NWP-201: Issue virtual cards from the console

build-battle/merchant-console/package.json

@@ -22,7 +22,7 @@
     "@remixicon/react": "^4.6.0",
     "clsx": "^2.1.1",
     "lucide-react": "^0.473.0",
-    "next": "15.1.9",
+    "next": "^15.5.26",
     "next-themes": "^0.4.6",
     "react": "19.0.0",
     "react-dom": "19.0.0",
@@ -42,7 +42,7 @@
     "tailwindcss": "^3.4.18",
     "typescript": "^5.9.3",
     "vite-tsconfig-paths": "^6.1.1",
-    "vitest": "^3.2.7"
+    "vitest": "^5.0.2"
   },
   "pnpm": {
     "overrides": {

build-battle/merchant-console/src/app/api/cards/[id]/route.ts

@@ -0,0 +1,92 @@
+import { store } from "@/data/store"
+import { NextResponse } from "next/server"
+
+export async function GET(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id } = await params
+  const card = store.cards.find((c) => c.id === id)
+
+  if (!card) {
+    return NextResponse.json(
+      { error: "Card not found" },
+      { status: 404 },
+    )
+  }
+
+  // Return card without full number (always masked after creation)
+  return NextResponse.json(card)
+}
+
+export async function PATCH(
+  request: Request,
+  { params }: { params: Promise<{ id: string }> },
+) {
+  const { id } = await params
+
+  const card = store.cards.find((c) => c.id === id)
+
+  if (!card) {
+    return NextResponse.json(
+      { error: "Card not found" },
+      { status: 404 },
+    )
+  }
+
+  try {
+    const body = await request.json()
+    const { status } = body
+
+    if (!status) {
+      return NextResponse.json(
+        { error: "Status is required" },
+        { status: 400 },
+      )
+    }
+
+    // Validate state machine
+    if (card.status === "cancelled") {
+      return NextResponse.json(
+        { error: "Cannot change a cancelled card" },
+        { status: 400 },
+      )
+    }
+
+    if (status === "frozen") {
+      if (card.status !== "active") {
+        return NextResponse.json(
+          { error: "Only active cards can be frozen" },
+          { status: 400 },
+        )
+      }
+    } else if (status === "active") {
+      if (card.status !== "frozen") {
+        return NextResponse.json(
+          { error: "Only frozen cards can be reactivated" },
+          { status: 400 },
+        )
+      }
+    } else if (status === "cancelled") {
+      if (!["active", "frozen"].includes(card.status)) {
+        return NextResponse.json(
+          { error: "Only active or frozen cards can be cancelled" },
+          { status: 400 },
+        )
+      }
+    } else {
+      return NextResponse.json(
+        { error: "Invalid status" },
+        { status: 400 },
+      )
+    }
+
+    card.status = status
+    return NextResponse.json(card)
+  } catch (error) {
+    return NextResponse.json(
+      { error: "Invalid request" },
+      { status: 400 },
+    )
+  }
+}

build-battle/merchant-console/src/app/api/cards/route.ts

@@ -0,0 +1,108 @@
+import { store } from "@/data/store"
+import { Card, Currency } from "@/data/types"
+import { generateCardNumber, getLastFour } from "@/lib/luhn"
+import { merchantById } from "@/data/merchants"
+import { NextRequest, NextResponse } from "next/server"
+
+const VALID_CURRENCIES: Currency[] = ["USD", "EUR", "GBP"]
+const MAX_LIMIT = 500000000 // 5,000,000 in minor units
+
+export function GET() {
+  const cards = store.cards.map((card) => ({
+    ...card,
+  }))
+  return NextResponse.json(cards)
+}
+
+export async function POST(request: NextRequest) {
+  try {
+    const body = await request.json()
+    const { merchantId, nickname, limit, currency } = body
+
+    // Validate merchant exists
+    if (!merchantId || typeof merchantId !== "string") {
+      return NextResponse.json(
+        { error: "Merchant ID is required" },
+        { status: 400 },
+      )
+    }
+
+    const merchant = merchantById(merchantId)
+    if (!merchant) {
+      return NextResponse.json(
+        { error: "Merchant not found" },
+        { status: 400 },
+      )
+    }
+
+    // Validate nickname
+    if (!nickname || typeof nickname !== "string" || !nickname.trim()) {
+      return NextResponse.json(
+        { error: "Nickname is required" },
+        { status: 400 },
+      )
+    }
+
+    // Validate limit
+    if (typeof limit !== "number") {
+      return NextResponse.json(
+        { error: "Limit must be a number" },
+        { status: 400 },
+      )
+    }
+
+    if (limit <= 0) {
+      return NextResponse.json(
+        { error: "Limit must be greater than 0" },
+        { status: 400 },
+      )
+    }
+
+    if (limit > MAX_LIMIT) {
+      return NextResponse.json(
+        { error: `Limit cannot exceed ${MAX_LIMIT / 100}` },
+        { status: 400 },
+      )
+    }
+
+    // Validate currency
+    if (!currency || !VALID_CURRENCIES.includes(currency)) {
+      return NextResponse.json(
+        { error: `Currency must be one of: ${VALID_CURRENCIES.join(", ")}` },
+        { status: 400 },
+      )
+    }
+
+    // Generate card
+    const fullCardNumber = generateCardNumber()
+    const last4 = getLastFour(fullCardNumber)
+
+    const card: Card = {
+      id: `card_${Date.now()}_${Math.random().toString(36).substr(2, 9)}`,
+      merchantId,
+      nickname: nickname.trim(),
+      last4,
+      limit,
+      currency,
+      status: "active",
+      createdAt: new Date().toISOString(),
+    }
+
+    // Store card
+    store.cards.push(card)
+
+    // Return response with full number (shown once only)
+    return NextResponse.json(
+      {
+        ...card,
+        fullNumber: fullCardNumber,
+      },
+      { status: 201 },
+    )
+  } catch (error) {
+    return NextResponse.json(
+      { error: "Invalid request" },
+      { status: 400 },
+    )
+  }
+}