@open-mercato/core 0.6.3-develop.3525.3.cc18b8a43f → 0.6.3-develop.3574.1.f3c5dcf345

package/src/modules/auth/lib/grantChecks.ts

@@ -1,8 +1,8 @@
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { hasFeature } from '@open-mercato/shared/security/features'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Role, RoleAcl } from '@open-mercato/core/modules/auth/data/entities'
+import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Role, RoleAcl, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 
 type ActorAcl = {
@@ -33,6 +33,16 @@ type FeatureGrantCheckInput = GrantCheckContext & {
   organizations?: string[] | null
 }
 
+type SuperAdminUserTargetInput = GrantCheckContext & {
+  targetUserId: string
+  actorIsSuperAdmin?: boolean
+}
+
+type SuperAdminRoleTargetInput = GrantCheckContext & {
+  targetRoleId: string
+  actorIsSuperAdmin?: boolean
+}
+
 const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i
 
 export async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {
@@ -99,6 +109,110 @@ export function normalizeGrantFeatureList(features: unknown): string[] {
   return normalizeStringList(features)
 }
 
+export async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator accounts.')
+  }
+}
+
+export async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {
+  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)
+  if (actorIsSuperAdmin) return
+  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)
+  if (targetIsSuperAdmin) {
+    throw forbidden('Only super administrators can modify super administrator roles.')
+  }
+}
+
+async function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {
+  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin
+  const acl = await loadActorAcl(input)
+  return acl.isSuperAdmin
+}
+
+export async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {
+  const directGrant = await em.findOne(
+    UserAcl,
+    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,
+  )
+  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true
+  const links = await findWithDecryption(
+    em,
+    UserRole,
+    { user: userId as unknown } as FilterQuery<UserRole>,
+    { populate: ['role'] },
+    { tenantId: null, organizationId: null },
+  )
+  const roleIds = (Array.isArray(links) ? links : [])
+    .map((link) => {
+      const role = (link as { role?: { id?: unknown } | string | null }).role
+      if (!role) return null
+      if (typeof role === 'string') return role
+      return role.id ? String(role.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (!roleIds.length) return false
+  const roleGrant = await em.findOne(
+    RoleAcl,
+    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {
+  const grant = await em.findOne(
+    RoleAcl,
+    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true
+}
+
+export async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {
+  const ids = new Set<string>()
+  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }
+  if (tenantId) userAclFilter.tenantId = tenantId
+  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)
+  for (const acl of userAcls) {
+    const userRef = (acl as { user?: { id?: unknown } | string | null }).user
+    const userId = userRef && typeof userRef === 'object'
+      ? userRef.id
+      : userRef
+    if (userId) ids.add(String(userId))
+  }
+  const roleAcls = await em.find(
+    RoleAcl,
+    { isSuperAdmin: true } as FilterQuery<RoleAcl>,
+  )
+  const roleIds = roleAcls
+    .map((acl) => {
+      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role
+      if (!roleRef) return null
+      if (typeof roleRef === 'string') return roleRef
+      return roleRef.id ? String(roleRef.id) : null
+    })
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
+  if (roleIds.length) {
+    const links = await findWithDecryption(
+      em,
+      UserRole,
+      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,
+      {},
+      { tenantId: null, organizationId: null },
+    )
+    for (const link of Array.isArray(links) ? links : []) {
+      const userRef = (link as { user?: { id?: unknown } | string | null }).user
+      const userId = userRef && typeof userRef === 'object'
+        ? userRef.id
+        : userRef
+      if (userId) ids.add(String(userId))
+    }
+  }
+  return ids
+}
+
 async function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {
   const actorUserId = normalizeNullableString(input.actorUserId)
   if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')

package/src/modules/business_rules/lib/expression-evaluator.ts

@@ -1,4 +1,5 @@
 import type { ComparisonOperator, LogicalOperator } from '../data/validators'
+import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import { getNestedValue, resolveSpecialValue } from './value-resolver'
 
 /**
@@ -319,11 +320,8 @@ function endsWith(str: any, suffix: any): boolean {
   return String(str).endsWith(String(suffix))
 }
 
-/**
- * Security limits for regex operations
- */
-const REGEX_TIMEOUT_MS = 100
 const MAX_REGEX_LENGTH = 200
+const MAX_REGEX_INPUT_LENGTH = 10_000
 
 /**
  * Check if string matches regex pattern (with ReDoS protection)
@@ -345,18 +343,16 @@ function matches(str: any, pattern: any): boolean {
       return false
     }
 
-    const regex = new RegExp(patternStr)
     const testStr = String(str)
-
-    // Use a simple timeout mechanism
-    const startTime = Date.now()
-    const result = regex.test(testStr)
-
-    if (Date.now() - startTime > REGEX_TIMEOUT_MS) {
-      throw new Error('Regex execution timeout - potential ReDoS pattern detected')
+    if (testStr.length > MAX_REGEX_INPUT_LENGTH) {
+      return false
     }
 
-    return result
+    const result = testLinearRegex(patternStr, testStr, {
+      maxPatternLength: MAX_REGEX_LENGTH,
+      maxInputLength: MAX_REGEX_INPUT_LENGTH,
+    })
+    return result.ok ? result.matched : false
   } catch (error) {
     // Log the error for debugging but don't expose to user
     const message = error instanceof Error ? error.message : 'Unknown error'

package/src/modules/dashboards/components/WidgetVisibilityEditor.tsx

@@ -32,6 +32,7 @@ type UserResponse = {
 type BaseProps = {
   tenantId?: string | null
   organizationId?: string | null
+  preserveOnTenantChange?: boolean
 }
 
 type RoleProps = BaseProps & {
@@ -92,7 +93,7 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     (widget: WidgetCatalogItem) => resolveWidgetText(t, widget.id, 'description', widget.description || ''),
     [t],
   )
-  const { kind, targetId, tenantId, organizationId } = props
+  const { kind, targetId, tenantId, organizationId, preserveOnTenantChange = false } = props
   const [catalog, setCatalog] = React.useState<WidgetCatalogItem[]>([])
   const [loading, setLoading] = React.useState(true)
   const [saving, setSaving] = React.useState(false)
@@ -136,10 +137,16 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setCatalog(mapped)
   }, [])
 
-  const loadRoleData = React.useCallback(async () => {
+  const tenantIdRef = React.useRef(tenantId)
+  React.useEffect(() => { tenantIdRef.current = tenantId }, [tenantId])
+  const organizationIdRef = React.useRef(organizationId)
+  React.useEffect(() => { organizationIdRef.current = organizationId }, [organizationId])
+  const hasMountedRef = React.useRef(false)
+
+  const loadRoleData = React.useCallback(async (forTenantId: string | null | undefined, forOrganizationId: string | null | undefined) => {
     const params = new URLSearchParams({ roleId: targetId })
-    if (tenantId) params.set('tenantId', tenantId)
-    if (organizationId) params.set('organizationId', organizationId)
+    if (forTenantId) params.set('tenantId', forTenantId)
+    if (forOrganizationId) params.set('organizationId', forOrganizationId)
     const data = await readApiResultOrThrow<RoleResponse>(
       `/api/dashboards/roles/widgets?${params.toString()}`,
       undefined,
@@ -151,12 +158,12 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setMode('override')
     setOriginalMode('override')
     setEffective(ids)
-  }, [organizationId, targetId, tenantId])
+  }, [targetId])
 
-  const loadUserData = React.useCallback(async () => {
+  const loadUserData = React.useCallback(async (forTenantId: string | null | undefined, forOrganizationId: string | null | undefined) => {
     const params = new URLSearchParams({ userId: targetId })
-    if (tenantId) params.set('tenantId', tenantId)
-    if (organizationId) params.set('organizationId', organizationId)
+    if (forTenantId) params.set('tenantId', forTenantId)
+    if (forOrganizationId) params.set('organizationId', forOrganizationId)
     const data = await readApiResultOrThrow<UserResponse>(
       `/api/dashboards/users/widgets?${params.toString()}`,
       undefined,
@@ -168,7 +175,7 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
     setMode(data.mode || 'inherit')
     setOriginalMode(data.mode || 'inherit')
     setEffective(Array.isArray(data.effectiveWidgetIds) ? data.effectiveWidgetIds : [])
-  }, [organizationId, targetId, tenantId])
+  }, [targetId])
 
   React.useEffect(() => {
     let cancelled = false
@@ -177,21 +184,40 @@ export const WidgetVisibilityEditor = React.forwardRef<WidgetVisibilityEditorHan
       setError(null)
       try {
         await loadCatalog()
-        if (kind === 'role') await loadRoleData()
-        else await loadUserData()
+        if (kind === 'role') await loadRoleData(tenantIdRef.current, organizationIdRef.current)
+        else await loadUserData(tenantIdRef.current, organizationIdRef.current)
       } catch (err) {
         console.error('Failed to load widget visibility data', err)
         if (!cancelled) {
           setError(tRef.current('dashboards.widgets.error.load', 'Unable to load widget configuration.'))
         }
       } finally {
-        if (!cancelled) setLoading(false)
+        if (!cancelled) {
+          setLoading(false)
+          hasMountedRef.current = true
+        }
       }
     }
     load()
     return () => { cancelled = true }
   }, [kind, loadCatalog, loadRoleData, loadUserData])
 
+  React.useEffect(() => {
+    if (!hasMountedRef.current) return
+    if (preserveOnTenantChange) return
+    let cancelled = false
+    async function refetch() {
+      try {
+        if (kind === 'role') await loadRoleData(tenantId, organizationId)
+        else await loadUserData(tenantId, organizationId)
+      } catch (err) {
+        console.error('Failed to reload widget visibility data', err)
+      }
+    }
+    refetch()
+    return () => { cancelled = true }
+  }, [tenantId, organizationId, kind, loadRoleData, loadUserData, preserveOnTenantChange])
+
   const toggle = React.useCallback((id: string) => {
     setSelected((prev) => (prev.includes(id) ? prev.filter((value) => value !== id) : [...prev, id]))
   }, [])

package/src/modules/sales/commands/documents.ts

@@ -67,6 +67,9 @@ import {
 } from "../../customers/data/entities";
 import {
   enforceAdjustmentSign,
+  validateReturnAdjustmentWithinRemaining,
+  RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE,
+  RETURN_ADJUSTMENT_EXCEEDS_REMAINING_NET_MESSAGE,
   quoteCreateSchema,
   quoteLineCreateSchema,
   quoteAdjustmentCreateSchema,
@@ -7384,6 +7387,63 @@ const orderAdjustmentUpsertCommand: CommandHandler<
       shippingMethodCode: order.shippingMethodCode ?? null,
       paymentMethodCode: order.paymentMethodCode ?? null,
     });
+    const effectiveAdjustment = nextAdjustments.find(
+      (adj) => adj.id === adjustmentId,
+    );
+    if (effectiveAdjustment?.kind === "return") {
+      const baselineAdjustments = nextAdjustments.filter(
+        (adj) => adj.id !== adjustmentId,
+      );
+      const baselineCalculation =
+        await salesCalculationService.calculateDocumentTotals({
+          documentKind: "order",
+          lines: calcLines,
+          adjustments: baselineAdjustments,
+          context: calculationContext,
+          existingTotals: resolveExistingPaymentTotals(order),
+        });
+      const issues = validateReturnAdjustmentWithinRemaining({
+        kind: "return",
+        amountNet:
+          effectiveAdjustment.amountNet ?? effectiveAdjustment.amountGross ?? 0,
+        amountGross:
+          effectiveAdjustment.amountGross ?? effectiveAdjustment.amountNet ?? 0,
+        remainingNet: Number(
+          baselineCalculation.totals?.grandTotalNetAmount ?? 0,
+        ),
+        remainingGross: Number(
+          baselineCalculation.totals?.grandTotalGrossAmount ?? 0,
+        ),
+      });
+      if (issues.length > 0) {
+        const { translate } = await resolveTranslations();
+        const grossIssue = issues.find((issue) => issue.path === "amountGross");
+        const netIssue = issues.find((issue) => issue.path === "amountNet");
+        const fieldErrors: Record<string, string> = {};
+        if (grossIssue) {
+          fieldErrors.amountGross = translate(
+            "sales.adjustments.error.returnExceedsRemainingGrandTotalGross",
+            RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE,
+          );
+        }
+        if (netIssue) {
+          fieldErrors.amountNet = translate(
+            "sales.adjustments.error.returnExceedsRemainingGrandTotalNet",
+            RETURN_ADJUSTMENT_EXCEEDS_REMAINING_NET_MESSAGE,
+          );
+        }
+        throw new CrudHttpError(400, {
+          error:
+            fieldErrors.amountGross ??
+            fieldErrors.amountNet ??
+            translate(
+              "sales.adjustments.error.returnExceedsRemainingGrandTotalGross",
+              RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE,
+            ),
+          fieldErrors,
+        });
+      }
+    }
     const calculation = await salesCalculationService.calculateDocumentTotals({
       documentKind: "order",
       lines: calcLines,
@@ -7766,6 +7826,62 @@ const quoteAdjustmentUpsertCommand: CommandHandler<
       shippingMethodCode: quote.shippingMethodCode ?? null,
       paymentMethodCode: quote.paymentMethodCode ?? null,
     });
+    const effectiveAdjustment = nextAdjustments.find(
+      (adj) => adj.id === adjustmentId,
+    );
+    if (effectiveAdjustment?.kind === "return") {
+      const baselineAdjustments = nextAdjustments.filter(
+        (adj) => adj.id !== adjustmentId,
+      );
+      const baselineCalculation =
+        await salesCalculationService.calculateDocumentTotals({
+          documentKind: "quote",
+          lines: calcLines,
+          adjustments: baselineAdjustments,
+          context: calculationContext,
+        });
+      const issues = validateReturnAdjustmentWithinRemaining({
+        kind: "return",
+        amountNet:
+          effectiveAdjustment.amountNet ?? effectiveAdjustment.amountGross ?? 0,
+        amountGross:
+          effectiveAdjustment.amountGross ?? effectiveAdjustment.amountNet ?? 0,
+        remainingNet: Number(
+          baselineCalculation.totals?.grandTotalNetAmount ?? 0,
+        ),
+        remainingGross: Number(
+          baselineCalculation.totals?.grandTotalGrossAmount ?? 0,
+        ),
+      });
+      if (issues.length > 0) {
+        const { translate } = await resolveTranslations();
+        const grossIssue = issues.find((issue) => issue.path === "amountGross");
+        const netIssue = issues.find((issue) => issue.path === "amountNet");
+        const fieldErrors: Record<string, string> = {};
+        if (grossIssue) {
+          fieldErrors.amountGross = translate(
+            "sales.adjustments.error.returnExceedsRemainingGrandTotalGross",
+            RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE,
+          );
+        }
+        if (netIssue) {
+          fieldErrors.amountNet = translate(
+            "sales.adjustments.error.returnExceedsRemainingGrandTotalNet",
+            RETURN_ADJUSTMENT_EXCEEDS_REMAINING_NET_MESSAGE,
+          );
+        }
+        throw new CrudHttpError(400, {
+          error:
+            fieldErrors.amountGross ??
+            fieldErrors.amountNet ??
+            translate(
+              "sales.adjustments.error.returnExceedsRemainingGrandTotalGross",
+              RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE,
+            ),
+          fieldErrors,
+        });
+      }
+    }
     const calculation = await salesCalculationService.calculateDocumentTotals({
       documentKind: "quote",
       lines: calcLines,

package/src/modules/sales/data/validators.ts

@@ -523,6 +523,44 @@ export const enforceAdjustmentSign = (
  */
 export const enforceReturnAdjustmentSign = enforceAdjustmentSign
 
+export const RETURN_ADJUSTMENT_EXCEEDS_REMAINING_NET_MESSAGE =
+  'Return adjustment amountNet exceeds the remaining grand total. Reduce the amount or remove existing returns first.'
+export const RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE =
+  'Return adjustment amountGross exceeds the remaining grand total. Reduce the amount or remove existing returns first.'
+
+export type ReturnAdjustmentRemainingCheck = {
+  kind?: string | null
+  amountNet?: number | null
+  amountGross?: number | null
+  remainingNet: number
+  remainingGross: number
+}
+
+export type ReturnAdjustmentRemainingIssue = {
+  path: 'amountNet' | 'amountGross'
+  message: string
+}
+
+// Inclusive: abs(amount) === remaining is allowed. Tiny epsilon absorbs
+// floating-point rounding from upstream tax/rate adjustments.
+const RETURN_REMAINING_EPSILON = 0.005
+
+export const validateReturnAdjustmentWithinRemaining = (
+  value: ReturnAdjustmentRemainingCheck
+): ReturnAdjustmentRemainingIssue[] => {
+  if (value.kind !== 'return') return []
+  const absNet = typeof value.amountNet === 'number' ? Math.abs(value.amountNet) : 0
+  const absGross = typeof value.amountGross === 'number' ? Math.abs(value.amountGross) : 0
+  const issues: ReturnAdjustmentRemainingIssue[] = []
+  if (absGross > value.remainingGross + RETURN_REMAINING_EPSILON) {
+    issues.push({ path: 'amountGross', message: RETURN_ADJUSTMENT_EXCEEDS_REMAINING_GROSS_MESSAGE })
+  }
+  if (absNet > value.remainingNet + RETURN_REMAINING_EPSILON) {
+    issues.push({ path: 'amountNet', message: RETURN_ADJUSTMENT_EXCEEDS_REMAINING_NET_MESSAGE })
+  }
+  return issues
+}
+
 export const orderAdjustmentCreateSchema = scoped.extend({
   orderId: uuid(),
   orderLineId: uuid().optional(),

package/src/modules/sales/i18n/de.json

@@ -4,6 +4,8 @@
   "audit_logs.resource_kind.sales.payment": "Zahlung",
   "audit_logs.resource_kind.sales.shipment": "Versand",
   "customers~sales.nav.group": "Vertrieb",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalGross": "Der Bruttobetrag der Rücksendeanpassung überschreitet den verbleibenden Gesamtbetrag. Bitte verringern Sie den Betrag oder entfernen Sie bestehende Rücksendungen.",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalNet": "Der Nettobetrag der Rücksendeanpassung überschreitet den verbleibenden Gesamtbetrag. Bitte verringern Sie den Betrag oder entfernen Sie bestehende Rücksendungen.",
   "sales.audit.channels.create": "Vertriebskanal erstellen",
   "sales.audit.channels.delete": "Vertriebskanal löschen",
   "sales.audit.channels.update": "Vertriebskanal aktualisieren",

package/src/modules/sales/i18n/en.json

@@ -4,6 +4,8 @@
   "audit_logs.resource_kind.sales.payment": "Payment",
   "audit_logs.resource_kind.sales.shipment": "Shipment",
   "customers~sales.nav.group": "Sales",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalGross": "Return adjustment amountGross exceeds the remaining grand total. Reduce the amount or remove existing returns first.",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalNet": "Return adjustment amountNet exceeds the remaining grand total. Reduce the amount or remove existing returns first.",
   "sales.audit.channels.create": "Create sales channel",
   "sales.audit.channels.delete": "Delete sales channel",
   "sales.audit.channels.update": "Update sales channel",

package/src/modules/sales/i18n/es.json

@@ -4,6 +4,8 @@
   "audit_logs.resource_kind.sales.payment": "Pago",
   "audit_logs.resource_kind.sales.shipment": "Envío",
   "customers~sales.nav.group": "Ventas",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalGross": "El importe bruto del ajuste de devolución supera el total restante. Reduzca el importe o elimine las devoluciones existentes.",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalNet": "El importe neto del ajuste de devolución supera el total restante. Reduzca el importe o elimine las devoluciones existentes.",
   "sales.audit.channels.create": "Crear canal de ventas",
   "sales.audit.channels.delete": "Eliminar canal de ventas",
   "sales.audit.channels.update": "Actualizar canal de ventas",

package/src/modules/sales/i18n/pl.json

@@ -4,6 +4,8 @@
   "audit_logs.resource_kind.sales.payment": "Płatność",
   "audit_logs.resource_kind.sales.shipment": "Wysyłka",
   "customers~sales.nav.group": "Sprzedaż",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalGross": "Kwota brutto korekty zwrotu przekracza pozostałą wartość zamówienia. Zmniejsz kwotę lub usuń istniejące zwroty.",
+  "sales.adjustments.error.returnExceedsRemainingGrandTotalNet": "Kwota netto korekty zwrotu przekracza pozostałą wartość zamówienia. Zmniejsz kwotę lub usuń istniejące zwroty.",
   "sales.audit.channels.create": "Utwórz kanał sprzedaży",
   "sales.audit.channels.delete": "Usuń kanał sprzedaży",
   "sales.audit.channels.update": "Zaktualizuj kanał sprzedaży",

package/src/modules/translations/components/TranslationManager.tsx

@@ -69,6 +69,7 @@ export function TranslationManager({
   const [editedTranslations, setEditedTranslations] = React.useState<Record<string, Record<string, string>>>({})
   const editedTranslationsRef = React.useRef<Record<string, Record<string, string>>>({})
   const [hasUserEdited, setHasUserEdited] = React.useState(false)
+  const hasUserEditedRef = React.useRef(false)
 
   const entityType = isEmbedded ? (propEntityType ?? '') : selectedEntityType
   const recordId = isEmbedded ? (propRecordId ?? '') : selectedRecordId
@@ -191,11 +192,11 @@ export function TranslationManager({
 
   React.useEffect(() => {
     const sig = translationSignature
-    if (sig === lastTranslationSignatureRef.current && hasUserEdited) return
+    if (sig === lastTranslationSignatureRef.current && hasUserEditedRef.current) return
     lastTranslationSignatureRef.current = sig
 
     if (!translationData?.translations) {
-      if (!hasUserEdited) {
+      if (!hasUserEditedRef.current) {
         editedTranslationsRef.current = {}
         setEditedTranslations({})
       }
@@ -210,11 +211,11 @@ export function TranslationManager({
         parsed[locale][key] = typeof val === 'string' ? val : ''
       }
     }
-    if (!hasUserEdited) {
+    if (!hasUserEditedRef.current) {
       editedTranslationsRef.current = parsed
       setEditedTranslations(parsed)
     }
-  }, [translationSignature, translationData, hasUserEdited])
+  }, [translationSignature, translationData])
 
   const mutation = useMutation({
     mutationFn: async () => {
@@ -252,6 +253,7 @@ export function TranslationManager({
     },
     onSuccess: () => {
       flash(t('translations.manager.flash.saved', 'Translations saved'), 'success')
+      hasUserEditedRef.current = false
       setHasUserEdited(false)
       void refetchTranslation()
     },
@@ -262,6 +264,7 @@ export function TranslationManager({
   })
 
   const updateFieldValue = (locale: string, fieldKey: string, value: string) => {
+    hasUserEditedRef.current = true
     setHasUserEdited(true)
     const next = {
       ...editedTranslationsRef.current,
@@ -288,6 +291,7 @@ export function TranslationManager({
           value={selectedRecordId}
           onChange={(next) => {
             setSelectedRecordId(next)
+            hasUserEditedRef.current = false
             setHasUserEdited(false)
           }}
           placeholder={t('translations.manager.searchRecords', 'Search records...')}
@@ -482,6 +486,7 @@ export function TranslationManager({
                     onChange={(next) => {
                       setSelectedEntityType(next)
                       setSelectedRecordId('')
+                      hasUserEditedRef.current = false
                       setHasUserEdited(false)
                     }}
                     placeholder={t('translations.manager.placeholder', 'Select an entity')}

package/src/modules/workflows/lib/event-trigger-service.ts

@@ -6,9 +6,12 @@
  */
 
 import type { EntityManager } from '@mikro-orm/core'
+import type { EntityManager as PostgreSqlEntityManager } from '@mikro-orm/postgresql'
 import type { AwilixContainer } from 'awilix'
 import type { CacheService } from '@open-mercato/cache'
 import { matchEventPattern } from '@open-mercato/shared/lib/events/patterns'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { testLinearRegex } from '@open-mercato/shared/lib/regex/linear'
 import {
   WorkflowEventTrigger,
   WorkflowDefinition,
@@ -257,11 +260,12 @@ function evaluateCondition(condition: TriggerFilterCondition, payload: Record<st
       if (typeof value !== 'string' || typeof expected !== 'string') return false
       if (value.length > MAX_WORKFLOW_REGEX_INPUT_LENGTH) return false
       if (!isSafeWorkflowRegexPattern(expected)) return false
-      try {
-        const regex = new RegExp(expected)
-        return regex.test(value)
-      } catch {
-        return false
+      {
+        const result = testLinearRegex(expected, value, {
+          maxPatternLength: MAX_WORKFLOW_REGEX_PATTERN_LENGTH,
+          maxInputLength: MAX_WORKFLOW_REGEX_INPUT_LENGTH,
+        })
+        return result.ok ? result.matched : false
       }
 
     default:
@@ -325,7 +329,9 @@ async function loadLegacyTriggers(
   tenantId: string,
   organizationId: string
 ): Promise<UnifiedTrigger[]> {
-  const legacyTriggers = await em.find(
+  const postgresEm = em as unknown as PostgreSqlEntityManager
+  const legacyTriggers = await findWithDecryption(
+    postgresEm,
     WorkflowEventTrigger,
     {
       tenantId,
@@ -335,16 +341,19 @@ async function loadLegacyTriggers(
     },
     {
       orderBy: { priority: 'DESC', createdAt: 'ASC' },
-    }
+    },
+    { tenantId, organizationId },
   )
 
   // Get definitions for these triggers to get workflowId
   const definitionIds = [...new Set(legacyTriggers.map(t => t.workflowDefinitionId))]
-  const definitions = definitionIds.length > 0 ? await em.find(WorkflowDefinition, {
+  const definitions = definitionIds.length > 0 ? await findWithDecryption(postgresEm, WorkflowDefinition, {
     id: { $in: definitionIds },
+    tenantId,
+    organizationId,
     enabled: true,
     deletedAt: null,
-  }) : []
+  }, {}, { tenantId, organizationId }) : []
   const definitionMap = new Map(definitions.map(d => [d.id, d]))
 
   return legacyTriggers
@@ -379,15 +388,19 @@ async function loadEmbeddedTriggers(
   tenantId: string,
   organizationId: string
 ): Promise<UnifiedTrigger[]> {
+  const postgresEm = em as unknown as PostgreSqlEntityManager
   // Load all enabled definitions that may have triggers
-  const definitions = await em.find(
+  const definitions = await findWithDecryption(
+    postgresEm,
     WorkflowDefinition,
     {
       tenantId,
       organizationId,
       enabled: true,
       deletedAt: null,
-    }
+    },
+    {},
+    { tenantId, organizationId },
   )
 
   const triggers: UnifiedTrigger[] = []