@open-mercato/core 0.4.2-canary-3b5064ce72 → 0.4.2-canary-15e78de280

package/src/modules/auth/i18n/de.json

@@ -2,26 +2,12 @@
   "auth.signIn": "Anmelden",
   "auth.email": "E-Mail",
   "auth.password": "Passwort",
-  "auth.password.requirements.help": "Passwortanforderungen: {requirements}",
-  "auth.password.requirements.minLength": "Mindestens {min} Zeichen",
-  "auth.password.requirements.digit": "Eine Zahl",
-  "auth.password.requirements.uppercase": "Ein Großbuchstabe",
-  "auth.password.requirements.special": "Ein Sonderzeichen",
-  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Link zum Zurücksetzen senden",
   "auth.resetPassword": "Passwort zurücksetzen",
-  "auth.reset.title": "Neues Passwort festlegen",
-  "auth.reset.subtitle": "Wähle ein sicheres Passwort für dein Konto.",
-  "auth.reset.form.password": "Neues Passwort",
-  "auth.reset.form.loading": "...",
-  "auth.reset.form.submit": "Passwort aktualisieren",
-  "auth.reset.errors.failed": "Passwort konnte nicht zurückgesetzt werden",
   "auth.usersRoles": "Benutzer und Rollen",
   "auth.manageAuthSettings": "Verwalte die Authentifizierungseinstellungen.",
   "auth.login.errors.permissionDenied": "Du hast keine Berechtigung, auf diesen Bereich zuzugreifen. Bitte wende dich an deine Administration.",
   "auth.login.errors.invalidCredentials": "Ungültige E-Mail oder ungültiges Passwort",
-  "auth.login.errors.tenantRequired": "Nutze den Login-Link aus deiner Tenant-Aktivierung, um fortzufahren.",
-  "auth.login.errors.tenantInvalid": "Tenant nicht gefunden. Entferne die Tenant-Auswahl und versuche es erneut.",
   "auth.login.errors.generic": "Es ist ein Fehler aufgetreten. Bitte versuche es erneut.",
   "auth.login.logoAlt": "Open Mercato Logo",
   "auth.login.brandName": "Open Mercato",
@@ -29,9 +15,6 @@
   "auth.login.requireRoleMessage": "Für den Zugriff ist die folgende Rolle erforderlich: {roles}",
   "auth.login.requireRolesMessage": "Für den Zugriff ist eine der folgenden Rollen erforderlich: {roles}",
   "auth.login.featureDenied": "Du hast keinen Zugriff auf diese Funktion ({feature}). Bitte wende dich an deine Administration.",
-  "auth.login.tenantBanner": "Du meldest dich beim Tenant {tenant} an.",
-  "auth.login.tenantLoading": "Tenant-Daten werden geladen...",
-  "auth.login.tenantClear": "Zurücksetzen",
   "auth.login.rememberMe": "Angemeldet bleiben",
   "auth.login.loading": "Wird geladen ...",
   "auth.login.forgotPassword": "Passwort vergessen?",
@@ -97,21 +80,6 @@
   "auth.users.form.errors.load": "Benutzerdaten konnten nicht geladen werden",
   "auth.users.form.errors.aclUpdate": "Aktualisierung der Benutzerberechtigungen fehlgeschlagen",
   "auth.users.form.errors.delete": "Benutzer konnte nicht gelöscht werden",
-  "auth.profile.title": "Profil",
-  "auth.profile.subtitle": "Passwort ändern",
-  "auth.profile.form.email": "E-Mail",
-  "auth.profile.form.password": "Neues Passwort",
-  "auth.profile.form.confirmPassword": "Neues Passwort bestätigen",
-  "auth.profile.form.save": "Änderungen speichern",
-  "auth.profile.form.loading": "Profil wird geladen...",
-  "auth.profile.form.errors.load": "Profil konnte nicht geladen werden.",
-  "auth.profile.form.errors.save": "Profil konnte nicht aktualisiert werden.",
-  "auth.profile.form.errors.invalid": "Ungültige Profilaktualisierung.",
-  "auth.profile.form.errors.passwordMismatch": "Die Passwörter stimmen nicht überein.",
-  "auth.profile.form.errors.passwordRequirements": "Das Passwort muss die Anforderungen erfüllen.",
-  "auth.profile.form.errors.noChanges": "Keine Änderungen zu speichern.",
-  "auth.profile.form.errors.emailRequired": "E-Mail ist erforderlich.",
-  "auth.profile.form.success": "Profil aktualisiert.",
   "auth.users.list.error.load": "Benutzer konnten nicht geladen werden",
   "auth.users.list.error.delete": "Benutzer konnte nicht gelöscht werden",
   "auth.users.flash.created": "Benutzer erstellt",
@@ -127,20 +95,5 @@
   "auth.email.resetPassword.title": "Passwort zurücksetzen",
   "auth.email.resetPassword.body": "Klicken Sie auf den Link unten, um ein neues Passwort festzulegen. Dieser Link läuft in 60 Minuten ab.",
   "auth.email.resetPassword.cta": "Neues Passwort festlegen",
-  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren.",
-  "auth.notifications.passwordReset.requested.title": "Passwort-Zurücksetzung angefordert",
-  "auth.notifications.passwordReset.requested.body": "Ein Link zum Zurücksetzen des Passworts wurde an Ihre E-Mail gesendet",
-  "auth.notifications.passwordReset.completed.title": "Passwort erfolgreich geändert",
-  "auth.notifications.passwordReset.completed.body": "Ihr Passwort wurde erfolgreich aktualisiert",
-  "auth.notifications.account.locked.title": "Konto gesperrt",
-  "auth.notifications.account.locked.body": "Ihr Konto wurde aus Sicherheitsgründen gesperrt. Bitte wenden Sie sich an den Support.",
-  "auth.notifications.login.newDevice.title": "Neues Gerät erkannt",
-  "auth.notifications.login.newDevice.body": "Es wurde eine Anmeldung von einem unbekannten Gerät für Ihr Konto erkannt",
-  "auth.notifications.role.assigned.title": "Neue Rolle zugewiesen",
-  "auth.notifications.role.assigned.body": "Ihnen wurde eine neue Rolle mit zusätzlichen Berechtigungen zugewiesen",
-  "auth.notifications.role.revoked.title": "Rolle entfernt",
-  "auth.notifications.role.revoked.body": "Eine Rolle wurde von Ihrem Konto entfernt",
-  "auth.actions.contactSupport": "Support kontaktieren",
-  "auth.actions.viewSessions": "Sitzungen anzeigen",
-  "auth.actions.viewPermissions": "Berechtigungen anzeigen"
+  "auth.email.resetPassword.hint": "Wenn Sie dies nicht angefordert haben, können Sie diese E-Mail ignorieren."
 }

package/src/modules/auth/i18n/en.json

@@ -2,26 +2,12 @@
   "auth.signIn": "Sign in",
   "auth.email": "Email",
   "auth.password": "Password",
-  "auth.password.requirements.help": "Password requirements: {requirements}",
-  "auth.password.requirements.minLength": "At least {min} characters",
-  "auth.password.requirements.digit": "One number",
-  "auth.password.requirements.uppercase": "One uppercase letter",
-  "auth.password.requirements.special": "One special character",
-  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Send reset link",
   "auth.resetPassword": "Reset password",
-  "auth.reset.title": "Set a new password",
-  "auth.reset.subtitle": "Choose a strong password for your account.",
-  "auth.reset.form.password": "New password",
-  "auth.reset.form.loading": "...",
-  "auth.reset.form.submit": "Update password",
-  "auth.reset.errors.failed": "Unable to reset password",
   "auth.usersRoles": "Users & Roles",
   "auth.manageAuthSettings": "Manage authentication settings.",
   "auth.login.errors.permissionDenied": "You do not have permission to access this area. Please contact your administrator.",
   "auth.login.errors.invalidCredentials": "Invalid email or password",
-  "auth.login.errors.tenantRequired": "Use the login link provided with your tenant activation to continue.",
-  "auth.login.errors.tenantInvalid": "Tenant not found. Clear the tenant selection and try again.",
   "auth.login.errors.generic": "An error occurred. Please try again.",
   "auth.login.logoAlt": "Open Mercato logo",
   "auth.login.brandName": "Open Mercato",
@@ -29,9 +15,6 @@
   "auth.login.requireRoleMessage": "Access requires role: {roles}",
   "auth.login.requireRolesMessage": "Access requires one of the following roles: {roles}",
   "auth.login.featureDenied": "You don't have access to this feature ({feature}). Please contact your administrator.",
-  "auth.login.tenantBanner": "You're logging in to {tenant} tenant.",
-  "auth.login.tenantLoading": "Loading tenant details...",
-  "auth.login.tenantClear": "Clear",
   "auth.login.rememberMe": "Remember me",
   "auth.login.loading": "Loading...",
   "auth.login.forgotPassword": "Forgot password?",
@@ -97,21 +80,6 @@
   "auth.users.form.errors.load": "Failed to load user data",
   "auth.users.form.errors.aclUpdate": "Failed to update user access control",
   "auth.users.form.errors.delete": "Failed to delete user",
-  "auth.profile.title": "Profile",
-  "auth.profile.subtitle": "Change password",
-  "auth.profile.form.email": "Email",
-  "auth.profile.form.password": "New password",
-  "auth.profile.form.confirmPassword": "Confirm new password",
-  "auth.profile.form.save": "Save changes",
-  "auth.profile.form.loading": "Loading profile...",
-  "auth.profile.form.errors.load": "Failed to load profile.",
-  "auth.profile.form.errors.save": "Failed to update profile.",
-  "auth.profile.form.errors.invalid": "Invalid profile update.",
-  "auth.profile.form.errors.passwordMismatch": "Passwords do not match.",
-  "auth.profile.form.errors.passwordRequirements": "Password must meet the requirements.",
-  "auth.profile.form.errors.noChanges": "No changes to save.",
-  "auth.profile.form.errors.emailRequired": "Email is required.",
-  "auth.profile.form.success": "Profile updated.",
   "auth.users.list.error.load": "Failed to load users",
   "auth.users.list.error.delete": "Failed to delete user",
   "auth.users.flash.created": "User created",
@@ -127,20 +95,5 @@
   "auth.email.resetPassword.title": "Reset your password",
   "auth.email.resetPassword.body": "Click the link below to set a new password. This link will expire in 60 minutes.",
   "auth.email.resetPassword.cta": "Set a new password",
-  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email.",
-  "auth.notifications.passwordReset.requested.title": "Password reset requested",
-  "auth.notifications.passwordReset.requested.body": "A password reset link has been sent to your email",
-  "auth.notifications.passwordReset.completed.title": "Password successfully changed",
-  "auth.notifications.passwordReset.completed.body": "Your password has been updated successfully",
-  "auth.notifications.account.locked.title": "Account locked",
-  "auth.notifications.account.locked.body": "Your account has been locked due to security reasons. Please contact support.",
-  "auth.notifications.login.newDevice.title": "New device login detected",
-  "auth.notifications.login.newDevice.body": "A new login from an unrecognized device was detected on your account",
-  "auth.notifications.role.assigned.title": "New role assigned",
-  "auth.notifications.role.assigned.body": "You have been assigned a new role with additional permissions",
-  "auth.notifications.role.revoked.title": "Role removed",
-  "auth.notifications.role.revoked.body": "A role has been removed from your account",
-  "auth.actions.contactSupport": "Contact Support",
-  "auth.actions.viewSessions": "View Sessions",
-  "auth.actions.viewPermissions": "View Permissions"
+  "auth.email.resetPassword.hint": "If you didn't request this, you can safely ignore this email."
 }

package/src/modules/auth/i18n/es.json

@@ -2,26 +2,12 @@
   "auth.signIn": "Iniciar sesión",
   "auth.email": "Correo electrónico",
   "auth.password": "Contraseña",
-  "auth.password.requirements.help": "Requisitos de la contraseña: {requirements}",
-  "auth.password.requirements.minLength": "Al menos {min} caracteres",
-  "auth.password.requirements.digit": "Un número",
-  "auth.password.requirements.uppercase": "Una letra mayúscula",
-  "auth.password.requirements.special": "Un carácter especial",
-  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Enviar enlace de restablecimiento",
   "auth.resetPassword": "Restablecer contraseña",
-  "auth.reset.title": "Establecer una nueva contraseña",
-  "auth.reset.subtitle": "Elige una contraseña segura para tu cuenta.",
-  "auth.reset.form.password": "Nueva contraseña",
-  "auth.reset.form.loading": "...",
-  "auth.reset.form.submit": "Actualizar contraseña",
-  "auth.reset.errors.failed": "No se pudo restablecer la contraseña",
   "auth.usersRoles": "Usuarios y roles",
   "auth.manageAuthSettings": "Administra la configuración de autenticación.",
   "auth.login.errors.permissionDenied": "No tienes permiso para acceder a esta área. Ponte en contacto con tu administrador.",
   "auth.login.errors.invalidCredentials": "Correo electrónico o contraseña no válidos",
-  "auth.login.errors.tenantRequired": "Usa el enlace de inicio de sesión proporcionado con la activación de tu inquilino para continuar.",
-  "auth.login.errors.tenantInvalid": "No se encontró el inquilino. Borra la selección e inténtalo de nuevo.",
   "auth.login.errors.generic": "Se produjo un error. Inténtalo de nuevo.",
   "auth.login.logoAlt": "Logotipo de Open Mercato",
   "auth.login.brandName": "Open Mercato",
@@ -29,9 +15,6 @@
   "auth.login.requireRoleMessage": "El acceso requiere el rol: {roles}",
   "auth.login.requireRolesMessage": "El acceso requiere uno de los siguientes roles: {roles}",
   "auth.login.featureDenied": "No tienes acceso a esta funcionalidad ({feature}). Ponte en contacto con tu administrador.",
-  "auth.login.tenantBanner": "Estás iniciando sesión en el inquilino {tenant}.",
-  "auth.login.tenantLoading": "Cargando detalles del inquilino...",
-  "auth.login.tenantClear": "Borrar",
   "auth.login.rememberMe": "Recordarme",
   "auth.login.loading": "Cargando...",
   "auth.login.forgotPassword": "¿Olvidaste tu contraseña?",
@@ -97,21 +80,6 @@
   "auth.users.form.errors.load": "No se pudieron cargar los datos del usuario",
   "auth.users.form.errors.aclUpdate": "No se pudo actualizar el control de acceso del usuario",
   "auth.users.form.errors.delete": "No se pudo eliminar el usuario",
-  "auth.profile.title": "Perfil",
-  "auth.profile.subtitle": "Cambiar contraseña",
-  "auth.profile.form.email": "Correo electrónico",
-  "auth.profile.form.password": "Nueva contraseña",
-  "auth.profile.form.confirmPassword": "Confirmar nueva contraseña",
-  "auth.profile.form.save": "Guardar cambios",
-  "auth.profile.form.loading": "Cargando perfil...",
-  "auth.profile.form.errors.load": "No se pudo cargar el perfil.",
-  "auth.profile.form.errors.save": "No se pudo actualizar el perfil.",
-  "auth.profile.form.errors.invalid": "Actualización de perfil inválida.",
-  "auth.profile.form.errors.passwordMismatch": "Las contraseñas no coinciden.",
-  "auth.profile.form.errors.passwordRequirements": "La contraseña debe cumplir los requisitos.",
-  "auth.profile.form.errors.noChanges": "No hay cambios para guardar.",
-  "auth.profile.form.errors.emailRequired": "El correo electrónico es obligatorio.",
-  "auth.profile.form.success": "Perfil actualizado.",
   "auth.users.list.error.load": "No se pudieron cargar los usuarios",
   "auth.users.list.error.delete": "No se pudo eliminar el usuario",
   "auth.users.flash.created": "Usuario creado",
@@ -127,20 +95,5 @@
   "auth.email.resetPassword.title": "Restablecer tu contraseña",
   "auth.email.resetPassword.body": "Haz clic en el siguiente enlace para establecer una nueva contraseña. Este enlace caducará en 60 minutos.",
   "auth.email.resetPassword.cta": "Establecer nueva contraseña",
-  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura.",
-  "auth.notifications.passwordReset.requested.title": "Solicitud de restablecimiento de contraseña",
-  "auth.notifications.passwordReset.requested.body": "Se ha enviado un enlace de restablecimiento de contraseña a tu correo electrónico",
-  "auth.notifications.passwordReset.completed.title": "Contraseña cambiada correctamente",
-  "auth.notifications.passwordReset.completed.body": "Tu contraseña se actualizó correctamente",
-  "auth.notifications.account.locked.title": "Cuenta bloqueada",
-  "auth.notifications.account.locked.body": "Tu cuenta ha sido bloqueada por razones de seguridad. Ponte en contacto con soporte.",
-  "auth.notifications.login.newDevice.title": "Nuevo inicio de sesión detectado",
-  "auth.notifications.login.newDevice.body": "Se detectó un inicio de sesión desde un dispositivo no reconocido en tu cuenta",
-  "auth.notifications.role.assigned.title": "Nuevo rol asignado",
-  "auth.notifications.role.assigned.body": "Se te ha asignado un nuevo rol con permisos adicionales",
-  "auth.notifications.role.revoked.title": "Rol eliminado",
-  "auth.notifications.role.revoked.body": "Se ha eliminado un rol de tu cuenta",
-  "auth.actions.contactSupport": "Contactar soporte",
-  "auth.actions.viewSessions": "Ver sesiones",
-  "auth.actions.viewPermissions": "Ver permisos"
+  "auth.email.resetPassword.hint": "Si no solicitaste esto, puedes ignorar este correo de forma segura."
 }

package/src/modules/auth/i18n/pl.json

@@ -2,26 +2,12 @@
   "auth.signIn": "Zaloguj się",
   "auth.email": "Email",
   "auth.password": "Hasło",
-  "auth.password.requirements.help": "Wymagania hasła: {requirements}",
-  "auth.password.requirements.minLength": "Co najmniej {min} znaków",
-  "auth.password.requirements.digit": "Jedna cyfra",
-  "auth.password.requirements.uppercase": "Jedna wielka litera",
-  "auth.password.requirements.special": "Jeden znak specjalny",
-  "auth.password.requirements.separator": ", ",
   "auth.sendResetLink": "Wyślij link resetujący",
   "auth.resetPassword": "Resetuj hasło",
-  "auth.reset.title": "Ustaw nowe hasło",
-  "auth.reset.subtitle": "Wybierz silne hasło dla swojego konta.",
-  "auth.reset.form.password": "Nowe hasło",
-  "auth.reset.form.loading": "...",
-  "auth.reset.form.submit": "Zaktualizuj hasło",
-  "auth.reset.errors.failed": "Nie udało się zresetować hasła",
   "auth.usersRoles": "Użytkownicy i role",
   "auth.manageAuthSettings": "Zarządzaj ustawieniami uwierzytelniania.",
   "auth.login.errors.permissionDenied": "Nie masz uprawnień do tego obszaru. Skontaktuj się z administratorem.",
   "auth.login.errors.invalidCredentials": "Nieprawidłowy email lub hasło",
-  "auth.login.errors.tenantRequired": "Użyj linku logowania z aktywacji najemcy, aby kontynuować.",
-  "auth.login.errors.tenantInvalid": "Nie znaleziono najemcy. Wyczyść wybór i spróbuj ponownie.",
   "auth.login.errors.generic": "Wystąpił błąd. Spróbuj ponownie.",
   "auth.login.logoAlt": "Logo Open Mercato",
   "auth.login.brandName": "Open Mercato",
@@ -29,9 +15,6 @@
   "auth.login.requireRoleMessage": "Dostęp wymaga roli: {roles}",
   "auth.login.requireRolesMessage": "Dostęp wymaga jednej z następujących ról: {roles}",
   "auth.login.featureDenied": "Nie masz dostępu do tej funkcji ({feature}). Skontaktuj się z administratorem.",
-  "auth.login.tenantBanner": "Logujesz się do najemcy {tenant}.",
-  "auth.login.tenantLoading": "Ładowanie szczegółów najemcy...",
-  "auth.login.tenantClear": "Wyczyść",
   "auth.login.rememberMe": "Zapamiętaj mnie",
   "auth.login.loading": "Ładowanie...",
   "auth.login.forgotPassword": "Nie pamiętasz hasła?",
@@ -97,21 +80,6 @@
   "auth.users.form.errors.load": "Nie udało się wczytać danych użytkownika",
   "auth.users.form.errors.aclUpdate": "Nie udało się zaktualizować uprawnień użytkownika",
   "auth.users.form.errors.delete": "Nie udało się usunąć użytkownika",
-  "auth.profile.title": "Profil",
-  "auth.profile.subtitle": "Zmiana hasła",
-  "auth.profile.form.email": "Email",
-  "auth.profile.form.password": "Nowe hasło",
-  "auth.profile.form.confirmPassword": "Potwierdź nowe hasło",
-  "auth.profile.form.save": "Zapisz zmiany",
-  "auth.profile.form.loading": "Ładowanie profilu...",
-  "auth.profile.form.errors.load": "Nie udało się wczytać profilu.",
-  "auth.profile.form.errors.save": "Nie udało się zaktualizować profilu.",
-  "auth.profile.form.errors.invalid": "Nieprawidłowa aktualizacja profilu.",
-  "auth.profile.form.errors.passwordMismatch": "Hasła nie są zgodne.",
-  "auth.profile.form.errors.passwordRequirements": "Hasło musi spełniać wymagania.",
-  "auth.profile.form.errors.noChanges": "Brak zmian do zapisania.",
-  "auth.profile.form.errors.emailRequired": "Email jest wymagany.",
-  "auth.profile.form.success": "Profil zaktualizowany.",
   "auth.users.list.error.load": "Nie udało się wczytać użytkowników",
   "auth.users.list.error.delete": "Nie udało się usunąć użytkownika",
   "auth.users.flash.created": "Użytkownik utworzony",
@@ -127,20 +95,5 @@
   "auth.email.resetPassword.title": "Zresetuj swoje hasło",
   "auth.email.resetPassword.body": "Kliknij poniższy link, aby ustawić nowe hasło. Link wygaśnie za 60 minut.",
   "auth.email.resetPassword.cta": "Ustaw nowe hasło",
-  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować.",
-  "auth.notifications.passwordReset.requested.title": "Żądanie resetu hasła",
-  "auth.notifications.passwordReset.requested.body": "Link do resetu hasła został wysłany na Twój adres e-mail",
-  "auth.notifications.passwordReset.completed.title": "Hasło zmienione pomyślnie",
-  "auth.notifications.passwordReset.completed.body": "Twoje hasło zostało pomyślnie zaktualizowane",
-  "auth.notifications.account.locked.title": "Konto zablokowane",
-  "auth.notifications.account.locked.body": "Twoje konto zostało zablokowane z powodów bezpieczeństwa. Skontaktuj się z pomocą techniczną.",
-  "auth.notifications.login.newDevice.title": "Wykryto logowanie z nowego urządzenia",
-  "auth.notifications.login.newDevice.body": "Wykryto logowanie z nieznanego urządzenia na Twoim koncie",
-  "auth.notifications.role.assigned.title": "Przypisano nową rolę",
-  "auth.notifications.role.assigned.body": "Przypisano Ci nową rolę z dodatkowymi uprawnieniami",
-  "auth.notifications.role.revoked.title": "Rola usunięta",
-  "auth.notifications.role.revoked.body": "Z Twojego konta usunięto rolę",
-  "auth.actions.contactSupport": "Skontaktuj się z pomocą",
-  "auth.actions.viewSessions": "Zobacz sesje",
-  "auth.actions.viewPermissions": "Zobacz uprawnienia"
+  "auth.email.resetPassword.hint": "Jeśli nie prosiłeś o tę wiadomość, możesz ją bezpiecznie zignorować."
 }

package/src/modules/auth/lib/setup-app.ts

@@ -16,7 +16,6 @@ import { DEFAULT_ENCRYPTION_MAPS } from '@open-mercato/core/modules/entities/lib
 import { createKmsService } from '@open-mercato/shared/lib/encryption/kms'
 import { TenantDataEncryptionService } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 
 const DEFAULT_ROLE_NAMES = ['employee', 'admin', 'superadmin'] as const
 const DEMO_SUPERADMIN_EMAIL = 'superadmin@acme.com'
@@ -88,11 +87,6 @@ type PrimaryUserInput = {
   confirm?: boolean
 }
 
-const DERIVED_EMAIL_ENV = {
-  admin: 'OM_INIT_ADMIN_EMAIL',
-  employee: 'OM_INIT_EMPLOYEE_EMAIL',
-} as const
-
 export type SetupInitialTenantOptions = {
   orgName: string
   primaryUser: PrimaryUserInput
@@ -176,28 +170,16 @@ export async function setupInitialTenant(
   })
 
   if (!existingUser) {
-    const baseUsers: Array<{
-      email: string
-      roles: string[]
-      name?: string | null
-      passwordHash?: string | null
-    }> = [
+    const baseUsers: Array<{ email: string; roles: string[]; name?: string | null }> = [
       { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },
     ]
     if (includeDerivedUsers) {
-      const [, domain] = String(primaryUser.email).split('@')
-      const adminOverride = readEnvValue(DERIVED_EMAIL_ENV.admin)
-      const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)
-      const adminEmail = adminOverride ?? (domain ? `admin@${domain}` : '')
-      const employeeEmail = employeeOverride ?? (domain ? `employee@${domain}` : '')
-      const adminPassword = readEnvValue('OM_INIT_ADMIN_PASSWORD')
-      const employeePassword = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')
-      const adminPasswordHash = adminPassword ? await resolvePasswordHash({ email: adminEmail, password: adminPassword }) : null
-      const employeePasswordHash = employeePassword
-        ? await resolvePasswordHash({ email: employeeEmail, password: employeePassword })
-        : null
-      addUniqueBaseUser(baseUsers, { email: adminEmail, roles: ['admin'], passwordHash: adminPasswordHash })
-      addUniqueBaseUser(baseUsers, { email: employeeEmail, roles: ['employee'], passwordHash: employeePasswordHash })
+      const [local, domain] = String(primaryUser.email).split('@')
+      const isSuperadminLocal = (local || '').toLowerCase() === 'superadmin' && !!domain
+      if (isSuperadminLocal) {
+        baseUsers.push({ email: `admin@${domain}`, roles: ['admin'] })
+        baseUsers.push({ email: `employee@${domain}`, roles: ['employee'] })
+      }
     }
     const passwordHash = await resolvePasswordHash(primaryUser)
 
@@ -289,14 +271,13 @@ export async function setupInitialTenant(
       }
 
       for (const base of baseUsers) {
-        const resolvedPasswordHash = base.passwordHash ?? passwordHash
         let user = await tem.findOne(User, { email: base.email })
         const confirm = primaryUser.confirm ?? true
         const encryptedPayload = encryptionService
           ? await encryptionService.encryptEntityPayload('auth:user', { email: base.email }, tenantId, organizationId)
           : { email: base.email, emailHash: computeEmailHash(base.email) }
         if (user) {
-          user.passwordHash = resolvedPasswordHash
+          user.passwordHash = passwordHash
           user.organizationId = organizationId
           user.tenantId = tenantId
           if (isTenantDataEncryptionEnabled()) {
@@ -311,7 +292,7 @@ export async function setupInitialTenant(
           user = tem.create(User, {
             email: (encryptedPayload as any).email ?? base.email,
             emailHash: isTenantDataEncryptionEnabled() ? (encryptedPayload as any).emailHash ?? computeEmailHash(base.email) : undefined,
-            passwordHash: resolvedPasswordHash,
+            passwordHash,
             organizationId,
             tenantId,
             name: base.name ?? undefined,
@@ -359,34 +340,6 @@ function resolvePrimaryName(input: PrimaryUserInput): string | null {
   return null
 }
 
-function readEnvValue(key: string): string | undefined {
-  const value = process.env[key]
-  if (typeof value !== 'string') return undefined
-  const trimmed = value.trim()
-  return trimmed.length > 0 ? trimmed : undefined
-}
-
-function addUniqueBaseUser(
-  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null }>,
-  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null },
-) {
-  if (!entry.email) return
-  const normalized = entry.email.toLowerCase()
-  if (baseUsers.some((user) => user.email.toLowerCase() === normalized)) return
-  baseUsers.push(entry)
-}
-
-function isDemoModeEnabled(): boolean {
-  const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')
-  return parsed === false ? false : true
-}
-
-function shouldKeepDemoSuperadminDuringInit(): boolean {
-  if (process.env.OM_INIT_FLOW !== 'true') return false
-  if (!readEnvValue('OM_INIT_SUPERADMIN_EMAIL')) return false
-  return isDemoModeEnabled()
-}
-
 async function resolvePasswordHash(input: PrimaryUserInput): Promise<string | null> {
   if (typeof input.hashedPassword === 'string') return input.hashedPassword
   if (input.password) return hash(input.password, 10)
@@ -443,7 +396,6 @@ async function ensureDefaultRoleAcls(
       'dashboards.admin.assign-widgets',
       'analytics.view',
       'api_keys.*',
-      'notifications.manage',
       'perspectives.use',
       'perspectives.role_defaults',
       'business_rules.*',
@@ -535,7 +487,6 @@ async function ensureRoleAclFor(
 
 async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em: EntityManager) {
   if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return
-  if (shouldKeepDemoSuperadminDuringInit()) return
   try {
     const user = await em.findOne(User, { email: DEMO_SUPERADMIN_EMAIL })
     if (!user) return

package/src/modules/auth/services/authService.ts

@@ -18,29 +18,6 @@ export class AuthService {
     } as any)
   }
 
-  async findUsersByEmail(email: string) {
-    const emailHash = computeEmailHash(email)
-    return this.em.find(User, {
-      deletedAt: null,
-      $or: [
-        { email },
-        { emailHash },
-      ],
-    } as any)
-  }
-
-  async findUserByEmailAndTenant(email: string, tenantId: string) {
-    const emailHash = computeEmailHash(email)
-    return this.em.findOne(User, {
-      tenantId,
-      deletedAt: null,
-      $or: [
-        { email },
-        { emailHash },
-      ],
-    } as any)
-  }
-
   async verifyPassword(user: User, password: string) {
     if (!user.passwordHash) return false
     return compare(password, user.passwordHash)
@@ -98,15 +75,15 @@ export class AuthService {
     return { user, token }
   }
 
-  async confirmPasswordReset(token: string, newPassword: string): Promise<User | null> {
+  async confirmPasswordReset(token: string, newPassword: string) {
     const now = new Date()
     const row = await this.em.findOne(PasswordReset, { token })
-    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return null
+    if (!row || (row.usedAt && row.usedAt <= now) || row.expiresAt <= now) return false
     const user = await this.em.findOne(User, { id: row.user.id })
-    if (!user) return null
+    if (!user) return false
     user.passwordHash = await hash(newPassword, 10)
     row.usedAt = new Date()
     await this.em.flush()
-    return user
+    return true
   }
 }

package/src/modules/auth/services/rbacService.ts

@@ -69,7 +69,7 @@ export class RbacService {
     return granted === required
   }
 
-  private hasAllFeatures(required: string[], granted: string[]): boolean {
+  public hasAllFeatures(required: string[], granted: string[]): boolean {
     if (!required.length) return true
     if (!granted.length) return false
     return required.every((req) => granted.some((g) => this.matchFeature(req, g)))

package/src/modules/business_rules/api/execute/route.ts

@@ -4,7 +4,6 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import type { EventBus } from '@open-mercato/events'
 import { ruleEngineContextSchema } from '../../data/validators'
 import * as ruleEngine from '../../lib/rule-engine'
 
@@ -47,12 +46,6 @@ export async function POST(req: Request) {
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
-  let eventBus: EventBus | null = null
-  try {
-    eventBus = container.resolve('eventBus') as EventBus
-  } catch {
-    eventBus = null
-  }
 
   let body: any
   try {
@@ -92,7 +85,7 @@ export async function POST(req: Request) {
   }
 
   try {
-    const result = await ruleEngine.executeRules(em, context, { eventBus })
+    const result = await ruleEngine.executeRules(em, context)
 
     const response = {
       allowed: result.allowed,

package/src/modules/business_rules/backend/rules/page.tsx

@@ -264,17 +264,14 @@ export default function RulesListPage() {
         <RowActions
           items={[
             {
-              id: 'edit',
               label: t('common.edit'),
               href: `/backend/rules/${row.original.id}`,
             },
             {
-              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
-              id: 'duplicate',
               label: t('common.duplicate'),
               onSelect: () => {
                 // TODO: Implement duplicate functionality in Step 5.2
@@ -282,7 +279,6 @@ export default function RulesListPage() {
               },
             },
             {
-              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.ruleName),
               destructive: true,

package/src/modules/business_rules/backend/sets/page.tsx

@@ -196,17 +196,14 @@ export default function RuleSetsListPage() {
         <RowActions
           items={[
             {
-              id: 'edit',
               label: t('common.edit'),
               href: `/backend/sets/${row.original.id}`,
             },
             {
-              id: row.original.enabled ? 'disable' : 'enable',
               label: row.original.enabled ? t('common.disable') : t('common.enable'),
               onSelect: () => handleToggleEnabled(row.original.id, row.original.enabled),
             },
             {
-              id: 'delete',
               label: t('common.delete'),
               onSelect: () => handleDelete(row.original.id, row.original.setName),
               destructive: true,

package/src/modules/business_rules/cli.ts

@@ -44,7 +44,6 @@ const seedGuardRules: ModuleCli = {
       const rulesPath = path.join(__dirname, '../workflows/examples', 'guard-rules-example.json')
       const rulesData = JSON.parse(fs.readFileSync(rulesPath, 'utf8'))
 
-      console.log('🧠 Seeding guard rules...')
       let seededCount = 0
       let skippedCount = 0
 
@@ -74,7 +73,7 @@ const seedGuardRules: ModuleCli = {
         seededCount++
       }
 
-      console.log(`\n✅ Guard rules seeding complete:`)
+      console.log(`\n✓ Guard rules seeding complete:`)
       console.log(`  - Seeded: ${seededCount}`)
       console.log(`  - Skipped (existing): ${skippedCount}`)
       console.log(`  - Total: ${rulesData.length}`)

package/src/modules/business_rules/i18n/en.json

@@ -367,7 +367,5 @@
   "business_rules.components.conditionRow.field.comparisonPlaceholder": "e.g., user.role",
   "business_rules.components.conditionRow.value.help": "Use JSON for arrays: [\"a\",\"b\"]",
   "business_rules.components.conditionRow.field.comparisonHelp": "Field path to compare with",
-  "business_rules.components.conditionRow.deleteCondition": "Delete condition",
-  "businessRules.notifications.rule.executionFailed.title": "Business Rule Failed",
-  "businessRules.notifications.rule.executionFailed.body": "Rule \"{ruleName}\" failed to execute{entityType, select, other { on {entityType}}}: {errorMessage}"
+  "business_rules.components.conditionRow.deleteCondition": "Delete condition"
 }