@open-mercato/core 0.6.1-develop.3260.1.dc719cac84 → 0.6.1-develop.3278.1.a4d26475e4

package/src/modules/customer_accounts/lib/resolveTenantContext.ts

@@ -0,0 +1,96 @@
+/**
+ * Resolve the tenant context for a customer-portal request.
+ *
+ * - Platform-domain hosts: require `tenantId` in the request body.
+ * - Custom-domain hosts: resolve via `domainMappingService.resolveByHostname()`.
+ *   If the body supplied a different `tenantId`, fail closed (mismatch).
+ *
+ * This is the single entry point used by all customer-auth routes (login,
+ * signup, magic-link, password-reset) so they all behave consistently when
+ * the request arrives on a tenant's branded URL.
+ *
+ * See `.ai/specs/2026-04-08-portal-custom-domain-routing.md` Phase 1.5.
+ */
+
+import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'
+import { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import type { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+export class TenantResolutionError extends Error {
+  constructor(message: string, public readonly status: number) {
+    super(message)
+    this.name = 'TenantResolutionError'
+  }
+}
+
+export type ResolvedTenantContext = {
+  source: 'body' | 'host'
+  tenantId: string
+  organizationId: string | null
+  hostname: string | null
+}
+
+function readForcedHost(req: Request): string | null {
+  // Test-only override. The middleware honors `X-Force-Host` only when
+  // `NODE_ENV === 'test'` AND `X-Force-Host-Secret` matches; we mirror the
+  // same check here so request-scoped helpers behave the same way under tests.
+  if (process.env.NODE_ENV !== 'test') return null
+  const expected = process.env.FORCE_HOST_SECRET
+  if (!expected) return null
+  if (!secretEqual(req.headers.get('x-force-host-secret'), expected)) return null
+  const host = req.headers.get('x-force-host')
+  return host && host.length > 0 ? host : null
+}
+
+export async function resolveTenantContext(
+  req: Request,
+  bodyTenantId: string | null | undefined,
+  options?: { container?: AppContainer },
+): Promise<ResolvedTenantContext> {
+  const rawHost = readForcedHost(req) ?? req.headers.get('host')
+  const hostname = rawHost ? tryNormalizeHostname(rawHost) : null
+  const isPlatform = hostname ? platformDomains().includes(hostname) : true
+
+  if (isPlatform) {
+    if (!bodyTenantId) {
+      throw new TenantResolutionError('tenantId is required for platform-domain logins', 400)
+    }
+    return { source: 'body', tenantId: bodyTenantId, organizationId: null, hostname }
+  }
+
+  // Custom-domain host
+  let service: DomainMappingService | null = null
+  try {
+    if (options?.container) {
+      service = options.container.resolve('domainMappingService') as DomainMappingService
+    } else {
+      const { createRequestContainer } = await import('@open-mercato/shared/lib/di/container')
+      const container = await createRequestContainer()
+      service = container.resolve('domainMappingService') as DomainMappingService
+    }
+  } catch {
+    throw new TenantResolutionError('Custom domain routing is not available on this deployment', 503)
+  }
+
+  if (!hostname) throw new TenantResolutionError('Unable to determine request hostname', 400)
+  const resolved = await service.resolveByHostname(hostname)
+  if (!resolved || resolved.status !== 'active') {
+    throw new TenantResolutionError('This domain is not configured for any active organization', 404)
+  }
+
+  if (bodyTenantId && bodyTenantId !== resolved.tenantId) {
+    throw new TenantResolutionError(
+      'tenantId in request body does not match the resolved custom domain',
+      400,
+    )
+  }
+
+  return {
+    source: 'host',
+    tenantId: resolved.tenantId,
+    organizationId: resolved.organizationId,
+    hostname,
+  }
+}

package/src/modules/customer_accounts/lib/secretCompare.ts

@@ -0,0 +1,20 @@
+// Constant-time secret comparison for header-based shared-secret authentication.
+// Plain `===`/`!==` on strings short-circuits on the first mismatching byte and
+// leaks the matching prefix length through CPU timing. The custom-domain
+// `domain-check` and `domain-resolve` routes guard cross-tenant data with these
+// header secrets, so the comparison MUST be constant-time.
+//
+// `crypto.timingSafeEqual` requires equal-length buffers (it throws otherwise).
+// We always do a length check first; the resulting length leak is negligible
+// compared to the byte-by-byte leak of plain `!==`.
+
+import { timingSafeEqual } from 'node:crypto'
+
+export function secretEqual(supplied: string | null | undefined, expected: string): boolean {
+  if (typeof supplied !== 'string' || supplied.length === 0) return false
+  if (typeof expected !== 'string' || expected.length === 0) return false
+  const a = Buffer.from(supplied, 'utf8')
+  const b = Buffer.from(expected, 'utf8')
+  if (a.length !== b.length) return false
+  return timingSafeEqual(a, b)
+}

package/src/modules/customer_accounts/migrations/.snapshot-open-mercato.json

@@ -1826,6 +1826,347 @@
         }
       },
       "nativeEnums": {}
+    },
+    {
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": true,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "gen_random_uuid()",
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
+        "hostname": {
+          "name": "hostname",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": true,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "text"
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
+        "replaces_domain_id": {
+          "name": "replaces_domain_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
+        "provider": {
+          "name": "provider",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "'traefik'",
+          "comment": null,
+          "enumItems": [
+            "traefik"
+          ],
+          "mappedType": "enum"
+        },
+        "status": {
+          "name": "status",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "'pending'",
+          "comment": null,
+          "enumItems": [
+            "pending",
+            "verified",
+            "active",
+            "dns_failed",
+            "tls_failed"
+          ],
+          "mappedType": "enum"
+        },
+        "verified_at": {
+          "name": "verified_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        },
+        "last_dns_check_at": {
+          "name": "last_dns_check_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        },
+        "dns_failure_reason": {
+          "name": "dns_failure_reason",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": 500,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "text"
+        },
+        "tls_failure_reason": {
+          "name": "tls_failure_reason",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": 500,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "text"
+        },
+        "tls_retry_count": {
+          "name": "tls_retry_count",
+          "type": "int",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": "0",
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "integer"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": 6,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "datetime"
+        }
+      },
+      "name": "domain_mappings",
+      "schema": "public",
+      "indexes": [
+        {
+          "columnNames": [
+            "hostname"
+          ],
+          "composite": false,
+          "constraint": true,
+          "keyName": "domain_mappings_hostname_unique",
+          "primary": false,
+          "unique": true
+        },
+        {
+          "columnNames": [
+            "organization_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "keyName": "domain_mappings_organization_id_idx",
+          "primary": false,
+          "unique": false
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "domain_mappings_pending_tls_idx",
+          "primary": false,
+          "unique": false,
+          "expression": "create index \"domain_mappings_pending_tls_idx\" on \"domain_mappings\" (\"status\", \"updated_at\") where \"status\" in ('verified', 'tls_failed')"
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "domain_mappings_pending_verification_idx",
+          "primary": false,
+          "unique": false,
+          "expression": "create index \"domain_mappings_pending_verification_idx\" on \"domain_mappings\" (\"status\", \"last_dns_check_at\") where \"status\" in ('pending', 'dns_failed')"
+        },
+        {
+          "columnNames": [
+            "id"
+          ],
+          "composite": false,
+          "constraint": true,
+          "keyName": "domain_mappings_pkey",
+          "primary": true,
+          "unique": true
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": true,
+          "keyName": "domain_mappings_replaces_domain_id_unique",
+          "primary": false,
+          "unique": true,
+          "expression": "create unique index \"domain_mappings_replaces_domain_id_unique\" on \"domain_mappings\" (\"replaces_domain_id\") where \"replaces_domain_id\" is not null"
+        },
+        {
+          "columnNames": [
+            "tenant_id"
+          ],
+          "composite": false,
+          "constraint": false,
+          "keyName": "domain_mappings_tenant_id_idx",
+          "primary": false,
+          "unique": false
+        }
+      ],
+      "checks": [
+        {
+          "name": "domain_mappings_hostname_normalized_chk",
+          "expression": "\"hostname\" = lower(\"hostname\") and \"hostname\" not like '%.'",
+          "definition": "check (\"hostname\" = lower(\"hostname\") and \"hostname\" not like '%.')"
+        },
+        {
+          "name": "domain_mappings_provider_check",
+          "expression": "\"provider\" in ('traefik')",
+          "definition": "check (\"provider\" in ('traefik'))",
+          "columnName": "provider"
+        },
+        {
+          "name": "domain_mappings_status_check",
+          "expression": "\"status\" in ('pending', 'verified', 'active', 'dns_failed', 'tls_failed')",
+          "definition": "check (\"status\" in ('pending', 'verified', 'active', 'dns_failed', 'tls_failed'))",
+          "columnName": "status"
+        }
+      ],
+      "foreignKeys": {
+        "domain_mappings_replaces_domain_id_foreign": {
+          "columnNames": [
+            "replaces_domain_id"
+          ],
+          "constraintName": "domain_mappings_replaces_domain_id_foreign",
+          "localTableName": "public.domain_mappings",
+          "referencedColumnNames": [
+            "id"
+          ],
+          "referencedTableName": "public.domain_mappings",
+          "deleteRule": "set null"
+        }
+      },
+      "nativeEnums": {}
     }
   ],
   "nativeEnums": {}

package/src/modules/customer_accounts/migrations/Migration20260430120000_customer_accounts.ts

@@ -0,0 +1,38 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260430120000_customer_accounts extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`create table "domain_mappings" (
+      "id" uuid not null default gen_random_uuid(),
+      "hostname" text not null,
+      "tenant_id" uuid not null,
+      "organization_id" uuid not null,
+      "replaces_domain_id" uuid null,
+      "provider" text not null default 'traefik',
+      "status" text not null default 'pending',
+      "verified_at" timestamptz null,
+      "last_dns_check_at" timestamptz null,
+      "dns_failure_reason" varchar(500) null,
+      "tls_failure_reason" varchar(500) null,
+      "tls_retry_count" int not null default 0,
+      "created_at" timestamptz not null default now(),
+      "updated_at" timestamptz null,
+      constraint "domain_mappings_pkey" primary key ("id"),
+      constraint "domain_mappings_replaces_domain_id_foreign" foreign key ("replaces_domain_id") references "domain_mappings" ("id") on delete set null
+    );`);
+
+    this.addSql(`create unique index "domain_mappings_hostname_unique" on "domain_mappings" ("hostname");`);
+    this.addSql(`create index "domain_mappings_organization_id_idx" on "domain_mappings" ("organization_id");`);
+    this.addSql(`create index "domain_mappings_tenant_id_idx" on "domain_mappings" ("tenant_id");`);
+    this.addSql(`create unique index "domain_mappings_replaces_domain_id_unique" on "domain_mappings" ("replaces_domain_id") where "replaces_domain_id" is not null;`);
+    this.addSql(`create index "domain_mappings_pending_verification_idx" on "domain_mappings" ("status", "last_dns_check_at") where "status" in ('pending', 'dns_failed');`);
+    this.addSql(`create index "domain_mappings_pending_tls_idx" on "domain_mappings" ("status", "updated_at") where "status" in ('verified', 'tls_failed');`);
+    this.addSql(`alter table "domain_mappings" add constraint "domain_mappings_hostname_normalized_chk" check ("hostname" = lower("hostname") and "hostname" not like '%.');`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop table if exists "domain_mappings" cascade;`);
+  }
+
+}

package/src/modules/customer_accounts/notifications.client.ts

@@ -41,6 +41,82 @@ export const customerAccountsNotificationTypes: NotificationTypeDefinition[] = [
     linkHref: '/backend/customer_accounts/users/{sourceEntityId}',
     expiresAfterHours: 168,
   },
+  {
+    type: 'customer_accounts.domain_mapping.verified',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.verified.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.verified.body',
+    icon: 'check-circle',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.activated',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.activated.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.activated.body',
+    icon: 'globe',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.dns_failed',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.dns_failed.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.dns_failed.body',
+    icon: 'alert-triangle',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.tls_failed',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.tls_failed.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.tls_failed.body',
+    icon: 'shield-alert',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
 ]
 
 export default customerAccountsNotificationTypes

package/src/modules/customer_accounts/notifications.ts

@@ -39,6 +39,82 @@ export const notificationTypes: NotificationTypeDefinition[] = [
     linkHref: '/backend/customer_accounts/users/{sourceEntityId}',
     expiresAfterHours: 168,
   },
+  {
+    type: 'customer_accounts.domain_mapping.verified',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.verified.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.verified.body',
+    icon: 'check-circle',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.activated',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.activated.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.activated.body',
+    icon: 'globe',
+    severity: 'success',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.dns_failed',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.dns_failed.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.dns_failed.body',
+    icon: 'alert-triangle',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
+  {
+    type: 'customer_accounts.domain_mapping.tls_failed',
+    module: 'customer_accounts',
+    titleKey: 'customer_accounts.notifications.domain_mapping.tls_failed.title',
+    bodyKey: 'customer_accounts.notifications.domain_mapping.tls_failed.body',
+    icon: 'shield-alert',
+    severity: 'warning',
+    actions: [
+      {
+        id: 'view',
+        labelKey: 'common.view',
+        variant: 'outline',
+        href: '/backend/customer_accounts/settings/domain',
+        icon: 'external-link',
+      },
+    ],
+    linkHref: '/backend/customer_accounts/settings/domain',
+    expiresAfterHours: 168,
+  },
 ]
 
 export default notificationTypes