feat: harden support, localize knowledge and add operator availability [skip ci]

Source-only publication of reviewed commit 64e96a7f423673dc29ad56485be9fc79bce8af1c.

Passed in isolation: focused frontend/backend tests, race checks, TypeScript typecheck, lint, Go compilation, Flowgram build, and deterministic SDK build/tests.

Not accepted as a production release: Next.js export/native assembly remains blocked by environment memory limits; browser interaction and MySQL staging acceptance remain unverified. No production server, database/schema, runtime configuration, deployment, release tag, or workflow execution was performed.

Expected source tree: 0a4a7528e9.

internal/handlers/dashboard/support_availability_handler.go

@@ -0,0 +1,152 @@
+package dashboard
+
+import (
+	"agent-desk/internal/pkg/constants"
+	"agent-desk/internal/pkg/dto"
+	"agent-desk/internal/pkg/dto/request"
+	"agent-desk/internal/pkg/errorsx"
+	"agent-desk/internal/pkg/httpx"
+	"agent-desk/internal/pkg/httpx/params"
+	"agent-desk/internal/services"
+	"github.com/gin-gonic/gin"
+	"slices"
+	"strconv"
+)
+
+func SupportAvailabilityGetMe(ctx *gin.Context) {
+	ctx.Header("Cache-Control", "no-store")
+	principal := services.AuthService.GetAuthPrincipal(ctx)
+	if principal == nil {
+		httpx.WriteJSON(ctx, errorsx.UnauthorizedI18n("error.auth.expired"))
+		return
+	}
+	item, err := services.SupportAvailabilityService.ForUser(principal.UserID, true)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}
+func SupportAvailabilityPostMe(ctx *gin.Context) {
+	principal := services.AuthService.GetAuthPrincipal(ctx)
+	if principal == nil {
+		httpx.WriteJSON(ctx, errorsx.UnauthorizedI18n("error.auth.expired"))
+		return
+	}
+	req := request.SupportAvailabilityRequest{}
+	if err := params.ReadJSON(ctx, &req); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	// Never accept a target from a self-service request.
+	item, err := services.SupportAvailabilityService.Update(principal.UserID, req, principal)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}
+func SupportAvailabilityGetAgents(ctx *gin.Context) {
+	ctx.Header("Cache-Control", "no-store")
+	principal := services.AuthService.GetAuthPrincipal(ctx)
+	if principal == nil {
+		httpx.WriteJSON(ctx, errorsx.UnauthorizedI18n("error.auth.expired"))
+		return
+	}
+	if !slices.Contains(principal.Permissions, constants.PermissionAgentView.Code) && !slices.Contains(principal.Permissions, constants.PermissionConversationAssign.Code) && !slices.Contains(principal.Permissions, constants.PermissionConversationTransfer.Code) {
+		httpx.WriteJSON(ctx, errorsx.ForbiddenI18n("error.e0225"))
+		return
+	}
+	id, _ := strconv.ParseInt(ctx.Query("conversationId"), 10, 64)
+	if id <= 0 && !slices.Contains(principal.Permissions, constants.PermissionAgentView.Code) {
+		httpx.WriteJSON(ctx, errorsx.ForbiddenI18n("error.e0225"))
+		return
+	}
+	items, err := services.SupportAvailabilityService.List(id, principal)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, items)
+}
+func SupportAvailabilityPostAgent(ctx *gin.Context) {
+	principal, err := services.AuthService.RequirePermission(ctx, constants.PermissionAgentUpdate)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	req := request.SupportAvailabilityRequest{}
+	if err := params.ReadJSON(ctx, &req); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	item, err := services.SupportAvailabilityService.Update(req.UserID, req, principal)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}
+func supportCalendarPermission(ctx *gin.Context, teamID int64, write bool) (*dto.AuthPrincipal, error) {
+	if teamID == 0 {
+		if write {
+			return services.AuthService.RequirePermission(ctx, constants.PermissionSupportConfigUpdate)
+		}
+		return services.AuthService.RequirePermission(ctx, constants.PermissionSupportConfigView)
+	}
+	if write {
+		return services.AuthService.RequirePermission(ctx, constants.PermissionAgentTeamScheduleUpdate)
+	}
+	return services.AuthService.RequirePermission(ctx, constants.PermissionAgentTeamScheduleView)
+}
+func SupportAvailabilityGetCalendar(ctx *gin.Context) {
+	teamID, err := strconv.ParseInt(ctx.DefaultQuery("teamId", "0"), 10, 64)
+	if err != nil || teamID < 0 {
+		httpx.WriteJSON(ctx, errorsx.InvalidParamI18n("error.supportAvailability.invalidCalendar"))
+		return
+	}
+	if _, err := supportCalendarPermission(ctx, teamID, false); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	item, err := services.SupportCalendarService.Get(teamID)
+	if err != nil {
+		httpx.WriteJSON(ctx, errorsx.InvalidParamI18n("error.supportAvailability.persistence"))
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}
+func SupportAvailabilityPostCalendar(ctx *gin.Context) {
+	req := request.SupportCalendarRequest{}
+	if err := params.ReadJSON(ctx, &req); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	if _, err := supportCalendarPermission(ctx, req.TeamID, true); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	item, err := services.SupportCalendarService.Save(req)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}
+func SupportAvailabilityPostCalendarPreview(ctx *gin.Context) {
+	req := request.SupportCalendarPreviewRequest{}
+	if err := params.ReadJSON(ctx, &req); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	if _, err := supportCalendarPermission(ctx, req.Calendar.TeamID, false); err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	item, err := services.SupportCalendarService.Preview(req)
+	if err != nil {
+		httpx.WriteJSON(ctx, err)
+		return
+	}
+	httpx.WriteJSON(ctx, item)
+}