvedValue(null) };
     service = new BottlingService(
       prisma as unknown as PrismaService,
@@ -131,12 +136,19 @@ describe('BottlingService', () => {
   });
 
   it('update writes an audit log entry with before and after data', async () => {
-    const before = { id: 'b1', lotNumber: 'L-1' };
-    const updated = { id: 'b1', lotNumber: 'L-2' };
+    const before = {
+      id: 'b1',
+      lotNumber: 'L-1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 10 },
+      jarSize: 500,
+      jarCount: 10,
+      totalAmount: 5,
+    };
+    const updated = { ...before, lotNumber: 'L-2' };
     prisma.bottlingBatch.findUnique
       .mockResolvedValueOnce(before)
       .mockResolvedValueOnce(updated);
-    prisma.bottlingBatch.update.mockResolvedValue(updated);
 
     const result = await service.update('b1', { lotNumber: 'L-2' }, 'user-1');
 
@@ -160,4 +172,136 @@ describe('BottlingService', () => {
       service.update('b1', { productId: 'missing' }, 'user-1'),
     ).rejects.toBeInstanceOf(NotFoundException);
   });
+
+  it('clears the product assignment when productId is null', async () => {
+    const before = {
+      id: 'b1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 10 },
+      jarSize: 500,
+      jarCount: 10,
+      totalAmount: 5,
+      productId: 'p1',
+    };
+    prisma.bottlingBatch.findUnique
+      .mockResolvedValueOnce(before)
+      .mockResolvedValueOnce({ ...before, productId: null });
+
+    await service.update('b1', { productId: null }, 'user-1');
+
+    expect(prisma.product.findUnique).not.toHaveBeenCalled();
+    const [updateArgs] = tx.bottlingBatch.update.mock.calls as [
+      [{ where: { id: string }; data: { productId: string | null } }],
+    ];
+    expect(updateArgs[0].where).toEqual({ id: 'b1' });
+    expect(updateArgs[0].data.productId).toBeNull();
+  });
+
+  it('releases the previous amount before re-reserving a corrected jar count', async () => {
+    const before = {
+      id: 'b1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 0 },
+      jarSize: 500,
+      jarCount: 20,
+      totalAmount: 10,
+    };
+    prisma.bottlingBatch.findUnique
+      .mockResolvedValueOnce(before)
+      .mockResolvedValueOnce({ ...before, jarCount: 10, totalAmount: 5 });
+
+    await service.update('b1', { jarCount: 10 }, 'user-1');
+
+    const [updateArgs] = tx.bottlingBatch.update.mock.calls as [
+      [{ data: { jarCount: number; totalAmount: number } }],
+    ];
+    expect(updateArgs[0].data.jarCount).toBe(10);
+    expect(updateArgs[0].data.totalAmount).toBe(5);
+    expect(tx.honeyBatch.update).toHaveBeenCalledWith({
+      where: { id: 'h1' },
+      data: { amount: 5 },
+    });
+  });
+
+  it('rejects a corrected amount that exceeds the honey batch capacity', async () => {
+    prisma.bottlingBatch.findUnique.mockResolvedValueOnce({
+      id: 'b1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 0 },
+      jarSize: 500,
+      jarCount: 10,
+      totalAmount: 5,
+    });
+
+    await expect(
+      service.update('b1', { jarCount: 40 }, 'user-1'),
+    ).rejects.toBeInstanceOf(BadRequestException);
+  });
+
+  it('moves the amount between honey batches when the honey batch changes', async () => {
+    const before = {
+      id: 'b1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 2 },
+      jarSize: 500,
+      jarCount: 10,
+      totalAmount: 5,
+    };
+    prisma.bottlingBatch.findUnique
+      .mockResolvedValueOnce(before)
+      .mockResolvedValueOnce({ ...before, honeyBatchId: 'h2' });
+    prisma.honeyBatch.findUnique.mockResolvedValueOnce({ id: 'h2', amount: 8 });
+
+    await service.update('b1', { honeyBatchId: 'h2' }, 'user-1');
+
+    expect(tx.honeyBatch.update).toHaveBeenCalledWith({
+      where: { id: 'h1' },
+      data: { amount: 7 },
+    });
+    expect(tx.honeyBatch.update).toHaveBeenCalledWith({
+      where: { id: 'h2' },
+      data: { amount: 3, status: 'BOTTLED' },
+    });
+  });
+
+  it('remove gives the amount back and records a DELETE audit entry', async () => {
+    const before = {
+      id: 'b1',
+      honeyBatchId: 'h1',
+      honeyBatch: { id: 'h1', amount: 2 },
+      totalAmount: 5,
+    };
+    prisma.bottlingBatch.findUnique.mockResolvedValueOnce(before);
+
+    const result = await service.remove('b1', 'user-1');
+
+    expect(result).toEqual({ id: 'b1' });
+    expect(tx.bottlingBatch.delete).toHaveBeenCalledWith({
+      where: { id: 'b1' },
+    });
+    expect(tx.honeyBatch.update).toHaveBeenCalledWith({
+      where: { id: 'h1' },
+      data: { amount: 7 },
+    });
+    expect(auditLog.record).toHaveBeenCalledWith(
+      expect.objectContaining({
+        entityType: 'BottlingBatch',
+        entityId: 'b1',
+        action: 'DELETE',
+        beforeData: before,
+      }),
+    );
+    expect(webhooks.dispatch).toHaveBeenCalledWith(
+      'batch.updated',
+      before.honeyBatch,
+    );
+  });
+
+  it('remove throws NotFoundException for an unknown bottling batch', async () => {
+    prisma.bottlingBatch.findUnique.mockResolvedValueOnce(null);
+
+    await expect(service.remove('missing', 'user-1')).rejects.toBeInstanceOf(
+      NotFoundException,
+    );
+  });
 });

ApiCore-Backend/src/bottling/bottling.service.ts

@@ -20,6 +20,15 @@ export interface BottlingBatchFilter {
   honeyBatchId?: string;
 }
 
+/**
+ * Amounts are kept in kilograms with gram precision. Rounding on every write
+ * keeps a honey batch's remaining amount from drifting when a bottling batch
+ * is corrected or removed and its amount is given back.
+ */
+function roundKg(amount: number): number {
+  return Math.round(amount * 1000) / 1000;
+}
+
 @Injectable()
 export class BottlingService {
   constructor(
@@ -122,8 +131,16 @@ export class BottlingService {
     return created;
   }
 
+  /**
+   * Corrects any field of an existing bottling batch. Changing the honey
+   * batch, the jar size or the jar count also rebalances the remaining amount
+   * of the affected honey batch(es): the previously bottled amount is given
+   * back before the corrected amount is taken again, so a correction never
+   * double-charges the source batch.
+   */
   async update(id: string, dto: UpdateBottlingBatchDto, actingUserId: string) {
     const before = await this.findById(id);
+
     if (dto.productId) {
       const product = await this.prisma.product.findUnique({
         where: { id: dto.productId },
@@ -132,16 +149,87 @@ export class BottlingService {
         throw new NotFoundException('Product not found');
       }
     }
-    await this.prisma.bottlingBatch.update({
-      where: { id },
-      data: {
-        ...dto,
-        date: dto.date ? new Date(dto.date) : undefined,
-        bestBeforeDate: dto.bestBeforeDate
-          ? new Date(dto.bestBeforeDate)
-          : undefined,
-      },
+
+    const honeyBatchId = dto.honeyBatchId ?? before.honeyBatchId;
+    const movedToOtherHoneyBatch = honeyBatchId !== before.honeyBatchId;
+    const jarSize = dto.jarSize ?? before.jarSize;
+    const jarCount = dto.jarCount ?? before.jarCount;
+    const totalAmount = roundKg((jarSize * jarCount) / 1000);
+
+    const targetHoneyBatch = movedToOtherHoneyBatch
+      ? await this.prisma.honeyBatch.findUnique({ where: { id: honeyBatchId } })
+      : before.honeyBatch;
+    if (!targetHoneyBatch) {
+      throw new NotFoundException('Honey batch not found');
+    }
+
+    // Capacity on the target batch, with this bottling batch's current amount
+    // released first when it already sits on that same batch.
+    const availableOnTarget =
+      targetHoneyBatch.amount === null
+        ? null
+        : roundKg(
+            targetHoneyBatch.amount +
+              (movedToOtherHoneyBatch ? 0 : before.totalAmount),
+          );
+    if (availableOnTarget !== null && totalAmount > availableOnTarget) {
+      throw new BadRequestException(
+        'Abfüllmenge übersteigt die verfügbare Menge der Honigcharge',
+      );
+    }
+
+    // A duplicate lotNumber surfaces as Prisma P2002 and is turned into a
+    // 409 with a field-specific message by AllExceptionsFilter.
+    await this.prisma.$transaction(async (tx) => {
+      await tx.bottlingBatch.update({
+        where: { id },
+        data: {
+          honeyBatchId,
+          productId: dto.productId === undefined ? undefined : dto.productId,
+          date: dto.date ? new Date(dto.date) : undefined,
+          jarSize,
+          jarCount,
+          totalAmount,
+          bestBeforeDate: dto.bestBeforeDate
+            ? new Date(dto.bestBeforeDate)
+            : undefined,
+          lotNumber: dto.lotNumber,
+        },
+      });
+
+      if (movedToOtherHoneyBatch) {
+        await tx.honeyBatch.update({
+          where: { id: before.honeyBatchId },
+          data: {
+            amount:
+              before.honeyBatch.amount === null
+                ? null
+                : roundKg(before.honeyBatch.amount + before.totalAmount),
+          },
+        });
+        await tx.honeyBatch.update({
+          where: { id: honeyBatchId },
+          data: {
+            amount:
+              availableOnTarget === null
+                ? null
+                : roundKg(availableOnTarget - totalAmount),
+            status: 'BOTTLED',
+          },
+        });
+      } else if (totalAmount !== before.totalAmount) {
+        await tx.honeyBatch.update({
+          where: { id: honeyBatchId },
+          data: {
+            amount:
+              availableOnTarget === null
+                ? null
+                : roundKg(availableOnTarget - totalAmount),
+          },
+        });
+      }
     });
+
     const bottlingBatch = await this.findById(id);
     await this.auditLog.record({
       entityType: 'BottlingBatch',
@@ -151,6 +239,42 @@ export class BottlingService {
       beforeData: before,
       afterData: bottlingBatch,
     });
+    await this.webhooks.dispatch('batch.updated', bottlingBatch.honeyBatch);
     return bottlingBatch;
   }
+
+  /**
+   * Removes a bottling batch that was entered by mistake and gives its amount
+   * back to the honey batch. The full record is kept in the audit log
+   * (action DELETE, beforeData), so the history survives the row.
+   *
+   * The honey batch's status is deliberately left untouched: the status it
+   * held before being bottled is not recoverable here, and guessing it would
+   * write a fact that never happened.
+   */
+  async remove(id: string, actingUserId: string) {
+    const before = await this.findById(id);
+
+    await this.prisma.$transaction(async (tx) => {
+      await tx.bottlingBatch.delete({ where: { id } });
+      if (before.honeyBatch.amount !== null) {
+        await tx.honeyBatch.update({
+          where: { id: before.honeyBatchId },
+          data: {
+            amount: roundKg(before.honeyBatch.amount + before.totalAmount),
+          },
+        });
+      }
+    });
+
+    await this.auditLog.record({
+      entityType: 'BottlingBatch',
+      entityId: id,
+      action: 'DELETE',
+      userId: actingUserId,
+      beforeData: before,
+    });
+    await this.webhooks.dispatch('batch.updated', before.honeyBatch);
+    return { id };
+  }
 }

ApiCore-Backend/src/bottling/dto/update-bottling-batch.dto.ts

@@ -1,11 +1,63 @@
-import { PartialType, PickType } from '@nestjs/swagger';
-import { CreateBottlingBatchDto } from './create-bottling-batch.dto';
+import { ApiPropertyOptional } from '@nestjs/swagger';
+import {
+  IsDateString,
+  IsInt,
+  IsNumber,
+  IsOptional,
+  IsPositive,
+  IsString,
+  ValidateIf,
+} from 'class-validator';
 
-export class UpdateBottlingBatchDto extends PartialType(
-  PickType(CreateBottlingBatchDto, [
-    'productId',
-    'date',
-    'bestBeforeDate',
-    'lotNumber',
-  ] as const),
-) {}
+/**
+ * Every field of a bottling batch stays correctable after the fact - a
+ * mistyped jar count or a batch bottled against the wrong honey batch is a
+ * data-entry error, not a fact of production. The service rebalances the
+ * affected honey batch amounts for any change to honeyBatchId/jarSize/
+ * jarCount, so the traceability chain stays consistent.
+ *
+ * `productId: null` explicitly clears the product assignment; omitting the
+ * field leaves it untouched.
+ */
+export class UpdateBottlingBatchDto {
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  honeyBatchId?: string;
+
+  @ApiPropertyOptional({
+    nullable: true,
+    description: 'null entfernt die Produktzuordnung',
+  })
+  @IsOptional()
+  @ValidateIf((_object, value) => value !== null)
+  @IsString()
+  productId?: string | null;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsDateString()
+  date?: string;
+
+  @ApiPropertyOptional({ description: 'Glasgröße in Gramm' })
+  @IsOptional()
+  @IsNumber()
+  @IsPositive()
+  jarSize?: number;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsInt()
+  @IsPositive()
+  jarCount?: number;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsDateString()
+  bestBeforeDate?: string;
+
+  @ApiPropertyOptional()
+  @IsOptional()
+  @IsString()
+  lotNumber?: string;
+}