@open-mercato/core 0.10.1-develop.7799.1.d9cd0c8e41 → 0.10.1-develop.7801.1.52db3dc0dd

package/src/modules/customers/api/people/[id]/route.ts

@@ -771,7 +771,10 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
     if (viewerUserId) authorIds.add(viewerUserId)
 
     if (authorIds.size) {
-      const users = await findWithDecryption(em, User, { id: { $in: Array.from(authorIds) } }, {}, { tenantId: person.tenantId ?? auth.tenantId ?? null, organizationId: person.organizationId ?? auth.orgId ?? null })
+      const users = await findWithDecryption(em, User, {
+        id: { $in: Array.from(authorIds) },
+        tenantId: person.tenantId,
+      }, {}, { tenantId: person.tenantId, organizationId: person.organizationId })
       userMap = new Map(
         users.map((user) => [
           user.id,

package/src/modules/customers/commands/interactions.ts

@@ -12,7 +12,8 @@ import {
 import { DefaultDataEngine, type DataEngine } from '@open-mercato/shared/lib/data/engine'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
-import { CustomerInteraction, CustomerEntity } from '../data/entities'
+import { CustomerActivity, CustomerInteraction, CustomerEntity } from '../data/entities'
+import { User } from '@open-mercato/core/modules/auth/data/entities'
 import {
   interactionCreateSchema,
   interactionUpdateSchema,
@@ -38,7 +39,7 @@ import {
   loadCustomFieldSnapshot,
   buildCustomFieldResetMap,
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
-import { CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'
+import { badRequest, CrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'
 import { enforceRecordGoneIsConflict, enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import type { CrudIndexerConfig, CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
@@ -57,6 +58,8 @@ import { resolveCatalogEventType, resolveScopedCalendarEventTypes } from '../lib
 import { clearInapplicableCoreFields, findInapplicableCoreFields, omitHiddenCoreClears, preserveHiddenCoreValuesOnSameTypeEdit } from '../lib/calendar/interactionApplicability'
 import { calendarEventTypes, type CalendarEventTypeBehavior } from '../calendar-event-types'
 import { canonicalCalendarTimezone } from '../lib/calendar/timezone'
+import { findInteractionUserInScope, requireInteractionUsersInScope } from '../lib/interactionUsers'
+import { CUSTOMER_INTERACTION_ACTIVITY_ADAPTER_SOURCE } from '../lib/interactionCompatibility'
 
 const logger = createLogger('customers')
 
@@ -205,6 +208,16 @@ async function ensureInteractionRestoreAccess(
     await ensureInteractionPrivacyChangeAccess(ctx, current, { ...restored, visibility: restored.visibility ?? null })
   }
   await ensureInteractionMutationAccess(ctx, em, { ...restored, channelId: current?.channelId })
+  const userIds = new Set([restored.authorUserId, restored.ownerUserId].filter((value): value is string => !!value))
+  for (const userId of userIds) {
+    const user = await findOneWithDecryption(em, User, {
+      id: userId,
+      tenantId: restored.tenantId,
+    }, undefined, { tenantId: restored.tenantId, organizationId: restored.organizationId })
+    if (user) continue
+    const { translate } = await resolveTranslations()
+    throw badRequest(translate('auth.users.form.errors.notFound', 'User not found'))
+  }
 }
 
 async function loadInteractionSnapshot(em: EntityManager, id: string, ctx?: CommandRuntimeContext): Promise<InteractionSnapshot | null> {
@@ -559,12 +572,28 @@ const createInteractionCommand: CommandHandler<InteractionCreateInput, { interac
     const { parsed, custom } = parseWithCustomFields(interactionCreateSchema, rawInput)
 
     const em = ctx.transactionalEm ?? (ctx.container.resolve('em') as EntityManager).fork()
-    const normalizedAuthor = normalizeAuthorUserId(parsed.authorUserId ?? null, ctx.auth)
+    const defaultAuthor = normalizeAuthorUserId(parsed.authorUserId ?? null, ctx.auth)
     const { interaction, entityId, nextInteractionId } = await runInTransaction(em, async (trx) => {
       const entity = await requireTimelineParentEntity(trx, parsed.entityId, { tenantId: parsed.tenantId, organizationId: parsed.organizationId })
       ensureTenantScope(ctx, entity.tenantId)
       ensureOrganizationScope(ctx, entity.organizationId)
 
+      const legacyActivity = parsed.id && parsed.source === CUSTOMER_INTERACTION_ACTIVITY_ADAPTER_SOURCE
+        ? await findOneWithDecryption(trx, CustomerActivity, {
+          id: parsed.id,
+          entity: entity.id,
+          tenantId: entity.tenantId,
+          organizationId: entity.organizationId,
+        }, undefined, entity)
+        : null
+      const preservesHistoricalAuthor = !!legacyActivity && parsed.authorUserId === legacyActivity.authorUserId
+      await requireInteractionUsersInScope(trx, entity, parsed, legacyActivity ?? {})
+      const normalizedAuthor = preservesHistoricalAuthor
+        ? legacyActivity.authorUserId ?? null
+        : defaultAuthor && await findInteractionUserInScope(trx, defaultAuthor, entity)
+          ? defaultAuthor
+          : null
+
       if (parsed.dealId) {
         await requireDealInScope(trx, parsed.dealId, entity.tenantId, entity.organizationId)
       }
@@ -865,6 +894,7 @@ const updateInteractionCommand: CommandHandler<InteractionUpdateInput, { interac
       })
 
       await ensureInteractionPrivacyChangeAccess(ctx, interaction, parsed)
+      await requireInteractionUsersInScope(trx, interaction, parsed, interaction)
 
       const nextType = parsed.interactionType ?? interaction.interactionType
       const changingType = nextType !== interaction.interactionType

package/src/modules/customers/lib/interactionReadModel.ts

@@ -5,7 +5,7 @@ import { normalizeCustomFieldResponse } from '@open-mercato/shared/lib/custom-fi
 import type { EnricherContext } from '@open-mercato/shared/lib/crud/response-enricher'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { CustomerDeal, CustomerEntity, CustomerInteraction } from '../data/entities'
-import { User } from '@open-mercato/core/modules/auth/data/entities'
+import { interactionUserKey, loadInteractionAuthors } from './interactionUsers'
 import {
   CUSTOMER_INTERACTION_ENTITY_ID,
   type InteractionRecord,
@@ -128,14 +128,6 @@ export async function hydrateCanonicalInteractions({
 }: HydrateCanonicalInteractionsInput): Promise<InteractionRecord[]> {
   if (interactions.length === 0) return []
 
-  const authorIds = Array.from(
-    new Set(
-      interactions
-        .map((interaction) =>
-          typeof interaction.authorUserId === 'string' ? interaction.authorUserId : null)
-        .filter((value): value is string => !!value),
-    ),
-  )
   const dealIds = Array.from(
     new Set(
       interactions
@@ -146,8 +138,8 @@ export async function hydrateCanonicalInteractions({
 
   const tenantId = auth.tenantId ?? null
   const organizationId = selectedOrganizationId ?? null
-  const [users, deals, customFieldValues] = await Promise.all([
-    authorIds.length > 0 ? findWithDecryption(em, User, { id: { $in: authorIds } }, undefined, { tenantId, organizationId }) : Promise.resolve([]),
+  const [userMap, deals, customFieldValues] = await Promise.all([
+    loadInteractionAuthors(em, interactions),
     dealIds.length > 0 ? findWithDecryption(em, CustomerDeal, { id: { $in: dealIds } }, undefined, { tenantId, organizationId }) : Promise.resolve([]),
     loadCustomFieldValues({
       em,
@@ -159,15 +151,6 @@ export async function hydrateCanonicalInteractions({
     }),
   ])
 
-  const userMap = new Map(
-    users.map((user) => [
-      user.id,
-      {
-        name: user.name ?? null,
-        email: user.email ?? null,
-      },
-    ]),
-  )
   const dealMap = new Map(deals.map((deal) => [deal.id, deal.title]))
 
   const baseItems: InteractionRecord[] = interactions.map((interaction) => {
@@ -203,8 +186,8 @@ export async function hydrateCanonicalInteractions({
       tenantId: interaction.tenantId,
       createdAt: interaction.createdAt.toISOString(),
       updatedAt: interaction.updatedAt.toISOString(),
-      authorName: interaction.authorUserId ? userMap.get(interaction.authorUserId)?.name ?? null : null,
-      authorEmail: interaction.authorUserId ? userMap.get(interaction.authorUserId)?.email ?? null : null,
+      authorName: interaction.authorUserId ? userMap.get(interactionUserKey(interaction, interaction.authorUserId))?.name ?? null : null,
+      authorEmail: interaction.authorUserId ? userMap.get(interactionUserKey(interaction, interaction.authorUserId))?.email ?? null : null,
       dealTitle: interaction.dealId ? dealMap.get(interaction.dealId) ?? null : null,
       customValues: normalizeInteractionCustomValues(customFieldValues[interaction.id]),
     }

package/src/modules/customers/lib/interactionUsers.ts

@@ -0,0 +1,79 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { User } from '@open-mercato/core/modules/auth/data/entities'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+
+type InteractionUserScope = {
+  tenantId?: string | null
+  organizationId?: string | null
+}
+
+type InteractionUserReferences = {
+  authorUserId?: string | null
+  ownerUserId?: string | null
+}
+
+type AuthorProfile = { name: string | null; email: string | null }
+
+export function interactionUserKey(scope: InteractionUserScope, userId: string): string {
+  return `${scope.tenantId ?? ''}:${scope.organizationId ?? ''}:${userId}`
+}
+
+export async function findInteractionUserInScope(
+  em: EntityManager,
+  userId: string,
+  scope: InteractionUserScope,
+  options: { includeDeleted?: boolean } = {},
+): Promise<User | null> {
+  if (!scope.tenantId || !scope.organizationId) return null
+  return findOneWithDecryption(em, User, {
+    id: userId,
+    tenantId: scope.tenantId,
+    ...(options.includeDeleted ? {} : { deletedAt: null }),
+  }, undefined, scope)
+}
+
+export async function requireInteractionUsersInScope(
+  em: EntityManager,
+  scope: InteractionUserScope,
+  references: InteractionUserReferences,
+  previousReferences: InteractionUserReferences = {},
+): Promise<void> {
+  for (const field of ['authorUserId', 'ownerUserId'] as const) {
+    const userId = references[field]
+    if (!userId) continue
+    if (await findInteractionUserInScope(em, userId, scope, { includeDeleted: userId === previousReferences[field] })) continue
+    const { translate } = await resolveTranslations()
+    throw new CrudHttpError(400, { error: translate('auth.users.form.errors.notFound', 'User not found') })
+  }
+}
+
+export async function loadInteractionAuthors(
+  em: EntityManager,
+  references: Array<InteractionUserScope & { authorUserId?: string | null }>,
+): Promise<Map<string, AuthorProfile>> {
+  const groups = new Map<string, { tenantId: string; organizationId: string; userIds: Set<string> }>()
+  for (const reference of references) {
+    if (!reference.tenantId || !reference.organizationId || !reference.authorUserId) continue
+    const key = interactionUserKey(reference, '')
+    let group = groups.get(key)
+    if (!group) {
+      group = { tenantId: reference.tenantId, organizationId: reference.organizationId, userIds: new Set() }
+      groups.set(key, group)
+    }
+    group.userIds.add(reference.authorUserId)
+  }
+  const profiles = new Map<string, AuthorProfile>()
+  await Promise.all(Array.from(groups.values(), async ({ tenantId, organizationId, userIds }) => {
+    const scope = { tenantId, organizationId }
+    const users = await findWithDecryption(em, User, {
+      id: { $in: Array.from(userIds) },
+      tenantId,
+    }, undefined, scope)
+    for (const user of users) {
+      profiles.set(interactionUserKey(scope, user.id), { name: user.name ?? null, email: user.email ?? null })
+    }
+  }))
+  return profiles
+}

package/src/modules/entities/backend/entities/user/[entityId]/records/page.tsx

@@ -84,7 +84,6 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
   const [pageSize, setPageSize] = React.useState(50)
   const [search, setSearch] = React.useState('')
   const [filterValues, setFilterValues] = React.useState<Record<string, any>>({})
-  const [columns, setColumns] = React.useState<ColumnDef<any>[]>([])
   const [rawData, setRawData] = React.useState<any[]>([])
   const [total, setTotal] = React.useState(0)
   const [totalPages, setTotalPages] = React.useState(1)
@@ -102,10 +101,30 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
     contextId: deleteMutationContextId,
     blockedMessage: t('ui.forms.flash.saveBlocked', 'Save blocked by validation'),
   })
-  const { data: cfDefs = [] } = useCustomFieldDefs(entityId, {
+  const { data: customFieldDefs } = useCustomFieldDefs(entityId, {
     enabled: Boolean(entityId),
     keyExtras: [scopeVersion],
   })
+  const cfDefs = React.useMemo(() => customFieldDefs ?? [], [customFieldDefs])
+  const columns = React.useMemo<ColumnDef<any>[]>(() => {
+    const visibleDefs = filterCustomFieldDefs(cfDefs, 'list') as any
+    const maxVisible = 10
+    const cols: ColumnDef<any>[] = visibleDefs.map((d: any, idx: number) => ({
+      accessorKey: d.key,
+      header: d.label || d.key,
+      meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },
+      cell: ({ getValue }: { getValue: () => unknown }) => {
+        const v = getValue() as any
+        if (d.kind === 'relation') {
+          return <RelationCell fieldKey={d.key} value={v} fallbackText={normalizeCell(v)} />
+        }
+        return <span className="inline-block max-w-60 truncate align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
+      },
+    }))
+    const hasIdCol = cols.some((c) => (c as any).accessorKey === 'id' || (c as any).id === 'id')
+    if (!hasIdCol) cols.unshift({ accessorKey: 'id', header: 'ID', meta: { hidden: true, priority: 6 } } as any)
+    return cols
+  }, [cfDefs])
   const relationDefinitions = React.useMemo(
     () => filterCustomFieldDefs(cfDefs, 'list').filter(
       (definition): definition is CustomFieldDefDto => definition.kind === 'relation',
@@ -188,28 +207,6 @@ function RecordsPageInner({ params }: { params: { entityId?: string } }) {
     return () => { cancelled = true }
   }, [entityId, page, pageSize, sorting, filterValues, scopeVersion, search, searchableFields])
 
-  // Build columns from custom field definitions only (no data round-trip)
-  React.useEffect(() => {
-    const visibleDefs = filterCustomFieldDefs(cfDefs, 'list') as any
-    const maxVisible = 10
-    const cols: ColumnDef<any>[] = visibleDefs.map((d: any, idx: number) => ({
-      accessorKey: d.key,
-      header: d.label || d.key,
-      meta: { priority: idx < 4 ? 1 : idx < 6 ? 2 : idx < 8 ? 3 : idx < maxVisible ? 4 : 5 },
-      cell: ({ getValue }: { getValue: () => unknown }) => {
-        const v = getValue() as any
-        if (d.kind === 'relation') {
-          return <RelationCell fieldKey={d.key} value={v} fallbackText={normalizeCell(v)} />
-        }
-        return <span className="inline-block max-w-60 truncate align-top" title={normalizeCell(v)}>{normalizeCell(v)}</span>
-      },
-    }))
-    // Ensure hidden 'id' column exists for sorting/state
-    const hasIdCol = cols.some((c) => (c as any).accessorKey === 'id' || (c as any).id === 'id')
-    if (!hasIdCol) cols.unshift({ accessorKey: 'id', header: 'ID', meta: { hidden: true, priority: 6 } } as any)
-    setColumns(cols)
-  }, [cfDefs])
-
   // Search is server-side (see fetch effect); render the fetched page as-is so
   // pagination totals and exports stay consistent with the active search (#3229).
   const data = rawData