@open-mercato/core 0.10.1-develop.7691.1.d8af406541 → 0.10.1-develop.7699.1.5236fabda0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7691.1.d8af406541",
+  "version": "0.10.1-develop.7699.1.5236fabda0",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -265,16 +265,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7691.1.d8af406541",
-    "@open-mercato/shared": "0.10.1-develop.7691.1.d8af406541",
-    "@open-mercato/ui": "0.10.1-develop.7691.1.d8af406541",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7699.1.5236fabda0",
+    "@open-mercato/shared": "0.10.1-develop.7699.1.5236fabda0",
+    "@open-mercato/ui": "0.10.1-develop.7699.1.5236fabda0",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7691.1.d8af406541",
-    "@open-mercato/shared": "0.10.1-develop.7691.1.d8af406541",
-    "@open-mercato/ui": "0.10.1-develop.7691.1.d8af406541",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7699.1.5236fabda0",
+    "@open-mercato/shared": "0.10.1-develop.7699.1.5236fabda0",
+    "@open-mercato/ui": "0.10.1-develop.7699.1.5236fabda0",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/auth/api/autologin.ts

@@ -8,6 +8,7 @@ import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mer
 import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
 import { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'
 import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
+import { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'
 
 export const metadata = { requireAuth: false }
 
@@ -47,7 +48,8 @@ export async function GET(req: Request) {
   }
 
   const ok = await auth.verifyPassword(user, credentials.password)
-  if (!user || !ok) {
+  const tenantActive = user ? await isStaffTenantActive(container.resolve('em'), user.tenantId) : false
+  if (!user || !ok || !tenantActive) {
     // Misconfigured demo credentials — never loop; drop to the manual form.
     logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')
     return buildSafeRedirectResponse(req, '/login')

package/src/modules/auth/api/login.ts

@@ -16,6 +16,7 @@ import { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/c
 import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
 import { getAppBaseUrl, isCrossSiteBrowserRequest } from '@open-mercato/shared/lib/url'
 import { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'
+import { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'
 
 const loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {
   points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',
@@ -146,13 +147,15 @@ async function handleLoginRequest(req: Request) {
   // wrong-password, and multi-tenant cases return an identical 401 with
   // identical latency.
   const ok = await auth.verifyPassword(user, parsed.data.password)
-  if (!user || !ok || user.isConfirmed === false) {
+  const tenantActive = user ? await isStaffTenantActive(container.resolve('em'), user.tenantId) : false
+  if (!user || !ok || user.isConfirmed === false || !tenantActive) {
     // The 401 body stays identical for every branch so the response never reveals
     // which one fired. `reason` goes to the audit stream instead, where separating a
     // deactivated account from a mistyped password is the whole point — otherwise
     // repeated attempts against a disabled account look like ordinary fat-fingering.
     let reason: string
     if (user && user.isConfirmed === false) reason = 'account_deactivated'
+    else if (user && !tenantActive) reason = 'tenant_unavailable'
     else if (user?.passwordHash) reason = 'invalid_password'
     else reason = 'invalid_credentials'
     void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)

package/src/modules/auth/lib/sessionIntegrity.ts

@@ -2,6 +2,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Role, RoleAcl, Session, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
+import { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'
 
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
 const INVALID_SCOPE = Symbol('invalid-scope')
@@ -106,6 +107,7 @@ export async function resolveCanonicalStaffAuthContext(
   ) {
     return null
   }
+  if (!(await isStaffTenantActive(em, currentTenantId))) return null
 
   // Role links and the per-user super-admin flag are likewise independent, so they
   // run concurrently. The role-level super-admin lookup depends on the resolved

package/src/modules/auth/lib/tenantEligibility.ts

@@ -0,0 +1,17 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export async function isStaffTenantActive(
+  em: EntityManager,
+  tenantId: string | null | undefined,
+): Promise<boolean> {
+  if (tenantId == null) return true
+  const tenant = await findOneWithDecryption(
+    em,
+    Tenant,
+    { id: tenantId, isActive: true, deletedAt: null },
+    { fields: ['id'], refresh: true },
+  )
+  return tenant !== null
+}

package/src/modules/auth/services/authService.ts

@@ -4,6 +4,7 @@ import { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core
 import { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'
 
 // A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password
 // can match. verifyPassword compares against it whenever the user is missing or
@@ -95,6 +96,9 @@ export class AuthService {
 
 
   async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {
+    if (!(await isStaffTenantActive(this.em, user.tenantId))) {
+      throw new Error('[internal] Tenant is not available for authentication')
+    }
     const rawToken = generateAuthToken()
     const tokenHash = hashAuthToken(rawToken)
     const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)
@@ -129,6 +133,7 @@ export class AuthService {
     if (!sess || sess.expiresAt <= now) return null
     const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })
     if (!user) return null
+    if (!(await isStaffTenantActive(this.em, user.tenantId))) return null
     const roles = await this.getUserRoles(user, user.tenantId ?? null)
     return { user, roles, session: sess }
   }

package/src/modules/customer_accounts/api/admin/domain-mappings/[id]/health-check.ts

@@ -22,16 +22,16 @@ export async function POST(req: Request, ctx: { params: Promise<{ id: string }>
 
   const container = await createRequestContainer()
   const rbac = container.resolve('rbacService') as RbacService
-  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  })
-  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const { id } = await ctx.params
   const service = container.resolve('domainMappingService') as DomainMappingService
   const record = await service.findById(id, { tenantId: auth.tenantId })
   if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,

package/src/modules/customer_accounts/api/admin/domain-mappings/[id]/verify.ts

@@ -22,16 +22,16 @@ export async function POST(req: Request, ctx: { params: Promise<{ id: string }>
 
   const container = await createRequestContainer()
   const rbac = container.resolve('rbacService') as RbacService
-  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  })
-  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const { id } = await ctx.params
   const service = container.resolve('domainMappingService') as DomainMappingService
   const record = await service.findById(id, { tenantId: auth.tenantId })
   if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,

package/src/modules/customer_accounts/api/admin/domain-mappings.ts

@@ -1,12 +1,13 @@
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
-import { UniqueConstraintViolationException } from '@mikro-orm/core'
+import { UniqueConstraintViolationException, type FilterQuery } from '@mikro-orm/core'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
   validateCrudMutationGuard,
   runCrudMutationGuardAfterSuccess,
@@ -18,6 +19,7 @@ import {
   type ResolveResult,
 } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
 import { DomainMapping } from '@open-mercato/core/modules/customer_accounts/data/entities'
+import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 
 const FEATURE = 'customer_accounts.domain.manage'
 
@@ -59,7 +61,7 @@ function serializeRecord(record: DomainMapping) {
 
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
 
   const container = await createRequestContainer()
   const rbac = container.resolve('rbacService') as RbacService
@@ -71,11 +73,31 @@ export async function GET(req: Request) {
 
   const url = new URL(req.url)
   const orgFilter = url.searchParams.get('organizationId')
+  if (orgFilter && !await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: orgFilter,
+  })) {
+    return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+  }
 
   const em = container.resolve('em') as EntityManager
-  const where: Record<string, unknown> = { tenantId: auth.tenantId }
-  if (orgFilter) where.organizationId = orgFilter
-  const records = await em.find(DomainMapping, where as never, { orderBy: { createdAt: 'desc' } })
+  const where: FilterQuery<DomainMapping> = { tenantId: auth.tenantId }
+  if (orgFilter) {
+    where.organizationId = orgFilter
+  } else {
+    const featureAccess = await rbac.resolveFeatureOrganizationAccess(auth.sub, [FEATURE], { tenantId: auth.tenantId })
+    if (!featureAccess.unrestricted) {
+      const organizations = await findWithDecryption(em, Organization, {
+        tenant: auth.tenantId,
+        deletedAt: null,
+      }, { fields: ['id', 'ancestorIds'] }, { tenantId: auth.tenantId })
+      where.organizationId = { $in: featureAccess.filterOrganizationIds(organizations) }
+    }
+  }
+  const records = await findWithDecryption(em, DomainMapping, where, { orderBy: { createdAt: 'desc' } }, {
+    tenantId: auth.tenantId,
+    organizationId: orgFilter,
+  })
 
   return NextResponse.json({
     ok: true,
@@ -93,11 +115,6 @@ export async function POST(req: Request) {
 
   const container = await createRequestContainer()
   const rbac = container.resolve('rbacService') as RbacService
-  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  })
-  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const body = await readJsonSafe(req, {})
   const parsed = registerDomainSchema.safeParse(body)
@@ -107,6 +124,11 @@ export async function POST(req: Request) {
       { status: 400 },
     )
   }
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: parsed.data.organizationId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
@@ -176,11 +198,6 @@ export async function DELETE(req: Request) {
 
   const container = await createRequestContainer()
   const rbac = container.resolve('rbacService') as RbacService
-  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  })
-  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const url = new URL(req.url)
   const id = url.searchParams.get('id')
@@ -189,6 +206,11 @@ export async function DELETE(req: Request) {
   const service = container.resolve('domainMappingService') as DomainMappingService
   const existing = await service.findById(id, { tenantId: auth.tenantId })
   if (!existing) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: existing.organizationId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
 
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
@@ -248,7 +270,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'List domain mappings',
-      description: 'Returns all custom-domain mappings for the current tenant, optionally filtered by organization.',
+      description: 'Returns custom-domain mappings for authorized organizations in the current tenant, optionally filtered by organization.',
       responses: [
         {
           status: 200,

package/src/modules/customer_accounts/api/login.ts

@@ -23,6 +23,8 @@ import {
 } from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { isCrossSiteBrowserRequest } from '@open-mercato/shared/lib/url'
+import { isCustomerTenantActive } from '@open-mercato/core/modules/customer_accounts/lib/tenantEligibility'
+import type { EntityManager } from '@mikro-orm/postgresql'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -86,7 +88,7 @@ export async function POST(req: Request) {
   // password-less, inactive, locked, wrong-password, and unverified accounts all run a
   // bcrypt comparison and return the same generic 401 — lockout/deactivation guidance is
   // conveyed out-of-band (e.g. email), never in the synchronous response.
-  if (!user || !user.passwordHash) {
+  if (!user || !user.passwordHash || !(await isCustomerTenantActive(container.resolve('em') as EntityManager, tenantId))) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH)
     void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(reportLoginEventError)
     return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })

package/src/modules/customer_accounts/lib/customerAuth.ts

@@ -3,6 +3,7 @@ import { verifyAudienceJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
 import type { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
+import { isCustomerTenantActive } from './tenantEligibility'
 
 export interface CustomerAuthContext {
   sub: string
@@ -103,6 +104,7 @@ export async function validateUserState(
   if (user.sessionsRevokedAt && typeof iat === 'number' && iat * 1000 < user.sessionsRevokedAt.getTime()) {
     return { valid: false }
   }
+  if (!(await isCustomerTenantActive(em, tenantId))) return { valid: false }
 
   const { CustomerRbacService } = await import(
     '@open-mercato/core/modules/customer_accounts/services/customerRbacService'

package/src/modules/customer_accounts/lib/tenantEligibility.ts

@@ -0,0 +1,14 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { Tenant } from '@open-mercato/core/modules/directory/data/entities'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+
+export async function isCustomerTenantActive(em: EntityManager, tenantId: string): Promise<boolean> {
+  if (!tenantId) return false
+  const tenant = await findOneWithDecryption(
+    em,
+    Tenant,
+    { id: tenantId, isActive: true, deletedAt: null },
+    { refresh: true },
+  )
+  return Boolean(tenant)
+}

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -10,6 +10,7 @@ import {
 import { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'
 import { hashForLookup, lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isCustomerTenantActive } from '@open-mercato/core/modules/customer_accounts/lib/tenantEligibility'
 
 const BCRYPT_COST = 10
 const INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours
@@ -207,6 +208,7 @@ export class CustomerInvitationService {
   ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {
     const invitation = await this.findByToken(token)
     if (!invitation) return null
+    if (!(await isCustomerTenantActive(this.em, invitation.tenantId))) return null
 
     const emailHash = hashForLookup(invitation.email)
 

package/src/modules/customer_accounts/services/customerSessionService.ts

@@ -3,6 +3,7 @@ import { CustomerUser, CustomerUserSession } from '@open-mercato/core/modules/cu
 import { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'
 import { signAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isCustomerTenantActive } from '@open-mercato/core/modules/customer_accounts/lib/tenantEligibility'
 
 export const CUSTOMER_JWT_AUDIENCE = 'customer'
 const CUSTOMER_JWT_TTL_SECONDS = 60 * 60 * 8
@@ -90,6 +91,7 @@ export class CustomerSessionService {
     if (!session) return null
     const user = session.user as CustomerUser
     if (!user || user.deletedAt || !user.isActive) return null
+    if (!(await isCustomerTenantActive(this.em, user.tenantId))) return null
 
     await this.em.nativeUpdate(CustomerUserSession, { id: session.id }, { lastUsedAt: new Date() })
     const jwt = this.signCustomerJwt(user, resolvedFeatures, session.id)

package/src/modules/customer_accounts/services/customerTokenService.ts

@@ -6,6 +6,7 @@ import {
   CustomerUserPasswordReset,
 } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'
+import { isCustomerTenantActive } from '@open-mercato/core/modules/customer_accounts/lib/tenantEligibility'
 
 function getKysely(em: EntityManager): Kysely<any> {
   return (em as unknown as { getKysely: () => Kysely<any> }).getKysely()
@@ -74,6 +75,7 @@ export class CustomerTokenService {
 
     const user = record.user as CustomerUser
     if (tenantId && user?.tenantId !== tenantId) return null
+    if (purpose === 'magic_link' && !(await isCustomerTenantActive(this.em, user?.tenantId))) return null
 
     const db = getKysely(this.em)
     const updateResult = await db

package/src/modules/customer_accounts/services/domainMappingService.ts

@@ -287,6 +287,7 @@ export class DomainMappingService {
       replacesDomain = await this.em.findOne(DomainMapping, {
         id: input.replacesDomainId,
         tenantId: input.tenantId,
+        organizationId: input.organizationId,
       } as never)
     }
 
@@ -383,6 +384,8 @@ export class DomainMappingService {
     if (entity.replacesDomain) {
       const replaced = await this.em.findOne(DomainMapping, {
         id: (entity.replacesDomain as unknown as { id: string }).id,
+        tenantId: entity.tenantId,
+        organizationId: entity.organizationId,
       } as never)
       if (replaced) {
         const replacedHostname = replaced.hostname

package/src/modules/customers/components/linking/LinkEntityDialog.tsx

@@ -403,11 +403,19 @@ export function LinkEntityDialog<TDetails = unknown, TLinkSettings = Record<stri
 
   const handleRowClick = React.useCallback(
     (option: LinkEntityOption) => {
-      setFocusedId(option.id)
       const isSelected = draftSet.has(option.id)
       toggleDraftId(option.id, !isSelected)
+      if (!isSelected) {
+        setFocusedId(option.id)
+        return
+      }
+      setFocusedId((current) => {
+        if (current !== option.id) return current
+        const remaining = draftIds.filter((id) => id !== option.id)
+        return remaining.length > 0 ? remaining[0] : null
+      })
     },
-    [draftSet, toggleDraftId],
+    [draftIds, draftSet, toggleDraftId],
   )
 
   const handleAddNewCreated = React.useCallback(

package/src/modules/sales/backend/sales/documents/[id]/page.tsx

@@ -904,6 +904,7 @@ type DocumentRecord = {
   metadata?: Record<string, unknown> | null
   customFields?: Record<string, unknown> | null
   tags?: TagOption[] | null
+  validUntil?: string | null
 }
 
 type DocumentUpdateResult = {
@@ -972,6 +973,18 @@ const resolveLineItemCount = (record: unknown): number | null => {
   return Number.isFinite(current) ? current : null
 }
 
+const DEFAULT_QUOTE_VALID_FOR_DAYS = 14
+const MS_PER_DAY = 24 * 60 * 60 * 1000
+
+export function resolveDefaultValidForDays(validUntil: string | null | undefined): number {
+  if (!validUntil) return DEFAULT_QUOTE_VALID_FOR_DAYS
+  const target = new Date(validUntil)
+  if (Number.isNaN(target.getTime())) return DEFAULT_QUOTE_VALID_FOR_DAYS
+  const daysRemaining = Math.ceil((target.getTime() - Date.now()) / MS_PER_DAY)
+  if (daysRemaining < 1) return DEFAULT_QUOTE_VALID_FOR_DAYS
+  return Math.min(daysRemaining, 365)
+}
+
 async function fetchDocument(id: string, kind: 'order' | 'quote', errorMessage: string): Promise<DocumentRecord | null> {
   const params = new URLSearchParams({ id, page: '1', pageSize: '1' })
   const payload = await readApiResultOrThrow<{ items?: DocumentRecord[] }>(
@@ -1926,7 +1939,7 @@ export default function SalesDocumentDetailPage({
   const [deleting, setDeleting] = React.useState(false)
   const [sending, setSending] = React.useState(false)
   const [sendOpen, setSendOpen] = React.useState(false)
-  const [validForDays, setValidForDays] = React.useState(14)
+  const [validForDays, setValidForDays] = React.useState(DEFAULT_QUOTE_VALID_FOR_DAYS)
   const [numberEditing, setNumberEditing] = React.useState(false)
   const [canEditNumber, setCanEditNumber] = React.useState(false)
   const [currencyError, setCurrencyError] = React.useState<string | null>(null)
@@ -4688,7 +4701,7 @@ export default function SalesDocumentDetailPage({
           ) : undefined}
           menuActions={kind === 'quote' ? ([
             { id: 'convert', label: t('sales.documents.detail.convertToOrder', 'Convert to order'), icon: ArrowRightLeft, onSelect: () => void handleConvert(), disabled: converting, loading: converting },
-            { id: 'send', label: t('sales.quotes.send.action', 'Send to customer'), icon: Send, onSelect: () => setSendOpen(true), disabled: !contactEmail || sending, loading: sending },
+            { id: 'send', label: t('sales.quotes.send.action', 'Send to customer'), icon: Send, onSelect: () => { setValidForDays(resolveDefaultValidForDays(record.validUntil)); setSendOpen(true) }, disabled: !contactEmail || sending, loading: sending },
           ] satisfies ActionItem[]) : undefined}
           onDelete={() => void handleDelete()}
           isDeleting={deleting}