Product changelog

Appearance

July 24, 2026 — Backend ​

Release date: Friday, July 24, 2026

Summary ​

This week shipped the tender preparation module for captive BMS: create and edit a tender package (buildings, summary, documents), run it through approval and freeze, then publish an export for a separate tendering platform. Invitation email and market registration stay on that platform—not in this API.

Shipped ​

  • Tender workspace APIs: CRUD-style tender lifecycle under /api/v1/tenders with status machine DRAFT → PENDING_APPROVAL → APPROVED → PUBLISHED → CLOSED (reject returns to DRAFT).
  • Buildings: Select buildings into working copies (TenderBuilding); edit only in DRAFT; on approve, freeze into immutable TenderBuildingSnapshot rows.
  • Documents: Upload / list / delete while editable; download via GET /api/v1/tenders/:id/documents/:documentId/download (tender.view) for any status; mutations blocked after publish.
  • Export handoff: GET /api/v1/tenders/:id/export returns tender metadata, frozen buildings, document metadata, and preapproved reinsurers for the tendering platform.
  • Reinsurer directory: Preapproved reinsurer CRUD for inclusion in the export package.
  • Activity nest: Combined audit + TenderSupplierActivity events (GET …/activity; platform can POST …/activity/events).
  • Permissions: tender.view | tender.edit | tender.manage | tender.approve | tender.publish (seeded + role wiring).
  • Docs: docs/TENDER.md, audit action keys, OpenAPI refresh, and http/api.http examples.

Engineering (commit recap) ​

Backend — week of July 20 – July 24, 2026 ​

Window: 2026-07-17 < commit date < 2026-07-25 (git log --no-merges).

Summary ​

One feature commit landed on July 24. New Prisma models in tender.prisma, migration 20260724150000_tender_add_core_tables, and Nest module src/modules/tender/ (controller, service, reinsurer sub-API, DTOs, building seed util). Document download mirrors the building stored-object stream pattern (STORAGE_PORT + buildAttachmentContentDisposition).

Themes ​

  • Status and freeze: Working-copy edits gated to DRAFT; approve copies JSON building payloads into snapshots; publish sets PUBLISHED without sending invite email from captive.
  • Storage-backed documents: TenderDocument rows with storageKey; binary download scoped by tender id + document id (tender.view); no separate display-title field—clients use originalName.
  • Export contract: Stable JSON package for the external tendering platform (buildings, docs metadata, preapproved reinsurers).
  • AuthZ and audit: Five permission keys; audit actions for tender lifecycle; activity API for nest UI plus supplier sync webhook shape.
  • Testing: Controller/service specs (including download happy path and 404 scopes), DTO and reinsurer controller specs, building-seed util tests.

Notable fixes or risks (if any) ​

  • Deploy: Run migration tender_add_core_tables and re-seed permissions / role-permissions so roles receive the new tender.* keys.
  • Platform boundary: Clients must not expect invite/email flows from this API after publish—only export + activity sync.
  • Multer / temp: Document upload needs a writable OS temp directory (same operational note as other multipart uploads).