@open-mercato/cli 0.10.1-develop.7792.1.b0ce6289cf → 0.10.1-develop.7796.1.f2868e5c62

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/cli",
-  "version": "0.10.1-develop.7792.1.b0ce6289cf",
+  "version": "0.10.1-develop.7796.1.f2868e5c62",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -60,10 +60,10 @@
     "@mikro-orm/decorators": "^7.1.14",
     "@mikro-orm/migrations": "^7.1.14",
     "@mikro-orm/postgresql": "^7.1.14",
-    "@open-mercato/events": "0.10.1-develop.7792.1.b0ce6289cf",
-    "@open-mercato/queue": "0.10.1-develop.7792.1.b0ce6289cf",
-    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf",
-    "@open-mercato/telemetry": "0.10.1-develop.7792.1.b0ce6289cf",
+    "@open-mercato/events": "0.10.1-develop.7796.1.f2868e5c62",
+    "@open-mercato/queue": "0.10.1-develop.7796.1.f2868e5c62",
+    "@open-mercato/shared": "0.10.1-develop.7796.1.f2868e5c62",
+    "@open-mercato/telemetry": "0.10.1-develop.7796.1.f2868e5c62",
     "cross-spawn": "^7.0.6",
     "minisearch": "7.2.0",
     "pg": "8.23.0",
@@ -75,10 +75,10 @@
     "typescript-js": "npm:typescript@6.0.3"
   },
   "peerDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf"
+    "@open-mercato/shared": "0.10.1-develop.7796.1.f2868e5c62"
   },
   "devDependencies": {
-    "@open-mercato/shared": "0.10.1-develop.7792.1.b0ce6289cf",
+    "@open-mercato/shared": "0.10.1-develop.7796.1.f2868e5c62",
     "@types/jest": "^30.0.0",
     "jest": "^30.4.2",
     "ts-jest": "^29.4.12"

package/src/__tests__/mercato.test.ts

@@ -1153,6 +1153,118 @@ describe('init command failure output', () => {
     consoleErrorSpy.mockRestore()
     consoleLogSpy.mockRestore()
   })
+
+  it('derives admin/employee emails from the --email domain, not the acme.com default (#5806)', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+
+    let adminEmailAtSetupTime: string | undefined
+    let employeeEmailAtSetupTime: string | undefined
+    // Reads OM_INIT_ADMIN_EMAIL/OM_INIT_EMPLOYEE_EMAIL at call time, mirroring what the
+    // real `auth setup` -> setupInitialTenant reads. `runModuleCommand` invokes this
+    // in-process (not spawned), so the env vars `mercato init` sets right before this
+    // call are visible here exactly as they would be for the real command.
+    const authSetup = jest.fn().mockImplementation(async () => {
+      adminEmailAtSetupTime = process.env.OM_INIT_ADMIN_EMAIL
+      employeeEmailAtSetupTime = process.env.OM_INIT_EMPLOYEE_EMAIL
+    })
+    mockInitDependencies({ authSetup })
+
+    const mercato = await import('../mercato')
+    const exitCode = await mercato.run([
+      'node',
+      'mercato',
+      'init',
+      '--email=superadmin@example.org',
+      '--password=Strong-Pa55!!',
+    ])
+
+    expect(exitCode).toBe(0)
+    expect(authSetup).toHaveBeenCalled()
+    expect(adminEmailAtSetupTime).toBe('admin@example.org')
+    expect(employeeEmailAtSetupTime).toBe('employee@example.org')
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+    consoleErrorSpy.mockRestore()
+    consoleLogSpy.mockRestore()
+  })
+
+  it('does not set OM_INIT_ADMIN_EMAIL when it would equal the superadmin email (#5806)', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+
+    let adminEmailAtSetupTime: string | undefined
+    let employeeEmailAtSetupTime: string | undefined
+    const authSetup = jest.fn().mockImplementation(async () => {
+      adminEmailAtSetupTime = process.env.OM_INIT_ADMIN_EMAIL
+      employeeEmailAtSetupTime = process.env.OM_INIT_EMPLOYEE_EMAIL
+    })
+    mockInitDependencies({ authSetup })
+
+    const mercato = await import('../mercato')
+    const exitCode = await mercato.run([
+      'node',
+      'mercato',
+      'init',
+      '--email=admin@example.org',
+      '--password=Strong-Pa55!!',
+    ])
+
+    expect(exitCode).toBe(0)
+    expect(authSetup).toHaveBeenCalled()
+    // Derived admin@example.org would collide with the superadmin — leave unset so
+    // deactivateDemoUsersIfSelfOnboardingEnabled cannot lock the primary account out.
+    expect(adminEmailAtSetupTime).toBeUndefined()
+    expect(employeeEmailAtSetupTime).toBe('employee@example.org')
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+    consoleErrorSpy.mockRestore()
+    consoleLogSpy.mockRestore()
+  })
+
+  it('does not set OM_INIT_*_EMAIL when --no-demo-users is passed (#5806)', async () => {
+    const consoleErrorSpy = jest.spyOn(console, 'error').mockImplementation()
+    const consoleLogSpy = jest.spyOn(console, 'log').mockImplementation()
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+
+    let adminEmailAtSetupTime: string | undefined
+    let employeeEmailAtSetupTime: string | undefined
+    const authSetup = jest.fn().mockImplementation(async () => {
+      adminEmailAtSetupTime = process.env.OM_INIT_ADMIN_EMAIL
+      employeeEmailAtSetupTime = process.env.OM_INIT_EMPLOYEE_EMAIL
+    })
+    mockInitDependencies({ authSetup })
+
+    const mercato = await import('../mercato')
+    const exitCode = await mercato.run([
+      'node',
+      'mercato',
+      'init',
+      '--email=superadmin@example.org',
+      '--password=Strong-Pa55!!',
+      '--no-demo-users',
+    ])
+
+    expect(exitCode).toBe(0)
+    expect(authSetup).toHaveBeenCalled()
+    expect(adminEmailAtSetupTime).toBeUndefined()
+    expect(employeeEmailAtSetupTime).toBeUndefined()
+
+    delete process.env.OM_INIT_ADMIN_EMAIL
+    delete process.env.OM_INIT_EMPLOYEE_EMAIL
+    consoleErrorSpy.mockRestore()
+    consoleLogSpy.mockRestore()
+  })
 })
 
 describe('seed:defaults command', () => {

package/src/mercato.ts

@@ -1268,6 +1268,29 @@ export async function run(argv = process.argv) {
       if (!skipDemoUsers && employeeEmailDerived && derivedSecrets.employeePassword) {
         process.env.OM_INIT_EMPLOYEE_PASSWORD = derivedSecrets.employeePassword
       }
+      // Symmetrical with the passwords above: setupInitialTenant derives admin/employee
+      // emails from a hardcoded DEFAULT_DERIVED_EMAIL_DOMAIN ('acme.com') when these are
+      // unset, so without this the summary banner (which reads adminEmailDerived/
+      // employeeEmailDerived directly) and the actually-seeded accounts silently disagree
+      // for any --email domain other than acme.com (#5806). Skip when --no-demo-users
+      // (no accounts are created) or when the derived address equals the superadmin's
+      // own email — otherwise deactivateDemoUsersIfSelfOnboardingEnabled would treat
+      // the superadmin as a demo account and lock them out.
+      const primaryEmailLower = email.trim().toLowerCase()
+      if (
+        !skipDemoUsers &&
+        adminEmailDerived &&
+        adminEmailDerived.trim().toLowerCase() !== primaryEmailLower
+      ) {
+        process.env.OM_INIT_ADMIN_EMAIL = adminEmailDerived
+      }
+      if (
+        !skipDemoUsers &&
+        employeeEmailDerived &&
+        employeeEmailDerived.trim().toLowerCase() !== primaryEmailLower
+      ) {
+        process.env.OM_INIT_EMPLOYEE_EMAIL = employeeEmailDerived
+      }
       const roles = findArgValue(['--roles='], 'superadmin,admin,employee')
       const skipPasswordPolicyRaw = initArgs.find((arg) =>
         arg === '--skip-password-policy' ||