@dev.smartpricing/platform-layer 0.0.5 → 0.0.6

package/_shared/billingGeo.ts

@@ -0,0 +1,158 @@
+/**
+ * Static geo/billing lists for the legal-entity form dropdowns.
+ *
+ * The three code lists mirror the PostgreSQL enums core-api enforces on
+ * `legal_entities` (see `core-api/packages/db-schema/src/schema/enums.ts`:
+ * `iso_a2_country_code`, `vat_number_prefix_type`, `iso_phone_country_code`).
+ * Anything outside these lists is rejected server-side with a 400, so the
+ * UI must not offer it. Keep them in sync when core-api adds values.
+ */
+
+/** ISO 3166-1 alpha-2 billing countries (`iso_a2_country_code`). Note "IC"
+ * (Canary Islands) is a tax territory with no `Intl.DisplayNames` name —
+ * label it via the fallback. */
+export const ISO_A2_COUNTRY_CODES = [
+  'AD', 'AE', 'AF', 'AG', 'AI', 'AL', 'AM', 'AO', 'AQ', 'AR', 'AS', 'AT', 'AU', 'AW', 'AX', 'AZ',
+  'BA', 'BB', 'BD', 'BE', 'BF', 'BG', 'BH', 'BI', 'BJ', 'BL', 'BM', 'BN', 'BO', 'BQ', 'BR', 'BS',
+  'BT', 'BV', 'BW', 'BY', 'BZ', 'CA', 'CC', 'CD', 'CF', 'CG', 'CH', 'CI', 'CK', 'CL', 'CM', 'CN',
+  'CO', 'CR', 'CU', 'CV', 'CW', 'CX', 'CY', 'CZ', 'DE', 'DJ', 'DK', 'DM', 'DO', 'DZ', 'EC', 'EE',
+  'EG', 'EH', 'ER', 'ES', 'ET', 'FI', 'FJ', 'FK', 'FM', 'FO', 'FR', 'GA', 'GB', 'GD', 'GE', 'GF',
+  'GG', 'GH', 'GI', 'GL', 'GM', 'GN', 'GP', 'GQ', 'GR', 'GS', 'GT', 'GU', 'GW', 'GY', 'HK', 'HM',
+  'HN', 'HR', 'HT', 'HU', 'IC', 'ID', 'IE', 'IL', 'IM', 'IN', 'IO', 'IQ', 'IR', 'IS', 'IT', 'JE',
+  'JM', 'JO', 'JP', 'KE', 'KG', 'KH', 'KI', 'KM', 'KN', 'KP', 'KR', 'KW', 'KY', 'KZ', 'LA', 'LB',
+  'LC', 'LI', 'LK', 'LR', 'LS', 'LT', 'LU', 'LV', 'LY', 'MA', 'MC', 'MD', 'ME', 'MF', 'MG', 'MH',
+  'MK', 'ML', 'MM', 'MN', 'MO', 'MP', 'MQ', 'MR', 'MS', 'MT', 'MU', 'MV', 'MW', 'MX', 'MY', 'MZ',
+  'NA', 'NC', 'NE', 'NF', 'NG', 'NI', 'NL', 'NO', 'NP', 'NR', 'NU', 'NZ', 'OM', 'PA', 'PE', 'PF',
+  'PG', 'PH', 'PK', 'PL', 'PM', 'PN', 'PR', 'PS', 'PT', 'PW', 'PY', 'QA', 'RE', 'RO', 'RS', 'RU',
+  'RW', 'SA', 'SB', 'SC', 'SD', 'SE', 'SG', 'SH', 'SI', 'SJ', 'SK', 'SL', 'SM', 'SN', 'SO', 'SR',
+  'SS', 'ST', 'SV', 'SX', 'SY', 'SZ', 'TC', 'TD', 'TF', 'TG', 'TH', 'TJ', 'TK', 'TL', 'TM', 'TN',
+  'TO', 'TR', 'TT', 'TV', 'TW', 'TZ', 'UA', 'UG', 'UM', 'US', 'UY', 'UZ', 'VA', 'VC', 'VE', 'VG',
+  'VI', 'VN', 'VU', 'WF', 'WS', 'YE', 'YT', 'ZA', 'ZM', 'ZW',
+] as const
+
+/** VAT-number prefixes (`vat_number_prefix_type`): the country list plus the
+ * VAT-only codes "EL" (Greece) and "XI" (Northern Ireland). */
+export const VAT_NUMBER_PREFIXES = [
+  'AD', 'AE', 'AF', 'AG', 'AI', 'AL', 'AM', 'AO', 'AQ', 'AR', 'AS', 'AT', 'AU', 'AW', 'AX', 'AZ',
+  'BA', 'BB', 'BD', 'BE', 'BF', 'BG', 'BH', 'BI', 'BJ', 'BL', 'BM', 'BN', 'BO', 'BQ', 'BR', 'BS',
+  'BT', 'BV', 'BW', 'BY', 'BZ', 'CA', 'CC', 'CD', 'CF', 'CG', 'CH', 'CI', 'CK', 'CL', 'CM', 'CN',
+  'CO', 'CR', 'CU', 'CV', 'CW', 'CX', 'CY', 'CZ', 'DE', 'DJ', 'DK', 'DM', 'DO', 'DZ', 'EC', 'EE',
+  'EG', 'EH', 'EL', 'ER', 'ES', 'ET', 'FI', 'FJ', 'FK', 'FM', 'FO', 'FR', 'GA', 'GB', 'GD', 'GE',
+  'GF', 'GG', 'GH', 'GI', 'GL', 'GM', 'GN', 'GP', 'GQ', 'GR', 'GS', 'GT', 'GU', 'GW', 'GY', 'HK',
+  'HM', 'HN', 'HR', 'HT', 'HU', 'IC', 'ID', 'IE', 'IL', 'IM', 'IN', 'IO', 'IQ', 'IR', 'IS', 'IT',
+  'JE', 'JM', 'JO', 'JP', 'KE', 'KG', 'KH', 'KI', 'KM', 'KN', 'KP', 'KR', 'KW', 'KY', 'KZ', 'LA',
+  'LB', 'LC', 'LI', 'LK', 'LR', 'LS', 'LT', 'LU', 'LV', 'LY', 'MA', 'MC', 'MD', 'ME', 'MF', 'MG',
+  'MH', 'MK', 'ML', 'MM', 'MN', 'MO', 'MP', 'MQ', 'MR', 'MS', 'MT', 'MU', 'MV', 'MW', 'MX', 'MY',
+  'MZ', 'NA', 'NC', 'NE', 'NF', 'NG', 'NI', 'NL', 'NO', 'NP', 'NR', 'NU', 'NZ', 'OM', 'PA', 'PE',
+  'PF', 'PG', 'PH', 'PK', 'PL', 'PM', 'PN', 'PR', 'PS', 'PT', 'PW', 'PY', 'QA', 'RE', 'RO', 'RS',
+  'RU', 'RW', 'SA', 'SB', 'SC', 'SD', 'SE', 'SG', 'SH', 'SI', 'SJ', 'SK', 'SL', 'SM', 'SN', 'SO',
+  'SR', 'SS', 'ST', 'SV', 'SX', 'SY', 'SZ', 'TC', 'TD', 'TF', 'TG', 'TH', 'TJ', 'TK', 'TL', 'TM',
+  'TN', 'TO', 'TR', 'TT', 'TV', 'TW', 'TZ', 'UA', 'UG', 'UM', 'US', 'UY', 'UZ', 'VA', 'VC', 'VE',
+  'VG', 'VI', 'VN', 'VU', 'WF', 'WS', 'XI', 'YE', 'YT', 'ZA', 'ZM', 'ZW',
+] as const
+
+/** International calling codes, digits only — exactly the values
+ * `iso_phone_country_code` accepts ("+39" is rejected server-side). */
+export const PHONE_COUNTRY_CODES = [
+  '1', '7', '20', '27', '30', '31', '32', '33', '34', '36', '39', '40', '41', '43', '44', '45',
+  '46', '47', '48', '49', '51', '52', '53', '54', '55', '56', '57', '58', '60', '61', '62', '63',
+  '64', '65', '66', '81', '82', '84', '86', '90', '91', '92', '93', '94', '95', '98', '211', '212',
+  '213', '216', '218', '220', '221', '222', '223', '224', '225', '226', '227', '228', '229', '230',
+  '231', '232', '233', '234', '235', '236', '237', '238', '239', '240', '241', '242', '243', '244',
+  '245', '246', '247', '248', '249', '250', '251', '252', '253', '254', '255', '256', '257', '258',
+  '260', '261', '262', '263', '264', '265', '266', '267', '268', '269', '290', '291', '297', '298',
+  '299', '350', '351', '352', '353', '354', '355', '356', '357', '358', '359', '370', '371', '372',
+  '373', '374', '375', '376', '377', '378', '380', '381', '382', '383', '385', '386', '387', '389',
+  '420', '421', '423', '500', '501', '502', '503', '504', '505', '506', '507', '508', '509', '590',
+  '591', '592', '593', '594', '595', '596', '597', '598', '599', '670', '672', '673', '674', '675',
+  '676', '677', '678', '679', '680', '681', '682', '683', '685', '686', '687', '688', '689', '690',
+  '691', '692', '850', '852', '853', '855', '856', '880', '886', '960', '961', '962', '963', '964',
+  '965', '966', '967', '968', '970', '971', '972', '973', '974', '975', '976', '977', '992', '993',
+  '994', '995', '996', '998',
+] as const
+
+/**
+ * Representative ISO region per calling code, used ONLY for dropdown labels
+ * ("+39 · Italia"). Shared codes show their main region (libphonenumber's
+ * "main country for code": +1 → US, +7 → RU, ...) without enumerating the
+ * others — the stored value is the calling code, so the ambiguity is purely
+ * cosmetic. "AC" (+247) and "XK" (+383) are not ISO 3166 codes and fall back
+ * to the bare code in `Intl.DisplayNames` lookups.
+ */
+export const PHONE_CODE_PRIMARY_REGION: Record<string, string> = {
+  1: 'US', 7: 'RU', 20: 'EG', 27: 'ZA', 30: 'GR', 31: 'NL', 32: 'BE', 33: 'FR', 34: 'ES',
+  36: 'HU', 39: 'IT', 40: 'RO', 41: 'CH', 43: 'AT', 44: 'GB', 45: 'DK', 46: 'SE', 47: 'NO',
+  48: 'PL', 49: 'DE', 51: 'PE', 52: 'MX', 53: 'CU', 54: 'AR', 55: 'BR', 56: 'CL', 57: 'CO',
+  58: 'VE', 60: 'MY', 61: 'AU', 62: 'ID', 63: 'PH', 64: 'NZ', 65: 'SG', 66: 'TH', 81: 'JP',
+  82: 'KR', 84: 'VN', 86: 'CN', 90: 'TR', 91: 'IN', 92: 'PK', 93: 'AF', 94: 'LK', 95: 'MM',
+  98: 'IR', 211: 'SS', 212: 'MA', 213: 'DZ', 216: 'TN', 218: 'LY', 220: 'GM', 221: 'SN',
+  222: 'MR', 223: 'ML', 224: 'GN', 225: 'CI', 226: 'BF', 227: 'NE', 228: 'TG', 229: 'BJ',
+  230: 'MU', 231: 'LR', 232: 'SL', 233: 'GH', 234: 'NG', 235: 'TD', 236: 'CF', 237: 'CM',
+  238: 'CV', 239: 'ST', 240: 'GQ', 241: 'GA', 242: 'CG', 243: 'CD', 244: 'AO', 245: 'GW',
+  246: 'IO', 247: 'AC', 248: 'SC', 249: 'SD', 250: 'RW', 251: 'ET', 252: 'SO', 253: 'DJ',
+  254: 'KE', 255: 'TZ', 256: 'UG', 257: 'BI', 258: 'MZ', 260: 'ZM', 261: 'MG', 262: 'RE',
+  263: 'ZW', 264: 'NA', 265: 'MW', 266: 'LS', 267: 'BW', 268: 'SZ', 269: 'KM', 290: 'SH',
+  291: 'ER', 297: 'AW', 298: 'FO', 299: 'GL', 350: 'GI', 351: 'PT', 352: 'LU', 353: 'IE',
+  354: 'IS', 355: 'AL', 356: 'MT', 357: 'CY', 358: 'FI', 359: 'BG', 370: 'LT', 371: 'LV',
+  372: 'EE', 373: 'MD', 374: 'AM', 375: 'BY', 376: 'AD', 377: 'MC', 378: 'SM', 380: 'UA',
+  381: 'RS', 382: 'ME', 383: 'XK', 385: 'HR', 386: 'SI', 387: 'BA', 389: 'MK', 420: 'CZ',
+  421: 'SK', 423: 'LI', 500: 'FK', 501: 'BZ', 502: 'GT', 503: 'SV', 504: 'HN', 505: 'NI',
+  506: 'CR', 507: 'PA', 508: 'PM', 509: 'HT', 590: 'GP', 591: 'BO', 592: 'GY', 593: 'EC',
+  594: 'GF', 595: 'PY', 596: 'MQ', 597: 'SR', 598: 'UY', 599: 'CW', 670: 'TL', 672: 'NF',
+  673: 'BN', 674: 'NR', 675: 'PG', 676: 'TO', 677: 'SB', 678: 'VU', 679: 'FJ', 680: 'PW',
+  681: 'WF', 682: 'CK', 683: 'NU', 685: 'WS', 686: 'KI', 687: 'NC', 688: 'TV', 689: 'PF',
+  690: 'TK', 691: 'FM', 692: 'MH', 850: 'KP', 852: 'HK', 853: 'MO', 855: 'KH', 856: 'LA',
+  880: 'BD', 886: 'TW', 960: 'MV', 961: 'LB', 962: 'JO', 963: 'SY', 964: 'IQ', 965: 'KW',
+  966: 'SA', 967: 'YE', 968: 'OM', 970: 'PS', 971: 'AE', 972: 'IL', 973: 'BH', 974: 'QA',
+  975: 'BT', 976: 'MN', 977: 'NP', 992: 'TJ', 993: 'TM', 994: 'AZ', 995: 'GE', 996: 'KG',
+  998: 'UZ',
+}
+
+/**
+ * Countries whose VAT prefix differs from their ISO code. Same mapping as
+ * core-api (`packages/chargebee-schema/src/customers.ts`) and
+ * sp-checkout-frontend: Greece uses "EL" on VATINs.
+ */
+export const COUNTRY_TO_VAT_PREFIX: Record<string, string> = { GR: 'EL' }
+
+/** Derives the VAT prefix to preselect for a billing country (GR → EL). */
+export function countryToVatPrefix(country: string | null | undefined): string | null {
+  if (!country) return null
+  return COUNTRY_TO_VAT_PREFIX[country] ?? country
+}
+
+/**
+ * Normalizes a user-typed phone prefix to the digits-only form the core-api
+ * enum accepts: strips "+", spaces and any other non-digit ("+39 " → "39").
+ * Returns the digits, or '' when nothing is left.
+ */
+export function normalizePhonePrefix(input: string): string {
+  return input.replace(/\D/g, '')
+}
+
+/**
+ * E-invoice routing-code (codice destinatario / `cf_PR_address_code`)
+ * placeholders, mirroring core-api's enforcement matrix
+ * (`normalizeEinvoiceRoutingCodeOrThrow` in `legal-entities/service.ts`):
+ *  - non-IT (any type)        → "XXXXXXX"
+ *  - IT natural_person        → "0000000"
+ *  - IT legal_person          → any 7-char alphanumeric SDI code ("0000000"
+ *                               when invoices are delivered via PEC)
+ */
+export const IT_EINVOICE_PLACEHOLDER = '0000000'
+export const NON_IT_EINVOICE_PLACEHOLDER = 'XXXXXXX'
+export const SDI_CODE_REGEX = /^[A-Za-z0-9]{7}$/
+
+/**
+ * The locked routing-code value for a country/entity-type pair, or null when
+ * the field is freely editable (Italian businesses).
+ */
+export function fixedEinvoiceRoutingCode(
+  countryCode: string | null | undefined,
+  entityType: 'natural_person' | 'legal_person' | null | undefined,
+): string | null {
+  if (!countryCode || !entityType) return null
+  if (countryCode !== 'IT') return NON_IT_EINVOICE_PLACEHOLDER
+  if (entityType === 'natural_person') return IT_EINVOICE_PLACEHOLDER
+  return null
+}

package/_shared/billingLegalEntities.ts

@@ -1,6 +1,29 @@
 import { z } from 'zod'
+import {
+  ISO_A2_COUNTRY_CODES,
+  normalizePhonePrefix,
+  PHONE_COUNTRY_CODES,
+  SDI_CODE_REGEX,
+  VAT_NUMBER_PREFIXES,
+} from './billingGeo.js'
 import { UuidSchema } from './common.js'
 
+const COUNTRY_CODE_SET = new Set<string>(ISO_A2_COUNTRY_CODES)
+const VAT_PREFIX_SET = new Set<string>(VAT_NUMBER_PREFIXES)
+const PHONE_CODE_SET = new Set<string>(PHONE_COUNTRY_CODES)
+
+/** "+39 " → "39", then membership in core-api's `iso_phone_country_code` enum. */
+const PhoneCountryCodeSchema = z
+  .string()
+  .transform(normalizePhonePrefix)
+  .refine(v => PHONE_CODE_SET.has(v), { message: 'Unknown phone country code' })
+const CountryCodeSchema = z
+  .string()
+  .refine(v => COUNTRY_CODE_SET.has(v), { message: 'Unknown country code' })
+const VatNumberPrefixSchema = z
+  .string()
+  .refine(v => VAT_PREFIX_SET.has(v), { message: 'Unknown VAT number prefix' })
+
 export const LegalEntityTypeSchema = z.enum(['natural_person', 'legal_person'])
 
 /**
@@ -54,6 +77,12 @@ export const LegalEntityDetailSchema = z.object({
   einvoiceRoutingCode: z.string(),
   createdAt: z.string(),
   updatedAt: z.string(),
+  /**
+   * PATCH responses only: true when Chargebee/VIES rejected the VAT and
+   * core-api stored it as "unverified" instead of the validated field. The
+   * edit modal surfaces this as a warning toast.
+   */
+  vatNumberUnverified: z.boolean().optional(),
 })
 
 /**
@@ -68,17 +97,21 @@ export const UpdateLegalEntityRequestSchema = z.object({
   companyName: z.string().optional(),
   email: z.string().email().optional(),
   pec: z.string().nullable().optional(),
-  phoneCountryCode: z.string().nullable().optional(),
+  phoneCountryCode: PhoneCountryCodeSchema.nullable().optional(),
   phone: z.string().nullable().optional(),
   address: z.string().optional(),
   postcode: z.string().optional(),
   city: z.string().optional(),
-  state: z.string().optional(),
-  countryCode: z.string().optional(),
-  vatNumberPrefix: z.string().optional(),
+  // Always the 2-character state/province code (TN, NY, 75, …) — core-api
+  // rejects anything else and uppercases on write.
+  state: z.string().regex(/^[A-Za-z0-9]{2}$/).optional(),
+  countryCode: CountryCodeSchema.optional(),
+  vatNumberPrefix: VatNumberPrefixSchema.optional(),
   vatNumber: z.string().optional(),
   taxCode: z.string().optional(),
-  einvoiceRoutingCode: z.string().optional(),
+  // 7 alphanumeric chars: real SDI codes and both placeholders ("0000000",
+  // "XXXXXXX") pass; core-api enforces the full country/type matrix.
+  einvoiceRoutingCode: z.string().regex(SDI_CODE_REGEX).optional(),
 })
 
 /**

package/_shared/billingPaymentMethods.ts

@@ -74,7 +74,13 @@ export const CreatePaymentMethodRequestSchema = z.discriminatedUnion('type', [
 /** One item for a card, one per customer for the IBAN fan-out, plus per-customer failures. */
 export const CreatePaymentMethodsResponseSchema = z.object({
   items: z.array(PaymentMethodSchema),
-  failed: z.array(z.object({ customerId: UuidSchema, reason: z.string() })),
+  failed: z.array(z.object({
+    customerId: UuidSchema,
+    /** Provider message for logs/ops — never shown to the customer. */
+    reason: z.string(),
+    /** Machine-readable failure code (Chargebee api_error_code) the UI maps to localized copy. Optional during core-api rollout. */
+    code: z.string().optional(),
+  })),
 })
 
 export type PaymentMethodType = z.infer<typeof PaymentMethodTypeSchema>

package/_shared/index.ts

@@ -14,6 +14,7 @@ export * from './billingInvoices.js'
 export * from './billingCreditNotes.js'
 export * from './billingPaymentMethods.js'
 export * from './billingLegalEntities.js'
+export * from './billingGeo.js'
 export * from './billingOverview.js'
 export * from './billingDocuments.js'
 export * from './crossSelling.js'

package/_shared/permissions.ts

@@ -1,7 +1,14 @@
 import { z } from 'zod'
 
 const BundleSchema = z.object({
+  /** Has an active or trial billing subscription. */
+  subscribed: z.boolean(),
+  /** Lifecycle product_access capability is on. */
   enabled: z.boolean(),
+  /** Subscribed but blocked by overdue invoices (unpaid past grace). */
+  overdue: z.boolean(),
+  /** Computed: subscribed && enabled — can the user enter the product. */
+  canAccess: z.boolean(),
 })
 
 export const PermissionsResponseSchema = z.object({

package/_shared/products.ts

@@ -15,7 +15,7 @@ export const SuiteLinkSchema = z.object({
 export const OrgProductStatusSchema = z.enum(['active', 'trial', 'not_subscribed'])
 
 /**
- * Billing context surfaced when a paying customer cannot access a product —
+ * Billing context surfaced when a overdue customer cannot access a product —
  * lets the UI explain *why* access is blocked (e.g. an unpaid invoice).
  */
 export const ProductBlockedReasonSchema = z.object({

package/app/composables/apiClient.composable.ts

@@ -21,7 +21,11 @@ export function useApiClient() {
         },
       },
       onRefreshFailed: () => {
-        if (import.meta.client && !window.location.pathname.startsWith('/auth/login')) {
+        if (!import.meta.client) return
+        // An accounting-token exchange is in flight (00.accounting-token
+        // middleware) — redirecting to login now would clobber it.
+        if (new URLSearchParams(window.location.search).has('accounting_token')) return
+        if (!isPublicAuthRoute(window.location.pathname)) {
           window.location.assign(`${PLATFORM_URL}/auth/login`)
         }
       },

package/app/composables/useProductSwitcher.composable.ts

@@ -1,6 +1,38 @@
-import type { SuiteProduct } from 'nuxt-ui-layer/types'
+import type { PermissionsResponse } from '@package/platform-shared'
+import type { SuiteProduct } from 'nuxt-ui-layer/types';
 import { computed } from 'vue'
 
+type ProductKey = keyof PermissionsResponse['products']
+
+/**
+ * Product access state derived from the subscribed/enabled/overdue matrix
+ * (overdue = subscribed but blocked by unpaid invoices):
+ *
+ * | subscribed | enabled | overdue | state           | action               |
+ * |------------|---------|---------|-----------------|----------------------|
+ * | true       | true    | false   | accessible      | enter product        |
+ * | true       | false   | true    | overdue         | view unpaid invoices |
+ * | true       | false   | false   | blocked         | discovery            |
+ * | false      | true    | false   | not_subscribed  | go to billing        |
+ * | false      | false   | false   | not_subscribed  | discovery            |
+ */
+export type ProductAccessState = 'accessible' | 'overdue' | 'blocked' | 'not_subscribed'
+
+function resolveAccessState(product: { subscribed: boolean; enabled: boolean; overdue: boolean; canAccess: boolean }): ProductAccessState {
+  if (product.canAccess) return 'accessible'
+  if (product.subscribed && product.overdue) return 'overdue'
+  if (product.subscribed && !product.enabled) return 'blocked'
+  if (!product.subscribed && product.enabled) return 'not_subscribed'
+  return 'not_subscribed'
+}
+
+const PRODUCT_KEY_TO_SUITE: Record<ProductKey, SuiteProduct> = {
+  pricing: 'pricing',
+  connect: 'connect',
+  chat: 'chat',
+  smartpms: 'pms',
+}
+
 export function useProductSwitcher() {
   const { data: permissions, status } = usePermissionsQuery()
   const config = useRuntimeConfig().public
@@ -13,28 +45,27 @@ export function useProductSwitcher() {
     pms: config.PMS_APP_URL,
   }
 
-  /** All enabled product keys (from /permission + always-on "config"). */
-  const enabledProducts = computed<SuiteProduct[]>(() => {
-    // "config" is a new SuiteProduct value added in smartness-nuxt-ui — cast
-    // needed until the updated nuxt-ui-layer package is published.
-    const enabled: SuiteProduct[] = ['config' as SuiteProduct]
+  /** Access state for each suite product. */
+  const productStates = computed<Map<SuiteProduct, ProductAccessState>>(() => {
+    const map = new Map<SuiteProduct, ProductAccessState>()
+    if (!permissions.value) return map
 
-    if (!permissions.value)
-      return enabled
-
-    const products = permissions.value.products
-    const mapping: Record<string, SuiteProduct> = {
-      pricing: 'pricing',
-      connect: 'connect',
-      chat: 'chat',
-      smartpms: 'pms',
+    for (const [key, bundle] of Object.entries(permissions.value.products)) {
+      const suite = PRODUCT_KEY_TO_SUITE[key as ProductKey]
+      if (suite) {
+        map.set(suite, resolveAccessState(bundle))
+      }
     }
+    return map
+  })
 
-    for (const [key, product] of Object.entries(products)) {
-      if (product.enabled) {
-        const mapped = mapping[key]
-        if (mapped)
-          enabled.push(mapped)
+  /** Products the user can fully enter (subscribed + enabled). */
+  const enabledProducts = computed<SuiteProduct[]>(() => {
+    const enabled: SuiteProduct[] = ['config' as SuiteProduct]
+
+    for (const [suite, state] of productStates.value) {
+      if (state === 'accessible') {
+        enabled.push(suite)
       }
     }
 
@@ -46,25 +77,38 @@ export function useProductSwitcher() {
   function navigateToProduct(product?: SuiteProduct) {
     if (!product) return
 
-    const isEnabled = enabledProducts.value.includes(product)
-    if (!isEnabled) {
-      window.open(`${window.location.origin}/upgrade`, '_blank', 'noopener,noreferrer')
-      return
-    }
+    const state = productStates.value.get(product) ?? 'not_subscribed'
 
-    const url = productUrls[product]
-    if (url)
-      location.assign(url)
+    switch (state) {
+      case 'accessible': {
+        const url = productUrls[product]
+        if (url) location.assign(url)
+        break
+      }
+      case 'overdue':
+        window.open(`${productUrls.config}/account/overview`, '_blank', 'noopener,noreferrer')
+        break
+      case 'blocked':
+      case 'not_subscribed':
+        window.open(`${productUrls.config}/upgrade`, '_blank', 'noopener,noreferrer')
+        break
+    }
   }
 
   function getProductUrl(product: SuiteProduct): string | undefined {
     return productUrls[product] || undefined
   }
 
+  function getProductState(product: SuiteProduct): ProductAccessState {
+    return productStates.value.get(product) ?? 'not_subscribed'
+  }
+
   return {
     enabledProducts,
+    productStates,
     isLoading,
     navigateToProduct,
     getProductUrl,
+    getProductState,
   }
 }

package/app/queries/useBillingDocumentPdf.query.ts

@@ -18,5 +18,6 @@ export function useBillingDocumentPdfQuery(
       `/api/orgs/${encodeURIComponent(toValue(orgId))}/billing/documents/${toValue(type)}/${encodeURIComponent(toValue(id))}/pdf`,
     ),
     enabled: () => !!toValue(orgId) && !!toValue(id),
+    staleTime: 0,
   })
 }

package/app/queries/useBillingDocuments.query.ts

@@ -31,5 +31,6 @@ export function useBillingDocumentsQuery(
       { query: toValue(params) },
     ),
     enabled: () => !!toValue(orgId),
+    staleTime: 0,
   })
 }

package/app/queries/useBillingOverview.query.ts

@@ -13,5 +13,6 @@ export function useBillingOverviewQuery(orgId: MaybeRefOrGetter<string>) {
       `/api/orgs/${encodeURIComponent(toValue(orgId))}/billing`,
     ),
     enabled: () => !!toValue(orgId),
+    staleTime: 0,
   })
 }

package/app/queries/useCrossSelling.query.ts

@@ -10,5 +10,6 @@ export function useCrossSellingQuery() {
   return useQuery({
     key: crossSellingKeys.all,
     query: () => client<GetCrossSellingResponse>('/api/me/cross-selling'),
+    staleTime: 0,
   })
 }

package/app/queries/useLegalEntity.query.ts

@@ -16,5 +16,6 @@ export function useLegalEntityQuery(
       `/api/orgs/${encodeURIComponent(toValue(orgId))}/billing/legal-entities/${encodeURIComponent(toValue(id))}`,
     ),
     enabled: () => !!toValue(orgId) && !!toValue(id),
+    staleTime: 0,
   })
 }

package/app/queries/useOrganization.query.ts

@@ -13,5 +13,6 @@ export function useOrganizationQuery(orgId: MaybeRefOrGetter<string>) {
       `/api/orgs/${encodeURIComponent(toValue(orgId))}`,
     ),
     enabled: () => !!toValue(orgId),
+    staleTime: 0,
   })
 }

package/app/queries/usePermissions.query.ts

@@ -10,5 +10,6 @@ export function usePermissionsQuery() {
   return useQuery({
     key: permissionsKeys.all,
     query: () => client<PermissionsResponse>('/api/me/permissions'),
+    staleTime: 0,
   })
 }

package/app/queries/useSession.query.ts

@@ -10,5 +10,6 @@ export function useSessionQuery() {
   return useQuery({
     key: sessionKeys.me,
     query: () => client<MeContextResponse>('/api/me'),
+    staleTime: 0,
   })
 }

package/app/utils/apiClient.utils.ts

@@ -32,12 +32,26 @@ export interface ApiClientOptions {
   onResponseError?: OnResponseErrorHook
 }
 
+function errorCode(data: unknown): string | undefined {
+  return (data as { error?: { code?: string } } | undefined)?.error?.code
+}
+
 function defaultShouldRefresh(status: number, data: unknown): boolean {
   if (status !== 401) return false
-  const code = (data as { error?: { code?: string } } | undefined)?.error?.code
+  const code = errorCode(data)
   return code === 'session.expired' || code === 'session.missing'
 }
 
+/**
+ * Codes that mean the session is dead and can't be recovered by a refresh: a tampered/corrupted or
+ * rotated-secret token (`session.invalid`), or `session.expired`/`session.missing` once a refresh
+ * has already been tried and failed. Distinct from non-session 401s (bad credentials, wrong OTP)
+ * which must NOT trigger a logout redirect.
+ */
+function isDeadSessionCode(code: string | undefined): boolean {
+  return code === 'session.invalid' || code === 'session.expired' || code === 'session.missing'
+}
+
 // Module-level refresh dedup — safe because refresh is client-only
 let refreshPromise: Promise<boolean> | null = null
 
@@ -136,6 +150,17 @@ export function createApiClient(options: ApiClientOptions) {
             serializeAndThrow(retryError)
           }
         }
+      }
+
+      // A dead-session 401 we reach here is unrecoverable: either it wasn't refresh-eligible — a
+      // tampered or rotated-secret token surfaces as `session.invalid`, which never becomes
+      // `session.expired` and so never self-heals — or the refresh above failed. Force re-auth
+      // instead of leaving the client "logged in" while every request 401s (the zombie state: a JWT
+      // secret rotation would drop all active users into it at once). onRefreshFailed does a hard
+      // redirect to login, which reloads the app and discards the stale in-memory auth state; it
+      // self-guards against the accounting-token exchange and public auth routes. Non-session 401s
+      // (bad credentials, wrong OTP) fall through untouched so callers can surface the error.
+      if (status === 401 && isDeadSessionCode(errorCode(data))) {
         auth.onRefreshFailed?.()
       }
 

package/app/utils/auth.utils.ts

@@ -0,0 +1,18 @@
+/**
+ * Auth paths that require an active session despite living under `/auth/`.
+ * Every other `/auth/*` route is public (login, activate, password reset, etc.).
+ */
+const AUTHENTICATED_AUTH_PATHS = ['/auth/otp-step-up', '/auth/products'] as const
+
+/**
+ * Returns `true` for `/auth/*` routes that are reachable without a session
+ * (e.g. login, activate, forgot-password, reset-password).
+ *
+ * Used to:
+ * - skip the boot-time session restore (avoids a guaranteed-to-fail GET /api/me)
+ * - suppress the redirect-to-login on refresh failure
+ */
+export function isPublicAuthRoute(pathname: string): boolean {
+  if (!pathname.startsWith('/auth/')) return false
+  return !AUTHENTICATED_AUTH_PATHS.some(p => pathname.startsWith(p))
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@dev.smartpricing/platform-layer",
-  "version": "0.0.5",
+  "version": "0.0.6",
   "type": "module",
   "private": false,
   "main": "./nuxt.config.ts",
@@ -19,7 +19,7 @@
   },
   "devDependencies": {
     "nuxt": "^4.4.2",
-    "nuxt-ui-layer": "github:smartpricing/smartness-nuxt-ui#v1.6.19-platform.0",
+    "nuxt-ui-layer": "github:smartpricing/smartness-nuxt-ui#v1.7.1-platform.1",
     "vue": "latest"
   },
   "peerDependencies": {