@open-mercato/core 0.6.4-develop.4000.1.450e315cec → 0.6.4-develop.4011.1.4f3ed9ae3e

package/src/modules/catalog/commands/shared.ts

@@ -5,7 +5,7 @@ import {
   CatalogOptionSchemaTemplate,
   CatalogPriceKind,
 } from '../data/entities'
-import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -73,12 +73,42 @@ export function toNumericString(value: number | null | undefined): string | null
   return value.toString()
 }
 
+export type RequireScope = {
+  tenantId: string | null
+  organizationId: string | null
+}
+
+// Derives the actor's effective tenant/org scope for entry-point lookups, mirroring
+// the bypass semantics of ensureTenantScope/ensureOrganizationScope: tenant is always
+// strict, organization is left unrestricted for super-admins and global-org actors.
+export function commandActorScope(ctx: CommandRuntimeContext): RequireScope {
+  const orgUnrestricted = ctx.auth?.isSuperAdmin === true || ctx.organizationScope?.allowedIds === null
+  return {
+    tenantId: ctx.auth?.tenantId ?? null,
+    organizationId: orgUnrestricted ? null : (ctx.selectedOrganizationId ?? ctx.auth?.orgId ?? null),
+  }
+}
+
+function applyScopeToWhere(where: Record<string, unknown>, scope: RequireScope): void {
+  if (scope.tenantId != null) where.tenantId = scope.tenantId
+  if (scope.organizationId != null) where.organizationId = scope.organizationId
+}
+
 export async function requireProduct(
   em: EntityManager,
   id: string,
+  scope: RequireScope,
   message = 'Catalog product not found'
 ): Promise<CatalogProduct> {
-  const product = await findOneWithDecryption(em, CatalogProduct, { id, deletedAt: null })
+  const where: Record<string, unknown> = { id, deletedAt: null }
+  applyScopeToWhere(where, scope)
+  const product = await findOneWithDecryption(
+    em,
+    CatalogProduct,
+    where as FilterQuery<CatalogProduct>,
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
   if (!product) throw new CrudHttpError(404, { error: message })
   return product
 }
@@ -86,13 +116,17 @@ export async function requireProduct(
 export async function requireVariant(
   em: EntityManager,
   id: string,
+  scope: RequireScope,
   message = 'Catalog variant not found'
 ): Promise<CatalogProductVariant> {
+  const where: Record<string, unknown> = { id, deletedAt: null }
+  applyScopeToWhere(where, scope)
   const variant = await findOneWithDecryption(
     em,
     CatalogProductVariant,
-    { id, deletedAt: null },
+    where as FilterQuery<CatalogProductVariant>,
     { populate: ['product'] },
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
   )
   if (!variant) throw new CrudHttpError(404, { error: message })
   return variant
@@ -101,9 +135,18 @@ export async function requireVariant(
 export async function requireOffer(
   em: EntityManager,
   id: string,
+  scope: RequireScope,
   message = 'Catalog offer not found'
 ): Promise<CatalogOffer> {
-  const offer = await findOneWithDecryption(em, CatalogOffer, { id })
+  const where: Record<string, unknown> = { id }
+  applyScopeToWhere(where, scope)
+  const offer = await findOneWithDecryption(
+    em,
+    CatalogOffer,
+    where as FilterQuery<CatalogOffer>,
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
   if (!offer) throw new CrudHttpError(404, { error: message })
   return offer
 }
@@ -111,9 +154,21 @@ export async function requireOffer(
 export async function requirePriceKind(
   em: EntityManager,
   id: string,
+  scope: RequireScope,
   message = 'Catalog price kind not found'
 ): Promise<CatalogPriceKind> {
-  const priceKind = await findOneWithDecryption(em, CatalogPriceKind, { id, deletedAt: null })
+  // Price kinds are tenant-global: organization_id is always null and the unique key is
+  // (tenant_id, code). Scope by tenant only — applying a concrete org would never match the
+  // null row. Tenant scoping still closes the cross-tenant read hole this helper guards.
+  const where: Record<string, unknown> = { id, deletedAt: null }
+  applyScopeToWhere(where, { tenantId: scope.tenantId, organizationId: null })
+  const priceKind = await findOneWithDecryption(
+    em,
+    CatalogPriceKind,
+    where as FilterQuery<CatalogPriceKind>,
+    undefined,
+    { tenantId: scope.tenantId, organizationId: null },
+  )
   if (!priceKind) throw new CrudHttpError(404, { error: message })
   return priceKind
 }
@@ -121,9 +176,18 @@ export async function requirePriceKind(
 export async function requireOptionSchemaTemplate(
   em: EntityManager,
   id: string,
+  scope: RequireScope,
   message = 'Option schema not found'
 ): Promise<CatalogOptionSchemaTemplate> {
-  const schema = await findOneWithDecryption(em, CatalogOptionSchemaTemplate, { id, deletedAt: null })
+  const where: Record<string, unknown> = { id, deletedAt: null }
+  applyScopeToWhere(where, scope)
+  const schema = await findOneWithDecryption(
+    em,
+    CatalogOptionSchemaTemplate,
+    where as FilterQuery<CatalogOptionSchemaTemplate>,
+    undefined,
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
   if (!schema) throw new CrudHttpError(404, { error: message })
   return schema
 }

package/src/modules/catalog/commands/variants.ts

@@ -25,6 +25,7 @@ import {
 } from '../data/validators'
 import {
   cloneJson,
+  commandActorScope,
   ensureOrganizationScope,
   ensureTenantScope,
   emitCatalogQueryIndexEvent,
@@ -318,7 +319,10 @@ async function restoreVariantPricesFromSnapshots(
   if (!snapshots.length) return
   const productRef =
     typeof variant.product === 'string'
-      ? await requireProduct(em, variant.product)
+      ? await requireProduct(em, variant.product, {
+          tenantId: variant.tenantId,
+          organizationId: variant.organizationId,
+        })
       : variant.product
   for (const snapshot of snapshots) {
     const product =
@@ -547,7 +551,7 @@ const createVariantCommand: CommandHandler<VariantCreateInput, { variantId: stri
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(variantCreateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager).fork()
-    const product = await requireProduct(em, parsed.productId)
+    const product = await requireProduct(em, parsed.productId, commandActorScope(ctx))
     ensureTenantScope(ctx, product.tenantId)
     ensureOrganizationScope(ctx, product.organizationId)
     const { taxRateId, taxRate } = await resolveVariantTaxRate(
@@ -705,7 +709,10 @@ const updateVariantCommand: CommandHandler<VariantUpdateInput, { variantId: stri
     if (!record) throw new CrudHttpError(404, { error: 'Catalog variant not found' })
     ensureTenantScope(ctx, record.tenantId)
     ensureOrganizationScope(ctx, record.organizationId)
-    const product = await requireProduct(em, record.product.id)
+    const product = await requireProduct(em, record.product.id, {
+      tenantId: record.tenantId,
+      organizationId: record.organizationId,
+    })
 
     if (!product) throw new CrudHttpError(400, { error: 'Variant product missing' })
 
@@ -827,7 +834,10 @@ const updateVariantCommand: CommandHandler<VariantUpdateInput, { variantId: stri
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let record = await em.findOne(CatalogProductVariant, { id: before.id })
     if (!record) {
-      const product = await requireProduct(em, before.productId)
+      const product = await requireProduct(em, before.productId, {
+        tenantId: before.tenantId,
+        organizationId: before.organizationId,
+      })
       record = em.create(CatalogProductVariant, {
         id: before.id,
         product,
@@ -994,7 +1004,10 @@ const deleteVariantCommand: CommandHandler<
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     let record = await em.findOne(CatalogProductVariant, { id: before.id })
     if (!record) {
-      const product = await requireProduct(em, before.productId)
+      const product = await requireProduct(em, before.productId, {
+        tenantId: before.tenantId,
+        organizationId: before.organizationId,
+      })
       record = em.create(CatalogProductVariant, {
         id: before.id,
         product,

package/src/modules/catalog/i18n/de.json

@@ -361,6 +361,7 @@
   "catalog.products.create.variantsBuilder.vatColumn": "Steuerklasse",
   "catalog.products.create.variantsBuilder.vatOptionDefault": "Produkt-Steuerklasse verwenden ({{label}})",
   "catalog.products.create.variantsBuilder.vatOptionNone": "Keine Steuerklasse",
+  "catalog.products.edit.actions.backToList": "Zurück zu Produkten",
   "catalog.products.edit.custom.title": "Benutzerdefinierte Attribute",
   "catalog.products.edit.dimensions": "Maße & Gewicht",
   "catalog.products.edit.dimensions.depth": "Tiefe",

package/src/modules/catalog/i18n/en.json

@@ -361,6 +361,7 @@
   "catalog.products.create.variantsBuilder.vatColumn": "Tax class",
   "catalog.products.create.variantsBuilder.vatOptionDefault": "Use product tax class ({{label}})",
   "catalog.products.create.variantsBuilder.vatOptionNone": "No tax class",
+  "catalog.products.edit.actions.backToList": "Back to products",
   "catalog.products.edit.custom.title": "Custom attributes",
   "catalog.products.edit.dimensions": "Dimensions & weight",
   "catalog.products.edit.dimensions.depth": "Depth",

package/src/modules/catalog/i18n/es.json

@@ -361,6 +361,7 @@
   "catalog.products.create.variantsBuilder.vatColumn": "Clase de impuesto",
   "catalog.products.create.variantsBuilder.vatOptionDefault": "Usar clase de impuesto del producto ({{label}})",
   "catalog.products.create.variantsBuilder.vatOptionNone": "Sin clase de impuesto",
+  "catalog.products.edit.actions.backToList": "Volver a productos",
   "catalog.products.edit.custom.title": "Atributos personalizados",
   "catalog.products.edit.dimensions": "Dimensiones y peso",
   "catalog.products.edit.dimensions.depth": "Profundidad",

package/src/modules/catalog/i18n/pl.json

@@ -361,6 +361,7 @@
   "catalog.products.create.variantsBuilder.vatColumn": "Klasa podatkowa",
   "catalog.products.create.variantsBuilder.vatOptionDefault": "Użyj klasy podatkowej produktu ({{label}})",
   "catalog.products.create.variantsBuilder.vatOptionNone": "Brak klasy podatkowej",
+  "catalog.products.edit.actions.backToList": "Powrót do listy produktów",
   "catalog.products.edit.custom.title": "Atrybuty niestandardowe",
   "catalog.products.edit.dimensions": "Wymiary i waga",
   "catalog.products.edit.dimensions.depth": "Głębokość",

package/src/modules/resources/backend/resources/resources/[id]/page.tsx

@@ -10,7 +10,7 @@ import { collectCustomFieldValues } from '@open-mercato/ui/backend/utils/customF
 import { createCrudFormError } from '@open-mercato/ui/backend/utils/serverErrors'
 import { updateCrud, deleteCrud } from '@open-mercato/ui/backend/utils/crud'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
-import { ActivitiesSection, NotesSection, type SectionAction, type TagOption } from '@open-mercato/ui/backend/detail'
+import { ActivitiesSection, NotesSection, RecordNotFoundState, type SectionAction, type TagOption } from '@open-mercato/ui/backend/detail'
 import { VersionHistoryAction } from '@open-mercato/ui/backend/version-history'
 import { SendObjectMessageDialog } from '@open-mercato/ui/backend/messages'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -83,6 +83,7 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
   const router = useRouter()
   const searchParams = useSearchParams()
   const [initialValues, setInitialValues] = React.useState<Record<string, unknown> | null>(null)
+  const [isNotFound, setIsNotFound] = React.useState(false)
   const [tags, setTags] = React.useState<TagOption[]>([])
   const [activeTab, setActiveTab] = React.useState<'details' | 'availability'>('details')
   const [activeDetailTab, setActiveDetailTab] = React.useState<'notes' | 'activities'>('notes')
@@ -411,6 +412,7 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
 
   React.useEffect(() => {
     if (!resourceId || !resourceTypesLoaded) return
+    setIsNotFound(false)
     let cancelled = false
     async function loadResource() {
       try {
@@ -421,7 +423,10 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
         const record = await readApiResultOrThrow<ResourceResponse>(`/api/resources/resources?${params.toString()}`)
         const resourceRaw = Array.isArray(record?.items) ? record.items[0] : null
         const resource = resourceRaw ? normalizeResourceRecord(resourceRaw) : null
-        if (!resource) throw new Error(t('resources.resources.form.errors.notFound', 'Resource not found.'))
+        if (!resource) {
+          if (!cancelled) setIsNotFound(true)
+          return
+        }
         if (!cancelled) {
           const customValues = extractCustomFieldEntries(resource)
           setTags(Array.isArray(resource.tags) ? resource.tags : [])
@@ -479,6 +484,20 @@ export default function ResourcesResourceDetailPage({ params }: { params?: { id?
       ? initialValues.name.trim()
       : t('resources.resources.detail.untitled', 'Unnamed resource')
 
+  if (isNotFound) {
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('resources.resources.form.errors.notFound', 'Resource not found.')}
+            backHref="/backend/resources/resources"
+            backLabel={t('resources.resources.detail.back', 'Back to resources')}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
   return (
     <Page>
       <PageBody>

package/src/modules/sales/backend/sales/documents/[id]/page.tsx

@@ -11,6 +11,7 @@ import {
   ErrorMessage,
   InlineTextEditor,
   LoadingMessage,
+  RecordNotFoundState,
   TabEmptyState,
   TagsSection,
   type TagOption,
@@ -1876,6 +1877,7 @@ export default function SalesDocumentDetailPage({
   const searchParams = useSearchParams()
   const { confirm, ConfirmDialogElement } = useConfirmDialog()
   const [loading, setLoading] = React.useState(true)
+  const [isNotFound, setIsNotFound] = React.useState(false)
   const [record, setRecord] = React.useState<DocumentRecord | null>(null)
   const [tags, setTags] = React.useState<TagOption[]>([])
   const [kind, setKind] = React.useState<'order' | 'quote'>('quote')
@@ -2483,6 +2485,7 @@ export default function SalesDocumentDetailPage({
     async function load() {
       setLoading(true)
       setError(null)
+      setIsNotFound(false)
       const requestedKind = searchParams.get('kind')
       const preferredKind = requestedKind === 'order' ? 'order' : requestedKind === 'quote' ? 'quote' : initialKind ?? null
       const kindsToTry: Array<'order' | 'quote'> = preferredKind
@@ -2505,7 +2508,11 @@ export default function SalesDocumentDetailPage({
       }
       if (!cancelled) {
         setLoading(false)
-        setError(lastError ?? loadErrorMessage)
+        if (lastError) {
+          setError(lastError)
+        } else {
+          setIsNotFound(true)
+        }
       }
     }
     load().catch((err) => {
@@ -4435,6 +4442,26 @@ export default function SalesDocumentDetailPage({
     )
   }
 
+  if (isNotFound) {
+    const backHref = (searchParams.get('kind') === 'order' || initialKind === 'order')
+      ? '/backend/sales/orders'
+      : '/backend/sales/quotes'
+    const backLabel = (searchParams.get('kind') === 'order' || initialKind === 'order')
+      ? t('sales.documents.detail.backToOrders', 'Back to orders')
+      : t('sales.documents.detail.backToQuotes', 'Back to quotes')
+    return (
+      <Page>
+        <PageBody>
+          <RecordNotFoundState
+            label={t('sales.documents.detail.notFound', 'Document not found.')}
+            backHref={backHref}
+            backLabel={backLabel}
+          />
+        </PageBody>
+      </Page>
+    )
+  }
+
   if (error) {
     return (
       <Page>

package/src/modules/sales/i18n/de.json

@@ -552,6 +552,8 @@
   "sales.documents.detail.adjustments.updated": "Anpassung aktualisiert.",
   "sales.documents.detail.back": "Zurück zu Sales",
   "sales.documents.detail.backToCreate": "Neues Dokument erstellen",
+  "sales.documents.detail.backToOrders": "Zurück zu Bestellungen",
+  "sales.documents.detail.backToQuotes": "Zurück zu Angeboten",
   "sales.documents.detail.billing": "Rechnungsadresse",
   "sales.documents.detail.channel": "Kanal",
   "sales.documents.detail.channelInvalid": "Ausgewählter Kanal wurde nicht gefunden.",
@@ -679,6 +681,7 @@
   "sales.documents.detail.items.variant": "Variante",
   "sales.documents.detail.items.variantSearch": "Variante suchen",
   "sales.documents.detail.loading": "Dokument wird geladen…",
+  "sales.documents.detail.notFound": "Dokument nicht gefunden.",
   "sales.documents.detail.number": "Dokumentnummer",
   "sales.documents.detail.numberEditForbidden": "Dokumentennummer kann nicht bearbeitet werden.",
   "sales.documents.detail.numberEmpty": "Noch keine Nummer",

package/src/modules/sales/i18n/en.json

@@ -552,6 +552,8 @@
   "sales.documents.detail.adjustments.updated": "Adjustment updated.",
   "sales.documents.detail.back": "Back to Sales",
   "sales.documents.detail.backToCreate": "Create a new document",
+  "sales.documents.detail.backToOrders": "Back to orders",
+  "sales.documents.detail.backToQuotes": "Back to quotes",
   "sales.documents.detail.billing": "Billing address",
   "sales.documents.detail.channel": "Channel",
   "sales.documents.detail.channelInvalid": "Selected channel could not be found.",
@@ -679,6 +681,7 @@
   "sales.documents.detail.items.variant": "Variant",
   "sales.documents.detail.items.variantSearch": "Search variant",
   "sales.documents.detail.loading": "Loading document…",
+  "sales.documents.detail.notFound": "Document not found.",
   "sales.documents.detail.number": "Document number",
   "sales.documents.detail.numberEditForbidden": "Document number cannot be edited.",
   "sales.documents.detail.numberEmpty": "No number yet",

package/src/modules/sales/i18n/es.json

@@ -552,6 +552,8 @@
   "sales.documents.detail.adjustments.updated": "Ajuste actualizado.",
   "sales.documents.detail.back": "Volver a Ventas",
   "sales.documents.detail.backToCreate": "Crear un nuevo documento",
+  "sales.documents.detail.backToOrders": "Volver a pedidos",
+  "sales.documents.detail.backToQuotes": "Volver a cotizaciones",
   "sales.documents.detail.billing": "Dirección de facturación",
   "sales.documents.detail.channel": "Canal",
   "sales.documents.detail.channelInvalid": "No se pudo encontrar el canal seleccionado.",
@@ -679,6 +681,7 @@
   "sales.documents.detail.items.variant": "Variante",
   "sales.documents.detail.items.variantSearch": "Buscar variante",
   "sales.documents.detail.loading": "Cargando documento…",
+  "sales.documents.detail.notFound": "Documento no encontrado.",
   "sales.documents.detail.number": "Número de documento",
   "sales.documents.detail.numberEditForbidden": "El número de documento no se puede editar.",
   "sales.documents.detail.numberEmpty": "Sin número aún",

package/src/modules/sales/i18n/pl.json

@@ -552,6 +552,8 @@
   "sales.documents.detail.adjustments.updated": "Korekta zaktualizowana.",
   "sales.documents.detail.back": "Wróć do sprzedaży",
   "sales.documents.detail.backToCreate": "Utwórz nowy dokument",
+  "sales.documents.detail.backToOrders": "Powrót do zamówień",
+  "sales.documents.detail.backToQuotes": "Powrót do ofert",
   "sales.documents.detail.billing": "Adres rozliczeniowy",
   "sales.documents.detail.channel": "Kanał",
   "sales.documents.detail.channelInvalid": "Nie znaleziono wybranego kanału.",
@@ -679,6 +681,7 @@
   "sales.documents.detail.items.variant": "Wariant",
   "sales.documents.detail.items.variantSearch": "Szukaj wariantu",
   "sales.documents.detail.loading": "Ładowanie dokumentu…",
+  "sales.documents.detail.notFound": "Nie znaleziono dokumentu.",
   "sales.documents.detail.number": "Numer dokumentu",
   "sales.documents.detail.numberEditForbidden": "Numer dokumentu nie może być edytowany.",
   "sales.documents.detail.numberEmpty": "Brak numeru",