@open-mercato/core 0.10.1-develop.7761.1.9dfaf470ed → 0.10.1-develop.7763.1.caea616ebf

package/src/modules/dashboards/api/layout/route.ts

@@ -9,6 +9,8 @@ import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/l
 import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -80,15 +82,19 @@ export async function GET(req: Request) {
   // Use a fresh fork to avoid carrying over pending entities from other operations
   const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })
   const rbac = container.resolve('rbacService') as any
-  const url = new URL(req.url)
+  const userId = await resolveUserDataSubject(em, auth)
+  if (!userId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
 
   const scope: LayoutScope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
   }
 
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
   })
@@ -128,7 +134,7 @@ export async function GET(req: Request) {
       size: widget.metadata.defaultSize ?? DEFAULT_SIZE,
       settings: widget.metadata.defaultSettings ?? undefined,
     }))
-    if (hasRegisteredWidgets) {
+    if (hasRegisteredWidgets && !auth.isApiKey) {
       layout = em.create(DashboardLayout, {
         userId: scope.userId,
         tenantId: scope.tenantId,
@@ -138,7 +144,7 @@ export async function GET(req: Request) {
       em.persist(layout)
       hasChanged = true
     }
-  } else if (hasRegisteredWidgets) {
+  } else if (hasRegisteredWidgets || auth.isApiKey) {
     const existingLayout = layout
     const filtered = items.filter((item) => allowedIds.includes(item.widgetId))
     if (filtered.length !== items.length) {
@@ -152,11 +158,11 @@ export async function GET(req: Request) {
     ) {
       hasChanged = true
     }
-    existingLayout.layoutJson = items
+    if (!auth.isApiKey) existingLayout.layoutJson = items
     layout = existingLayout
   }
 
-  if (hasChanged) {
+  if (hasChanged && !auth.isApiKey) {
     await em.flush()
   }
 
@@ -231,14 +237,20 @@ export async function PUT(req: Request) {
   const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })
   const rbac = resolve('rbacService') as any
 
+  const userId = await resolveUserDataSubject(em, auth)
+  if (!userId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
+
   const scope: LayoutScope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
   }
 
   const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
+    auth.sub,
     ['dashboards.configure'],
     { tenantId: scope.tenantId, organizationId: scope.organizationId },
   )
@@ -249,7 +261,7 @@ export async function PUT(req: Request) {
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: scope.tenantId ?? '',
     organizationId: scope.organizationId,
-    userId: scope.userId,
+    userId: auth.sub,
     resourceKind: RESOURCE_KIND,
     resourceId: scope.userId,
     operation: 'update',
@@ -271,7 +283,7 @@ export async function PUT(req: Request) {
   if (widgets.length === 0) {
     return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })
   }
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
   })
@@ -323,7 +335,7 @@ export async function PUT(req: Request) {
     await runCrudMutationGuardAfterSuccess(container, {
       tenantId: scope.tenantId ?? '',
       organizationId: scope.organizationId,
-      userId: scope.userId,
+      userId: auth.sub,
       resourceKind: RESOURCE_KIND,
       resourceId: scope.userId,
       operation: 'update',
@@ -349,6 +361,7 @@ const layoutGetDoc: OpenApiMethodDoc = {
   ],
   errors: [
     { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },
+    { status: 403, description: 'No user binding in the authenticated scope', schema: dashboardsErrorSchema },
   ],
 }
 

package/src/modules/integrations/widgets/injection/external-ids/widget.client.tsx

@@ -22,7 +22,7 @@ function SyncStatusBadge({ status, lastSynced }: { status: ExternalIdMapping['sy
   const label = t(config.label, status)
 
   return (
-    <span className="inline-flex items-center gap-1 text-xs text-muted-foreground">
+    <span className="inline-flex shrink-0 items-center gap-1 text-xs text-muted-foreground">
       <span className={cn('inline-block size-1.5 rounded-full', config.dot)} aria-hidden="true" />
       <span>{label}</span>
       {lastSynced && (
@@ -60,11 +60,11 @@ export default function ExternalIdsWidget({ data }: InjectionWidgetComponentProp
             key={integrationId}
             className="flex items-center justify-between gap-2 rounded-md bg-muted/50 px-3 py-2"
           >
-            <div className="flex items-center gap-2 min-w-0">
+            <div className="flex min-w-0 flex-1 flex-wrap items-center gap-2">
               <span className="text-sm font-medium truncate">
                 {getIntegrationTitle(integrationId)}
               </span>
-              <code className="rounded bg-muted px-1.5 py-0.5 text-xs font-mono text-muted-foreground">
+              <code className="min-w-0 max-w-full break-all rounded bg-muted px-1.5 py-0.5 text-xs font-mono text-muted-foreground">
                 {mapping.externalId}
               </code>
               {mapping.externalUrl && (
@@ -72,7 +72,7 @@ export default function ExternalIdsWidget({ data }: InjectionWidgetComponentProp
                   href={mapping.externalUrl}
                   target="_blank"
                   rel="noopener noreferrer"
-                  className="text-muted-foreground hover:text-foreground transition-colors"
+                  className="shrink-0 text-muted-foreground hover:text-foreground transition-colors"
                   aria-label={t('integrations.externalIds.openExternal', 'Open in external system')}
                 >
                   <ExternalLinkIcon />