@open-mercato/core 0.4.2-canary-10c7a8bf2a → 0.4.2-canary-c84cff7ed5

package/src/modules/auth/frontend/reset/[token]/page.tsx

@@ -4,11 +4,20 @@ import { Input } from '@open-mercato/ui/primitives/input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { useState } from 'react'
 import { useRouter } from 'next/navigation'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { formatPasswordRequirements, getPasswordPolicy } from '@open-mercato/shared/lib/auth/passwordPolicy'
 
 export default function ResetWithTokenPage({ params }: { params: { token: string } }) {
   const router = useRouter()
+  const t = useT()
   const [error, setError] = useState<string | null>(null)
   const [submitting, setSubmitting] = useState(false)
+  const passwordPolicy = getPasswordPolicy()
+  const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)
+  const passwordDescription = passwordRequirements
+    ? t('auth.password.requirements.help', 'Password requirements: {requirements}', { requirements: passwordRequirements })
+    : ''
 
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault()
@@ -17,13 +26,15 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     try {
       const form = new FormData(e.currentTarget)
       form.set('token', params.token)
-      const res = await fetch('/api/auth/reset/confirm', { method: 'POST', body: form })
-      const data = await res.json().catch(() => null)
-      if (!res.ok) {
-        setError(data?.error || 'Unable to reset password')
+      const { ok, result } = await apiCall<{ ok?: boolean; error?: string; redirect?: string }>(
+        '/api/auth/reset/confirm',
+        { method: 'POST', body: form },
+      )
+      if (!ok || result?.ok === false) {
+        setError(result?.error || t('auth.reset.errors.failed', 'Unable to reset password'))
         return
       }
-      router.replace(data?.redirect || '/login')
+      router.replace(result?.redirect || '/login')
     } finally {
       setSubmitting(false)
     }
@@ -33,18 +44,21 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     <div className="min-h-svh flex items-center justify-center p-4">
       <Card className="w-full max-w-sm">
         <CardHeader>
-          <CardTitle>Set a new password</CardTitle>
-          <CardDescription>Choose a strong password for your account.</CardDescription>
+          <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>
+          <CardDescription>{t('auth.reset.subtitle', 'Choose a strong password for your account.')}</CardDescription>
         </CardHeader>
         <CardContent>
           <form className="grid gap-3" onSubmit={onSubmit}>
             {error && <div className="text-sm text-red-600">{error}</div>}
             <div className="grid gap-1">
-              <Label htmlFor="password">New password</Label>
-              <Input id="password" name="password" type="password" required minLength={6} />
+              <Label htmlFor="password">{t('auth.reset.form.password', 'New password')}</Label>
+              <Input id="password" name="password" type="password" required minLength={passwordPolicy.minLength} />
+              {passwordDescription ? (
+                <p className="text-xs text-muted-foreground">{passwordDescription}</p>
+              ) : null}
             </div>
             <button disabled={submitting} className="h-10 rounded-md bg-foreground text-background mt-2 hover:opacity-90 transition disabled:opacity-60">
-              {submitting ? '...' : 'Update password'}
+              {submitting ? t('auth.reset.form.loading', '...') : t('auth.reset.form.submit', 'Update password')}
             </button>
           </form>
         </CardContent>
@@ -52,4 +66,3 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     </div>
   )
 }
-

package/src/modules/auth/i18n/de.json

@@ -2,8 +2,20 @@
   "auth.signIn": "Anmelden",
   "auth.email": "E-Mail",
   "auth.password": "Passwort",
+  "auth.password.requirements.help": "Passwortanforderungen: {requirements}",
+  "auth.password.requirements.minLength": "Mindestens {min} Zeichen",
+  "auth.password.requirements.digit": "Eine Zahl",
+  "auth.password.requirements.uppercase": "Ein Großbuchstabe",
+  "auth.password.requirements.special": "Ein Sonderzeichen",
+  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Link zum Zurücksetzen senden",
   "auth.resetPassword": "Passwort zurücksetzen",
+  "auth.reset.title": "Neues Passwort festlegen",
+  "auth.reset.subtitle": "Wähle ein sicheres Passwort für dein Konto.",
+  "auth.reset.form.password": "Neues Passwort",
+  "auth.reset.form.loading": "...",
+  "auth.reset.form.submit": "Passwort aktualisieren",
+  "auth.reset.errors.failed": "Passwort konnte nicht zurückgesetzt werden",
   "auth.usersRoles": "Benutzer und Rollen",
   "auth.manageAuthSettings": "Verwalte die Authentifizierungseinstellungen.",
   "auth.login.errors.permissionDenied": "Du hast keine Berechtigung, auf diesen Bereich zuzugreifen. Bitte wende dich an deine Administration.",
@@ -80,6 +92,21 @@
   "auth.users.form.errors.load": "Benutzerdaten konnten nicht geladen werden",
   "auth.users.form.errors.aclUpdate": "Aktualisierung der Benutzerberechtigungen fehlgeschlagen",
   "auth.users.form.errors.delete": "Benutzer konnte nicht gelöscht werden",
+  "auth.profile.title": "Profil",
+  "auth.profile.subtitle": "Passwort ändern",
+  "auth.profile.form.email": "E-Mail",
+  "auth.profile.form.password": "Neues Passwort",
+  "auth.profile.form.confirmPassword": "Neues Passwort bestätigen",
+  "auth.profile.form.save": "Änderungen speichern",
+  "auth.profile.form.loading": "Profil wird geladen...",
+  "auth.profile.form.errors.load": "Profil konnte nicht geladen werden.",
+  "auth.profile.form.errors.save": "Profil konnte nicht aktualisiert werden.",
+  "auth.profile.form.errors.invalid": "Ungültige Profilaktualisierung.",
+  "auth.profile.form.errors.passwordMismatch": "Die Passwörter stimmen nicht überein.",
+  "auth.profile.form.errors.passwordRequirements": "Das Passwort muss die Anforderungen erfüllen.",
+  "auth.profile.form.errors.noChanges": "Keine Änderungen zu speichern.",
+  "auth.profile.form.errors.emailRequired": "E-Mail ist erforderlich.",
+  "auth.profile.form.success": "Profil aktualisiert.",
   "auth.users.list.error.load": "Benutzer konnten nicht geladen werden",
   "auth.users.list.error.delete": "Benutzer konnte nicht gelöscht werden",
   "auth.users.flash.created": "Benutzer erstellt",
@@ -95,5 +122,20 @@
   "auth.email.resetPassword.title": "Passwort zurücksetzen",
   "auth.email.resetPassword.body": "Klicken Sie auf den Link unten, um ein neues Passwort festzulegen. Dieser Link läuft in 60 Minuten ab.",
   "auth.email.resetPassword.cta": "Neues Passwort festlegen",
-  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren."
+  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren.",
+  "auth.notifications.passwordReset.requested.title": "Passwort-Zurücksetzung angefordert",
+  "auth.notifications.passwordReset.requested.body": "Ein Link zum Zurücksetzen des Passworts wurde an Ihre E-Mail gesendet",
+  "auth.notifications.passwordReset.completed.title": "Passwort erfolgreich geändert",
+  "auth.notifications.passwordReset.completed.body": "Ihr Passwort wurde erfolgreich aktualisiert",
+  "auth.notifications.account.locked.title": "Konto gesperrt",
+  "auth.notifications.account.locked.body": "Ihr Konto wurde aus Sicherheitsgründen gesperrt. Bitte wenden Sie sich an den Support.",
+  "auth.notifications.login.newDevice.title": "Neues Gerät erkannt",
+  "auth.notifications.login.newDevice.body": "Es wurde eine Anmeldung von einem unbekannten Gerät für Ihr Konto erkannt",
+  "auth.notifications.role.assigned.title": "Neue Rolle zugewiesen",
+  "auth.notifications.role.assigned.body": "Ihnen wurde eine neue Rolle mit zusätzlichen Berechtigungen zugewiesen",
+  "auth.notifications.role.revoked.title": "Rolle entfernt",
+  "auth.notifications.role.revoked.body": "Eine Rolle wurde von Ihrem Konto entfernt",
+  "auth.actions.contactSupport": "Support kontaktieren",
+  "auth.actions.viewSessions": "Sitzungen anzeigen",
+  "auth.actions.viewPermissions": "Berechtigungen anzeigen"
 }

package/src/modules/auth/i18n/en.json

@@ -2,8 +2,20 @@
   "auth.signIn": "Sign in",
   "auth.email": "Email",
   "auth.password": "Password",
+  "auth.password.requirements.help": "Password requirements: {requirements}",
+  "auth.password.requirements.minLength": "At least {min} characters",
+  "auth.password.requirements.digit": "One number",
+  "auth.password.requirements.uppercase": "One uppercase letter",
+  "auth.password.requirements.special": "One special character",
+  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Send reset link",
   "auth.resetPassword": "Reset password",
+  "auth.reset.title": "Set a new password",
+  "auth.reset.subtitle": "Choose a strong password for your account.",
+  "auth.reset.form.password": "New password",
+  "auth.reset.form.loading": "...",
+  "auth.reset.form.submit": "Update password",
+  "auth.reset.errors.failed": "Unable to reset password",
   "auth.usersRoles": "Users & Roles",
   "auth.manageAuthSettings": "Manage authentication settings.",
   "auth.login.errors.permissionDenied": "You do not have permission to access this area. Please contact your administrator.",
@@ -80,6 +92,21 @@
   "auth.users.form.errors.load": "Failed to load user data",
   "auth.users.form.errors.aclUpdate": "Failed to update user access control",
   "auth.users.form.errors.delete": "Failed to delete user",
+  "auth.profile.title": "Profile",
+  "auth.profile.subtitle": "Change password",
+  "auth.profile.form.email": "Email",
+  "auth.profile.form.password": "New password",
+  "auth.profile.form.confirmPassword": "Confirm new password",
+  "auth.profile.form.save": "Save changes",
+  "auth.profile.form.loading": "Loading profile...",
+  "auth.profile.form.errors.load": "Failed to load profile.",
+  "auth.profile.form.errors.save": "Failed to update profile.",
+  "auth.profile.form.errors.invalid": "Invalid profile update.",
+  "auth.profile.form.errors.passwordMismatch": "Passwords do not match.",
+  "auth.profile.form.errors.passwordRequirements": "Password must meet the requirements.",
+  "auth.profile.form.errors.noChanges": "No changes to save.",
+  "auth.profile.form.errors.emailRequired": "Email is required.",
+  "auth.profile.form.success": "Profile updated.",
   "auth.users.list.error.load": "Failed to load users",
   "auth.users.list.error.delete": "Failed to delete user",
   "auth.users.flash.created": "User created",
@@ -95,5 +122,20 @@
   "auth.email.resetPassword.title": "Reset your password",
   "auth.email.resetPassword.body": "Click the link below to set a new password. This link will expire in 60 minutes.",
   "auth.email.resetPassword.cta": "Set a new password",
-  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email."
+  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email.",
+  "auth.notifications.passwordReset.requested.title": "Password reset requested",
+  "auth.notifications.passwordReset.requested.body": "A password reset link has been sent to your email",
+  "auth.notifications.passwordReset.completed.title": "Password successfully changed",
+  "auth.notifications.passwordReset.completed.body": "Your password has been updated successfully",
+  "auth.notifications.account.locked.title": "Account locked",
+  "auth.notifications.account.locked.body": "Your account has been locked due to security reasons. Please contact support.",
+  "auth.notifications.login.newDevice.title": "New device login detected",
+  "auth.notifications.login.newDevice.body": "A new login from an unrecognized device was detected on your account",
+  "auth.notifications.role.assigned.title": "New role assigned",
+  "auth.notifications.role.assigned.body": "You have been assigned a new role with additional permissions",
+  "auth.notifications.role.revoked.title": "Role removed",
+  "auth.notifications.role.revoked.body": "A role has been removed from your account",
+  "auth.actions.contactSupport": "Contact Support",
+  "auth.actions.viewSessions": "View Sessions",
+  "auth.actions.viewPermissions": "View Permissions"
 }

package/src/modules/auth/i18n/es.json

@@ -2,8 +2,20 @@
   "auth.signIn": "Iniciar sesión",
   "auth.email": "Correo electrónico",
   "auth.password": "Contraseña",
+  "auth.password.requirements.help": "Requisitos de la contraseña: {requirements}",
+  "auth.password.requirements.minLength": "Al menos {min} caracteres",
+  "auth.password.requirements.digit": "Un número",
+  "auth.password.requirements.uppercase": "Una letra mayúscula",
+  "auth.password.requirements.special": "Un carácter especial",
+  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Enviar enlace de restablecimiento",
   "auth.resetPassword": "Restablecer contraseña",
+  "auth.reset.title": "Establecer una nueva contraseña",
+  "auth.reset.subtitle": "Elige una contraseña segura para tu cuenta.",
+  "auth.reset.form.password": "Nueva contraseña",
+  "auth.reset.form.loading": "...",
+  "auth.reset.form.submit": "Actualizar contraseña",
+  "auth.reset.errors.failed": "No se pudo restablecer la contraseña",
   "auth.usersRoles": "Usuarios y roles",
   "auth.manageAuthSettings": "Administra la configuración de autenticación.",
   "auth.login.errors.permissionDenied": "No tienes permiso para acceder a esta área. Ponte en contacto con tu administrador.",
@@ -80,6 +92,21 @@
   "auth.users.form.errors.load": "No se pudieron cargar los datos del usuario",
   "auth.users.form.errors.aclUpdate": "No se pudo actualizar el control de acceso del usuario",
   "auth.users.form.errors.delete": "No se pudo eliminar el usuario",
+  "auth.profile.title": "Perfil",
+  "auth.profile.subtitle": "Cambiar contraseña",
+  "auth.profile.form.email": "Correo electrónico",
+  "auth.profile.form.password": "Nueva contraseña",
+  "auth.profile.form.confirmPassword": "Confirmar nueva contraseña",
+  "auth.profile.form.save": "Guardar cambios",
+  "auth.profile.form.loading": "Cargando perfil...",
+  "auth.profile.form.errors.load": "No se pudo cargar el perfil.",
+  "auth.profile.form.errors.save": "No se pudo actualizar el perfil.",
+  "auth.profile.form.errors.invalid": "Actualización de perfil inválida.",
+  "auth.profile.form.errors.passwordMismatch": "Las contraseñas no coinciden.",
+  "auth.profile.form.errors.passwordRequirements": "La contraseña debe cumplir los requisitos.",
+  "auth.profile.form.errors.noChanges": "No hay cambios para guardar.",
+  "auth.profile.form.errors.emailRequired": "El correo electrónico es obligatorio.",
+  "auth.profile.form.success": "Perfil actualizado.",
   "auth.users.list.error.load": "No se pudieron cargar los usuarios",
   "auth.users.list.error.delete": "No se pudo eliminar el usuario",
   "auth.users.flash.created": "Usuario creado",
@@ -95,5 +122,20 @@
   "auth.email.resetPassword.title": "Restablecer tu contraseña",
   "auth.email.resetPassword.body": "Haz clic en el siguiente enlace para establecer una nueva contraseña. Este enlace caducará en 60 minutos.",
   "auth.email.resetPassword.cta": "Establecer nueva contraseña",
-  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura."
+  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura.",
+  "auth.notifications.passwordReset.requested.title": "Solicitud de restablecimiento de contraseña",
+  "auth.notifications.passwordReset.requested.body": "Se ha enviado un enlace de restablecimiento de contraseña a tu correo electrónico",
+  "auth.notifications.passwordReset.completed.title": "Contraseña cambiada correctamente",
+  "auth.notifications.passwordReset.completed.body": "Tu contraseña se actualizó correctamente",
+  "auth.notifications.account.locked.title": "Cuenta bloqueada",
+  "auth.notifications.account.locked.body": "Tu cuenta ha sido bloqueada por razones de seguridad. Ponte en contacto con soporte.",
+  "auth.notifications.login.newDevice.title": "Nuevo inicio de sesión detectado",
+  "auth.notifications.login.newDevice.body": "Se detectó un inicio de sesión desde un dispositivo no reconocido en tu cuenta",
+  "auth.notifications.role.assigned.title": "Nuevo rol asignado",
+  "auth.notifications.role.assigned.body": "Se te ha asignado un nuevo rol con permisos adicionales",
+  "auth.notifications.role.revoked.title": "Rol eliminado",
+  "auth.notifications.role.revoked.body": "Se ha eliminado un rol de tu cuenta",
+  "auth.actions.contactSupport": "Contactar soporte",
+  "auth.actions.viewSessions": "Ver sesiones",
+  "auth.actions.viewPermissions": "Ver permisos"
 }

package/src/modules/auth/i18n/pl.json

@@ -2,8 +2,20 @@
   "auth.signIn": "Zaloguj się",
   "auth.email": "Email",
   "auth.password": "Hasło",
+  "auth.password.requirements.help": "Wymagania hasła: {requirements}",
+  "auth.password.requirements.minLength": "Co najmniej {min} znaków",
+  "auth.password.requirements.digit": "Jedna cyfra",
+  "auth.password.requirements.uppercase": "Jedna wielka litera",
+  "auth.password.requirements.special": "Jeden znak specjalny",
+  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Wyślij link resetujący",
   "auth.resetPassword": "Resetuj hasło",
+  "auth.reset.title": "Ustaw nowe hasło",
+  "auth.reset.subtitle": "Wybierz silne hasło dla swojego konta.",
+  "auth.reset.form.password": "Nowe hasło",
+  "auth.reset.form.loading": "...",
+  "auth.reset.form.submit": "Zaktualizuj hasło",
+  "auth.reset.errors.failed": "Nie udało się zresetować hasła",
   "auth.usersRoles": "Użytkownicy i role",
   "auth.manageAuthSettings": "Zarządzaj ustawieniami uwierzytelniania.",
   "auth.login.errors.permissionDenied": "Nie masz uprawnień do tego obszaru. Skontaktuj się z administratorem.",
@@ -80,6 +92,21 @@
   "auth.users.form.errors.load": "Nie udało się wczytać danych użytkownika",
   "auth.users.form.errors.aclUpdate": "Nie udało się zaktualizować uprawnień użytkownika",
   "auth.users.form.errors.delete": "Nie udało się usunąć użytkownika",
+  "auth.profile.title": "Profil",
+  "auth.profile.subtitle": "Zmiana hasła",
+  "auth.profile.form.email": "Email",
+  "auth.profile.form.password": "Nowe hasło",
+  "auth.profile.form.confirmPassword": "Potwierdź nowe hasło",
+  "auth.profile.form.save": "Zapisz zmiany",
+  "auth.profile.form.loading": "Ładowanie profilu...",
+  "auth.profile.form.errors.load": "Nie udało się wczytać profilu.",
+  "auth.profile.form.errors.save": "Nie udało się zaktualizować profilu.",
+  "auth.profile.form.errors.invalid": "Nieprawidłowa aktualizacja profilu.",
+  "auth.profile.form.errors.passwordMismatch": "Hasła nie są zgodne.",
+  "auth.profile.form.errors.passwordRequirements": "Hasło musi spełniać wymagania.",
+  "auth.profile.form.errors.noChanges": "Brak zmian do zapisania.",
+  "auth.profile.form.errors.emailRequired": "Email jest wymagany.",
+  "auth.profile.form.success": "Profil zaktualizowany.",
   "auth.users.list.error.load": "Nie udało się wczytać użytkowników",
   "auth.users.list.error.delete": "Nie udało się usunąć użytkownika",
   "auth.users.flash.created": "Użytkownik utworzony",
@@ -95,5 +122,20 @@
   "auth.email.resetPassword.title": "Zresetuj swoje hasło",
   "auth.email.resetPassword.body": "Kliknij poniższy link, aby ustawić nowe hasło. Link wygaśnie za 60 minut.",
   "auth.email.resetPassword.cta": "Ustaw nowe hasło",
-  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować."
+  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować.",
+  "auth.notifications.passwordReset.requested.title": "Żądanie resetu hasła",
+  "auth.notifications.passwordReset.requested.body": "Link do resetu hasła został wysłany na Twój adres e-mail",
+  "auth.notifications.passwordReset.completed.title": "Hasło zmienione pomyślnie",
+  "auth.notifications.passwordReset.completed.body": "Twoje hasło zostało pomyślnie zaktualizowane",
+  "auth.notifications.account.locked.title": "Konto zablokowane",
+  "auth.notifications.account.locked.body": "Twoje konto zostało zablokowane z powodów bezpieczeństwa. Skontaktuj się z pomocą techniczną.",
+  "auth.notifications.login.newDevice.title": "Wykryto logowanie z nowego urządzenia",
+  "auth.notifications.login.newDevice.body": "Wykryto logowanie z nieznanego urządzenia na Twoim koncie",
+  "auth.notifications.role.assigned.title": "Przypisano nową rolę",
+  "auth.notifications.role.assigned.body": "Przypisano Ci nową rolę z dodatkowymi uprawnieniami",
+  "auth.notifications.role.revoked.title": "Rola usunięta",
+  "auth.notifications.role.revoked.body": "Z Twojego konta usunięto rolę",
+  "auth.actions.contactSupport": "Skontaktuj się z pomocą",
+  "auth.actions.viewSessions": "Zobacz sesje",
+  "auth.actions.viewPermissions": "Zobacz uprawnienia"
 }

package/src/modules/auth/lib/setup-app.ts

@@ -394,7 +394,9 @@ async function ensureDefaultRoleAcls(
       'example.*',
       'dashboards.*',
       'dashboards.admin.assign-widgets',
+      'analytics.view',
       'api_keys.*',
+      'notifications.manage',
       'perspectives.use',
       'perspectives.role_defaults',
       'business_rules.*',
@@ -424,6 +426,7 @@ async function ensureDefaultRoleAcls(
       'example.widgets.*',
       'dashboards.view',
       'dashboards.configure',
+      'analytics.view',
       'audit_logs.undo_self',
       'perspectives.use',
       'staff.leave_requests.send',

package/src/modules/auth/notifications.ts

@@ -0,0 +1,109 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'auth.password_reset.requested',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.requested.title',
+    bodyKey: 'auth.notifications.passwordReset.requested.body',
+    icon: 'key',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 24,
+  },
+  {
+    type: 'auth.password_reset.completed',
+    module: 'auth',
+    titleKey: 'auth.notifications.passwordReset.completed.title',
+    bodyKey: 'auth.notifications.passwordReset.completed.body',
+    icon: 'check-circle',
+    severity: 'success',
+    actions: [],
+    expiresAfterHours: 72,
+  },
+  {
+    type: 'auth.account.locked',
+    module: 'auth',
+    titleKey: 'auth.notifications.account.locked.title',
+    bodyKey: 'auth.notifications.account.locked.body',
+    icon: 'lock',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'contact_support',
+        labelKey: 'auth.actions.contactSupport',
+        variant: 'default',
+        href: '/backend/support',
+        icon: 'mail',
+      },
+    ],
+    linkHref: '/backend/support',
+  },
+  {
+    type: 'auth.login.new_device',
+    module: 'auth',
+    titleKey: 'auth.notifications.login.newDevice.title',
+    bodyKey: 'auth.notifications.login.newDevice.body',
+    icon: 'smartphone',
+    severity: 'info',
+    actions: [
+      {
+        id: 'view_sessions',
+        labelKey: 'auth.actions.viewSessions',
+        variant: 'outline',
+        href: '/backend/auth/sessions',
+        icon: 'list',
+      },
+    ],
+    linkHref: '/backend/auth/sessions',
+    expiresAfterHours: 168, // 7 days
+  },
+  {
+    type: 'auth.role.assigned',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.assigned.title',
+    bodyKey: 'auth.notifications.role.assigned.body',
+    icon: 'user-plus',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view_permissions',
+        labelKey: 'auth.actions.viewPermissions',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+        icon: 'shield',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'auth.role.revoked',
+    module: 'auth',
+    titleKey: 'auth.notifications.role.revoked.title',
+    bodyKey: 'auth.notifications.role.revoked.body',
+    icon: 'user-minus',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view_profile',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/auth/profile',
+      },
+    ],
+    linkHref: '/backend/auth/profile',
+    expiresAfterHours: 168,
+  },
+]
+
+export default notificationTypes

package/src/modules/auth/services/authService.ts

@@ -75,15 +75,15 @@ export class AuthService {
     return { user, token }
   }
 
-  async confirmPasswordReset(token: string, newPassword: string) {
+  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
     const now = new Date()
     const row = await this.em.findOne(PasswordReset, { token })
-    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return false
+    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
     const user = await this.em.findOne(User, { id: row.user.id })
-    if (!user) return false
+    if (!user) return null
     user.passwordHash = await hash(newPassword, 10)
     row.usedAt = new Date()
     await this.em.flush()
-    return true
+    return user
   }
 }

package/src/modules/business_rules/backend/rules/page.tsx

@@ -264,14 +264,17 @@ export default function RulesListPage() {
         <RowActions
           items={[
             {
+              id: 'edit',
               label: t('common.edit'),
               href: `/backend/rules/${row.original.id}`,
             },
             {
+              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
+              id: 'duplicate',
               label: t('common.duplicate'),
               onSelect: () => {
                 // TODO: Implement duplicate functionality in Step 5.2
@@ -279,6 +282,7 @@ export default function RulesListPage() {
               },
             },
             {
+              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.ruleName),
               destructive: true,

package/src/modules/business_rules/backend/sets/page.tsx

@@ -196,14 +196,17 @@ export default function RuleSetsListPage() {
         <RowActions
           items={[
             {
+              id: 'edit',
               label: t('common.edit'),
               href: `/backend/sets/${row.original.id}`,
             },
             {
+              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
+              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.setName),
               destructive: true,

package/src/modules/business_rules/i18n/en.json

@@ -367,5 +367,7 @@
   "business_rules.components.conditionRow.field.comparisonPlaceholder": "e.g., user.role",
   "business_rules.components.conditionRow.value.help": "Use JSON for arrays: [\"a\",\"b\"]",
   "business_rules.components.conditionRow.field.comparisonHelp": "Field path to compare with",
-  "business_rules.components.conditionRow.deleteCondition": "Delete condition"
+  "business_rules.components.conditionRow.deleteCondition": "Delete condition",
+  "businessRules.notifications.rule.executionFailed.title": "Business Rule Failed",
+  "businessRules.notifications.rule.executionFailed.body": "Rule \"{ruleName}\" failed to execute{entityType, select, other { on {entityType}}}: {errorMessage}"
 }

package/src/modules/business_rules/notifications.ts

@@ -0,0 +1,25 @@
+import type { NotificationTypeDefinition } from '@open-mercato/shared/modules/notifications/types'
+
+export const notificationTypes: NotificationTypeDefinition[] = [
+  {
+    type: 'business_rules.rule.execution_failed',
+    module: 'business_rules',
+    titleKey: 'businessRules.notifications.rule.executionFailed.title',
+    bodyKey: 'businessRules.notifications.rule.executionFailed.body',
+    icon: 'alert-triangle',
+    severity: 'error',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/business-rules/{sourceEntityId}',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/business-rules/{sourceEntityId}',
+    expiresAfterHours: 168, // 7 days
+  },
+]
+
+export default notificationTypes

package/src/modules/business_rules/subscribers/rule-execution-failed-notification.ts

@@ -0,0 +1,50 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { resolveNotificationService } from '../../notifications/lib/notificationService'
+import { buildFeatureNotificationFromType } from '../../notifications/lib/notificationBuilder'
+import { notificationTypes } from '../notifications'
+
+export const metadata = {
+  event: 'business_rules.rule.execution_failed',
+  persistent: true,
+  id: 'business_rules:rule-execution-failed-notification',
+}
+
+type RuleExecutionFailedPayload = {
+  ruleId: string
+  ruleName: string
+  entityType?: string | null
+  errorMessage?: string | null
+  tenantId: string
+  organizationId?: string | null
+}
+
+type ResolverContext = {
+  resolve: <T = unknown>(name: string) => T
+}
+
+export default async function handle(payload: RuleExecutionFailedPayload, ctx: ResolverContext) {
+  try {
+    const notificationService = resolveNotificationService(ctx)
+    const typeDef = notificationTypes.find((type) => type.type === 'business_rules.rule.execution_failed')
+    if (!typeDef) return
+
+    const notificationInput = buildFeatureNotificationFromType(typeDef, {
+      requiredFeature: 'business_rules.manage',
+      bodyVariables: {
+        ruleName: payload.ruleName,
+        entityType: payload.entityType ?? '',
+        errorMessage: payload.errorMessage ?? 'Unknown error',
+      },
+      sourceEntityType: 'business_rules:rule',
+      sourceEntityId: payload.ruleId,
+      linkHref: `/backend/business-rules/${payload.ruleId}`,
+    })
+
+    await notificationService.createForFeature(notificationInput, {
+      tenantId: payload.tenantId,
+      organizationId: payload.organizationId ?? null,
+    })
+  } catch (err) {
+    console.error('[business_rules:rule-execution-failed-notification] Failed to create notification:', err)
+  }
+}

package/src/modules/catalog/analytics.ts

@@ -0,0 +1,24 @@
+import type { AnalyticsModuleConfig } from '@open-mercato/shared/modules/analytics'
+
+export const analyticsConfig: AnalyticsModuleConfig = {
+  entities: [
+    {
+      entityId: 'catalog:products',
+      requiredFeatures: ['catalog.view'],
+      entityConfig: {
+        tableName: 'catalog_products',
+        dateField: 'created_at',
+        defaultScopeFields: ['tenant_id', 'organization_id'],
+      },
+      fieldMappings: {
+        id: { dbColumn: 'id', type: 'uuid' },
+        name: { dbColumn: 'name', type: 'text' },
+        status: { dbColumn: 'status', type: 'text' },
+        createdAt: { dbColumn: 'created_at', type: 'timestamp' },
+      },
+    },
+  ],
+}
+
+export default analyticsConfig
+export const config = analyticsConfig