task-c.1

docs/implementation/task-c1-customer-ownership-contact-sharing-governance.md

@@ -0,0 +1,51 @@
+# Task C.1: Customer Ownership and Contact Sharing Governance
+
+## Summary
+
+Task C.1 completes the missing customer-governance layer by adding:
+
+- persistent customer owner fields and owner history
+- persistent contact sharing
+- owner/share-aware customer and contact visibility
+- lead owner suggestion during lead/enquiry creation
+
+## Delivered
+
+- Added `ownerUserId`, `ownerAssignedAt`, and `ownerAssignedBy` to `crm_customers`
+- Added `crm_customer_owner_history`
+- Added `crm_contact_shares`
+- Added customer owner management route:
+  - `PATCH /api/crm/customers/[id]/owner`
+  - `DELETE /api/crm/customers/[id]/owner`
+- Added contact sharing routes:
+  - `GET /api/crm/customers/[id]/contacts/[contactId]/shares`
+  - `POST /api/crm/customers/[id]/contacts/[contactId]/shares`
+  - `DELETE /api/crm/customers/[id]/contacts/[contactId]/shares/[shareId]`
+- Expanded customer list/detail contracts with owner and share metadata
+- Added customer owner card with history on customer detail
+- Added contact sharing management UI on customer detail
+- Added owner columns and owner filter on customer list
+- Added new permissions:
+  - `crm.customer.owner.read`
+  - `crm.customer.owner.manage`
+  - `crm.contact.share.read`
+  - `crm.contact.share.create`
+  - `crm.contact.share.delete`
+  - `crm.contact.share.manage`
+- Added lead/enquiry assignee suggestion from selected customer owner
+- Added audit events for:
+  - `assign_owner`
+  - `change_owner`
+  - `clear_owner`
+  - `share`
+  - `unshare`
+  - `lead_owner_suggestion_used`
+  - `lead_owner_suggestion_overridden`
+
+## Verification
+
+- `npx tsc --noEmit`
+
+## Remaining limitation
+
+- Team-scope visibility is still approximate because the production model still lacks an explicit CRM team hierarchy.

docs/implementation/technical-debt.md

@@ -434,9 +434,8 @@ Future:
 ### Contact-sharing persistence gap
 
 Current:
-Task L.3.1 hardens customer/contact visibility, but the production schema still has no persisted contact-sharing relation. Legacy shared-contact behavior exists only in demo/mock material.
+Task C.1 closes the contact-sharing persistence gap, but cross-feature regression coverage for owner/share visibility is still light and team-scope remains approximate.
 
 Future:
-
-- add a first-class contact-sharing table and audit trail if the business still needs shared-contact workflows
-- extend security verification from creator/customer/admin visibility to explicit share-based visibility once persistence exists
+- add deeper automated regression coverage for owner/share visibility across customer, lead, enquiry, and quotation flows
+- introduce a first-class CRM team hierarchy if the business still needs inherited team visibility