@open-mercato/core 0.10.1-develop.7736.1.88e07906bf → 0.10.1-develop.7748.1.d745ba61aa

package/src/modules/attachments/lib/target-access-service.ts

@@ -2,7 +2,7 @@ import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Attachment, AttachmentPartition } from '../data/entities'
-import { checkAttachmentAccess } from './access'
+import { evaluateAttachmentAccess, type AttachmentAccessContext } from './access-runner'
 import { readAttachmentMetadata } from './metadata'
 
 export type AttachmentRecordTarget = {
@@ -19,7 +19,10 @@ export type AttachmentTargetAccessInput = {
 }
 
 export class AttachmentTargetAccessService {
-  constructor(private readonly em: EntityManager) {}
+  constructor(
+    private readonly em: EntityManager,
+    private readonly resolveAccessContext?: (() => AttachmentAccessContext) | null,
+  ) {}
 
   async canAccessLinkedTarget(input: AttachmentTargetAccessInput): Promise<boolean> {
     if (!input.targets.length) return false
@@ -44,7 +47,11 @@ export class AttachmentTargetAccessService {
       ],
     })
     if (!partition) return false
-    if (!checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true }).ok) return false
+    const access = await evaluateAttachmentAccess({
+      auth: input.auth, attachment, partition, action: 'read',
+      context: this.resolveAccessContext?.(), requireAuthForPublic: true,
+    })
+    if (!access.ok) return false
 
     const metadata = readAttachmentMetadata(attachment.storageMetadata)
     return input.targets.some((target) => (

package/src/modules/attachments/migrations/.snapshot-open-mercato.json

@@ -8,6 +8,23 @@
       "name": "attachment_partitions",
       "schema": "public",
       "columns": {
+        "access_resolver_requirements": {
+          "name": "access_resolver_requirements",
+          "type": "jsonb",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "collation": null,
+          "enumItems": [],
+          "mappedType": "json"
+        },
         "code": {
           "name": "code",
           "type": "text",

package/src/modules/attachments/migrations/Migration20261001120000_attachments.ts

@@ -0,0 +1,35 @@
+import { Migration } from '@mikro-orm/migrations'
+
+export class Migration20261001120000_attachments extends Migration {
+  override up(): void {
+    this.addSql('alter table "attachment_partitions" add column if not exists "access_resolver_requirements" jsonb null;')
+    this.addSql(`
+      update attachment_partitions as partition
+      set access_resolver_requirements = coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+        || '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb,
+        updated_at = now()
+      where (partition.access_resolver_requirements is null or jsonb_typeof(partition.access_resolver_requirements) = 'array')
+        and not coalesce(partition.access_resolver_requirements, '[]'::jsonb)
+          @> '[{"resolverId":"documents.document-attachments","targetEntity":"documents:document"}]'::jsonb
+        and exists (
+          select 1 from attachments as attachment
+          where attachment.partition_code = partition.code
+            and (
+              btrim(attachment.entity_id) = 'documents:document'
+              or exists (
+                select 1
+                from jsonb_array_elements(
+                  case jsonb_typeof(attachment.storage_metadata->'assignments')
+                    when 'array' then attachment.storage_metadata->'assignments'
+                    when 'object' then jsonb_build_array(attachment.storage_metadata->'assignments')
+                    else '[]'::jsonb
+                  end
+                ) as assignment
+                where jsonb_typeof(assignment) = 'object'
+                  and btrim(assignment->>'type') = 'documents:document'
+              )
+            )
+        );
+    `)
+  }
+}

package/src/modules/attachments/setup.ts

@@ -1,6 +1,16 @@
 import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+import { syncAttachmentAccessProtection } from './lib/access-protection'
+import { ensureDefaultPartitions } from './lib/partitions'
 
 export const setup: ModuleSetupConfig = {
+  async onTenantCreated({ em }) {
+    await ensureDefaultPartitions(em)
+    await syncAttachmentAccessProtection(em)
+  },
+  async seedDefaults({ em }) {
+    await ensureDefaultPartitions(em)
+    await syncAttachmentAccessProtection(em)
+  },
   defaultRoleFeatures: {
     admin: ['attachments.*', 'attachments.view', 'attachments.manage'],
     employee: ['attachments.view'],

package/src/modules/auth/i18n/de.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Einreichungsdaten exportieren (Datenübertragbarkeit, DSGVO Art. 15/20)",
   "auth.acl.features.forms.submissions.manage": "Einreichungen verwalten (erneut öffnen, Beteiligte zuweisen, exportieren)",
   "auth.acl.features.forms.view": "Formulare und Einreichungen ansehen",
+  "auth.acl.features.gateway_autopay.configure": "Configure Autopay gateway settings",
+  "auth.acl.features.gateway_autopay.view": "View Autopay gateway configuration",
   "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
   "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
   "auth.acl.features.gateway_tpay.configure": "Tpay-Gateway-Einstellungen konfigurieren",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Example Module",
   "auth.acl.modules.example_customers_sync": "Example Customers Sync",
   "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_autopay": "Autopay Payment Gateway",
   "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
   "auth.acl.modules.gateway_tpay": "Tpay-Zahlungsgateway",
   "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",

package/src/modules/auth/i18n/en.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Export submission data (GDPR Art. 15/20 portability)",
   "auth.acl.features.forms.submissions.manage": "Manage submissions (reopen, assign actors, export)",
   "auth.acl.features.forms.view": "View forms and submissions",
+  "auth.acl.features.gateway_autopay.configure": "Configure Autopay gateway settings",
+  "auth.acl.features.gateway_autopay.view": "View Autopay gateway configuration",
   "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
   "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
   "auth.acl.features.gateway_tpay.configure": "Configure Tpay gateway settings",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Example Module",
   "auth.acl.modules.example_customers_sync": "Example Customers Sync",
   "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_autopay": "Autopay Payment Gateway",
   "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
   "auth.acl.modules.gateway_tpay": "Tpay Payment Gateway",
   "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",

package/src/modules/auth/i18n/es.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Exportar datos de envíos (portabilidad, RGPD art. 15/20)",
   "auth.acl.features.forms.submissions.manage": "Gestionar envíos (reabrir, asignar participantes, exportar)",
   "auth.acl.features.forms.view": "Ver formularios y envíos",
+  "auth.acl.features.gateway_autopay.configure": "Configure Autopay gateway settings",
+  "auth.acl.features.gateway_autopay.view": "View Autopay gateway configuration",
   "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
   "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
   "auth.acl.features.gateway_tpay.configure": "Configurar los ajustes de la pasarela Tpay",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Example Module",
   "auth.acl.modules.example_customers_sync": "Example Customers Sync",
   "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_autopay": "Autopay Payment Gateway",
   "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
   "auth.acl.modules.gateway_tpay": "Pasarela de pago Tpay",
   "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",

package/src/modules/auth/i18n/ko.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Export submission data (GDPR Art. 15/20 portability)",
   "auth.acl.features.forms.submissions.manage": "Manage submissions (reopen, assign actors, export)",
   "auth.acl.features.forms.view": "View forms and submissions",
+  "auth.acl.features.gateway_autopay.configure": "Configure Autopay gateway settings",
+  "auth.acl.features.gateway_autopay.view": "View Autopay gateway configuration",
   "auth.acl.features.gateway_stripe.configure": "Configure Stripe gateway settings",
   "auth.acl.features.gateway_stripe.view": "View Stripe gateway configuration",
   "auth.acl.features.gateway_tpay.configure": "Tpay 게이트웨이 설정 구성",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Example Module",
   "auth.acl.modules.example_customers_sync": "Example Customers Sync",
   "auth.acl.modules.feature_toggles": "Feature Toggles",
+  "auth.acl.modules.gateway_autopay": "Autopay Payment Gateway",
   "auth.acl.modules.gateway_stripe": "Stripe Payment Gateway",
   "auth.acl.modules.gateway_tpay": "Tpay 결제 게이트웨이",
   "auth.acl.modules.inbox_ops": "InboxOps — Email-to-ERP Agent",

package/src/modules/auth/i18n/pl.json

@@ -228,6 +228,8 @@
   "auth.acl.features.forms.submissions.export": "Eksport danych zgłoszeń (przenoszenie danych, RODO art. 15/20)",
   "auth.acl.features.forms.submissions.manage": "Zarządzanie zgłoszeniami (ponowne otwieranie, przypisywanie uczestników, eksport)",
   "auth.acl.features.forms.view": "Przeglądanie formularzy i zgłoszeń",
+  "auth.acl.features.gateway_autopay.configure": "Konfiguruj ustawienia bramki Autopay",
+  "auth.acl.features.gateway_autopay.view": "Wyświetl konfigurację bramki Autopay",
   "auth.acl.features.gateway_stripe.configure": "Konfiguruj ustawienia bramki Stripe",
   "auth.acl.features.gateway_stripe.view": "Wyświetl konfigurację bramki Stripe",
   "auth.acl.features.gateway_tpay.configure": "Konfiguruj ustawienia bramki Tpay",
@@ -459,6 +461,7 @@
   "auth.acl.modules.example": "Moduł przykładowy",
   "auth.acl.modules.example_customers_sync": "Przykładowa synchronizacja klientów",
   "auth.acl.modules.feature_toggles": "Przełączniki funkcji",
+  "auth.acl.modules.gateway_autopay": "Bramka płatnicza Autopay",
   "auth.acl.modules.gateway_stripe": "Bramka płatnicza Stripe",
   "auth.acl.modules.gateway_tpay": "Bramka płatnicza Tpay",
   "auth.acl.modules.inbox_ops": "InboxOps — agent e-mail do ERP",

package/src/modules/notifications/api/[id]/action/route.ts

@@ -97,6 +97,14 @@ export const openApi = {
           },
         },
       },
+      403: {
+        description: 'The stored action command is not declared by the notification type with the same action id and command, or the user lacks the features the declared action requires (`code: notification_action_forbidden`)',
+        content: {
+          'application/json': {
+            schema: actionConflictResponseSchema,
+          },
+        },
+      },
       400: {
         description: 'Action not found or failed',
         content: {

package/src/modules/notifications/api/route.ts

@@ -9,6 +9,7 @@ import {
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
@@ -21,12 +22,14 @@ import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
   notificationValidationErrorResponse,
+  rejectNotificationActionCommands,
   resolveGuardedNotificationContext,
   resolveNotificationContext,
   runGuardedNotificationWrite,
   TENANT_SCOPE_REQUIRED_ERROR_CODE,
 } from '../lib/routeHelpers'
 import {
+  actionConflictResponseSchema,
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
   notificationItemSchema,
@@ -216,6 +219,8 @@ export async function POST(req: Request) {
   if (!parsed.success) {
     return notificationValidationErrorResponse(parsed.error)
   }
+  const commandRejection = await rejectNotificationActionCommands(parsed.data)
+  if (commandRejection) return commandRejection
 
   try {
     const guarded = await runGuardedNotificationWrite(
@@ -251,6 +256,7 @@ const notificationsCrudOpenApi = buildNotificationsCrudOpenApi({
 })
 
 const notificationsCrudGet = notificationsCrudOpenApi.methods?.GET ?? {}
+const notificationsCrudPost = notificationsCrudOpenApi.methods?.POST ?? {}
 
 // The CRUD factory documents errors only for DELETE, and POST already gets an auto-generated 403
 // from its `requireFeatures` metadata. GET is authenticated-only, so its tenant-scope rejection has
@@ -270,5 +276,16 @@ export const openApi: OpenApiRouteDoc = {
         },
       ],
     },
+    POST: {
+      ...notificationsCrudPost,
+      errors: [
+        ...(notificationsCrudPost.errors ?? []),
+        {
+          status: 400,
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          schema: actionConflictResponseSchema,
+        },
+      ],
+    },
   },
 }

package/src/modules/notifications/data/validators.ts

@@ -15,7 +15,7 @@ export const notificationActionSchema = z.object({
   labelKey: z.string().optional(),
   variant: z.enum(['default', 'secondary', 'destructive', 'outline', 'ghost']).optional(),
   icon: z.string().optional(),
-  commandId: z.string().optional(),
+  commandId: z.string().optional().describe('Refused by the HTTP create routes (400 notification_action_command_not_allowed); command actions are attached by server code from the notification type definition'),
   href: safeRelativeHrefSchema.optional(),
   confirmRequired: z.boolean().optional(),
   confirmMessage: z.string().optional(),

package/src/modules/notifications/i18n/de.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Ungültige Zustelleinstellungen",
   "notifications.empty": "Keine Benachrichtigungen",
   "notifications.error.action": "Aktion konnte nicht ausgeführt werden",
+  "notifications.error.actionCommandNotAllowed": "Über die API erstellte Benachrichtigungsaktionen dürfen keine Befehle ausführen",
+  "notifications.error.actionForbidden": "Sie dürfen diese Benachrichtigungsaktion nicht ausführen",
   "notifications.error.load": "Benachrichtigungen konnten nicht geladen werden",
   "notifications.filters.actionRequired": "Aktion erforderlich",
   "notifications.filters.all": "Alle",

package/src/modules/notifications/i18n/en.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Invalid delivery settings",
   "notifications.empty": "No notifications",
   "notifications.error.action": "Failed to execute action",
+  "notifications.error.actionCommandNotAllowed": "Notification actions created through the API cannot run commands",
+  "notifications.error.actionForbidden": "You are not allowed to run this notification action",
   "notifications.error.load": "Failed to load notifications",
   "notifications.filters.actionRequired": "Action Required",
   "notifications.filters.all": "All",

package/src/modules/notifications/i18n/es.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Configuración de entrega no válida",
   "notifications.empty": "Sin notificaciones",
   "notifications.error.action": "No se pudo ejecutar la acción",
+  "notifications.error.actionCommandNotAllowed": "Las acciones de notificación creadas mediante la API no pueden ejecutar comandos",
+  "notifications.error.actionForbidden": "No tienes permiso para ejecutar esta acción de notificación",
   "notifications.error.load": "No se pudieron cargar las notificaciones",
   "notifications.filters.actionRequired": "Acción requerida",
   "notifications.filters.all": "Todas",

package/src/modules/notifications/i18n/ko.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "잘못된 전달 설정입니다",
   "notifications.empty": "알림 없음",
   "notifications.error.action": "작업을 실행하지 못했습니다",
+  "notifications.error.actionCommandNotAllowed": "API로 생성한 알림 작업은 명령을 실행할 수 없습니다",
+  "notifications.error.actionForbidden": "이 알림 작업을 실행할 권한이 없습니다",
   "notifications.error.load": "알림을 불러오지 못했습니다",
   "notifications.filters.actionRequired": "조치 필요",
   "notifications.filters.all": "전체",

package/src/modules/notifications/i18n/pl.json

@@ -14,6 +14,8 @@
   "notifications.delivery.settings.invalid": "Nieprawidłowe ustawienia dostarczania",
   "notifications.empty": "Brak powiadomień",
   "notifications.error.action": "Nie udało się wykonać akcji",
+  "notifications.error.actionCommandNotAllowed": "Akcje powiadomień utworzone przez API nie mogą uruchamiać poleceń",
+  "notifications.error.actionForbidden": "Nie masz uprawnień do wykonania tej akcji powiadomienia",
   "notifications.error.load": "Nie udało się załadować powiadomień",
   "notifications.filters.actionRequired": "Wymagana akcja",
   "notifications.filters.all": "Wszystkie",

package/src/modules/notifications/lib/notificationService.ts

@@ -6,8 +6,13 @@ import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import {
   NOTIFICATION_ACTION_ALREADY_EXECUTED_ERROR_CODE,
+  NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  type NotificationAction,
   type NotificationPollData,
+  type NotificationTypeAction,
 } from '@open-mercato/shared/modules/notifications/types'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getTelemetryRuntime } from '@open-mercato/shared/lib/telemetry/runtime'
 import { NOTIFICATION_EVENTS, NOTIFICATION_SSE_EVENTS } from './events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -97,6 +102,27 @@ function actionAlreadyExecuted(): CrudHttpError {
   })
 }
 
+async function actionForbidden(): Promise<CrudHttpError> {
+  const { translate } = await resolveTranslations()
+  return new CrudHttpError(403, {
+    error: translate('notifications.error.actionForbidden', 'You are not allowed to run this notification action'),
+    code: NOTIFICATION_ACTION_FORBIDDEN_ERROR_CODE,
+  })
+}
+
+/**
+ * The command action the notification's registered type declares for a stored action: same action
+ * id (across `actions` and `optionalActions`) and same `commandId`. Anything else is not dispatched.
+ */
+function findDeclaredCommandAction(type: string, action: NotificationAction): NotificationTypeAction | null {
+  const definition = getNotificationType(type)
+  if (!definition) return null
+  const declared = [...definition.actions, ...(definition.optionalActions ?? [])]
+    .find((candidate) => candidate.id === action.id)
+  if (!declared?.commandId || declared.commandId !== action.commandId) return null
+  return declared
+}
+
 function applyNotificationContent(
   notification: Notification,
   input: NotificationContentInput,
@@ -285,6 +311,39 @@ export interface NotificationServiceDeps {
 export function createNotificationService(deps: NotificationServiceDeps): NotificationService {
   const { em: rootEm, eventBus, commandBus, container } = deps
 
+  /**
+   * Whether the clicking user holds every feature a declared notification action requires.
+   * Fails closed: no user, no container, or a failing RBAC check denies the action.
+   */
+  const userHoldsActionFeatures = async (
+    requiredFeatures: string[] | undefined,
+    scopeCtx: NotificationServiceContext,
+  ): Promise<boolean> => {
+    if (!requiredFeatures || requiredFeatures.length === 0) return true
+    if (!scopeCtx.userId || !container) return false
+    try {
+      const rbacService = container.resolve('rbacService') as {
+        userHasAllFeatures: (
+          userId: string,
+          features: string[],
+          scope: { tenantId: string | null; organizationId: string | null },
+        ) => Promise<boolean>
+      }
+      const allowed = await rbacService.userHasAllFeatures(
+        scopeCtx.userId,
+        requiredFeatures,
+        { tenantId: scopeCtx.tenantId, organizationId: scopeCtx.organizationId ?? null },
+      )
+      return allowed === true
+    } catch (err) {
+      getTelemetryRuntime()?.reportError(err, {
+        module: 'notifications',
+        code: 'notifications.action_feature_check_failed',
+      })
+      return false
+    }
+  }
+
   /**
    * Resolves the authoritative delivery-channel set for one recipient at create time — the single
    * gate that folds per-send target, per-type eligibility, registered strategies, and the
@@ -696,6 +755,13 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         throw actionAlreadyExecuted()
       }
 
+      if (action.commandId) {
+        const declared = findDeclaredCommandAction(notification.type, action)
+        if (!declared || !(await userHoldsActionFeatures(declared.requiredFeatures, ctx))) {
+          throw await actionForbidden()
+        }
+      }
+
       const actionedAt = new Date()
       const previousStatus = notification.status
       const previousActionedAt = notification.actionedAt ?? null
@@ -749,8 +815,8 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
       if (action.commandId && commandBus && container) {
         const commandInput = {
-          id: notification.sourceEntityId,
           ...input.payload,
+          id: notification.sourceEntityId,
         }
 
         // Build a CommandRuntimeContext from the notification service context

package/src/modules/notifications/lib/routeHelpers.ts

@@ -5,7 +5,9 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE } from '@open-mercato/shared/modules/notifications/types'
 import { resolveNotificationService, type NotificationService } from './notificationService'
+import { actionConflictResponseSchema } from '../api/openapi'
 
 /**
  * Mutation-guard resource kind for notification rows.
@@ -60,6 +62,32 @@ export async function notificationValidationErrorResponse(error: z.ZodError): Pr
   )
 }
 
+export type NotificationActionsPayload = { actions?: Array<{ commandId?: string | null }> | null }
+
+/**
+ * Reject an API-supplied action that carries a `commandId`.
+ *
+ * Command-backed actions run with the clicking user's identity, so only server code may attach
+ * them, from the notification type definition. Called after payload validation and before the
+ * mutation guard or the service write.
+ */
+export async function rejectNotificationActionCommands(
+  data: NotificationActionsPayload,
+): Promise<Response | null> {
+  if (!data.actions?.some((action) => action.commandId)) return null
+  const { t } = await resolveTranslations()
+  return Response.json(
+    {
+      error: t(
+        'notifications.error.actionCommandNotAllowed',
+        'Notification actions created through the API cannot run commands',
+      ),
+      code: NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE,
+    },
+    { status: 400 },
+  )
+}
+
 export function notificationCrudErrorResponse(error: unknown): Response | null {
   if (!isCrudHttpError(error)) return null
   return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
@@ -235,6 +263,8 @@ export function createBulkNotificationRoute<TSchema extends z.ZodTypeAny>(
     if (!parsed.success) {
       return notificationValidationErrorResponse(parsed.error)
     }
+    const commandRejection = await rejectNotificationActionCommands(parsed.data as NotificationActionsPayload)
+    if (commandRejection) return commandRejection
 
     try {
       const guarded = await runGuardedNotificationWrite(
@@ -298,6 +328,14 @@ export function createBulkNotificationOpenApi<TSchema extends z.ZodTypeAny>(
             },
           },
         },
+        400: {
+          description: `Invalid payload, or an action carries a \`commandId\` (code: ${NOTIFICATION_ACTION_COMMAND_NOT_ALLOWED_ERROR_CODE})`,
+          content: {
+            'application/json': {
+              schema: actionConflictResponseSchema,
+            },
+          },
+        },
       },
     },
   }

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -1,5 +1,5 @@
 import { randomUUID } from 'node:crypto'
-import { QueryOrder } from '@mikro-orm/core'
+import { LockMode, QueryOrder } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -21,7 +21,7 @@ import type { IntegrationStateService } from '../../integrations/lib/state-servi
 import type { IntegrationLogService } from '../../integrations/lib/log-service'
 import { conflict, CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { GatewayPaymentOperation, GatewaySessionInitialization, GatewayTransaction } from '../data/entities'
-import { canApplyManualAction, isValidTransition, type ManualGatewayAction } from './status-machine'
+import { canApplyManualAction, isValidTransition, resolveImpliedCaptureStatus, type ManualGatewayAction } from './status-machine'
 import { emitPaymentGatewayEvent } from '../events'
 import { readGatewayMetadata, readWebhookLog } from './transaction-fields'
 import { reconcileSessionAmountWithOrder } from './order-amount-reconciliation'
@@ -124,6 +124,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
     transactionId: string,
     scope: { organizationId: string; tenantId: string },
     targetEm: EntityManager = em,
+    options?: { lockMode: LockMode.PESSIMISTIC_WRITE },
   ): Promise<GatewayTransaction> {
     const transaction = await findOneWithDecryption(
       targetEm,
@@ -134,7 +135,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         tenantId: scope.tenantId,
         deletedAt: null,
       },
-      undefined,
+      options,
       scope,
     )
     if (!transaction) {
@@ -765,42 +766,57 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         receivedAt?: string
       }
     }, scope: { organizationId: string; tenantId: string }): Promise<void> {
-      const transaction = await findTransactionOrThrow(transactionId, scope)
-      const currentStatus = transaction.unifiedStatus as UnifiedPaymentStatus
-      const canTransition = isValidTransition(currentStatus, update.unifiedStatus)
-      const shouldApplyStatus = canTransition && update.unifiedStatus !== currentStatus
-      const previousStatus = transaction.unifiedStatus
-      if (shouldApplyStatus) {
-        transaction.unifiedStatus = update.unifiedStatus
-        alignCapturedAmountWithStatus(transaction, update.unifiedStatus)
-      }
-      if (update.providerStatus) {
-        transaction.gatewayStatus = update.providerStatus
-      }
-      if (update.providerData) {
-        transaction.gatewayMetadata = { ...readGatewayMetadata(transaction.gatewayMetadata), ...update.providerData }
-      }
-      if (update.webhookEvent) {
-        const webhookLog = readWebhookLog(transaction.webhookLog)
-        webhookLog.push({
-          eventType: update.webhookEvent.eventType,
-          receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
-          idempotencyKey: update.webhookEvent.idempotencyKey,
-          unifiedStatus: update.unifiedStatus,
-          processed: update.webhookEvent.processed,
-        })
-        transaction.webhookLog = webhookLog
-      }
-      transaction.lastWebhookAt = new Date()
-      await em.flush()
+      const { transaction, previousStatus, impliedCaptureStatus, shouldApplyStatus } = await em.fork().transactional(async (tx) => {
+        const locked = await findTransactionOrThrow(transactionId, scope, tx, { lockMode: LockMode.PESSIMISTIC_WRITE })
+        const currentStatus = locked.unifiedStatus as UnifiedPaymentStatus
+        const implied = resolveImpliedCaptureStatus(currentStatus, update.unifiedStatus)
+        const canTransition = isValidTransition(currentStatus, update.unifiedStatus) || implied !== null
+        const applies = canTransition && update.unifiedStatus !== currentStatus
+        if (applies) {
+          if (implied) alignCapturedAmountWithStatus(locked, implied)
+          locked.unifiedStatus = update.unifiedStatus
+          alignCapturedAmountWithStatus(locked, update.unifiedStatus)
+        }
+        if (update.providerStatus) {
+          locked.gatewayStatus = update.providerStatus
+        }
+        if (update.providerData) {
+          locked.gatewayMetadata = { ...readGatewayMetadata(locked.gatewayMetadata), ...update.providerData }
+        }
+        if (update.webhookEvent) {
+          const webhookLog = readWebhookLog(locked.webhookLog)
+          webhookLog.push({
+            eventType: update.webhookEvent.eventType,
+            receivedAt: update.webhookEvent.receivedAt ?? new Date().toISOString(),
+            idempotencyKey: update.webhookEvent.idempotencyKey,
+            unifiedStatus: update.unifiedStatus,
+            processed: update.webhookEvent.processed,
+          })
+          locked.webhookLog = webhookLog
+        }
+        locked.lastWebhookAt = new Date()
+        await tx.flush()
+        return {
+          transaction: locked,
+          previousStatus: currentStatus,
+          impliedCaptureStatus: applies ? implied : null,
+          shouldApplyStatus: applies,
+        }
+      })
       if (shouldApplyStatus) {
-        await emitStatusEvent(update.unifiedStatus, {
+        const eventPayload = {
           transactionId: transaction.id,
           paymentId: transaction.paymentId,
           providerKey: transaction.providerKey,
-          previousStatus,
           organizationId: transaction.organizationId,
           tenantId: transaction.tenantId,
+        }
+        if (impliedCaptureStatus) {
+          await emitStatusEvent(impliedCaptureStatus, { ...eventPayload, previousStatus })
+        }
+        await emitStatusEvent(update.unifiedStatus, {
+          ...eventPayload,
+          previousStatus: impliedCaptureStatus ?? previousStatus,
         })
       }
       await writeTransactionLog(
@@ -811,6 +827,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         shouldApplyStatus ? 'Payment status synchronized from webhook' : 'Webhook received with no status transition',
         {
           previousStatus,
+          ...(impliedCaptureStatus ? { impliedStatus: impliedCaptureStatus } : {}),
           nextStatus: update.unifiedStatus,
           providerStatus: update.providerStatus ?? null,
           eventType: update.webhookEvent?.eventType ?? null,