feat: sales activities, forecast products, catalog categories, member cache, procurement filters, and comprehensive tests

New features:
- ActivityController and manager for CW sales activities (CRUD)
- ForecastProductController for opportunity forecast/product lines
- CW member cache with dual-layer (in-memory + Redis) resolution
- Catalog category/subcategory/ecosystem taxonomy module
- Quote statuses type definitions with CW mapping
- User-defined fields (UDF) module with cache and event refresh
- Company sites CW module with serialization
- Procurement manager filters (category, ecosystem, manufacturer, price, stock)
- Opportunity notes CRUD and product line management via CW API
- Opportunity type definitions endpoint

Updates:
- OpportunityController: CW refresh, company hydration, activities, custom fields
- UserController: cwIdentifier field for CW member linking
- CatalogItemController: category/subcategory fields from CW
- PermissionNodes: sales note/product CRUD nodes, subCategories, collectPermissions
- API routes: procurement categories/filters, sales notes/products, opportunity types
- Global events: UDF and member refresh intervals on startup

Tests (414 passing):
- ActivityController, ForecastProductController, OpportunityController unit tests
- UserController cwIdentifier tests
- catalogCategories, companySites, memberCache, procurement module tests
- activityTypes, opportunityTypes, quoteStatuses type tests
- permissionNodes subCategories and getAllPermissionNodes tests
- Updated test setup with redis mock, API method mocks, and builder helpers

src/api/companies/[id]/fetch.ts

@@ -5,6 +5,7 @@ import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
 import GenericError from "../../../Errors/GenericError";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/company/companies/[id] */
 export default createRoute(
@@ -42,13 +43,20 @@ export default createRoute(
       }
     }
 
+    const companyData = company.toJson({
+      includeAddress,
+      includePrimaryContact,
+      includeAllContacts,
+    });
+    const gatedData = await processObjectValuePerms(
+      companyData,
+      "obj.company",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "Company Fetched Successfully!",
-      company.toJson({
-        includeAddress,
-        includePrimaryContact,
-        includeAllContacts,
-      }),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/companies/[id]/unifiSites.ts

@@ -4,6 +4,7 @@ import { companies } from "../../../managers/companies";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/company/companies/:identifier/unifi/sites */
 export default createRoute(
@@ -12,9 +13,16 @@ export default createRoute(
   async (c) => {
     const company = await companies.fetch(c.req.param("identifier"));
     const sites = await unifiSites.fetchByCompany(company.id);
+
+    const gatedData = await Promise.all(
+      sites.map((site) =>
+        processObjectValuePerms(site, "obj.unifiSite", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Company UniFi Sites Fetched Successfully!",
-      sites,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/companies/fetchAll.ts

@@ -4,6 +4,7 @@ import { companies } from "../../managers/companies";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/company/companies */
 export default createRoute(
@@ -22,9 +23,15 @@ export default createRoute(
       ? (await companies.search(search, 1, 999999)).length
       : await companies.count();
 
+    const gatedData = await Promise.all(
+      data.map((item) =>
+        processObjectValuePerms(item, "obj.company", c.get("user")),
+      ),
+    );
+
     let response = apiResponse.successful(
       "Companies Fetched Successfully!",
-      data,
+      gatedData,
       {
         pagination: {
           previousPage: page == 1 ? null : page - 1, // Previous Page

src/api/credential-types/fetch.ts

@@ -4,6 +4,7 @@ import { credentialTypes } from "../../managers/credentialTypes";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/credential-type/:identifier */
 export default createRoute(
@@ -15,9 +16,15 @@ export default createRoute(
       c.req.param("identifier"),
     );
 
+    const gatedData = await processObjectValuePerms(
+      credentialType.toJson({ includeCredentialCount: true }),
+      "obj.credentialType",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "Credential Type Fetched Successfully!",
-      credentialType.toJson({ includeCredentialCount: true }),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/credential-types/fetchAll.ts

@@ -4,6 +4,7 @@ import { credentialTypes } from "../../managers/credentialTypes";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/credential-type */
 export default createRoute(
@@ -13,11 +14,19 @@ export default createRoute(
   async (c) => {
     const allCredentialTypes = await credentialTypes.fetchAll();
 
+    const gatedData = await Promise.all(
+      allCredentialTypes.map((ct) =>
+        processObjectValuePerms(
+          ct.toJson({ includeCredentialCount: true }),
+          "obj.credentialType",
+          c.get("user"),
+        ),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Credential Types Fetched Successfully!",
-      allCredentialTypes.map((ct) =>
-        ct.toJson({ includeCredentialCount: true }),
-      ),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/credential-types/fetchCredentials.ts

@@ -4,6 +4,7 @@ import { credentialTypes } from "../../managers/credentialTypes";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/credential-type/:id/credentials */
 export default createRoute(
@@ -14,9 +15,15 @@ export default createRoute(
     const credentialType = await credentialTypes.fetch(c.req.param("id"));
     const credentials = await credentialType.fetchCredentials();
 
+    const gatedData = await Promise.all(
+      credentials.map((cred) =>
+        processObjectValuePerms(cred.toJson(), "obj.credential", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Credentials Fetched Successfully!",
-      credentials.map((cred) => cred.toJson()),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/credentials/fetch.ts

@@ -4,6 +4,7 @@ import { credentials } from "../../managers/credentials";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/credential/:id */
 export default createRoute(
@@ -12,10 +13,15 @@ export default createRoute(
 
   async (c) => {
     const credential = await credentials.fetch(c.req.param("id"));
+    const gatedData = await processObjectValuePerms(
+      credential.toJson(),
+      "obj.credential",
+      c.get("user"),
+    );
 
     const response = apiResponse.successful(
       "Credential Fetched Successfully!",
-      credential.toJson(),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/credentials/fetchByCompany.ts

@@ -4,6 +4,7 @@ import { credentials } from "../../managers/credentials";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/credential/company/:companyId */
 export default createRoute(
@@ -15,9 +16,15 @@ export default createRoute(
       c.req.param("companyId"),
     );
 
+    const gatedData = await Promise.all(
+      companyCredentials.map((cred) =>
+        processObjectValuePerms(cred.toJson(), "obj.credential", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Company Credentials Fetched Successfully!",
-      companyCredentials.map((cred) => cred.toJson()),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/credentials/fetchSubCredentials.ts

@@ -3,6 +3,7 @@ import { credentials } from "../../managers/credentials";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/credential/credentials/:id/sub-credentials */
 export default createRoute(
@@ -17,9 +18,15 @@ export default createRoute(
 
     const subCredentials = await credentials.fetchSubCredentials(parentId);
 
+    const gatedData = await Promise.all(
+      subCredentials.map((sc) =>
+        processObjectValuePerms(sc.toJson(), "obj.credential", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Sub-Credentials Fetched Successfully!",
-      subCredentials.map((sc) => sc.toJson()),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/procurement/[id]/fetch.ts

@@ -3,6 +3,7 @@ import { procurement } from "../../../managers/procurement";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/procurement/items/:identifier */
 export default createRoute(
@@ -14,9 +15,15 @@ export default createRoute(
 
     const item = await procurement.fetchItem(identifier);
 
+    const gatedData = await processObjectValuePerms(
+      item.toJson({ includeLinkedItems }),
+      "obj.catalogItem",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "Catalog item fetched successfully!",
-      item.toJson({ includeLinkedItems }),
+      gatedData,
     );
 
     return c.json(response, response.status as ContentfulStatusCode);

src/api/procurement/[id]/fetchLinked.ts

@@ -3,6 +3,7 @@ import { procurement } from "../../../managers/procurement";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/procurement/items/:identifier/linked */
 export default createRoute(
@@ -14,9 +15,15 @@ export default createRoute(
 
     const linkedItems = item.getLinkedItems().map((linked) => linked.toJson());
 
+    const gatedData = await Promise.all(
+      linkedItems.map((linked) =>
+        processObjectValuePerms(linked, "obj.catalogItem", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "Linked catalog items fetched successfully!",
-      linkedItems,
+      gatedData,
     );
 
     return c.json(response, response.status as ContentfulStatusCode);

src/api/procurement/categories.ts

@@ -0,0 +1,26 @@
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../middleware/authorization";
+import {
+  serializeCategoryTree,
+  serializeEcosystemTree,
+} from "../../modules/catalog-categories/catalogCategories";
+
+/* /v1/procurement/categories */
+export default createRoute(
+  "get",
+  ["/categories"],
+  async (c) => {
+    const categories = serializeCategoryTree();
+    const ecosystems = serializeEcosystemTree();
+
+    const response = apiResponse.successful(
+      "Category and ecosystem data fetched successfully!",
+      { categories, ecosystems },
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["procurement.catalog.fetch.many"] }),
+);

src/api/procurement/fetchAll.ts

@@ -1,8 +1,9 @@
 import { createRoute } from "../../modules/api-utils/createRoute";
-import { procurement } from "../../managers/procurement";
+import { procurement, CatalogFilterOpts } from "../../managers/procurement";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* /v1/procurement/items */
 export default createRoute(
@@ -14,17 +15,53 @@ export default createRoute(
     const search = c.req.query("search") as string;
     const includeInactive = c.req.query("includeInactive") === "true";
 
-    const data = search
-      ? await procurement.search(search, page, rpp, { includeInactive })
-      : await procurement.fetchPages(page, rpp, { includeInactive });
+    // Category / filter params
+    const category = c.req.query("category") as string | undefined;
+    const subcategory = c.req.query("subcategory") as string | undefined;
+    const group = c.req.query("group") as string | undefined;
+    const manufacturer = c.req.query("manufacturer") as string | undefined;
+    const ecosystem = c.req.query("ecosystem") as string | undefined;
+    const inStock = c.req.query("inStock") === "true" ? true : undefined;
+    const minPrice = c.req.query("minPrice")
+      ? Number(c.req.query("minPrice"))
+      : undefined;
+    const maxPrice = c.req.query("maxPrice")
+      ? Number(c.req.query("maxPrice"))
+      : undefined;
 
-    const totalRecords = await procurement.count({
-      activeOnly: !includeInactive,
-    });
+    const filterOpts: CatalogFilterOpts = {
+      includeInactive,
+      category,
+      subcategory,
+      group,
+      manufacturer,
+      ecosystem,
+      inStock,
+      minPrice,
+      maxPrice,
+    };
+
+    const data = search
+      ? await procurement.search(search, page, rpp, filterOpts)
+      : await procurement.fetchPages(page, rpp, filterOpts);
+
+    const totalRecords = search
+      ? await procurement.countSearch(search, filterOpts)
+      : await procurement.count(filterOpts);
+
+    const gatedData = await Promise.all(
+      data.map((item) =>
+        processObjectValuePerms(
+          item.toJson(),
+          "obj.catalogItem",
+          c.get("user"),
+        ),
+      ),
+    );
 
     const response = apiResponse.successful(
       "Catalog items fetched successfully!",
-      data.map((item) => item.toJson()),
+      gatedData,
       {
         pagination: {
           previousPage: page <= 1 ? null : page - 1,

src/api/procurement/filters.ts

@@ -0,0 +1,32 @@
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { procurement } from "../../managers/procurement";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../middleware/authorization";
+
+/* /v1/procurement/filters */
+export default createRoute(
+  "get",
+  ["/filters"],
+  async (c) => {
+    const category = c.req.query("category") as string | undefined;
+    const subcategory = c.req.query("subcategory") as string | undefined;
+    const includeInactive = c.req.query("includeInactive") === "true";
+
+    const filterOpts = { category, subcategory, includeInactive };
+
+    const [categories, subcategories, manufacturers] = await Promise.all([
+      procurement.fetchDistinctValues("category", filterOpts),
+      procurement.fetchDistinctValues("subcategory", filterOpts),
+      procurement.fetchDistinctValues("manufacturer", filterOpts),
+    ]);
+
+    const response = apiResponse.successful(
+      "Available filter values fetched successfully!",
+      { categories, subcategories, manufacturers },
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["procurement.catalog.fetch.many"] }),
+);

src/api/procurement/index.ts

@@ -5,5 +5,17 @@ import { default as link } from "./[id]/link";
 import { default as unlink } from "./[id]/unlink";
 import { default as fetchLinked } from "./[id]/fetchLinked";
 import { default as count } from "./count";
+import { default as categories } from "./categories";
+import { default as filters } from "./filters";
 
-export { count, fetch, fetchAll, fetchLinked, link, refreshInventory, unlink };
+export {
+  categories,
+  count,
+  fetch,
+  fetchAll,
+  fetchLinked,
+  filters,
+  link,
+  refreshInventory,
+  unlink,
+};

src/api/roles/fetch.ts

@@ -4,6 +4,7 @@ import { roles } from "../../managers/roles";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/role/:identifier */
 export default createRoute(
@@ -15,9 +16,15 @@ export default createRoute(
 
     const role = await roles.fetch(identifier);
 
+    const gatedData = await processObjectValuePerms(
+      role.toJson({ viewPermissions: true }),
+      "obj.role",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "Role Fetched Successfully!",
-      role.toJson({ viewPermissions: true }),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/roles/fetchAll.ts

@@ -4,6 +4,7 @@ import { roles } from "../../managers/roles";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/role */
 export default createRoute(
@@ -13,13 +14,19 @@ export default createRoute(
   async (c) => {
     const allRoles = await roles.fetchAllRoles();
 
-    const rolesArray = allRoles.map((role) =>
-      role.toJson({ viewPermissions: true }),
+    const gatedData = await Promise.all(
+      allRoles.map((role) =>
+        processObjectValuePerms(
+          role.toJson({ viewPermissions: true }),
+          "obj.role",
+          c.get("user"),
+        ),
+      ),
     );
 
     const response = apiResponse.successful(
       "Roles Fetched Successfully!",
-      rolesArray,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/roles/getUsers.ts

@@ -4,6 +4,7 @@ import { roles } from "../../managers/roles";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/role/:identifier/users */
 export default createRoute(
@@ -16,11 +17,15 @@ export default createRoute(
     const role = await roles.fetch(identifier);
     const users = role.getUsers();
 
-    const usersArray = users.map((user) => user.toJson());
+    const gatedData = await Promise.all(
+      users.map((user) =>
+        processObjectValuePerms(user.toJson(), "obj.user", c.get("user")),
+      ),
+    );
 
     const response = apiResponse.successful(
       "Users Fetched Successfully!",
-      usersArray,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/sales/[id]/contacts.ts

@@ -3,7 +3,6 @@ import { opportunities } from "../../../managers/opportunities";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
-import { opportunityCw } from "../../../modules/cw-utils/opportunities/opportunities";
 
 /* GET /v1/sales/opportunities/:identifier/contacts */
 export default createRoute(
@@ -13,22 +12,7 @@ export default createRoute(
     const identifier = c.req.param("identifier");
     const item = await opportunities.fetchItem(identifier);
 
-    const contacts = await opportunityCw.fetchContacts(item.cwOpportunityId);
-
-    const data = contacts.map((ct) => ({
-      id: ct.id,
-      contact: ct.contact ? { id: ct.contact.id, name: ct.contact.name } : null,
-      company: ct.company
-        ? {
-            id: ct.company.id,
-            identifier: ct.company.identifier,
-            name: ct.company.name,
-          }
-        : null,
-      role: ct.role ? { id: ct.role.id, name: ct.role.name } : null,
-      notes: ct.notes,
-      referralFlag: ct.referralFlag,
-    }));
+    const data = await item.fetchContacts();
 
     const response = apiResponse.successful(
       "Opportunity contacts fetched successfully!",

src/api/sales/[id]/createNote.ts

@@ -0,0 +1,47 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+import { resolveMember } from "../../../modules/cw-utils/members/memberCache";
+import { z } from "zod";
+
+/* POST /v1/sales/opportunities/:identifier/notes */
+export default createRoute(
+  "post",
+  ["/opportunities/:identifier/notes"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const body = await c.req.json();
+
+    const schema = z.object({
+      text: z.string().min(1, "Note text is required"),
+      flagged: z.boolean().optional(),
+    });
+
+    const data = schema.parse(body);
+
+    const item = await opportunities.fetchItem(identifier);
+    const user = c.get("user");
+
+    const created = await item.addNote(data.text, user.login, {
+      flagged: data.flagged,
+    });
+
+    const response = apiResponse.created(
+      "Opportunity note created successfully!",
+      {
+        id: created.id,
+        text: created.text,
+        type: created.type
+          ? { id: created.type.id, name: created.type.name }
+          : null,
+        flagged: created.flagged,
+        enteredBy: await resolveMember(created.enteredBy),
+      },
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.note.create"] }),
+);

src/api/sales/[id]/deleteNote.ts

@@ -0,0 +1,33 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+import GenericError from "../../../Errors/GenericError";
+
+/* DELETE /v1/sales/opportunities/:identifier/notes/:noteId */
+export default createRoute(
+  "delete",
+  ["/opportunities/:identifier/notes/:noteId"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const noteId = Number(c.req.param("noteId"));
+
+    if (isNaN(noteId))
+      throw new GenericError({
+        status: 400,
+        name: "InvalidNoteId",
+        message: "Note ID must be a number",
+      });
+
+    const item = await opportunities.fetchItem(identifier);
+    await item.deleteNote(noteId);
+
+    const response = apiResponse.successful(
+      "Opportunity note deleted successfully!",
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.note.delete"] }),
+);

src/api/sales/[id]/fetch.ts

@@ -3,6 +3,7 @@ import { opportunities } from "../../../managers/opportunities";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/sales/opportunities/:identifier */
 export default createRoute(
@@ -13,9 +14,18 @@ export default createRoute(
 
     const item = await opportunities.fetchItem(identifier);
 
+    // Eagerly load site data so toJson() includes full site info
+    await item.fetchSite();
+
+    const gatedData = await processObjectValuePerms(
+      item.toJson(),
+      "obj.opportunity",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "Opportunity fetched successfully!",
-      item.toJson(),
+      gatedData,
     );
 
     return c.json(response, response.status as ContentfulStatusCode);

src/api/sales/[id]/fetchNote.ts

@@ -0,0 +1,34 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+import GenericError from "../../../Errors/GenericError";
+
+/* GET /v1/sales/opportunities/:identifier/notes/:noteId */
+export default createRoute(
+  "get",
+  ["/opportunities/:identifier/notes/:noteId"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const noteId = Number(c.req.param("noteId"));
+
+    if (isNaN(noteId))
+      throw new GenericError({
+        status: 400,
+        name: "InvalidNoteId",
+        message: "Note ID must be a number",
+      });
+
+    const item = await opportunities.fetchItem(identifier);
+    const data = await item.fetchNote(noteId);
+
+    const response = apiResponse.successful(
+      "Opportunity note fetched successfully!",
+      data,
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.fetch"] }),
+);

src/api/sales/[id]/forecasts.ts

@@ -1,39 +0,0 @@
-import { createRoute } from "../../../modules/api-utils/createRoute";
-import { opportunities } from "../../../managers/opportunities";
-import { apiResponse } from "../../../modules/api-utils/apiResponse";
-import { ContentfulStatusCode } from "hono/utils/http-status";
-import { authMiddleware } from "../../middleware/authorization";
-import { opportunityCw } from "../../../modules/cw-utils/opportunities/opportunities";
-
-/* GET /v1/sales/opportunities/:identifier/forecasts */
-export default createRoute(
-  "get",
-  ["/opportunities/:identifier/forecasts"],
-  async (c) => {
-    const identifier = c.req.param("identifier");
-    const item = await opportunities.fetchItem(identifier);
-
-    const forecasts = await opportunityCw.fetchForecasts(item.cwOpportunityId);
-
-    const data = forecasts.map((f) => ({
-      id: f.id,
-      forecastType: f.forecastType,
-      forecastMonth: f.forecastMonth,
-      revenue: f.revenue,
-      cost: f.cost,
-      forecastPercentage: f.forecastPercentage,
-      status: f.status ? { id: f.status.id, name: f.status.name } : null,
-      includedFlag: f.includedFlag,
-      linkedFlag: f.linkedFlag,
-      recurringFlag: f.recurringFlag,
-    }));
-
-    const response = apiResponse.successful(
-      "Opportunity forecasts fetched successfully!",
-      data,
-    );
-
-    return c.json(response, response.status as ContentfulStatusCode);
-  },
-  authMiddleware({ permissions: ["sales.opportunity.fetch"] }),
-);

src/api/sales/[id]/notes.ts

@@ -3,7 +3,6 @@ import { opportunities } from "../../../managers/opportunities";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
-import { opportunityCw } from "../../../modules/cw-utils/opportunities/opportunities";
 
 /* GET /v1/sales/opportunities/:identifier/notes */
 export default createRoute(
@@ -13,15 +12,7 @@ export default createRoute(
     const identifier = c.req.param("identifier");
     const item = await opportunities.fetchItem(identifier);
 
-    const notes = await opportunityCw.fetchNotes(item.cwOpportunityId);
-
-    const data = notes.map((n) => ({
-      id: n.id,
-      text: n.text,
-      type: n.type ? { id: n.type.id, name: n.type.name } : null,
-      flagged: n.flagged,
-      enteredBy: n.enteredBy,
-    }));
+    const data = await item.fetchNotes();
 
     const response = apiResponse.successful(
       "Opportunity notes fetched successfully!",

src/api/sales/[id]/products.ts

@@ -0,0 +1,25 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+
+/* GET /v1/sales/opportunities/:identifier/products */
+export default createRoute(
+  "get",
+  ["/opportunities/:identifier/products"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const item = await opportunities.fetchItem(identifier);
+
+    const data = await item.fetchProducts();
+
+    const response = apiResponse.successful(
+      "Opportunity products fetched successfully!",
+      data.map((p) => p.toJson()),
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.fetch"] }),
+);

src/api/sales/[id]/resequenceProducts.ts

@@ -0,0 +1,44 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+import { z } from "zod";
+
+/* PATCH /v1/sales/opportunities/:identifier/products/sequence */
+export default createRoute(
+  "patch",
+  ["/opportunities/:identifier/products/sequence"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const body = await c.req.json();
+
+    const schema = z.object({
+      orderedIds: z
+        .array(z.number().int().positive())
+        .min(1, "At least one forecast item ID is required"),
+    });
+
+    const { orderedIds } = schema.parse(body);
+
+    const item = await opportunities.fetchItem(identifier);
+    const updated = await item.resequenceProducts(orderedIds);
+
+    // Map original IDs to the new IDs returned by ConnectWise
+    const idMap: Record<number, number> = {};
+    for (let i = 0; i < orderedIds.length; i++) {
+      idMap[orderedIds[i]!] = updated[i]!.cwForecastId;
+    }
+
+    const response = apiResponse.successful(
+      "Product sequence updated successfully!",
+      {
+        products: updated.map((p) => p.toJson()),
+        idMap,
+      },
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.product.update"] }),
+);

src/api/sales/[id]/updateNote.ts

@@ -0,0 +1,57 @@
+import { createRoute } from "../../../modules/api-utils/createRoute";
+import { opportunities } from "../../../managers/opportunities";
+import { apiResponse } from "../../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../../middleware/authorization";
+import GenericError from "../../../Errors/GenericError";
+import { resolveMember } from "../../../modules/cw-utils/members/memberCache";
+import { z } from "zod";
+
+/* PATCH /v1/sales/opportunities/:identifier/notes/:noteId */
+export default createRoute(
+  "patch",
+  ["/opportunities/:identifier/notes/:noteId"],
+  async (c) => {
+    const identifier = c.req.param("identifier");
+    const noteId = Number(c.req.param("noteId"));
+
+    if (isNaN(noteId))
+      throw new GenericError({
+        status: 400,
+        name: "InvalidNoteId",
+        message: "Note ID must be a number",
+      });
+
+    const body = await c.req.json();
+
+    const schema = z
+      .object({
+        text: z.string().min(1).optional(),
+        flagged: z.boolean().optional(),
+      })
+      .refine((d) => d.text !== undefined || d.flagged !== undefined, {
+        message: "At least one of 'text' or 'flagged' must be provided",
+      });
+
+    const data = schema.parse(body);
+
+    const item = await opportunities.fetchItem(identifier);
+    const updated = await item.updateNote(noteId, data);
+
+    const response = apiResponse.successful(
+      "Opportunity note updated successfully!",
+      {
+        id: updated.id,
+        text: updated.text,
+        type: updated.type
+          ? { id: updated.type.id, name: updated.type.name }
+          : null,
+        flagged: updated.flagged,
+        enteredBy: await resolveMember(updated.enteredBy),
+      },
+    );
+
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.note.update"] }),
+);

src/api/sales/fetchAll.ts

@@ -3,6 +3,7 @@ import { opportunities } from "../../managers/opportunities";
 import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../middleware/authorization";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/sales/opportunities */
 export default createRoute(
@@ -18,13 +19,23 @@ export default createRoute(
       ? await opportunities.search(search, page, rpp, { includeClosed })
       : await opportunities.fetchPages(page, rpp, { includeClosed });
 
-    const totalRecords = await opportunities.count({
-      openOnly: !includeClosed,
-    });
+    const totalRecords = search
+      ? await opportunities.searchCount(search, { includeClosed })
+      : await opportunities.count({ openOnly: !includeClosed });
+
+    const gatedData = await Promise.all(
+      data.map((item) =>
+        processObjectValuePerms(
+          item.toJson(),
+          "obj.opportunity",
+          c.get("user"),
+        ),
+      ),
+    );
 
     const response = apiResponse.successful(
       "Opportunities fetched successfully!",
-      data.map((item) => item.toJson()),
+      gatedData,
       {
         pagination: {
           previousPage: page <= 1 ? null : page - 1,

src/api/sales/fetchOpportunityTypes.ts

@@ -0,0 +1,20 @@
+import { createRoute } from "../../modules/api-utils/createRoute";
+import { apiResponse } from "../../modules/api-utils/apiResponse";
+import { ContentfulStatusCode } from "hono/utils/http-status";
+import { authMiddleware } from "../middleware/authorization";
+import { QUOTE_STATUSES } from "../../types/QuoteStatuses";
+
+/* GET /v1/sales/opportunity-types */
+export default createRoute(
+  "get",
+  ["/opportunity-types"],
+
+  async (c) => {
+    const response = apiResponse.successful(
+      "Opportunity Types Fetched Successfully!",
+      QUOTE_STATUSES,
+    );
+    return c.json(response, response.status as ContentfulStatusCode);
+  },
+  authMiddleware({ permissions: ["sales.opportunity.fetch.many"] }),
+);

src/api/sales/index.ts

@@ -1,9 +1,29 @@
 import { default as fetchAll } from "./fetchAll";
+import { default as fetchOpportunityTypes } from "./fetchOpportunityTypes";
 import { default as count } from "./count";
 import { default as fetch } from "./[id]/fetch";
 import { default as refresh } from "./[id]/refresh";
-import { default as forecasts } from "./[id]/forecasts";
+import { default as products } from "./[id]/products";
+import { default as resequenceProducts } from "./[id]/resequenceProducts";
 import { default as notes } from "./[id]/notes";
+import { default as fetchNote } from "./[id]/fetchNote";
+import { default as createNote } from "./[id]/createNote";
+import { default as updateNote } from "./[id]/updateNote";
+import { default as deleteNote } from "./[id]/deleteNote";
 import { default as contacts } from "./[id]/contacts";
 
-export { count, fetch, fetchAll, forecasts, notes, contacts, refresh };
+export {
+  count,
+  fetch,
+  fetchAll,
+  fetchOpportunityTypes,
+  products,
+  resequenceProducts,
+  notes,
+  fetchNote,
+  createNote,
+  updateNote,
+  deleteNote,
+  contacts,
+  refresh,
+};

src/api/unifi/site/fetch.ts

@@ -3,6 +3,7 @@ import { unifiSites } from "../../../managers/unifiSites";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/unifi/site/:id */
 export default createRoute(
@@ -10,9 +11,16 @@ export default createRoute(
   ["/site/:id"],
   async (c) => {
     const site = await unifiSites.fetch(c.req.param("id"));
+
+    const gatedData = await processObjectValuePerms(
+      site,
+      "obj.unifiSite",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "UniFi Site Fetched Successfully!",
-      site,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/unifi/sites/fetchAll.ts

@@ -3,6 +3,7 @@ import { unifiSites } from "../../../managers/unifiSites";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { ContentfulStatusCode } from "hono/utils/http-status";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/unifi/sites */
 export default createRoute(
@@ -10,9 +11,16 @@ export default createRoute(
   ["/sites"],
   async (c) => {
     const sites = await unifiSites.fetchAll();
+
+    const gatedData = await Promise.all(
+      sites.map((site) =>
+        processObjectValuePerms(site, "obj.unifiSite", c.get("user")),
+      ),
+    );
+
     const response = apiResponse.successful(
       "UniFi Sites Fetched Successfully!",
-      sites,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/user/@me/fetch.ts

@@ -2,16 +2,20 @@ import { ContentfulStatusCode } from "hono/utils/http-status";
 import { apiResponse } from "../../../modules/api-utils/apiResponse";
 import { createRoute } from "../../../modules/api-utils/createRoute";
 import { authMiddleware } from "../../middleware/authorization";
+import { processObjectValuePerms } from "../../../modules/permission-utils/processObjectPermissions";
 
 // /v1/user/@me
 export default createRoute(
   "get",
   ["/@me"],
-  (c) => {
-    const response = apiResponse.successful(
-      "Fetched user.",
+  async (c) => {
+    const gatedData = await processObjectValuePerms(
       c.get("user")?.toJson(),
+      "obj.user",
+      c.get("user"),
     );
+
+    const response = apiResponse.successful("Fetched user.", gatedData);
     return c.json(response, response.status as ContentfulStatusCode);
   },
   authMiddleware({ scopes: ["user.read"] }),

src/api/user/fetch.ts

@@ -4,6 +4,7 @@ import { createRoute } from "../../modules/api-utils/createRoute";
 import { authMiddleware } from "../middleware/authorization";
 import { users } from "../../managers/users";
 import GenericError from "../../Errors/GenericError";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/user/users/:identifier */
 export default createRoute(
@@ -21,9 +22,15 @@ export default createRoute(
         status: 404,
       });
 
+    const gatedData = await processObjectValuePerms(
+      user.toJson(),
+      "obj.user",
+      c.get("user"),
+    );
+
     const response = apiResponse.successful(
       "User Fetched Successfully!",
-      user.toJson(),
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/user/fetchAll.ts

@@ -3,6 +3,7 @@ import { apiResponse } from "../../modules/api-utils/apiResponse";
 import { createRoute } from "../../modules/api-utils/createRoute";
 import { authMiddleware } from "../middleware/authorization";
 import { users } from "../../managers/users";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/user/users */
 export default createRoute(
@@ -11,11 +12,16 @@ export default createRoute(
 
   async (c) => {
     const allUsers = await users.fetchAllUsers();
-    const usersArray = allUsers.map((u) => u.toJson());
+
+    const gatedData = await Promise.all(
+      allUsers.map((u) =>
+        processObjectValuePerms(u.toJson(), "obj.user", c.get("user")),
+      ),
+    );
 
     const response = apiResponse.successful(
       "Users Fetched Successfully!",
-      usersArray,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },

src/api/user/fetchRoles.ts

@@ -4,6 +4,7 @@ import { createRoute } from "../../modules/api-utils/createRoute";
 import { authMiddleware } from "../middleware/authorization";
 import { users } from "../../managers/users";
 import GenericError from "../../Errors/GenericError";
+import { processObjectValuePerms } from "../../modules/permission-utils/processObjectPermissions";
 
 /* GET /v1/user/users/:identifier/roles */
 export default createRoute(
@@ -22,11 +23,20 @@ export default createRoute(
       });
 
     const roles = await user.fetchRoles();
-    const rolesArray = roles.map((r) => r.toJson({ viewPermissions: true }));
+
+    const gatedData = await Promise.all(
+      roles.map((r) =>
+        processObjectValuePerms(
+          r.toJson({ viewPermissions: true }),
+          "obj.role",
+          c.get("user"),
+        ),
+      ),
+    );
 
     const response = apiResponse.successful(
       "User Roles Fetched Successfully!",
-      rolesArray,
+      gatedData,
     );
     return c.json(response, response.status as ContentfulStatusCode);
   },