npm - @open-mercato/core - Versions diffs - 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3287.1.450f4ffb56 - Mend

@open-mercato/core 0.6.1-develop.3276.1.1fcd145078 → 0.6.1-develop.3287.1.450f4ffb56

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (266) hide show

package/dist/modules/customer_accounts/api/domain-resolve.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/modules/customer_accounts/api/domain-resolve.ts"],
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { secretEqual } from '@open-mercato/core/modules/customer_accounts/lib/secretCompare'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\n\nconst ORIGIN_HEADER_NAME = process.env.CUSTOMER_DOMAIN_ORIGIN_HEADER ?? 'X-Open-Mercato-Origin'\n\nexport const metadata = {\n  GET: { requireAuth: false },\n}\n\nfunction withOriginHeader(response: NextResponse): NextResponse {\n  response.headers.set(ORIGIN_HEADER_NAME, '1')\n  return response\n}\n\nexport async function GET(req: Request) {\n  const expected = process.env.DOMAIN_RESOLVE_SECRET\n  if (!expected) {\n    // Fail closed when the gating secret is not configured on the server.\n    return withOriginHeader(\n      NextResponse.json(\n        { ok: false, error: 'DOMAIN_RESOLVE_SECRET is not configured on the server' },\n        { status: 503 },\n      ),\n    )\n  }\n  const supplied = req.headers.get('x-domain-resolve-secret')\n  if (!secretEqual(supplied, expected)) {\n    return withOriginHeader(NextResponse.json({ ok: false, error: 'Forbidden' }, { status: 403 }))\n  }\n\n  const url = new URL(req.url)\n  const rawHost = url.searchParams.get('host')\n  if (!rawHost) return withOriginHeader(NextResponse.json({ ok: false, error: 'host param required' }, { status: 400 }))\n  const hostname = tryNormalizeHostname(rawHost)\n  if (!hostname) return withOriginHeader(NextResponse.json({ ok: false, error: 'invalid host' }, { status: 400 }))\n\n  const container = await createRequestContainer()\n  const service = container.resolve('domainMappingService') as DomainMappingService\n  const result = await service.resolveByHostname(hostname)\n  if (!result || result.status !== 'active') {\n    return withOriginHeader(NextResponse.json({ ok: false, error: 'Not found' }, { status: 404 }))\n  }\n\n  return withOriginHeader(\n    NextResponse.json({\n      ok: true,\n      tenantId: result.tenantId,\n      organizationId: result.organizationId,\n      orgSlug: result.orgSlug,\n      status: result.status,\n    }),\n  )\n}\n\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'CustomerAccounts',\n  summary: 'Resolve a custom domain to its tenant and organization',\n  methods: {\n    GET: {\n      summary: 'Single-host resolve for the Node middleware',\n      description:\n        'Internal endpoint used by the portal middleware to populate its in-memory cache. Requires X-Domain-Resolve-Secret header.',\n      responses: [\n        {\n          status: 200,\n          description: 'OK',\n          schema: z.object({\n            ok: z.literal(true),\n            tenantId: z.string().uuid(),\n            organizationId: z.string().uuid(),\n            orgSlug: z.string().nullable(),\n            status: z.literal('active'),\n          }),\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Bad request', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n        { status: 404, description: 'Not found', schema: errorSchema },\n        { status: 503, description: 'Server misconfiguration', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAG5B,MAAM,qBAAqB,QAAQ,IAAI,iCAAiC;AAEjE,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM;AAC5B;AAEA,SAAS,iBAAiB,UAAsC;AAC9D,WAAS,QAAQ,IAAI,oBAAoB,GAAG;AAC5C,SAAO;AACT;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,QAAQ,IAAI;AAC7B,MAAI,CAAC,UAAU;AAEb,WAAO;AAAA,MACL,aAAa;AAAA,QACX,EAAE,IAAI,OAAO,OAAO,wDAAwD;AAAA,QAC5E,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AACA,QAAM,WAAW,IAAI,QAAQ,IAAI,yBAAyB;AAC1D,MAAI,CAAC,YAAY,UAAU,QAAQ,GAAG;AACpC,WAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAC/F;AAEA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,UAAU,IAAI,aAAa,IAAI,MAAM;AAC3C,MAAI,CAAC,QAAS,QAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AACrH,QAAM,WAAW,qBAAqB,OAAO;AAC7C,MAAI,CAAC,SAAU,QAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAE/G,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,QAAM,SAAS,MAAM,QAAQ,kBAAkB,QAAQ;AACvD,MAAI,CAAC,UAAU,OAAO,WAAW,UAAU;AACzC,WAAO,iBAAiB,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC,CAAC;AAAA,EAC/F;AAEA,SAAO;AAAA,IACL,aAAa,KAAK;AAAA,MAChB,IAAI;AAAA,MACJ,UAAU,OAAO;AAAA,MACjB,gBAAgB,OAAO;AAAA,MACvB,SAAS,OAAO;AAAA,MAChB,QAAQ,OAAO;AAAA,IACjB,CAAC;AAAA,EACH;AACF;AAEA,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAEjE,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ,EAAE,OAAO;AAAA,YACf,IAAI,EAAE,QAAQ,IAAI;AAAA,YAClB,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,YAC1B,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,YAChC,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,YAC7B,QAAQ,EAAE,QAAQ,QAAQ;AAAA,UAC5B,CAAC;AAAA,QACH;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,YAAY;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,QAC7D,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,MAC7E;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/customer_accounts/api/login.js CHANGED Viewed

@@ -11,6 +11,10 @@ import {
   customerLoginRateLimitConfig,
   customerLoginIpRateLimitConfig
 } from "@open-mercato/core/modules/customer_accounts/lib/rateLimiter";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 const metadata = { requireAuth: false };
 async function POST(req) {
   let body;
@@ -23,9 +27,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: false, error: "Invalid credentials" }, { status: 400 });
   }
-  const { email, password, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: false, error: "tenantId is required" }, { status: 400 });
+  const { email, password } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: false, error: err.message }, { status: err.status });
+    }
+    throw err;
   }
   const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({
     req,

package/dist/modules/customer_accounts/api/login.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { loginSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  resetAuthRateLimit,\n  customerLoginRateLimitConfig,\n  customerLoginIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = loginSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid credentials' }, { status: 400 })\n  }\n\n  const { email, password, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: false, error: 'tenantId is required' }, { status: 400 })\n  }\n\n  const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerLoginIpRateLimitConfig,\n    compoundConfig: customerLoginRateLimitConfig,\n    compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (!user || !user.passwordHash) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.isActive) {\n    return NextResponse.json({ ok: false, error: 'Account is deactivated' }, { status: 401 })\n  }\n\n  if (customerUserService.checkLockout(user)) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Account is temporarily locked. Please try again later.' }, { status: 423 })\n  }\n\n  const passwordValid = await customerUserService.verifyPassword(user, password)\n  if (!passwordValid) {\n    await customerUserService.incrementFailedAttempts(user)\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.emailVerifiedAt) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', {\n      email,\n      reason: 'email_not_verified',\n      tenantId,\n    }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  await customerUserService.resetFailedAttempts(user)\n  await customerUserService.updateLastLoginAt(user)\n\n  if (compoundKey) {\n    await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)\n  }\n\n  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })\n  const resolvedFeatures = acl.features\n\n  const ip = getClientIp(req, 0)\n  const userAgent = req.headers.get('user-agent') || null\n  const { rawToken, jwt, session } = await customerSessionService.createSession(user, resolvedFeatures, ip, userAgent)\n\n  void emitCustomerAccountsEvent('customer_accounts.login.success', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId: user.organizationId,\n  }).catch(() => undefined)\n\n  const res = NextResponse.json({\n    ok: true,\n    user: {\n      id: user.id,\n      email: user.email,\n      displayName: user.displayName,\n      emailVerified: !!user.emailVerifiedAt,\n    },\n    resolvedFeatures,\n  })\n\n  res.cookies.set('customer_auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n  res.cookies.set('customer_session_token', rawToken, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 24 * 30,\n  })\n\n  return res\n}\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({\n    id: z.string().uuid(),\n    email: z.string().email(),\n    displayName: z.string(),\n    emailVerified: z.boolean(),\n  }),\n  resolvedFeatures: z.array(z.string()),\n})\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate customer credentials',\n  description: 'Validates customer credentials and issues JWT + session cookies.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: loginSchema,\n    description: 'Login payload with email and password.',\n  },\n  responses: [\n    { status: 200, description: 'Login successful', schema: loginSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Invalid credentials', schema: errorSchema },\n    { status: 423, description: 'Account locked', schema: errorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer login',\n  description: 'Handles customer authentication and session issuance.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAIvC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,YAAY,UAAU,IAAI;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,UAAU,SAAS,IAAI,OAAO;AAC7C,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,EAAE,OAAO,gBAAgB,YAAY,IAAI,MAAM,mBAAmB;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AACzE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,CAAC,QAAQ,CAAC,KAAK,cAAc;AAC/B,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,uBAAuB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1I,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI,oBAAoB,aAAa,IAAI,GAAG;AAC1C,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7H,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yDAAyD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AAEA,QAAM,gBAAgB,MAAM,oBAAoB,eAAe,MAAM,QAAQ;AAC7E,MAAI,CAAC,eAAe;AAClB,UAAM,oBAAoB,wBAAwB,IAAI;AACtD,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,oBAAoB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AACvI,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,iBAAiB;AACzB,SAAK,0BAA0B,kCAAkC;AAAA,MAC/D;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,QAAM,oBAAoB,oBAAoB,IAAI;AAClD,QAAM,oBAAoB,kBAAkB,IAAI;AAEhD,MAAI,aAAa;AACf,UAAM,mBAAmB,aAAa,4BAA4B;AAAA,EACpE;AAEA,QAAM,MAAM,MAAM,oBAAoB,QAAQ,KAAK,IAAI,EAAE,UAAU,gBAAgB,KAAK,eAAe,CAAC;AACxG,QAAM,mBAAmB,IAAI;AAE7B,QAAM,KAAK,YAAY,KAAK,CAAC;AAC7B,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,QAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,uBAAuB,cAAc,MAAM,kBAAkB,IAAI,SAAS;AAEnH,OAAK,0BAA0B,mCAAmC;AAAA,IAChE,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,QAAQ,IAAI,uBAAuB,KAAK;AAAA,IAC1C,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,QAAQ,IAAI,0BAA0B,UAAU;AAAA,IAClD,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,QAAQ;AAAA,EAC3B,CAAC;AAAA,EACD,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { loginSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  resetAuthRateLimit,\n  customerLoginRateLimitConfig,\n  customerLoginIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = loginSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid credentials' }, { status: 400 })\n  }\n\n  const { email, password } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })\n    }\n    throw err\n  }\n\n  const { error: rateLimitError, compoundKey } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerLoginIpRateLimitConfig,\n    compoundConfig: customerLoginRateLimitConfig,\n    compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (!user || !user.passwordHash) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_credentials', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.isActive) {\n    return NextResponse.json({ ok: false, error: 'Account is deactivated' }, { status: 401 })\n  }\n\n  if (customerUserService.checkLockout(user)) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'locked', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Account is temporarily locked. Please try again later.' }, { status: 423 })\n  }\n\n  const passwordValid = await customerUserService.verifyPassword(user, password)\n  if (!passwordValid) {\n    await customerUserService.incrementFailedAttempts(user)\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', { email, reason: 'invalid_password', tenantId }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  if (!user.emailVerifiedAt) {\n    void emitCustomerAccountsEvent('customer_accounts.login.failed', {\n      email,\n      reason: 'email_not_verified',\n      tenantId,\n    }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: 'Invalid email or password' }, { status: 401 })\n  }\n\n  await customerUserService.resetFailedAttempts(user)\n  await customerUserService.updateLastLoginAt(user)\n\n  if (compoundKey) {\n    await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)\n  }\n\n  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })\n  const resolvedFeatures = acl.features\n\n  const ip = getClientIp(req, 0)\n  const userAgent = req.headers.get('user-agent') || null\n  const { rawToken, jwt, session } = await customerSessionService.createSession(user, resolvedFeatures, ip, userAgent)\n\n  void emitCustomerAccountsEvent('customer_accounts.login.success', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId: user.organizationId,\n  }).catch(() => undefined)\n\n  const res = NextResponse.json({\n    ok: true,\n    user: {\n      id: user.id,\n      email: user.email,\n      displayName: user.displayName,\n      emailVerified: !!user.emailVerifiedAt,\n    },\n    resolvedFeatures,\n  })\n\n  res.cookies.set('customer_auth_token', jwt, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 8,\n  })\n  res.cookies.set('customer_session_token', rawToken, {\n    httpOnly: true,\n    path: '/',\n    sameSite: 'lax',\n    secure: process.env.NODE_ENV === 'production',\n    maxAge: 60 * 60 * 24 * 30,\n  })\n\n  return res\n}\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({\n    id: z.string().uuid(),\n    email: z.string().email(),\n    displayName: z.string(),\n    emailVerified: z.boolean(),\n  }),\n  resolvedFeatures: z.array(z.string()),\n})\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate customer credentials',\n  description: 'Validates customer credentials and issues JWT + session cookies.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: loginSchema,\n    description: 'Login payload with email and password.',\n  },\n  responses: [\n    { status: 200, description: 'Login successful', schema: loginSuccessSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Invalid credentials', schema: errorSchema },\n    { status: 423, description: 'Account locked', schema: errorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer login',\n  description: 'Handles customer authentication and session issuance.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,mBAAmB;AAC5B,SAAS,8BAA8B;AAIvC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B;AACrC,SAAS,mBAAmB;AAC5B;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,YAAY,UAAU,IAAI;AACzC,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sBAAsB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvF;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACpF;AACA,UAAM;AAAA,EACR;AAEA,QAAM,EAAE,OAAO,gBAAgB,YAAY,IAAI,MAAM,mBAAmB;AAAA,IACtE;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AACzE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,CAAC,QAAQ,CAAC,KAAK,cAAc;AAC/B,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,uBAAuB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1I,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,UAAU;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI,oBAAoB,aAAa,IAAI,GAAG;AAC1C,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,UAAU,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AAC7H,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yDAAyD,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1H;AAEA,QAAM,gBAAgB,MAAM,oBAAoB,eAAe,MAAM,QAAQ;AAC7E,MAAI,CAAC,eAAe;AAClB,UAAM,oBAAoB,wBAAwB,IAAI;AACtD,SAAK,0BAA0B,kCAAkC,EAAE,OAAO,QAAQ,oBAAoB,SAAS,CAAC,EAAE,MAAM,MAAM,MAAS;AACvI,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,MAAI,CAAC,KAAK,iBAAiB;AACzB,SAAK,0BAA0B,kCAAkC;AAAA,MAC/D;AAAA,MACA,QAAQ;AAAA,MACR;AAAA,IACF,CAAC,EAAE,MAAM,MAAM,MAAS;AACxB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC7F;AAEA,QAAM,oBAAoB,oBAAoB,IAAI;AAClD,QAAM,oBAAoB,kBAAkB,IAAI;AAEhD,MAAI,aAAa;AACf,UAAM,mBAAmB,aAAa,4BAA4B;AAAA,EACpE;AAEA,QAAM,MAAM,MAAM,oBAAoB,QAAQ,KAAK,IAAI,EAAE,UAAU,gBAAgB,KAAK,eAAe,CAAC;AACxG,QAAM,mBAAmB,IAAI;AAE7B,QAAM,KAAK,YAAY,KAAK,CAAC;AAC7B,QAAM,YAAY,IAAI,QAAQ,IAAI,YAAY,KAAK;AACnD,QAAM,EAAE,UAAU,KAAK,QAAQ,IAAI,MAAM,uBAAuB,cAAc,MAAM,kBAAkB,IAAI,SAAS;AAEnH,OAAK,0BAA0B,mCAAmC;AAAA,IAChE,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,QAAM,MAAM,aAAa,KAAK;AAAA,IAC5B,IAAI;AAAA,IACJ,MAAM;AAAA,MACJ,IAAI,KAAK;AAAA,MACT,OAAO,KAAK;AAAA,MACZ,aAAa,KAAK;AAAA,MAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACxB;AAAA,IACA;AAAA,EACF,CAAC;AAED,MAAI,QAAQ,IAAI,uBAAuB,KAAK;AAAA,IAC1C,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK;AAAA,EACpB,CAAC;AACD,MAAI,QAAQ,IAAI,0BAA0B,UAAU;AAAA,IAClD,UAAU;AAAA,IACV,MAAM;AAAA,IACN,UAAU;AAAA,IACV,QAAQ,QAAQ,IAAI,aAAa;AAAA,IACjC,QAAQ,KAAK,KAAK,KAAK;AAAA,EACzB,CAAC;AAED,SAAO;AACT;AAEA,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO;AAAA,IACb,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,MAAM;AAAA,IACxB,aAAa,EAAE,OAAO;AAAA,IACtB,eAAe,EAAE,QAAQ;AAAA,EAC3B,CAAC;AAAA,EACD,kBAAkB,EAAE,MAAM,EAAE,OAAO,CAAC;AACtC,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,mBAAmB;AAAA,EAC7E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,YAAY;AAAA,IACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/magic-link/request.js CHANGED Viewed

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { magicLinkRequestSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 import {
@@ -29,9 +33,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: true });
   }
-  const { email, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: true });
+  const { email } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: true });
+    }
+    throw err;
   }
   const container = await createRequestContainer();
   const customerUserService = container.resolve("customerUserService");

package/dist/modules/customer_accounts/api/magic-link/request.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/magic-link/request.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { magicLinkRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerMagicLinkRateLimitConfig,\n  customerMagicLinkIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerMagicLinkIpRateLimitConfig,\n    compoundConfig: customerMagicLinkRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true })\n  }\n\n  const parsed = magicLinkRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const { email, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createMagicLink(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.magic_link.requested', {\n        userId: user.id,\n        tenantId,\n        organizationId: user.organizationId,\n      })\n    ).catch(() => undefined)\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request magic link login',\n  description: 'Sends a magic link to the customer email. Always returns 200 to prevent enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: magicLinkRequestSchema,\n    description: 'Magic link request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Request customer magic link',\n  description: 'Handles magic link login requests for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,gBAAgB,KAAK,IAAI,QAAQ;AAG5D,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,0CAA0C;AAAA,QAClE,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { magicLinkRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerMagicLinkRateLimitConfig,\n  customerMagicLinkIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerMagicLinkIpRateLimitConfig,\n    compoundConfig: customerMagicLinkRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true })\n  }\n\n  const parsed = magicLinkRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const { email } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: true })\n    }\n    throw err\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createMagicLink(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.magic_link.requested', {\n        userId: user.id,\n        tenantId,\n        organizationId: user.organizationId,\n      })\n    ).catch(() => undefined)\n  }\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request magic link login',\n  description: 'Sends a magic link to the customer email. Always returns 200 to prevent enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: magicLinkRequestSchema,\n    description: 'Magic link request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Request customer magic link',\n  description: 'Handles magic link login requests for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,uBAAuB,UAAU,IAAI;AACpD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,MAAM,IAAI,OAAO;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AACA,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,gBAAgB,KAAK,IAAI,QAAQ;AAG5D,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,0CAA0C;AAAA,QAClE,QAAQ,KAAK;AAAA,QACb;AAAA,QACA,gBAAgB,KAAK;AAAA,MACvB,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/password/reset-request.js CHANGED Viewed

@@ -1,6 +1,10 @@
 import { NextResponse } from "next/server";
 import { z } from "zod";
 import { passwordResetRequestSchema } from "@open-mercato/core/modules/customer_accounts/data/validators";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
 import {
@@ -29,9 +33,16 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: true });
   }
-  const { email, tenantId } = parsed.data;
-  if (!tenantId) {
-    return NextResponse.json({ ok: true });
+  const { email } = parsed.data;
+  let tenantId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: true });
+    }
+    throw err;
   }
   const container = await createRequestContainer();
   const customerUserService = container.resolve("customerUserService");

package/dist/modules/customer_accounts/api/password/reset-request.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/password/reset-request.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerPasswordResetRateLimitConfig,\n  customerPasswordResetIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerPasswordResetIpRateLimitConfig,\n    compoundConfig: customerPasswordResetRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true }) // Always 200\n  }\n\n  const parsed = passwordResetRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true }) // Always 200 to prevent enumeration\n  }\n\n  const { email, tenantId } = parsed.data\n  if (!tenantId) {\n    return NextResponse.json({ ok: true })\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createPasswordReset(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.password_reset.requested', {\n        userId: user.id,\n        tenantId,\n      })\n    ).catch(() => undefined)\n  }\n\n  // Always return 200 to prevent email enumeration\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request customer password reset',\n  description: 'Initiates a password reset flow. Always returns 200 to prevent email enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetRequestSchema,\n    description: 'Password reset request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer password reset request',\n  description: 'Handles password reset initiation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,OAAO,SAAS,IAAI,OAAO;AACnC,MAAI,CAAC,UAAU;AACb,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,oBAAoB,KAAK,IAAI,QAAQ;AAGhE,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,8CAA8C;AAAA,QACtE,QAAQ,KAAK;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAGA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetRequestSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerPasswordResetRateLimitConfig,\n  customerPasswordResetIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerPasswordResetIpRateLimitConfig,\n    compoundConfig: customerPasswordResetRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: true }) // Always 200\n  }\n\n  const parsed = passwordResetRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: true }) // Always 200 to prevent enumeration\n  }\n\n  const { email } = parsed.data\n  let tenantId: string\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      // Always return 200 to avoid leaking whether a tenant exists for this host.\n      return NextResponse.json({ ok: true })\n    }\n    throw err\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n\n  const user = await customerUserService.findByEmail(email, tenantId)\n  if (user) {\n    await customerTokenService.createPasswordReset(user.id, tenantId)\n    // Token is stored in DB; email delivery should be handled by a direct service call,\n    // NOT via the event bus \u2014 raw tokens must never travel through events.\n    void import('@open-mercato/core/modules/customer_accounts/events').then(({ emitCustomerAccountsEvent }) =>\n      emitCustomerAccountsEvent('customer_accounts.password_reset.requested', {\n        userId: user.id,\n        tenantId,\n      })\n    ).catch(() => undefined)\n  }\n\n  // Always return 200 to prevent email enumeration\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Request customer password reset',\n  description: 'Initiates a password reset flow. Always returns 200 to prevent email enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetRequestSchema,\n    description: 'Password reset request with email.',\n  },\n  responses: [\n    { status: 200, description: 'Request accepted', schema: successSchema },\n  ],\n  errors: [\n    { status: 429, description: 'Too many requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer password reset request',\n  description: 'Handles password reset initiation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,8BAA8B;AAGvC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,EACvC;AAEA,QAAM,EAAE,MAAM,IAAI,OAAO;AACzB,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AAAA,EACrB,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AAExC,aAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AAAA,IACvC;AACA,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AAErE,QAAM,OAAO,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AAClE,MAAI,MAAM;AACR,UAAM,qBAAqB,oBAAoB,KAAK,IAAI,QAAQ;AAGhE,SAAK,OAAO,qDAAqD,EAAE;AAAA,MAAK,CAAC,EAAE,0BAA0B,MACnG,0BAA0B,8CAA8C;AAAA,QACtE,QAAQ,KAAK;AAAA,QACb;AAAA,MACF,CAAC;AAAA,IACH,EAAE,MAAM,MAAM,MAAS;AAAA,EACzB;AAGA,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAEtD,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,cAAc;AAAA,EACxE;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,qBAAqB;AAAA,EAChF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/signup.js CHANGED Viewed

@@ -18,6 +18,11 @@ import {
 import { readNormalizedEmailFromJsonRequest } from "@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier";
 import { findOrganizationInTenant } from "@open-mercato/core/modules/customer_accounts/lib/organizationLookup";
 import { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from "@open-mercato/shared/lib/url";
+import {
+  resolveTenantContext,
+  TenantResolutionError
+} from "@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext";
+import { urlForCustomerOrg } from "@open-mercato/core/modules/customer_accounts/lib/customerUrl";
 const metadata = { requireAuth: false };
 const TIMING_EQUALIZATION_HASH = "$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i";
 function resolvePortalLoginUrl(baseUrl, organizationSlug) {
@@ -46,9 +51,21 @@ async function POST(req) {
   if (!parsed.success) {
     return NextResponse.json({ ok: false, error: "Validation failed", details: parsed.error.flatten().fieldErrors }, { status: 400 });
   }
-  const { email, password, displayName, tenantId, organizationId } = parsed.data;
-  if (!tenantId || !organizationId) {
-    return NextResponse.json({ ok: false, error: "tenantId and organizationId are required" }, { status: 400 });
+  const { email, password, displayName } = parsed.data;
+  let tenantId;
+  let organizationId;
+  try {
+    const context = await resolveTenantContext(req, parsed.data.tenantId);
+    tenantId = context.tenantId;
+    organizationId = context.organizationId ?? parsed.data.organizationId ?? null;
+  } catch (err) {
+    if (err instanceof TenantResolutionError) {
+      return NextResponse.json({ ok: false, error: err.message }, { status: err.status });
+    }
+    throw err;
+  }
+  if (!organizationId) {
+    return NextResponse.json({ ok: false, error: "organizationId is required" }, { status: 400 });
   }
   let baseUrl;
   try {
@@ -74,7 +91,11 @@ async function POST(req) {
   if (existing) {
     await bcryptCompare(password, TIMING_EQUALIZATION_HASH);
     const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId);
-    const loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null);
+    let loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null);
+    try {
+      loginUrl = await urlForCustomerOrg(existing.organizationId, "/login", { container });
+    } catch {
+    }
     const subject2 = translate("customer_accounts.signup.existing.subject", "You already have a portal account");
     const copy2 = {
       preview: translate("customer_accounts.signup.existing.preview", "A sign-up attempt was made for an email that already has a portal account."),
@@ -114,7 +135,13 @@ async function POST(req) {
   }
   await em.persist(user).flush();
   const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId);
-  const verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug);
+  let verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug);
+  try {
+    verifyUrl = await urlForCustomerOrg(organizationId, `/verify?token=${encodeURIComponent(verificationToken)}`, {
+      container
+    });
+  } catch {
+  }
   const subject = translate("customer_accounts.signup.created.subject", "Verify your portal account");
   const copy = {
     preview: translate("customer_accounts.signup.created.preview", "Verify your portal account to finish sign-up."),

package/dist/modules/customer_accounts/api/signup.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/api/signup.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { compare as bcryptCompare } from 'bcryptjs'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { signupSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRole, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport CustomerSignupVerificationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerSignupVerificationEmail'\nimport CustomerExistingAccountEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerExistingAccountEmail'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerSignupRateLimitConfig,\n  customerSignupIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\n// Precomputed bcrypt cost-10 hash of an unknowable random 32-byte input; used to equalize\n// response latency between the existing-user and new-user signup branches so the endpoint's\n// 202-for-both contract is not undone by a timing side channel.\nconst TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'\nfunction resolvePortalLoginUrl(baseUrl: string, organizationSlug?: string | null): string {\n  return organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/login`\n    : `${baseUrl}/portal/login`\n}\n\nfunction resolvePortalVerifyUrl(baseUrl: string, token: string, organizationSlug?: string | null): string {\n  const route = organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/verify`\n    : `${baseUrl}/portal/verify`\n  return `${route}?token=${encodeURIComponent(token)}`\n}\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerSignupIpRateLimitConfig,\n    compoundConfig: customerSignupRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = signupSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const { email, password, displayName, tenantId, organizationId } = parsed.data\n  if (!tenantId || !organizationId) {\n    return NextResponse.json({ ok: false, error: 'tenantId and organizationId are required' }, { status: 400 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'customer_accounts.signup',\n      configMessage: 'Customer signup is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const { translate } = await resolveTranslations()\n\n  const orgRow = await findOrganizationInTenant(em, organizationId, tenantId)\n  if (!orgRow) {\n    return NextResponse.json({ ok: false, error: 'Registration could not be completed' }, { status: 400 })\n  }\n\n  const existing = await customerUserService.findByEmail(email, tenantId)\n  if (existing) {\n    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)\n    const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId)\n    const loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null)\n    const subject = translate('customer_accounts.signup.existing.subject', 'You already have a portal account')\n    const copy = {\n      preview: translate('customer_accounts.signup.existing.preview', 'A sign-up attempt was made for an email that already has a portal account.'),\n      title: translate('customer_accounts.signup.existing.title', 'You already have a portal account'),\n      body: translate(\n        'customer_accounts.signup.existing.body',\n        'A sign-up request was made for this email address. You can sign in with your existing account. If you forgot your password, use the password reset option on the sign-in page.',\n      ),\n      cta: translate('customer_accounts.signup.existing.cta', 'Open sign-in page'),\n      hint: translate(\n        'customer_accounts.signup.existing.hint',\n        'If this was not you, you can ignore this message. No new portal account was created.',\n      ),\n    }\n\n    void sendEmail({\n      to: existing.email,\n      subject,\n      react: CustomerExistingAccountEmail({ loginUrl, copy }),\n    }).catch((error) => {\n      console.error('[customer_accounts.signup] existing-account email failed', error)\n    })\n\n    return NextResponse.json({ ok: true }, { status: 202 })\n  }\n\n  const user = await customerUserService.createUser(email, password, displayName, { tenantId, organizationId })\n\n  const defaultRole = await em.findOne(CustomerRole, {\n    tenantId,\n    isDefault: true,\n    deletedAt: null,\n  })\n  if (defaultRole) {\n    const userRole = em.create(CustomerUserRole, {\n      user,\n      role: defaultRole,\n      createdAt: new Date(),\n    } as any)\n    em.persist(userRole)\n  }\n\n  await em.persist(user).flush()\n\n  const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId)\n  const verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug)\n  const subject = translate('customer_accounts.signup.created.subject', 'Verify your portal account')\n  const copy = {\n    preview: translate('customer_accounts.signup.created.preview', 'Verify your portal account to finish sign-up.'),\n    title: translate('customer_accounts.signup.created.title', 'Verify your portal account'),\n    body: translate(\n      'customer_accounts.signup.created.body',\n      'Your account request was accepted. Confirm your email address to finish setting up portal access.',\n    ),\n    cta: translate('customer_accounts.signup.created.cta', 'Verify email address'),\n    hint: translate(\n      'customer_accounts.signup.created.hint',\n      'This verification link expires in 24 hours. If you did not request this, you can ignore this email.',\n    ),\n  }\n\n  void sendEmail({\n    to: user.email,\n    subject,\n    react: CustomerSignupVerificationEmail({ verifyUrl, copy }),\n  }).catch((error) => {\n    console.error('[customer_accounts.signup] verification email failed', error)\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true }, { status: 202 })\n}\n\nconst signupAcceptedSchema = z.object({ ok: z.literal(true) })\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Register a new customer account',\n  description: 'Accepts a signup request and always returns 202 to prevent account enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: signupSchema,\n    description: 'Signup payload with email, password, and display name.',\n  },\n  responses: [\n    { status: 202, description: 'Signup accepted', schema: signupAcceptedSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or invalid request origin', schema: errorSchema },\n    { status: 429, description: 'Too many signup attempts', schema: rateLimitErrorSchema },\n    { status: 500, description: 'Signup email origin is not configured', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer account registration',\n  description: 'Handles customer self-registration without revealing whether the email already exists.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAGvC,SAAS,cAAc,wBAAwB;AAC/C,SAAS,iCAAiC;AAC1C,OAAO,qCAAqC;AAC5C,OAAO,kCAAkC;AACzC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,gCAAgC;AAE3D,MAAM,WAAqD,EAAE,aAAa,MAAM;AAKvF,MAAM,2BAA2B;AACjC,SAAS,sBAAsB,SAAiB,kBAA0C;AACxF,SAAO,mBACH,GAAG,OAAO,IAAI,gBAAgB,kBAC9B,GAAG,OAAO;AAChB;AAEA,SAAS,uBAAuB,SAAiB,OAAe,kBAA0C;AACxG,QAAM,QAAQ,mBACV,GAAG,OAAO,IAAI,gBAAgB,mBAC9B,GAAG,OAAO;AACd,SAAO,GAAG,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACpD;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,EAAE,OAAO,UAAU,aAAa,UAAU,eAAe,IAAI,OAAO;AAC1E,MAAI,CAAC,YAAY,CAAC,gBAAgB;AAChC,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5G;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAM,SAAS,MAAM,yBAAyB,IAAI,gBAAgB,QAAQ;AAC1E,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AACtE,MAAI,UAAU;AACZ,UAAM,cAAc,UAAU,wBAAwB;AACtD,UAAM,cAAc,MAAM,yBAAyB,IAAI,SAAS,gBAAgB,QAAQ;AACxF,UAAM,WAAW,sBAAsB,SAAS,aAAa,QAAQ,IAAI;AACzE,UAAMA,WAAU,UAAU,6CAA6C,mCAAmC;AAC1G,UAAMC,QAAO;AAAA,MACX,SAAS,UAAU,6CAA6C,4EAA4E;AAAA,MAC5I,OAAO,UAAU,2CAA2C,mCAAmC;AAAA,MAC/F,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,MACA,KAAK,UAAU,yCAAyC,mBAAmB;AAAA,MAC3E,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,UAAU;AAAA,MACb,IAAI,SAAS;AAAA,MACb,SAAAD;AAAA,MACA,OAAO,6BAA6B,EAAE,UAAU,MAAAC,MAAK,CAAC;AAAA,IACxD,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAQ,MAAM,4DAA4D,KAAK;AAAA,IACjF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD;AAEA,QAAM,OAAO,MAAM,oBAAoB,WAAW,OAAO,UAAU,aAAa,EAAE,UAAU,eAAe,CAAC;AAE5G,QAAM,cAAc,MAAM,GAAG,QAAQ,cAAc;AAAA,IACjD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,aAAa;AACf,UAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,MAC3C;AAAA,MACA,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,QAAQ;AAAA,EACrB;AAEA,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,QAAM,oBAAoB,MAAM,qBAAqB,wBAAwB,KAAK,IAAI,QAAQ;AAC9F,QAAM,YAAY,uBAAuB,SAAS,mBAAmB,OAAO,IAAI;AAChF,QAAM,UAAU,UAAU,4CAA4C,4BAA4B;AAClG,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,4CAA4C,+CAA+C;AAAA,IAC9G,OAAO,UAAU,0CAA0C,4BAA4B;AAAA,IACvF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,wCAAwC,sBAAsB;AAAA,IAC7E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,OAAK,UAAU;AAAA,IACb,IAAI,KAAK;AAAA,IACT;AAAA,IACA,OAAO,gCAAgC,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5D,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,wDAAwD,KAAK;AAAA,EAC7E,CAAC;AAED,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxD;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAE7D,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB;AAAA,EAC9E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { compare as bcryptCompare } from 'bcryptjs'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { sendEmail } from '@open-mercato/shared/lib/email/send'\nimport { signupSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerRole, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport CustomerSignupVerificationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerSignupVerificationEmail'\nimport CustomerExistingAccountEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerExistingAccountEmail'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerSignupRateLimitConfig,\n  customerSignupIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\nimport { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'\nimport { getSecurityEmailBaseUrl, mapSecurityEmailUrlError } from '@open-mercato/shared/lib/url'\nimport {\n  resolveTenantContext,\n  TenantResolutionError,\n} from '@open-mercato/core/modules/customer_accounts/lib/resolveTenantContext'\nimport { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\n// Precomputed bcrypt cost-10 hash of an unknowable random 32-byte input; used to equalize\n// response latency between the existing-user and new-user signup branches so the endpoint's\n// 202-for-both contract is not undone by a timing side channel.\nconst TIMING_EQUALIZATION_HASH = '$2b$10$.F2A6UHFzk.d8trNdfqt4OLz05Nf3IOuMmN6VJKflhD4.rz.prR8i'\nfunction resolvePortalLoginUrl(baseUrl: string, organizationSlug?: string | null): string {\n  return organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/login`\n    : `${baseUrl}/portal/login`\n}\n\nfunction resolvePortalVerifyUrl(baseUrl: string, token: string, organizationSlug?: string | null): string {\n  const route = organizationSlug\n    ? `${baseUrl}/${organizationSlug}/portal/verify`\n    : `${baseUrl}/portal/verify`\n  return `${route}?token=${encodeURIComponent(token)}`\n}\n\nexport async function POST(req: Request) {\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerSignupIpRateLimitConfig,\n    compoundConfig: customerSignupRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = signupSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const { email, password, displayName } = parsed.data\n  let tenantId: string\n  let organizationId: string | null\n  try {\n    const context = await resolveTenantContext(req, parsed.data.tenantId)\n    tenantId = context.tenantId\n    organizationId = context.organizationId ?? parsed.data.organizationId ?? null\n  } catch (err) {\n    if (err instanceof TenantResolutionError) {\n      return NextResponse.json({ ok: false, error: err.message }, { status: err.status })\n    }\n    throw err\n  }\n  if (!organizationId) {\n    return NextResponse.json({ ok: false, error: 'organizationId is required' }, { status: 400 })\n  }\n\n  let baseUrl: string\n  try {\n    baseUrl = getSecurityEmailBaseUrl(req)\n  } catch (error) {\n    const mapped = mapSecurityEmailUrlError(error, {\n      scope: 'customer_accounts.signup',\n      configMessage: 'Customer signup is not configured',\n    })\n    if (mapped) return NextResponse.json(mapped.body, { status: mapped.status })\n    throw error\n  }\n\n  const container = await createRequestContainer()\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const { translate } = await resolveTranslations()\n\n  const orgRow = await findOrganizationInTenant(em, organizationId, tenantId)\n  if (!orgRow) {\n    return NextResponse.json({ ok: false, error: 'Registration could not be completed' }, { status: 400 })\n  }\n\n  const existing = await customerUserService.findByEmail(email, tenantId)\n  if (existing) {\n    await bcryptCompare(password, TIMING_EQUALIZATION_HASH)\n    const existingOrg = await findOrganizationInTenant(em, existing.organizationId, tenantId)\n    // Prefer the org's active custom domain when available; fall back to the\n    // platform login URL preserved by `resolvePortalLoginUrl`.\n    let loginUrl = resolvePortalLoginUrl(baseUrl, existingOrg?.slug ?? null)\n    try {\n      loginUrl = await urlForCustomerOrg(existing.organizationId, '/login', { container })\n    } catch {\n      // Fall back to platform URL on any resolution issue.\n    }\n    const subject = translate('customer_accounts.signup.existing.subject', 'You already have a portal account')\n    const copy = {\n      preview: translate('customer_accounts.signup.existing.preview', 'A sign-up attempt was made for an email that already has a portal account.'),\n      title: translate('customer_accounts.signup.existing.title', 'You already have a portal account'),\n      body: translate(\n        'customer_accounts.signup.existing.body',\n        'A sign-up request was made for this email address. You can sign in with your existing account. If you forgot your password, use the password reset option on the sign-in page.',\n      ),\n      cta: translate('customer_accounts.signup.existing.cta', 'Open sign-in page'),\n      hint: translate(\n        'customer_accounts.signup.existing.hint',\n        'If this was not you, you can ignore this message. No new portal account was created.',\n      ),\n    }\n\n    void sendEmail({\n      to: existing.email,\n      subject,\n      react: CustomerExistingAccountEmail({ loginUrl, copy }),\n    }).catch((error) => {\n      console.error('[customer_accounts.signup] existing-account email failed', error)\n    })\n\n    return NextResponse.json({ ok: true }, { status: 202 })\n  }\n\n  const user = await customerUserService.createUser(email, password, displayName, { tenantId, organizationId })\n\n  const defaultRole = await em.findOne(CustomerRole, {\n    tenantId,\n    isDefault: true,\n    deletedAt: null,\n  })\n  if (defaultRole) {\n    const userRole = em.create(CustomerUserRole, {\n      user,\n      role: defaultRole,\n      createdAt: new Date(),\n    } as any)\n    em.persist(userRole)\n  }\n\n  await em.persist(user).flush()\n\n  const verificationToken = await customerTokenService.createEmailVerification(user.id, tenantId)\n  let verifyUrl = resolvePortalVerifyUrl(baseUrl, verificationToken, orgRow.slug)\n  try {\n    verifyUrl = await urlForCustomerOrg(organizationId, `/verify?token=${encodeURIComponent(verificationToken)}`, {\n      container,\n    })\n  } catch {\n    // Fall back to the platform-derived URL on any resolution issue.\n  }\n  const subject = translate('customer_accounts.signup.created.subject', 'Verify your portal account')\n  const copy = {\n    preview: translate('customer_accounts.signup.created.preview', 'Verify your portal account to finish sign-up.'),\n    title: translate('customer_accounts.signup.created.title', 'Verify your portal account'),\n    body: translate(\n      'customer_accounts.signup.created.body',\n      'Your account request was accepted. Confirm your email address to finish setting up portal access.',\n    ),\n    cta: translate('customer_accounts.signup.created.cta', 'Verify email address'),\n    hint: translate(\n      'customer_accounts.signup.created.hint',\n      'This verification link expires in 24 hours. If you did not request this, you can ignore this email.',\n    ),\n  }\n\n  void sendEmail({\n    to: user.email,\n    subject,\n    react: CustomerSignupVerificationEmail({ verifyUrl, copy }),\n  }).catch((error) => {\n    console.error('[customer_accounts.signup] verification email failed', error)\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId,\n    organizationId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true }, { status: 202 })\n}\n\nconst signupAcceptedSchema = z.object({ ok: z.literal(true) })\n\nconst errorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Register a new customer account',\n  description: 'Accepts a signup request and always returns 202 to prevent account enumeration.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: signupSchema,\n    description: 'Signup payload with email, password, and display name.',\n  },\n  responses: [\n    { status: 202, description: 'Signup accepted', schema: signupAcceptedSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed or invalid request origin', schema: errorSchema },\n    { status: 429, description: 'Too many signup attempts', schema: rateLimitErrorSchema },\n    { status: 500, description: 'Signup email origin is not configured', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer account registration',\n  description: 'Handles customer self-registration without revealing whether the email already exists.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,WAAW,qBAAqB;AACzC,SAAS,SAAS;AAElB,SAAS,2BAA2B;AACpC,SAAS,iBAAiB;AAC1B,SAAS,oBAAoB;AAC7B,SAAS,8BAA8B;AAGvC,SAAS,cAAc,wBAAwB;AAC/C,SAAS,iCAAiC;AAC1C,OAAO,qCAAqC;AAC5C,OAAO,kCAAkC;AACzC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AACnD,SAAS,gCAAgC;AACzC,SAAS,yBAAyB,gCAAgC;AAClE;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAE3B,MAAM,WAAqD,EAAE,aAAa,MAAM;AAKvF,MAAM,2BAA2B;AACjC,SAAS,sBAAsB,SAAiB,kBAA0C;AACxF,SAAO,mBACH,GAAG,OAAO,IAAI,gBAAgB,kBAC9B,GAAG,OAAO;AAChB;AAEA,SAAS,uBAAuB,SAAiB,OAAe,kBAA0C;AACxG,QAAM,QAAQ,mBACV,GAAG,OAAO,IAAI,gBAAgB,mBAC9B,GAAG,OAAO;AACd,SAAO,GAAG,KAAK,UAAU,mBAAmB,KAAK,CAAC;AACpD;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,aAAa,UAAU,IAAI;AAC1C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,EAAE,OAAO,UAAU,YAAY,IAAI,OAAO;AAChD,MAAI;AACJ,MAAI;AACJ,MAAI;AACF,UAAM,UAAU,MAAM,qBAAqB,KAAK,OAAO,KAAK,QAAQ;AACpE,eAAW,QAAQ;AACnB,qBAAiB,QAAQ,kBAAkB,OAAO,KAAK,kBAAkB;AAAA,EAC3E,SAAS,KAAK;AACZ,QAAI,eAAe,uBAAuB;AACxC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,IAAI,QAAQ,GAAG,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IACpF;AACA,UAAM;AAAA,EACR;AACA,MAAI,CAAC,gBAAgB;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,6BAA6B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC9F;AAEA,MAAI;AACJ,MAAI;AACF,cAAU,wBAAwB,GAAG;AAAA,EACvC,SAAS,OAAO;AACd,UAAM,SAAS,yBAAyB,OAAO;AAAA,MAC7C,OAAO;AAAA,MACP,eAAe;AAAA,IACjB,CAAC;AACD,QAAI,OAAQ,QAAO,aAAa,KAAK,OAAO,MAAM,EAAE,QAAQ,OAAO,OAAO,CAAC;AAC3E,UAAM;AAAA,EACR;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAEhD,QAAM,SAAS,MAAM,yBAAyB,IAAI,gBAAgB,QAAQ;AAC1E,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAEA,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,QAAQ;AACtE,MAAI,UAAU;AACZ,UAAM,cAAc,UAAU,wBAAwB;AACtD,UAAM,cAAc,MAAM,yBAAyB,IAAI,SAAS,gBAAgB,QAAQ;AAGxF,QAAI,WAAW,sBAAsB,SAAS,aAAa,QAAQ,IAAI;AACvE,QAAI;AACF,iBAAW,MAAM,kBAAkB,SAAS,gBAAgB,UAAU,EAAE,UAAU,CAAC;AAAA,IACrF,QAAQ;AAAA,IAER;AACA,UAAMA,WAAU,UAAU,6CAA6C,mCAAmC;AAC1G,UAAMC,QAAO;AAAA,MACX,SAAS,UAAU,6CAA6C,4EAA4E;AAAA,MAC5I,OAAO,UAAU,2CAA2C,mCAAmC;AAAA,MAC/F,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,MACA,KAAK,UAAU,yCAAyC,mBAAmB;AAAA,MAC3E,MAAM;AAAA,QACJ;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,SAAK,UAAU;AAAA,MACb,IAAI,SAAS;AAAA,MACb,SAAAD;AAAA,MACA,OAAO,6BAA6B,EAAE,UAAU,MAAAC,MAAK,CAAC;AAAA,IACxD,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,cAAQ,MAAM,4DAA4D,KAAK;AAAA,IACjF,CAAC;AAED,WAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxD;AAEA,QAAM,OAAO,MAAM,oBAAoB,WAAW,OAAO,UAAU,aAAa,EAAE,UAAU,eAAe,CAAC;AAE5G,QAAM,cAAc,MAAM,GAAG,QAAQ,cAAc;AAAA,IACjD;AAAA,IACA,WAAW;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,aAAa;AACf,UAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,MAC3C;AAAA,MACA,MAAM;AAAA,MACN,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,QAAQ;AAAA,EACrB;AAEA,QAAM,GAAG,QAAQ,IAAI,EAAE,MAAM;AAE7B,QAAM,oBAAoB,MAAM,qBAAqB,wBAAwB,KAAK,IAAI,QAAQ;AAC9F,MAAI,YAAY,uBAAuB,SAAS,mBAAmB,OAAO,IAAI;AAC9E,MAAI;AACF,gBAAY,MAAM,kBAAkB,gBAAgB,iBAAiB,mBAAmB,iBAAiB,CAAC,IAAI;AAAA,MAC5G;AAAA,IACF,CAAC;AAAA,EACH,QAAQ;AAAA,EAER;AACA,QAAM,UAAU,UAAU,4CAA4C,4BAA4B;AAClG,QAAM,OAAO;AAAA,IACX,SAAS,UAAU,4CAA4C,+CAA+C;AAAA,IAC9G,OAAO,UAAU,0CAA0C,4BAA4B;AAAA,IACvF,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,IACA,KAAK,UAAU,wCAAwC,sBAAsB;AAAA,IAC7E,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,OAAK,UAAU;AAAA,IACb,IAAI,KAAK;AAAA,IACT;AAAA,IACA,OAAO,gCAAgC,EAAE,WAAW,KAAK,CAAC;AAAA,EAC5D,CAAC,EAAE,MAAM,CAAC,UAAU;AAClB,YAAQ,MAAM,wDAAwD,KAAK;AAAA,EAC7E,CAAC;AAED,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ;AAAA,IACA;AAAA,EACF,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,GAAG,EAAE,QAAQ,IAAI,CAAC;AACxD;AAEA,MAAM,uBAAuB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AAE7D,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,qBAAqB;AAAA,EAC9E;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,+CAA+C,QAAQ,YAAY;AAAA,IAC/F,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,qBAAqB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,YAAY;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": ["subject", "copy"]
 }

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Actions.js ADDED Viewed

@@ -0,0 +1,48 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { ExternalLink, RefreshCw, Replace, Trash2 } from "lucide-react";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function DefaultActions({
+  mapping,
+  isReplacement,
+  onCheckNow,
+  onRetryTls,
+  onChangeDomain,
+  onRemove,
+  busy
+}) {
+  const t = useT();
+  const showCheckNow = mapping.status === "pending" || mapping.status === "dns_failed";
+  const showRetryTls = mapping.status === "tls_failed" || mapping.status === "verified";
+  const showTestDomain = mapping.status === "active";
+  const showChangeDomain = mapping.status === "active" && !isReplacement;
+  return /* @__PURE__ */ jsxs("div", { className: "flex flex-wrap items-center gap-2", children: [
+    showCheckNow ? /* @__PURE__ */ jsxs(Button, { type: "button", variant: "outline", size: "sm", onClick: onCheckNow, disabled: busy, children: [
+      /* @__PURE__ */ jsx(RefreshCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      t("customer_accounts.domainMapping.verifyNow", "Check Now")
+    ] }) : null,
+    showRetryTls ? /* @__PURE__ */ jsxs(Button, { type: "button", variant: "outline", size: "sm", onClick: onRetryTls, disabled: busy, children: [
+      /* @__PURE__ */ jsx(RefreshCw, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      t("customer_accounts.domainMapping.tls.retryButton", "Retry SSL")
+    ] }) : null,
+    showTestDomain ? /* @__PURE__ */ jsx(Button, { type: "button", variant: "outline", size: "sm", asChild: true, children: /* @__PURE__ */ jsxs("a", { href: `https://${mapping.hostname}`, target: "_blank", rel: "noopener noreferrer", children: [
+      /* @__PURE__ */ jsx(ExternalLink, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      t("customer_accounts.domainMapping.preview", "Test Domain")
+    ] }) }) : null,
+    showChangeDomain ? /* @__PURE__ */ jsxs(Button, { type: "button", variant: "outline", size: "sm", onClick: onChangeDomain, disabled: busy, children: [
+      /* @__PURE__ */ jsx(Replace, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      t("customer_accounts.domainMapping.changeDomain", "Change Domain")
+    ] }) : null,
+    /* @__PURE__ */ jsxs(Button, { type: "button", variant: "outline", size: "sm", onClick: onRemove, disabled: busy, children: [
+      /* @__PURE__ */ jsx(Trash2, { className: "mr-1.5 h-4 w-4", "aria-hidden": true }),
+      t("customer_accounts.domainMapping.removeDomain", "Remove Domain")
+    ] })
+  ] });
+}
+var Actions_default = DefaultActions;
+export {
+  DefaultActions,
+  Actions_default as default
+};
+//# sourceMappingURL=Actions.js.map

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Actions.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Actions.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { ExternalLink, RefreshCw, Replace, Trash2 } from 'lucide-react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { DomainMappingRow } from './types'\n\nexport type ActionsProps = {\n  mapping: DomainMappingRow\n  isReplacement: boolean\n  onCheckNow: () => void\n  onRetryTls: () => void\n  onChangeDomain: () => void\n  onRemove: () => void\n  busy?: boolean\n}\n\nexport function DefaultActions({\n  mapping,\n  isReplacement,\n  onCheckNow,\n  onRetryTls,\n  onChangeDomain,\n  onRemove,\n  busy,\n}: ActionsProps) {\n  const t = useT()\n  const showCheckNow = mapping.status === 'pending' || mapping.status === 'dns_failed'\n  const showRetryTls = mapping.status === 'tls_failed' || mapping.status === 'verified'\n  const showTestDomain = mapping.status === 'active'\n  const showChangeDomain = mapping.status === 'active' && !isReplacement\n\n  return (\n    <div className=\"flex flex-wrap items-center gap-2\">\n      {showCheckNow ? (\n        <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={onCheckNow} disabled={busy}>\n          <RefreshCw className=\"mr-1.5 h-4 w-4\" aria-hidden />\n          {t('customer_accounts.domainMapping.verifyNow', 'Check Now')}\n        </Button>\n      ) : null}\n      {showRetryTls ? (\n        <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={onRetryTls} disabled={busy}>\n          <RefreshCw className=\"mr-1.5 h-4 w-4\" aria-hidden />\n          {t('customer_accounts.domainMapping.tls.retryButton', 'Retry SSL')}\n        </Button>\n      ) : null}\n      {showTestDomain ? (\n        <Button type=\"button\" variant=\"outline\" size=\"sm\" asChild>\n          <a href={`https://${mapping.hostname}`} target=\"_blank\" rel=\"noopener noreferrer\">\n            <ExternalLink className=\"mr-1.5 h-4 w-4\" aria-hidden />\n            {t('customer_accounts.domainMapping.preview', 'Test Domain')}\n          </a>\n        </Button>\n      ) : null}\n      {showChangeDomain ? (\n        <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={onChangeDomain} disabled={busy}>\n          <Replace className=\"mr-1.5 h-4 w-4\" aria-hidden />\n          {t('customer_accounts.domainMapping.changeDomain', 'Change Domain')}\n        </Button>\n      ) : null}\n      <Button type=\"button\" variant=\"outline\" size=\"sm\" onClick={onRemove} disabled={busy}>\n        <Trash2 className=\"mr-1.5 h-4 w-4\" aria-hidden />\n        {t('customer_accounts.domainMapping.removeDomain', 'Remove Domain')}\n      </Button>\n    </div>\n  )\n}\n\nexport default DefaultActions\n"],
+  "mappings": ";AAoCQ,SACE,KADF;AAjCR,SAAS,cAAc,WAAW,SAAS,cAAc;AACzD,SAAS,cAAc;AACvB,SAAS,YAAY;AAad,SAAS,eAAe;AAAA,EAC7B;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF,GAAiB;AACf,QAAM,IAAI,KAAK;AACf,QAAM,eAAe,QAAQ,WAAW,aAAa,QAAQ,WAAW;AACxE,QAAM,eAAe,QAAQ,WAAW,gBAAgB,QAAQ,WAAW;AAC3E,QAAM,iBAAiB,QAAQ,WAAW;AAC1C,QAAM,mBAAmB,QAAQ,WAAW,YAAY,CAAC;AAEzD,SACE,qBAAC,SAAI,WAAU,qCACZ;AAAA,mBACC,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,YAAY,UAAU,MAC/E;AAAA,0BAAC,aAAU,WAAU,kBAAiB,eAAW,MAAC;AAAA,MACjD,EAAE,6CAA6C,WAAW;AAAA,OAC7D,IACE;AAAA,IACH,eACC,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,YAAY,UAAU,MAC/E;AAAA,0BAAC,aAAU,WAAU,kBAAiB,eAAW,MAAC;AAAA,MACjD,EAAE,mDAAmD,WAAW;AAAA,OACnE,IACE;AAAA,IACH,iBACC,oBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAO,MACvD,+BAAC,OAAE,MAAM,WAAW,QAAQ,QAAQ,IAAI,QAAO,UAAS,KAAI,uBAC1D;AAAA,0BAAC,gBAAa,WAAU,kBAAiB,eAAW,MAAC;AAAA,MACpD,EAAE,2CAA2C,aAAa;AAAA,OAC7D,GACF,IACE;AAAA,IACH,mBACC,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,gBAAgB,UAAU,MACnF;AAAA,0BAAC,WAAQ,WAAU,kBAAiB,eAAW,MAAC;AAAA,MAC/C,EAAE,gDAAgD,eAAe;AAAA,OACpE,IACE;AAAA,IACJ,qBAAC,UAAO,MAAK,UAAS,SAAQ,WAAU,MAAK,MAAK,SAAS,UAAU,UAAU,MAC7E;AAAA,0BAAC,UAAO,WAAU,kBAAiB,eAAW,MAAC;AAAA,MAC9C,EAAE,gDAAgD,eAAe;AAAA,OACpE;AAAA,KACF;AAEJ;AAEA,IAAO,kBAAQ;",
+  "names": []
+}

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Diagnostics.js ADDED Viewed

@@ -0,0 +1,43 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import { AlertTriangle } from "lucide-react";
+import { Alert, AlertTitle, AlertDescription } from "@open-mercato/ui/primitives/alert";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function DnsDiagnostics({ mapping }) {
+  const t = useT();
+  if (mapping.status !== "dns_failed") return null;
+  return /* @__PURE__ */ jsxs(Alert, { variant: "destructive", children: [
+    /* @__PURE__ */ jsx(AlertTriangle, { className: "h-4 w-4", "aria-hidden": true }),
+    /* @__PURE__ */ jsx(AlertTitle, { children: t("customer_accounts.domainMapping.dns.diagnostics.title", "DNS configuration issue") }),
+    /* @__PURE__ */ jsx(AlertDescription, { children: /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+      mapping.dnsFailureReason ? /* @__PURE__ */ jsx("p", { children: mapping.dnsFailureReason }) : null,
+      mapping.cnameTarget ? /* @__PURE__ */ jsxs("dl", { className: "grid grid-cols-[max-content_1fr] gap-x-3 gap-y-1 text-xs", children: [
+        /* @__PURE__ */ jsx("dt", { className: "text-muted-foreground", children: t("customer_accounts.domainMapping.dns.diagnostics.expected", "Expected target") }),
+        /* @__PURE__ */ jsx("dd", { className: "font-mono", children: mapping.cnameTarget })
+      ] }) : null
+    ] }) })
+  ] });
+}
+function TlsDiagnostics({ mapping }) {
+  const t = useT();
+  if (mapping.status !== "tls_failed") return null;
+  return /* @__PURE__ */ jsxs(Alert, { variant: "warning", children: [
+    /* @__PURE__ */ jsx(AlertTriangle, { className: "h-4 w-4", "aria-hidden": true }),
+    /* @__PURE__ */ jsx(AlertTitle, { children: t("customer_accounts.domainMapping.tls.diagnostics.title", "SSL certificate issue") }),
+    /* @__PURE__ */ jsx(AlertDescription, { children: /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+      mapping.tlsFailureReason ? /* @__PURE__ */ jsx("p", { children: mapping.tlsFailureReason }) : null,
+      /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t("customer_accounts.domainMapping.tls.diagnostics.retryCount", "Retry attempts: {count}", {
+        count: String(mapping.tlsRetryCount)
+      }) }),
+      /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t(
+        "customer_accounts.domainMapping.tls.diagnostics.operatorNote",
+        "We are retrying automatically. If this persists, contact platform support \u2014 your DNS is fine, this is on our side."
+      ) })
+    ] }) })
+  ] });
+}
+export {
+  DnsDiagnostics,
+  TlsDiagnostics
+};
+//# sourceMappingURL=Diagnostics.js.map

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Diagnostics.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/customer_accounts/backend/customer_accounts/settings/domain/components/Diagnostics.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { AlertTriangle } from 'lucide-react'\nimport { Alert, AlertTitle, AlertDescription } from '@open-mercato/ui/primitives/alert'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport type { DomainMappingRow } from './types'\n\nexport type DiagnosticsProps = {\n  mapping: DomainMappingRow\n}\n\nexport function DnsDiagnostics({ mapping }: DiagnosticsProps) {\n  const t = useT()\n  if (mapping.status !== 'dns_failed') return null\n  return (\n    <Alert variant=\"destructive\">\n      <AlertTriangle className=\"h-4 w-4\" aria-hidden />\n      <AlertTitle>\n        {t('customer_accounts.domainMapping.dns.diagnostics.title', 'DNS configuration issue')}\n      </AlertTitle>\n      <AlertDescription>\n        <div className=\"space-y-2\">\n          {mapping.dnsFailureReason ? <p>{mapping.dnsFailureReason}</p> : null}\n          {mapping.cnameTarget ? (\n            <dl className=\"grid grid-cols-[max-content_1fr] gap-x-3 gap-y-1 text-xs\">\n              <dt className=\"text-muted-foreground\">\n                {t('customer_accounts.domainMapping.dns.diagnostics.expected', 'Expected target')}\n              </dt>\n              <dd className=\"font-mono\">{mapping.cnameTarget}</dd>\n            </dl>\n          ) : null}\n        </div>\n      </AlertDescription>\n    </Alert>\n  )\n}\n\nexport function TlsDiagnostics({ mapping }: DiagnosticsProps) {\n  const t = useT()\n  if (mapping.status !== 'tls_failed') return null\n  return (\n    <Alert variant=\"warning\">\n      <AlertTriangle className=\"h-4 w-4\" aria-hidden />\n      <AlertTitle>\n        {t('customer_accounts.domainMapping.tls.diagnostics.title', 'SSL certificate issue')}\n      </AlertTitle>\n      <AlertDescription>\n        <div className=\"space-y-2\">\n          {mapping.tlsFailureReason ? <p>{mapping.tlsFailureReason}</p> : null}\n          <p className=\"text-xs text-muted-foreground\">\n            {t('customer_accounts.domainMapping.tls.diagnostics.retryCount', 'Retry attempts: {count}', {\n              count: String(mapping.tlsRetryCount),\n            })}\n          </p>\n          <p className=\"text-xs text-muted-foreground\">\n            {t(\n              'customer_accounts.domainMapping.tls.diagnostics.operatorNote',\n              'We are retrying automatically. If this persists, contact platform support \u2014 your DNS is fine, this is on our side.',\n            )}\n          </p>\n        </div>\n      </AlertDescription>\n    </Alert>\n  )\n}\n"],
+  "mappings": ";AAiBM,cAQM,YARN;AAdN,SAAS,qBAAqB;AAC9B,SAAS,OAAO,YAAY,wBAAwB;AACpD,SAAS,YAAY;AAOd,SAAS,eAAe,EAAE,QAAQ,GAAqB;AAC5D,QAAM,IAAI,KAAK;AACf,MAAI,QAAQ,WAAW,aAAc,QAAO;AAC5C,SACE,qBAAC,SAAM,SAAQ,eACb;AAAA,wBAAC,iBAAc,WAAU,WAAU,eAAW,MAAC;AAAA,IAC/C,oBAAC,cACE,YAAE,yDAAyD,yBAAyB,GACvF;AAAA,IACA,oBAAC,oBACC,+BAAC,SAAI,WAAU,aACZ;AAAA,cAAQ,mBAAmB,oBAAC,OAAG,kBAAQ,kBAAiB,IAAO;AAAA,MAC/D,QAAQ,cACP,qBAAC,QAAG,WAAU,4DACZ;AAAA,4BAAC,QAAG,WAAU,yBACX,YAAE,4DAA4D,iBAAiB,GAClF;AAAA,QACA,oBAAC,QAAG,WAAU,aAAa,kBAAQ,aAAY;AAAA,SACjD,IACE;AAAA,OACN,GACF;AAAA,KACF;AAEJ;AAEO,SAAS,eAAe,EAAE,QAAQ,GAAqB;AAC5D,QAAM,IAAI,KAAK;AACf,MAAI,QAAQ,WAAW,aAAc,QAAO;AAC5C,SACE,qBAAC,SAAM,SAAQ,WACb;AAAA,wBAAC,iBAAc,WAAU,WAAU,eAAW,MAAC;AAAA,IAC/C,oBAAC,cACE,YAAE,yDAAyD,uBAAuB,GACrF;AAAA,IACA,oBAAC,oBACC,+BAAC,SAAI,WAAU,aACZ;AAAA,cAAQ,mBAAmB,oBAAC,OAAG,kBAAQ,kBAAiB,IAAO;AAAA,MAChE,oBAAC,OAAE,WAAU,iCACV,YAAE,8DAA8D,2BAA2B;AAAA,QAC1F,OAAO,OAAO,QAAQ,aAAa;AAAA,MACrC,CAAC,GACH;AAAA,MACA,oBAAC,OAAE,WAAU,iCACV;AAAA,QACC;AAAA,QACA;AAAA,MACF,GACF;AAAA,OACF,GACF;AAAA,KACF;AAEJ;",
+  "names": []
+}

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/DnsConfig.js ADDED Viewed

@@ -0,0 +1,53 @@
+"use client";
+import { jsx, jsxs } from "react/jsx-runtime";
+import * as React from "react";
+import { Copy, Check } from "lucide-react";
+import { Button } from "@open-mercato/ui/primitives/button";
+import { useT } from "@open-mercato/shared/lib/i18n/context";
+function CopyButton({ value, label }) {
+  const t = useT();
+  const [copied, setCopied] = React.useState(false);
+  const handleCopy = React.useCallback(async () => {
+    if (typeof navigator === "undefined" || !navigator.clipboard) return;
+    await navigator.clipboard.writeText(value);
+    setCopied(true);
+    window.setTimeout(() => setCopied(false), 1500);
+  }, [value]);
+  return /* @__PURE__ */ jsxs(Button, { type: "button", variant: "ghost", size: "sm", onClick: handleCopy, "aria-label": label, children: [
+    copied ? /* @__PURE__ */ jsx(Check, { className: "h-4 w-4", "aria-hidden": true }) : /* @__PURE__ */ jsx(Copy, { className: "h-4 w-4", "aria-hidden": true }),
+    /* @__PURE__ */ jsx("span", { className: "ml-1.5 text-xs", children: copied ? t("customer_accounts.domainMapping.copyTarget.copied", "Copied") : t("customer_accounts.domainMapping.copyTarget", "Copy") })
+  ] });
+}
+function DefaultDnsConfig({ hostname, cnameTarget, aRecordTarget }) {
+  const t = useT();
+  const exampleHost = hostname ?? t("customer_accounts.domainMapping.hostname.placeholder", "e.g., shop.yourdomain.com");
+  return /* @__PURE__ */ jsxs("div", { className: "space-y-4 rounded-lg border bg-muted/20 p-4", children: [
+    /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+      /* @__PURE__ */ jsx("p", { className: "text-sm font-medium text-foreground", children: t("customer_accounts.domainMapping.cnameInstruction", "Add a CNAME record for {hostname} pointing to {target} in your DNS provider", {
+        hostname: exampleHost,
+        target: cnameTarget ?? "\u2014"
+      }) }),
+      cnameTarget ? /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 rounded-md border bg-background px-3 py-2", children: [
+        /* @__PURE__ */ jsx("code", { className: "flex-1 truncate font-mono text-sm", children: cnameTarget }),
+        /* @__PURE__ */ jsx(CopyButton, { value: cnameTarget, label: t("customer_accounts.domainMapping.copyTarget", "Copy") })
+      ] }) : null
+    ] }),
+    aRecordTarget ? /* @__PURE__ */ jsxs("div", { className: "space-y-2", children: [
+      /* @__PURE__ */ jsx("p", { className: "text-sm text-muted-foreground", children: t("customer_accounts.domainMapping.aRecordInstruction", "For an apex domain, add an A record for {hostname} pointing to {target}", {
+        hostname: exampleHost,
+        target: aRecordTarget
+      }) }),
+      /* @__PURE__ */ jsxs("div", { className: "flex items-center gap-2 rounded-md border bg-background px-3 py-2", children: [
+        /* @__PURE__ */ jsx("code", { className: "flex-1 truncate font-mono text-sm", children: aRecordTarget }),
+        /* @__PURE__ */ jsx(CopyButton, { value: aRecordTarget, label: t("customer_accounts.domainMapping.copyTarget", "Copy") })
+      ] })
+    ] }) : null,
+    /* @__PURE__ */ jsx("p", { className: "text-xs text-muted-foreground", children: t("customer_accounts.domainMapping.propagationNote", "DNS changes can take up to 48 hours to propagate. The system checks automatically \u2014 you'll be notified when it's ready.") })
+  ] });
+}
+var DnsConfig_default = DefaultDnsConfig;
+export {
+  DefaultDnsConfig,
+  DnsConfig_default as default
+};
+//# sourceMappingURL=DnsConfig.js.map

package/dist/modules/customer_accounts/backend/customer_accounts/settings/domain/components/DnsConfig.js.map ADDED Viewed

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../../../../src/modules/customer_accounts/backend/customer_accounts/settings/domain/components/DnsConfig.tsx"],
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport { Copy, Check } from 'lucide-react'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\nexport type DnsConfigProps = {\n  hostname: string | null\n  cnameTarget: string | null\n  aRecordTarget: string | null\n}\n\nfunction CopyButton({ value, label }: { value: string; label: string }) {\n  const t = useT()\n  const [copied, setCopied] = React.useState(false)\n\n  const handleCopy = React.useCallback(async () => {\n    if (typeof navigator === 'undefined' || !navigator.clipboard) return\n    await navigator.clipboard.writeText(value)\n    setCopied(true)\n    window.setTimeout(() => setCopied(false), 1500)\n  }, [value])\n\n  return (\n    <Button type=\"button\" variant=\"ghost\" size=\"sm\" onClick={handleCopy} aria-label={label}>\n      {copied ? <Check className=\"h-4 w-4\" aria-hidden /> : <Copy className=\"h-4 w-4\" aria-hidden />}\n      <span className=\"ml-1.5 text-xs\">\n        {copied\n          ? t('customer_accounts.domainMapping.copyTarget.copied', 'Copied')\n          : t('customer_accounts.domainMapping.copyTarget', 'Copy')}\n      </span>\n    </Button>\n  )\n}\n\nexport function DefaultDnsConfig({ hostname, cnameTarget, aRecordTarget }: DnsConfigProps) {\n  const t = useT()\n  const exampleHost = hostname ?? t('customer_accounts.domainMapping.hostname.placeholder', 'e.g., shop.yourdomain.com')\n\n  return (\n    <div className=\"space-y-4 rounded-lg border bg-muted/20 p-4\">\n      <div className=\"space-y-2\">\n        <p className=\"text-sm font-medium text-foreground\">\n          {t('customer_accounts.domainMapping.cnameInstruction', 'Add a CNAME record for {hostname} pointing to {target} in your DNS provider', {\n            hostname: exampleHost,\n            target: cnameTarget ?? '\u2014',\n          })}\n        </p>\n        {cnameTarget ? (\n          <div className=\"flex items-center gap-2 rounded-md border bg-background px-3 py-2\">\n            <code className=\"flex-1 truncate font-mono text-sm\">{cnameTarget}</code>\n            <CopyButton value={cnameTarget} label={t('customer_accounts.domainMapping.copyTarget', 'Copy')} />\n          </div>\n        ) : null}\n      </div>\n      {aRecordTarget ? (\n        <div className=\"space-y-2\">\n          <p className=\"text-sm text-muted-foreground\">\n            {t('customer_accounts.domainMapping.aRecordInstruction', 'For an apex domain, add an A record for {hostname} pointing to {target}', {\n              hostname: exampleHost,\n              target: aRecordTarget,\n            })}\n          </p>\n          <div className=\"flex items-center gap-2 rounded-md border bg-background px-3 py-2\">\n            <code className=\"flex-1 truncate font-mono text-sm\">{aRecordTarget}</code>\n            <CopyButton value={aRecordTarget} label={t('customer_accounts.domainMapping.copyTarget', 'Copy')} />\n          </div>\n        </div>\n      ) : null}\n      <p className=\"text-xs text-muted-foreground\">\n        {t('customer_accounts.domainMapping.propagationNote', 'DNS changes can take up to 48 hours to propagate. The system checks automatically \u2014 you\\'ll be notified when it\\'s ready.')}\n      </p>\n    </div>\n  )\n}\n\nexport default DefaultDnsConfig\n"],
+  "mappings": ";AAyBI,SACY,KADZ;AAvBJ,YAAY,WAAW;AACvB,SAAS,MAAM,aAAa;AAC5B,SAAS,cAAc;AACvB,SAAS,YAAY;AAQrB,SAAS,WAAW,EAAE,OAAO,MAAM,GAAqC;AACtE,QAAM,IAAI,KAAK;AACf,QAAM,CAAC,QAAQ,SAAS,IAAI,MAAM,SAAS,KAAK;AAEhD,QAAM,aAAa,MAAM,YAAY,YAAY;AAC/C,QAAI,OAAO,cAAc,eAAe,CAAC,UAAU,UAAW;AAC9D,UAAM,UAAU,UAAU,UAAU,KAAK;AACzC,cAAU,IAAI;AACd,WAAO,WAAW,MAAM,UAAU,KAAK,GAAG,IAAI;AAAA,EAChD,GAAG,CAAC,KAAK,CAAC;AAEV,SACE,qBAAC,UAAO,MAAK,UAAS,SAAQ,SAAQ,MAAK,MAAK,SAAS,YAAY,cAAY,OAC9E;AAAA,aAAS,oBAAC,SAAM,WAAU,WAAU,eAAW,MAAC,IAAK,oBAAC,QAAK,WAAU,WAAU,eAAW,MAAC;AAAA,IAC5F,oBAAC,UAAK,WAAU,kBACb,mBACG,EAAE,qDAAqD,QAAQ,IAC/D,EAAE,8CAA8C,MAAM,GAC5D;AAAA,KACF;AAEJ;AAEO,SAAS,iBAAiB,EAAE,UAAU,aAAa,cAAc,GAAmB;AACzF,QAAM,IAAI,KAAK;AACf,QAAM,cAAc,YAAY,EAAE,wDAAwD,2BAA2B;AAErH,SACE,qBAAC,SAAI,WAAU,+CACb;AAAA,yBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,OAAE,WAAU,uCACV,YAAE,oDAAoD,+EAA+E;AAAA,QACpI,UAAU;AAAA,QACV,QAAQ,eAAe;AAAA,MACzB,CAAC,GACH;AAAA,MACC,cACC,qBAAC,SAAI,WAAU,qEACb;AAAA,4BAAC,UAAK,WAAU,qCAAqC,uBAAY;AAAA,QACjE,oBAAC,cAAW,OAAO,aAAa,OAAO,EAAE,8CAA8C,MAAM,GAAG;AAAA,SAClG,IACE;AAAA,OACN;AAAA,IACC,gBACC,qBAAC,SAAI,WAAU,aACb;AAAA,0BAAC,OAAE,WAAU,iCACV,YAAE,sDAAsD,2EAA2E;AAAA,QAClI,UAAU;AAAA,QACV,QAAQ;AAAA,MACV,CAAC,GACH;AAAA,MACA,qBAAC,SAAI,WAAU,qEACb;AAAA,4BAAC,UAAK,WAAU,qCAAqC,yBAAc;AAAA,QACnE,oBAAC,cAAW,OAAO,eAAe,OAAO,EAAE,8CAA8C,MAAM,GAAG;AAAA,SACpG;AAAA,OACF,IACE;AAAA,IACJ,oBAAC,OAAE,WAAU,iCACV,YAAE,mDAAmD,8HAA2H,GACnL;AAAA,KACF;AAEJ;AAEA,IAAO,oBAAQ;",
+  "names": []
+}