@open-mercato/core 0.10.1-develop.7761.1.9dfaf470ed → 0.10.1-develop.7763.1.caea616ebf

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 6184 entry points
+[build:core] found 6195 entry points
 [build:core] built successfully
 [build:core:generated] found 271 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/profile/route.js

@@ -10,6 +10,7 @@ import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find"
 import { buildPasswordSchema } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { resolveUserDataSubject } from "@open-mercato/core/modules/auth/lib/userDataSubject";
 const logger = createLogger("auth").child({ component: "profile" });
 const profileResponseSchema = z.object({
   email: z.string().email(),
@@ -84,10 +85,18 @@ async function GET(req) {
   try {
     const container = await createRequestContainer();
     const em = container.resolve("em");
+    const userId = await resolveUserDataSubject(em, auth);
+    if (!userId) {
+      return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+    }
     const user = await findOneWithDecryption(
       em,
       User,
-      { id: auth.sub, deletedAt: null },
+      {
+        id: userId,
+        deletedAt: null,
+        ...auth.isApiKey ? { tenantId: auth.tenantId, ...auth.orgId ? { organizationId: auth.orgId } : {} } : {}
+      },
       void 0,
       { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null }
     );
@@ -111,6 +120,9 @@ async function PUT(req) {
   if (!auth?.sub) {
     return NextResponse.json({ error: translate("api.errors.unauthorized", "Unauthorized") }, { status: 401 });
   }
+  if (auth.isApiKey) {
+    return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+  }
   try {
     const body = await req.json().catch(() => ({}));
     const parsed = buildUpdateSchema(translate).safeParse(body);
@@ -206,6 +218,7 @@ const openApi = {
       responses: [
         { status: 200, description: "Profile payload", schema: profileResponseSchema },
         { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "No user binding in the authenticated scope", schema: z.object({ error: z.string() }) },
         { status: 404, description: "User not found", schema: z.object({ error: z.string() }) }
       ]
     },
@@ -219,7 +232,8 @@ const openApi = {
       responses: [
         { status: 200, description: "Profile updated", schema: profileUpdateResponseSchema },
         { status: 400, description: "Invalid payload", schema: z.object({ error: z.string() }) },
-        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) }
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Interactive session required", schema: z.object({ error: z.string() }) }
       ]
     }
   }

package/dist/modules/auth/api/profile/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/profile/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const userId = await resolveUserDataSubject(em, auth)\n    if (!userId) {\n      return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n    }\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      {\n        id: userId,\n        deletedAt: null,\n        ...(auth.isApiKey ? { tenantId: auth.tenantId, ...(auth.orgId ? { organizationId: auth.orgId } : {}) } : {}),\n      },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  if (auth.isApiKey) {\n    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No user binding in the authenticated scope', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Interactive session required', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,8BAA8B;AAEvC,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,SAAS,MAAM,uBAAuB,IAAI,IAAI;AACpD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AACA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,WAAW;AAAA,QACX,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,UAAU,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC,EAAG,IAAI,CAAC;AAAA,MAC5G;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI,KAAK,UAAU;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAClH,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/userDataSubject.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { User } from "../data/entities.js";
+const uuidSchema = z.string().uuid();
+async function resolveUserDataSubject(em, auth) {
+  if (!auth.isApiKey) return auth.sub;
+  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null;
+  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null;
+  const user = await findOneWithDecryption(
+    em,
+    User,
+    {
+      id: auth.userId,
+      tenantId: auth.tenantId,
+      ...auth.orgId ? { organizationId: auth.orgId } : {},
+      deletedAt: null
+    },
+    void 0,
+    { tenantId: auth.tenantId, organizationId: auth.orgId }
+  );
+  return user?.id ?? null;
+}
+export {
+  resolveUserDataSubject
+};
+//# sourceMappingURL=userDataSubject.js.map

package/dist/modules/auth/lib/userDataSubject.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/userDataSubject.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '../data/entities'\n\nconst uuidSchema = z.string().uuid()\n\nexport async function resolveUserDataSubject(\n  em: EntityManager,\n  auth: NonNullable<AuthContext>,\n): Promise<string | null> {\n  if (!auth.isApiKey) return auth.sub\n  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null\n  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null\n\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    {\n      id: auth.userId,\n      tenantId: auth.tenantId,\n      ...(auth.orgId ? { organizationId: auth.orgId } : {}),\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  return user?.id ?? null\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,6BAA6B;AACtC,SAAS,YAAY;AAErB,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK;AAEnC,eAAsB,uBACpB,IACA,MACwB;AACxB,MAAI,CAAC,KAAK,SAAU,QAAO,KAAK;AAChC,MAAI,CAAC,WAAW,UAAU,KAAK,MAAM,EAAE,WAAW,CAAC,WAAW,UAAU,KAAK,QAAQ,EAAE,QAAS,QAAO;AACvG,MAAI,KAAK,UAAU,QAAQ,CAAC,WAAW,UAAU,KAAK,KAAK,EAAE,QAAS,QAAO;AAE7E,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;AAAA,MACnD,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,SAAO,MAAM,MAAM;AACrB;",
+  "names": []
+}

package/dist/modules/customer_accounts/widgets/injection/account-status/widget.client.js

@@ -228,6 +228,7 @@ function AccountStatusWidget({ context }) {
     queryClient.invalidateQueries({ queryKey: ["customer-account-status", personEntityId] });
     queryClient.invalidateQueries({ queryKey: ["customer-account-pending-invitation", personEntityId] });
   }
+  if (!personEntityId) return null;
   if (isLoading) {
     return /* @__PURE__ */ jsx("div", { className: "text-sm text-muted-foreground", children: t("common.loading", "Loading...") });
   }

package/dist/modules/customer_accounts/widgets/injection/account-status/widget.client.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/widgets/injection/account-status/widget.client.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport React from 'react'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { StatusBadge } from '@open-mercato/ui/primitives/status-badge'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\ninterface AccountStatusData {\n  id: string\n  email: string\n  isActive: boolean\n  emailVerified: boolean\n  lastLoginAt: string | null\n}\n\ninterface PendingInvitationData {\n  id: string\n  email: string\n  expiresAt: string\n}\n\ninterface AccountStatusProps {\n  context?: {\n    entityId?: string\n    recordId?: string\n  }\n}\n\ninterface RoleOption {\n  id: string\n  name: string\n}\n\ninterface PersonData {\n  person?: {\n    primaryEmail?: string | null\n    displayName?: string | null\n  }\n  profile?: {\n    firstName?: string | null\n    lastName?: string | null\n  } | null\n}\n\nasync function fetchPendingInvitation(filter: string): Promise<PendingInvitationData | null> {\n  const result = await apiCall(`/api/customer_accounts/admin/users-invite?${filter}&pageSize=1`)\n  if (!result.ok) return null\n  const json = result.result as Record<string, unknown> | null\n  const items = json?.items as PendingInvitationData[] | undefined\n  return items?.[0] || null\n}\n\nfunction InviteForm({\n  personEntityId,\n  personData,\n  isLoadingPerson,\n  onSuccess,\n}: {\n  personEntityId: string\n  personData: PersonData | null\n  isLoadingPerson: boolean\n  onSuccess: () => void\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [availableRoles, setAvailableRoles] = React.useState<RoleOption[]>([])\n  const [isLoadingRoles, setIsLoadingRoles] = React.useState(true)\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const { runMutation } = useGuardedMutation<{ entityType: string }>({\n    contextId: 'customer_accounts:account-status-invite',\n  })\n\n  React.useEffect(() => {\n    if (!personData) return\n    const person = personData.person\n    const profile = personData.profile\n    if (person?.primaryEmail) {\n      setEmail(person.primaryEmail)\n    }\n    const nameParts = [profile?.firstName, profile?.lastName].filter(Boolean)\n    if (nameParts.length > 0) {\n      setDisplayName(nameParts.join(' '))\n    } else if (person?.displayName) {\n      setDisplayName(person.displayName)\n    }\n  }, [personData])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadRoles() {\n      try {\n        const call = await apiCall<{ items?: RoleOption[] }>(\n          '/api/customer_accounts/admin/roles?pageSize=100',\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const items = Array.isArray(call.result.items) ? call.result.items : []\n          setAvailableRoles(items.map((role) => ({ id: role.id, name: role.name })))\n        }\n      } catch {\n        /* ignore */\n      } finally {\n        if (!cancelled) setIsLoadingRoles(false)\n      }\n    }\n    loadRoles()\n    return () => { cancelled = true }\n  }, [])\n\n  function toggleRole(roleId: string) {\n    setSelectedRoleIds((prev) =>\n      prev.includes(roleId) ? prev.filter((id) => id !== roleId) : [...prev, roleId],\n    )\n  }\n\n  async function handleSubmit() {\n    const trimmedEmail = email.trim()\n    if (!trimmedEmail) {\n      flash(t('customer_accounts.widgets.invite.error.emailRequired', 'Email is required'), 'error')\n      return\n    }\n    if (selectedRoleIds.length === 0) {\n      flash(t('customer_accounts.widgets.invite.error.roleRequired', 'At least one role must be selected'), 'error')\n      return\n    }\n\n    setIsSubmitting(true)\n    try {\n      await runMutation({\n        context: { entityType: 'customer_accounts:user' },\n        mutationPayload: { personEntityId, roleIds: selectedRoleIds },\n        operation: async () => {\n          // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit\n          const call = await apiCall<{ ok: boolean; error?: string }>(\n            '/api/customer_accounts/admin/users-invite',\n            {\n              method: 'POST',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({\n                email: trimmedEmail,\n                roleIds: selectedRoleIds,\n                displayName: displayName.trim() || undefined,\n                personEntityId,\n              }),\n            },\n          )\n\n          if (!call.ok) {\n            const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined\n            flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n            return\n          }\n\n          flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')\n          onSuccess()\n        },\n      })\n    } catch {\n      flash(t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }\n\n  const isLoading = isLoadingPerson || isLoadingRoles\n\n  if (isLoading) {\n    return (\n      <div className=\"text-sm text-muted-foreground py-2\">\n        {t('common.loading', 'Loading...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3 mt-2\">\n      <div>\n        <label htmlFor=\"invite-email\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('common.email', 'Email')}\n        </label>\n        <EmailInput\n          id=\"invite-email\"\n          size=\"sm\"\n          value={email}\n          onChange={(event) => setEmail(event.target.value)}\n          required\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <label htmlFor=\"invite-display-name\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('customer_accounts.widgets.invite.displayName', 'Display Name')}\n        </label>\n        <Input\n          id=\"invite-display-name\"\n          type=\"text\"\n          size=\"sm\"\n          value={displayName}\n          onChange={(event) => setDisplayName(event.target.value)}\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <div className=\"text-xs font-medium text-muted-foreground mb-1.5\">\n          {t('customer_accounts.widgets.invite.roles', 'Roles')}\n        </div>\n        {availableRoles.length === 0 ? (\n          <div className=\"text-xs text-muted-foreground\">\n            {t('customer_accounts.widgets.invite.noRoles', 'No roles available')}\n          </div>\n        ) : (\n          <div className=\"flex flex-wrap gap-1.5\">\n            {availableRoles.map((role) => (\n              <Button\n                key={role.id}\n                type=\"button\"\n                variant={selectedRoleIds.includes(role.id) ? 'default' : 'outline'}\n                size=\"sm\"\n                onClick={() => toggleRole(role.id)}\n                disabled={isSubmitting}\n                className=\"text-xs h-7\"\n              >\n                {role.name}\n              </Button>\n            ))}\n          </div>\n        )}\n      </div>\n\n      <div className=\"flex justify-end gap-2 pt-1\">\n        <Button\n          type=\"button\"\n          size=\"sm\"\n          onClick={handleSubmit}\n          disabled={isSubmitting || !email.trim() || selectedRoleIds.length === 0}\n        >\n          {isSubmitting\n            ? t('common.loading', 'Loading...')\n            : t('customer_accounts.widgets.invite.submit', 'Send Invitation')}\n        </Button>\n      </div>\n    </div>\n  )\n}\n\nexport default function AccountStatusWidget({ context }: AccountStatusProps) {\n  const t = useT()\n  const queryClient = useQueryClient()\n  const personEntityId = context?.recordId\n  const [showInviteForm, setShowInviteForm] = React.useState(false)\n\n  const { data, isLoading } = useQuery({\n    queryKey: ['customer-account-status', personEntityId],\n    queryFn: async (): Promise<AccountStatusData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall(`/api/customer_accounts/admin/users?personEntityId=${personEntityId}&pageSize=1`)\n      if (!result.ok) return null\n      const json = result.result as Record<string, unknown> | null\n      const items = json?.items as AccountStatusData[] | undefined\n      return items?.[0] || null\n    },\n    enabled: !!personEntityId,\n  })\n\n  // The person record backs both the pending-invitation email fallback below and\n  // the invite form defaults, so it is fetched once here and shared.\n  const { data: personData, isLoading: isLoadingPerson } = useQuery({\n    queryKey: ['customer-account-person', personEntityId],\n    queryFn: async (): Promise<PersonData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall<PersonData>(\n        `/api/customers/people/${encodeURIComponent(personEntityId)}`,\n      )\n      if (!result.ok) return null\n      return (result.result as PersonData | null) || null\n    },\n    enabled: !!personEntityId && !isLoading && !data,\n  })\n\n  const personEmail = personData?.person?.primaryEmail?.trim() || null\n\n  // A portal account only exists once the invitation is accepted, so the users\n  // query above stays empty right after a successful invite. Without this the\n  // widget renders the identical \"no account\" state and the invite looks like a\n  // no-op (#4950).\n  const { data: pendingInvitation, isLoading: isLoadingInvitation } = useQuery({\n    queryKey: ['customer-account-pending-invitation', personEntityId, personEmail],\n    queryFn: async (): Promise<PendingInvitationData | null> => {\n      if (!personEntityId) return null\n      const byPerson = await fetchPendingInvitation(\n        `personEntityId=${encodeURIComponent(personEntityId)}`,\n      )\n      if (byPerson) return byPerson\n      // person_entity_id is optional on an invitation: the portal invite route\n      // only ever knows the company, and rows written before the entity-ownership\n      // guard landed the person id in customer_entity_id instead. The recipient\n      // address is the one identity every invitation carries, so match on it\n      // before reporting \"no account\" for someone who was already invited (#5499).\n      if (!personEmail) return null\n      return fetchPendingInvitation(`email=${encodeURIComponent(personEmail)}`)\n    },\n    enabled: !!personEntityId && !isLoading && !data && !isLoadingPerson,\n  })\n\n  // A disabled React Query reports isLoading === false, so isLoadingInvitation is\n  // false for the whole person fetch the email fallback waits on. Rendering off\n  // that alone would show \"no portal account linked\" with a live invite button\n  // during that window \u2014 the double-invite #5499 exists to prevent.\n  const isResolvingInvitation = isLoadingPerson || isLoadingInvitation\n\n  function handleInviteSuccess() {\n    setShowInviteForm(false)\n    queryClient.invalidateQueries({ queryKey: ['customer-account-status', personEntityId] })\n    queryClient.invalidateQueries({ queryKey: ['customer-account-pending-invitation', personEntityId] })\n  }\n\n  if (isLoading) {\n    return <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n  }\n\n  if (!data) {\n    return (\n      <div className=\"rounded-md border p-3\">\n        <div className=\"text-sm font-medium mb-1\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n        {isResolvingInvitation ? (\n          <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n        ) : pendingInvitation ? (\n          <div className=\"space-y-1 text-sm\">\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n              <StatusBadge variant=\"warning\" dot>\n                {t('customer_accounts.widgets.invitationPending', 'Invitation pending')}\n              </StatusBadge>\n            </div>\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n              <span>{pendingInvitation.email}</span>\n            </div>\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.invitationExpires', 'Invitation expires')}</span>\n              <span>{new Date(pendingInvitation.expiresAt).toLocaleDateString()}</span>\n            </div>\n          </div>\n        ) : (\n          <div className=\"text-sm text-muted-foreground\">{t('customer_accounts.widgets.noAccount', 'No portal account linked')}</div>\n        )}\n        {!showInviteForm && personEntityId && !isResolvingInvitation && (\n          <div className=\"mt-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => setShowInviteForm(true)}\n            >\n              {pendingInvitation\n                ? t('customer_accounts.widgets.invite.resend', 'Resend invitation')\n                : t('customer_accounts.widgets.invite.button', 'Invite to Portal')}\n            </Button>\n          </div>\n        )}\n        {showInviteForm && personEntityId && (\n          <InviteForm\n            personEntityId={personEntityId}\n            personData={personData ?? null}\n            isLoadingPerson={isLoadingPerson}\n            onSuccess={handleInviteSuccess}\n          />\n        )}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"rounded-md border p-3\">\n      <div className=\"text-sm font-medium mb-2\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n      <div className=\"space-y-1 text-sm\">\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n          <StatusBadge variant={data.isActive ? 'success' : 'error'} dot>\n            {data.isActive ? t('common.active', 'Active') : t('common.inactive', 'Inactive')}\n          </StatusBadge>\n        </div>\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n          <span>{data.email}</span>\n        </div>\n        {data.emailVerified !== undefined && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.emailVerified', 'Email Verified')}</span>\n            <span>{data.emailVerified ? '\u2713' : '\u2717'}</span>\n          </div>\n        )}\n        {data.lastLoginAt && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.lastLogin', 'Last Login')}</span>\n            <span>{new Date(data.lastLoginAt).toLocaleDateString()}</span>\n          </div>\n        )}\n      </div>\n      <div className=\"mt-2\">\n        <a\n          href={`/backend/customer_accounts/users/${data.id}`}\n          className=\"text-xs text-primary hover:underline\"\n        >\n          {t('customer_accounts.widgets.viewAccount', 'View account details \u2192')}\n        </a>\n      </div>\n    </div>\n  )\n}\n"],
-  "mappings": ";AAiLM,cAQA,YARA;AA/KN,OAAO,WAAW;AAClB,SAAS,UAAU,sBAAsB;AACzC,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAuCtB,eAAe,uBAAuB,QAAuD;AAC3F,QAAM,SAAS,MAAM,QAAQ,6CAA6C,MAAM,aAAa;AAC7F,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,QAAM,OAAO,OAAO;AACpB,QAAM,QAAQ,MAAM;AACpB,SAAO,QAAQ,CAAC,KAAK;AACvB;AAEA,SAAS,WAAW;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC3E,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,IAAI;AAC/D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,EAAE,YAAY,IAAI,mBAA2C;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,WAAY;AACjB,UAAM,SAAS,WAAW;AAC1B,UAAM,UAAU,WAAW;AAC3B,QAAI,QAAQ,cAAc;AACxB,eAAS,OAAO,YAAY;AAAA,IAC9B;AACA,UAAM,YAAY,CAAC,SAAS,WAAW,SAAS,QAAQ,EAAE,OAAO,OAAO;AACxE,QAAI,UAAU,SAAS,GAAG;AACxB,qBAAe,UAAU,KAAK,GAAG,CAAC;AAAA,IACpC,WAAW,QAAQ,aAAa;AAC9B,qBAAe,OAAO,WAAW;AAAA,IACnC;AAAA,EACF,GAAG,CAAC,UAAU,CAAC;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,QAAQ,MAAM,QAAQ,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACtE,4BAAkB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,mBAAkB,KAAK;AAAA,MACzC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW,QAAgB;AAClC;AAAA,MAAmB,CAAC,SAClB,KAAK,SAAS,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,IAC/E;AAAA,EACF;AAEA,iBAAe,eAAe;AAC5B,UAAM,eAAe,MAAM,KAAK;AAChC,QAAI,CAAC,cAAc;AACjB,YAAM,EAAE,wDAAwD,mBAAmB,GAAG,OAAO;AAC7F;AAAA,IACF;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,EAAE,uDAAuD,oCAAoC,GAAG,OAAO;AAC7G;AAAA,IACF;AAEA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,SAAS,EAAE,YAAY,yBAAyB;AAAA,QAChD,iBAAiB,EAAE,gBAAgB,SAAS,gBAAgB;AAAA,QAC5D,WAAW,YAAY;AAErB,gBAAM,OAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,OAAO;AAAA,gBACP,SAAS;AAAA,gBACT,aAAa,YAAY,KAAK,KAAK;AAAA,gBACnC;AAAA,cACF,CAAC;AAAA,YACH;AAAA,UACF;AAEA,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,eAAgB,KAAK,QAA2C;AACtE,kBAAM,gBAAgB,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAC9G;AAAA,UACF;AAEA,gBAAM,EAAE,4CAA4C,8BAA8B,GAAG,SAAS;AAC9F,oBAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAAA,IAChG,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB;AAErC,MAAI,WAAW;AACb,WACE,oBAAC,SAAI,WAAU,sCACZ,YAAE,kBAAkB,YAAY,GACnC;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,kBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,gBAAe,WAAU,wDACrC,YAAE,gBAAgB,OAAO,GAC5B;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,UAChD,UAAQ;AAAA,UACR,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,uBAAsB,WAAU,wDAC5C,YAAE,gDAAgD,cAAc,GACnE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,UACtD,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,SAAI,WAAU,oDACZ,YAAE,0CAA0C,OAAO,GACtD;AAAA,MACC,eAAe,WAAW,IACzB,oBAAC,SAAI,WAAU,iCACZ,YAAE,4CAA4C,oBAAoB,GACrE,IAEA,oBAAC,SAAI,WAAU,0BACZ,yBAAe,IAAI,CAAC,SACnB;AAAA,QAAC;AAAA;AAAA,UAEC,MAAK;AAAA,UACL,SAAS,gBAAgB,SAAS,KAAK,EAAE,IAAI,YAAY;AAAA,UACzD,MAAK;AAAA,UACL,SAAS,MAAM,WAAW,KAAK,EAAE;AAAA,UACjC,UAAU;AAAA,UACV,WAAU;AAAA,UAET,eAAK;AAAA;AAAA,QARD,KAAK;AAAA,MASZ,CACD,GACH;AAAA,OAEJ;AAAA,IAEA,oBAAC,SAAI,WAAU,+BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS;AAAA,QACT,UAAU,gBAAgB,CAAC,MAAM,KAAK,KAAK,gBAAgB,WAAW;AAAA,QAErE,yBACG,EAAE,kBAAkB,YAAY,IAChC,EAAE,2CAA2C,iBAAiB;AAAA;AAAA,IACpE,GACF;AAAA,KACF;AAEJ;AAEe,SAAR,oBAAqC,EAAE,QAAQ,GAAuB;AAC3E,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,eAAe;AACnC,QAAM,iBAAiB,SAAS;AAChC,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,KAAK;AAEhE,QAAM,EAAE,MAAM,UAAU,IAAI,SAAS;AAAA,IACnC,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAA+C;AACtD,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM,QAAQ,qDAAqD,cAAc,aAAa;AAC7G,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO,QAAQ,CAAC,KAAK;AAAA,IACvB;AAAA,IACA,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AAID,QAAM,EAAE,MAAM,YAAY,WAAW,gBAAgB,IAAI,SAAS;AAAA,IAChE,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAAwC;AAC/C,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM;AAAA,QACnB,yBAAyB,mBAAmB,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,aAAQ,OAAO,UAAgC;AAAA,IACjD;AAAA,IACA,SAAS,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC;AAAA,EAC9C,CAAC;AAED,QAAM,cAAc,YAAY,QAAQ,cAAc,KAAK,KAAK;AAMhE,QAAM,EAAE,MAAM,mBAAmB,WAAW,oBAAoB,IAAI,SAAS;AAAA,IAC3E,UAAU,CAAC,uCAAuC,gBAAgB,WAAW;AAAA,IAC7E,SAAS,YAAmD;AAC1D,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,WAAW,MAAM;AAAA,QACrB,kBAAkB,mBAAmB,cAAc,CAAC;AAAA,MACtD;AACA,UAAI,SAAU,QAAO;AAMrB,UAAI,CAAC,YAAa,QAAO;AACzB,aAAO,uBAAuB,SAAS,mBAAmB,WAAW,CAAC,EAAE;AAAA,IAC1E;AAAA,IACA,SAAS,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC;AAAA,EACvD,CAAC;AAMD,QAAM,wBAAwB,mBAAmB;AAEjD,WAAS,sBAAsB;AAC7B,sBAAkB,KAAK;AACvB,gBAAY,kBAAkB,EAAE,UAAU,CAAC,2BAA2B,cAAc,EAAE,CAAC;AACvF,gBAAY,kBAAkB,EAAE,UAAU,CAAC,uCAAuC,cAAc,EAAE,CAAC;AAAA,EACrG;AAEA,MAAI,WAAW;AACb,WAAO,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE;AAAA,EAC3F;AAEA,MAAI,CAAC,MAAM;AACT,WACE,qBAAC,SAAI,WAAU,yBACb;AAAA,0BAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,MACzG,wBACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE,IAChF,oBACF,qBAAC,SAAI,WAAU,qBACb;AAAA,6BAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,UACtE,oBAAC,eAAY,SAAQ,WAAU,KAAG,MAC/B,YAAE,+CAA+C,oBAAoB,GACxE;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,UACpE,oBAAC,UAAM,4BAAkB,OAAM;AAAA,WACjC;AAAA,QACA,qBAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,+CAA+C,oBAAoB,GAAE;AAAA,UAChH,oBAAC,UAAM,cAAI,KAAK,kBAAkB,SAAS,EAAE,mBAAmB,GAAE;AAAA,WACpE;AAAA,SACF,IAEA,oBAAC,SAAI,WAAU,iCAAiC,YAAE,uCAAuC,0BAA0B,GAAE;AAAA,MAEtH,CAAC,kBAAkB,kBAAkB,CAAC,yBACrC,oBAAC,SAAI,WAAU,QACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,kBAAkB,IAAI;AAAA,UAEpC,8BACG,EAAE,2CAA2C,mBAAmB,IAChE,EAAE,2CAA2C,kBAAkB;AAAA;AAAA,MACrE,GACF;AAAA,MAED,kBAAkB,kBACjB;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,UACA,WAAW;AAAA;AAAA,MACb;AAAA,OAEJ;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,yBACb;AAAA,wBAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,IAC1G,qBAAC,SAAI,WAAU,qBACb;AAAA,2BAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,QACtE,oBAAC,eAAY,SAAS,KAAK,WAAW,YAAY,SAAS,KAAG,MAC3D,eAAK,WAAW,EAAE,iBAAiB,QAAQ,IAAI,EAAE,mBAAmB,UAAU,GACjF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,QACpE,oBAAC,UAAM,eAAK,OAAM;AAAA,SACpB;AAAA,MACC,KAAK,kBAAkB,UACtB,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,QACxG,oBAAC,UAAM,eAAK,gBAAgB,WAAM,UAAI;AAAA,SACxC;AAAA,MAED,KAAK,eACJ,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,uCAAuC,YAAY,GAAE;AAAA,QAChG,oBAAC,UAAM,cAAI,KAAK,KAAK,WAAW,EAAE,mBAAmB,GAAE;AAAA,SACzD;AAAA,OAEJ;AAAA,IACA,oBAAC,SAAI,WAAU,QACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oCAAoC,KAAK,EAAE;AAAA,QACjD,WAAU;AAAA,QAET,YAAE,yCAAyC,6BAAwB;AAAA;AAAA,IACtE,GACF;AAAA,KACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport React from 'react'\nimport { useQuery, useQueryClient } from '@tanstack/react-query'\nimport { apiCall } from '@open-mercato/ui/backend/utils/apiCall'\nimport { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Input } from '@open-mercato/ui/primitives/input'\nimport { EmailInput } from '@open-mercato/ui/primitives/email-input'\nimport { StatusBadge } from '@open-mercato/ui/primitives/status-badge'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\n\ninterface AccountStatusData {\n  id: string\n  email: string\n  isActive: boolean\n  emailVerified: boolean\n  lastLoginAt: string | null\n}\n\ninterface PendingInvitationData {\n  id: string\n  email: string\n  expiresAt: string\n}\n\ninterface AccountStatusProps {\n  context?: {\n    entityId?: string\n    recordId?: string\n  }\n}\n\ninterface RoleOption {\n  id: string\n  name: string\n}\n\ninterface PersonData {\n  person?: {\n    primaryEmail?: string | null\n    displayName?: string | null\n  }\n  profile?: {\n    firstName?: string | null\n    lastName?: string | null\n  } | null\n}\n\nasync function fetchPendingInvitation(filter: string): Promise<PendingInvitationData | null> {\n  const result = await apiCall(`/api/customer_accounts/admin/users-invite?${filter}&pageSize=1`)\n  if (!result.ok) return null\n  const json = result.result as Record<string, unknown> | null\n  const items = json?.items as PendingInvitationData[] | undefined\n  return items?.[0] || null\n}\n\nfunction InviteForm({\n  personEntityId,\n  personData,\n  isLoadingPerson,\n  onSuccess,\n}: {\n  personEntityId: string\n  personData: PersonData | null\n  isLoadingPerson: boolean\n  onSuccess: () => void\n}) {\n  const t = useT()\n  const [email, setEmail] = React.useState('')\n  const [displayName, setDisplayName] = React.useState('')\n  const [selectedRoleIds, setSelectedRoleIds] = React.useState<string[]>([])\n  const [availableRoles, setAvailableRoles] = React.useState<RoleOption[]>([])\n  const [isLoadingRoles, setIsLoadingRoles] = React.useState(true)\n  const [isSubmitting, setIsSubmitting] = React.useState(false)\n\n  const { runMutation } = useGuardedMutation<{ entityType: string }>({\n    contextId: 'customer_accounts:account-status-invite',\n  })\n\n  React.useEffect(() => {\n    if (!personData) return\n    const person = personData.person\n    const profile = personData.profile\n    if (person?.primaryEmail) {\n      setEmail(person.primaryEmail)\n    }\n    const nameParts = [profile?.firstName, profile?.lastName].filter(Boolean)\n    if (nameParts.length > 0) {\n      setDisplayName(nameParts.join(' '))\n    } else if (person?.displayName) {\n      setDisplayName(person.displayName)\n    }\n  }, [personData])\n\n  React.useEffect(() => {\n    let cancelled = false\n    async function loadRoles() {\n      try {\n        const call = await apiCall<{ items?: RoleOption[] }>(\n          '/api/customer_accounts/admin/roles?pageSize=100',\n        )\n        if (cancelled) return\n        if (call.ok && call.result) {\n          const items = Array.isArray(call.result.items) ? call.result.items : []\n          setAvailableRoles(items.map((role) => ({ id: role.id, name: role.name })))\n        }\n      } catch {\n        /* ignore */\n      } finally {\n        if (!cancelled) setIsLoadingRoles(false)\n      }\n    }\n    loadRoles()\n    return () => { cancelled = true }\n  }, [])\n\n  function toggleRole(roleId: string) {\n    setSelectedRoleIds((prev) =>\n      prev.includes(roleId) ? prev.filter((id) => id !== roleId) : [...prev, roleId],\n    )\n  }\n\n  async function handleSubmit() {\n    const trimmedEmail = email.trim()\n    if (!trimmedEmail) {\n      flash(t('customer_accounts.widgets.invite.error.emailRequired', 'Email is required'), 'error')\n      return\n    }\n    if (selectedRoleIds.length === 0) {\n      flash(t('customer_accounts.widgets.invite.error.roleRequired', 'At least one role must be selected'), 'error')\n      return\n    }\n\n    setIsSubmitting(true)\n    try {\n      await runMutation({\n        context: { entityType: 'customer_accounts:user' },\n        mutationPayload: { personEntityId, roleIds: selectedRoleIds },\n        operation: async () => {\n          // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit\n          const call = await apiCall<{ ok: boolean; error?: string }>(\n            '/api/customer_accounts/admin/users-invite',\n            {\n              method: 'POST',\n              headers: { 'content-type': 'application/json' },\n              body: JSON.stringify({\n                email: trimmedEmail,\n                roleIds: selectedRoleIds,\n                displayName: displayName.trim() || undefined,\n                personEntityId,\n              }),\n            },\n          )\n\n          if (!call.ok) {\n            const errorMessage = (call.result as Record<string, unknown> | null)?.error as string | undefined\n            flash(errorMessage || t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n            return\n          }\n\n          flash(t('customer_accounts.widgets.invite.success', 'Invitation sent successfully'), 'success')\n          onSuccess()\n        },\n      })\n    } catch {\n      flash(t('customer_accounts.widgets.invite.error.failed', 'Failed to send invitation'), 'error')\n    } finally {\n      setIsSubmitting(false)\n    }\n  }\n\n  const isLoading = isLoadingPerson || isLoadingRoles\n\n  if (isLoading) {\n    return (\n      <div className=\"text-sm text-muted-foreground py-2\">\n        {t('common.loading', 'Loading...')}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"space-y-3 mt-2\">\n      <div>\n        <label htmlFor=\"invite-email\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('common.email', 'Email')}\n        </label>\n        <EmailInput\n          id=\"invite-email\"\n          size=\"sm\"\n          value={email}\n          onChange={(event) => setEmail(event.target.value)}\n          required\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <label htmlFor=\"invite-display-name\" className=\"block text-xs font-medium text-muted-foreground mb-1\">\n          {t('customer_accounts.widgets.invite.displayName', 'Display Name')}\n        </label>\n        <Input\n          id=\"invite-display-name\"\n          type=\"text\"\n          size=\"sm\"\n          value={displayName}\n          onChange={(event) => setDisplayName(event.target.value)}\n          disabled={isSubmitting}\n        />\n      </div>\n\n      <div>\n        <div className=\"text-xs font-medium text-muted-foreground mb-1.5\">\n          {t('customer_accounts.widgets.invite.roles', 'Roles')}\n        </div>\n        {availableRoles.length === 0 ? (\n          <div className=\"text-xs text-muted-foreground\">\n            {t('customer_accounts.widgets.invite.noRoles', 'No roles available')}\n          </div>\n        ) : (\n          <div className=\"flex flex-wrap gap-1.5\">\n            {availableRoles.map((role) => (\n              <Button\n                key={role.id}\n                type=\"button\"\n                variant={selectedRoleIds.includes(role.id) ? 'default' : 'outline'}\n                size=\"sm\"\n                onClick={() => toggleRole(role.id)}\n                disabled={isSubmitting}\n                className=\"text-xs h-7\"\n              >\n                {role.name}\n              </Button>\n            ))}\n          </div>\n        )}\n      </div>\n\n      <div className=\"flex justify-end gap-2 pt-1\">\n        <Button\n          type=\"button\"\n          size=\"sm\"\n          onClick={handleSubmit}\n          disabled={isSubmitting || !email.trim() || selectedRoleIds.length === 0}\n        >\n          {isSubmitting\n            ? t('common.loading', 'Loading...')\n            : t('customer_accounts.widgets.invite.submit', 'Send Invitation')}\n        </Button>\n      </div>\n    </div>\n  )\n}\n\nexport default function AccountStatusWidget({ context }: AccountStatusProps) {\n  const t = useT()\n  const queryClient = useQueryClient()\n  const personEntityId = context?.recordId\n  const [showInviteForm, setShowInviteForm] = React.useState(false)\n\n  const { data, isLoading } = useQuery({\n    queryKey: ['customer-account-status', personEntityId],\n    queryFn: async (): Promise<AccountStatusData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall(`/api/customer_accounts/admin/users?personEntityId=${personEntityId}&pageSize=1`)\n      if (!result.ok) return null\n      const json = result.result as Record<string, unknown> | null\n      const items = json?.items as AccountStatusData[] | undefined\n      return items?.[0] || null\n    },\n    enabled: !!personEntityId,\n  })\n\n  // The person record backs both the pending-invitation email fallback below and\n  // the invite form defaults, so it is fetched once here and shared.\n  const { data: personData, isLoading: isLoadingPerson } = useQuery({\n    queryKey: ['customer-account-person', personEntityId],\n    queryFn: async (): Promise<PersonData | null> => {\n      if (!personEntityId) return null\n      const result = await apiCall<PersonData>(\n        `/api/customers/people/${encodeURIComponent(personEntityId)}`,\n      )\n      if (!result.ok) return null\n      return (result.result as PersonData | null) || null\n    },\n    enabled: !!personEntityId && !isLoading && !data,\n  })\n\n  const personEmail = personData?.person?.primaryEmail?.trim() || null\n\n  // A portal account only exists once the invitation is accepted, so the users\n  // query above stays empty right after a successful invite. Without this the\n  // widget renders the identical \"no account\" state and the invite looks like a\n  // no-op (#4950).\n  const { data: pendingInvitation, isLoading: isLoadingInvitation } = useQuery({\n    queryKey: ['customer-account-pending-invitation', personEntityId, personEmail],\n    queryFn: async (): Promise<PendingInvitationData | null> => {\n      if (!personEntityId) return null\n      const byPerson = await fetchPendingInvitation(\n        `personEntityId=${encodeURIComponent(personEntityId)}`,\n      )\n      if (byPerson) return byPerson\n      // person_entity_id is optional on an invitation: the portal invite route\n      // only ever knows the company, and rows written before the entity-ownership\n      // guard landed the person id in customer_entity_id instead. The recipient\n      // address is the one identity every invitation carries, so match on it\n      // before reporting \"no account\" for someone who was already invited (#5499).\n      if (!personEmail) return null\n      return fetchPendingInvitation(`email=${encodeURIComponent(personEmail)}`)\n    },\n    enabled: !!personEntityId && !isLoading && !data && !isLoadingPerson,\n  })\n\n  // A disabled React Query reports isLoading === false, so isLoadingInvitation is\n  // false for the whole person fetch the email fallback waits on. Rendering off\n  // that alone would show \"no portal account linked\" with a live invite button\n  // during that window \u2014 the double-invite #5499 exists to prevent.\n  const isResolvingInvitation = isLoadingPerson || isLoadingInvitation\n\n  function handleInviteSuccess() {\n    setShowInviteForm(false)\n    queryClient.invalidateQueries({ queryKey: ['customer-account-status', personEntityId] })\n    queryClient.invalidateQueries({ queryKey: ['customer-account-pending-invitation', personEntityId] })\n  }\n\n  if (!personEntityId) return null\n\n  if (isLoading) {\n    return <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n  }\n\n  if (!data) {\n    return (\n      <div className=\"rounded-md border p-3\">\n        <div className=\"text-sm font-medium mb-1\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n        {isResolvingInvitation ? (\n          <div className=\"text-sm text-muted-foreground\">{t('common.loading', 'Loading...')}</div>\n        ) : pendingInvitation ? (\n          <div className=\"space-y-1 text-sm\">\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n              <StatusBadge variant=\"warning\" dot>\n                {t('customer_accounts.widgets.invitationPending', 'Invitation pending')}\n              </StatusBadge>\n            </div>\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n              <span>{pendingInvitation.email}</span>\n            </div>\n            <div className=\"flex justify-between\">\n              <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.invitationExpires', 'Invitation expires')}</span>\n              <span>{new Date(pendingInvitation.expiresAt).toLocaleDateString()}</span>\n            </div>\n          </div>\n        ) : (\n          <div className=\"text-sm text-muted-foreground\">{t('customer_accounts.widgets.noAccount', 'No portal account linked')}</div>\n        )}\n        {!showInviteForm && personEntityId && !isResolvingInvitation && (\n          <div className=\"mt-2\">\n            <Button\n              type=\"button\"\n              variant=\"outline\"\n              size=\"sm\"\n              onClick={() => setShowInviteForm(true)}\n            >\n              {pendingInvitation\n                ? t('customer_accounts.widgets.invite.resend', 'Resend invitation')\n                : t('customer_accounts.widgets.invite.button', 'Invite to Portal')}\n            </Button>\n          </div>\n        )}\n        {showInviteForm && personEntityId && (\n          <InviteForm\n            personEntityId={personEntityId}\n            personData={personData ?? null}\n            isLoadingPerson={isLoadingPerson}\n            onSuccess={handleInviteSuccess}\n          />\n        )}\n      </div>\n    )\n  }\n\n  return (\n    <div className=\"rounded-md border p-3\">\n      <div className=\"text-sm font-medium mb-2\">{t('customer_accounts.widgets.accountStatus', 'Portal Account')}</div>\n      <div className=\"space-y-1 text-sm\">\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.status', 'Status')}</span>\n          <StatusBadge variant={data.isActive ? 'success' : 'error'} dot>\n            {data.isActive ? t('common.active', 'Active') : t('common.inactive', 'Inactive')}\n          </StatusBadge>\n        </div>\n        <div className=\"flex justify-between\">\n          <span className=\"text-muted-foreground\">{t('common.email', 'Email')}</span>\n          <span>{data.email}</span>\n        </div>\n        {data.emailVerified !== undefined && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.emailVerified', 'Email Verified')}</span>\n            <span>{data.emailVerified ? '\u2713' : '\u2717'}</span>\n          </div>\n        )}\n        {data.lastLoginAt && (\n          <div className=\"flex justify-between\">\n            <span className=\"text-muted-foreground\">{t('customer_accounts.widgets.lastLogin', 'Last Login')}</span>\n            <span>{new Date(data.lastLoginAt).toLocaleDateString()}</span>\n          </div>\n        )}\n      </div>\n      <div className=\"mt-2\">\n        <a\n          href={`/backend/customer_accounts/users/${data.id}`}\n          className=\"text-xs text-primary hover:underline\"\n        >\n          {t('customer_accounts.widgets.viewAccount', 'View account details \u2192')}\n        </a>\n      </div>\n    </div>\n  )\n}\n"],
+  "mappings": ";AAiLM,cAQA,YARA;AA/KN,OAAO,WAAW;AAClB,SAAS,UAAU,sBAAsB;AACzC,SAAS,eAAe;AACxB,SAAS,0BAA0B;AACnC,SAAS,YAAY;AACrB,SAAS,cAAc;AACvB,SAAS,aAAa;AACtB,SAAS,kBAAkB;AAC3B,SAAS,mBAAmB;AAC5B,SAAS,aAAa;AAuCtB,eAAe,uBAAuB,QAAuD;AAC3F,QAAM,SAAS,MAAM,QAAQ,6CAA6C,MAAM,aAAa;AAC7F,MAAI,CAAC,OAAO,GAAI,QAAO;AACvB,QAAM,OAAO,OAAO;AACpB,QAAM,QAAQ,MAAM;AACpB,SAAO,QAAQ,CAAC,KAAK;AACvB;AAEA,SAAS,WAAW;AAAA,EAClB;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAKG;AACD,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAS,EAAE;AAC3C,QAAM,CAAC,aAAa,cAAc,IAAI,MAAM,SAAS,EAAE;AACvD,QAAM,CAAC,iBAAiB,kBAAkB,IAAI,MAAM,SAAmB,CAAC,CAAC;AACzE,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAuB,CAAC,CAAC;AAC3E,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,IAAI;AAC/D,QAAM,CAAC,cAAc,eAAe,IAAI,MAAM,SAAS,KAAK;AAE5D,QAAM,EAAE,YAAY,IAAI,mBAA2C;AAAA,IACjE,WAAW;AAAA,EACb,CAAC;AAED,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,WAAY;AACjB,UAAM,SAAS,WAAW;AAC1B,UAAM,UAAU,WAAW;AAC3B,QAAI,QAAQ,cAAc;AACxB,eAAS,OAAO,YAAY;AAAA,IAC9B;AACA,UAAM,YAAY,CAAC,SAAS,WAAW,SAAS,QAAQ,EAAE,OAAO,OAAO;AACxE,QAAI,UAAU,SAAS,GAAG;AACxB,qBAAe,UAAU,KAAK,GAAG,CAAC;AAAA,IACpC,WAAW,QAAQ,aAAa;AAC9B,qBAAe,OAAO,WAAW;AAAA,IACnC;AAAA,EACF,GAAG,CAAC,UAAU,CAAC;AAEf,QAAM,UAAU,MAAM;AACpB,QAAI,YAAY;AAChB,mBAAe,YAAY;AACzB,UAAI;AACF,cAAM,OAAO,MAAM;AAAA,UACjB;AAAA,QACF;AACA,YAAI,UAAW;AACf,YAAI,KAAK,MAAM,KAAK,QAAQ;AAC1B,gBAAM,QAAQ,MAAM,QAAQ,KAAK,OAAO,KAAK,IAAI,KAAK,OAAO,QAAQ,CAAC;AACtE,4BAAkB,MAAM,IAAI,CAAC,UAAU,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,KAAK,EAAE,CAAC;AAAA,QAC3E;AAAA,MACF,QAAQ;AAAA,MAER,UAAE;AACA,YAAI,CAAC,UAAW,mBAAkB,KAAK;AAAA,MACzC;AAAA,IACF;AACA,cAAU;AACV,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,CAAC;AAEL,WAAS,WAAW,QAAgB;AAClC;AAAA,MAAmB,CAAC,SAClB,KAAK,SAAS,MAAM,IAAI,KAAK,OAAO,CAAC,OAAO,OAAO,MAAM,IAAI,CAAC,GAAG,MAAM,MAAM;AAAA,IAC/E;AAAA,EACF;AAEA,iBAAe,eAAe;AAC5B,UAAM,eAAe,MAAM,KAAK;AAChC,QAAI,CAAC,cAAc;AACjB,YAAM,EAAE,wDAAwD,mBAAmB,GAAG,OAAO;AAC7F;AAAA,IACF;AACA,QAAI,gBAAgB,WAAW,GAAG;AAChC,YAAM,EAAE,uDAAuD,oCAAoC,GAAG,OAAO;AAC7G;AAAA,IACF;AAEA,oBAAgB,IAAI;AACpB,QAAI;AACF,YAAM,YAAY;AAAA,QAChB,SAAS,EAAE,YAAY,yBAAyB;AAAA,QAChD,iBAAiB,EAAE,gBAAgB,SAAS,gBAAgB;AAAA,QAC5D,WAAW,YAAY;AAErB,gBAAM,OAAO,MAAM;AAAA,YACjB;AAAA,YACA;AAAA,cACE,QAAQ;AAAA,cACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,cAC9C,MAAM,KAAK,UAAU;AAAA,gBACnB,OAAO;AAAA,gBACP,SAAS;AAAA,gBACT,aAAa,YAAY,KAAK,KAAK;AAAA,gBACnC;AAAA,cACF,CAAC;AAAA,YACH;AAAA,UACF;AAEA,cAAI,CAAC,KAAK,IAAI;AACZ,kBAAM,eAAgB,KAAK,QAA2C;AACtE,kBAAM,gBAAgB,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAC9G;AAAA,UACF;AAEA,gBAAM,EAAE,4CAA4C,8BAA8B,GAAG,SAAS;AAC9F,oBAAU;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH,QAAQ;AACN,YAAM,EAAE,iDAAiD,2BAA2B,GAAG,OAAO;AAAA,IAChG,UAAE;AACA,sBAAgB,KAAK;AAAA,IACvB;AAAA,EACF;AAEA,QAAM,YAAY,mBAAmB;AAErC,MAAI,WAAW;AACb,WACE,oBAAC,SAAI,WAAU,sCACZ,YAAE,kBAAkB,YAAY,GACnC;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,kBACb;AAAA,yBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,gBAAe,WAAU,wDACrC,YAAE,gBAAgB,OAAO,GAC5B;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,SAAS,MAAM,OAAO,KAAK;AAAA,UAChD,UAAQ;AAAA,UACR,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,WAAM,SAAQ,uBAAsB,WAAU,wDAC5C,YAAE,gDAAgD,cAAc,GACnE;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,IAAG;AAAA,UACH,MAAK;AAAA,UACL,MAAK;AAAA,UACL,OAAO;AAAA,UACP,UAAU,CAAC,UAAU,eAAe,MAAM,OAAO,KAAK;AAAA,UACtD,UAAU;AAAA;AAAA,MACZ;AAAA,OACF;AAAA,IAEA,qBAAC,SACC;AAAA,0BAAC,SAAI,WAAU,oDACZ,YAAE,0CAA0C,OAAO,GACtD;AAAA,MACC,eAAe,WAAW,IACzB,oBAAC,SAAI,WAAU,iCACZ,YAAE,4CAA4C,oBAAoB,GACrE,IAEA,oBAAC,SAAI,WAAU,0BACZ,yBAAe,IAAI,CAAC,SACnB;AAAA,QAAC;AAAA;AAAA,UAEC,MAAK;AAAA,UACL,SAAS,gBAAgB,SAAS,KAAK,EAAE,IAAI,YAAY;AAAA,UACzD,MAAK;AAAA,UACL,SAAS,MAAM,WAAW,KAAK,EAAE;AAAA,UACjC,UAAU;AAAA,UACV,WAAU;AAAA,UAET,eAAK;AAAA;AAAA,QARD,KAAK;AAAA,MASZ,CACD,GACH;AAAA,OAEJ;AAAA,IAEA,oBAAC,SAAI,WAAU,+BACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,MAAK;AAAA,QACL,SAAS;AAAA,QACT,UAAU,gBAAgB,CAAC,MAAM,KAAK,KAAK,gBAAgB,WAAW;AAAA,QAErE,yBACG,EAAE,kBAAkB,YAAY,IAChC,EAAE,2CAA2C,iBAAiB;AAAA;AAAA,IACpE,GACF;AAAA,KACF;AAEJ;AAEe,SAAR,oBAAqC,EAAE,QAAQ,GAAuB;AAC3E,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,eAAe;AACnC,QAAM,iBAAiB,SAAS;AAChC,QAAM,CAAC,gBAAgB,iBAAiB,IAAI,MAAM,SAAS,KAAK;AAEhE,QAAM,EAAE,MAAM,UAAU,IAAI,SAAS;AAAA,IACnC,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAA+C;AACtD,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM,QAAQ,qDAAqD,cAAc,aAAa;AAC7G,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,YAAM,OAAO,OAAO;AACpB,YAAM,QAAQ,MAAM;AACpB,aAAO,QAAQ,CAAC,KAAK;AAAA,IACvB;AAAA,IACA,SAAS,CAAC,CAAC;AAAA,EACb,CAAC;AAID,QAAM,EAAE,MAAM,YAAY,WAAW,gBAAgB,IAAI,SAAS;AAAA,IAChE,UAAU,CAAC,2BAA2B,cAAc;AAAA,IACpD,SAAS,YAAwC;AAC/C,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,SAAS,MAAM;AAAA,QACnB,yBAAyB,mBAAmB,cAAc,CAAC;AAAA,MAC7D;AACA,UAAI,CAAC,OAAO,GAAI,QAAO;AACvB,aAAQ,OAAO,UAAgC;AAAA,IACjD;AAAA,IACA,SAAS,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC;AAAA,EAC9C,CAAC;AAED,QAAM,cAAc,YAAY,QAAQ,cAAc,KAAK,KAAK;AAMhE,QAAM,EAAE,MAAM,mBAAmB,WAAW,oBAAoB,IAAI,SAAS;AAAA,IAC3E,UAAU,CAAC,uCAAuC,gBAAgB,WAAW;AAAA,IAC7E,SAAS,YAAmD;AAC1D,UAAI,CAAC,eAAgB,QAAO;AAC5B,YAAM,WAAW,MAAM;AAAA,QACrB,kBAAkB,mBAAmB,cAAc,CAAC;AAAA,MACtD;AACA,UAAI,SAAU,QAAO;AAMrB,UAAI,CAAC,YAAa,QAAO;AACzB,aAAO,uBAAuB,SAAS,mBAAmB,WAAW,CAAC,EAAE;AAAA,IAC1E;AAAA,IACA,SAAS,CAAC,CAAC,kBAAkB,CAAC,aAAa,CAAC,QAAQ,CAAC;AAAA,EACvD,CAAC;AAMD,QAAM,wBAAwB,mBAAmB;AAEjD,WAAS,sBAAsB;AAC7B,sBAAkB,KAAK;AACvB,gBAAY,kBAAkB,EAAE,UAAU,CAAC,2BAA2B,cAAc,EAAE,CAAC;AACvF,gBAAY,kBAAkB,EAAE,UAAU,CAAC,uCAAuC,cAAc,EAAE,CAAC;AAAA,EACrG;AAEA,MAAI,CAAC,eAAgB,QAAO;AAE5B,MAAI,WAAW;AACb,WAAO,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE;AAAA,EAC3F;AAEA,MAAI,CAAC,MAAM;AACT,WACE,qBAAC,SAAI,WAAU,yBACb;AAAA,0BAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,MACzG,wBACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,kBAAkB,YAAY,GAAE,IAChF,oBACF,qBAAC,SAAI,WAAU,qBACb;AAAA,6BAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,UACtE,oBAAC,eAAY,SAAQ,WAAU,KAAG,MAC/B,YAAE,+CAA+C,oBAAoB,GACxE;AAAA,WACF;AAAA,QACA,qBAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,UACpE,oBAAC,UAAM,4BAAkB,OAAM;AAAA,WACjC;AAAA,QACA,qBAAC,SAAI,WAAU,wBACb;AAAA,8BAAC,UAAK,WAAU,yBAAyB,YAAE,+CAA+C,oBAAoB,GAAE;AAAA,UAChH,oBAAC,UAAM,cAAI,KAAK,kBAAkB,SAAS,EAAE,mBAAmB,GAAE;AAAA,WACpE;AAAA,SACF,IAEA,oBAAC,SAAI,WAAU,iCAAiC,YAAE,uCAAuC,0BAA0B,GAAE;AAAA,MAEtH,CAAC,kBAAkB,kBAAkB,CAAC,yBACrC,oBAAC,SAAI,WAAU,QACb;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,SAAQ;AAAA,UACR,MAAK;AAAA,UACL,SAAS,MAAM,kBAAkB,IAAI;AAAA,UAEpC,8BACG,EAAE,2CAA2C,mBAAmB,IAChE,EAAE,2CAA2C,kBAAkB;AAAA;AAAA,MACrE,GACF;AAAA,MAED,kBAAkB,kBACjB;AAAA,QAAC;AAAA;AAAA,UACC;AAAA,UACA,YAAY,cAAc;AAAA,UAC1B;AAAA,UACA,WAAW;AAAA;AAAA,MACb;AAAA,OAEJ;AAAA,EAEJ;AAEA,SACE,qBAAC,SAAI,WAAU,yBACb;AAAA,wBAAC,SAAI,WAAU,4BAA4B,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,IAC1G,qBAAC,SAAI,WAAU,qBACb;AAAA,2BAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,iBAAiB,QAAQ,GAAE;AAAA,QACtE,oBAAC,eAAY,SAAS,KAAK,WAAW,YAAY,SAAS,KAAG,MAC3D,eAAK,WAAW,EAAE,iBAAiB,QAAQ,IAAI,EAAE,mBAAmB,UAAU,GACjF;AAAA,SACF;AAAA,MACA,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,gBAAgB,OAAO,GAAE;AAAA,QACpE,oBAAC,UAAM,eAAK,OAAM;AAAA,SACpB;AAAA,MACC,KAAK,kBAAkB,UACtB,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,2CAA2C,gBAAgB,GAAE;AAAA,QACxG,oBAAC,UAAM,eAAK,gBAAgB,WAAM,UAAI;AAAA,SACxC;AAAA,MAED,KAAK,eACJ,qBAAC,SAAI,WAAU,wBACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,uCAAuC,YAAY,GAAE;AAAA,QAChG,oBAAC,UAAM,cAAI,KAAK,KAAK,WAAW,EAAE,mBAAmB,GAAE;AAAA,SACzD;AAAA,OAEJ;AAAA,IACA,oBAAC,SAAI,WAAU,QACb;AAAA,MAAC;AAAA;AAAA,QACC,MAAM,oCAAoC,KAAK,EAAE;AAAA,QACjD,WAAU;AAAA,QAET,YAAE,yCAAyC,6BAAwB;AAAA;AAAA,IACtE,GACF;AAAA,KACF;AAEJ;",
   "names": []
 }

package/dist/modules/customers/api/companies/[id]/route.js

@@ -1,3 +1,4 @@
+import { enrichCustomerDetailResponse } from "../../../lib/detailResponseEnrichment.js";
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
@@ -410,7 +411,7 @@ async function GET(_req, ctx) {
   }) : null;
   if (cache && cacheKey) {
     const cached = await runWithCacheTenant(cacheTenantId, () => cache.get(cacheKey));
-    if (cached) return NextResponse.json(cached);
+    if (cached) return NextResponse.json(await enrichCustomerDetailResponse(cached, "company", { auth, container, em, tenantId: companyScope.tenantId, organizationId: companyScope.organizationId }));
   }
   const shouldLoadCanonicalInteractions = includeInteractions || includeActivities || includeTodos;
   const [profile, addresses, tagAssignments, labelAssignments, comments, canonicalInteractionRows] = await Promise.all([
@@ -964,7 +965,7 @@ async function GET(_req, ctx) {
       logger.warn("Failed to set company detail cache", { component: "companies", err });
     }
   }
-  return NextResponse.json(payload);
+  return NextResponse.json(await enrichCustomerDetailResponse(payload, "company", { auth, container, em, tenantId: companyScope.tenantId, organizationId: companyScope.organizationId }));
 }
 const companyDetailQuerySchema = z.object({
   include: z.string().optional().describe("Comma-separated list of relations to include (addresses, comments, activities, interactions, deals, todos, people).")