@open-mercato/core 0.10.1-develop.7761.1.9dfaf470ed → 0.10.1-develop.7763.1.caea616ebf

package/src/modules/auth/api/profile/route.ts

@@ -14,6 +14,7 @@ import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'
 
 const logger = createLogger('auth').child({ component: 'profile' })
 
@@ -98,10 +99,18 @@ export async function GET(req: Request) {
   try {
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
+    const userId = await resolveUserDataSubject(em, auth)
+    if (!userId) {
+      return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+    }
     const user = await findOneWithDecryption(
       em,
       User,
-      { id: auth.sub, deletedAt: null },
+      {
+        id: userId,
+        deletedAt: null,
+        ...(auth.isApiKey ? { tenantId: auth.tenantId, ...(auth.orgId ? { organizationId: auth.orgId } : {}) } : {}),
+      },
       undefined,
       { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
     )
@@ -126,6 +135,9 @@ export async function PUT(req: Request) {
   if (!auth?.sub) {
     return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
+  if (auth.isApiKey) {
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
   try {
     const body = await req.json().catch(() => ({}))
     const parsed = buildUpdateSchema(translate).safeParse(body)
@@ -222,6 +234,7 @@ export const openApi: OpenApiRouteDoc = {
       responses: [
         { status: 200, description: 'Profile payload', schema: profileResponseSchema },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'No user binding in the authenticated scope', schema: z.object({ error: z.string() }) },
         { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },
       ],
     },
@@ -236,6 +249,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },
         { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Interactive session required', schema: z.object({ error: z.string() }) },
       ],
     },
   },

package/src/modules/auth/lib/userDataSubject.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { User } from '../data/entities'
+
+const uuidSchema = z.string().uuid()
+
+export async function resolveUserDataSubject(
+  em: EntityManager,
+  auth: NonNullable<AuthContext>,
+): Promise<string | null> {
+  if (!auth.isApiKey) return auth.sub
+  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null
+  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null
+
+  const user = await findOneWithDecryption(
+    em,
+    User,
+    {
+      id: auth.userId,
+      tenantId: auth.tenantId,
+      ...(auth.orgId ? { organizationId: auth.orgId } : {}),
+      deletedAt: null,
+    },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId },
+  )
+  return user?.id ?? null
+}

package/src/modules/customer_accounts/widgets/injection/account-status/widget.client.tsx

@@ -325,6 +325,8 @@ export default function AccountStatusWidget({ context }: AccountStatusProps) {
     queryClient.invalidateQueries({ queryKey: ['customer-account-pending-invitation', personEntityId] })
   }
 
+  if (!personEntityId) return null
+
   if (isLoading) {
     return <div className="text-sm text-muted-foreground">{t('common.loading', 'Loading...')}</div>
   }

package/src/modules/customers/api/companies/[id]/route.ts

@@ -1,3 +1,4 @@
+import { enrichCustomerDetailResponse } from '../../../lib/detailResponseEnrichment'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
@@ -524,7 +525,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     : null
   if (cache && cacheKey) {
     const cached = await runWithCacheTenant(cacheTenantId, () => cache.get(cacheKey))
-    if (cached) return NextResponse.json(cached)
+    if (cached) return NextResponse.json(await enrichCustomerDetailResponse(cached as Record<string, unknown>, 'company', { auth, container, em, tenantId: companyScope.tenantId, organizationId: companyScope.organizationId }))
   }
 
   const shouldLoadCanonicalInteractions = includeInteractions || includeActivities || includeTodos
@@ -1211,7 +1212,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     }
   }
 
-  return NextResponse.json(payload)
+  return NextResponse.json(await enrichCustomerDetailResponse(payload, 'company', { auth, container, em, tenantId: companyScope.tenantId, organizationId: companyScope.organizationId }))
 }
 
 const companyDetailQuerySchema = z.object({

package/src/modules/customers/api/deals/[id]/route.ts

@@ -1,3 +1,4 @@
+import { enrichCustomerDetailResponse } from '../../../lib/detailResponseEnrichment'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
@@ -491,20 +492,11 @@ export async function GET(request: Request, context: { params?: Record<string, u
       })
     : null
 
+  let cachedBody: Record<string, unknown> | null = null
   if (detailCache && detailCacheKey) {
     try {
       const cached = await runWithCacheTenant(cacheTenantId, () => detailCache.get(detailCacheKey))
-      if (cached && typeof cached === 'object') {
-        const viewerInfo = await resolveViewer()
-        return NextResponse.json({
-          ...(cached as Record<string, unknown>),
-          viewer: {
-            userId: viewerUserId,
-            name: viewerInfo.name,
-            email: viewerInfo.email,
-          },
-        })
-      }
+      if (cached && typeof cached === 'object') cachedBody = cached as Record<string, unknown>
     } catch (err) {
       // A cache-backend read error must degrade to a fresh DB read, never a 500.
       debugCrudCache('get', {
@@ -514,6 +506,14 @@ export async function GET(request: Request, context: { params?: Record<string, u
       })
     }
   }
+  if (cachedBody) {
+    const viewerInfo = await resolveViewer()
+    return NextResponse.json(await enrichCustomerDetailResponse({
+      ...cachedBody,
+      viewer: { userId: viewerUserId, name: viewerInfo.name, email: viewerInfo.email },
+    }, 'deal', { auth, container, em, tenantId: cacheTenantId, organizationId: cacheOrganizationId }))
+  }
+
   // Issue #3175: the reads below only depend on the already-resolved deal +
   // organization scope + decryption scope, so they are grouped into Promise.all
   // batches instead of being awaited one after another. True dependencies stay
@@ -872,7 +872,7 @@ export async function GET(request: Request, context: { params?: Record<string, u
     }
   }
 
-  return NextResponse.json({ ...cacheableBody, viewer })
+  return NextResponse.json(await enrichCustomerDetailResponse({ ...cacheableBody, viewer }, 'deal', { auth, container, em, tenantId: cacheTenantId, organizationId: cacheOrganizationId }))
 }
 
 const dealDetailQuerySchema = z.object({

package/src/modules/customers/api/people/[id]/route.ts

@@ -1,3 +1,4 @@
+import { enrichCustomerDetailResponse } from '../../../lib/detailResponseEnrichment'
 import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
@@ -579,7 +580,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
         statusCode = 200
         profileMeta = { cacheHit: true, include: Array.from(includeTokens), interactionMode }
         profiler.mark('cache_hit')
-        return NextResponse.json(cached)
+        return NextResponse.json(await enrichCustomerDetailResponse(cached as Record<string, unknown>, 'person', { auth, container, em, tenantId: personDetailTenantId, organizationId: personDetailOrganizationId }))
       }
     }
 
@@ -1134,7 +1135,7 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       } catch {}
     }
 
-    const response = NextResponse.json(payload)
+    const response = NextResponse.json(await enrichCustomerDetailResponse(payload, 'person', { auth, container, em, tenantId: personDetailTenantId, organizationId: personDetailOrganizationId }))
     statusCode = 200
     profileMeta = {
       include: Array.from(includeTokens),

package/src/modules/customers/backend/customers/companies/create/page.tsx

@@ -45,6 +45,8 @@ export default function CreateCompanyPage() {
           initialValues={{ addresses: [] as CompanyFormValues['addresses'] }}
           injectionSpotId={extensionPoints.hosts.companyForm.spotId}
           legacyInjectionSpotId={COMPANY_CREATE_LEGACY_INJECTION_SPOT_ID}
+          entityId="customers.company"
+          resourceKind="customers.company"
           entityIds={[E.customers.customer_entity, E.customers.customer_company_profile]}
           submitLabel={t('customers.companies.form.submit')}
           cancelHref={returnTo ?? '/backend/customers/companies'}
@@ -125,6 +127,10 @@ export default function CreateCompanyPage() {
             }
 
             flash(t('customers.companies.form.success'), 'success')
+            return newId ? { resourceId: newId } : undefined
+          }}
+          onSubmitSuccess={async (_values, result) => {
+            const newId = result?.resourceId
             if (returnTo) router.push(returnTo)
             else if (newId) router.push(`/backend/customers/companies-v2/${newId}`)
             else router.push('/backend/customers/companies')

package/src/modules/customers/backend/customers/companies-v2/[id]/page.tsx

@@ -15,7 +15,9 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { AttachmentsSection, ErrorMessage, LoadingMessage, RecordNotFoundState, type SectionAction } from '@open-mercato/ui/backend/detail'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
-import { InjectionSpot, useInjectionWidgets } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { useCustomerInjectedTabs } from '../../../../components/detail/useCustomerInjectedTabs'
+import { CustomerDetailSidebar } from '../../../../components/detail/CustomerDetailSidebar'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { buildRecordInjectionContext, useSetCurrentRecordInjectionContext } from '@open-mercato/ui/backend/injection/recordContext'
 import { createTranslatorWithFallback } from '@open-mercato/shared/lib/i18n/translate'
@@ -32,7 +34,7 @@ import type { TagsSectionController } from '@open-mercato/ui/backend/detail'
 import { coerceDisplayName } from '../../../../lib/displayName'
 import { isDetailNotFoundStatus } from '@open-mercato/core/modules/customers/lib/detailHelpers'
 import { CompanyDetailHeader } from '../../../../components/detail/CompanyDetailHeader'
-import { CompanyDetailTabs, resolveLegacyTab, type CompanyTabId } from '../../../../components/detail/CompanyDetailTabs'
+import { CompanyDetailTabs, COMPANY_DETAIL_TAB_IDS, resolveLegacyTab, type CompanyTabId } from '../../../../components/detail/CompanyDetailTabs'
 import { useDealsAccess } from '../../../../components/detail/useDealsAccess'
 import { CompanyKpiBar } from '../../../../components/detail/CompanyKpiBar'
 import { ScheduleActivityDialog, type ScheduleActivityEditData } from '../../../../components/detail/ScheduleActivityDialog'
@@ -192,9 +194,11 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
       resourceKind: 'customers.company',
       resourceId: currentCompanyId ?? (id ?? undefined),
       data,
+      isDirty,
+      isSaving,
       retryLastMutation,
     }),
-    [currentCompanyId, data, id, mutationContextId, retryLastMutation],
+    [currentCompanyId, data, isDirty, isSaving, id, mutationContextId, retryLastMutation],
   )
   const runMutationWithContext = React.useCallback(
     async <T,>(operation: () => Promise<T>, mutationPayload?: Record<string, unknown>): Promise<T> => {
@@ -295,36 +299,19 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
     setScheduleDialogOpen(true)
   }, [])
 
-  // Injected tabs from UMES
-  const { widgets: injectedTabWidgets } = useInjectionWidgets('detail:customers.company:tabs', {
+  const { injectedTabs, injectedTabMap, loading: injectedTabsLoading } = useCustomerInjectedTabs({
+    spotId: extensionPoints.hosts.companyTabs.spotId,
     context: injectionContext,
-    triggerOnLoad: true,
+    data,
+    onDataChange: setData,
+    nativeTabIds: COMPANY_DETAIL_TAB_IDS,
   })
 
-  const injectedTabs = React.useMemo(
-    () =>
-      (injectedTabWidgets ?? [])
-        .filter((widget) => (widget.placement?.kind ?? 'tab') === 'tab')
-        .map((widget) => {
-          const tabId = widget.placement?.groupId ?? widget.widgetId
-          const label = widget.placement?.groupLabel
-            ? t(widget.placement.groupLabel, widget.placement.groupLabel)
-            : widget.module.metadata.title ?? tabId
-          const priority = typeof widget.placement?.priority === 'number' ? widget.placement.priority : 0
-          const render = () => (
-            <widget.module.Widget
-              context={injectionContext}
-              data={data}
-              onDataChange={(next: unknown) => setData(next as CompanyOverview)}
-            />
-          )
-          return { id: tabId, label, priority, render }
-        })
-        .sort((a, b) => b.priority - a.priority),
-    [data, injectedTabWidgets, injectionContext, t],
-  )
-
-  const injectedTabMap = React.useMemo(() => new Map(injectedTabs.map((tab) => [tab.id, tab.render])), [injectedTabs])
+  const injectedTabIds = React.useMemo(() => injectedTabs.map((tab) => tab.id), [injectedTabs])
+  React.useEffect(() => {
+    const requested = resolveLegacyTab(searchParams?.get('tab'), injectedTabIds)
+    setActiveTab(requested === 'deals' && isDealsAccessReady && !canViewDeals ? 'people' : requested)
+  }, [searchParams, injectedTabIds, isDealsAccessReady, canViewDeals])
 
   // Tags
   const handleTagsChange = React.useCallback((nextTags: TagSummary[]) => {
@@ -492,6 +479,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
 
           {/* Persistent company header */}
           <CompanyDetailHeader
+            actions={<InjectionSpot spotId={extensionPoints.hosts.companyHeaderActions.spotId} context={injectionContext} data={data} disabled={isSaving} />}
             data={data}
             onTagsChange={handleTagsChange}
             tagsSectionControllerRef={tagsSectionControllerRef}
@@ -506,6 +494,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
           <CompanyKpiBar data={data} />
 
           {/* Two-zone layout: zone1 = form, zone2 = tabs */}
+          <CustomerDetailSidebar spotId={extensionPoints.hosts.companySidebar.spotId} context={injectionContext} data={data} onDataChange={setData} disabled={isSaving}>
           <CollapsibleZoneLayout
             pageType="company-v2"
             entityName={companyName}
@@ -517,6 +506,10 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
                   embedded
                   trackDirtyWhenEmbedded
                   injectionSpotId={extensionPoints.hosts.companyForm.spotId}
+                  entityId="customers.company"
+                  resourceKind="customers.company"
+                  resourceId={companyId}
+                  injectionGroupAliases={{ details: 'identity', profile: 'businessProfile' }}
                   entityIds={[E.customers.customer_entity, E.customers.customer_company_profile]}
                   schema={formSchema}
                   fields={formFields}
@@ -536,6 +529,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
               <CompanyDetailTabs
                 activeTab={activeTab}
                 onTabChange={handleTabChange}
+                isLoadingInjectedTabs={injectedTabsLoading}
                 injectedTabs={injectedTabs.map((tab) => ({ id: tab.id, label: tab.label }))}
                 peopleCount={data.counts?.people ?? 0}
                 dealsCount={dealCount}
@@ -621,7 +615,10 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
             }
           />
 
+          </CustomerDetailSidebar>
+
           {/* UMES footer injection */}
+
           <InjectionSpot spotId={extensionPoints.hosts.companyFooter.spotId} context={injectionContext} data={data} />
 
           {/* Schedule Activity Dialog */}

package/src/modules/customers/backend/customers/deals/[id]/hooks/useDealInjectedTabs.tsx

@@ -1,60 +1,25 @@
 import * as React from 'react'
-import { useInjectionWidgets } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { useCustomerInjectedTabs } from '../../../../../components/detail/useCustomerInjectedTabs'
+import { DEAL_DETAIL_TAB_IDS } from '../../../../../components/detail/DealDetailTabs'
+import { extensionPoints } from '../../../../../extension-points'
 import type { DealDetailPayload } from './types'
 
-type InjectedTab = {
-  id: string
-  label: string
-  priority: number
-  render: () => React.ReactNode
-}
-
 type UseDealInjectedTabsOptions = {
   injectionContext: unknown
   data: DealDetailPayload | null
   setData: React.Dispatch<React.SetStateAction<DealDetailPayload | null>>
 }
 
-type UseDealInjectedTabsResult = {
-  injectedTabs: InjectedTab[]
-  injectedTabMap: Map<string, () => React.ReactNode>
-}
-
 export function useDealInjectedTabs({
   injectionContext,
   data,
   setData,
-}: UseDealInjectedTabsOptions): UseDealInjectedTabsResult {
-  const { widgets: injectedTabWidgets } = useInjectionWidgets('detail:customers.deal:tabs', {
+}: UseDealInjectedTabsOptions) {
+  return useCustomerInjectedTabs({
+    spotId: extensionPoints.hosts.dealTabs.spotId,
     context: injectionContext,
-    triggerOnLoad: true,
+    data,
+    onDataChange: setData,
+    nativeTabIds: DEAL_DETAIL_TAB_IDS,
   })
-
-  const injectedTabs = React.useMemo<InjectedTab[]>(
-    () =>
-      (injectedTabWidgets ?? [])
-        .filter((widget) => (widget.placement?.kind ?? 'tab') === 'tab')
-        .map((widget) => {
-          const tabId = widget.placement?.groupId ?? widget.widgetId
-          const label = widget.placement?.groupLabel ?? widget.module.metadata.title ?? tabId
-          const priority = typeof widget.placement?.priority === 'number' ? widget.placement.priority : 0
-          const render = () => (
-            <widget.module.Widget
-              context={injectionContext}
-              data={data}
-              onDataChange={(next: unknown) => setData(next as DealDetailPayload)}
-            />
-          )
-          return { id: tabId, label, priority, render }
-        })
-        .sort((left, right) => right.priority - left.priority),
-    [data, injectedTabWidgets, injectionContext, setData],
-  )
-
-  const injectedTabMap = React.useMemo(
-    () => new Map(injectedTabs.map((tab) => [tab.id, tab.render])),
-    [injectedTabs],
-  )
-
-  return { injectedTabs, injectedTabMap }
 }

package/src/modules/customers/backend/customers/deals/[id]/page.tsx

@@ -10,6 +10,7 @@ import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { AttachmentsSection, ErrorMessage, LoadingMessage, NotesSection, RecordNotFoundState } from '@open-mercato/ui/backend/detail'
 import { InjectionSpot } from '@open-mercato/ui/backend/injection/InjectionSpot'
+import { CustomerDetailSidebar } from '../../../../components/detail/CustomerDetailSidebar'
 import { buildRecordInjectionContext, useSetCurrentRecordInjectionContext } from '@open-mercato/ui/backend/injection/recordContext'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
 import { CollapsibleZoneLayout, type ZoneSectionDescriptor } from '@open-mercato/ui/backend/crud/CollapsibleZoneLayout'
@@ -100,7 +101,7 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
     [detailTranslator, runMutationWithContext],
   )
 
-  const { injectedTabs, injectedTabMap } = useDealInjectedTabs({
+  const { injectedTabs, injectedTabMap, loading: injectedTabsLoading } = useDealInjectedTabs({
     injectionContext,
     data,
     setData,
@@ -428,8 +429,6 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
   const zone2Content = (
     <div className="rounded-[10px] border border-border bg-card px-5 py-5">
       {(() => {
-        const injected = injectedTabMap.get(activeTab)
-        if (injected) return injected()
 
         if (activeTab === 'activities') {
           const activityEntitySelection = activityEntities.length > 1 ? (
@@ -618,6 +617,7 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
 
         return null
       })()}
+      {injectedTabMap.get(activeTab)?.()}
     </div>
   )
 
@@ -628,6 +628,7 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
           <InjectionSpot spotId={extensionPoints.hosts.dealHeader.spotId} context={injectionContext} data={data} />
 
           <DealDetailHeader
+            actions={<InjectionSpot spotId={extensionPoints.hosts.dealHeaderActions.spotId} context={{ ...injectionContext, isDirty, isSaving }} data={data} disabled={isSaving} />}
             deal={data.deal}
             owner={data.owner}
             people={data.people}
@@ -661,7 +662,9 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
             )}
           />
 
+          <CustomerDetailSidebar spotId={extensionPoints.hosts.dealSidebar.spotId} context={injectionContext} data={data} onDataChange={setData} disabled={isSaving}>
           <DealDetailTabs
+            isLoadingInjectedTabs={injectedTabsLoading}
             activeTab={activeTab}
             onTabChange={handleTabChange}
             injectedTabs={injectedTabs.map((tab) => ({ id: tab.id, label: tab.label }))}
@@ -678,6 +681,7 @@ export default function DealDetailPage({ params }: { params?: { id?: string } })
               zone2={zone2Content}
             />
           </DealDetailTabs>
+          </CustomerDetailSidebar>
 
           <InjectionSpot spotId={extensionPoints.hosts.dealFooter.spotId} context={injectionContext} data={data} />
         </div>

package/src/modules/customers/backend/customers/deals/pipeline/components/QuickDealDialog.tsx

@@ -2,6 +2,7 @@
 
 import * as React from 'react'
 import { z } from 'zod'
+import { E } from '#generated/entities.ids.generated'
 import {
   Dialog,
   DialogContent,
@@ -14,6 +15,7 @@ import { CrudForm, type CrudField, type CrudFormGroup } from '@open-mercato/ui/b
 import { ComboboxInput } from '@open-mercato/ui/backend/inputs/ComboboxInput'
 import { createCrud } from '@open-mercato/ui/backend/utils/crud'
 import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
+import { extensionPoints } from '../../../../../extension-points'
 import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuardedMutation'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -124,14 +126,8 @@ export function QuickDealDialog({
     if (open) setFormInstanceKey((current) => current + 1)
   }, [open])
 
-  const { runMutation, retryLastMutation } = useGuardedMutation<{
-    formId: string
-    resourceKind: string
-    retryLastMutation: () => Promise<boolean>
-  }>({
-    contextId: QUICK_DEAL_CONTEXT_ID,
-    blockedMessage: translateWithFallback(t, 'ui.forms.flash.saveBlocked', 'Save blocked by validation'),
-  })
+
+  const { runMutation, retryLastMutation } = useGuardedMutation({ contextId: QUICK_DEAL_CONTEXT_ID, blockedMessage: translateWithFallback(t, 'ui.forms.flash.saveBlocked', 'Save blocked by validation') })
 
   const titleRequiredMessage = translateWithFallback(
     t,
@@ -355,33 +351,28 @@ export function QuickDealDialog({
       if (values.description && values.description.trim().length) {
         payload.description = values.description
       }
-      const operation = () =>
-        createCrud('customers/deals', payload, {
+      const { result } = await runMutation({
+        operation: () => createCrud<{ id?: string; entityId?: string }>('customers/deals', payload, {
           errorMessage: translateWithFallback(t, 'customers.deals.create.error', 'Failed to create deal.'),
-        })
-      await runMutation({
-        operation,
-        context: {
-          formId: QUICK_DEAL_CONTEXT_ID,
-          resourceKind: 'customers.deal',
-          retryLastMutation,
-        },
+        }),
+        context: { formId: QUICK_DEAL_CONTEXT_ID, resourceKind: 'customers.deal', retryLastMutation },
+        mutationPayload: payload,
       })
       flash(
-        translateWithFallback(
-          t,
-          'customers.deals.kanban.quickDeal.success',
-          'Deal added to {stage}.',
-          { stage: context.pipelineStageLabel },
-        ),
+        translateWithFallback(t, 'customers.deals.kanban.quickDeal.success', 'Deal added to {stage}.', { stage: context.pipelineStageLabel }),
         'success',
       )
-      onCreated()
-      onClose()
+      return { resourceId: result?.id ?? result?.entityId }
     },
-    [context, currentUserId, onClose, onCreated, retryLastMutation, runMutation, t, titleRequiredMessage],
+    [context, currentUserId, t, titleRequiredMessage, runMutation, retryLastMutation],
   )
 
+  const handleSubmitSuccess = React.useCallback(() => {
+    if (!context) return
+    onCreated()
+    onClose()
+  }, [context, onCreated, onClose])
+
   if (!context) return null
 
   return (
@@ -409,6 +400,12 @@ export function QuickDealDialog({
         <CrudForm<QuickDealFormValues>
           key={`${context.pipelineStageId}:${formInstanceKey}`}
           embedded
+          formId={QUICK_DEAL_CONTEXT_ID}
+          entityId="customers.deal"
+          entityIds={[E.customers.customer_deal]}
+          resourceKind="customers.deal"
+          injectionSpotId={extensionPoints.hosts.dealForm.spotId}
+          injectionGroupAliases={{ details: 'basic' }}
           fields={fields}
           groups={groups}
           // The "More details" group starts collapsed; users can expand to set
@@ -419,6 +416,7 @@ export function QuickDealDialog({
           schema={formSchema}
           submitLabel={translateWithFallback(t, 'customers.deals.kanban.quickDeal.submit', 'Add deal')}
           onSubmit={handleSubmit}
+          onSubmitSuccess={handleSubmitSuccess}
         />
       </DialogContent>
     </Dialog>

package/src/modules/customers/backend/customers/people/create/page.tsx

@@ -10,6 +10,7 @@ import { E } from '#generated/entities.ids.generated'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useOrganizationScopeDetail } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { extensionPoints } from '../../../../extension-points'
 import {
   buildPersonPayload,
   createPersonFormFields,
@@ -52,6 +53,10 @@ export default function CreatePersonPage() {
           fields={fields}
           groups={groups}
           initialValues={initialValues}
+          injectionSpotId={extensionPoints.hosts.personForm.spotId}
+          legacyInjectionSpotId="crud-form:customers.customer_entity"
+          entityId="customers.person"
+          resourceKind="customers.person"
           entityIds={[E.customers.customer_entity, E.customers.customer_person_profile]}
           submitLabel={t('customers.people.form.submit')}
           cancelHref={returnTo ?? '/backend/customers/people'}
@@ -127,6 +132,10 @@ export default function CreatePersonPage() {
             }
 
             flash(t('customers.people.form.success'), 'success')
+            return newId ? { resourceId: newId } : undefined
+          }}
+          onSubmitSuccess={async (_values, result) => {
+            const newId = result?.resourceId
             if (returnTo) router.push(returnTo)
             else if (newId) router.push(`/backend/customers/people-v2/${newId}`)
             else router.push('/backend/customers/people')