@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3278.1.a4d26475e4

package/dist/modules/customer_accounts/api/domain-check.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/api/domain-check.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nconst ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nfunction withOriginHeader(response: NextResponse): NextResponse {\n  response.headers.set(ORIGIN_HEADER_NAME, '1')\n  return response\n}\n\nfunction unauthorized(message: string): NextResponse {\n  return withOriginHeader(NextResponse.json({ ok: false, error: message }, { status: 403 }))\n}\n\nfunction notFound(): NextResponse {\n  return withOriginHeader(NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 }))\n}\n\nfunction ok(): NextResponse {\n  return withOriginHeader(NextResponse.json({ ok: true }))\n}\n\nexport async function GET(req: Request) {\n  const expected = process.env.DOMAIN_CHECK_SECRET\n  if (!expected) {\n    // Fail closed when the gating secret is not configured on the server.\n    return withOriginHeader(\n      NextResponse.json(\n        { ok: false, error: 'DOMAIN_CHECK_SECRET is not configured on the server' },\n        { status: 503 },\n      ),\n    )\n  }\n  const supplied = req.headers.get('x-domain-check-secret')\n  if (!secretEqual(supplied, expected)) return unauthorized('Forbidden')\n\n  const url = new URL(req.url)\n  // Traefik's ForwardAuth middleware cannot template the auth URL with the\n  // original Host, so it forwards the original request via X-Forwarded-Host.\n  // Manual / direct callers can still pass `?host=` explicitly.\n  const rawHost =\n    url.searchParams.get('host') ?? req.headers.get('x-forwarded-host')\n  if (!rawHost) return notFound()\n  const hostname = tryNormalizeHostname(rawHost)\n  if (!hostname) return notFound()\n\n  const container = await createRequestContainer()\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const result = await service.isAllowedForTls(hostname)\n  if (!result) return notFound()\n  return ok()\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Traefik domain-check gate',\n  methods: {\n    GET: {\n      summary: 'Verify a hostname is allowed for TLS provisioning',\n      description:\n        'Called by Traefik before issuing a Let\\'s Encrypt certificate. Requires the X-Domain-Check-Secret header to match DOMAIN_CHECK_SECRET.',\n      responses: [\n        { status: 200, description: 'Hostname allowed', schema: z.object({ ok: z.literal(true) }) },\n      ],\n      errors: [\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 404, description: 'Hostname not registered or not yet verified', schema: errorSchema },\n        { status: 503, description: 'Server misconfiguration', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAG5B,MAAM,qBAAqB,QAAQ,IAAI,iCAAiC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,SAAS,iBAAiB,UAAsC;AAC9D,WAAS,QAAQ,IAAI,oBAAoB,GAAG;AAC5C,SAAO;AACT;AAEA,SAAS,aAAa,SAA+B;AACnD,SAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAC3F;AAEA,SAAS,WAAyB;AAChC,SAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAC/F;AAEA,SAAS,KAAmB;AAC1B,SAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC,CAAC;AACzD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AAEb,WAAO;AAAA,MACL,aAAa;AAAA,QACX,EAAE,IAAI,OAAO,OAAO,sDAAsD;AAAA,QAC1E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,IAAI,QAAQ,IAAI,uBAAuB;AACxD,MAAI,CAAC,YAAY,UAAU,QAAQ,EAAG,QAAO,aAAa,WAAW;AAErE,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAI3B,QAAM,UACJ,IAAI,aAAa,IAAI,MAAM,KAAK,IAAI,QAAQ,IAAI,kBAAkB;AACpE,MAAI,CAAC,QAAS,QAAO,SAAS;AAC9B,QAAM,WAAW,qBAAqB,OAAO;AAC7C,MAAI,CAAC,SAAU,QAAO,SAAS;AAE/B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,SAAS,MAAM,QAAQ,gBAAgB,QAAQ;AACrD,MAAI,CAAC,OAAQ,QAAO,SAAS;AAC7B,SAAO,GAAG;AACZ;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,EAAE;AAAA,MAC5F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,QAC/F,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/domain-resolve/all.js

@@ -0,0 +1,128 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { secretEqual } from "@open-mercato/core/modules/customer_accounts/lib/secretCompare";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
+import {
+  checkAuthRateLimit,
+  domainResolveAllIpRateLimitConfig
+} from "@open-mercato/core/modules/customer_accounts/lib/rateLimiter";
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin";
+const LOG_PREFIX = "[domain-resolve/all]";
+const ENDPOINT_PATH = "/api/customer_accounts/domain-resolve/all";
+const metadata = {
+  GET: { requireAuth: false }
+};
+function withOriginHeader(response) {
+  response.headers.set(ORIGIN_HEADER_NAME, "1");
+  return response;
+}
+function readCallerIp(req) {
+  const forwardedFor = req.headers.get("x-forwarded-for");
+  if (forwardedFor) {
+    const firstHop = forwardedFor.split(",")[0]?.trim();
+    if (firstHop) return firstHop;
+  }
+  const realIp = req.headers.get("x-real-ip");
+  if (realIp && realIp.trim().length > 0) return realIp.trim();
+  return "unknown";
+}
+async function GET(req) {
+  const callerIp = readCallerIp(req);
+  const expected = process.env.DOMAIN_RESOLVE_SECRET;
+  if (!expected) {
+    console.warn(`${LOG_PREFIX} rejected request \u2014 secret not configured`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: "misconfigured"
+    });
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: "DOMAIN_RESOLVE_SECRET is not configured on the server" },
+        { status: 503 }
+      )
+    );
+  }
+  const { error: rateLimitError } = await checkAuthRateLimit({
+    req,
+    ipConfig: domainResolveAllIpRateLimitConfig
+  });
+  if (rateLimitError) {
+    console.warn(`${LOG_PREFIX} rate-limited`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: "rate_limited"
+    });
+    return withOriginHeader(rateLimitError);
+  }
+  const supplied = req.headers.get("x-domain-resolve-secret");
+  if (!secretEqual(supplied, expected)) {
+    console.warn(`${LOG_PREFIX} rejected request \u2014 invalid secret`, {
+      endpoint: ENDPOINT_PATH,
+      ip: callerIp,
+      outcome: "forbidden"
+    });
+    return withOriginHeader(NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 }));
+  }
+  const container = await createRequestContainer();
+  const service = container.resolve("domainMappingService");
+  const records = await service.resolveAll();
+  console.info(`${LOG_PREFIX} authorized`, {
+    endpoint: ENDPOINT_PATH,
+    ip: callerIp,
+    outcome: "ok",
+    domains: records.length
+  });
+  return withOriginHeader(
+    NextResponse.json({
+      ok: true,
+      domains: records.map((r) => ({
+        hostname: r.hostname,
+        tenantId: r.tenantId,
+        organizationId: r.organizationId,
+        orgSlug: r.orgSlug,
+        status: r.status
+      }))
+    })
+  );
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "Batch resolve all active custom domains",
+  methods: {
+    GET: {
+      summary: "Batch warm-up for the Node middleware",
+      description: "Returns every active domain mapping in a single payload so the middleware can populate its cache on process start. Requires X-Domain-Resolve-Secret header.",
+      responses: [
+        {
+          status: 200,
+          description: "OK",
+          schema: z.object({
+            ok: z.literal(true),
+            domains: z.array(
+              z.object({
+                hostname: z.string(),
+                tenantId: z.string().uuid(),
+                organizationId: z.string().uuid(),
+                orgSlug: z.string().nullable(),
+                status: z.literal("active")
+              })
+            )
+          })
+        }
+      ],
+      errors: [
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 429, description: "Too many requests", schema: rateLimitErrorSchema },
+        { status: 503, description: "Server misconfiguration", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=all.js.map

package/dist/modules/customer_accounts/api/domain-resolve/all.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/customer_accounts/api/domain-resolve/all.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  domainResolveAllIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\n\nconst ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'\nconst LOG_PREFIX = '[domain-resolve/all]'\nconst ENDPOINT_PATH = '/api/customer_accounts/domain-resolve/all'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nfunction withOriginHeader(response: NextResponse): NextResponse {\n  response.headers.set(ORIGIN_HEADER_NAME, '1')\n  return response\n}\n\nfunction readCallerIp(req: Request): string {\n  const forwardedFor = req.headers.get('x-forwarded-for')\n  if (forwardedFor) {\n    const firstHop = forwardedFor.split(',')[0]?.trim()\n    if (firstHop) return firstHop\n  }\n  const realIp = req.headers.get('x-real-ip')\n  if (realIp && realIp.trim().length > 0) return realIp.trim()\n  return 'unknown'\n}\n\nexport async function GET(req: Request) {\n  const callerIp = readCallerIp(req)\n  const expected = process.env.DOMAIN_RESOLVE_SECRET\n  if (!expected) {\n    // Fail closed when the gating secret is not configured on the server.\n    console.warn(`${LOG_PREFIX} rejected request \u2014 secret not configured`, {\n      endpoint: ENDPOINT_PATH,\n      ip: callerIp,\n      outcome: 'misconfigured',\n    })\n    return withOriginHeader(\n      NextResponse.json(\n        { ok: false, error: 'DOMAIN_RESOLVE_SECRET is not configured on the server' },\n        { status: 503 },\n      ),\n    )\n  }\n\n  // Rate-limit by caller IP before the secret comparison to make leak-driven\n  // enumeration noisy and bounded. Fails closed (returns the helper's 429\n  // response) when the limit is exceeded.\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: domainResolveAllIpRateLimitConfig,\n  })\n  if (rateLimitError) {\n    console.warn(`${LOG_PREFIX} rate-limited`, {\n      endpoint: ENDPOINT_PATH,\n      ip: callerIp,\n      outcome: 'rate_limited',\n    })\n    return withOriginHeader(rateLimitError)\n  }\n\n  const supplied = req.headers.get('x-domain-resolve-secret')\n  if (!secretEqual(supplied, expected)) {\n    console.warn(`${LOG_PREFIX} rejected request \u2014 invalid secret`, {\n      endpoint: ENDPOINT_PATH,\n      ip: callerIp,\n      outcome: 'forbidden',\n    })\n    return withOriginHeader(NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 }))\n  }\n\n  const container = await createRequestContainer()\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const records = await service.resolveAll()\n  console.info(`${LOG_PREFIX} authorized`, {\n    endpoint: ENDPOINT_PATH,\n    ip: callerIp,\n    outcome: 'ok',\n    domains: records.length,\n  })\n  return withOriginHeader(\n    NextResponse.json({\n      ok: true,\n      domains: records.map((r) => ({\n        hostname: r.hostname,\n        tenantId: r.tenantId,\n        organizationId: r.organizationId,\n        orgSlug: r.orgSlug,\n        status: r.status,\n      })),\n    }),\n  )\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Batch resolve all active custom domains',\n  methods: {\n    GET: {\n      summary: 'Batch warm-up for the Node middleware',\n      description:\n        'Returns every active domain mapping in a single payload so the middleware can populate its cache on process start. Requires X-Domain-Resolve-Secret header.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK',\n          schema: z.object({\n            ok: z.literal(true),\n            domains: z.array(\n              z.object({\n                hostname: z.string(),\n                tenantId: z.string().uuid(),\n                organizationId: z.string().uuid(),\n                orgSlug: z.string().nullable(),\n                status: z.literal('active'),\n              }),\n            ),\n          }),\n        },\n      ],\n      errors: [\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n        { status: 503, description: 'Server misconfiguration', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,mBAAmB;AAE5B,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP,MAAM,qBAAqB,QAAQ,IAAI,iCAAiC;AACxE,MAAM,aAAa;AACnB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,SAAS,iBAAiB,UAAsC;AAC9D,WAAS,QAAQ,IAAI,oBAAoB,GAAG;AAC5C,SAAO;AACT;AAEA,SAAS,aAAa,KAAsB;AAC1C,QAAM,eAAe,IAAI,QAAQ,IAAI,iBAAiB;AACtD,MAAI,cAAc;AAChB,UAAM,WAAW,aAAa,MAAM,GAAG,EAAE,CAAC,GAAG,KAAK;AAClD,QAAI,SAAU,QAAO;AAAA,EACvB;AACA,QAAM,SAAS,IAAI,QAAQ,IAAI,WAAW;AAC1C,MAAI,UAAU,OAAO,KAAK,EAAE,SAAS,EAAG,QAAO,OAAO,KAAK;AAC3D,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,aAAa,GAAG;AACjC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AAEb,YAAQ,KAAK,GAAG,UAAU,kDAA6C;AAAA,MACrE,UAAU;AAAA,MACV,IAAI;AAAA,MACJ,SAAS;AAAA,IACX,CAAC;AACD,WAAO;AAAA,MACL,aAAa;AAAA,QACX,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,QAC5E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAKA,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,EACZ,CAAC;AACD,MAAI,gBAAgB;AAClB,YAAQ,KAAK,GAAG,UAAU,iBAAiB;AAAA,MACzC,UAAU;AAAA,MACV,IAAI;AAAA,MACJ,SAAS;AAAA,IACX,CAAC;AACD,WAAO,iBAAiB,cAAc;AAAA,EACxC;AAEA,QAAM,WAAW,IAAI,QAAQ,IAAI,yBAAyB;AAC1D,MAAI,CAAC,YAAY,UAAU,QAAQ,GAAG;AACpC,YAAQ,KAAK,GAAG,UAAU,2CAAsC;AAAA,MAC9D,UAAU;AAAA,MACV,IAAI;AAAA,MACJ,SAAS;AAAA,IACX,CAAC;AACD,WAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAC/F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,UAAU,MAAM,QAAQ,WAAW;AACzC,UAAQ,KAAK,GAAG,UAAU,eAAe;AAAA,IACvC,UAAU;AAAA,IACV,IAAI;AAAA,IACJ,SAAS;AAAA,IACT,SAAS,QAAQ;AAAA,EACnB,CAAC;AACD,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,MAChB,IAAI;AAAA,MACJ,SAAS,QAAQ,IAAI,CAAC,OAAO;AAAA,QAC3B,UAAU,EAAE;AAAA,QACZ,UAAU,EAAE;AAAA,QACZ,gBAAgB,EAAE;AAAA,QAClB,SAAS,EAAE;AAAA,QACX,QAAQ,EAAE;AAAA,MACZ,EAAE;AAAA,IACJ,CAAC;AAAA,EACH;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,SAAS,EAAE;AAAA,cACT,EAAE,OAAO;AAAA,gBACP,UAAU,EAAE,OAAO;AAAA,gBACnB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,gBAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,gBAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,gBAC7B,QAAQ,EAAE,QAAQ,QAAQ;AAAA,cAC5B,CAAC;AAAA,YACH;AAAA,UACF,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,QAC9E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/domain-resolve.js

@@ -0,0 +1,84 @@
+import { NextResponse } from "next/server";
+import { z } from "zod";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { tryNormalizeHostname } from "@open-mercato/core/modules/customer_accounts/lib/hostname";
+import { secretEqual } from "@open-mercato/core/modules/customer_accounts/lib/secretCompare";
+const ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? "X-Open-Mercato-Origin";
+const metadata = {
+  GET: { requireAuth: false }
+};
+function withOriginHeader(response) {
+  response.headers.set(ORIGIN_HEADER_NAME, "1");
+  return response;
+}
+async function GET(req) {
+  const expected = process.env.DOMAIN_RESOLVE_SECRET;
+  if (!expected) {
+    return withOriginHeader(
+      NextResponse.json(
+        { ok: false, error: "DOMAIN_RESOLVE_SECRET is not configured on the server" },
+        { status: 503 }
+      )
+    );
+  }
+  const supplied = req.headers.get("x-domain-resolve-secret");
+  if (!secretEqual(supplied, expected)) {
+    return withOriginHeader(NextResponse.json({ ok: false, error: "Forbidden" }, { status: 403 }));
+  }
+  const url = new URL(req.url);
+  const rawHost = url.searchParams.get("host");
+  if (!rawHost) return withOriginHeader(NextResponse.json({ ok: false, error: "host param required" }, { status: 400 }));
+  const hostname = tryNormalizeHostname(rawHost);
+  if (!hostname) return withOriginHeader(NextResponse.json({ ok: false, error: "invalid host" }, { status: 400 }));
+  const container = await createRequestContainer();
+  const service = container.resolve("domainMappingService");
+  const result = await service.resolveByHostname(hostname);
+  if (!result || result.status !== "active") {
+    return withOriginHeader(NextResponse.json({ ok: false, error: "Not found" }, { status: 404 }));
+  }
+  return withOriginHeader(
+    NextResponse.json({
+      ok: true,
+      tenantId: result.tenantId,
+      organizationId: result.organizationId,
+      orgSlug: result.orgSlug,
+      status: result.status
+    })
+  );
+}
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() });
+const openApi = {
+  tag: "CustomerAccounts",
+  summary: "Resolve a custom domain to its tenant and organization",
+  methods: {
+    GET: {
+      summary: "Single-host resolve for the Node middleware",
+      description: "Internal endpoint used by the portal middleware to populate its in-memory cache. Requires X-Domain-Resolve-Secret header.",
+      responses: [
+        {
+          status: 200,
+          description: "OK",
+          schema: z.object({
+            ok: z.literal(true),
+            tenantId: z.string().uuid(),
+            organizationId: z.string().uuid(),
+            orgSlug: z.string().nullable(),
+            status: z.literal("active")
+          })
+        }
+      ],
+      errors: [
+        { status: 400, description: "Bad request", schema: errorSchema },
+        { status: 403, description: "Forbidden", schema: errorSchema },
+        { status: 404, description: "Not found", schema: errorSchema },
+        { status: 503, description: "Server misconfiguration", schema: errorSchema }
+      ]
+    }
+  }
+};
+export {
+  GET,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=domain-resolve.js.map

package/dist/modules/customer_accounts/api/domain-resolve.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/api/domain-resolve.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nconst ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nfunction withOriginHeader(response: NextResponse): NextResponse {\n  response.headers.set(ORIGIN_HEADER_NAME, '1')\n  return response\n}\n\nexport async function GET(req: Request) {\n  const expected = process.env.DOMAIN_RESOLVE_SECRET\n  if (!expected) {\n    // Fail closed when the gating secret is not configured on the server.\n    return withOriginHeader(\n      NextResponse.json(\n        { ok: false, error: 'DOMAIN_RESOLVE_SECRET is not configured on the server' },\n        { status: 503 },\n      ),\n    )\n  }\n  const supplied = req.headers.get('x-domain-resolve-secret')\n  if (!secretEqual(supplied, expected)) {\n    return withOriginHeader(NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 }))\n  }\n\n  const url = new URL(req.url)\n  const rawHost = url.searchParams.get('host')\n  if (!rawHost) return withOriginHeader(NextResponse.json({ ok: false, error: 'host param required' }, { status: 400 }))\n  const hostname = tryNormalizeHostname(rawHost)\n  if (!hostname) return withOriginHeader(NextResponse.json({ ok: false, error: 'invalid host' }, { status: 400 }))\n\n  const container = await createRequestContainer()\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const result = await service.resolveByHostname(hostname)\n  if (!result || result.status !== 'active') {\n    return withOriginHeader(NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 }))\n  }\n\n  return withOriginHeader(\n    NextResponse.json({\n      ok: true,\n      tenantId: result.tenantId,\n      organizationId: result.organizationId,\n      orgSlug: result.orgSlug,\n      status: result.status,\n    }),\n  )\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Resolve a custom domain to its tenant and organization',\n  methods: {\n    GET: {\n      summary: 'Single-host resolve for the Node middleware',\n      description:\n        'Internal endpoint used by the portal middleware to populate its in-memory cache. Requires X-Domain-Resolve-Secret header.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK',\n          schema: z.object({\n            ok: z.literal(true),\n            tenantId: z.string().uuid(),\n            organizationId: z.string().uuid(),\n            orgSlug: z.string().nullable(),\n            status: z.literal('active'),\n          }),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Bad request', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 404, description: 'Not found', schema: errorSchema },\n        { status: 503, description: 'Server misconfiguration', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAG5B,MAAM,qBAAqB,QAAQ,IAAI,iCAAiC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,SAAS,iBAAiB,UAAsC;AAC9D,WAAS,QAAQ,IAAI,oBAAoB,GAAG;AAC5C,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AAEb,WAAO;AAAA,MACL,aAAa;AAAA,QACX,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,QAC5E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,IAAI,QAAQ,IAAI,yBAAyB;AAC1D,MAAI,CAAC,YAAY,UAAU,QAAQ,GAAG;AACpC,WAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAC/F;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,IAAI,aAAa,IAAI,MAAM;AAC3C,MAAI,CAAC,QAAS,QAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AACrH,QAAM,WAAW,qBAAqB,OAAO;AAC7C,MAAI,CAAC,SAAU,QAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAE/G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,SAAS,MAAM,QAAQ,kBAAkB,QAAQ;AACvD,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,WAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAC/F;AAEA,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,MAChB,IAAI;AAAA,MACJ,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,YAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,YAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,QAAQ,EAAE,QAAQ,QAAQ;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,YAAY;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/login.js

@@ -11,6 +11,10 @@ import {
   customerLoginRateLimitConfig,
   customerLoginIpRateLimitConfig
 } from "@open-mercato/core/modules/customer_accounts/lib/rateLimiter";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 const metadata = { requireAuth: false };
 async function POST(req) {
   let body;
@@ -23,9 +27,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: false, error: "Invalid credentials" }, { status: 400 });
   }
-  const { email, password, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: false, error: "tenantId is required" }, { status: 400 });
+  const { email, password } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: false, error: err.message }, { status: err.status });
+    }
+    throw err;
   }
   const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({
     req,

package/dist/modules/customer_accounts/api/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { loginSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  resetAuthRateLimit,\n  customerLoginRateLimitConfig,\n  customerLoginIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = loginSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid credentials' }, { status: 400 })\n  }\n\n  const { email, password, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: false, error: 'tenantId is required' }, { status: 400 })\n  }\n\n  const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerLoginIpRateLimitConfig,\n    compoundConfig: customerLoginRateLimitConfig,\n    compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (!user || !user.passwordHash) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.isActive) {\n    return NextResponse.json({ ok: false, error: 'Account is deactivated' }, { status: 401 })\n  }\n\n  if (customerUserService.checkLockout(user)) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Account is temporarily locked. Please try again later.' }, { status: 423 })\n  }\n\n  const passwordValid = await customerUserService.verifyPassword(user, password)\n  if (!passwordValid) {\n    await customerUserService.incrementFailedAttempts(user)\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.emailVerifiedAt) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', {\n      email,\n      reason: 'email_not_verified',\n      tenantId,\n    }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  await customerUserService.resetFailedAttempts(user)\n  await customerUserService.updateLastLoginAt(user)\n\n  if (compoundKey) {\n    await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)\n  }\n\n  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })\n  const resolvedFeatures = acl.features\n\n  const ip = getClientIp(req, 0)\n  const userAgent = req.headers.get('user-agent') || null\n  const { rawToken, jwt, session } = await customerSessionService.createSession(user, resolvedFeatures, ip, userAgent)\n\n  void emitCustomerAccountsEvent('customer_accounts.login.success', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId: user.organizationId,\n  }).catch(() => undefined)\n\n  const res = NextResponse.json({\n    ok: true,\n    user: {\n      id: user.id,\n      email: user.email,\n      displayName: user.displayName,\n      emailVerified: !!user.emailVerifiedAt,\n    },\n    resolvedFeatures,\n  })\n\n  res.cookies.set('customer_auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n  res.cookies.set('customer_session_token', rawToken, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 24 * 30,\n  })\n\n  return res\n}\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({\n    id: z.string().uuid(),\n    email: z.string().email(),\n    displayName: z.string(),\n    emailVerified: z.boolean(),\n  }),\n  resolvedFeatures: z.array(z.string()),\n})\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate customer credentials',\n  description: 'Validates customer credentials and issues JWT + session cookies.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: loginSchema,\n    description: 'Login payload with email and password.',\n  },\n  responses: [\n    { status: 200, description: 'Login successful', schema: loginSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Invalid credentials', schema: errorSchema },\n    { status: 423, description: 'Account locked', schema: errorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer login',\n  description: 'Handles customer authentication and session issuance.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAIvC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,YAAY,UAAU,IAAI;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,UAAU,SAAS,IAAI,OAAO;AAC7C,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,EAAE,OAAO,gBAAgB,YAAY,IAAI,MAAM,mBAAmB;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AACzE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,CAAC,QAAQ,CAAC,KAAK,cAAc;AAC/B,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,uBAAuB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1I,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI,oBAAoB,aAAa,IAAI,GAAG;AAC1C,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7H,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yDAAyD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AAEA,QAAM,gBAAgB,MAAM,oBAAoB,eAAe,MAAM,QAAQ;AAC7E,MAAI,CAAC,eAAe;AAClB,UAAM,oBAAoB,wBAAwB,IAAI;AACtD,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,oBAAoB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AACvI,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,iBAAiB;AACzB,SAAK,0BAA0B,kCAAkC;AAAA,MAC/D;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,QAAM,oBAAoB,oBAAoB,IAAI;AAClD,QAAM,oBAAoB,kBAAkB,IAAI;AAEhD,MAAI,aAAa;AACf,UAAM,mBAAmB,aAAa,4BAA4B;AAAA,EACpE;AAEA,QAAM,MAAM,MAAM,oBAAoB,QAAQ,KAAK,IAAI,EAAE,UAAU,gBAAgB,KAAK,eAAe,CAAC;AACxG,QAAM,mBAAmB,IAAI;AAE7B,QAAM,KAAK,YAAY,KAAK,CAAC;AAC7B,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,QAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,uBAAuB,cAAc,MAAM,kBAAkB,IAAI,SAAS;AAEnH,OAAK,0BAA0B,mCAAmC;AAAA,IAChE,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,QAAQ,IAAI,uBAAuB,KAAK;AAAA,IAC1C,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,QAAQ,IAAI,0BAA0B,UAAU;AAAA,IAClD,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,QAAQ;AAAA,EAC3B,CAAC;AAAA,EACD,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { loginSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  resetAuthRateLimit,\n  customerLoginRateLimitConfig,\n  customerLoginIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = loginSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid credentials' }, { status: 400 })\n  }\n\n  const { email, password } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })\n    }\n    throw err\n  }\n\n  const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerLoginIpRateLimitConfig,\n    compoundConfig: customerLoginRateLimitConfig,\n    compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (!user || !user.passwordHash) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.isActive) {\n    return NextResponse.json({ ok: false, error: 'Account is deactivated' }, { status: 401 })\n  }\n\n  if (customerUserService.checkLockout(user)) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Account is temporarily locked. Please try again later.' }, { status: 423 })\n  }\n\n  const passwordValid = await customerUserService.verifyPassword(user, password)\n  if (!passwordValid) {\n    await customerUserService.incrementFailedAttempts(user)\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.emailVerifiedAt) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', {\n      email,\n      reason: 'email_not_verified',\n      tenantId,\n    }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  await customerUserService.resetFailedAttempts(user)\n  await customerUserService.updateLastLoginAt(user)\n\n  if (compoundKey) {\n    await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)\n  }\n\n  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })\n  const resolvedFeatures = acl.features\n\n  const ip = getClientIp(req, 0)\n  const userAgent = req.headers.get('user-agent') || null\n  const { rawToken, jwt, session } = await customerSessionService.createSession(user, resolvedFeatures, ip, userAgent)\n\n  void emitCustomerAccountsEvent('customer_accounts.login.success', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId: user.organizationId,\n  }).catch(() => undefined)\n\n  const res = NextResponse.json({\n    ok: true,\n    user: {\n      id: user.id,\n      email: user.email,\n      displayName: user.displayName,\n      emailVerified: !!user.emailVerifiedAt,\n    },\n    resolvedFeatures,\n  })\n\n  res.cookies.set('customer_auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n  res.cookies.set('customer_session_token', rawToken, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 24 * 30,\n  })\n\n  return res\n}\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({\n    id: z.string().uuid(),\n    email: z.string().email(),\n    displayName: z.string(),\n    emailVerified: z.boolean(),\n  }),\n  resolvedFeatures: z.array(z.string()),\n})\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate customer credentials',\n  description: 'Validates customer credentials and issues JWT + session cookies.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: loginSchema,\n    description: 'Login payload with email and password.',\n  },\n  responses: [\n    { status: 200, description: 'Login successful', schema: loginSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Invalid credentials', schema: errorSchema },\n    { status: 423, description: 'Account locked', schema: errorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer login',\n  description: 'Handles customer authentication and session issuance.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAIvC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,YAAY,UAAU,IAAI;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACpF;AACA,UAAM;AAAA,EACR;AAEA,QAAM,EAAE,OAAO,gBAAgB,YAAY,IAAI,MAAM,mBAAmB;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AACzE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,CAAC,QAAQ,CAAC,KAAK,cAAc;AAC/B,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,uBAAuB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1I,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI,oBAAoB,aAAa,IAAI,GAAG;AAC1C,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7H,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yDAAyD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AAEA,QAAM,gBAAgB,MAAM,oBAAoB,eAAe,MAAM,QAAQ;AAC7E,MAAI,CAAC,eAAe;AAClB,UAAM,oBAAoB,wBAAwB,IAAI;AACtD,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,oBAAoB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AACvI,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,iBAAiB;AACzB,SAAK,0BAA0B,kCAAkC;AAAA,MAC/D;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,QAAM,oBAAoB,oBAAoB,IAAI;AAClD,QAAM,oBAAoB,kBAAkB,IAAI;AAEhD,MAAI,aAAa;AACf,UAAM,mBAAmB,aAAa,4BAA4B;AAAA,EACpE;AAEA,QAAM,MAAM,MAAM,oBAAoB,QAAQ,KAAK,IAAI,EAAE,UAAU,gBAAgB,KAAK,eAAe,CAAC;AACxG,QAAM,mBAAmB,IAAI;AAE7B,QAAM,KAAK,YAAY,KAAK,CAAC;AAC7B,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,QAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,uBAAuB,cAAc,MAAM,kBAAkB,IAAI,SAAS;AAEnH,OAAK,0BAA0B,mCAAmC;AAAA,IAChE,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,QAAQ,IAAI,uBAAuB,KAAK;AAAA,IAC1C,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,QAAQ,IAAI,0BAA0B,UAAU;AAAA,IAClD,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,QAAQ;AAAA,EAC3B,CAAC;AAAA,EACD,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/magic-link/request.js

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { magicLinkRequestSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 import {
@@ -29,9 +33,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: true });
   }
-  const { email, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: true });
+  const { email } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: true });
+    }
+    throw err;
   }
   const container = await createRequestContainer();
   const customerUserService = container.resolve("customerUserService");

package/dist/modules/customer_accounts/api/magic-link/request.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/magic-link/request.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { magicLinkRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerMagicLinkRateLimitConfig,\n  customerMagicLinkIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerMagicLinkIpRateLimitConfig,\n    compoundConfig: customerMagicLinkRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true })\n  }\n\n  const parsed = magicLinkRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const { email, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createMagicLink(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.magic_link.requested', {\n        userId: user.id,\n        tenantId,\n        organizationId: user.organizationId,\n      })\n    ).catch(() => undefined)\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request magic link login',\n  description: 'Sends a magic link to the customer email. Always returns 200 to prevent enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: magicLinkRequestSchema,\n    description: 'Magic link request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Request customer magic link',\n  description: 'Handles magic link login requests for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,gBAAgB,KAAK,IAAI,QAAQ;AAG5D,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,0CAA0C;AAAA,QAClE,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { magicLinkRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerMagicLinkRateLimitConfig,\n  customerMagicLinkIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerMagicLinkIpRateLimitConfig,\n    compoundConfig: customerMagicLinkRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true })\n  }\n\n  const parsed = magicLinkRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const { email } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: true })\n    }\n    throw err\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createMagicLink(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.magic_link.requested', {\n        userId: user.id,\n        tenantId,\n        organizationId: user.organizationId,\n      })\n    ).catch(() => undefined)\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request magic link login',\n  description: 'Sends a magic link to the customer email. Always returns 200 to prevent enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: magicLinkRequestSchema,\n    description: 'Magic link request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Request customer magic link',\n  description: 'Handles magic link login requests for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,MAAM,IAAI,OAAO;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AACA,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,gBAAgB,KAAK,IAAI,QAAQ;AAG5D,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,0CAA0C;AAAA,QAClE,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/password/reset-request.js

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { passwordResetRequestSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 import {
@@ -29,9 +33,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: true });
   }
-  const { email, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: true });
+  const { email } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: true });
+    }
+    throw err;
   }
   const container = await createRequestContainer();
   const customerUserService = container.resolve("customerUserService");

package/dist/modules/customer_accounts/api/password/reset-request.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/password/reset-request.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerPasswordResetRateLimitConfig,\n  customerPasswordResetIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerPasswordResetIpRateLimitConfig,\n    compoundConfig: customerPasswordResetRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true }) // Always 200\n  }\n\n  const parsed = passwordResetRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true }) // Always 200 to prevent enumeration\n  }\n\n  const { email, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createPasswordReset(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.password_reset.requested', {\n        userId: user.id,\n        tenantId,\n      })\n    ).catch(() => undefined)\n  }\n\n  // Always return 200 to prevent email enumeration\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request customer password reset',\n  description: 'Initiates a password reset flow. Always returns 200 to prevent email enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetRequestSchema,\n    description: 'Password reset request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer password reset request',\n  description: 'Handles password reset initiation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,oBAAoB,KAAK,IAAI,QAAQ;AAGhE,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,8CAA8C;AAAA,QACtE,QAAQ,KAAK;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAGA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerPasswordResetRateLimitConfig,\n  customerPasswordResetIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerPasswordResetIpRateLimitConfig,\n    compoundConfig: customerPasswordResetRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true }) // Always 200\n  }\n\n  const parsed = passwordResetRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true }) // Always 200 to prevent enumeration\n  }\n\n  const { email } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      // Always return 200 to avoid leaking whether a tenant exists for this host.\n      return NextResponse.json({ ok: true })\n    }\n    throw err\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createPasswordReset(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.password_reset.requested', {\n        userId: user.id,\n        tenantId,\n      })\n    ).catch(() => undefined)\n  }\n\n  // Always return 200 to prevent email enumeration\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request customer password reset',\n  description: 'Initiates a password reset flow. Always returns 200 to prevent email enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetRequestSchema,\n    description: 'Password reset request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer password reset request',\n  description: 'Handles password reset initiation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,MAAM,IAAI,OAAO;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AAExC,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AACA,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,oBAAoB,KAAK,IAAI,QAAQ;AAGhE,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,8CAA8C;AAAA,QACtE,QAAQ,KAAK;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAGA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/signup.js

@@ -18,6 +18,11 @@ import {
 import { readNormalizedEmailFromJsonRequest } from "@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier";
 import { findOrganizationInTenant } from "@open-mercato/core/modules/customer_accounts/lib/organizationLookup";
 import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from "@open-mercato/shared/lib/url";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
+import { urlForCustomerOrg } from "@open-mercato/core/modules/customer_accounts/lib/customerUrl";
 const metadata = { requireAuth: false };
 const TIMING_EQUALIZATION_HASH = "$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i";
 function resolvePortalLoginUrl(baseUrl, organizationSlug) {
@@ -46,9 +51,21 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: false, error: "Validation failed", details: parsed.error.flatten().fieldErrors }, { status: 400 });
   }
-  const { email, password, displayName, tenantId, organizationId } = parsed.data;
-  if (!tenantId || !organizationId) {
-    return NextResponse.json({ ok: false, error: "tenantId and organizationId are required" }, { status: 400 });
+  const { email, password, displayName } = parsed.data;
+  let tenantId;
+  let organizationId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+    organizationId = context.organizationId ?? parsed.data.organizationId ?? null;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: false, error: err.message }, { status: err.status });
+    }
+    throw err;
+  }
+  if (!organizationId) {
+    return NextResponse.json({ ok: false, error: "organizationId is required" }, { status: 400 });
   }
   let baseUrl;
   try {
@@ -74,7 +91,11 @@ async function POST(req) {
   if (existing) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH);
     const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId);
-    const loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null);
+    let loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null);
+    try {
+      loginUrl = await urlForCustomerOrg(existing.organizationId, "/login", { container });
+    } catch {
+    }
     const subject2 = translate("customer_accounts.signup.existing.subject", "You already have a portal account");
     const copy2 = {
       preview: translate("customer_accounts.signup.existing.preview", "A sign-up attempt was made for an email that already has a portal account."),
@@ -114,7 +135,13 @@ async function POST(req) {
   }
   await em.persist(user).flush();
   const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId);
-  const verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug);
+  let verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug);
+  try {
+    verifyUrl = await urlForCustomerOrg(organizationId, `/verify?token=${encodeURIComponent(verificationToken)}`, {
+      container
+    });
+  } catch {
+  }
   const subject = translate("customer_accounts.signup.created.subject", "Verify your portal account");
   const copy = {
     preview: translate("customer_accounts.signup.created.preview", "Verify your portal account to finish sign-up."),