@open-mercato/core 0.10.1-develop.7762.1.657bb7236b → 0.10.1-develop.7763.1.caea616ebf

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 6193 entry points
+[build:core] found 6195 entry points
 [build:core] built successfully
 [build:core:generated] found 271 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/profile/route.js

@@ -10,6 +10,7 @@ import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find"
 import { buildPasswordSchema } from "@open-mercato/shared/lib/auth/passwordPolicy";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 import { getCommandInterceptorHttpRejection } from "@open-mercato/shared/lib/commands/errors";
+import { resolveUserDataSubject } from "@open-mercato/core/modules/auth/lib/userDataSubject";
 const logger = createLogger("auth").child({ component: "profile" });
 const profileResponseSchema = z.object({
   email: z.string().email(),
@@ -84,10 +85,18 @@ async function GET(req) {
   try {
     const container = await createRequestContainer();
     const em = container.resolve("em");
+    const userId = await resolveUserDataSubject(em, auth);
+    if (!userId) {
+      return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+    }
     const user = await findOneWithDecryption(
       em,
       User,
-      { id: auth.sub, deletedAt: null },
+      {
+        id: userId,
+        deletedAt: null,
+        ...auth.isApiKey ? { tenantId: auth.tenantId, ...auth.orgId ? { organizationId: auth.orgId } : {} } : {}
+      },
       void 0,
       { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null }
     );
@@ -111,6 +120,9 @@ async function PUT(req) {
   if (!auth?.sub) {
     return NextResponse.json({ error: translate("api.errors.unauthorized", "Unauthorized") }, { status: 401 });
   }
+  if (auth.isApiKey) {
+    return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+  }
   try {
     const body = await req.json().catch(() => ({}));
     const parsed = buildUpdateSchema(translate).safeParse(body);
@@ -206,6 +218,7 @@ const openApi = {
       responses: [
         { status: 200, description: "Profile payload", schema: profileResponseSchema },
         { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "No user binding in the authenticated scope", schema: z.object({ error: z.string() }) },
         { status: 404, description: "User not found", schema: z.object({ error: z.string() }) }
       ]
     },
@@ -219,7 +232,8 @@ const openApi = {
       responses: [
         { status: 200, description: "Profile updated", schema: profileUpdateResponseSchema },
         { status: 400, description: "Invalid payload", schema: z.object({ error: z.string() }) },
-        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) }
+        { status: 401, description: "Unauthorized", schema: z.object({ error: z.string() }) },
+        { status: 403, description: "Interactive session required", schema: z.object({ error: z.string() }) }
       ]
     }
   }

package/dist/modules/auth/api/profile/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/auth/api/profile/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      { id: auth.sub, deletedAt: null },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AAEnD,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,MAChC;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\nimport { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'\nimport { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'\n\nconst logger = createLogger('auth').child({ component: 'profile' })\n\nconst profileResponseSchema = z.object({\n  email: z.string().email(),\n  name: z.string().nullable().optional(),\n  roles: z.array(z.string()),\n})\n\nconst passwordSchema = buildPasswordSchema()\n\nconst updateSchemaBase = z.object({\n  email: z.string().email().optional(),\n  currentPassword: z.string().trim().min(1).optional(),\n  password: passwordSchema.optional(),\n})\n\nfunction buildUpdateSchema(translate: (key: string, fallback: string) => string) {\n  return updateSchemaBase.superRefine((data, ctx) => {\n    if (!data.email && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.emailOrPasswordRequired',\n          'Provide an email or password.',\n        ),\n        path: ['email'],\n      })\n    }\n    if (data.password && !data.currentPassword) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.currentPasswordRequired',\n          'Current password is required.',\n        ),\n        path: ['currentPassword'],\n      })\n    }\n    if (data.currentPassword && !data.password) {\n      ctx.addIssue({\n        code: z.ZodIssueCode.custom,\n        message: translate(\n          'auth.profile.form.errors.newPasswordRequired',\n          'New password is required.',\n        ),\n        path: ['password'],\n      })\n    }\n  })\n}\n\nconst updateSchema = buildUpdateSchema((_key, fallback) => fallback)\n\nconst profileUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  email: z.string().email(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true },\n  PUT: { requireAuth: true },\n}\n\nfunction buildCommandContext(container: Awaited<ReturnType<typeof createRequestContainer>>, auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>, req: Request): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: null,\n    selectedOrganizationId: auth.orgId ?? null,\n    organizationIds: auth.orgId ? [auth.orgId] : null,\n    request: req,\n  }\n}\n\nexport async function GET(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  try {\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const userId = await resolveUserDataSubject(em, auth)\n    if (!userId) {\n      return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n    }\n    const user = await findOneWithDecryption(\n      em,\n      User,\n      {\n        id: userId,\n        deletedAt: null,\n        ...(auth.isApiKey ? { tenantId: auth.tenantId, ...(auth.orgId ? { organizationId: auth.orgId } : {}) } : {}),\n      },\n      undefined,\n      { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n    )\n    if (!user) {\n      return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n    }\n    const displayName = typeof user.name === 'string' ? user.name.trim() : ''\n    return NextResponse.json({\n      email: String(user.email),\n      name: displayName.length > 0 ? displayName : null,\n      roles: auth.roles ?? [],\n    })\n  } catch (err) {\n    logger.error('Profile load failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })\n  }\n}\n\nexport async function PUT(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })\n  }\n  if (auth.isApiKey) {\n    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n  }\n  try {\n    const body = await req.json().catch(() => ({}))\n    const parsed = buildUpdateSchema(translate).safeParse(body)\n    if (!parsed.success) {\n      return NextResponse.json(\n        {\n          error: translate('auth.profile.form.errors.invalid', 'Invalid profile update.'),\n          issues: parsed.error.issues,\n        },\n        { status: 400 },\n      )\n    }\n    const container = await createRequestContainer()\n    const em = (container.resolve('em') as EntityManager)\n    const authService = container.resolve('authService') as AuthService\n    if (parsed.data.password) {\n      const user = await findOneWithDecryption(\n        em,\n        User,\n        { id: auth.sub, deletedAt: null },\n        undefined,\n        { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n      )\n      if (!user) {\n        return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })\n      }\n      const currentPassword = parsed.data.currentPassword?.trim() ?? ''\n      const isCurrentPasswordValid = await authService.verifyPassword(user, currentPassword)\n      if (!isCurrentPasswordValid) {\n        const message = translate(\n          'auth.profile.form.errors.currentPasswordInvalid',\n          'Current password is incorrect.',\n        )\n        return NextResponse.json(\n          {\n            error: message,\n            issues: [{ path: ['currentPassword'], message }],\n          },\n          { status: 400 },\n        )\n      }\n    }\n    const commandBus = (container.resolve('commandBus') as CommandBus)\n    const ctx = buildCommandContext(container, auth, req)\n    const { result } = await commandBus.execute<{ id: string; email?: string; password?: string }, User>(\n      'auth.users.update',\n      {\n        input: {\n          id: auth.sub,\n          email: parsed.data.email,\n          password: parsed.data.password,\n        },\n        ctx,\n      },\n    )\n    const roles = await authService.getUserRoles(result, result.tenantId ? String(result.tenantId) : null)\n    const jwt = signJwt({\n      sub: String(result.id),\n      sid: typeof auth.sid === 'string' ? auth.sid : undefined,\n      tenantId: result.tenantId ? String(result.tenantId) : null,\n      orgId: result.organizationId ? String(result.organizationId) : null,\n      email: result.email,\n      roles,\n    })\n    const res = NextResponse.json({ ok: true, email: String(result.email) })\n    res.cookies.set('auth_token', jwt, {\n      httpOnly: true,\n      path: '/',\n      sameSite: 'lax',\n      secure: process.env.NODE_ENV === 'production',\n      maxAge: 60 * 60 * 8,\n    })\n    return res\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    const interceptorRejection = getCommandInterceptorHttpRejection(err)\n    if (interceptorRejection) {\n      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })\n    }\n    logger.error('Profile update failed', { err })\n    return NextResponse.json({ error: translate('auth.profile.form.errors.save', 'Failed to update profile.') }, { status: 400 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Profile settings',\n  methods: {\n    GET: {\n      summary: 'Get current profile',\n      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',\n      responses: [\n        { status: 200, description: 'Profile payload', schema: profileResponseSchema },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'No user binding in the authenticated scope', schema: z.object({ error: z.string() }) },\n        { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },\n      ],\n    },\n    PUT: {\n      summary: 'Update current profile',\n      description: 'Updates the email address or password for the signed-in user.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: updateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },\n        { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },\n        { status: 403, description: 'Interactive session required', schema: z.object({ error: z.string() }) },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAGlB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AACpC,SAAS,uBAAuB;AAEhC,SAAS,YAAY;AAErB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,0CAA0C;AACnD,SAAS,8BAA8B;AAEvC,MAAM,SAAS,aAAa,MAAM,EAAE,MAAM,EAAE,WAAW,UAAU,CAAC;AAElE,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,EACxB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACrC,OAAO,EAAE,MAAM,EAAE,OAAO,CAAC;AAC3B,CAAC;AAED,MAAM,iBAAiB,oBAAoB;AAE3C,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS;AAAA,EACnC,iBAAiB,EAAE,OAAO,EAAE,KAAK,EAAE,IAAI,CAAC,EAAE,SAAS;AAAA,EACnD,UAAU,eAAe,SAAS;AACpC,CAAC;AAED,SAAS,kBAAkB,WAAsD;AAC/E,SAAO,iBAAiB,YAAY,CAAC,MAAM,QAAQ;AACjD,QAAI,CAAC,KAAK,SAAS,CAAC,KAAK,UAAU;AACjC,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,OAAO;AAAA,MAChB,CAAC;AAAA,IACH;AACA,QAAI,KAAK,YAAY,CAAC,KAAK,iBAAiB;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,iBAAiB;AAAA,MAC1B,CAAC;AAAA,IACH;AACA,QAAI,KAAK,mBAAmB,CAAC,KAAK,UAAU;AAC1C,UAAI,SAAS;AAAA,QACX,MAAM,EAAE,aAAa;AAAA,QACrB,SAAS;AAAA,UACP;AAAA,UACA;AAAA,QACF;AAAA,QACA,MAAM,CAAC,UAAU;AAAA,MACnB,CAAC;AAAA,IACH;AAAA,EACF,CAAC;AACH;AAEA,MAAM,eAAe,kBAAkB,CAAC,MAAM,aAAa,QAAQ;AAEnE,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,MAAM;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,KAAK;AAAA,EACzB,KAAK,EAAE,aAAa,KAAK;AAC3B;AAEA,SAAS,oBAAoB,WAA+D,MAAmE,KAAqC;AAClM,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,KAAK,SAAS;AAAA,IACtC,iBAAiB,KAAK,QAAQ,CAAC,KAAK,KAAK,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,SAAS,MAAM,uBAAuB,IAAI,IAAI;AACpD,QAAI,CAAC,QAAQ;AACX,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrG;AACA,UAAM,OAAO,MAAM;AAAA,MACjB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,WAAW;AAAA,QACX,GAAI,KAAK,WAAW,EAAE,UAAU,KAAK,UAAU,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC,EAAG,IAAI,CAAC;AAAA,MAC5G;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,IACxE;AACA,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACrH;AACA,UAAM,cAAc,OAAO,KAAK,SAAS,WAAW,KAAK,KAAK,KAAK,IAAI;AACvE,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,OAAO,KAAK,KAAK;AAAA,MACxB,MAAM,YAAY,SAAS,IAAI,cAAc;AAAA,MAC7C,OAAO,KAAK,SAAS,CAAC;AAAA,IACxB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,WAAO,MAAM,uBAAuB,EAAE,IAAI,CAAC;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,yBAAyB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5H;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3G;AACA,MAAI,KAAK,UAAU;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AACA,MAAI;AACF,UAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,UAAM,SAAS,kBAAkB,SAAS,EAAE,UAAU,IAAI;AAC1D,QAAI,CAAC,OAAO,SAAS;AACnB,aAAO,aAAa;AAAA,QAClB;AAAA,UACE,OAAO,UAAU,oCAAoC,yBAAyB;AAAA,UAC9E,QAAQ,OAAO,MAAM;AAAA,QACvB;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AACA,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,KAAM,UAAU,QAAQ,IAAI;AAClC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAI,OAAO,KAAK,UAAU;AACxB,YAAM,OAAO,MAAM;AAAA,QACjB;AAAA,QACA;AAAA,QACA,EAAE,IAAI,KAAK,KAAK,WAAW,KAAK;AAAA,QAChC;AAAA,QACA,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,MACxE;AACA,UAAI,CAAC,MAAM;AACT,eAAO,aAAa,KAAK,EAAE,OAAO,UAAU,mCAAmC,gBAAgB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,MACrH;AACA,YAAM,kBAAkB,OAAO,KAAK,iBAAiB,KAAK,KAAK;AAC/D,YAAM,yBAAyB,MAAM,YAAY,eAAe,MAAM,eAAe;AACrF,UAAI,CAAC,wBAAwB;AAC3B,cAAM,UAAU;AAAA,UACd;AAAA,UACA;AAAA,QACF;AACA,eAAO,aAAa;AAAA,UAClB;AAAA,YACE,OAAO;AAAA,YACP,QAAQ,CAAC,EAAE,MAAM,CAAC,iBAAiB,GAAG,QAAQ,CAAC;AAAA,UACjD;AAAA,UACA,EAAE,QAAQ,IAAI;AAAA,QAChB;AAAA,MACF;AAAA,IACF;AACA,UAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,UAAM,MAAM,oBAAoB,WAAW,MAAM,GAAG;AACpD,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,KAAK;AAAA,UACT,OAAO,OAAO,KAAK;AAAA,UACnB,UAAU,OAAO,KAAK;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF;AACA,UAAM,QAAQ,MAAM,YAAY,aAAa,QAAQ,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI,IAAI;AACrG,UAAM,MAAM,QAAQ;AAAA,MAClB,KAAK,OAAO,OAAO,EAAE;AAAA,MACrB,KAAK,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM;AAAA,MAC/C,UAAU,OAAO,WAAW,OAAO,OAAO,QAAQ,IAAI;AAAA,MACtD,OAAO,OAAO,iBAAiB,OAAO,OAAO,cAAc,IAAI;AAAA,MAC/D,OAAO,OAAO;AAAA,MACd;AAAA,IACF,CAAC;AACD,UAAM,MAAM,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,OAAO,OAAO,KAAK,EAAE,CAAC;AACvE,QAAI,QAAQ,IAAI,cAAc,KAAK;AAAA,MACjC,UAAU;AAAA,MACV,MAAM;AAAA,MACN,UAAU;AAAA,MACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,MACjC,QAAQ,KAAK,KAAK;AAAA,IACpB,CAAC;AACD,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,UAAM,uBAAuB,mCAAmC,GAAG;AACnE,QAAI,sBAAsB;AACxB,aAAO,aAAa,KAAK,qBAAqB,MAAM,EAAE,QAAQ,qBAAqB,OAAO,CAAC;AAAA,IAC7F;AACA,WAAO,MAAM,yBAAyB,EAAE,IAAI,CAAC;AAC7C,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iCAAiC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9H;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,sBAAsB;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QAClH,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACxF;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,4BAA4B;AAAA,QACnF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACvF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC,EAAE;AAAA,MACtG;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/lib/userDataSubject.js

@@ -0,0 +1,26 @@
+import { z } from "zod";
+import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { User } from "../data/entities.js";
+const uuidSchema = z.string().uuid();
+async function resolveUserDataSubject(em, auth) {
+  if (!auth.isApiKey) return auth.sub;
+  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null;
+  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null;
+  const user = await findOneWithDecryption(
+    em,
+    User,
+    {
+      id: auth.userId,
+      tenantId: auth.tenantId,
+      ...auth.orgId ? { organizationId: auth.orgId } : {},
+      deletedAt: null
+    },
+    void 0,
+    { tenantId: auth.tenantId, organizationId: auth.orgId }
+  );
+  return user?.id ?? null;
+}
+export {
+  resolveUserDataSubject
+};
+//# sourceMappingURL=userDataSubject.js.map

package/dist/modules/auth/lib/userDataSubject.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/auth/lib/userDataSubject.ts"],
+  "sourcesContent": ["import { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { User } from '../data/entities'\n\nconst uuidSchema = z.string().uuid()\n\nexport async function resolveUserDataSubject(\n  em: EntityManager,\n  auth: NonNullable<AuthContext>,\n): Promise<string | null> {\n  if (!auth.isApiKey) return auth.sub\n  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null\n  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null\n\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    {\n      id: auth.userId,\n      tenantId: auth.tenantId,\n      ...(auth.orgId ? { organizationId: auth.orgId } : {}),\n      deletedAt: null,\n    },\n    undefined,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  return user?.id ?? null\n}\n"],
+  "mappings": "AAAA,SAAS,SAAS;AAGlB,SAAS,6BAA6B;AACtC,SAAS,YAAY;AAErB,MAAM,aAAa,EAAE,OAAO,EAAE,KAAK;AAEnC,eAAsB,uBACpB,IACA,MACwB;AACxB,MAAI,CAAC,KAAK,SAAU,QAAO,KAAK;AAChC,MAAI,CAAC,WAAW,UAAU,KAAK,MAAM,EAAE,WAAW,CAAC,WAAW,UAAU,KAAK,QAAQ,EAAE,QAAS,QAAO;AACvG,MAAI,KAAK,UAAU,QAAQ,CAAC,WAAW,UAAU,KAAK,KAAK,EAAE,QAAS,QAAO;AAE7E,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,KAAK;AAAA,MACT,UAAU,KAAK;AAAA,MACf,GAAI,KAAK,QAAQ,EAAE,gBAAgB,KAAK,MAAM,IAAI,CAAC;AAAA,MACnD,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,SAAO,MAAM,MAAM;AACrB;",
+  "names": []
+}

package/dist/modules/dashboards/api/layout/[itemId]/route.js

@@ -2,6 +2,8 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveUserDataSubject } from "@open-mercato/core/modules/auth/lib/userDataSubject";
 import { DashboardLayout } from "@open-mercato/core/modules/dashboards/data/entities";
 import { dashboardLayoutItemPatchSchema } from "@open-mercato/core/modules/dashboards/data/validators";
 import {
@@ -41,13 +43,18 @@ async function PATCH(req, ctx) {
   const { resolve } = container;
   const em = resolve("em");
   const rbac = resolve("rbacService");
+  const userId = await resolveUserDataSubject(em, auth);
+  if (!userId) {
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+  }
   const scope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null
   };
   const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
+    auth.sub,
     ["dashboards.configure"],
     { tenantId: scope.tenantId, organizationId: scope.organizationId }
   );
@@ -57,7 +64,7 @@ async function PATCH(req, ctx) {
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: scope.tenantId ?? "",
     organizationId: scope.organizationId,
-    userId: scope.userId,
+    userId: auth.sub,
     resourceKind: RESOURCE_KIND,
     resourceId: layoutItemId,
     operation: "update",
@@ -92,7 +99,7 @@ async function PATCH(req, ctx) {
     await runCrudMutationGuardAfterSuccess(container, {
       tenantId: scope.tenantId ?? "",
       organizationId: scope.organizationId,
-      userId: scope.userId,
+      userId: auth.sub,
       resourceKind: RESOURCE_KIND,
       resourceId: layoutItemId,
       operation: "update",

package/dist/modules/dashboards/api/layout/[itemId]/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dashboards/api/layout/%5BitemId%5D/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutItemUpdateSchema,\n} from '../../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { itemId?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const layoutItemId = ctx.params?.itemId\n  if (!layoutItemId) return NextResponse.json({ error: 'Missing layout item id' }, { status: 400 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  if (!body || typeof body !== 'object' || Array.isArray(body)) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutItemPatchSchema.safeParse({ ...(body as Record<string, unknown>), id: layoutItemId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n\n  const scope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    scope.userId,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: RESOURCE_KIND,\n    resourceId: layoutItemId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { id: layoutItemId, size: parsed.data.size, settings: parsed.data.settings },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const layout = await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n  if (!layout) {\n    return NextResponse.json({ error: 'Layout not found' }, { status: 404 })\n  }\n\n  const idx = layout.layoutJson.findIndex((item: { id?: string | null }) => item?.id === layoutItemId)\n  if (idx === -1) {\n    return NextResponse.json({ error: 'Layout item not found' }, { status: 404 })\n  }\n\n  const current = layout.layoutJson[idx]\n  layout.layoutJson[idx] = {\n    ...current,\n    size: parsed.data.size ?? current.size ?? DEFAULT_SIZE,\n    settings: parsed.data.settings ?? current.settings,\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: layoutItemId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutItemParamsSchema = z.object({\n  itemId: z.string().uuid(),\n})\n\nconst layoutItemPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update a dashboard layout item',\n  description: 'Adjusts the size or settings for a single widget within the dashboard layout.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutItemUpdateSchema,\n    description: 'Payload containing the new size or settings for the widget.',\n  },\n  responses: [\n    { status: 200, description: 'Layout item updated.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or missing item id', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n    { status: 404, description: 'Item not found', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Update dashboard layout item',\n  pathParams: layoutItemParamsSchema,\n  methods: {\n    PATCH: layoutItemPatchDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACxE;AAEA,eAAsB,MAAM,KAAc,KAAuC;AAC/E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,eAAe,IAAI,QAAQ;AACjC,MAAI,CAAC,aAAc,QAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,SAAS,+BAA+B,UAAU,EAAE,GAAI,MAAkC,IAAI,aAAa,CAAC;AAClH,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,QAAQ;AAAA,IACZ,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,MAAM;AAAA,IACN,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,IAAI,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,OAAO,KAAK,SAAS;AAAA,EAC9F,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC/C,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,MAAM,OAAO,WAAW,UAAU,CAAC,SAAiC,MAAM,OAAO,YAAY;AACnG,MAAI,QAAQ,IAAI;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,OAAO,WAAW,GAAG;AACrC,SAAO,WAAW,GAAG,IAAI;AAAA,IACvB,GAAG;AAAA,IACH,MAAM,OAAO,KAAK,QAAQ,QAAQ,QAAQ;AAAA,IAC1C,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,EAC5C;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAED,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,mBAAmB;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,IAClG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,OAAO;AAAA,EACT;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutItemUpdateSchema,\n} from '../../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  PATCH: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\nexport async function PATCH(req: Request, ctx: { params?: { itemId?: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const layoutItemId = ctx.params?.itemId\n  if (!layoutItemId) return NextResponse.json({ error: 'Missing layout item id' }, { status: 400 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  if (!body || typeof body !== 'object' || Array.isArray(body)) {\n    return NextResponse.json({ error: 'Invalid payload' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutItemPatchSchema.safeParse({ ...(body as Record<string, unknown>), id: layoutItemId })\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n\n  const userId = await resolveUserDataSubject(em, auth)\n  if (!userId) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n  }\n\n  const scope = {\n    userId,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: RESOURCE_KIND,\n    resourceId: layoutItemId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { id: layoutItemId, size: parsed.data.size, settings: parsed.data.settings },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const layout = await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n  if (!layout) {\n    return NextResponse.json({ error: 'Layout not found' }, { status: 404 })\n  }\n\n  const idx = layout.layoutJson.findIndex((item: { id?: string | null }) => item?.id === layoutItemId)\n  if (idx === -1) {\n    return NextResponse.json({ error: 'Layout item not found' }, { status: 404 })\n  }\n\n  const current = layout.layoutJson[idx]\n  layout.layoutJson[idx] = {\n    ...current,\n    size: parsed.data.size ?? current.size ?? DEFAULT_SIZE,\n    settings: parsed.data.settings ?? current.settings,\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: RESOURCE_KIND,\n      resourceId: layoutItemId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutItemParamsSchema = z.object({\n  itemId: z.string().uuid(),\n})\n\nconst layoutItemPatchDoc: OpenApiMethodDoc = {\n  summary: 'Update a dashboard layout item',\n  description: 'Adjusts the size or settings for a single widget within the dashboard layout.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutItemUpdateSchema,\n    description: 'Payload containing the new size or settings for the widget.',\n  },\n  responses: [\n    { status: 200, description: 'Layout item updated.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or missing item id', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n    { status: 404, description: 'Item not found', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Update dashboard layout item',\n  pathParams: layoutItemParamsSchema,\n  methods: {\n    PATCH: layoutItemPatchDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,sCAAsC;AAC/C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,OAAO,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACxE;AAEA,eAAsB,MAAM,KAAc,KAAuC;AAC/E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,eAAe,IAAI,QAAQ;AACjC,MAAI,CAAC,aAAc,QAAO,aAAa,KAAK,EAAE,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEhG,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,MAAM,QAAQ,IAAI,GAAG;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxE;AACA,QAAM,SAAS,+BAA+B,UAAU,EAAE,GAAI,MAAkC,IAAI,aAAa,CAAC;AAClH,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,SAAS,MAAM,uBAAuB,IAAI,IAAI;AACpD,MAAI,CAAC,QAAQ;AACX,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,QAAQ;AAAA,IACZ;AAAA,IACA,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,KAAK;AAAA,IACL,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY;AAAA,IACZ,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,IAAI,cAAc,MAAM,OAAO,KAAK,MAAM,UAAU,OAAO,KAAK,SAAS;AAAA,EAC9F,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,SAAS,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC/C,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzE;AAEA,QAAM,MAAM,OAAO,WAAW,UAAU,CAAC,SAAiC,MAAM,OAAO,YAAY;AACnG,MAAI,QAAQ,IAAI;AACd,WAAO,aAAa,KAAK,EAAE,OAAO,wBAAwB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9E;AAEA,QAAM,UAAU,OAAO,WAAW,GAAG;AACrC,SAAO,WAAW,GAAG,IAAI;AAAA,IACvB,GAAG;AAAA,IACH,MAAM,OAAO,KAAK,QAAQ,QAAQ,QAAQ;AAAA,IAC1C,UAAU,OAAO,KAAK,YAAY,QAAQ;AAAA,EAC5C;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY;AAAA,MACZ,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAC1B,CAAC;AAED,MAAM,qBAAuC;AAAA,EAC3C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,mBAAmB;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,IAClG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,YAAY;AAAA,EACZ,SAAS;AAAA,IACP,OAAO;AAAA,EACT;AACF;",
   "names": []
 }

package/dist/modules/dashboards/api/layout/route.js

@@ -9,6 +9,8 @@ import { resolveAllowedWidgetIds } from "@open-mercato/core/modules/dashboards/l
 import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
+import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
+import { resolveUserDataSubject } from "@open-mercato/core/modules/auth/lib/userDataSubject";
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard
@@ -61,13 +63,17 @@ async function GET(req) {
   const container = await createRequestContainer();
   const em = container.resolve("em").fork({ clear: true, freshEventManager: true, useContext: true });
   const rbac = container.resolve("rbacService");
-  const url = new URL(req.url);
+  const userId = await resolveUserDataSubject(em, auth);
+  if (!userId) {
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+  }
   const scope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null
   };
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId
   });
@@ -98,7 +104,7 @@ async function GET(req) {
       size: widget.metadata.defaultSize ?? DEFAULT_SIZE,
       settings: widget.metadata.defaultSettings ?? void 0
     }));
-    if (hasRegisteredWidgets) {
+    if (hasRegisteredWidgets && !auth.isApiKey) {
       layout = em.create(DashboardLayout, {
         userId: scope.userId,
         tenantId: scope.tenantId,
@@ -108,7 +114,7 @@ async function GET(req) {
       em.persist(layout);
       hasChanged = true;
     }
-  } else if (hasRegisteredWidgets) {
+  } else if (hasRegisteredWidgets || auth.isApiKey) {
     const existingLayout = layout;
     const filtered = items.filter((item) => allowedIds.includes(item.widgetId));
     if (filtered.length !== items.length) {
@@ -119,10 +125,10 @@ async function GET(req) {
     if (existingLayout.layoutJson.length !== items.length || items.some((item, idx) => existingLayout.layoutJson[idx]?.id !== item.id)) {
       hasChanged = true;
     }
-    existingLayout.layoutJson = items;
+    if (!auth.isApiKey) existingLayout.layoutJson = items;
     layout = existingLayout;
   }
-  if (hasChanged) {
+  if (hasChanged && !auth.isApiKey) {
     await em.flush();
   }
   const canConfigure = authorizeFeatures(["dashboards.configure"], {
@@ -189,13 +195,18 @@ async function PUT(req) {
   const { resolve } = container;
   const em = resolve("em").fork({ clear: true, freshEventManager: true, useContext: true });
   const rbac = resolve("rbacService");
+  const userId = await resolveUserDataSubject(em, auth);
+  if (!userId) {
+    const { translate } = await resolveTranslations();
+    return NextResponse.json({ error: translate("api.errors.forbidden", "Forbidden") }, { status: 403 });
+  }
   const scope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null
   };
   const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
+    auth.sub,
     ["dashboards.configure"],
     { tenantId: scope.tenantId, organizationId: scope.organizationId }
   );
@@ -205,7 +216,7 @@ async function PUT(req) {
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: scope.tenantId ?? "",
     organizationId: scope.organizationId,
-    userId: scope.userId,
+    userId: auth.sub,
     resourceKind: RESOURCE_KIND,
     resourceId: scope.userId,
     operation: "update",
@@ -220,7 +231,7 @@ async function PUT(req) {
   if (widgets.length === 0) {
     return NextResponse.json({ error: "Widget registry unavailable" }, { status: 503 });
   }
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId
   });
@@ -266,7 +277,7 @@ async function PUT(req) {
     await runCrudMutationGuardAfterSuccess(container, {
       tenantId: scope.tenantId ?? "",
       organizationId: scope.organizationId,
-      userId: scope.userId,
+      userId: auth.sub,
       resourceKind: RESOURCE_KIND,
       resourceId: scope.userId,
       operation: "update",
@@ -289,7 +300,8 @@ const layoutGetDoc = {
     }
   ],
   errors: [
-    { status: 401, description: "Authentication required", schema: dashboardsErrorSchema }
+    { status: 401, description: "Authentication required", schema: dashboardsErrorSchema },
+    { status: 403, description: "No user binding in the authenticated scope", schema: dashboardsErrorSchema }
   ]
 };
 const layoutPutDoc = {

package/dist/modules/dashboards/api/layout/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/dashboards/api/layout/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { randomUUID } from 'node:crypto'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutStateSchema,\n} from '../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\ntype LayoutScope = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nasync function loadScopeLayout(em: any, scope: LayoutScope): Promise<DashboardLayout | null> {\n  return await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n}\n\nfunction normalizeLayoutItems(items: any[]) {\n  const list = Array.isArray(items) ? items : []\n  const seenIds = new Set<string>()\n  const sanitized = list\n    .filter((item) => item && typeof item === 'object')\n    .map((item) => ({\n      id: String(item.id),\n      widgetId: String(item.widgetId),\n      order: Number.isInteger(item.order) ? Number(item.order) : undefined,\n      priority: Number.isInteger(item.priority) ? Number(item.priority) : undefined,\n      size: typeof item.size === 'string' ? item.size : undefined,\n      settings: item.settings,\n    }))\n    .filter((item) => {\n      if (!item.id || !item.widgetId) return false\n      if (seenIds.has(item.id)) return false\n      seenIds.add(item.id)\n      return true\n    })\n    .sort((a, b) => {\n      const aOrder = a.order ?? a.priority ?? 0\n      const bOrder = b.order ?? b.priority ?? 0\n      return aOrder - bOrder\n    })\n    .map((item, idx) => ({ ...item, order: idx, priority: idx }))\n  return sanitized\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  // Use a fresh fork to avoid carrying over pending entities from other operations\n  const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = container.resolve('rbacService') as any\n  const url = new URL(req.url)\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const widgets = await loadAllWidgets()\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id))\n\n  // An empty widget registry means the module registry has not been populated yet\n  // (a boot race), not that this app has no widgets. Every write below is derived\n  // from it, so a read request must persist nothing until it recovers \u2014 otherwise a\n  // restart-recoverable glitch is written into saved layouts for good (#5041).\n  // Note this keys off the registry, not off `allowedIds`: a user whose allowlist is\n  // legitimately empty on a healthy registry is still pruned and seeded as before.\n  const hasRegisteredWidgets = widgets.length > 0\n\n  let layout = await loadScopeLayout(em, scope)\n  let items = layout ? normalizeLayoutItems(layout.layoutJson) : []\n  let hasChanged = false\n\n  if (!layout) {\n    const defaults = allowedWidgets.filter((widget) => widget.metadata.defaultEnabled)\n    items = defaults.map((widget, index) => ({\n      id: randomUUID(),\n      widgetId: widget.metadata.id,\n      order: index,\n      priority: index,\n      size: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      settings: widget.metadata.defaultSettings ?? undefined,\n    }))\n    if (hasRegisteredWidgets) {\n      layout = em.create(DashboardLayout, {\n        userId: scope.userId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        layoutJson: items,\n      })\n      em.persist(layout)\n      hasChanged = true\n    }\n  } else if (hasRegisteredWidgets) {\n    const existingLayout = layout\n    const filtered = items.filter((item) => allowedIds.includes(item.widgetId))\n    if (filtered.length !== items.length) {\n      hasChanged = true\n      items = filtered\n    }\n    items = items.map((item, index) => (item.order !== index || item.priority !== index ? { ...item, order: index, priority: index } : item))\n    if (\n      existingLayout.layoutJson.length !== items.length ||\n      items.some((item, idx) => existingLayout.layoutJson[idx]?.id !== item.id)\n    ) {\n      hasChanged = true\n    }\n    existingLayout.layoutJson = items\n    layout = existingLayout\n  }\n\n  if (hasChanged) {\n    await em.flush()\n  }\n\n  const canConfigure = authorizeFeatures(['dashboards.configure'], {\n    grantedFeatures: effectiveFeatures,\n  })\n\n  let userEmail: string | null = null\n  let userName: string | null = null\n  let userLabel: string | null = null\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { id: scope.userId, deletedAt: null },\n    undefined,\n    { tenantId: scope.tenantId ?? null, organizationId: scope.organizationId ?? null },\n  )\n  if (user) {\n    userName = user.name?.trim() ?? null\n    userEmail = user.email ?? null\n    userLabel = (userName && userName.length > 0 ? userName : userEmail) ?? null\n  }\n  if (!userLabel) {\n    userLabel = scope.userId\n  }\n\n  const response = {\n    layout: { items },\n    allowedWidgetIds: allowedIds,\n    canConfigure,\n    context: {\n      ...scope,\n      userName,\n      userEmail,\n      userLabel,\n    },\n    widgets: allowedWidgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid layout payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = resolve('rbacService') as any\n\n  const scope: LayoutScope = {\n    userId: String(auth.sub),\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    scope.userId,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: scope.userId,\n    resourceKind: RESOURCE_KIND,\n    resourceId: scope.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { items: parsed.data.items },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const widgets = await loadAllWidgets()\n  // The allowlist below is derived from the registry, and this handler persists the\n  // filtered result unconditionally. An empty registry \u2014 the boot race behind #5041 \u2014\n  // would drop every submitted item and save `[]` while answering `{ ok: true }`, so a\n  // stale tab reordering a widget could erase the layout it just rendered. Fail the\n  // write instead: the save is explicit, so the client must learn it did not happen\n  // and retry, rather than be told a wipe succeeded.\n  if (widgets.length === 0) {\n    return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })\n  }\n  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedSet = new Set(allowedIds)\n\n  const payloadItems = parsed.data.items\n  const sanitized = payloadItems\n    .map((item, index) => ({\n      id: item.id,\n      widgetId: item.widgetId,\n      order: index,\n      priority: index,\n      size: item.size ?? DEFAULT_SIZE,\n      settings: item.settings,\n    }))\n    .filter((item) => allowedSet.has(item.widgetId))\n\n  const uniqueIds = new Set(sanitized.map((item) => item.id))\n  if (uniqueIds.size !== sanitized.length) {\n    return NextResponse.json({ error: 'Layout item IDs must be unique' }, { status: 400 })\n  }\n\n  let layout = await loadScopeLayout(em, scope)\n  if (!layout) {\n    layout = em.create(DashboardLayout, {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      layoutJson: sanitized,\n    })\n    em.persist(layout)\n  } else {\n    layout.layoutJson = sanitized\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: scope.userId,\n      resourceKind: RESOURCE_KIND,\n      resourceId: scope.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutGetDoc: OpenApiMethodDoc = {\n  summary: 'Load the current dashboard layout',\n  description: 'Returns the saved widget layout together with the widgets the current user is allowed to place.',\n  tags: [dashboardsTag],\n  responses: [\n    {\n      status: 200,\n      description: 'Current dashboard layout and available widgets.',\n      schema: dashboardLayoutStateSchema,\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst layoutPutDoc: OpenApiMethodDoc = {\n  summary: 'Persist dashboard layout changes',\n  description: 'Saves the provided widget ordering, sizes, and settings for the current user.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutSchema,\n    description: 'List of dashboard widgets with ordering, sizing, and settings.',\n  },\n  responses: [\n    { status: 200, description: 'Layout updated successfully.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid layout payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n    { status: 503, description: 'Widget registry unavailable \u2014 the layout was not saved', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage personal dashboard layout',\n  methods: {\n    GET: layoutGetDoc,\n    PUT: layoutPutDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAQA,eAAe,gBAAgB,IAAS,OAAqD;AAC3F,SAAO,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IACvC,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAc;AAC1C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AAC7C,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,YAAY,KACf,OAAO,CAAC,SAAS,QAAQ,OAAO,SAAS,QAAQ,EACjD,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,UAAU,OAAO,KAAK,QAAQ;AAAA,IAC9B,OAAO,OAAO,UAAU,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI;AAAA,IAC3D,UAAU,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,IAAI;AAAA,IACpE,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS;AAChB,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAU,QAAO;AACvC,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG,QAAO;AACjC,YAAQ,IAAI,KAAK,EAAE;AACnB,WAAO;AAAA,EACT,CAAC,EACA,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,WAAO,SAAS;AAAA,EAClB,CAAC,EACA,IAAI,CAAC,MAAM,SAAS,EAAE,GAAG,MAAM,OAAO,KAAK,UAAU,IAAI,EAAE;AAC9D,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAE/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AAC3G,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAE3B,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,QAAQ,OAAO,CAAC,MAAM,WAAW,SAAS,EAAE,SAAS,EAAE,CAAC;AAQ/E,QAAM,uBAAuB,QAAQ,SAAS;AAE9C,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,QAAQ,SAAS,qBAAqB,OAAO,UAAU,IAAI,CAAC;AAChE,MAAI,aAAa;AAEjB,MAAI,CAAC,QAAQ;AACX,UAAM,WAAW,eAAe,OAAO,CAAC,WAAW,OAAO,SAAS,cAAc;AACjF,YAAQ,SAAS,IAAI,CAAC,QAAQ,WAAW;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,UAAU,OAAO,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,MAAM,OAAO,SAAS,eAAe;AAAA,MACrC,UAAU,OAAO,SAAS,mBAAmB;AAAA,IAC/C,EAAE;AACF,QAAI,sBAAsB;AACxB,eAAS,GAAG,OAAO,iBAAiB;AAAA,QAClC,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,YAAY;AAAA,MACd,CAAC;AACD,SAAG,QAAQ,MAAM;AACjB,mBAAa;AAAA,IACf;AAAA,EACF,WAAW,sBAAsB;AAC/B,UAAM,iBAAiB;AACvB,UAAM,WAAW,MAAM,OAAO,CAAC,SAAS,WAAW,SAAS,KAAK,QAAQ,CAAC;AAC1E,QAAI,SAAS,WAAW,MAAM,QAAQ;AACpC,mBAAa;AACb,cAAQ;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,CAAC,MAAM,UAAW,KAAK,UAAU,SAAS,KAAK,aAAa,QAAQ,EAAE,GAAG,MAAM,OAAO,OAAO,UAAU,MAAM,IAAI,IAAK;AACxI,QACE,eAAe,WAAW,WAAW,MAAM,UAC3C,MAAM,KAAK,CAAC,MAAM,QAAQ,eAAe,WAAW,GAAG,GAAG,OAAO,KAAK,EAAE,GACxE;AACA,mBAAa;AAAA,IACf;AACA,mBAAe,aAAa;AAC5B,aAAS;AAAA,EACX;AAEA,MAAI,YAAY;AACd,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,QAAM,eAAe,kBAAkB,CAAC,sBAAsB,GAAG;AAAA,IAC/D,iBAAiB;AAAA,EACnB,CAAC;AAED,MAAI,YAA2B;AAC/B,MAAI,WAA0B;AAC9B,MAAI,YAA2B;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,QAAQ,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,MAAM,YAAY,MAAM,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,MAAI,MAAM;AACR,eAAW,KAAK,MAAM,KAAK,KAAK;AAChC,gBAAY,KAAK,SAAS;AAC1B,iBAAa,YAAY,SAAS,SAAS,IAAI,WAAW,cAAc;AAAA,EAC1E;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM;AAAA,EACpB;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,MAAM;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,MACP,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS,eAAe,IAAI,CAAC,YAAY;AAAA,MACvC,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAM,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjG,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,QAAqB;AAAA,IACzB,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,MAAM;AAAA,IACN,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,OAAO,OAAO,KAAK,MAAM;AAAA,EAC9C,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,eAAe;AAOrC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,MAAM,QAAQ;AAAA,IACtE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU;AAErC,QAAM,eAAe,OAAO,KAAK;AACjC,QAAM,YAAY,aACf,IAAI,CAAC,MAAM,WAAW;AAAA,IACrB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,OAAO;AAAA,IACP,UAAU;AAAA,IACV,MAAM,KAAK,QAAQ;AAAA,IACnB,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS,WAAW,IAAI,KAAK,QAAQ,CAAC;AAEjD,QAAM,YAAY,IAAI,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC1D,MAAI,UAAU,SAAS,UAAU,QAAQ;AACvC,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,iBAAiB;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,aAAa;AAAA,EACtB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,MAAM;AAAA,MACd,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,EACvF;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mBAAmB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,sBAAsB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,IAClG,EAAE,QAAQ,KAAK,aAAa,+DAA0D,QAAQ,sBAAsB;AAAA,EACtH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { randomUUID } from 'node:crypto'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardsOkSchema,\n  dashboardLayoutStateSchema,\n} from '../openapi'\n\nconst DEFAULT_SIZE = 'md'\nconst RESOURCE_KIND = 'dashboards.layout'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['dashboards.configure'] },\n}\n\ntype LayoutScope = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n}\n\nasync function loadScopeLayout(em: any, scope: LayoutScope): Promise<DashboardLayout | null> {\n  return await em.findOne(DashboardLayout, {\n    userId: scope.userId,\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n    deletedAt: null,\n  })\n}\n\nfunction normalizeLayoutItems(items: any[]) {\n  const list = Array.isArray(items) ? items : []\n  const seenIds = new Set<string>()\n  const sanitized = list\n    .filter((item) => item && typeof item === 'object')\n    .map((item) => ({\n      id: String(item.id),\n      widgetId: String(item.widgetId),\n      order: Number.isInteger(item.order) ? Number(item.order) : undefined,\n      priority: Number.isInteger(item.priority) ? Number(item.priority) : undefined,\n      size: typeof item.size === 'string' ? item.size : undefined,\n      settings: item.settings,\n    }))\n    .filter((item) => {\n      if (!item.id || !item.widgetId) return false\n      if (seenIds.has(item.id)) return false\n      seenIds.add(item.id)\n      return true\n    })\n    .sort((a, b) => {\n      const aOrder = a.order ?? a.priority ?? 0\n      const bOrder = b.order ?? b.priority ?? 0\n      return aOrder - bOrder\n    })\n    .map((item, idx) => ({ ...item, order: idx, priority: idx }))\n  return sanitized\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const container = await createRequestContainer()\n  // Use a fresh fork to avoid carrying over pending entities from other operations\n  const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = container.resolve('rbacService') as any\n  const userId = await resolveUserDataSubject(em, auth)\n  if (!userId) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n  }\n\n  const scope: LayoutScope = {\n    userId,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const widgets = await loadAllWidgets()\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedWidgets = widgets.filter((w) => allowedIds.includes(w.metadata.id))\n\n  // An empty widget registry means the module registry has not been populated yet\n  // (a boot race), not that this app has no widgets. Every write below is derived\n  // from it, so a read request must persist nothing until it recovers \u2014 otherwise a\n  // restart-recoverable glitch is written into saved layouts for good (#5041).\n  // Note this keys off the registry, not off `allowedIds`: a user whose allowlist is\n  // legitimately empty on a healthy registry is still pruned and seeded as before.\n  const hasRegisteredWidgets = widgets.length > 0\n\n  let layout = await loadScopeLayout(em, scope)\n  let items = layout ? normalizeLayoutItems(layout.layoutJson) : []\n  let hasChanged = false\n\n  if (!layout) {\n    const defaults = allowedWidgets.filter((widget) => widget.metadata.defaultEnabled)\n    items = defaults.map((widget, index) => ({\n      id: randomUUID(),\n      widgetId: widget.metadata.id,\n      order: index,\n      priority: index,\n      size: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      settings: widget.metadata.defaultSettings ?? undefined,\n    }))\n    if (hasRegisteredWidgets && !auth.isApiKey) {\n      layout = em.create(DashboardLayout, {\n        userId: scope.userId,\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        layoutJson: items,\n      })\n      em.persist(layout)\n      hasChanged = true\n    }\n  } else if (hasRegisteredWidgets || auth.isApiKey) {\n    const existingLayout = layout\n    const filtered = items.filter((item) => allowedIds.includes(item.widgetId))\n    if (filtered.length !== items.length) {\n      hasChanged = true\n      items = filtered\n    }\n    items = items.map((item, index) => (item.order !== index || item.priority !== index ? { ...item, order: index, priority: index } : item))\n    if (\n      existingLayout.layoutJson.length !== items.length ||\n      items.some((item, idx) => existingLayout.layoutJson[idx]?.id !== item.id)\n    ) {\n      hasChanged = true\n    }\n    if (!auth.isApiKey) existingLayout.layoutJson = items\n    layout = existingLayout\n  }\n\n  if (hasChanged && !auth.isApiKey) {\n    await em.flush()\n  }\n\n  const canConfigure = authorizeFeatures(['dashboards.configure'], {\n    grantedFeatures: effectiveFeatures,\n  })\n\n  let userEmail: string | null = null\n  let userName: string | null = null\n  let userLabel: string | null = null\n  const user = await findOneWithDecryption(\n    em,\n    User,\n    { id: scope.userId, deletedAt: null },\n    undefined,\n    { tenantId: scope.tenantId ?? null, organizationId: scope.organizationId ?? null },\n  )\n  if (user) {\n    userName = user.name?.trim() ?? null\n    userEmail = user.email ?? null\n    userLabel = (userName && userName.length > 0 ? userName : userEmail) ?? null\n  }\n  if (!userLabel) {\n    userLabel = scope.userId\n  }\n\n  const response = {\n    layout: { items },\n    allowedWidgetIds: allowedIds,\n    canConfigure,\n    context: {\n      ...scope,\n      userName,\n      userEmail,\n      userLabel,\n    },\n    widgets: allowedWidgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? DEFAULT_SIZE,\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = dashboardLayoutSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid layout payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })\n  const rbac = resolve('rbacService') as any\n\n  const userId = await resolveUserDataSubject(em, auth)\n  if (!userId) {\n    const { translate } = await resolveTranslations()\n    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })\n  }\n\n  const scope: LayoutScope = {\n    userId,\n    tenantId: auth.tenantId ?? null,\n    organizationId: auth.orgId ?? null,\n  }\n\n  const canConfigure = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['dashboards.configure'],\n    { tenantId: scope.tenantId, organizationId: scope.organizationId },\n  )\n  if (!canConfigure) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: scope.tenantId ?? '',\n    organizationId: scope.organizationId,\n    userId: auth.sub,\n    resourceKind: RESOURCE_KIND,\n    resourceId: scope.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { items: parsed.data.items },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const widgets = await loadAllWidgets()\n  // The allowlist below is derived from the registry, and this handler persists the\n  // filtered result unconditionally. An empty registry \u2014 the boot race behind #5041 \u2014\n  // would drop every submitted item and save `[]` while answering `{ ok: true }`, so a\n  // stale tab reordering a widget could erase the layout it just rendered. Fail the\n  // write instead: the save is explicit, so the client must learn it did not happen\n  // and retry, rather than be told a wipe succeeded.\n  if (widgets.length === 0) {\n    return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })\n  }\n  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {\n    tenantId: scope.tenantId,\n    organizationId: scope.organizationId,\n  })\n  const allowedIds = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      features: effectiveFeatures,\n      isSuperAdmin: false,\n    },\n    widgets,\n  )\n  const allowedSet = new Set(allowedIds)\n\n  const payloadItems = parsed.data.items\n  const sanitized = payloadItems\n    .map((item, index) => ({\n      id: item.id,\n      widgetId: item.widgetId,\n      order: index,\n      priority: index,\n      size: item.size ?? DEFAULT_SIZE,\n      settings: item.settings,\n    }))\n    .filter((item) => allowedSet.has(item.widgetId))\n\n  const uniqueIds = new Set(sanitized.map((item) => item.id))\n  if (uniqueIds.size !== sanitized.length) {\n    return NextResponse.json({ error: 'Layout item IDs must be unique' }, { status: 400 })\n  }\n\n  let layout = await loadScopeLayout(em, scope)\n  if (!layout) {\n    layout = em.create(DashboardLayout, {\n      userId: scope.userId,\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      layoutJson: sanitized,\n    })\n    em.persist(layout)\n  } else {\n    layout.layoutJson = sanitized\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: scope.tenantId ?? '',\n      organizationId: scope.organizationId,\n      userId: auth.sub,\n      resourceKind: RESOURCE_KIND,\n      resourceId: scope.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst layoutGetDoc: OpenApiMethodDoc = {\n  summary: 'Load the current dashboard layout',\n  description: 'Returns the saved widget layout together with the widgets the current user is allowed to place.',\n  tags: [dashboardsTag],\n  responses: [\n    {\n      status: 200,\n      description: 'Current dashboard layout and available widgets.',\n      schema: dashboardLayoutStateSchema,\n    },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'No user binding in the authenticated scope', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst layoutPutDoc: OpenApiMethodDoc = {\n  summary: 'Persist dashboard layout changes',\n  description: 'Saves the provided widget ordering, sizes, and settings for the current user.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: dashboardLayoutSchema,\n    description: 'List of dashboard widgets with ordering, sizing, and settings.',\n  },\n  responses: [\n    { status: 200, description: 'Layout updated successfully.', schema: dashboardsOkSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid layout payload', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Missing dashboards.configure feature', schema: dashboardsErrorSchema },\n    { status: 503, description: 'Widget registry unavailable \u2014 the layout was not saved', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage personal dashboard layout',\n  methods: {\n    GET: layoutGetDoc,\n    PUT: layoutPutDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,kBAAkB;AAC3B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC,SAAS,6BAA6B;AACtC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC,SAAS,yBAAyB;AAClC,SAAS,YAAY;AACrB,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,eAAe;AACrB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAQA,eAAe,gBAAgB,IAAS,OAAqD;AAC3F,SAAO,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IACvC,QAAQ,MAAM;AAAA,IACd,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,qBAAqB,OAAc;AAC1C,QAAM,OAAO,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC;AAC7C,QAAM,UAAU,oBAAI,IAAY;AAChC,QAAM,YAAY,KACf,OAAO,CAAC,SAAS,QAAQ,OAAO,SAAS,QAAQ,EACjD,IAAI,CAAC,UAAU;AAAA,IACd,IAAI,OAAO,KAAK,EAAE;AAAA,IAClB,UAAU,OAAO,KAAK,QAAQ;AAAA,IAC9B,OAAO,OAAO,UAAU,KAAK,KAAK,IAAI,OAAO,KAAK,KAAK,IAAI;AAAA,IAC3D,UAAU,OAAO,UAAU,KAAK,QAAQ,IAAI,OAAO,KAAK,QAAQ,IAAI;AAAA,IACpE,MAAM,OAAO,KAAK,SAAS,WAAW,KAAK,OAAO;AAAA,IAClD,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS;AAChB,QAAI,CAAC,KAAK,MAAM,CAAC,KAAK,SAAU,QAAO;AACvC,QAAI,QAAQ,IAAI,KAAK,EAAE,EAAG,QAAO;AACjC,YAAQ,IAAI,KAAK,EAAE;AACnB,WAAO;AAAA,EACT,CAAC,EACA,KAAK,CAAC,GAAG,MAAM;AACd,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,UAAM,SAAS,EAAE,SAAS,EAAE,YAAY;AACxC,WAAO,SAAS;AAAA,EAClB,CAAC,EACA,IAAI,CAAC,MAAM,SAAS,EAAE,GAAG,MAAM,OAAO,KAAK,UAAU,IAAI,EAAE;AAC9D,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,YAAY,MAAM,uBAAuB;AAE/C,QAAM,KAAM,UAAU,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AAC3G,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,SAAS,MAAM,uBAAuB,IAAI,IAAI;AACpD,MAAI,CAAC,QAAQ;AACX,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,QAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IAClE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,iBAAiB,QAAQ,OAAO,CAAC,MAAM,WAAW,SAAS,EAAE,SAAS,EAAE,CAAC;AAQ/E,QAAM,uBAAuB,QAAQ,SAAS;AAE9C,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,QAAQ,SAAS,qBAAqB,OAAO,UAAU,IAAI,CAAC;AAChE,MAAI,aAAa;AAEjB,MAAI,CAAC,QAAQ;AACX,UAAM,WAAW,eAAe,OAAO,CAAC,WAAW,OAAO,SAAS,cAAc;AACjF,YAAQ,SAAS,IAAI,CAAC,QAAQ,WAAW;AAAA,MACvC,IAAI,WAAW;AAAA,MACf,UAAU,OAAO,SAAS;AAAA,MAC1B,OAAO;AAAA,MACP,UAAU;AAAA,MACV,MAAM,OAAO,SAAS,eAAe;AAAA,MACrC,UAAU,OAAO,SAAS,mBAAmB;AAAA,IAC/C,EAAE;AACF,QAAI,wBAAwB,CAAC,KAAK,UAAU;AAC1C,eAAS,GAAG,OAAO,iBAAiB;AAAA,QAClC,QAAQ,MAAM;AAAA,QACd,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,YAAY;AAAA,MACd,CAAC;AACD,SAAG,QAAQ,MAAM;AACjB,mBAAa;AAAA,IACf;AAAA,EACF,WAAW,wBAAwB,KAAK,UAAU;AAChD,UAAM,iBAAiB;AACvB,UAAM,WAAW,MAAM,OAAO,CAAC,SAAS,WAAW,SAAS,KAAK,QAAQ,CAAC;AAC1E,QAAI,SAAS,WAAW,MAAM,QAAQ;AACpC,mBAAa;AACb,cAAQ;AAAA,IACV;AACA,YAAQ,MAAM,IAAI,CAAC,MAAM,UAAW,KAAK,UAAU,SAAS,KAAK,aAAa,QAAQ,EAAE,GAAG,MAAM,OAAO,OAAO,UAAU,MAAM,IAAI,IAAK;AACxI,QACE,eAAe,WAAW,WAAW,MAAM,UAC3C,MAAM,KAAK,CAAC,MAAM,QAAQ,eAAe,WAAW,GAAG,GAAG,OAAO,KAAK,EAAE,GACxE;AACA,mBAAa;AAAA,IACf;AACA,QAAI,CAAC,KAAK,SAAU,gBAAe,aAAa;AAChD,aAAS;AAAA,EACX;AAEA,MAAI,cAAc,CAAC,KAAK,UAAU;AAChC,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,QAAM,eAAe,kBAAkB,CAAC,sBAAsB,GAAG;AAAA,IAC/D,iBAAiB;AAAA,EACnB,CAAC;AAED,MAAI,YAA2B;AAC/B,MAAI,WAA0B;AAC9B,MAAI,YAA2B;AAC/B,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,MAAM,QAAQ,WAAW,KAAK;AAAA,IACpC;AAAA,IACA,EAAE,UAAU,MAAM,YAAY,MAAM,gBAAgB,MAAM,kBAAkB,KAAK;AAAA,EACnF;AACA,MAAI,MAAM;AACR,eAAW,KAAK,MAAM,KAAK,KAAK;AAChC,gBAAY,KAAK,SAAS;AAC1B,iBAAa,YAAY,SAAS,SAAS,IAAI,WAAW,cAAc;AAAA,EAC1E;AACA,MAAI,CAAC,WAAW;AACd,gBAAY,MAAM;AAAA,EACpB;AAEA,QAAM,WAAW;AAAA,IACf,QAAQ,EAAE,MAAM;AAAA,IAChB,kBAAkB;AAAA,IAClB;AAAA,IACA,SAAS;AAAA,MACP,GAAG;AAAA,MACH;AAAA,MACA;AAAA,MACA;AAAA,IACF;AAAA,IACA,SAAS,eAAe,IAAI,CAAC,YAAY;AAAA,MACvC,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,0BAA0B,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAM,QAAQ,IAAI,EAAU,KAAK,EAAE,OAAO,MAAM,mBAAmB,MAAM,YAAY,KAAK,CAAC;AACjG,QAAM,OAAO,QAAQ,aAAa;AAElC,QAAM,SAAS,MAAM,uBAAuB,IAAI,IAAI;AACpD,MAAI,CAAC,QAAQ;AACX,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,wBAAwB,WAAW,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,QAAqB;AAAA,IACzB;AAAA,IACA,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB,KAAK,SAAS;AAAA,EAChC;AAEA,QAAM,eAAe,MAAM,KAAK;AAAA,IAC9B,KAAK;AAAA,IACL,CAAC,sBAAsB;AAAA,IACvB,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,EACnE;AACA,MAAI,CAAC,cAAc;AACjB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,MAAM,YAAY;AAAA,IAC5B,gBAAgB,MAAM;AAAA,IACtB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,MAAM;AAAA,IAClB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,OAAO,OAAO,KAAK,MAAM;AAAA,EAC9C,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,UAAU,MAAM,eAAe;AAOrC,MAAI,QAAQ,WAAW,GAAG;AACxB,WAAO,aAAa,KAAK,EAAE,OAAO,8BAA8B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpF;AACA,QAAM,oBAAoB,MAAM,KAAK,qBAAqB,KAAK,KAAK;AAAA,IAClE,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,EACxB,CAAC;AACD,QAAM,aAAa,MAAM;AAAA,IACvB;AAAA,IACA;AAAA,MACE,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,IAChB;AAAA,IACA;AAAA,EACF;AACA,QAAM,aAAa,IAAI,IAAI,UAAU;AAErC,QAAM,eAAe,OAAO,KAAK;AACjC,QAAM,YAAY,aACf,IAAI,CAAC,MAAM,WAAW;AAAA,IACrB,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,OAAO;AAAA,IACP,UAAU;AAAA,IACV,MAAM,KAAK,QAAQ;AAAA,IACnB,UAAU,KAAK;AAAA,EACjB,EAAE,EACD,OAAO,CAAC,SAAS,WAAW,IAAI,KAAK,QAAQ,CAAC;AAEjD,QAAM,YAAY,IAAI,IAAI,UAAU,IAAI,CAAC,SAAS,KAAK,EAAE,CAAC;AAC1D,MAAI,UAAU,SAAS,UAAU,QAAQ;AACvC,WAAO,aAAa,KAAK,EAAE,OAAO,iCAAiC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,MAAI,SAAS,MAAM,gBAAgB,IAAI,KAAK;AAC5C,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,iBAAiB;AAAA,MAClC,QAAQ,MAAM;AAAA,MACd,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,YAAY;AAAA,IACd,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,aAAa;AAAA,EACtB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,MAAM,YAAY;AAAA,MAC5B,gBAAgB,MAAM;AAAA,MACtB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,MAAM;AAAA,MAClB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,sBAAsB;AAAA,EAC1G;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,mBAAmB;AAAA,EACzF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,sBAAsB;AAAA,IACpF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,wCAAwC,QAAQ,sBAAsB;AAAA,IAClG,EAAE,QAAQ,KAAK,aAAa,+DAA0D,QAAQ,sBAAsB;AAAA,EACtH;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.10.1-develop.7762.1.657bb7236b",
+  "version": "0.10.1-develop.7763.1.caea616ebf",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -266,16 +266,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7762.1.657bb7236b",
-    "@open-mercato/shared": "0.10.1-develop.7762.1.657bb7236b",
-    "@open-mercato/ui": "0.10.1-develop.7762.1.657bb7236b",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7763.1.caea616ebf",
+    "@open-mercato/shared": "0.10.1-develop.7763.1.caea616ebf",
+    "@open-mercato/ui": "0.10.1-develop.7763.1.caea616ebf",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.10.1-develop.7762.1.657bb7236b",
-    "@open-mercato/shared": "0.10.1-develop.7762.1.657bb7236b",
-    "@open-mercato/ui": "0.10.1-develop.7762.1.657bb7236b",
+    "@open-mercato/ai-assistant": "0.10.1-develop.7763.1.caea616ebf",
+    "@open-mercato/shared": "0.10.1-develop.7763.1.caea616ebf",
+    "@open-mercato/ui": "0.10.1-develop.7763.1.caea616ebf",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.1",
     "@testing-library/react": "^16.3.3",

package/src/modules/auth/api/profile/route.ts

@@ -14,6 +14,7 @@ import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
+import { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'
 
 const logger = createLogger('auth').child({ component: 'profile' })
 
@@ -98,10 +99,18 @@ export async function GET(req: Request) {
   try {
     const container = await createRequestContainer()
     const em = (container.resolve('em') as EntityManager)
+    const userId = await resolveUserDataSubject(em, auth)
+    if (!userId) {
+      return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+    }
     const user = await findOneWithDecryption(
       em,
       User,
-      { id: auth.sub, deletedAt: null },
+      {
+        id: userId,
+        deletedAt: null,
+        ...(auth.isApiKey ? { tenantId: auth.tenantId, ...(auth.orgId ? { organizationId: auth.orgId } : {}) } : {}),
+      },
       undefined,
       { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
     )
@@ -126,6 +135,9 @@ export async function PUT(req: Request) {
   if (!auth?.sub) {
     return NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
+  if (auth.isApiKey) {
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
   try {
     const body = await req.json().catch(() => ({}))
     const parsed = buildUpdateSchema(translate).safeParse(body)
@@ -222,6 +234,7 @@ export const openApi: OpenApiRouteDoc = {
       responses: [
         { status: 200, description: 'Profile payload', schema: profileResponseSchema },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'No user binding in the authenticated scope', schema: z.object({ error: z.string() }) },
         { status: 404, description: 'User not found', schema: z.object({ error: z.string() }) },
       ],
     },
@@ -236,6 +249,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'Profile updated', schema: profileUpdateResponseSchema },
         { status: 400, description: 'Invalid payload', schema: z.object({ error: z.string() }) },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },
+        { status: 403, description: 'Interactive session required', schema: z.object({ error: z.string() }) },
       ],
     },
   },

package/src/modules/auth/lib/userDataSubject.ts

@@ -0,0 +1,30 @@
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { User } from '../data/entities'
+
+const uuidSchema = z.string().uuid()
+
+export async function resolveUserDataSubject(
+  em: EntityManager,
+  auth: NonNullable<AuthContext>,
+): Promise<string | null> {
+  if (!auth.isApiKey) return auth.sub
+  if (!uuidSchema.safeParse(auth.userId).success || !uuidSchema.safeParse(auth.tenantId).success) return null
+  if (auth.orgId !== null && !uuidSchema.safeParse(auth.orgId).success) return null
+
+  const user = await findOneWithDecryption(
+    em,
+    User,
+    {
+      id: auth.userId,
+      tenantId: auth.tenantId,
+      ...(auth.orgId ? { organizationId: auth.orgId } : {}),
+      deletedAt: null,
+    },
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId },
+  )
+  return user?.id ?? null
+}

package/src/modules/dashboards/api/layout/[itemId]/route.ts

@@ -2,6 +2,8 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'
 import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'
 import { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import {
@@ -48,14 +50,20 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
 
+  const userId = await resolveUserDataSubject(em, auth)
+  if (!userId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
+
   const scope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
   }
 
   const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
+    auth.sub,
     ['dashboards.configure'],
     { tenantId: scope.tenantId, organizationId: scope.organizationId },
   )
@@ -66,7 +74,7 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: scope.tenantId ?? '',
     organizationId: scope.organizationId,
-    userId: scope.userId,
+    userId: auth.sub,
     resourceKind: RESOURCE_KIND,
     resourceId: layoutItemId,
     operation: 'update',
@@ -105,7 +113,7 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     await runCrudMutationGuardAfterSuccess(container, {
       tenantId: scope.tenantId ?? '',
       organizationId: scope.organizationId,
-      userId: scope.userId,
+      userId: auth.sub,
       resourceKind: RESOURCE_KIND,
       resourceId: layoutItemId,
       operation: 'update',

package/src/modules/dashboards/api/layout/route.ts

@@ -9,6 +9,8 @@ import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/l
 import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveUserDataSubject } from '@open-mercato/core/modules/auth/lib/userDataSubject'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -80,15 +82,19 @@ export async function GET(req: Request) {
   // Use a fresh fork to avoid carrying over pending entities from other operations
   const em = (container.resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })
   const rbac = container.resolve('rbacService') as any
-  const url = new URL(req.url)
+  const userId = await resolveUserDataSubject(em, auth)
+  if (!userId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
 
   const scope: LayoutScope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
   }
 
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
   })
@@ -128,7 +134,7 @@ export async function GET(req: Request) {
       size: widget.metadata.defaultSize ?? DEFAULT_SIZE,
       settings: widget.metadata.defaultSettings ?? undefined,
     }))
-    if (hasRegisteredWidgets) {
+    if (hasRegisteredWidgets && !auth.isApiKey) {
       layout = em.create(DashboardLayout, {
         userId: scope.userId,
         tenantId: scope.tenantId,
@@ -138,7 +144,7 @@ export async function GET(req: Request) {
       em.persist(layout)
       hasChanged = true
     }
-  } else if (hasRegisteredWidgets) {
+  } else if (hasRegisteredWidgets || auth.isApiKey) {
     const existingLayout = layout
     const filtered = items.filter((item) => allowedIds.includes(item.widgetId))
     if (filtered.length !== items.length) {
@@ -152,11 +158,11 @@ export async function GET(req: Request) {
     ) {
       hasChanged = true
     }
-    existingLayout.layoutJson = items
+    if (!auth.isApiKey) existingLayout.layoutJson = items
     layout = existingLayout
   }
 
-  if (hasChanged) {
+  if (hasChanged && !auth.isApiKey) {
     await em.flush()
   }
 
@@ -231,14 +237,20 @@ export async function PUT(req: Request) {
   const em = (resolve('em') as any).fork({ clear: true, freshEventManager: true, useContext: true })
   const rbac = resolve('rbacService') as any
 
+  const userId = await resolveUserDataSubject(em, auth)
+  if (!userId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ error: translate('api.errors.forbidden', 'Forbidden') }, { status: 403 })
+  }
+
   const scope: LayoutScope = {
-    userId: String(auth.sub),
+    userId,
     tenantId: auth.tenantId ?? null,
     organizationId: auth.orgId ?? null,
   }
 
   const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
+    auth.sub,
     ['dashboards.configure'],
     { tenantId: scope.tenantId, organizationId: scope.organizationId },
   )
@@ -249,7 +261,7 @@ export async function PUT(req: Request) {
   const guardResult = await validateCrudMutationGuard(container, {
     tenantId: scope.tenantId ?? '',
     organizationId: scope.organizationId,
-    userId: scope.userId,
+    userId: auth.sub,
     resourceKind: RESOURCE_KIND,
     resourceId: scope.userId,
     operation: 'update',
@@ -271,7 +283,7 @@ export async function PUT(req: Request) {
   if (widgets.length === 0) {
     return NextResponse.json({ error: 'Widget registry unavailable' }, { status: 503 })
   }
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+  const effectiveFeatures = await rbac.getEffectiveFeatures(auth.sub, {
     tenantId: scope.tenantId,
     organizationId: scope.organizationId,
   })
@@ -323,7 +335,7 @@ export async function PUT(req: Request) {
     await runCrudMutationGuardAfterSuccess(container, {
       tenantId: scope.tenantId ?? '',
       organizationId: scope.organizationId,
-      userId: scope.userId,
+      userId: auth.sub,
       resourceKind: RESOURCE_KIND,
       resourceId: scope.userId,
       operation: 'update',
@@ -349,6 +361,7 @@ const layoutGetDoc: OpenApiMethodDoc = {
   ],
   errors: [
     { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },
+    { status: 403, description: 'No user binding in the authenticated scope', schema: dashboardsErrorSchema },
   ],
 }