up

src/Notifier/StellaOps.Notifier/StellaOps.Notifier.WebService/Program.cs

@@ -118,6 +118,50 @@ app.MapPost("/api/v1/notify/pack-approvals", async (
     return Results.Accepted();
 });
 
+app.MapPost("/api/v1/notify/pack-approvals/{packId}/ack", async (
+    HttpContext context,
+    string packId,
+    PackApprovalAckRequest request,
+    INotifyLockRepository locks,
+    INotifyAuditRepository audit,
+    TimeProvider timeProvider) =>
+{
+    var tenantId = context.Request.Headers["X-StellaOps-Tenant"].ToString();
+    if (string.IsNullOrWhiteSpace(tenantId))
+    {
+        return Results.BadRequest(Error("tenant_missing", "X-StellaOps-Tenant header is required.", context));
+    }
+
+    if (string.IsNullOrWhiteSpace(request.AckToken))
+    {
+        return Results.BadRequest(Error("ack_token_missing", "AckToken is required.", context));
+    }
+
+    var lockKey = $"pack-approvals-ack|{tenantId}|{packId}|{request.AckToken}";
+    var reserved = await locks.TryAcquireAsync(tenantId, lockKey, "pack-approvals-ack", TimeSpan.FromMinutes(10), context.RequestAborted)
+        .ConfigureAwait(false);
+
+    if (!reserved)
+    {
+        return Results.StatusCode(StatusCodes.Status200OK);
+    }
+
+    var auditEntry = new NotifyAuditEntryDocument
+    {
+        TenantId = tenantId,
+        Actor = "pack-approvals-ack",
+        Action = "pack.approval.acknowledged",
+        EntityId = packId,
+        EntityType = "pack-approval",
+        Timestamp = timeProvider.GetUtcNow(),
+        Payload = MongoDB.Bson.Serialization.BsonSerializer.Deserialize<MongoDB.Bson.BsonDocument>(JsonSerializer.Serialize(request))
+    };
+
+    await audit.AppendAsync(auditEntry, context.RequestAborted).ConfigureAwait(false);
+
+    return Results.NoContent();
+});
+
 app.MapGet("/.well-known/openapi", (HttpContext context, OpenApiDocumentCache cache) =>
 {
     context.Response.Headers.CacheControl = "public, max-age=300";