@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3278.1.a4d26475e4

package/src/modules/customer_accounts/api/admin/domain-mappings.ts

@@ -0,0 +1,303 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { UniqueConstraintViolationException } from '@mikro-orm/core'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import { registerDomainSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
+import {
+  DomainMappingService,
+  type ResolveResult,
+} from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+import { DomainMapping } from '@open-mercato/core/modules/customer_accounts/data/entities'
+
+const FEATURE = 'customer_accounts.domain.manage'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: [FEATURE] },
+  POST: { requireAuth: true, requireFeatures: [FEATURE] },
+  DELETE: { requireAuth: true, requireFeatures: [FEATURE] },
+}
+
+function isUniqueViolation(error: unknown): boolean {
+  if (error instanceof UniqueConstraintViolationException) return true
+  if (!error || typeof error !== 'object') return false
+  const code = (error as { code?: string }).code
+  if (code === '23505') return true
+  const messageRaw = (error as { message?: string }).message
+  const message = typeof messageRaw === 'string' ? messageRaw : ''
+  return message.toLowerCase().includes('duplicate key')
+}
+
+function serializeRecord(record: DomainMapping) {
+  return {
+    id: record.id,
+    hostname: record.hostname,
+    organizationId: record.organizationId,
+    tenantId: record.tenantId,
+    provider: record.provider,
+    status: record.status,
+    verifiedAt: record.verifiedAt?.toISOString() ?? null,
+    lastDnsCheckAt: record.lastDnsCheckAt?.toISOString() ?? null,
+    dnsFailureReason: record.dnsFailureReason ?? null,
+    tlsFailureReason: record.tlsFailureReason ?? null,
+    tlsRetryCount: record.tlsRetryCount,
+    cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,
+    aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null,
+    createdAt: record.createdAt.toISOString(),
+    updatedAt: record.updatedAt?.toISOString() ?? null,
+  }
+}
+
+export async function GET(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+
+  const container = await createRequestContainer()
+  const rbac = container.resolve('rbacService') as RbacService
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+
+  const url = new URL(req.url)
+  const orgFilter = url.searchParams.get('organizationId')
+
+  const em = container.resolve('em') as EntityManager
+  const where: Record<string, unknown> = { tenantId: auth.tenantId }
+  if (orgFilter) where.organizationId = orgFilter
+  const records = await em.find(DomainMapping, where as never, { orderBy: { createdAt: 'desc' } })
+
+  return NextResponse.json({
+    ok: true,
+    domainMappings: records.map(serializeRecord),
+    config: {
+      cnameTarget: process.env.CUSTOM_DOMAIN_CNAME_TARGET ?? null,
+      aRecordTarget: process.env.CUSTOM_DOMAIN_A_RECORD_TARGET ?? null,
+    },
+  })
+}
+
+export async function POST(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+
+  const container = await createRequestContainer()
+  const rbac = container.resolve('rbacService') as RbacService
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+
+  const body = await readJsonSafe(req, {})
+  const parsed = registerDomainSchema.safeParse(body)
+  if (!parsed.success) {
+    return NextResponse.json(
+      { ok: false, error: 'Invalid request', issues: parsed.error.flatten() },
+      { status: 400 },
+    )
+  }
+
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: parsed.data.organizationId,
+    userId: auth.sub,
+    resourceKind: 'customer_accounts.domain_mapping',
+    resourceId: parsed.data.organizationId,
+    operation: 'create',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+    mutationPayload: parsed.data as unknown as Record<string, unknown>,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  const service = container.resolve('domainMappingService') as DomainMappingService
+
+  let entity: DomainMapping
+  try {
+    // service.register normalizes hostname internally — guards may have
+    // returned modifiedPayload but the typed runner doesn't expose it,
+    // so we rely on the service for the canonical form.
+    entity = await service.register({
+      hostname: parsed.data.hostname,
+      organizationId: parsed.data.organizationId,
+      tenantId: auth.tenantId,
+      replacesDomainId: parsed.data.replacesDomainId,
+    })
+  } catch (err: unknown) {
+    if (isUniqueViolation(err)) {
+      return NextResponse.json(
+        { ok: false, error: 'This domain is not available. Please choose a different hostname.' },
+        { status: 409 },
+      )
+    }
+    const message = err instanceof Error ? err.message : 'Failed to register domain'
+    return NextResponse.json({ ok: false, error: message }, { status: 500 })
+  }
+
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: parsed.data.organizationId,
+      userId: auth.sub,
+      resourceKind: 'customer_accounts.domain_mapping',
+      resourceId: entity.id,
+      operation: 'create',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
+  return NextResponse.json({ ok: true, domainMapping: serializeRecord(entity) }, { status: 201 })
+}
+
+export async function DELETE(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+
+  const container = await createRequestContainer()
+  const rbac = container.resolve('rbacService') as RbacService
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+
+  const url = new URL(req.url)
+  const id = url.searchParams.get('id')
+  if (!id) return NextResponse.json({ ok: false, error: 'id is required' }, { status: 400 })
+
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const existing = await service.findById(id, { tenantId: auth.tenantId })
+  if (!existing) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: existing.organizationId,
+    userId: auth.sub,
+    resourceKind: 'customer_accounts.domain_mapping',
+    resourceId: id,
+    operation: 'delete',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  await service.remove(id, { tenantId: auth.tenantId })
+
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: existing.organizationId,
+      userId: auth.sub,
+      resourceKind: 'customer_accounts.domain_mapping',
+      resourceId: id,
+      operation: 'delete',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
+  return NextResponse.json({ ok: true })
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+const domainMappingSchema = z.object({
+  id: z.string().uuid(),
+  hostname: z.string(),
+  organizationId: z.string().uuid(),
+  tenantId: z.string().uuid(),
+  provider: z.literal('traefik'),
+  status: z.enum(['pending', 'verified', 'active', 'dns_failed', 'tls_failed']),
+  verifiedAt: z.string().nullable(),
+  lastDnsCheckAt: z.string().nullable(),
+  dnsFailureReason: z.string().nullable(),
+  tlsFailureReason: z.string().nullable(),
+  tlsRetryCount: z.number().int().nonnegative(),
+  cnameTarget: z.string().nullable(),
+  aRecordTarget: z.string().nullable(),
+  createdAt: z.string(),
+  updatedAt: z.string().nullable(),
+})
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'Custom portal domain mappings (admin)',
+  methods: {
+    GET: {
+      summary: 'List domain mappings',
+      description: 'Returns all custom-domain mappings for the current tenant, optionally filtered by organization.',
+      responses: [
+        {
+          status: 200,
+          description: 'OK',
+          schema: z.object({
+            ok: z.literal(true),
+            domainMappings: z.array(domainMappingSchema),
+            config: z.object({
+              cnameTarget: z.string().nullable(),
+              aRecordTarget: z.string().nullable(),
+            }),
+          }),
+        },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+      ],
+    },
+    POST: {
+      summary: 'Register a custom domain',
+      description: 'Registers a new custom domain mapping for an organization. Verifies via DNS asynchronously.',
+      requestBody: {
+        contentType: 'application/json',
+        schema: z.object({
+          hostname: z.string(),
+          organizationId: z.string().uuid(),
+          replacesDomainId: z.string().uuid().optional(),
+        }),
+      },
+      responses: [
+        {
+          status: 201,
+          description: 'Created',
+          schema: z.object({ ok: z.literal(true), domainMapping: domainMappingSchema }),
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Validation error', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 409, description: 'Conflict', schema: errorSchema },
+      ],
+    },
+    DELETE: {
+      summary: 'Remove a custom domain',
+      description: 'Removes the domain mapping identified by ?id=. Cache and Traefik routing drain within TTL.',
+      responses: [{ status: 200, description: 'OK', schema: z.object({ ok: z.literal(true) }) }],
+      errors: [
+        { status: 400, description: 'Bad request', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+      ],
+    },
+  },
+}
+
+// Re-export resolve type so tests can import without indirect lookup
+export type { ResolveResult }

package/src/modules/customer_accounts/api/domain-check.ts

@@ -0,0 +1,83 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+function withOriginHeader(response: NextResponse): NextResponse {
+  response.headers.set(ORIGIN_HEADER_NAME, '1')
+  return response
+}
+
+function unauthorized(message: string): NextResponse {
+  return withOriginHeader(NextResponse.json({ ok: false, error: message }, { status: 403 }))
+}
+
+function notFound(): NextResponse {
+  return withOriginHeader(NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 }))
+}
+
+function ok(): NextResponse {
+  return withOriginHeader(NextResponse.json({ ok: true }))
+}
+
+export async function GET(req: Request) {
+  const expected = process.env.DOMAIN_CHECK_SECRET
+  if (!expected) {
+    // Fail closed when the gating secret is not configured on the server.
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: 'DOMAIN_CHECK_SECRET is not configured on the server' },
+        { status: 503 },
+      ),
+    )
+  }
+  const supplied = req.headers.get('x-domain-check-secret')
+  if (!secretEqual(supplied, expected)) return unauthorized('Forbidden')
+
+  const url = new URL(req.url)
+  // Traefik's ForwardAuth middleware cannot template the auth URL with the
+  // original Host, so it forwards the original request via X-Forwarded-Host.
+  // Manual / direct callers can still pass `?host=` explicitly.
+  const rawHost =
+    url.searchParams.get('host') ?? req.headers.get('x-forwarded-host')
+  if (!rawHost) return notFound()
+  const hostname = tryNormalizeHostname(rawHost)
+  if (!hostname) return notFound()
+
+  const container = await createRequestContainer()
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const result = await service.isAllowedForTls(hostname)
+  if (!result) return notFound()
+  return ok()
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'Traefik domain-check gate',
+  methods: {
+    GET: {
+      summary: 'Verify a hostname is allowed for TLS provisioning',
+      description:
+        'Called by Traefik before issuing a Let\'s Encrypt certificate. Requires the X-Domain-Check-Secret header to match DOMAIN_CHECK_SECRET.',
+      responses: [
+        { status: 200, description: 'Hostname allowed', schema: z.object({ ok: z.literal(true) }) },
+      ],
+      errors: [
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 404, description: 'Hostname not registered or not yet verified', schema: errorSchema },
+        { status: 503, description: 'Server misconfiguration', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customer_accounts/api/domain-resolve/all.ts

@@ -0,0 +1,139 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import {
+  checkAuthRateLimit,
+  domainResolveAllIpRateLimitConfig,
+} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
+
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'
+const LOG_PREFIX = '[domain-resolve/all]'
+const ENDPOINT_PATH = '/api/customer_accounts/domain-resolve/all'
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+function withOriginHeader(response: NextResponse): NextResponse {
+  response.headers.set(ORIGIN_HEADER_NAME, '1')
+  return response
+}
+
+function readCallerIp(req: Request): string {
+  const forwardedFor = req.headers.get('x-forwarded-for')
+  if (forwardedFor) {
+    const firstHop = forwardedFor.split(',')[0]?.trim()
+    if (firstHop) return firstHop
+  }
+  const realIp = req.headers.get('x-real-ip')
+  if (realIp && realIp.trim().length > 0) return realIp.trim()
+  return 'unknown'
+}
+
+export async function GET(req: Request) {
+  const callerIp = readCallerIp(req)
+  const expected = process.env.DOMAIN_RESOLVE_SECRET
+  if (!expected) {
+    // Fail closed when the gating secret is not configured on the server.
+    console.warn(`${LOG_PREFIX} rejected request — secret not configured`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: 'misconfigured',
+    })
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: 'DOMAIN_RESOLVE_SECRET is not configured on the server' },
+        { status: 503 },
+      ),
+    )
+  }
+
+  // Rate-limit by caller IP before the secret comparison to make leak-driven
+  // enumeration noisy and bounded. Fails closed (returns the helper's 429
+  // response) when the limit is exceeded.
+  const { error: rateLimitError } = await checkAuthRateLimit({
+    req,
+    ipConfig: domainResolveAllIpRateLimitConfig,
+  })
+  if (rateLimitError) {
+    console.warn(`${LOG_PREFIX} rate-limited`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: 'rate_limited',
+    })
+    return withOriginHeader(rateLimitError)
+  }
+
+  const supplied = req.headers.get('x-domain-resolve-secret')
+  if (!secretEqual(supplied, expected)) {
+    console.warn(`${LOG_PREFIX} rejected request — invalid secret`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: 'forbidden',
+    })
+    return withOriginHeader(NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 }))
+  }
+
+  const container = await createRequestContainer()
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const records = await service.resolveAll()
+  console.info(`${LOG_PREFIX} authorized`, {
+    endpoint: ENDPOINT_PATH,
+    ip: callerIp,
+    outcome: 'ok',
+    domains: records.length,
+  })
+  return withOriginHeader(
+    NextResponse.json({
+      ok: true,
+      domains: records.map((r) => ({
+        hostname: r.hostname,
+        tenantId: r.tenantId,
+        organizationId: r.organizationId,
+        orgSlug: r.orgSlug,
+        status: r.status,
+      })),
+    }),
+  )
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'Batch resolve all active custom domains',
+  methods: {
+    GET: {
+      summary: 'Batch warm-up for the Node middleware',
+      description:
+        'Returns every active domain mapping in a single payload so the middleware can populate its cache on process start. Requires X-Domain-Resolve-Secret header.',
+      responses: [
+        {
+          status: 200,
+          description: 'OK',
+          schema: z.object({
+            ok: z.literal(true),
+            domains: z.array(
+              z.object({
+                hostname: z.string(),
+                tenantId: z.string().uuid(),
+                organizationId: z.string().uuid(),
+                orgSlug: z.string().nullable(),
+                status: z.literal('active'),
+              }),
+            ),
+          }),
+        },
+      ],
+      errors: [
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },
+        { status: 503, description: 'Server misconfiguration', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customer_accounts/api/domain-resolve.ts

@@ -0,0 +1,91 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'
+
+export const metadata = {
+  GET: { requireAuth: false },
+}
+
+function withOriginHeader(response: NextResponse): NextResponse {
+  response.headers.set(ORIGIN_HEADER_NAME, '1')
+  return response
+}
+
+export async function GET(req: Request) {
+  const expected = process.env.DOMAIN_RESOLVE_SECRET
+  if (!expected) {
+    // Fail closed when the gating secret is not configured on the server.
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: 'DOMAIN_RESOLVE_SECRET is not configured on the server' },
+        { status: 503 },
+      ),
+    )
+  }
+  const supplied = req.headers.get('x-domain-resolve-secret')
+  if (!secretEqual(supplied, expected)) {
+    return withOriginHeader(NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 }))
+  }
+
+  const url = new URL(req.url)
+  const rawHost = url.searchParams.get('host')
+  if (!rawHost) return withOriginHeader(NextResponse.json({ ok: false, error: 'host param required' }, { status: 400 }))
+  const hostname = tryNormalizeHostname(rawHost)
+  if (!hostname) return withOriginHeader(NextResponse.json({ ok: false, error: 'invalid host' }, { status: 400 }))
+
+  const container = await createRequestContainer()
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const result = await service.resolveByHostname(hostname)
+  if (!result || result.status !== 'active') {
+    return withOriginHeader(NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 }))
+  }
+
+  return withOriginHeader(
+    NextResponse.json({
+      ok: true,
+      tenantId: result.tenantId,
+      organizationId: result.organizationId,
+      orgSlug: result.orgSlug,
+      status: result.status,
+    }),
+  )
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'Resolve a custom domain to its tenant and organization',
+  methods: {
+    GET: {
+      summary: 'Single-host resolve for the Node middleware',
+      description:
+        'Internal endpoint used by the portal middleware to populate its in-memory cache. Requires X-Domain-Resolve-Secret header.',
+      responses: [
+        {
+          status: 200,
+          description: 'OK',
+          schema: z.object({
+            ok: z.literal(true),
+            tenantId: z.string().uuid(),
+            organizationId: z.string().uuid(),
+            orgSlug: z.string().nullable(),
+            status: z.literal('active'),
+          }),
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Bad request', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 404, description: 'Not found', schema: errorSchema },
+        { status: 503, description: 'Server misconfiguration', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customer_accounts/api/login.ts

@@ -15,6 +15,10 @@ import {
   customerLoginRateLimitConfig,
   customerLoginIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
+import {
+  resolveTenantContext,
+  TenantResolutionError,
+} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -31,9 +35,16 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Invalid credentials' }, { status: 400 })
   }
 
-  const { email, password, tenantId } = parsed.data
-  if (!tenantId) {
-    return NextResponse.json({ ok: false, error: 'tenantId is required' }, { status: 400 })
+  const { email, password } = parsed.data
+  let tenantId: string
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId)
+    tenantId = context.tenantId
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })
+    }
+    throw err
   }
 
   const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({

package/src/modules/customer_accounts/api/magic-link/request.ts

@@ -2,6 +2,10 @@ import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import { magicLinkRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
+import {
+  resolveTenantContext,
+  TenantResolutionError,
+} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'
 import { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'
@@ -37,9 +41,16 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: true })
   }
 
-  const { email, tenantId } = parsed.data
-  if (!tenantId) {
-    return NextResponse.json({ ok: true })
+  const { email } = parsed.data
+  let tenantId: string
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId)
+    tenantId = context.tenantId
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: true })
+    }
+    throw err
   }
 
   const container = await createRequestContainer()