@open-mercato/core 0.10.1-develop.7691.1.d8af406541 → 0.10.1-develop.7701.1.87b1ad4224

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 6003 entry points
+[build:core] found 6007 entry points
 [build:core] built successfully
 [build:core:generated] found 266 entry points
 [build:core:generated] built successfully

package/dist/modules/attachments/api/file/[id]/route.js

@@ -78,7 +78,7 @@ async function GET(req, context) {
   const forceDownload = url.searchParams.get("download") === "1";
   const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);
   const headers = {
-    "Cache-Control": partition.isPublic ? "public, max-age=86400" : "private, max-age=60",
+    "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=86400" : "private, max-age=60",
     "Content-Security-Policy": "default-src 'none'; sandbox",
     "Content-Type": renderInline ? attachment.mimeType || "application/octet-stream" : "application/octet-stream",
     "Content-Disposition": buildAttachmentContentDisposition(

package/dist/modules/attachments/api/file/[id]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/attachments/api/file/%5Bid%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": partition.isPublic\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,UAAU,WACvB,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from \"next/server\";\nimport type { OpenApiRouteDoc } from \"@open-mercato/shared/lib/openapi\";\nimport { getAuthFromRequest } from \"@open-mercato/shared/lib/auth/server\";\nimport { createRequestContainer } from \"@open-mercato/shared/lib/di/container\";\nimport {\n  Attachment,\n  AttachmentPartition,\n} from \"@open-mercato/core/modules/attachments/data/entities\";\nimport type { EntityManager } from \"@mikro-orm/postgresql\";\nimport { checkAttachmentAccess, isSuperAdminAuth } from \"@open-mercato/core/modules/attachments/lib/access\";\nimport { z } from \"zod\";\nimport { attachmentsTag, attachmentErrorSchema } from \"../../openapi\";\nimport {\n  buildAttachmentContentDisposition,\n  canRenderInlineAttachment,\n} from \"@open-mercato/core/modules/attachments/lib/security\";\nimport { StorageDriverFactory } from '../../../lib/drivers';\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope';\n\nexport const metadata = {\n  GET: { requireAuth: false },\n};\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string }> },\n) {\n  const { id } = await context.params;\n  if (!id) {\n    return NextResponse.json(\n      { error: \"Attachment id is required\" },\n      { status: 400 },\n    );\n  }\n  const auth = await getAuthFromRequest(req);\n  const container = await createRequestContainer();\n  const em = container.resolve(\"em\") as EntityManager;\n  const storageDriverFactory =\n    (container.resolve(\"storageDriverFactory\") as StorageDriverFactory | null) ??\n    new StorageDriverFactory(em);\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req);\n  if (requestScope.denied) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth;\n  const findFilter: Record<string, unknown> = { id };\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId;\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId;\n  }\n  const attachment = await em.findOne(Attachment, findFilter);\n  if (!attachment) {\n    return NextResponse.json(\n      { error: \"Attachment not found\" },\n      { status: 404 },\n    );\n  }\n  const partition = await em.findOne(AttachmentPartition, {\n    code: attachment.partitionCode,\n  });\n  if (!partition) {\n    return NextResponse.json(\n      { error: \"Partition misconfigured\" },\n      { status: 500 },\n    );\n  }\n\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition);\n  if (!access.ok) {\n    const message = access.status === 401 ? \"Unauthorized\" : \"Forbidden\";\n    return NextResponse.json({ error: message }, { status: access.status });\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  });\n  let buffer: Buffer;\n  try {\n    const result = await driver.read(attachment.partitionCode, attachment.storagePath);\n    buffer = result.buffer;\n  } catch {\n    return NextResponse.json({ error: \"File not available\" }, { status: 404 });\n  }\n\n  const url = new URL(req.url);\n  const forceDownload = url.searchParams.get(\"download\") === \"1\";\n  const renderInline = !forceDownload && canRenderInlineAttachment(attachment.mimeType);\n  const headers: Record<string, string> = {\n    \"Cache-Control\": checkAttachmentAccess(null, attachment, partition).ok\n      ? \"public, max-age=86400\"\n      : \"private, max-age=60\",\n    \"Content-Security-Policy\": \"default-src 'none'; sandbox\",\n    \"Content-Type\": renderInline\n      ? attachment.mimeType || \"application/octet-stream\"\n      : \"application/octet-stream\",\n    \"Content-Disposition\": buildAttachmentContentDisposition(\n      attachment.fileName,\n      renderInline ? \"inline\" : \"attachment\",\n    ),\n    \"X-Content-Type-Options\": \"nosniff\",\n  };\n  if (attachment.fileSize > 0) {\n    headers[\"Content-Length\"] = String(attachment.fileSize);\n  }\n\n  const responseBody = new Uint8Array(buffer);\n\n  return new NextResponse(responseBody, { status: 200, headers });\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: \"Download attachment file\",\n  methods: {\n    GET: {\n      summary: \"Download or serve attachment file\",\n      description:\n        \"Returns the raw file content for an attachment. Path parameter: {id} - Attachment UUID. Query parameter: ?download=1 - Force file download with Content-Disposition header. Access control is enforced based on partition settings.\",\n      responses: [\n        {\n          status: 200,\n          description: \"File content with appropriate MIME type\",\n          schema: z.any().describe(\"Binary file content\"),\n        },\n      ],\n      errors: [\n        {\n          status: 400,\n          description: \"Missing attachment ID\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 401,\n          description:\n            \"Unauthorized - authentication required for private partitions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 403,\n          description: \"Forbidden - insufficient permissions\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 404,\n          description: \"Attachment or file not found\",\n          schema: attachmentErrorSchema,\n        },\n        {\n          status: 500,\n          description: \"Partition misconfigured\",\n          schema: attachmentErrorSchema,\n        },\n      ],\n    },\n  },\n};\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAE1C,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,SAAS,uBAAuB,wBAAwB;AACxD,SAAS,SAAS;AAClB,SAAS,gBAAgB,6BAA6B;AACtD;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAEvC,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,4BAA4B;AAAA,MACrC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KACzC,IAAI,qBAAqB,EAAE;AAE7B,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,uBAAuB;AAAA,MAChC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB;AAAA,IACtD,MAAM,WAAW;AAAA,EACnB,CAAC;AACD,MAAI,CAAC,WAAW;AACd,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,0BAA0B;AAAA,MACnC,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,MAAI;AACJ,MAAI;AACF,UAAM,SAAS,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AACjF,aAAS,OAAO;AAAA,EAClB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,gBAAgB,IAAI,aAAa,IAAI,UAAU,MAAM;AAC3D,QAAM,eAAe,CAAC,iBAAiB,0BAA0B,WAAW,QAAQ;AACpF,QAAM,UAAkC;AAAA,IACtC,iBAAiB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAChE,0BACA;AAAA,IACJ,2BAA2B;AAAA,IAC3B,gBAAgB,eACZ,WAAW,YAAY,6BACvB;AAAA,IACJ,uBAAuB;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,WAAW;AAAA,IAC5B;AAAA,IACA,0BAA0B;AAAA,EAC5B;AACA,MAAI,WAAW,WAAW,GAAG;AAC3B,YAAQ,gBAAgB,IAAI,OAAO,WAAW,QAAQ;AAAA,EACxD;AAEA,QAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,SAAO,IAAI,aAAa,cAAc,EAAE,QAAQ,KAAK,QAAQ,CAAC;AAChE;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,qBAAqB;AAAA,QAChD;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aACE;AAAA,UACF,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,QACA;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js

@@ -120,7 +120,7 @@ async function GET(req, context) {
     return new NextResponse(responseBody, {
       headers: {
         "Content-Type": attachment.mimeType || "image/jpeg",
-        "Cache-Control": partition.isPublic ? "public, max-age=3600" : "private, max-age=60",
+        "Cache-Control": checkAttachmentAccess(null, attachment, partition).ok ? "public, max-age=3600" : "private, max-age=60",
         "X-Content-Type-Options": "nosniff"
       }
     });

package/dist/modules/attachments/api/image/[id]/[[...slug]]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/attachments/api/image/%5Bid%5D/%5B%5B...slug%5D%5D/route.ts"],
-  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport sharp, { type ResizeOptions } from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess, isSuperAdminAuth } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\nimport { StorageDriverFactory } from '../../../../lib/drivers'\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments').child({ component: 'image' })\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth\n  const findFilter: Record<string, unknown> = { id }\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId\n  }\n  const attachment = await em.findOne(Attachment, findFilter)\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition)\n  if (!access.ok) {\n    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'\n    return NextResponse.json({ error: message }, { status: access.status })\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  })\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          logger.error('Thumbnail cache write failed', { err: cacheError })\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': partition.isPublic ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    logger.error('Image read failed', { err: error })\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,OAAO,WAAmC;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB,wBAAwB;AAExD,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEvE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAE3G,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAC5F,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAA+B;AAAA,UACnC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,iBAAO,MAAM,gCAAgC,EAAE,KAAK,WAAW,CAAC;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,UAAU,WAAW,yBAAyB;AAAA,QAC/D,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,qBAAqB,EAAE,KAAK,MAAM,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextRequest, NextResponse } from 'next/server'\nimport sharp, { type ResizeOptions } from 'sharp'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'\nimport {\n  buildThumbnailCacheKey,\n  readThumbnailCache,\n  writeThumbnailCache,\n} from '@open-mercato/core/modules/attachments/lib/thumbnailCache'\nimport { canRenderInlineAttachment } from '@open-mercato/core/modules/attachments/lib/security'\nimport { checkAttachmentAccess, isSuperAdminAuth } from '@open-mercato/core/modules/attachments/lib/access'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { attachmentsTag, imageQuerySchema, attachmentErrorSchema } from '../../../openapi'\nimport {\n  MAX_IMAGE_SOURCE_PIXELS,\n  validateImageDimensions,\n  validateImageMagicBytes,\n} from '@open-mercato/core/modules/attachments/lib/imageSafety'\nimport { StorageDriverFactory } from '../../../../lib/drivers'\nimport { resolveAttachmentRequestScope } from '@open-mercato/core/modules/attachments/lib/requestScope'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('attachments').child({ component: 'image' })\n\nconst querySchema = z.object({\n  width: z.coerce.number().int().min(1).max(4000).optional(),\n  height: z.coerce.number().int().min(1).max(4000).optional(),\n  cropType: z.enum(['cover', 'contain']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nexport async function GET(\n  req: NextRequest,\n  context: { params: Promise<{ id: string; slug?: string[] | undefined }> }\n) {\n  const auth = await getAuthFromRequest(req)\n  const { id } = await context.params\n  if (!id) {\n    return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })\n  }\n  const parsedQuery = querySchema.safeParse(\n    Object.fromEntries(new URL(req.url).searchParams.entries())\n  )\n  if (!parsedQuery.success) {\n    return NextResponse.json({ error: 'Invalid size parameters' }, { status: 400 })\n  }\n  const { width, height, cropType } = parsedQuery.data\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const storageDriverFactory =\n    (container.resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)\n\n  const requestScope = await resolveAttachmentRequestScope(container, auth, req)\n  if (requestScope.denied) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  const scopedAuth = auth ? { ...auth, orgId: requestScope.organizationId } : auth\n  const findFilter: Record<string, unknown> = { id }\n  if (scopedAuth && !isSuperAdminAuth(scopedAuth)) {\n    if (scopedAuth.tenantId) findFilter.tenantId = scopedAuth.tenantId\n    if (scopedAuth.orgId) findFilter.organizationId = scopedAuth.orgId\n  }\n  const attachment = await em.findOne(Attachment, findFilter)\n  if (!attachment) {\n    return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  }\n  if (!canRenderInlineAttachment(attachment.mimeType)) {\n    return NextResponse.json({ error: 'Unsupported media type' }, { status: 400 })\n  }\n  const partition = await em.findOne(AttachmentPartition, { code: attachment.partitionCode })\n  if (!partition) {\n    return NextResponse.json({ error: 'Partition misconfigured' }, { status: 500 })\n  }\n  const access = checkAttachmentAccess(scopedAuth, attachment, partition)\n  if (!access.ok) {\n    const message = access.status === 401 ? 'Unauthorized' : 'Forbidden'\n    return NextResponse.json({ error: message }, { status: access.status })\n  }\n\n  const driver = await storageDriverFactory.resolveForPartition(attachment.partitionCode, {\n    tenantId: attachment.tenantId ?? '',\n    organizationId: attachment.organizationId ?? '',\n  })\n  const cacheKey = buildThumbnailCacheKey(width, height, cropType)\n  try {\n    let buffer: Buffer | null = null\n    if (cacheKey) {\n      buffer = await readThumbnailCache(attachment.partitionCode, attachment.id, cacheKey)\n    }\n    if (!buffer) {\n      const { buffer: input } = await driver.read(attachment.partitionCode, attachment.storagePath)\n      const magicBytesValidation = validateImageMagicBytes(input, attachment.mimeType)\n      if (!magicBytesValidation.ok) {\n        return NextResponse.json({ error: magicBytesValidation.error }, { status: magicBytesValidation.status })\n      }\n\n      const dimensionsValidation = await validateImageDimensions(input)\n      if (!dimensionsValidation.ok) {\n        return NextResponse.json({ error: dimensionsValidation.error }, { status: dimensionsValidation.status })\n      }\n\n      let transformer = sharp(input, {\n        failOn: 'error',\n        limitInputPixels: MAX_IMAGE_SOURCE_PIXELS,\n      })\n      if (width || height) {\n        const resizeOptions: ResizeOptions = {\n          width: width || undefined,\n          height: height || undefined,\n          fit: cropType === 'contain' ? 'contain' : 'cover',\n        }\n        if (cropType === 'contain') {\n          resizeOptions.background = { r: 0, g: 0, b: 0, alpha: 0 }\n        }\n        transformer = transformer.resize(resizeOptions)\n      }\n      buffer = await transformer.toBuffer()\n      if (cacheKey) {\n        void writeThumbnailCache(attachment.partitionCode, attachment.id, cacheKey, buffer).catch((cacheError) => {\n          logger.error('Thumbnail cache write failed', { err: cacheError })\n        })\n      }\n    }\n    if (!buffer) {\n      return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n    }\n    const responseBody = new Uint8Array(buffer)\n\n    return new NextResponse(responseBody, {\n      headers: {\n        'Content-Type': attachment.mimeType || 'image/jpeg',\n        'Cache-Control': checkAttachmentAccess(null, attachment, partition).ok ? 'public, max-age=3600' : 'private, max-age=60',\n        'X-Content-Type-Options': 'nosniff',\n      },\n    })\n  } catch (error) {\n    logger.error('Image read failed', { err: error })\n    return NextResponse.json({ error: 'Failed to render image' }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Serve resized images',\n  methods: {\n    GET: {\n      summary: 'Serve image with optional resizing',\n      description: 'Returns an image attachment with optional on-the-fly resizing and cropping. Resized images are cached for performance. Only works with image MIME types. Path parameter: {id} - Attachment UUID. Query parameters: ?width=N (1-4000 pixels), ?height=N (1-4000 pixels), ?cropType=cover|contain (resize behavior).',\n      responses: [\n        {\n          status: 200,\n          description: 'Binary image content (Content-Type: image/jpeg, image/png, etc.)',\n          schema: z.any().describe('Binary image content - actual Content-Type header set to image MIME type, not application/json'),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid parameters, missing ID, or non-image attachment', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized - authentication required for private partitions', schema: attachmentErrorSchema },\n        { status: 403, description: 'Forbidden - insufficient permissions', schema: attachmentErrorSchema },\n        { status: 404, description: 'Image not found', schema: attachmentErrorSchema },\n        { status: 500, description: 'Partition misconfigured or image rendering failed', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAsB,oBAAoB;AAC1C,OAAO,WAAmC;AAC1C,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,YAAY,2BAA2B;AAChD;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,iCAAiC;AAC1C,SAAS,uBAAuB,wBAAwB;AAExD,SAAS,gBAAkC,6BAA6B;AACxE;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,4BAA4B;AACrC,SAAS,qCAAqC;AAC9C,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,aAAa,EAAE,MAAM,EAAE,WAAW,QAAQ,CAAC;AAEvE,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EACzD,QAAQ,EAAE,OAAO,OAAO,EAAE,IAAI,EAAE,IAAI,CAAC,EAAE,IAAI,GAAI,EAAE,SAAS;AAAA,EAC1D,UAAU,EAAE,KAAK,CAAC,SAAS,SAAS,CAAC,EAAE,SAAS;AAClD,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,eAAsB,IACpB,KACA,SACA;AACA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,QAAM,EAAE,GAAG,IAAI,MAAM,QAAQ;AAC7B,MAAI,CAAC,IAAI;AACP,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,QAAM,cAAc,YAAY;AAAA,IAC9B,OAAO,YAAY,IAAI,IAAI,IAAI,GAAG,EAAE,aAAa,QAAQ,CAAC;AAAA,EAC5D;AACA,MAAI,CAAC,YAAY,SAAS;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,EAAE,OAAO,QAAQ,SAAS,IAAI,YAAY;AAEhD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,uBACH,UAAU,QAAQ,sBAAsB,KAAqC,IAAI,qBAAqB,EAAE;AAE3G,QAAM,eAAe,MAAM,8BAA8B,WAAW,MAAM,GAAG;AAC7E,MAAI,aAAa,QAAQ;AACvB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,QAAM,aAAa,OAAO,EAAE,GAAG,MAAM,OAAO,aAAa,eAAe,IAAI;AAC5E,QAAM,aAAsC,EAAE,GAAG;AACjD,MAAI,cAAc,CAAC,iBAAiB,UAAU,GAAG;AAC/C,QAAI,WAAW,SAAU,YAAW,WAAW,WAAW;AAC1D,QAAI,WAAW,MAAO,YAAW,iBAAiB,WAAW;AAAA,EAC/D;AACA,QAAM,aAAa,MAAM,GAAG,QAAQ,YAAY,UAAU;AAC1D,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,CAAC,0BAA0B,WAAW,QAAQ,GAAG;AACnD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACA,QAAM,YAAY,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,WAAW,cAAc,CAAC;AAC1F,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AACA,QAAM,SAAS,sBAAsB,YAAY,YAAY,SAAS;AACtE,MAAI,CAAC,OAAO,IAAI;AACd,UAAM,UAAU,OAAO,WAAW,MAAM,iBAAiB;AACzD,WAAO,aAAa,KAAK,EAAE,OAAO,QAAQ,GAAG,EAAE,QAAQ,OAAO,OAAO,CAAC;AAAA,EACxE;AAEA,QAAM,SAAS,MAAM,qBAAqB,oBAAoB,WAAW,eAAe;AAAA,IACtF,UAAU,WAAW,YAAY;AAAA,IACjC,gBAAgB,WAAW,kBAAkB;AAAA,EAC/C,CAAC;AACD,QAAM,WAAW,uBAAuB,OAAO,QAAQ,QAAQ;AAC/D,MAAI;AACF,QAAI,SAAwB;AAC5B,QAAI,UAAU;AACZ,eAAS,MAAM,mBAAmB,WAAW,eAAe,WAAW,IAAI,QAAQ;AAAA,IACrF;AACA,QAAI,CAAC,QAAQ;AACX,YAAM,EAAE,QAAQ,MAAM,IAAI,MAAM,OAAO,KAAK,WAAW,eAAe,WAAW,WAAW;AAC5F,YAAM,uBAAuB,wBAAwB,OAAO,WAAW,QAAQ;AAC/E,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,YAAM,uBAAuB,MAAM,wBAAwB,KAAK;AAChE,UAAI,CAAC,qBAAqB,IAAI;AAC5B,eAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,MAAM,GAAG,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,MACzG;AAEA,UAAI,cAAc,MAAM,OAAO;AAAA,QAC7B,QAAQ;AAAA,QACR,kBAAkB;AAAA,MACpB,CAAC;AACD,UAAI,SAAS,QAAQ;AACnB,cAAM,gBAA+B;AAAA,UACnC,OAAO,SAAS;AAAA,UAChB,QAAQ,UAAU;AAAA,UAClB,KAAK,aAAa,YAAY,YAAY;AAAA,QAC5C;AACA,YAAI,aAAa,WAAW;AAC1B,wBAAc,aAAa,EAAE,GAAG,GAAG,GAAG,GAAG,GAAG,GAAG,OAAO,EAAE;AAAA,QAC1D;AACA,sBAAc,YAAY,OAAO,aAAa;AAAA,MAChD;AACA,eAAS,MAAM,YAAY,SAAS;AACpC,UAAI,UAAU;AACZ,aAAK,oBAAoB,WAAW,eAAe,WAAW,IAAI,UAAU,MAAM,EAAE,MAAM,CAAC,eAAe;AACxG,iBAAO,MAAM,gCAAgC,EAAE,KAAK,WAAW,CAAC;AAAA,QAClE,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC/E;AACA,UAAM,eAAe,IAAI,WAAW,MAAM;AAE1C,WAAO,IAAI,aAAa,cAAc;AAAA,MACpC,SAAS;AAAA,QACP,gBAAgB,WAAW,YAAY;AAAA,QACvC,iBAAiB,sBAAsB,MAAM,YAAY,SAAS,EAAE,KAAK,yBAAyB;AAAA,QAClG,0BAA0B;AAAA,MAC5B;AAAA,IACF,CAAC;AAAA,EACH,SAAS,OAAO;AACd,WAAO,MAAM,qBAAqB,EAAE,KAAK,MAAM,CAAC;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC/E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,IAAI,EAAE,SAAS,gGAAgG;AAAA,QAC3H;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,2DAA2D,QAAQ,sBAAsB;AAAA,QACrH,EAAE,QAAQ,KAAK,aAAa,iEAAiE,QAAQ,sBAAsB;AAAA,QAC3H,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,QAClG,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,sBAAsB;AAAA,MACjH;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/autologin.js

@@ -6,6 +6,7 @@ import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from "@open-mer
 import { sanitizeRedirectPath } from "@open-mercato/core/modules/auth/lib/safeRedirect";
 import { resolveAutoLoginCredentials } from "@open-mercato/core/modules/auth/lib/autologin";
 import { emitAuthEvent } from "@open-mercato/core/modules/auth/events";
+import { isStaffTenantActive } from "@open-mercato/core/modules/auth/lib/tenantEligibility";
 const metadata = { requireAuth: false };
 const accessTokenMaxAgeSeconds = 60 * 60 * 8;
 const logger = createLogger("auth").child({ component: "autologin" });
@@ -31,7 +32,8 @@ async function GET(req) {
     user = users.length === 1 ? users[0] : null;
   }
   const ok = await auth.verifyPassword(user, credentials.password);
-  if (!user || !ok) {
+  const tenantActive = user ? await isStaffTenantActive(container.resolve("em"), user.tenantId) : false;
+  if (!user || !ok || !tenantActive) {
     logger.warn("OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login");
     return buildSafeRedirectResponse(req, "/login");
   }

package/dist/modules/auth/api/autologin.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/autologin.ts"],
-  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\n\nexport const metadata = { requireAuth: false }\n\nconst accessTokenMaxAgeSeconds = 60 * 60 * 8\nconst logger = createLogger('auth').child({ component: 'autologin' })\n\n// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the\n// visitor in with those credentials and redirect into the app. Gated entirely\n// behind env vars \u2014 the homepage only routes here when they are set. On any\n// failure (feature off, bad credentials) it falls back to the manual login form\n// so a misconfigured demo can never loop.\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin\n  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')\n\n  const credentials = resolveAutoLoginCredentials()\n  if (!credentials) {\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  // Already signed in \u2014 go straight to the app instead of re-issuing a session.\n  const existing = await getAuthFromRequest(req)\n  if (existing) {\n    return buildSafeRedirectResponse(req, redirectTo)\n  }\n\n  const container = await createRequestContainer()\n  const auth = container.resolve<AuthService>('authService')\n\n  let user = null\n  if (credentials.tenantId) {\n    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(credentials.email)\n    user = users.length === 1 ? users[0] : null\n  }\n\n  const ok = await auth.verifyPassword(user, credentials.password)\n  if (!user || !ok) {\n    // Misconfigured demo credentials \u2014 never loop; drop to the manual form.\n    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const roles = await auth.getUserRoles(user, resolvedTenantId)\n  await auth.updateLastLoginAt(user)\n  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session } = await auth.createSession(user, expiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(session.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles,\n  })\n  void emitAuthEvent('auth.login.success', {\n    id: String(user.id),\n    email: user.email,\n    tenantId: resolvedTenantId,\n    organizationId: user.organizationId ? String(user.organizationId) : null,\n  }).catch(() => undefined)\n\n  const res = buildSafeRedirectResponse(req, redirectTo)\n  res.cookies.set('auth_token', token, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: accessTokenMaxAgeSeconds,\n  })\n  return res\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Demo autologin',\n  methods: {\n    GET: {\n      summary: 'Auto sign-in using env-configured demo credentials',\n      description:\n        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',\n      responses: [\n        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAEvB,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,2BAA2B,KAAK,KAAK;AAC3C,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAOpE,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,2BAA2B,GAAG,KAAK,IAAI;AACvD,QAAM,aAAa,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,UAAU;AAE7F,QAAM,cAAc,4BAA4B;AAChD,MAAI,CAAC,aAAa;AAChB,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAGA,QAAM,WAAW,MAAM,mBAAmB,GAAG;AAC7C,MAAI,UAAU;AACZ,WAAO,0BAA0B,KAAK,UAAU;AAAA,EAClD;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AAEzD,MAAI,OAAO;AACX,MAAI,YAAY,UAAU;AACxB,WAAO,MAAM,KAAK,yBAAyB,YAAY,OAAO,YAAY,QAAQ;AAAA,EACpF,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,YAAY,KAAK;AAC3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAEA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,YAAY,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,IAAI;AAEhB,WAAO,KAAK,wFAAwF;AACpG,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAEA,QAAM,mBAAmB,YAAY,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC1F,QAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,gBAAgB;AAC5D,QAAM,KAAK,kBAAkB,IAAI;AACjC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACvE,QAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,cAAc,MAAM,SAAS;AAC5D,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,QAAQ,EAAE;AAAA,IACtB,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ;AAAA,EACF,CAAC;AACD,OAAK,cAAc,sBAAsB;AAAA,IACvC,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,OAAO,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,EACtE,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,0BAA0B,KAAK,UAAU;AACrD,MAAI,QAAQ,IAAI,cAAc,OAAO;AAAA,IACnC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mDAAmD,WAAW,YAAY;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'\n\nexport const metadata = { requireAuth: false }\n\nconst accessTokenMaxAgeSeconds = 60 * 60 * 8\nconst logger = createLogger('auth').child({ component: 'autologin' })\n\n// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the\n// visitor in with those credentials and redirect into the app. Gated entirely\n// behind env vars \u2014 the homepage only routes here when they are set. On any\n// failure (feature off, bad credentials) it falls back to the manual login form\n// so a misconfigured demo can never loop.\nexport async function GET(req: Request) {\n  const url = new URL(req.url)\n  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin\n  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')\n\n  const credentials = resolveAutoLoginCredentials()\n  if (!credentials) {\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  // Already signed in \u2014 go straight to the app instead of re-issuing a session.\n  const existing = await getAuthFromRequest(req)\n  if (existing) {\n    return buildSafeRedirectResponse(req, redirectTo)\n  }\n\n  const container = await createRequestContainer()\n  const auth = container.resolve<AuthService>('authService')\n\n  let user = null\n  if (credentials.tenantId) {\n    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(credentials.email)\n    user = users.length === 1 ? users[0] : null\n  }\n\n  const ok = await auth.verifyPassword(user, credentials.password)\n  const tenantActive = user ? await isStaffTenantActive(container.resolve('em'), user.tenantId) : false\n  if (!user || !ok || !tenantActive) {\n    // Misconfigured demo credentials \u2014 never loop; drop to the manual form.\n    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')\n    return buildSafeRedirectResponse(req, '/login')\n  }\n\n  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const roles = await auth.getUserRoles(user, resolvedTenantId)\n  await auth.updateLastLoginAt(user)\n  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session } = await auth.createSession(user, expiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(session.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles,\n  })\n  void emitAuthEvent('auth.login.success', {\n    id: String(user.id),\n    email: user.email,\n    tenantId: resolvedTenantId,\n    organizationId: user.organizationId ? String(user.organizationId) : null,\n  }).catch(() => undefined)\n\n  const res = buildSafeRedirectResponse(req, redirectTo)\n  res.cookies.set('auth_token', token, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: accessTokenMaxAgeSeconds,\n  })\n  return res\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Demo autologin',\n  methods: {\n    GET: {\n      summary: 'Auto sign-in using env-configured demo credentials',\n      description:\n        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',\n      responses: [\n        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AACA,SAAS,8BAA8B;AACvC,SAAS,oBAAoB;AAE7B,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,2BAA2B,kCAAkC;AACtE,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,qBAAqB;AAC9B,SAAS,2BAA2B;AAE7B,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,2BAA2B,KAAK,KAAK;AAC3C,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,YAAY,CAAC;AAOpE,eAAsB,IAAI,KAAc;AACtC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,2BAA2B,GAAG,KAAK,IAAI;AACvD,QAAM,aAAa,qBAAqB,IAAI,aAAa,IAAI,UAAU,GAAG,SAAS,UAAU;AAE7F,QAAM,cAAc,4BAA4B;AAChD,MAAI,CAAC,aAAa;AAChB,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAGA,QAAM,WAAW,MAAM,mBAAmB,GAAG;AAC7C,MAAI,UAAU;AACZ,WAAO,0BAA0B,KAAK,UAAU;AAAA,EAClD;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AAEzD,MAAI,OAAO;AACX,MAAI,YAAY,UAAU;AACxB,WAAO,MAAM,KAAK,yBAAyB,YAAY,OAAO,YAAY,QAAQ;AAAA,EACpF,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,YAAY,KAAK;AAC3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAEA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,YAAY,QAAQ;AAC/D,QAAM,eAAe,OAAO,MAAM,oBAAoB,UAAU,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI;AAChG,MAAI,CAAC,QAAQ,CAAC,MAAM,CAAC,cAAc;AAEjC,WAAO,KAAK,wFAAwF;AACpG,WAAO,0BAA0B,KAAK,QAAQ;AAAA,EAChD;AAEA,QAAM,mBAAmB,YAAY,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC1F,QAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,gBAAgB;AAC5D,QAAM,KAAK,kBAAkB,IAAI;AACjC,QAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACvE,QAAM,EAAE,QAAQ,IAAI,MAAM,KAAK,cAAc,MAAM,SAAS;AAC5D,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,QAAQ,EAAE;AAAA,IACtB,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ;AAAA,EACF,CAAC;AACD,OAAK,cAAc,sBAAsB;AAAA,IACvC,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,OAAO,KAAK;AAAA,IACZ,UAAU;AAAA,IACV,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,EACtE,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,0BAA0B,KAAK,UAAU;AACrD,MAAI,QAAQ,IAAI,cAAc,OAAO;AAAA,IACnC,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ;AAAA,EACV,CAAC;AACD,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mDAAmD,WAAW,YAAY;AAAA,MACxG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/login.js

@@ -13,6 +13,7 @@ import { runCustomRouteAfterInterceptors } from "@open-mercato/shared/lib/crud/c
 import { sanitizeRedirectPath } from "@open-mercato/core/modules/auth/lib/safeRedirect";
 import { getAppBaseUrl, isCrossSiteBrowserRequest } from "@open-mercato/shared/lib/url";
 import { handleAuthRouteError } from "@open-mercato/core/modules/auth/api/routeError";
+import { isStaffTenantActive } from "@open-mercato/core/modules/auth/lib/tenantEligibility";
 const loginRateLimitConfig = readEndpointRateLimitConfig("LOGIN", {
   points: 5,
   duration: 60,
@@ -117,9 +118,11 @@ async function handleLoginRequest(req) {
     user = users.length === 1 ? users[0] : null;
   }
   const ok = await auth.verifyPassword(user, parsed.data.password);
-  if (!user || !ok || user.isConfirmed === false) {
+  const tenantActive = user ? await isStaffTenantActive(container.resolve("em"), user.tenantId) : false;
+  if (!user || !ok || user.isConfirmed === false || !tenantActive) {
     let reason;
     if (user && user.isConfirmed === false) reason = "account_deactivated";
+    else if (user && !tenantActive) reason = "tenant_unavailable";
     else if (user?.passwordHash) reason = "invalid_password";
     else reason = "invalid_credentials";
     void emitAuthEvent("auth.login.failed", { email: parsed.data.email, reason }).catch(() => void 0);

package/dist/modules/auth/api/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl, isCrossSiteBrowserRequest } from '@open-mercato/shared/lib/url'\nimport { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\n// Resolving translations can itself be what failed, so the generic message is\n// recovered defensively \u2014 the error path must never throw a second time.\nasync function resolveGenericLoginError(): Promise<string> {\n  try {\n    const { translate } = await resolveTranslations()\n    return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n  } catch {\n    return 'An error occurred. Please try again.'\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handleLoginRequest(req)\n  } catch (error) {\n    return handleAuthRouteError(error, {\n      scope: 'auth.login',\n      message: await resolveGenericLoginError(),\n    })\n  }\n}\n\nasync function handleLoginRequest(req: Request) {\n  const { translate } = await resolveTranslations()\n  if (isCrossSiteBrowserRequest(req)) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.crossSiteRequest', 'This sign-in request did not come from this application. Open the sign-in page and try again.') }, { status: 403 })\n  }\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok || user.isConfirmed === false) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional\n  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the\n  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff\n  // token and skip the outstanding second factor, so it is cleared alongside the swap.\n  const authTokenReplacedByInterceptor = authTokenForCookie !== token\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && !authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  } else if (authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role, or the request was submitted cross-site', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,eAAe,iCAAiC;AACzD,SAAS,4BAA4B;AAErC,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAIA,eAAe,2BAA4C;AACzD,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,UAAU,6BAA6B,sCAAsC;AAAA,EACtF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,mBAAmB,GAAG;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,qBAAqB,OAAO;AAAA,MACjC,OAAO;AAAA,MACP,SAAS,MAAM,yBAAyB;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBAAmB,KAAc;AAC9C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,0BAA0B,GAAG,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,+FAA+F,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClN;AACA,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,OAAO;AAK9C,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAMJ,QAAM,iCAAiC,uBAAuB;AAE9D,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,CAAC,gCAAgC;AACvD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL,WAAW,gCAAgC;AACzC,QAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,EAAE,CAAC;AAAA,EAC/I;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,iBAAiB;AAAA,IAC1H,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl, isCrossSiteBrowserRequest } from '@open-mercato/shared/lib/url'\nimport { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'\nimport { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\n// Resolving translations can itself be what failed, so the generic message is\n// recovered defensively \u2014 the error path must never throw a second time.\nasync function resolveGenericLoginError(): Promise<string> {\n  try {\n    const { translate } = await resolveTranslations()\n    return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n  } catch {\n    return 'An error occurred. Please try again.'\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handleLoginRequest(req)\n  } catch (error) {\n    return handleAuthRouteError(error, {\n      scope: 'auth.login',\n      message: await resolveGenericLoginError(),\n    })\n  }\n}\n\nasync function handleLoginRequest(req: Request) {\n  const { translate } = await resolveTranslations()\n  if (isCrossSiteBrowserRequest(req)) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.crossSiteRequest', 'This sign-in request did not come from this application. Open the sign-in page and try again.') }, { status: 403 })\n  }\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  const tenantActive = user ? await isStaffTenantActive(container.resolve('em'), user.tenantId) : false\n  if (!user || !ok || user.isConfirmed === false || !tenantActive) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user && !tenantActive) reason = 'tenant_unavailable'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional\n  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the\n  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff\n  // token and skip the outstanding second factor, so it is cleared alongside the swap.\n  const authTokenReplacedByInterceptor = authTokenForCookie !== token\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && !authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  } else if (authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role, or the request was submitted cross-site', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,eAAe,iCAAiC;AACzD,SAAS,4BAA4B;AACrC,SAAS,2BAA2B;AAEpC,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAIA,eAAe,2BAA4C;AACzD,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,UAAU,6BAA6B,sCAAsC;AAAA,EACtF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,mBAAmB,GAAG;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,qBAAqB,OAAO;AAAA,MACjC,OAAO;AAAA,MACP,SAAS,MAAM,yBAAyB;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBAAmB,KAAc;AAC9C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI,0BAA0B,GAAG,GAAG;AAClC,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,+FAA+F,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClN;AACA,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,QAAM,eAAe,OAAO,MAAM,oBAAoB,UAAU,QAAQ,IAAI,GAAG,KAAK,QAAQ,IAAI;AAChG,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,SAAS,CAAC,cAAc;AAK/D,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,QAAQ,CAAC,aAAc,UAAS;AAAA,aAChC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAMJ,QAAM,iCAAiC,uBAAuB;AAE9D,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,CAAC,gCAAgC;AACvD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL,WAAW,gCAAgC;AACzC,QAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,EAAE,CAAC;AAAA,EAC/I;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,qEAAqE,QAAQ,iBAAiB;AAAA,IAC1H,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": ["requireRoleRaw", "userRoleNames"]
 }

package/dist/modules/auth/lib/sessionIntegrity.js

@@ -1,5 +1,6 @@
 import { findOneWithDecryption, findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { RoleAcl, Session, User, UserAcl, UserRole } from "@open-mercato/core/modules/auth/data/entities";
+import { isStaffTenantActive } from "@open-mercato/core/modules/auth/lib/tenantEligibility";
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 const INVALID_SCOPE = /* @__PURE__ */ Symbol("invalid-scope");
 function normalizeScopeId(value) {
@@ -54,6 +55,7 @@ async function resolveCanonicalStaffAuthContext(em, auth) {
   if (currentTenantId === INVALID_SCOPE || currentOrganizationId === INVALID_SCOPE || currentTenantId !== actorTenantId || currentOrganizationId !== actorOrganizationId) {
     return null;
   }
+  if (!await isStaffTenantActive(em, currentTenantId)) return null;
   const linksPromise = currentTenantId ? findWithDecryption(
     em,
     UserRole,

package/dist/modules/auth/lib/sessionIntegrity.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/sessionIntegrity.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, Session, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\nconst INVALID_SCOPE = Symbol('invalid-scope')\n\ntype NormalizedScopeId = string | null | typeof INVALID_SCOPE\n\nfunction normalizeScopeId(value: unknown): NormalizedScopeId {\n  if (value === null || value === undefined) return null\n  if (typeof value !== 'string') return INVALID_SCOPE\n  const trimmed = value.trim()\n  if (!trimmed) return null\n  return UUID_RE.test(trimmed) ? trimmed : INVALID_SCOPE\n}\n\nfunction resolveActorTenantId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorTenantId = (auth as { actorTenantId?: unknown }).actorTenantId\n  return normalizeScopeId(actorTenantId ?? auth.tenantId ?? null)\n}\n\nfunction resolveActorOrganizationId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorOrgId = (auth as { actorOrgId?: unknown }).actorOrgId\n  return normalizeScopeId(actorOrgId ?? auth.orgId ?? null)\n}\n\nexport async function resolveCanonicalStaffAuthContext(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<AuthContext> {\n  if (!auth) return null\n  if (auth.isApiKey) return auth\n\n  const subjectId = normalizeScopeId(auth.sub)\n  const actorTenantId = resolveActorTenantId(auth)\n  const actorOrganizationId = resolveActorOrganizationId(auth)\n  if (\n    subjectId === INVALID_SCOPE ||\n    actorTenantId === INVALID_SCOPE ||\n    actorOrganizationId === INVALID_SCOPE\n  ) {\n    return null\n  }\n\n  // Session binding: when the JWT carries an `sid` claim, require the referenced session to\n  // still exist (not soft-deleted, not expired). This is what makes logout / password-reset\n  // actually invalidate an already-issued JWT.\n  //\n  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period so\n  // that rolling deployments don't force-logout every user. `verifyJwt` owns that window: it only\n  // marks a payload `_legacyToken` while the token's own `iat` is within JWT_LEGACY_GRACE_MINUTES\n  // and before JWT_LEGACY_CUTOVER_AT, so an aged or post-cutover raw-secret token fails\n  // verification before reaching this point and every remaining token must carry a live `sid`.\n  const sessionId = normalizeScopeId(typeof auth.sid === 'string' ? auth.sid : null)\n  if (sessionId === INVALID_SCOPE) return null\n  if (sessionId === null) {\n    // Legacy token without sid \u2014 allow only if it was verified via the legacy fallback path.\n    // The `_legacyToken` flag is set by `verifyJwt` when a token passes raw-secret verification\n    // but fails audience-derived verification. Without this flag, reject.\n    if ((auth as Record<string, unknown>)._legacyToken === true) {\n      // Allow through without session validation \u2014 the token will expire naturally\n    } else {\n      return null\n    }\n  }\n  // The session-revocation check and the user load are independent (neither reads\n  // the other's result), so they run concurrently to collapse two sequential DB\n  // round-trips into one. The `em` here is a fresh request-scoped EntityManager\n  // (resolved per request, never inside an explicit transaction), so concurrent\n  // reads on it are safe.\n  //\n  // The session lookup is bound to the token subject (`user: subjectId`) so the\n  // referenced session must actually belong to the JWT's subject. Without this\n  // binding, a forged-but-otherwise-valid token could pair `sub` for one user with\n  // a still-live `sid` belonging to another, evading per-user session revocation\n  // (logout / deleteAllUserSessions / password reset).\n  const sessionPromise = sessionId !== null\n    ? findOneWithDecryption(em, Session, { id: sessionId, user: subjectId, deletedAt: null })\n    : Promise.resolve(null)\n  const userPromise = findOneWithDecryption(\n    em,\n    User,\n    { id: subjectId, deletedAt: null },\n    undefined,\n    { tenantId: actorTenantId, organizationId: actorOrganizationId },\n  )\n  const [session, user] = await Promise.all([sessionPromise, userPromise])\n\n  if (sessionId !== null) {\n    if (!session) return null\n    if (resolveSessionUserId(session) !== subjectId) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n  }\n\n  if (!user || user.isConfirmed === false) return null\n\n  const currentTenantId = normalizeScopeId(user.tenantId ?? null)\n  const currentOrganizationId = normalizeScopeId(user.organizationId ?? null)\n  if (\n    currentTenantId === INVALID_SCOPE ||\n    currentOrganizationId === INVALID_SCOPE ||\n    currentTenantId !== actorTenantId ||\n    currentOrganizationId !== actorOrganizationId\n  ) {\n    return null\n  }\n\n  // Role links and the per-user super-admin flag are likewise independent, so they\n  // run concurrently. The role-level super-admin lookup depends on the resolved\n  // role ids, so it stays sequential after the links resolve (and is skipped\n  // entirely when the per-user flag already grants super-admin).\n  const linksPromise = currentTenantId\n    ? findWithDecryption(\n        em,\n        UserRole,\n        {\n          user: user.id,\n          deletedAt: null,\n          role: { tenantId: currentTenantId, deletedAt: null } as unknown as Role,\n        } as never,\n        { populate: ['role'] },\n        { tenantId: currentTenantId, organizationId: currentOrganizationId },\n      )\n    : Promise.resolve([] as UserRole[])\n  const userAclSuperAdminPromise = currentTenantId\n    ? userAclGrantsSuperAdmin(em, user.id, currentTenantId, currentOrganizationId)\n    : Promise.resolve(false)\n  const [links, userAclSuperAdmin] = await Promise.all([linksPromise, userAclSuperAdminPromise])\n\n  const linkedRoles = links\n    .map((link) => link.role)\n    .filter((role): role is Role => !!role)\n\n  const roles = linkedRoles\n    .map((role) => role.name)\n    .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n\n  const isSuperAdmin = currentTenantId\n    ? userAclSuperAdmin || (await roleAclGrantsSuperAdmin(em, linkedRoles, currentTenantId, currentOrganizationId))\n    : false\n\n  return {\n    ...auth,\n    sub: user.id,\n    tenantId: currentTenantId,\n    orgId: currentOrganizationId,\n    roles,\n    isSuperAdmin,\n  }\n}\n\nfunction resolveSessionUserId(session: Session): string | null {\n  const owner = (session as { user?: unknown }).user\n  if (typeof owner === 'string') return owner\n  if (owner && typeof owner === 'object') {\n    const ownerId = (owner as { id?: unknown }).id\n    if (typeof ownerId === 'string') return ownerId\n  }\n  return null\n}\n\nasync function userAclGrantsSuperAdmin(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const userAcl = await findOneWithDecryption(\n    em,\n    UserAcl,\n    {\n      user: userId,\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(userAcl && (userAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nasync function roleAclGrantsSuperAdmin(\n  em: EntityManager,\n  linkedRoles: Role[],\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const roleIds = Array.from(\n    new Set(\n      linkedRoles\n        .map((role) => (role?.id ? String(role.id) : null))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0),\n    ),\n  )\n  if (!roleIds.length) return false\n\n  const roleAcl = await findOneWithDecryption(\n    em,\n    RoleAcl,\n    {\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n      role: { $in: roleIds },\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(roleAcl && (roleAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nexport async function isAuthContextValid(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<boolean> {\n  return (await resolveCanonicalStaffAuthContext(em, auth)) !== null\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAe,SAAS,SAAS,MAAM,SAAS,gBAAgB;AAEhE,MAAM,UAAU;AAChB,MAAM,gBAAgB,uBAAO,eAAe;AAI5C,SAAS,iBAAiB,OAAmC;AAC3D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,KAAK,OAAO,IAAI,UAAU;AAC3C;AAEA,SAAS,qBAAqB,MAAmD;AAC/E,QAAM,gBAAiB,KAAqC;AAC5D,SAAO,iBAAiB,iBAAiB,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,2BAA2B,MAAmD;AACrF,QAAM,aAAc,KAAkC;AACtD,SAAO,iBAAiB,cAAc,KAAK,SAAS,IAAI;AAC1D;AAEA,eAAsB,iCACpB,IACA,MACsB;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAU,QAAO;AAE1B,QAAM,YAAY,iBAAiB,KAAK,GAAG;AAC3C,QAAM,gBAAgB,qBAAqB,IAAI;AAC/C,QAAM,sBAAsB,2BAA2B,IAAI;AAC3D,MACE,cAAc,iBACd,kBAAkB,iBAClB,wBAAwB,eACxB;AACA,WAAO;AAAA,EACT;AAWA,QAAM,YAAY,iBAAiB,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,IAAI;AACjF,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,MAAM;AAItB,QAAK,KAAiC,iBAAiB,MAAM;AAAA,IAE7D,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAYA,QAAM,iBAAiB,cAAc,OACjC,sBAAsB,IAAI,SAAS,EAAE,IAAI,WAAW,MAAM,WAAW,WAAW,KAAK,CAAC,IACtF,QAAQ,QAAQ,IAAI;AACxB,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,WAAW,WAAW,KAAK;AAAA,IACjC;AAAA,IACA,EAAE,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,EACjE;AACA,QAAM,CAAC,SAAS,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAEvE,MAAI,cAAc,MAAM;AACtB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,qBAAqB,OAAO,MAAM,UAAW,QAAO;AACxD,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAAA,EACvD;AAEA,MAAI,CAAC,QAAQ,KAAK,gBAAgB,MAAO,QAAO;AAEhD,QAAM,kBAAkB,iBAAiB,KAAK,YAAY,IAAI;AAC9D,QAAM,wBAAwB,iBAAiB,KAAK,kBAAkB,IAAI;AAC1E,MACE,oBAAoB,iBACpB,0BAA0B,iBAC1B,oBAAoB,iBACpB,0BAA0B,qBAC1B;AACA,WAAO;AAAA,EACT;AAMA,QAAM,eAAe,kBACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM,EAAE,UAAU,iBAAiB,WAAW,KAAK;AAAA,IACrD;AAAA,IACA,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,iBAAiB,gBAAgB,sBAAsB;AAAA,EACrE,IACA,QAAQ,QAAQ,CAAC,CAAe;AACpC,QAAM,2BAA2B,kBAC7B,wBAAwB,IAAI,KAAK,IAAI,iBAAiB,qBAAqB,IAC3E,QAAQ,QAAQ,KAAK;AACzB,QAAM,CAAC,OAAO,iBAAiB,IAAI,MAAM,QAAQ,IAAI,CAAC,cAAc,wBAAwB,CAAC;AAE7F,QAAM,cAAc,MACjB,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI;AAExC,QAAM,QAAQ,YACX,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAEtF,QAAM,eAAe,kBACjB,qBAAsB,MAAM,wBAAwB,IAAI,aAAa,iBAAiB,qBAAqB,IAC3G;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAiC;AAC7D,QAAM,QAAS,QAA+B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA2B;AAC5C,QAAI,OAAO,YAAY,SAAU,QAAO;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,eAAe,wBACb,IACA,QACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAe,wBACb,IACA,aACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB,IAAI;AAAA,MACF,YACG,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,MAAM,EAAE,KAAK,QAAQ;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAsB,mBACpB,IACA,MACkB;AAClB,SAAQ,MAAM,iCAAiC,IAAI,IAAI,MAAO;AAChE;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, Session, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\nconst INVALID_SCOPE = Symbol('invalid-scope')\n\ntype NormalizedScopeId = string | null | typeof INVALID_SCOPE\n\nfunction normalizeScopeId(value: unknown): NormalizedScopeId {\n  if (value === null || value === undefined) return null\n  if (typeof value !== 'string') return INVALID_SCOPE\n  const trimmed = value.trim()\n  if (!trimmed) return null\n  return UUID_RE.test(trimmed) ? trimmed : INVALID_SCOPE\n}\n\nfunction resolveActorTenantId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorTenantId = (auth as { actorTenantId?: unknown }).actorTenantId\n  return normalizeScopeId(actorTenantId ?? auth.tenantId ?? null)\n}\n\nfunction resolveActorOrganizationId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorOrgId = (auth as { actorOrgId?: unknown }).actorOrgId\n  return normalizeScopeId(actorOrgId ?? auth.orgId ?? null)\n}\n\nexport async function resolveCanonicalStaffAuthContext(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<AuthContext> {\n  if (!auth) return null\n  if (auth.isApiKey) return auth\n\n  const subjectId = normalizeScopeId(auth.sub)\n  const actorTenantId = resolveActorTenantId(auth)\n  const actorOrganizationId = resolveActorOrganizationId(auth)\n  if (\n    subjectId === INVALID_SCOPE ||\n    actorTenantId === INVALID_SCOPE ||\n    actorOrganizationId === INVALID_SCOPE\n  ) {\n    return null\n  }\n\n  // Session binding: when the JWT carries an `sid` claim, require the referenced session to\n  // still exist (not soft-deleted, not expired). This is what makes logout / password-reset\n  // actually invalidate an already-issued JWT.\n  //\n  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period so\n  // that rolling deployments don't force-logout every user. `verifyJwt` owns that window: it only\n  // marks a payload `_legacyToken` while the token's own `iat` is within JWT_LEGACY_GRACE_MINUTES\n  // and before JWT_LEGACY_CUTOVER_AT, so an aged or post-cutover raw-secret token fails\n  // verification before reaching this point and every remaining token must carry a live `sid`.\n  const sessionId = normalizeScopeId(typeof auth.sid === 'string' ? auth.sid : null)\n  if (sessionId === INVALID_SCOPE) return null\n  if (sessionId === null) {\n    // Legacy token without sid \u2014 allow only if it was verified via the legacy fallback path.\n    // The `_legacyToken` flag is set by `verifyJwt` when a token passes raw-secret verification\n    // but fails audience-derived verification. Without this flag, reject.\n    if ((auth as Record<string, unknown>)._legacyToken === true) {\n      // Allow through without session validation \u2014 the token will expire naturally\n    } else {\n      return null\n    }\n  }\n  // The session-revocation check and the user load are independent (neither reads\n  // the other's result), so they run concurrently to collapse two sequential DB\n  // round-trips into one. The `em` here is a fresh request-scoped EntityManager\n  // (resolved per request, never inside an explicit transaction), so concurrent\n  // reads on it are safe.\n  //\n  // The session lookup is bound to the token subject (`user: subjectId`) so the\n  // referenced session must actually belong to the JWT's subject. Without this\n  // binding, a forged-but-otherwise-valid token could pair `sub` for one user with\n  // a still-live `sid` belonging to another, evading per-user session revocation\n  // (logout / deleteAllUserSessions / password reset).\n  const sessionPromise = sessionId !== null\n    ? findOneWithDecryption(em, Session, { id: sessionId, user: subjectId, deletedAt: null })\n    : Promise.resolve(null)\n  const userPromise = findOneWithDecryption(\n    em,\n    User,\n    { id: subjectId, deletedAt: null },\n    undefined,\n    { tenantId: actorTenantId, organizationId: actorOrganizationId },\n  )\n  const [session, user] = await Promise.all([sessionPromise, userPromise])\n\n  if (sessionId !== null) {\n    if (!session) return null\n    if (resolveSessionUserId(session) !== subjectId) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n  }\n\n  if (!user || user.isConfirmed === false) return null\n\n  const currentTenantId = normalizeScopeId(user.tenantId ?? null)\n  const currentOrganizationId = normalizeScopeId(user.organizationId ?? null)\n  if (\n    currentTenantId === INVALID_SCOPE ||\n    currentOrganizationId === INVALID_SCOPE ||\n    currentTenantId !== actorTenantId ||\n    currentOrganizationId !== actorOrganizationId\n  ) {\n    return null\n  }\n  if (!(await isStaffTenantActive(em, currentTenantId))) return null\n\n  // Role links and the per-user super-admin flag are likewise independent, so they\n  // run concurrently. The role-level super-admin lookup depends on the resolved\n  // role ids, so it stays sequential after the links resolve (and is skipped\n  // entirely when the per-user flag already grants super-admin).\n  const linksPromise = currentTenantId\n    ? findWithDecryption(\n        em,\n        UserRole,\n        {\n          user: user.id,\n          deletedAt: null,\n          role: { tenantId: currentTenantId, deletedAt: null } as unknown as Role,\n        } as never,\n        { populate: ['role'] },\n        { tenantId: currentTenantId, organizationId: currentOrganizationId },\n      )\n    : Promise.resolve([] as UserRole[])\n  const userAclSuperAdminPromise = currentTenantId\n    ? userAclGrantsSuperAdmin(em, user.id, currentTenantId, currentOrganizationId)\n    : Promise.resolve(false)\n  const [links, userAclSuperAdmin] = await Promise.all([linksPromise, userAclSuperAdminPromise])\n\n  const linkedRoles = links\n    .map((link) => link.role)\n    .filter((role): role is Role => !!role)\n\n  const roles = linkedRoles\n    .map((role) => role.name)\n    .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n\n  const isSuperAdmin = currentTenantId\n    ? userAclSuperAdmin || (await roleAclGrantsSuperAdmin(em, linkedRoles, currentTenantId, currentOrganizationId))\n    : false\n\n  return {\n    ...auth,\n    sub: user.id,\n    tenantId: currentTenantId,\n    orgId: currentOrganizationId,\n    roles,\n    isSuperAdmin,\n  }\n}\n\nfunction resolveSessionUserId(session: Session): string | null {\n  const owner = (session as { user?: unknown }).user\n  if (typeof owner === 'string') return owner\n  if (owner && typeof owner === 'object') {\n    const ownerId = (owner as { id?: unknown }).id\n    if (typeof ownerId === 'string') return ownerId\n  }\n  return null\n}\n\nasync function userAclGrantsSuperAdmin(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const userAcl = await findOneWithDecryption(\n    em,\n    UserAcl,\n    {\n      user: userId,\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(userAcl && (userAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nasync function roleAclGrantsSuperAdmin(\n  em: EntityManager,\n  linkedRoles: Role[],\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const roleIds = Array.from(\n    new Set(\n      linkedRoles\n        .map((role) => (role?.id ? String(role.id) : null))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0),\n    ),\n  )\n  if (!roleIds.length) return false\n\n  const roleAcl = await findOneWithDecryption(\n    em,\n    RoleAcl,\n    {\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n      role: { $in: roleIds },\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(roleAcl && (roleAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nexport async function isAuthContextValid(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<boolean> {\n  return (await resolveCanonicalStaffAuthContext(em, auth)) !== null\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAe,SAAS,SAAS,MAAM,SAAS,gBAAgB;AAChE,SAAS,2BAA2B;AAEpC,MAAM,UAAU;AAChB,MAAM,gBAAgB,uBAAO,eAAe;AAI5C,SAAS,iBAAiB,OAAmC;AAC3D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,KAAK,OAAO,IAAI,UAAU;AAC3C;AAEA,SAAS,qBAAqB,MAAmD;AAC/E,QAAM,gBAAiB,KAAqC;AAC5D,SAAO,iBAAiB,iBAAiB,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,2BAA2B,MAAmD;AACrF,QAAM,aAAc,KAAkC;AACtD,SAAO,iBAAiB,cAAc,KAAK,SAAS,IAAI;AAC1D;AAEA,eAAsB,iCACpB,IACA,MACsB;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAU,QAAO;AAE1B,QAAM,YAAY,iBAAiB,KAAK,GAAG;AAC3C,QAAM,gBAAgB,qBAAqB,IAAI;AAC/C,QAAM,sBAAsB,2BAA2B,IAAI;AAC3D,MACE,cAAc,iBACd,kBAAkB,iBAClB,wBAAwB,eACxB;AACA,WAAO;AAAA,EACT;AAWA,QAAM,YAAY,iBAAiB,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,IAAI;AACjF,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,MAAM;AAItB,QAAK,KAAiC,iBAAiB,MAAM;AAAA,IAE7D,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAYA,QAAM,iBAAiB,cAAc,OACjC,sBAAsB,IAAI,SAAS,EAAE,IAAI,WAAW,MAAM,WAAW,WAAW,KAAK,CAAC,IACtF,QAAQ,QAAQ,IAAI;AACxB,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,WAAW,WAAW,KAAK;AAAA,IACjC;AAAA,IACA,EAAE,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,EACjE;AACA,QAAM,CAAC,SAAS,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAEvE,MAAI,cAAc,MAAM;AACtB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,qBAAqB,OAAO,MAAM,UAAW,QAAO;AACxD,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAAA,EACvD;AAEA,MAAI,CAAC,QAAQ,KAAK,gBAAgB,MAAO,QAAO;AAEhD,QAAM,kBAAkB,iBAAiB,KAAK,YAAY,IAAI;AAC9D,QAAM,wBAAwB,iBAAiB,KAAK,kBAAkB,IAAI;AAC1E,MACE,oBAAoB,iBACpB,0BAA0B,iBAC1B,oBAAoB,iBACpB,0BAA0B,qBAC1B;AACA,WAAO;AAAA,EACT;AACA,MAAI,CAAE,MAAM,oBAAoB,IAAI,eAAe,EAAI,QAAO;AAM9D,QAAM,eAAe,kBACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM,EAAE,UAAU,iBAAiB,WAAW,KAAK;AAAA,IACrD;AAAA,IACA,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,iBAAiB,gBAAgB,sBAAsB;AAAA,EACrE,IACA,QAAQ,QAAQ,CAAC,CAAe;AACpC,QAAM,2BAA2B,kBAC7B,wBAAwB,IAAI,KAAK,IAAI,iBAAiB,qBAAqB,IAC3E,QAAQ,QAAQ,KAAK;AACzB,QAAM,CAAC,OAAO,iBAAiB,IAAI,MAAM,QAAQ,IAAI,CAAC,cAAc,wBAAwB,CAAC;AAE7F,QAAM,cAAc,MACjB,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI;AAExC,QAAM,QAAQ,YACX,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAEtF,QAAM,eAAe,kBACjB,qBAAsB,MAAM,wBAAwB,IAAI,aAAa,iBAAiB,qBAAqB,IAC3G;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAiC;AAC7D,QAAM,QAAS,QAA+B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA2B;AAC5C,QAAI,OAAO,YAAY,SAAU,QAAO;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,eAAe,wBACb,IACA,QACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAe,wBACb,IACA,aACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB,IAAI;AAAA,MACF,YACG,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,MAAM,EAAE,KAAK,QAAQ;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAsB,mBACpB,IACA,MACkB;AAClB,SAAQ,MAAM,iCAAiC,IAAI,IAAI,MAAO;AAChE;",
   "names": []
 }

package/dist/modules/auth/lib/tenantEligibility.js

@@ -0,0 +1,16 @@
+import { Tenant } from "@open-mercato/core/modules/directory/data/entities";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+async function isStaffTenantActive(em, tenantId) {
+  if (tenantId == null) return true;
+  const tenant = await findOneWithDecryption(
+    em,
+    Tenant,
+    { id: tenantId, isActive: true, deletedAt: null },
+    { fields: ["id"], refresh: true }
+  );
+  return tenant !== null;
+}
+export {
+  isStaffTenantActive
+};
+//# sourceMappingURL=tenantEligibility.js.map

package/dist/modules/auth/lib/tenantEligibility.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/tenantEligibility.ts"],
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { Tenant } from '@open-mercato/core/modules/directory/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport async function isStaffTenantActive(\n  em: EntityManager,\n  tenantId: string | null | undefined,\n): Promise<boolean> {\n  if (tenantId == null) return true\n  const tenant = await findOneWithDecryption(\n    em,\n    Tenant,\n    { id: tenantId, isActive: true, deletedAt: null },\n    { fields: ['id'], refresh: true },\n  )\n  return tenant !== null\n}\n"],
+  "mappings": "AACA,SAAS,cAAc;AACvB,SAAS,6BAA6B;AAEtC,eAAsB,oBACpB,IACA,UACkB;AAClB,MAAI,YAAY,KAAM,QAAO;AAC7B,QAAM,SAAS,MAAM;AAAA,IACnB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,UAAU,UAAU,MAAM,WAAW,KAAK;AAAA,IAChD,EAAE,QAAQ,CAAC,IAAI,GAAG,SAAS,KAAK;AAAA,EAClC;AACA,SAAO,WAAW;AACpB;",
+  "names": []
+}

package/dist/modules/auth/services/authService.js

@@ -3,6 +3,7 @@ import { User, UserRole, Session, PasswordReset } from "@open-mercato/core/modul
 import { emailHashLookupValues } from "@open-mercato/core/modules/auth/lib/emailHash";
 import { generateAuthToken, hashAuthToken } from "@open-mercato/core/modules/auth/lib/tokenHash";
 import { findWithDecryption, findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { isStaffTenantActive } from "@open-mercato/core/modules/auth/lib/tenantEligibility";
 const TIMING_EQUALIZER_PASSWORD_HASH = "$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6";
 class AuthService {
   constructor(em) {
@@ -68,6 +69,9 @@ class AuthService {
     return links.map((l) => l.role).filter((role) => !!role).map((role) => role.name).filter((name) => typeof name === "string" && name.trim().length > 0);
   }
   async createSession(user, expiresAt) {
+    if (!await isStaffTenantActive(this.em, user.tenantId)) {
+      throw new Error("[internal] Tenant is not available for authentication");
+    }
     const rawToken = generateAuthToken();
     const tokenHash = hashAuthToken(rawToken);
     const sess = this.em.create(Session, { user, token: tokenHash, expiresAt, createdAt: /* @__PURE__ */ new Date() });
@@ -97,6 +101,7 @@ class AuthService {
     if (!sess || sess.expiresAt <= now) return null;
     const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null });
     if (!user) return null;
+    if (!await isStaffTenantActive(this.em, user.tenantId)) return null;
     const roles = await this.getUserRoles(user, user.tenantId ?? null);
     return { user, roles, session: sess };
   }

package/dist/modules/auth/services/authService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/services/authService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  private async findUnconsumedPasswordReset(token: string): Promise<PasswordReset | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row) return null\n    if (row.usedAt && row.usedAt <= now) return null\n    if (row.expiresAt <= now) return null\n    return row\n  }\n\n  async isPasswordResetTokenValid(token: string): Promise<boolean> {\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return false\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    return user != null\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
-  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAO1D,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAc,4BAA4B,OAA8C;AACtF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,UAAU,IAAI,UAAU,IAAK,QAAO;AAC5C,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,OAAiC;AAC/D,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AAGjB,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { compare, hash } from 'bcryptjs'\nimport { User, Role, UserRole, Session, PasswordReset } from '@open-mercato/core/modules/auth/data/entities'\nimport { emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'\nimport { generateAuthToken, hashAuthToken } from '@open-mercato/core/modules/auth/lib/tokenHash'\nimport { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { isStaffTenantActive } from '@open-mercato/core/modules/auth/lib/tenantEligibility'\n\n// A fixed, valid bcrypt hash (cost 10) of a throwaway value no real password\n// can match. verifyPassword compares against it whenever the user is missing or\n// has no password hash, so a failed login spends the same bcrypt CPU time\n// regardless of whether the account exists \u2014 closing the timing side channel\n// for account enumeration (issue #2242).\nconst TIMING_EQUALIZER_PASSWORD_HASH = '$2b$10$OcZrhmZpIzJOjkfwUrk7d.Nl0eHNzOvalBcBlt5Ran.4lj8R3HZg6'\n\nexport class AuthService {\n  constructor(private em: EntityManager) {}\n\n  async findUserByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUsersByEmail(email: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findWithDecryption(this.em, User, {\n      deletedAt: null,\n      $or: [\n        { email },\n        { emailHash: { $in: emailHashes } },\n      ],\n    } as any)\n  }\n\n  async findUserByEmailAndTenant(email: string, tenantId: string) {\n    const emailHashes = emailHashLookupValues(email)\n    return findOneWithDecryption(\n      this.em,\n      User,\n      {\n        tenantId,\n        deletedAt: null,\n        $or: [\n          { email },\n          { emailHash: { $in: emailHashes } },\n        ],\n      } as any,\n      undefined,\n      { tenantId },\n    )\n  }\n\n  async verifyPassword(user: User | null, password: string) {\n    const storedHash = user?.passwordHash ?? null\n    // Always run a bcrypt comparison \u2014 against a fixed dummy hash when the user\n    // is absent or has no password \u2014 so login latency does not reveal whether\n    // the account exists (timing-based enumeration, issue #2242).\n    const matched = await compare(password, storedHash ?? TIMING_EQUALIZER_PASSWORD_HASH)\n    return storedHash !== null && matched\n  }\n\n  async updateLastLoginAt(user: User) {\n    const now = new Date()\n    // Use native update to avoid flushing unrelated entities that might be pending in this EM\n    await this.em.nativeUpdate(User, { id: user.id }, { lastLoginAt: now })\n    user.lastLoginAt = now\n  }\n\n  async getUserRoles(user: User, tenantId?: string | null): Promise<string[]> {\n    const resolvedTenantId = tenantId ?? user.tenantId ?? null\n    if (!resolvedTenantId) return []\n    const links = await findWithDecryption(\n      this.em,\n      UserRole,\n      { user, deletedAt: null, role: { tenantId: resolvedTenantId, deletedAt: null } as any },\n      { populate: ['role'] },\n      { tenantId: resolvedTenantId, organizationId: user.organizationId ?? null },\n    )\n    // A populated `role` can still be null when the link points at a soft-deleted\n    // role (the Role soft-delete filter suppresses hydration), e.g. an admin link\n    // orphaned by a re-seed during interrupted-provisioning recovery. Dropping such\n    // links keeps role resolution from throwing on the login / session-refresh hot\n    // path, mirroring resolveCanonicalStaffAuthContext in lib/sessionIntegrity.ts.\n    return links\n      .map((l) => l.role)\n      .filter((role): role is Role => !!role)\n      .map((role) => role.name)\n      .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n  }\n\n\n  async createSession(user: User, expiresAt: Date): Promise<{ session: Session; token: string }> {\n    if (!(await isStaffTenantActive(this.em, user.tenantId))) {\n      throw new Error('[internal] Tenant is not available for authentication')\n    }\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const sess = this.em.create(Session as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(sess).flush()\n    return { session: sess as Session, token: rawToken }\n  }\n\n  async deleteSessionByToken(token: string) {\n    const hashedToken = hashAuthToken(token)\n    await this.em.nativeDelete(Session, { token: hashedToken })\n  }\n\n  async deleteSessionById(sessionId: string) {\n    await this.em.nativeDelete(Session, { id: sessionId })\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<Session | null> {\n    const session = await this.em.findOne(Session, { id: sessionId, deletedAt: null })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async deleteAllUserSessions(userId: string) {\n    await this.em.nativeDelete(Session, { user: userId })\n  }\n\n  async refreshFromSessionToken(token: string) {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const sess = await this.em.findOne(Session, { token: hashedToken })\n    if (!sess || sess.expiresAt <= now) return null\n    const user = await findOneWithDecryption(this.em, User, { id: sess.user.id, deletedAt: null })\n    if (!user) return null\n    if (!(await isStaffTenantActive(this.em, user.tenantId))) return null\n    const roles = await this.getUserRoles(user, user.tenantId ?? null)\n    return { user, roles, session: sess }\n  }\n\n  async requestPasswordReset(email: string) {\n    const user = await this.findUserByEmail(email)\n    if (!user) return null\n    const rawToken = generateAuthToken()\n    const tokenHash = hashAuthToken(rawToken)\n    const expiresAt = new Date(Date.now() + 60 * 60 * 1000)\n    const row = this.em.create(PasswordReset as any, { user, token: tokenHash, expiresAt, createdAt: new Date() } as any)\n    await this.em.persist(row).flush()\n    return { user, token: rawToken }\n  }\n\n  private async findUnconsumedPasswordReset(token: string): Promise<PasswordReset | null> {\n    const now = new Date()\n    const hashedToken = hashAuthToken(token)\n    const row = await this.em.findOne(PasswordReset, { token: hashedToken })\n    if (!row) return null\n    if (row.usedAt && row.usedAt <= now) return null\n    if (row.expiresAt <= now) return null\n    return row\n  }\n\n  async isPasswordResetTokenValid(token: string): Promise<boolean> {\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return false\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    return user != null\n  }\n\n  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {\n    const now = new Date()\n    const row = await this.findUnconsumedPasswordReset(token)\n    if (!row) return null\n\n    // Atomic compare-and-set: only mark used if still unused \u2014 prevents token replay under concurrency\n    const affected = await this.em.nativeUpdate(\n      PasswordReset,\n      { id: row.id, usedAt: null },\n      { usedAt: now },\n    )\n    if (affected === 0) return null\n\n    const user = await findOneWithDecryption(this.em, User, { id: row.user.id, deletedAt: null })\n    if (!user) return null\n    user.passwordHash = await hash(newPassword, 10)\n    await this.em.flush()\n    await this.deleteAllUserSessions(String(user.id))\n    return user\n  }\n}\n"],
+  "mappings": "AACA,SAAS,SAAS,YAAY;AAC9B,SAAS,MAAY,UAAU,SAAS,qBAAqB;AAC7D,SAAS,6BAA6B;AACtC,SAAS,mBAAmB,qBAAqB;AACjD,SAAS,oBAAoB,6BAA6B;AAC1D,SAAS,2BAA2B;AAOpC,MAAM,iCAAiC;AAEhC,MAAM,YAAY;AAAA,EACvB,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,gBAAgB,OAAe;AACnC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,sBAAsB,KAAK,IAAI,MAAM;AAAA,MAC1C,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,iBAAiB,OAAe;AACpC,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO,mBAAmB,KAAK,IAAI,MAAM;AAAA,MACvC,WAAW;AAAA,MACX,KAAK;AAAA,QACH,EAAE,MAAM;AAAA,QACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,MACpC;AAAA,IACF,CAAQ;AAAA,EACV;AAAA,EAEA,MAAM,yBAAyB,OAAe,UAAkB;AAC9D,UAAM,cAAc,sBAAsB,KAAK;AAC/C,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE;AAAA,QACA,WAAW;AAAA,QACX,KAAK;AAAA,UACH,EAAE,MAAM;AAAA,UACR,EAAE,WAAW,EAAE,KAAK,YAAY,EAAE;AAAA,QACpC;AAAA,MACF;AAAA,MACA;AAAA,MACA,EAAE,SAAS;AAAA,IACb;AAAA,EACF;AAAA,EAEA,MAAM,eAAe,MAAmB,UAAkB;AACxD,UAAM,aAAa,MAAM,gBAAgB;AAIzC,UAAM,UAAU,MAAM,QAAQ,UAAU,cAAc,8BAA8B;AACpF,WAAO,eAAe,QAAQ;AAAA,EAChC;AAAA,EAEA,MAAM,kBAAkB,MAAY;AAClC,UAAM,MAAM,oBAAI,KAAK;AAErB,UAAM,KAAK,GAAG,aAAa,MAAM,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,aAAa,IAAI,CAAC;AACtE,SAAK,cAAc;AAAA,EACrB;AAAA,EAEA,MAAM,aAAa,MAAY,UAA6C;AAC1E,UAAM,mBAAmB,YAAY,KAAK,YAAY;AACtD,QAAI,CAAC,iBAAkB,QAAO,CAAC;AAC/B,UAAM,QAAQ,MAAM;AAAA,MAClB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,MAAM,WAAW,MAAM,MAAM,EAAE,UAAU,kBAAkB,WAAW,KAAK,EAAS;AAAA,MACtF,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,kBAAkB,gBAAgB,KAAK,kBAAkB,KAAK;AAAA,IAC5E;AAMA,WAAO,MACJ,IAAI,CAAC,MAAM,EAAE,IAAI,EACjB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI,EACrC,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAAA,EACxF;AAAA,EAGA,MAAM,cAAc,MAAY,WAA+D;AAC7F,QAAI,CAAE,MAAM,oBAAoB,KAAK,IAAI,KAAK,QAAQ,GAAI;AACxD,YAAM,IAAI,MAAM,uDAAuD;AAAA,IACzE;AACA,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,OAAO,KAAK,GAAG,OAAO,SAAgB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AAC/G,UAAM,KAAK,GAAG,QAAQ,IAAI,EAAE,MAAM;AAClC,WAAO,EAAE,SAAS,MAAiB,OAAO,SAAS;AAAA,EACrD;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,OAAO,YAAY,CAAC;AAAA,EAC5D;AAAA,EAEA,MAAM,kBAAkB,WAAmB;AACzC,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,IAAI,UAAU,CAAC;AAAA,EACvD;AAAA,EAEA,MAAM,sBAAsB,WAA4C;AACtE,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,IAAI,WAAW,WAAW,KAAK,CAAC;AACjF,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,sBAAsB,QAAgB;AAC1C,UAAM,KAAK,GAAG,aAAa,SAAS,EAAE,MAAM,OAAO,CAAC;AAAA,EACtD;AAAA,EAEA,MAAM,wBAAwB,OAAe;AAC3C,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,OAAO,MAAM,KAAK,GAAG,QAAQ,SAAS,EAAE,OAAO,YAAY,CAAC;AAClE,QAAI,CAAC,QAAQ,KAAK,aAAa,IAAK,QAAO;AAC3C,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,KAAK,KAAK,IAAI,WAAW,KAAK,CAAC;AAC7F,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,CAAE,MAAM,oBAAoB,KAAK,IAAI,KAAK,QAAQ,EAAI,QAAO;AACjE,UAAM,QAAQ,MAAM,KAAK,aAAa,MAAM,KAAK,YAAY,IAAI;AACjE,WAAO,EAAE,MAAM,OAAO,SAAS,KAAK;AAAA,EACtC;AAAA,EAEA,MAAM,qBAAqB,OAAe;AACxC,UAAM,OAAO,MAAM,KAAK,gBAAgB,KAAK;AAC7C,QAAI,CAAC,KAAM,QAAO;AAClB,UAAM,WAAW,kBAAkB;AACnC,UAAM,YAAY,cAAc,QAAQ;AACxC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,KAAK,KAAK,GAAI;AACtD,UAAM,MAAM,KAAK,GAAG,OAAO,eAAsB,EAAE,MAAM,OAAO,WAAW,WAAW,WAAW,oBAAI,KAAK,EAAE,CAAQ;AACpH,UAAM,KAAK,GAAG,QAAQ,GAAG,EAAE,MAAM;AACjC,WAAO,EAAE,MAAM,OAAO,SAAS;AAAA,EACjC;AAAA,EAEA,MAAc,4BAA4B,OAA8C;AACtF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,cAAc,cAAc,KAAK;AACvC,UAAM,MAAM,MAAM,KAAK,GAAG,QAAQ,eAAe,EAAE,OAAO,YAAY,CAAC;AACvE,QAAI,CAAC,IAAK,QAAO;AACjB,QAAI,IAAI,UAAU,IAAI,UAAU,IAAK,QAAO;AAC5C,QAAI,IAAI,aAAa,IAAK,QAAO;AACjC,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,0BAA0B,OAAiC;AAC/D,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,WAAO,QAAQ;AAAA,EACjB;AAAA,EAEA,MAAM,qBAAqB,OAAe,aAA2C;AACnF,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,MAAM,MAAM,KAAK,4BAA4B,KAAK;AACxD,QAAI,CAAC,IAAK,QAAO;AAGjB,UAAM,WAAW,MAAM,KAAK,GAAG;AAAA,MAC7B;AAAA,MACA,EAAE,IAAI,IAAI,IAAI,QAAQ,KAAK;AAAA,MAC3B,EAAE,QAAQ,IAAI;AAAA,IAChB;AACA,QAAI,aAAa,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,sBAAsB,KAAK,IAAI,MAAM,EAAE,IAAI,IAAI,KAAK,IAAI,WAAW,KAAK,CAAC;AAC5F,QAAI,CAAC,KAAM,QAAO;AAClB,SAAK,eAAe,MAAM,KAAK,aAAa,EAAE;AAC9C,UAAM,KAAK,GAAG,MAAM;AACpB,UAAM,KAAK,sBAAsB,OAAO,KAAK,EAAE,CAAC;AAChD,WAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/api/admin/domain-mappings/[id]/health-check.js

@@ -15,15 +15,15 @@ async function POST(req, ctx) {
   if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: "Unauthorized" }, { status: 401 });
   const container = await createRequestContainer();
   const rbac = container.resolve("rbacService");
-  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId
-  });
-  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
   const { id } = await ctx.params;
   const service = container.resolve("domainMappingService");
   const record = await service.findById(id, { tenantId: auth.tenantId });
   if (!record) return NextResponse.json({ ok: false, error: "Not found" }, { status: 404 });
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId
+  });
+  if (!allowed) return NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 });
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: auth.tenantId,
     organizationId: record.organizationId,