@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3287.1.450f4ffb56

package/generated/entities/domain_mapping/index.ts

@@ -0,0 +1,14 @@
+export const id = "id";
+export const hostname = "hostname";
+export const tenant_id = "tenant_id";
+export const organization_id = "organization_id";
+export const replaces_domain = "replaces_domain";
+export const provider = "provider";
+export const status = "status";
+export const verified_at = "verified_at";
+export const last_dns_check_at = "last_dns_check_at";
+export const dns_failure_reason = "dns_failure_reason";
+export const tls_failure_reason = "tls_failure_reason";
+export const tls_retry_count = "tls_retry_count";
+export const created_at = "created_at";
+export const updated_at = "updated_at";

package/generated/entities.ids.generated.ts

@@ -262,7 +262,8 @@ export const M = {
       "customer_user_session": "customer_accounts:customer_user_session",
       "customer_user_email_verification": "customer_accounts:customer_user_email_verification",
       "customer_user_password_reset": "customer_accounts:customer_user_password_reset",
-      "customer_user_invitation": "customer_accounts:customer_user_invitation"
+      "customer_user_invitation": "customer_accounts:customer_user_invitation",
+      "domain_mapping": "customer_accounts:domain_mapping"
     }
   } as const;
 

package/generated/entity-fields-registry.ts

@@ -985,6 +985,22 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "created_at": "created_at",
       "updated_at": "updated_at"
     },
+    "domain_mapping": {
+      "id": "id",
+      "hostname": "hostname",
+      "tenant_id": "tenant_id",
+      "organization_id": "organization_id",
+      "replaces_domain": "replaces_domain",
+      "provider": "provider",
+      "status": "status",
+      "verified_at": "verified_at",
+      "last_dns_check_at": "last_dns_check_at",
+      "dns_failure_reason": "dns_failure_reason",
+      "tls_failure_reason": "tls_failure_reason",
+      "tls_retry_count": "tls_retry_count",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
     "encryption_map": {
       "id": "id",
       "entity_id": "entity_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.1-develop.3276.1.1fcd145078",
+  "version": "0.6.1-develop.3287.1.450f4ffb56",
   "type": "module",
   "main": "./dist/index.js",
   "scripts": {
@@ -237,12 +237,12 @@
     "ts-pattern": "^5.0.0"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.1-develop.3276.1.1fcd145078",
-    "@open-mercato/shared": "0.6.1-develop.3276.1.1fcd145078"
+    "@open-mercato/ai-assistant": "0.6.1-develop.3287.1.450f4ffb56",
+    "@open-mercato/shared": "0.6.1-develop.3287.1.450f4ffb56"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.1-develop.3276.1.1fcd145078",
-    "@open-mercato/shared": "0.6.1-develop.3276.1.1fcd145078",
+    "@open-mercato/ai-assistant": "0.6.1-develop.3287.1.450f4ffb56",
+    "@open-mercato/shared": "0.6.1-develop.3287.1.450f4ffb56",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/auth.ts

@@ -207,7 +207,7 @@ export async function login(page: Page, role: Role = 'admin'): Promise<void> {
   }
   await page.getByLabel('Email').fill(creds.email);
 
-  const passwordInput = page.getByLabel('Password').first();
+  const passwordInput = page.getByLabel('Password', { exact: true }).first();
   if (await passwordInput.isVisible().catch(() => false)) {
     await passwordInput.fill(creds.password);
     await passwordInput.press('Enter');

package/src/helpers/integration/authUi.ts

@@ -37,6 +37,6 @@ export async function createUserViaUi(page: Page, input: { email: string; passwo
 
   await page.getByRole('button', { name: 'Create' }).first().click();
   await expect(page).toHaveURL(/\/backend\/users(?:\?.*)?$/);
-  await page.getByRole('textbox', { name: 'Search', exact: true }).fill(input.email);
+  await page.getByRole('searchbox', { name: 'Search', exact: true }).fill(input.email);
   await expect(page.getByRole('row', { name: new RegExp(input.email, 'i') })).toBeVisible();
 }

package/src/helpers/integration/salesUi.ts

@@ -94,10 +94,6 @@ function parseCurrencyAmount(value: string): number {
   return Number.parseFloat(lastMatch.replace('$', ''));
 }
 
-function normalizeAdjustmentKindValue(kindLabel: string): string {
-  return kindLabel.trim().toLowerCase().replace(/\s+/g, '_');
-}
-
 function readId(payload: unknown, keys: string[]): string | null {
   if (!payload || typeof payload !== 'object') return null;
   const map = payload as Record<string, unknown>;
@@ -1099,32 +1095,40 @@ export async function addAdjustment(page: Page, options: AddAdjustmentOptions):
     // Radix Select trigger — target by CrudForm field id (kind picker)
     const kindTrigger = dialog.locator('[data-crud-field-id="kind"] [role="combobox"]').first();
     await expect(kindTrigger).toBeVisible({ timeout: TEST_WAIT_TIMEOUT_MS });
-
-    const labelInput = dialog.getByPlaceholder(/e\.g\. Shipping fee/i).first();
-    await expect(labelInput).toBeVisible({ timeout: TEST_WAIT_TIMEOUT_MS });
-    // Bumped toHaveValue timeout 2 s → 5 s — covers the worst-case reset race
-    // where the tax-rates fetch resolves *after* the networkidle window above
-    // (e.g. when a slow Docker host bundles the requests inconsistently).
-    await fillControlledInput(labelInput, options.label, 5_000);
-
-    if ((await kindTrigger.count()) > 0) {
-      const expectedKindValue = normalizeAdjustmentKindValue(options.kindLabel ?? 'Surcharge');
-      const kindLabel = options.kindLabel ?? 'Surcharge';
-      await kindTrigger.click();
-      const option = page.getByRole('option', { name: new RegExp(`^${escapeRegExp(kindLabel)}$`, 'i') }).first();
-      const optionVisible = await option.waitFor({ state: 'visible', timeout: 2_000 }).then(
-        () => true,
-        () => false,
+    const kindLabel = options.kindLabel ?? 'Surcharge';
+    const selectKindOption = async (): Promise<void> => {
+      if ((await kindTrigger.count()) === 0) return;
+      await waitForOptionalTextToDisappear(
+        dialog,
+        /Loading adjustment kinds…|Loading adjustment kinds\.\.\./i,
+        TEST_WAIT_TIMEOUT_MS,
       );
+      await expect(kindTrigger).toBeEnabled({ timeout: TEST_WAIT_TIMEOUT_MS });
+      await kindTrigger.click();
+      const kindOption = page.getByRole('option', { name: new RegExp(`^${escapeRegExp(kindLabel)}$`, 'i') }).first();
+      const optionVisible = await kindOption
+        .waitFor({ state: 'visible', timeout: TEST_WAIT_TIMEOUT_MS })
+        .then(() => true, () => false);
       if (optionVisible) {
-        await option.click({ force: true });
+        await kindOption.click({ force: true });
       } else {
+        // Fallback: drive selection via keyboard when modal-backdrop click interception
+        // hides the rendered option. Brought forward from develop.
         await page.keyboard.type(kindLabel.charAt(0));
         await page.waitForTimeout(150);
         await page.keyboard.press('Enter');
       }
-      void expectedKindValue;
-    }
+      await expect(kindTrigger).toContainText(kindLabel, { timeout: 2_000 });
+    };
+
+    // Select kind first — the Radix Select interaction can trigger CrudForm re-renders that
+    // clear inputs filled before it, so we run the dropdown sequence up front and then fill
+    // the remaining fields once.
+    await selectKindOption();
+
+    const labelInput = dialog.getByPlaceholder(/e\.g\. Shipping fee/i).first();
+    await expect(labelInput).toBeVisible({ timeout: TEST_WAIT_TIMEOUT_MS });
+    await fillControlledInput(labelInput, options.label);
 
     const fixedAmountButton = dialog.getByRole('button', { name: /^Fixed amount$/i }).first();
     if ((await fixedAmountButton.count()) > 0) {

package/src/modules/auth/frontend/login.tsx

@@ -6,6 +6,8 @@ import Link from 'next/link'
 import { useRouter, useSearchParams } from 'next/navigation'
 import { Card, CardContent, CardHeader, CardDescription } from '@open-mercato/ui/primitives/card'
 import { Input } from '@open-mercato/ui/primitives/input'
+import { EmailInput } from '@open-mercato/ui/primitives/email-input'
+import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -352,10 +354,9 @@ export default function LoginPage() {
               )}
               <div className="grid gap-1">
                 <Label htmlFor="email">{t('auth.email')}</Label>
-                <Input
+                <EmailInput
                   id="email"
                   name="email"
-                  type="email"
                   required
                   aria-invalid={!!error}
                   onChange={(e) => setEmail(e.target.value)}
@@ -369,7 +370,7 @@ export default function LoginPage() {
               {authOverride?.hidePassword ? null : (
                 <div className="grid gap-1">
                   <Label htmlFor="password">{t('auth.password')}</Label>
-                  <Input id="password" name="password" type="password" required={!authOverride} aria-invalid={!!error} />
+                  <PasswordInput id="password" name="password" required={!authOverride} aria-invalid={!!error} autoComplete="current-password" />
                 </div>
               )}
               {!authOverride?.hideRememberMe && !authOverride?.hidePassword && (

package/src/modules/auth/frontend/reset/[token]/page.tsx

@@ -1,7 +1,7 @@
 "use client"
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Input } from '@open-mercato/ui/primitives/input'
+import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { useState } from 'react'
 import { useRouter } from 'next/navigation'
@@ -69,19 +69,19 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
             {error && <div className="text-sm text-status-error-text">{error}</div>}
             <div className="grid gap-1">
               <Label htmlFor="password">{t('auth.reset.form.password', 'New password')}</Label>
-              <Input id="password" name="password" type="password" required minLength={passwordPolicy.minLength} />
+              <PasswordInput id="password" name="password" required minLength={passwordPolicy.minLength} autoComplete="new-password" />
               {passwordDescription ? (
                 <p className="text-xs text-muted-foreground">{passwordDescription}</p>
               ) : null}
             </div>
             <div className="grid gap-1">
               <Label htmlFor="confirmPassword">{t('auth.profile.form.confirmPassword', 'Confirm new password')}</Label>
-              <Input
+              <PasswordInput
                 id="confirmPassword"
                 name="confirmPassword"
-                type="password"
                 required
                 minLength={passwordPolicy.minLength}
+                autoComplete="new-password"
               />
             </div>
             <Button type="submit" className="mt-2 w-full" disabled={submitting}>

package/src/modules/auth/frontend/reset.tsx

@@ -3,7 +3,7 @@ import { useState } from 'react'
 import Link from 'next/link'
 import { Card, CardContent, CardHeader, CardTitle, CardDescription } from '@open-mercato/ui/primitives/card'
 import { Button } from '@open-mercato/ui/primitives/button'
-import { Input } from '@open-mercato/ui/primitives/input'
+import { EmailInput } from '@open-mercato/ui/primitives/email-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 
@@ -59,7 +59,7 @@ export default function ResetPage() {
               {error && <div className="text-sm text-red-600">{error}</div>}
               <div className="grid gap-1">
                 <Label htmlFor="email">{t('auth.email')}</Label>
-                <Input id="email" name="email" type="email" required aria-invalid={!!fieldError} aria-describedby={fieldError ? 'email-error' : undefined} />
+                <EmailInput id="email" name="email" required aria-invalid={!!fieldError} aria-describedby={fieldError ? 'email-error' : undefined} />
                 {fieldError && <p id="email-error" className="text-sm text-red-600">{fieldError}</p>}
               </div>
               <Button type="submit" className="mt-2 w-full" disabled={submitting}>

package/src/modules/customer_accounts/acl.ts

@@ -3,6 +3,7 @@ export const features = [
   { id: 'customer_accounts.manage', title: 'Manage customer accounts', module: 'customer_accounts' },
   { id: 'customer_accounts.roles.manage', title: 'Manage customer roles', module: 'customer_accounts' },
   { id: 'customer_accounts.invite', title: 'Invite customer users', module: 'customer_accounts' },
+  { id: 'customer_accounts.domain.manage', title: 'Manage custom portal domains', module: 'customer_accounts' },
 ]
 
 export default features

package/src/modules/customer_accounts/api/admin/domain-mappings/[id]/health-check.ts

@@ -0,0 +1,119 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+const FEATURE = 'customer_accounts.domain.manage'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: [FEATURE] },
+}
+
+export async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+
+  const container = await createRequestContainer()
+  const rbac = container.resolve('rbacService') as RbacService
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+
+  const { id } = await ctx.params
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const record = await service.findById(id, { tenantId: auth.tenantId })
+  if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+    userId: auth.sub,
+    resourceKind: 'customer_accounts.domain_mapping',
+    resourceId: id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  let updated
+  try {
+    updated = await service.healthCheck(id)
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : 'Health check failed' },
+      { status: 500 },
+    )
+  }
+
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: record.organizationId,
+      userId: auth.sub,
+      resourceKind: 'customer_accounts.domain_mapping',
+      resourceId: id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
+  return NextResponse.json({
+    ok: true,
+    domainMapping: {
+      id: updated.id,
+      hostname: updated.hostname,
+      status: updated.status,
+      tlsRetryCount: updated.tlsRetryCount,
+      tlsFailureReason: updated.tlsFailureReason ?? null,
+    },
+  })
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'TLS health check for a custom domain mapping',
+  methods: {
+    POST: {
+      summary: 'Trigger TLS health check',
+      description:
+        'Runs an HTTPS probe to verify Traefik has provisioned a certificate. On success: transitions the mapping to active.',
+      responses: [
+        {
+          status: 200,
+          description: 'OK',
+          schema: z.object({
+            ok: z.literal(true),
+            domainMapping: z.object({
+              id: z.string().uuid(),
+              hostname: z.string(),
+              status: z.string(),
+              tlsRetryCount: z.number().int().nonnegative(),
+              tlsFailureReason: z.string().nullable(),
+            }),
+          }),
+        },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 404, description: 'Not found', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/customer_accounts/api/admin/domain-mappings/[id]/verify.ts

@@ -0,0 +1,123 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import {
+  validateCrudMutationGuard,
+  runCrudMutationGuardAfterSuccess,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
+
+const FEATURE = 'customer_accounts.domain.manage'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: [FEATURE] },
+}
+
+export async function POST(req: Request, ctx: { params: Promise<{ id: string }> }) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })
+
+  const container = await createRequestContainer()
+  const rbac = container.resolve('rbacService') as RbacService
+  const allowed = await rbac.userHasAllFeatures(auth.sub, [FEATURE], {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
+  if (!allowed) return NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 })
+
+  const { id } = await ctx.params
+  const service = container.resolve('domainMappingService') as DomainMappingService
+  const record = await service.findById(id, { tenantId: auth.tenantId })
+  if (!record) return NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 })
+
+  const guardResult = await validateCrudMutationGuard(container, {
+    tenantId: auth.tenantId,
+    organizationId: record.organizationId,
+    userId: auth.sub,
+    resourceKind: 'customer_accounts.domain_mapping',
+    resourceId: id,
+    operation: 'update',
+    requestMethod: req.method,
+    requestHeaders: req.headers,
+  })
+  if (guardResult && !guardResult.ok) {
+    return NextResponse.json(guardResult.body, { status: guardResult.status })
+  }
+
+  let result
+  try {
+    result = await service.verify(id)
+  } catch (err) {
+    return NextResponse.json(
+      { ok: false, error: err instanceof Error ? err.message : 'DNS verification failed' },
+      { status: 500 },
+    )
+  }
+
+  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+    await runCrudMutationGuardAfterSuccess(container, {
+      tenantId: auth.tenantId,
+      organizationId: record.organizationId,
+      userId: auth.sub,
+      resourceKind: 'customer_accounts.domain_mapping',
+      resourceId: id,
+      operation: 'update',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      metadata: guardResult.metadata ?? null,
+    })
+  }
+
+  return NextResponse.json({
+    ok: true,
+    domainMapping: {
+      id: result.domainMapping.id,
+      hostname: result.domainMapping.hostname,
+      status: result.domainMapping.status,
+      verifiedAt: result.domainMapping.verifiedAt?.toISOString() ?? null,
+      lastDnsCheckAt: result.domainMapping.lastDnsCheckAt?.toISOString() ?? null,
+      dnsFailureReason: result.domainMapping.dnsFailureReason ?? null,
+    },
+    diagnostics: result.diagnostics ?? null,
+  })
+}
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'CustomerAccounts',
+  summary: 'Verify a custom domain mapping (DNS check)',
+  methods: {
+    POST: {
+      summary: 'Trigger DNS verification',
+      description:
+        'Runs DNS verification (CNAME → A → reverse-resolve fallback) for the domain mapping. Returns diagnostics on failure.',
+      responses: [
+        {
+          status: 200,
+          description: 'OK — see status',
+          schema: z.object({
+            ok: z.literal(true),
+            domainMapping: z.object({
+              id: z.string().uuid(),
+              hostname: z.string(),
+              status: z.string(),
+              verifiedAt: z.string().nullable(),
+              lastDnsCheckAt: z.string().nullable(),
+              dnsFailureReason: z.string().nullable(),
+            }),
+            diagnostics: z.unknown().nullable(),
+          }),
+        },
+      ],
+      errors: [
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 403, description: 'Forbidden', schema: errorSchema },
+        { status: 404, description: 'Not found', schema: errorSchema },
+      ],
+    },
+  },
+}