@open-mercato/core 0.6.4-develop.4217.1.c9aa050183 → 0.6.4-develop.4239.1.4a264a5828

package/dist/modules/customer_accounts/api/admin/users.js

@@ -185,33 +185,34 @@ async function POST(req) {
     { tenantId: auth.tenantId, organizationId: auth.orgId }
   );
   user.emailVerifiedAt = /* @__PURE__ */ new Date();
-  em.persist(user);
-  await em.flush();
-  if (parsed.data.customerEntityId) {
-    await em.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId });
-  }
-  if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
-    const validRoles = await findWithDecryption(
-      em,
-      CustomerRole,
-      {
-        id: { $in: parsed.data.roleIds },
-        tenantId: auth.tenantId,
-        deletedAt: null
-      },
-      void 0,
-      { tenantId: auth.tenantId, organizationId: auth.orgId }
-    );
-    for (const role of validRoles) {
-      const userRole = em.create(CustomerUserRole, {
-        user,
-        role,
-        createdAt: /* @__PURE__ */ new Date()
-      });
-      em.persist(userRole);
+  await em.transactional(async (tx) => {
+    tx.persist(user);
+    await tx.flush();
+    if (parsed.data.customerEntityId) {
+      await tx.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId });
     }
-    await em.flush();
-  }
+    if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {
+      const validRoles = await findWithDecryption(
+        tx,
+        CustomerRole,
+        {
+          id: { $in: parsed.data.roleIds },
+          tenantId: auth.tenantId,
+          deletedAt: null
+        },
+        void 0,
+        { tenantId: auth.tenantId, organizationId: auth.orgId }
+      );
+      for (const role of validRoles) {
+        const userRole = tx.create(CustomerUserRole, {
+          user,
+          role,
+          createdAt: /* @__PURE__ */ new Date()
+        });
+        tx.persist(userRole);
+      }
+    }
+  });
   void emitCustomerAccountsEvent("customer_accounts.user.created", {
     id: user.id,
     email: user.email,

package/dist/modules/customer_accounts/api/admin/users.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/admin/users.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { adminCreateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { sql } from 'kysely'\n\nconst EMAIL_LIKE_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport const metadata = {}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const page = Math.max(1, parseInt(url.searchParams.get('page') || '1'))\n  const pageSize = Math.min(100, Math.max(1, parseInt(url.searchParams.get('pageSize') || '25')))\n  const status = url.searchParams.get('status') as 'active' | 'inactive' | 'locked' | null\n  const customerEntityId = url.searchParams.get('customerEntityId')\n  const personEntityId = url.searchParams.get('personEntityId')\n  const roleId = url.searchParams.get('roleId')\n  const search = url.searchParams.get('search')\n\n  const where: Record<string, unknown> = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  }\n\n  if (status === 'active') {\n    where.isActive = true\n    where.$or = [{ lockedUntil: null }, { lockedUntil: { $lt: new Date() } }]\n  } else if (status === 'inactive') {\n    where.isActive = false\n  } else if (status === 'locked') {\n    where.lockedUntil = { $gt: new Date() }\n  }\n\n  if (customerEntityId) {\n    where.customerEntityId = customerEntityId\n  }\n\n  if (personEntityId) {\n    where.personEntityId = personEntityId\n  }\n\n  if (search) {\n    const trimmedSearch = search.trim()\n    // email/displayName are stored encrypted, so SQL ILIKE on the ciphertext\n    // never matches a plaintext search term. Use search_tokens table for partial\n    // matches and emailHash for exact email lookups.\n    const searchFilter: Record<string, unknown>[] = []\n\n    // Search encrypted fields via search_tokens\n    const matchedIds = await findCustomerUserIdsBySearchTokens(em, E.customer_accounts.customer_user, trimmedSearch, auth.tenantId)\n    if (matchedIds && matchedIds.length > 0) {\n      searchFilter.push({ id: { $in: matchedIds } })\n    }\n\n    // Also support exact email lookup via emailHash\n    if (EMAIL_LIKE_PATTERN.test(search)) {\n      searchFilter.push({ emailHash: hashForLookup(search) })\n    }\n\n    if (searchFilter.length > 0) {\n      if (where.$or) {\n        where.$and = [{ $or: where.$or }, { $or: searchFilter }]\n        delete where.$or\n      } else {\n        where.$or = searchFilter\n      }\n    } else {\n      // No search results found, return empty\n      return NextResponse.json({\n        ok: true,\n        items: [],\n        total: 0,\n        totalPages: 1,\n        page,\n      })\n    }\n  }\n\n  let userIds: string[] | null = null\n  if (roleId) {\n    const roleLinks = await findWithDecryption(\n      em,\n      CustomerUserRole,\n      { role: roleId as any, deletedAt: null } as any,\n      undefined,\n      { tenantId: auth.tenantId, organizationId: auth.orgId },\n    )\n    userIds = roleLinks.map((link) => (link.user as any)?.id || (link.user as unknown as string))\n    if (userIds.length === 0) {\n      return NextResponse.json({\n        ok: true,\n        items: [],\n        total: 0,\n        totalPages: 1,\n        page,\n      })\n    }\n    where.id = { $in: userIds }\n  }\n\n  const offset = (page - 1) * pageSize\n  const [users, total] = await findAndCountWithDecryption(\n    em,\n    CustomerUser,\n    where as any,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: pageSize,\n      offset,\n    },\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n\n  const pageUserIds = users.map((user) => user.id)\n  const userRoleLinks = pageUserIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerUserRole,\n        { user: { $in: pageUserIds } as any, deletedAt: null } as any,\n        { populate: ['role'] },\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n\n  const rolesByUserId = new Map<string, Array<{ id: string; name: string; slug: string }>>()\n  for (const link of userRoleLinks) {\n    const linkUserId = (link.user as any)?.id ?? (link.user as unknown as string)\n    const role = link.role as any\n    const bucket = rolesByUserId.get(linkUserId)\n    const entry = { id: role.id, name: role.name, slug: role.slug }\n    if (bucket) bucket.push(entry)\n    else rolesByUserId.set(linkUserId, [entry])\n  }\n\n  const items = users.map((user) => ({\n    id: user.id,\n    email: user.email,\n    displayName: user.displayName,\n    emailVerified: !!user.emailVerifiedAt,\n    isActive: user.isActive,\n    lockedUntil: user.lockedUntil || null,\n    lastLoginAt: user.lastLoginAt || null,\n    customerEntityId: user.customerEntityId || null,\n    personEntityId: user.personEntityId || null,\n    createdAt: user.createdAt,\n    roles: rolesByUserId.get(user.id) ?? [],\n  }))\n\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n\n  return NextResponse.json({\n    ok: true,\n    items,\n    total,\n    totalPages,\n    page,\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = adminCreateUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n\n  const existing = await customerUserService.findByEmail(parsed.data.email, auth.tenantId!)\n  if (existing) {\n    return NextResponse.json({ ok: false, error: 'A user with this email already exists' }, { status: 409 })\n  }\n\n  const user = await customerUserService.createUser(\n    parsed.data.email,\n    parsed.data.password,\n    parsed.data.displayName,\n    { tenantId: auth.tenantId!, organizationId: auth.orgId! },\n  )\n  user.emailVerifiedAt = new Date()\n  em.persist(user)\n  await em.flush()\n\n  if (parsed.data.customerEntityId) {\n    await em.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })\n  }\n\n  if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {\n    const validRoles = await findWithDecryption(\n      em,\n      CustomerRole,\n      {\n        id: { $in: parsed.data.roleIds } as any,\n        tenantId: auth.tenantId,\n        deletedAt: null,\n      } as any,\n      undefined,\n      { tenantId: auth.tenantId, organizationId: auth.orgId },\n    )\n    for (const role of validRoles) {\n      const userRole = em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      em.persist(userRole)\n    }\n    await em.flush()\n  }\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    createdBy: auth.sub,\n  }).catch(() => undefined)\n\n  return NextResponse.json({\n    ok: true,\n    user: { id: user.id, email: user.email, displayName: user.displayName },\n  }, { status: 201 })\n}\n\nconst roleSchema = z.object({ id: z.string().uuid(), name: z.string(), slug: z.string() })\nconst userSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string(),\n  displayName: z.string(),\n  emailVerified: z.boolean(),\n  isActive: z.boolean(),\n  lockedUntil: z.string().datetime().nullable(),\n  lastLoginAt: z.string().datetime().nullable(),\n  customerEntityId: z.string().uuid().nullable(),\n  personEntityId: z.string().uuid().nullable(),\n  createdAt: z.string().datetime(),\n  roles: z.array(roleSchema),\n})\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({ id: z.string().uuid(), email: z.string(), displayName: z.string() }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nasync function findCustomerUserIdsBySearchTokens(\n  em: EntityManager,\n  entityType: string,\n  search: string,\n  tenantScope: string | null | undefined,\n  field?: string,\n): Promise<string[] | null> {\n  const trimmed = search.trim()\n  if (!trimmed) return null\n  const searchConfig = resolveSearchConfig()\n  if (!searchConfig.enabled) return []\n  const { hashes } = tokenizeText(trimmed, searchConfig)\n  if (!hashes.length) return []\n\n  const db = (em as any).getKysely() as any\n  let query = db\n    .selectFrom('search_tokens')\n    .select('entity_id')\n    .where('entity_type', '=', entityType)\n    .where('token_hash', 'in', hashes)\n    .groupBy('entity_id')\n    .having(sql<boolean>`count(distinct token_hash) >= ${hashes.length}`)\n  if (field) {\n    query = query.where('field', '=', field)\n  }\n  if (tenantScope !== undefined) {\n    query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantScope}`)\n  }\n  const rows = (await query.execute()) as Array<{ entity_id?: unknown }>\n  return rows\n    .map((row) => (typeof row.entity_id === 'string' ? row.entity_id : null))\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List customer users (admin)',\n  description: 'Returns a paginated list of customer users with roles. Supports filtering by status, company, role, and search.',\n  tags: ['Customer Accounts Admin'],\n  query: z.object({\n    page: z.number().int().positive().optional(),\n    pageSize: z.number().int().positive().max(100).optional(),\n    status: z.enum(['active', 'inactive', 'locked']).optional(),\n    customerEntityId: z.string().uuid().optional(),\n    roleId: z.string().uuid().optional(),\n    search: z.string().optional(),\n  }),\n  responses: [{\n    status: 200,\n    description: 'Paginated user list',\n    schema: z.object({ ok: z.literal(true), items: z.array(userSchema), total: z.number(), totalPages: z.number(), page: z.number() }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n  ],\n}\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Create customer user (admin)',\n  description: 'Creates a new customer user directly. Staff-initiated, bypasses signup flow.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: adminCreateUserSchema },\n  responses: [{ status: 201, description: 'User created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 409, description: 'Email already exists', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer user management (admin)',\n  methods: {\n    GET: getMethodDoc,\n    POST: postMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,6BAA6B;AACtC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B,0BAA0B;AAC/D,SAAS,qBAAqB;AAC9B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AAEpB,MAAM,qBAAqB;AAEpB,MAAM,WAAW,CAAC;AAEzB,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,OAAO,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,GAAG,CAAC;AACtE,QAAM,WAAW,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,CAAC,CAAC;AAC9F,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,mBAAmB,IAAI,aAAa,IAAI,kBAAkB;AAChE,QAAM,iBAAiB,IAAI,aAAa,IAAI,gBAAgB;AAC5D,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAE5C,QAAM,QAAiC;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,WAAW;AACjB,UAAM,MAAM,CAAC,EAAE,aAAa,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,oBAAI,KAAK,EAAE,EAAE,CAAC;AAAA,EAC1E,WAAW,WAAW,YAAY;AAChC,UAAM,WAAW;AAAA,EACnB,WAAW,WAAW,UAAU;AAC9B,UAAM,cAAc,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,EACxC;AAEA,MAAI,kBAAkB;AACpB,UAAM,mBAAmB;AAAA,EAC3B;AAEA,MAAI,gBAAgB;AAClB,UAAM,iBAAiB;AAAA,EACzB;AAEA,MAAI,QAAQ;AACV,UAAM,gBAAgB,OAAO,KAAK;AAIlC,UAAM,eAA0C,CAAC;AAGjD,UAAM,aAAa,MAAM,kCAAkC,IAAI,EAAE,kBAAkB,eAAe,eAAe,KAAK,QAAQ;AAC9H,QAAI,cAAc,WAAW,SAAS,GAAG;AACvC,mBAAa,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;AAAA,IAC/C;AAGA,QAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,mBAAa,KAAK,EAAE,WAAW,cAAc,MAAM,EAAE,CAAC;AAAA,IACxD;AAEA,QAAI,aAAa,SAAS,GAAG;AAC3B,UAAI,MAAM,KAAK;AACb,cAAM,OAAO,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,EAAE,KAAK,aAAa,CAAC;AACvD,eAAO,MAAM;AAAA,MACf,OAAO;AACL,cAAM,MAAM;AAAA,MACd;AAAA,IACF,OAAO;AAEL,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO,CAAC;AAAA,QACR,OAAO;AAAA,QACP,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,UAA2B;AAC/B,MAAI,QAAQ;AACV,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,WAAW,KAAK;AAAA,MACvC;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACxD;AACA,cAAU,UAAU,IAAI,CAAC,SAAU,KAAK,MAAc,MAAO,KAAK,IAA0B;AAC5F,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO,CAAC;AAAA,QACR,OAAO;AAAA,QACP,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK,EAAE,KAAK,QAAQ;AAAA,EAC5B;AAEA,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAC/C,QAAM,gBAAgB,YAAY,SAAS,IACvC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,YAAY,GAAU,WAAW,KAAK;AAAA,IACrD,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AAEL,QAAM,gBAAgB,oBAAI,IAA+D;AACzF,aAAW,QAAQ,eAAe;AAChC,UAAM,aAAc,KAAK,MAAc,MAAO,KAAK;AACnD,UAAM,OAAO,KAAK;AAClB,UAAM,SAAS,cAAc,IAAI,UAAU;AAC3C,UAAM,QAAQ,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAC9D,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,eAAc,IAAI,YAAY,CAAC,KAAK,CAAC;AAAA,EAC5C;AAEA,QAAM,QAAQ,MAAM,IAAI,CAAC,UAAU;AAAA,IACjC,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,aAAa,KAAK;AAAA,IAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACtB,UAAU,KAAK;AAAA,IACf,aAAa,KAAK,eAAe;AAAA,IACjC,aAAa,KAAK,eAAe;AAAA,IACjC,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,WAAW,KAAK;AAAA,IAChB,OAAO,cAAc,IAAI,KAAK,EAAE,KAAK,CAAC;AAAA,EACxC,EAAE;AAEF,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,0BAA0B,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACtJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,KAAK,OAAO,KAAK,QAAS;AACxF,MAAI,UAAU;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,OAAO,MAAM,oBAAoB;AAAA,IACrC,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAW,gBAAgB,KAAK,MAAO;AAAA,EAC1D;AACA,OAAK,kBAAkB,oBAAI,KAAK;AAChC,KAAG,QAAQ,IAAI;AACf,QAAM,GAAG,MAAM;AAEf,MAAI,OAAO,KAAK,kBAAkB;AAChC,UAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,kBAAkB,OAAO,KAAK,iBAAiB,CAAC;AAAA,EACzG;AAEA,MAAI,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ,SAAS,GAAG;AACzD,UAAM,aAAa,MAAM;AAAA,MACvB;AAAA,MACA;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,OAAO,KAAK,QAAQ;AAAA,QAC/B,UAAU,KAAK;AAAA,QACf,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACxD;AACA,eAAW,QAAQ,YAAY;AAC7B,YAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,QAC3C;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,QAAQ;AAAA,IACrB;AACA,UAAM,GAAG,MAAM;AAAA,EACjB;AAEA,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK;AAAA,EAClB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,OAAO,aAAa,KAAK,YAAY;AAAA,EACxE,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AACzF,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO;AAAA,EACtB,eAAe,EAAE,QAAQ;AAAA,EACzB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,MAAM,UAAU;AAC3B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,eAAe,kCACb,IACA,YACA,QACA,aACA,OAC0B;AAC1B,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,eAAe,oBAAoB;AACzC,MAAI,CAAC,aAAa,QAAS,QAAO,CAAC;AACnC,QAAM,EAAE,OAAO,IAAI,aAAa,SAAS,YAAY;AACrD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,KAAM,GAAW,UAAU;AACjC,MAAI,QAAQ,GACT,WAAW,eAAe,EAC1B,OAAO,WAAW,EAClB,MAAM,eAAe,KAAK,UAAU,EACpC,MAAM,cAAc,MAAM,MAAM,EAChC,QAAQ,WAAW,EACnB,OAAO,oCAA6C,OAAO,MAAM,EAAE;AACtE,MAAI,OAAO;AACT,YAAQ,MAAM,MAAM,SAAS,KAAK,KAAK;AAAA,EACzC;AACA,MAAI,gBAAgB,QAAW;AAC7B,YAAQ,MAAM,MAAM,qCAA8C,WAAW,EAAE;AAAA,EACjF;AACA,QAAM,OAAQ,MAAM,MAAM,QAAQ;AAClC,SAAO,KACJ,IAAI,CAAC,QAAS,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY,IAAK,EACvE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACzE;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACxD,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC1D,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,CAAC;AAAA,EACD,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,MAAM,UAAU,GAAG,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,EACnI,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,EAC9E;AACF;AAEA,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,sBAAsB;AAAA,EAC7C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { adminCreateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { findAndCountWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { E } from '#generated/entities.ids.generated'\nimport { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'\nimport { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'\nimport { sql } from 'kysely'\n\nconst EMAIL_LIKE_PATTERN = /^[^\\s@]+@[^\\s@]+\\.[^\\s@]+$/\n\nexport const metadata = {}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n\n  const url = new URL(req.url)\n  const page = Math.max(1, parseInt(url.searchParams.get('page') || '1'))\n  const pageSize = Math.min(100, Math.max(1, parseInt(url.searchParams.get('pageSize') || '25')))\n  const status = url.searchParams.get('status') as 'active' | 'inactive' | 'locked' | null\n  const customerEntityId = url.searchParams.get('customerEntityId')\n  const personEntityId = url.searchParams.get('personEntityId')\n  const roleId = url.searchParams.get('roleId')\n  const search = url.searchParams.get('search')\n\n  const where: Record<string, unknown> = {\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  }\n\n  if (status === 'active') {\n    where.isActive = true\n    where.$or = [{ lockedUntil: null }, { lockedUntil: { $lt: new Date() } }]\n  } else if (status === 'inactive') {\n    where.isActive = false\n  } else if (status === 'locked') {\n    where.lockedUntil = { $gt: new Date() }\n  }\n\n  if (customerEntityId) {\n    where.customerEntityId = customerEntityId\n  }\n\n  if (personEntityId) {\n    where.personEntityId = personEntityId\n  }\n\n  if (search) {\n    const trimmedSearch = search.trim()\n    // email/displayName are stored encrypted, so SQL ILIKE on the ciphertext\n    // never matches a plaintext search term. Use search_tokens table for partial\n    // matches and emailHash for exact email lookups.\n    const searchFilter: Record<string, unknown>[] = []\n\n    // Search encrypted fields via search_tokens\n    const matchedIds = await findCustomerUserIdsBySearchTokens(em, E.customer_accounts.customer_user, trimmedSearch, auth.tenantId)\n    if (matchedIds && matchedIds.length > 0) {\n      searchFilter.push({ id: { $in: matchedIds } })\n    }\n\n    // Also support exact email lookup via emailHash\n    if (EMAIL_LIKE_PATTERN.test(search)) {\n      searchFilter.push({ emailHash: hashForLookup(search) })\n    }\n\n    if (searchFilter.length > 0) {\n      if (where.$or) {\n        where.$and = [{ $or: where.$or }, { $or: searchFilter }]\n        delete where.$or\n      } else {\n        where.$or = searchFilter\n      }\n    } else {\n      // No search results found, return empty\n      return NextResponse.json({\n        ok: true,\n        items: [],\n        total: 0,\n        totalPages: 1,\n        page,\n      })\n    }\n  }\n\n  let userIds: string[] | null = null\n  if (roleId) {\n    const roleLinks = await findWithDecryption(\n      em,\n      CustomerUserRole,\n      { role: roleId as any, deletedAt: null } as any,\n      undefined,\n      { tenantId: auth.tenantId, organizationId: auth.orgId },\n    )\n    userIds = roleLinks.map((link) => (link.user as any)?.id || (link.user as unknown as string))\n    if (userIds.length === 0) {\n      return NextResponse.json({\n        ok: true,\n        items: [],\n        total: 0,\n        totalPages: 1,\n        page,\n      })\n    }\n    where.id = { $in: userIds }\n  }\n\n  const offset = (page - 1) * pageSize\n  const [users, total] = await findAndCountWithDecryption(\n    em,\n    CustomerUser,\n    where as any,\n    {\n      orderBy: { createdAt: 'DESC' },\n      limit: pageSize,\n      offset,\n    },\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n\n  const pageUserIds = users.map((user) => user.id)\n  const userRoleLinks = pageUserIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerUserRole,\n        { user: { $in: pageUserIds } as any, deletedAt: null } as any,\n        { populate: ['role'] },\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n\n  const rolesByUserId = new Map<string, Array<{ id: string; name: string; slug: string }>>()\n  for (const link of userRoleLinks) {\n    const linkUserId = (link.user as any)?.id ?? (link.user as unknown as string)\n    const role = link.role as any\n    const bucket = rolesByUserId.get(linkUserId)\n    const entry = { id: role.id, name: role.name, slug: role.slug }\n    if (bucket) bucket.push(entry)\n    else rolesByUserId.set(linkUserId, [entry])\n  }\n\n  const items = users.map((user) => ({\n    id: user.id,\n    email: user.email,\n    displayName: user.displayName,\n    emailVerified: !!user.emailVerifiedAt,\n    isActive: user.isActive,\n    lockedUntil: user.lockedUntil || null,\n    lastLoginAt: user.lastLoginAt || null,\n    customerEntityId: user.customerEntityId || null,\n    personEntityId: user.personEntityId || null,\n    createdAt: user.createdAt,\n    roles: rolesByUserId.get(user.id) ?? [],\n  }))\n\n  const totalPages = Math.max(1, Math.ceil(total / pageSize))\n\n  return NextResponse.json({\n    ok: true,\n    items,\n    total,\n    totalPages,\n    page,\n  })\n}\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = adminCreateUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n\n  const existing = await customerUserService.findByEmail(parsed.data.email, auth.tenantId!)\n  if (existing) {\n    return NextResponse.json({ ok: false, error: 'A user with this email already exists' }, { status: 409 })\n  }\n\n  const user = await customerUserService.createUser(\n    parsed.data.email,\n    parsed.data.password,\n    parsed.data.displayName,\n    { tenantId: auth.tenantId!, organizationId: auth.orgId! },\n  )\n  user.emailVerifiedAt = new Date()\n\n  // Persist the user, its company association, and its role links in one\n  // transaction so a flush failure on the role loop cannot leave a roleless\n  // user committed (privilege gap).\n  await em.transactional(async (tx) => {\n    tx.persist(user)\n    await tx.flush()\n\n    if (parsed.data.customerEntityId) {\n      await tx.nativeUpdate(CustomerUser, { id: user.id }, { customerEntityId: parsed.data.customerEntityId })\n    }\n\n    if (parsed.data.roleIds && parsed.data.roleIds.length > 0) {\n      const validRoles = await findWithDecryption(\n        tx,\n        CustomerRole,\n        {\n          id: { $in: parsed.data.roleIds } as any,\n          tenantId: auth.tenantId,\n          deletedAt: null,\n        } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n      for (const role of validRoles) {\n        const userRole = tx.create(CustomerUserRole, {\n          user,\n          role,\n          createdAt: new Date(),\n        } as any)\n        tx.persist(userRole)\n      }\n    }\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.user.created', {\n    id: user.id,\n    email: user.email,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    createdBy: auth.sub,\n  }).catch(() => undefined)\n\n  return NextResponse.json({\n    ok: true,\n    user: { id: user.id, email: user.email, displayName: user.displayName },\n  }, { status: 201 })\n}\n\nconst roleSchema = z.object({ id: z.string().uuid(), name: z.string(), slug: z.string() })\nconst userSchema = z.object({\n  id: z.string().uuid(),\n  email: z.string(),\n  displayName: z.string(),\n  emailVerified: z.boolean(),\n  isActive: z.boolean(),\n  lockedUntil: z.string().datetime().nullable(),\n  lastLoginAt: z.string().datetime().nullable(),\n  customerEntityId: z.string().uuid().nullable(),\n  personEntityId: z.string().uuid().nullable(),\n  createdAt: z.string().datetime(),\n  roles: z.array(roleSchema),\n})\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  user: z.object({ id: z.string().uuid(), email: z.string(), displayName: z.string() }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nasync function findCustomerUserIdsBySearchTokens(\n  em: EntityManager,\n  entityType: string,\n  search: string,\n  tenantScope: string | null | undefined,\n  field?: string,\n): Promise<string[] | null> {\n  const trimmed = search.trim()\n  if (!trimmed) return null\n  const searchConfig = resolveSearchConfig()\n  if (!searchConfig.enabled) return []\n  const { hashes } = tokenizeText(trimmed, searchConfig)\n  if (!hashes.length) return []\n\n  const db = (em as any).getKysely() as any\n  let query = db\n    .selectFrom('search_tokens')\n    .select('entity_id')\n    .where('entity_type', '=', entityType)\n    .where('token_hash', 'in', hashes)\n    .groupBy('entity_id')\n    .having(sql<boolean>`count(distinct token_hash) >= ${hashes.length}`)\n  if (field) {\n    query = query.where('field', '=', field)\n  }\n  if (tenantScope !== undefined) {\n    query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantScope}`)\n  }\n  const rows = (await query.execute()) as Array<{ entity_id?: unknown }>\n  return rows\n    .map((row) => (typeof row.entity_id === 'string' ? row.entity_id : null))\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n}\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'List customer users (admin)',\n  description: 'Returns a paginated list of customer users with roles. Supports filtering by status, company, role, and search.',\n  tags: ['Customer Accounts Admin'],\n  query: z.object({\n    page: z.number().int().positive().optional(),\n    pageSize: z.number().int().positive().max(100).optional(),\n    status: z.enum(['active', 'inactive', 'locked']).optional(),\n    customerEntityId: z.string().uuid().optional(),\n    roleId: z.string().uuid().optional(),\n    search: z.string().optional(),\n  }),\n  responses: [{\n    status: 200,\n    description: 'Paginated user list',\n    schema: z.object({ ok: z.literal(true), items: z.array(userSchema), total: z.number(), totalPages: z.number(), page: z.number() }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n  ],\n}\n\nconst postMethodDoc: OpenApiMethodDoc = {\n  summary: 'Create customer user (admin)',\n  description: 'Creates a new customer user directly. Staff-initiated, bypasses signup flow.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: adminCreateUserSchema },\n  responses: [{ status: 201, description: 'User created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 409, description: 'Email already exists', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer user management (admin)',\n  methods: {\n    GET: getMethodDoc,\n    POST: postMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAGvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,6BAA6B;AACtC,SAAS,iCAAiC;AAC1C,SAAS,4BAA4B,0BAA0B;AAC/D,SAAS,qBAAqB;AAC9B,SAAS,SAAS;AAClB,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,WAAW;AAEpB,MAAM,qBAAqB;AAEpB,MAAM,WAAW,CAAC;AAEzB,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,OAAO,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,MAAM,KAAK,GAAG,CAAC;AACtE,QAAM,WAAW,KAAK,IAAI,KAAK,KAAK,IAAI,GAAG,SAAS,IAAI,aAAa,IAAI,UAAU,KAAK,IAAI,CAAC,CAAC;AAC9F,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,mBAAmB,IAAI,aAAa,IAAI,kBAAkB;AAChE,QAAM,iBAAiB,IAAI,aAAa,IAAI,gBAAgB;AAC5D,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAE5C,QAAM,QAAiC;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb;AAEA,MAAI,WAAW,UAAU;AACvB,UAAM,WAAW;AACjB,UAAM,MAAM,CAAC,EAAE,aAAa,KAAK,GAAG,EAAE,aAAa,EAAE,KAAK,oBAAI,KAAK,EAAE,EAAE,CAAC;AAAA,EAC1E,WAAW,WAAW,YAAY;AAChC,UAAM,WAAW;AAAA,EACnB,WAAW,WAAW,UAAU;AAC9B,UAAM,cAAc,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,EACxC;AAEA,MAAI,kBAAkB;AACpB,UAAM,mBAAmB;AAAA,EAC3B;AAEA,MAAI,gBAAgB;AAClB,UAAM,iBAAiB;AAAA,EACzB;AAEA,MAAI,QAAQ;AACV,UAAM,gBAAgB,OAAO,KAAK;AAIlC,UAAM,eAA0C,CAAC;AAGjD,UAAM,aAAa,MAAM,kCAAkC,IAAI,EAAE,kBAAkB,eAAe,eAAe,KAAK,QAAQ;AAC9H,QAAI,cAAc,WAAW,SAAS,GAAG;AACvC,mBAAa,KAAK,EAAE,IAAI,EAAE,KAAK,WAAW,EAAE,CAAC;AAAA,IAC/C;AAGA,QAAI,mBAAmB,KAAK,MAAM,GAAG;AACnC,mBAAa,KAAK,EAAE,WAAW,cAAc,MAAM,EAAE,CAAC;AAAA,IACxD;AAEA,QAAI,aAAa,SAAS,GAAG;AAC3B,UAAI,MAAM,KAAK;AACb,cAAM,OAAO,CAAC,EAAE,KAAK,MAAM,IAAI,GAAG,EAAE,KAAK,aAAa,CAAC;AACvD,eAAO,MAAM;AAAA,MACf,OAAO;AACL,cAAM,MAAM;AAAA,MACd;AAAA,IACF,OAAO;AAEL,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO,CAAC;AAAA,QACR,OAAO;AAAA,QACP,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,UAA2B;AAC/B,MAAI,QAAQ;AACV,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,QAAe,WAAW,KAAK;AAAA,MACvC;AAAA,MACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACxD;AACA,cAAU,UAAU,IAAI,CAAC,SAAU,KAAK,MAAc,MAAO,KAAK,IAA0B;AAC5F,QAAI,QAAQ,WAAW,GAAG;AACxB,aAAO,aAAa,KAAK;AAAA,QACvB,IAAI;AAAA,QACJ,OAAO,CAAC;AAAA,QACR,OAAO;AAAA,QACP,YAAY;AAAA,QACZ;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,KAAK,EAAE,KAAK,QAAQ;AAAA,EAC5B;AAEA,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,CAAC,OAAO,KAAK,IAAI,MAAM;AAAA,IAC3B;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE,SAAS,EAAE,WAAW,OAAO;AAAA,MAC7B,OAAO;AAAA,MACP;AAAA,IACF;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AAEA,QAAM,cAAc,MAAM,IAAI,CAAC,SAAS,KAAK,EAAE;AAC/C,QAAM,gBAAgB,YAAY,SAAS,IACvC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,YAAY,GAAU,WAAW,KAAK;AAAA,IACrD,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AAEL,QAAM,gBAAgB,oBAAI,IAA+D;AACzF,aAAW,QAAQ,eAAe;AAChC,UAAM,aAAc,KAAK,MAAc,MAAO,KAAK;AACnD,UAAM,OAAO,KAAK;AAClB,UAAM,SAAS,cAAc,IAAI,UAAU;AAC3C,UAAM,QAAQ,EAAE,IAAI,KAAK,IAAI,MAAM,KAAK,MAAM,MAAM,KAAK,KAAK;AAC9D,QAAI,OAAQ,QAAO,KAAK,KAAK;AAAA,QACxB,eAAc,IAAI,YAAY,CAAC,KAAK,CAAC;AAAA,EAC5C;AAEA,QAAM,QAAQ,MAAM,IAAI,CAAC,UAAU;AAAA,IACjC,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,aAAa,KAAK;AAAA,IAClB,eAAe,CAAC,CAAC,KAAK;AAAA,IACtB,UAAU,KAAK;AAAA,IACf,aAAa,KAAK,eAAe;AAAA,IACjC,aAAa,KAAK,eAAe;AAAA,IACjC,kBAAkB,KAAK,oBAAoB;AAAA,IAC3C,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,WAAW,KAAK;AAAA,IAChB,OAAO,cAAc,IAAI,KAAK,EAAE,KAAK,CAAC;AAAA,EACxC,EAAE;AAEF,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,QAAQ,QAAQ,CAAC;AAE1D,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,0BAA0B,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACtJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,sBAAsB,UAAU,IAAI;AACnD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,QAAM,WAAW,MAAM,oBAAoB,YAAY,OAAO,KAAK,OAAO,KAAK,QAAS;AACxF,MAAI,UAAU;AACZ,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzG;AAEA,QAAM,OAAO,MAAM,oBAAoB;AAAA,IACrC,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAW,gBAAgB,KAAK,MAAO;AAAA,EAC1D;AACA,OAAK,kBAAkB,oBAAI,KAAK;AAKhC,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,OAAG,QAAQ,IAAI;AACf,UAAM,GAAG,MAAM;AAEf,QAAI,OAAO,KAAK,kBAAkB;AAChC,YAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,kBAAkB,OAAO,KAAK,iBAAiB,CAAC;AAAA,IACzG;AAEA,QAAI,OAAO,KAAK,WAAW,OAAO,KAAK,QAAQ,SAAS,GAAG;AACzD,YAAM,aAAa,MAAM;AAAA,QACvB;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,OAAO,KAAK,QAAQ;AAAA,UAC/B,UAAU,KAAK;AAAA,UACf,WAAW;AAAA,QACb;AAAA,QACA;AAAA,QACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,MACxD;AACA,iBAAW,QAAQ,YAAY;AAC7B,cAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,UAC3C;AAAA,UACA;AAAA,UACA,WAAW,oBAAI,KAAK;AAAA,QACtB,CAAQ;AACR,WAAG,QAAQ,QAAQ;AAAA,MACrB;AAAA,IACF;AAAA,EACF,CAAC;AAED,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,OAAO,KAAK;AAAA,IACZ,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW,KAAK;AAAA,EAClB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,MAAM,EAAE,IAAI,KAAK,IAAI,OAAO,KAAK,OAAO,aAAa,KAAK,YAAY;AAAA,EACxE,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,aAAa,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,MAAM,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AACzF,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,OAAO,EAAE,OAAO;AAAA,EAChB,aAAa,EAAE,OAAO;AAAA,EACtB,eAAe,EAAE,QAAQ;AAAA,EACzB,UAAU,EAAE,QAAQ;AAAA,EACpB,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,aAAa,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC5C,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC7C,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EAC3C,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,OAAO,EAAE,MAAM,UAAU;AAC3B,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,GAAG,OAAO,EAAE,OAAO,GAAG,aAAa,EAAE,OAAO,EAAE,CAAC;AACtF,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,eAAe,kCACb,IACA,YACA,QACA,aACA,OAC0B;AAC1B,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,eAAe,oBAAoB;AACzC,MAAI,CAAC,aAAa,QAAS,QAAO,CAAC;AACnC,QAAM,EAAE,OAAO,IAAI,aAAa,SAAS,YAAY;AACrD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,KAAM,GAAW,UAAU;AACjC,MAAI,QAAQ,GACT,WAAW,eAAe,EAC1B,OAAO,WAAW,EAClB,MAAM,eAAe,KAAK,UAAU,EACpC,MAAM,cAAc,MAAM,MAAM,EAChC,QAAQ,WAAW,EACnB,OAAO,oCAA6C,OAAO,MAAM,EAAE;AACtE,MAAI,OAAO;AACT,YAAQ,MAAM,MAAM,SAAS,KAAK,KAAK;AAAA,EACzC;AACA,MAAI,gBAAgB,QAAW;AAC7B,YAAQ,MAAM,MAAM,qCAA8C,WAAW,EAAE;AAAA,EACjF;AACA,QAAM,OAAQ,MAAM,MAAM,QAAQ;AAClC,SAAO,KACJ,IAAI,CAAC,QAAS,OAAO,IAAI,cAAc,WAAW,IAAI,YAAY,IAAK,EACvE,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACzE;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,OAAO,EAAE,OAAO;AAAA,IACd,MAAM,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,SAAS;AAAA,IAC3C,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,SAAS,EAAE,IAAI,GAAG,EAAE,SAAS;AAAA,IACxD,QAAQ,EAAE,KAAK,CAAC,UAAU,YAAY,QAAQ,CAAC,EAAE,SAAS;AAAA,IAC1D,kBAAkB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IAC7C,QAAQ,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,IACnC,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC9B,CAAC;AAAA,EACD,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,OAAO,EAAE,MAAM,UAAU,GAAG,OAAO,EAAE,OAAO,GAAG,YAAY,EAAE,OAAO,GAAG,MAAM,EAAE,OAAO,EAAE,CAAC;AAAA,EACnI,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,EAC9E;AACF;AAEA,MAAM,gBAAkC;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,sBAAsB;AAAA,EAC7C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,YAAY;AAAA,EAC1E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/api/password/reset-confirm.js

@@ -32,12 +32,12 @@ async function POST(req) {
   await em.transactional(async (trx) => {
     await customerUserService.updatePassword(user, parsed.data.password, trx);
     await customerSessionService.revokeAllUserSessions(user.id, trx);
+    await trx.nativeUpdate(
+      CustomerUser,
+      { id: user.id, emailVerifiedAt: null },
+      { emailVerifiedAt: /* @__PURE__ */ new Date() }
+    );
   });
-  await em.nativeUpdate(
-    CustomerUser,
-    { id: user.id, emailVerifiedAt: null },
-    { emailVerifiedAt: /* @__PURE__ */ new Date() }
-  );
   void emitCustomerAccountsEvent("customer_accounts.password.changed", {
     userId: user.id,
     tenantId: user.tenantId,

package/dist/modules/customer_accounts/api/password/reset-confirm.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/password/reset-confirm.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetConfirmSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport type { EntityManager } from '@mikro-orm/postgresql'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = passwordResetConfirmSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n\n  const result = await customerTokenService.verifyPasswordResetToken(parsed.data.token)\n  if (!result) {\n    return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  }\n\n  const user = await customerUserService.findById(result.userId, result.tenantId)\n  if (!user) {\n    return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n  await em.transactional(async (trx) => {\n    await customerUserService.updatePassword(user, parsed.data.password, trx)\n    await customerSessionService.revokeAllUserSessions(user.id, trx)\n  })\n\n  await em.nativeUpdate(\n    CustomerUser,\n    { id: user.id, emailVerifiedAt: null },\n    { emailVerifiedAt: new Date() },\n  )\n\n  void emitCustomerAccountsEvent('customer_accounts.password.changed', {\n    userId: user.id,\n    tenantId: user.tenantId,\n    organizationId: user.organizationId ?? null,\n    changedBy: 'reset',\n    changedById: null,\n    at: new Date().toISOString(),\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Confirm customer password reset',\n  description: 'Validates the reset token and sets a new password. Revokes all existing sessions.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetConfirmSchema,\n    description: 'Password reset confirmation with token and new password.',\n  },\n  responses: [\n    { status: 200, description: 'Password reset successful', schema: successSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid or expired token', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Confirm customer password reset',\n  description: 'Handles password reset confirmation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAIvC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAGnC,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AAEzE,QAAM,SAAS,MAAM,qBAAqB,yBAAyB,OAAO,KAAK,KAAK;AACpF,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,OAAO,MAAM,oBAAoB,SAAS,OAAO,QAAQ,OAAO,QAAQ;AAC9E,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,oBAAoB,eAAe,MAAM,OAAO,KAAK,UAAU,GAAG;AACxE,UAAM,uBAAuB,sBAAsB,KAAK,IAAI,GAAG;AAAA,EACjE,CAAC;AAED,QAAM,GAAG;AAAA,IACP;AAAA,IACA,EAAE,IAAI,KAAK,IAAI,iBAAiB,KAAK;AAAA,IACrC,EAAE,iBAAiB,oBAAI,KAAK,EAAE;AAAA,EAChC;AAEA,OAAK,0BAA0B,sCAAsC;AAAA,IACnE,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,WAAW;AAAA,IACX,aAAa;AAAA,IACb,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,cAAc;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { passwordResetConfirmSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUserService } from '@open-mercato/core/modules/customer_accounts/services/customerUserService'\nimport { CustomerTokenService } from '@open-mercato/core/modules/customer_accounts/services/customerTokenService'\nimport { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport type { EntityManager } from '@mikro-orm/postgresql'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = passwordResetConfirmSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const customerTokenService = container.resolve('customerTokenService') as CustomerTokenService\n  const customerUserService = container.resolve('customerUserService') as CustomerUserService\n  const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService\n\n  const result = await customerTokenService.verifyPasswordResetToken(parsed.data.token)\n  if (!result) {\n    return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  }\n\n  const user = await customerUserService.findById(result.userId, result.tenantId)\n  if (!user) {\n    return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as EntityManager\n  await em.transactional(async (trx) => {\n    await customerUserService.updatePassword(user, parsed.data.password, trx)\n    await customerSessionService.revokeAllUserSessions(user.id, trx)\n    await trx.nativeUpdate(\n      CustomerUser,\n      { id: user.id, emailVerifiedAt: null },\n      { emailVerifiedAt: new Date() },\n    )\n  })\n\n  void emitCustomerAccountsEvent('customer_accounts.password.changed', {\n    userId: user.id,\n    tenantId: user.tenantId,\n    organizationId: user.organizationId ?? null,\n    changedBy: 'reset',\n    changedById: null,\n    at: new Date().toISOString(),\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Confirm customer password reset',\n  description: 'Validates the reset token and sets a new password. Revokes all existing sessions.',\n  tags: ['Customer Authentication'],\n  requestBody: {\n    schema: passwordResetConfirmSchema,\n    description: 'Password reset confirmation with token and new password.',\n  },\n  responses: [\n    { status: 200, description: 'Password reset successful', schema: successSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid or expired token', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Confirm customer password reset',\n  description: 'Handles password reset confirmation for customer accounts.',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,kCAAkC;AAC3C,SAAS,8BAA8B;AAIvC,SAAS,oBAAoB;AAC7B,SAAS,iCAAiC;AAGnC,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,2BAA2B,UAAU,IAAI;AACxD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,uBAAuB,UAAU,QAAQ,sBAAsB;AACrE,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,yBAAyB,UAAU,QAAQ,wBAAwB;AAEzE,QAAM,SAAS,MAAM,qBAAqB,yBAAyB,OAAO,KAAK,KAAK;AACpF,MAAI,CAAC,QAAQ;AACX,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,OAAO,MAAM,oBAAoB,SAAS,OAAO,QAAQ,OAAO,QAAQ;AAC9E,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,GAAG,cAAc,OAAO,QAAQ;AACpC,UAAM,oBAAoB,eAAe,MAAM,OAAO,KAAK,UAAU,GAAG;AACxE,UAAM,uBAAuB,sBAAsB,KAAK,IAAI,GAAG;AAC/D,UAAM,IAAI;AAAA,MACR;AAAA,MACA,EAAE,IAAI,KAAK,IAAI,iBAAiB,KAAK;AAAA,MACrC,EAAE,iBAAiB,oBAAI,KAAK,EAAE;AAAA,IAChC;AAAA,EACF,CAAC;AAED,OAAK,0BAA0B,sCAAsC;AAAA,IACnE,QAAQ,KAAK;AAAA,IACb,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK,kBAAkB;AAAA,IACvC,WAAW;AAAA,IACX,aAAa;AAAA,IACb,KAAI,oBAAI,KAAK,GAAE,YAAY;AAAA,EAC7B,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa;AAAA,IACX,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,cAAc;AAAA,EACjF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,EAC9E;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/portal/users/[id]/roles.js

@@ -58,16 +58,17 @@ async function PUT(req, { params }) {
     }
     validatedRoles.push(role);
   }
-  await em.nativeDelete(CustomerUserRole, { user: targetUser.id });
-  for (const role of validatedRoles) {
-    const userRole = em.create(CustomerUserRole, {
-      user: targetUser,
-      role,
-      createdAt: /* @__PURE__ */ new Date()
-    });
-    em.persist(userRole);
-  }
-  await em.flush();
+  await em.transactional(async (tx) => {
+    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id });
+    for (const role of validatedRoles) {
+      const userRole = tx.create(CustomerUserRole, {
+        user: targetUser,
+        role,
+        createdAt: /* @__PURE__ */ new Date()
+      });
+      tx.persist(userRole);
+    }
+  });
   await customerRbacService.invalidateUserCache(targetUser.id);
   return NextResponse.json({ ok: true });
 }

package/dist/modules/customer_accounts/api/portal/users/[id]/roles.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/api/portal/users/%5Bid%5D/roles.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { assignRolesSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.roles.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = assignRolesSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Verify target user belongs to same company\n  const targetUser = await findOneWithDecryption(em, CustomerUser, {\n    id: params.id,\n    customerEntityId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  }, undefined, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!targetUser) {\n    return NextResponse.json({ ok: false, error: 'User not found' }, { status: 404 })\n  }\n\n  // Validate all roles are customer_assignable and collect for assignment\n  const requestedRoleIds = parsed.data.roleIds\n  const fetchedRoles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const fetchedRolesById = new Map(fetchedRoles.map((role) => [role.id, role]))\n  const validatedRoles: InstanceType<typeof CustomerRole>[] = []\n  for (const roleId of requestedRoleIds) {\n    const role = fetchedRolesById.get(roleId)\n    if (!role || !role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: 'Role not found or not assignable' }, { status: 400 })\n    }\n    validatedRoles.push(role)\n  }\n\n  // Remove existing roles\n  await em.nativeDelete(CustomerUserRole, { user: targetUser.id as any })\n\n  // Assign new roles\n  for (const role of validatedRoles) {\n    const userRole = em.create(CustomerUserRole, {\n      user: targetUser,\n      role,\n      createdAt: new Date(),\n    } as any)\n    em.persist(userRole)\n  }\n  await em.flush()\n\n  await customerRbacService.invalidateUserCache(targetUser.id)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update portal user roles',\n  description: 'Assigns new roles to a company portal user.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: assignRolesSchema },\n  responses: [{ status: 200, description: 'Roles updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'User not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update portal user roles',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AACvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAEnD,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,2BAA2B,GAAG,mBAAmB;AAAA,EACvF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,aAAa,MAAM,sBAAsB,IAAI,cAAc;AAAA,IAC/D,IAAI,OAAO;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAGA,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,eAAe,iBAAiB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,mBAAmB,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5E,QAAM,iBAAsD,CAAC;AAC7D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,iBAAiB,IAAI,MAAM;AACxC,QAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB;AACrC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAGA,QAAM,GAAG,aAAa,kBAAkB,EAAE,MAAM,WAAW,GAAU,CAAC;AAGtE,aAAW,QAAQ,gBAAgB;AACjC,UAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,MAC3C,MAAM;AAAA,MACN;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,QAAQ;AAAA,EACrB;AACA,QAAM,GAAG,MAAM;AAEf,QAAM,oBAAoB,oBAAoB,WAAW,EAAE;AAE3D,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,kBAAkB;AAAA,EACzC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,cAAc,CAAC;AAAA,EAChF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { assignRolesSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.roles.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = assignRolesSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Verify target user belongs to same company\n  const targetUser = await findOneWithDecryption(em, CustomerUser, {\n    id: params.id,\n    customerEntityId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  }, undefined, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!targetUser) {\n    return NextResponse.json({ ok: false, error: 'User not found' }, { status: 404 })\n  }\n\n  // Validate all roles are customer_assignable and collect for assignment\n  const requestedRoleIds = parsed.data.roleIds\n  const fetchedRoles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const fetchedRolesById = new Map(fetchedRoles.map((role) => [role.id, role]))\n  const validatedRoles: InstanceType<typeof CustomerRole>[] = []\n  for (const roleId of requestedRoleIds) {\n    const role = fetchedRolesById.get(roleId)\n    if (!role || !role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: 'Role not found or not assignable' }, { status: 400 })\n    }\n    validatedRoles.push(role)\n  }\n\n  // Replace the role set atomically: deleting the old roles and inserting the new\n  // ones in one transaction prevents a flush failure from leaving the user with\n  // zero roles (portal lockout / privilege loss) (#2337).\n  await em.transactional(async (tx) => {\n    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id as any })\n    for (const role of validatedRoles) {\n      const userRole = tx.create(CustomerUserRole, {\n        user: targetUser,\n        role,\n        createdAt: new Date(),\n      } as any)\n      tx.persist(userRole)\n    }\n  })\n\n  await customerRbacService.invalidateUserCache(targetUser.id)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update portal user roles',\n  description: 'Assigns new roles to a company portal user.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: assignRolesSchema },\n  responses: [{ status: 200, description: 'Roles updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'User not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update portal user roles',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AACvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAEnD,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,2BAA2B,GAAG,mBAAmB;AAAA,EACvF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,aAAa,MAAM,sBAAsB,IAAI,cAAc;AAAA,IAC/D,IAAI,OAAO;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAGA,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,eAAe,iBAAiB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,mBAAmB,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5E,QAAM,iBAAsD,CAAC;AAC7D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,iBAAiB,IAAI,MAAM;AACxC,QAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB;AACrC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAKA,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,UAAM,GAAG,aAAa,kBAAkB,EAAE,MAAM,WAAW,GAAU,CAAC;AACtE,eAAW,QAAQ,gBAAgB;AACjC,YAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,QAC3C,MAAM;AAAA,QACN;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,oBAAoB,WAAW,EAAE;AAE3D,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,kBAAkB;AAAA,EACzC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,cAAc,CAAC;AAAA,EAChF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js

@@ -10,6 +10,7 @@ import { Spinner } from "@open-mercato/ui/primitives/spinner";
 import { apiCall, readApiResultOrThrow } from "@open-mercato/ui/backend/utils/apiCall";
 import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
+import { RecordNotFoundState, ErrorMessage } from "@open-mercato/ui/backend/detail";
 const PORTAL_FEATURES = [
   { id: "portal.profile.view", labelKey: "customer_accounts.admin.portalFeatures.profile.view", fallback: "View profile", descriptionKey: "customer_accounts.admin.portalFeatures.profile.view.description", descriptionFallback: "Allows viewing own profile information and account details" },
   { id: "portal.profile.edit", labelKey: "customer_accounts.admin.portalFeatures.profile.edit", fallback: "Edit profile", descriptionKey: "customer_accounts.admin.portalFeatures.profile.edit.description", descriptionFallback: "Allows editing display name and other profile settings" },
@@ -121,9 +122,10 @@ function CustomerRoleDetailPage({ params }) {
   const [data, setData] = React.useState(null);
   const [isLoading, setIsLoading] = React.useState(true);
   const [error, setError] = React.useState(null);
+  const [isNotFound, setIsNotFound] = React.useState(false);
   React.useEffect(() => {
     if (!id) {
-      setError(t("customer_accounts.admin.roleDetail.error.notFound", "Role not found"));
+      setIsNotFound(true);
       setIsLoading(false);
       return;
     }
@@ -131,6 +133,7 @@ function CustomerRoleDetailPage({ params }) {
     async function load() {
       setIsLoading(true);
       setError(null);
+      setIsNotFound(false);
       try {
         const payload = await readApiResultOrThrow(
           `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,
@@ -141,8 +144,12 @@ function CustomerRoleDetailPage({ params }) {
         setData(payload);
       } catch (err) {
         if (cancelled) return;
-        const message = err instanceof Error ? err.message : t("customer_accounts.admin.roleDetail.error.load", "Failed to load role");
-        setError(message);
+        if (err.status === 404) {
+          setIsNotFound(true);
+        } else {
+          const message = err instanceof Error ? err.message : t("customer_accounts.admin.roleDetail.error.load", "Failed to load role");
+          setError(message);
+        }
       } finally {
         if (!cancelled) setIsLoading(false);
       }
@@ -263,11 +270,24 @@ function CustomerRoleDetailPage({ params }) {
       /* @__PURE__ */ jsx("span", { children: t("customer_accounts.admin.roleDetail.loading", "Loading role...") })
     ] }) }) });
   }
+  if (isNotFound) {
+    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+      RecordNotFoundState,
+      {
+        label: t("customer_accounts.admin.roleDetail.error.notFound", "Role not found"),
+        backHref: "/backend/customer_accounts/roles",
+        backLabel: t("customer_accounts.admin.roleDetail.actions.backToList", "Back to roles")
+      }
+    ) }) });
+  }
   if (error || !data) {
-    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsxs("div", { className: "flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground", children: [
-      /* @__PURE__ */ jsx("p", { children: error || t("customer_accounts.admin.roleDetail.error.notFound", "Role not found") }),
-      /* @__PURE__ */ jsx(Button, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx(Link, { href: "/backend/customer_accounts/roles", children: t("customer_accounts.admin.roleDetail.actions.backToList", "Back to roles") }) })
-    ] }) }) });
+    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+      ErrorMessage,
+      {
+        label: error ?? t("customer_accounts.admin.roleDetail.error.notFound", "Role not found"),
+        action: /* @__PURE__ */ jsx(Button, { asChild: true, variant: "outline", size: "sm", children: /* @__PURE__ */ jsx(Link, { href: "/backend/customer_accounts/roles", children: t("customer_accounts.admin.roleDetail.actions.backToList", "Back to roles") }) })
+      }
+    ) }) });
   }
   return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
     CrudForm,

package/dist/modules/customer_accounts/backend/customer_accounts/roles/[id]/page.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/backend/customer_accounts/roles/%5Bid%5D/page.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <input\n                  type=\"checkbox\"\n                  checked={allSelected}\n                  ref={(el) => { if (el) el.indeterminate = someSelected && !allSelected }}\n                  onChange={() => handleGroupToggle(groupFeatures)}\n                  className=\"rounded border-border\"\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <input\n                      type=\"checkbox\"\n                      checked={features.includes(featureId)}\n                      onChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5 rounded border-border\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n\n  React.useEffect(() => {\n    if (!id) {\n      setError(t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found'))\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n        setError(message)\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const roleCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          name: (values.name as string)?.trim(),\n          description: (values.description as string)?.trim() || null,\n          isDefault: values.isDefault,\n          customerAssignable: values.customerAssignable,\n        }),\n      },\n    )\n    if (!roleCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    const aclCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ features }),\n      },\n    )\n    if (!aclCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const call = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      { method: 'DELETE' },\n    )\n    if (!call.ok) {\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <p>{error || t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}</p>\n            <Button asChild variant=\"outline\">\n              <Link href=\"/backend/customer_accounts/roles\">\n                {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n              </Link>\n            </Button>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isSystem ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
-  "mappings": ";AAqGc,cACA,YADA;AAnGd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,YAAY;AAarB,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAC1R;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,KAAK,CAAC,OAAO;AAAE,oBAAI,GAAI,IAAG,gBAAgB,gBAAgB,CAAC;AAAA,cAAY;AAAA,cACvE,UAAU,MAAM,kBAAkB,aAAa;AAAA,cAC/C,WAAU;AAAA;AAAA,UACZ;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,UAAU,MAAM,oBAAoB,SAAS;AAAA,cAC7C,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAZU,SAaZ;AAAA,MAEJ,CAAC,GACH;AAAA,SAlCQ,MAAM,EAmChB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAE5D,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,eAAS,EAAE,qDAAqD,gBAAgB,CAAC;AACjF,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,cAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,iBAAS,OAAO;AAAA,MAClB,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,WAAW,MAAM;AAAA,MACrB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACrE,UAAM,UAAU,MAAM;AAAA,MACpB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,MAAM;AAAA,MACjB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB;AACA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,OAAG,mBAAS,EAAE,qDAAqD,gBAAgB,GAAE;AAAA,MACtF,oBAAC,UAAO,SAAO,MAAC,SAAQ,WACtB,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA,OACF,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,WAAW,eAAe;AAAA,MAC1C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useRouter } from 'next/navigation'\nimport { Page, PageBody } from '@open-mercato/ui/backend/Page'\nimport { CrudForm } from '@open-mercato/ui/backend/CrudForm'\nimport type { CrudField, CrudFormGroup, CrudFormGroupComponentProps } from '@open-mercato/ui/backend/CrudForm'\nimport { Button } from '@open-mercato/ui/primitives/button'\nimport { Spinner } from '@open-mercato/ui/primitives/spinner'\nimport { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'\nimport { flash } from '@open-mercato/ui/backend/FlashMessages'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { RecordNotFoundState, ErrorMessage } from '@open-mercato/ui/backend/detail'\n\ntype RoleDetail = {\n  id: string\n  name: string\n  slug: string\n  description: string | null\n  isDefault: boolean\n  isSystem: boolean\n  customerAssignable: boolean\n  features: string[]\n}\n\nconst PORTAL_FEATURES = [\n  { id: 'portal.profile.view', labelKey: 'customer_accounts.admin.portalFeatures.profile.view', fallback: 'View profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.view.description', descriptionFallback: 'Allows viewing own profile information and account details' },\n  { id: 'portal.profile.edit', labelKey: 'customer_accounts.admin.portalFeatures.profile.edit', fallback: 'Edit profile', descriptionKey: 'customer_accounts.admin.portalFeatures.profile.edit.description', descriptionFallback: 'Allows editing display name and other profile settings' },\n  { id: 'portal.orders.view', labelKey: 'customer_accounts.admin.portalFeatures.orders.view', fallback: 'View orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.view.description', descriptionFallback: 'Allows viewing order history and order details' },\n  { id: 'portal.orders.create', labelKey: 'customer_accounts.admin.portalFeatures.orders.create', fallback: 'Create orders', descriptionKey: 'customer_accounts.admin.portalFeatures.orders.create.description', descriptionFallback: 'Allows placing new orders through the portal' },\n  { id: 'portal.invoices.view', labelKey: 'customer_accounts.admin.portalFeatures.invoices.view', fallback: 'View invoices', descriptionKey: 'customer_accounts.admin.portalFeatures.invoices.view.description', descriptionFallback: 'Allows viewing invoices and payment history' },\n  { id: 'portal.quotes.view', labelKey: 'customer_accounts.admin.portalFeatures.quotes.view', fallback: 'View quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.view.description', descriptionFallback: 'Allows viewing received quotes and their details' },\n  { id: 'portal.quotes.request', labelKey: 'customer_accounts.admin.portalFeatures.quotes.request', fallback: 'Request quotes', descriptionKey: 'customer_accounts.admin.portalFeatures.quotes.request.description', descriptionFallback: 'Allows requesting new quotes from the company' },\n  { id: 'portal.addresses.view', labelKey: 'customer_accounts.admin.portalFeatures.addresses.view', fallback: 'View addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.view.description', descriptionFallback: 'Allows viewing saved shipping and billing addresses' },\n  { id: 'portal.addresses.manage', labelKey: 'customer_accounts.admin.portalFeatures.addresses.manage', fallback: 'Manage addresses', descriptionKey: 'customer_accounts.admin.portalFeatures.addresses.manage.description', descriptionFallback: 'Allows adding, editing, and removing addresses' },\n  { id: 'portal.users.view', labelKey: 'customer_accounts.admin.portalFeatures.users.view', fallback: 'View team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.view.description', descriptionFallback: 'Allows viewing other team members in the organization' },\n  { id: 'portal.users.invite', labelKey: 'customer_accounts.admin.portalFeatures.users.invite', fallback: 'Invite team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.invite.description', descriptionFallback: 'Allows sending portal invitations to new team members' },\n  { id: 'portal.users.manage', labelKey: 'customer_accounts.admin.portalFeatures.users.manage', fallback: 'Manage team members', descriptionKey: 'customer_accounts.admin.portalFeatures.users.manage.description', descriptionFallback: 'Allows editing roles and removing team members' },\n]\n\nconst FEATURE_GROUPS: Array<{ id: string; labelKey: string; fallback: string; features: string[] }> = (() => {\n  const groups = new Map<string, string[]>()\n  for (const feature of PORTAL_FEATURES) {\n    const parts = feature.id.split('.')\n    const groupKey = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0]\n    const existing = groups.get(groupKey)\n    if (existing) {\n      existing.push(feature.id)\n    } else {\n      groups.set(groupKey, [feature.id])\n    }\n  }\n  return Array.from(groups.entries()).map(([groupId, features]) => {\n    const scope = groupId.split('.').slice(1).join('')\n    const fallback = scope.replace(/^\\w/, (ch) => ch.toUpperCase())\n    return {\n      id: groupId,\n      labelKey: `customer_accounts.admin.portalFeatures.groups.${scope}`,\n      fallback,\n      features,\n    }\n  })\n})()\n\nfunction PortalPermissionsEditor({ values, setValue }: CrudFormGroupComponentProps) {\n  const t = useT()\n  const features = React.useMemo(\n    () => Array.isArray(values.features) ? values.features as string[] : [],\n    [values.features],\n  )\n\n  const handleFeatureToggle = React.useCallback((featureId: string) => {\n    const next = features.includes(featureId)\n      ? features.filter((existingId) => existingId !== featureId)\n      : [...features, featureId]\n    setValue('features', next)\n  }, [features, setValue])\n\n  const handleGroupToggle = React.useCallback((featureIds: string[]) => {\n    const allSelected = featureIds.every((featureId) => features.includes(featureId))\n    let next: string[]\n    if (allSelected) {\n      next = features.filter((featureId) => !featureIds.includes(featureId))\n    } else {\n      next = [...features]\n      for (const featureId of featureIds) {\n        if (!next.includes(featureId)) next.push(featureId)\n      }\n    }\n    setValue('features', next)\n  }, [features, setValue])\n\n  return (\n    <div className=\"grid gap-4 sm:grid-cols-2\">\n      {FEATURE_GROUPS.map((group) => {\n        const groupFeatures = group.features\n        const allSelected = groupFeatures.every((featureId) => features.includes(featureId))\n        const someSelected = groupFeatures.some((featureId) => features.includes(featureId))\n        return (\n          <div key={group.id} className=\"rounded-lg border\">\n            <div className=\"flex items-center justify-between border-b px-4 py-3\">\n              <span className=\"text-sm font-semibold\">{t(group.labelKey, group.fallback)}</span>\n              <label className=\"flex items-center gap-2 text-xs text-muted-foreground\">\n                <input\n                  type=\"checkbox\"\n                  checked={allSelected}\n                  ref={(el) => { if (el) el.indeterminate = someSelected && !allSelected }}\n                  onChange={() => handleGroupToggle(groupFeatures)}\n                  className=\"rounded border-border\"\n                />\n                {t('customer_accounts.admin.roleDetail.selectAll', 'Select all')}\n              </label>\n            </div>\n            <div className=\"divide-y\">\n              {groupFeatures.map((featureId) => {\n                const feature = PORTAL_FEATURES.find((portalFeature) => portalFeature.id === featureId)\n                return (\n                  <label key={featureId} className=\"flex items-start gap-3 px-4 py-3 cursor-pointer hover:bg-muted/50 transition-colors\">\n                    <input\n                      type=\"checkbox\"\n                      checked={features.includes(featureId)}\n                      onChange={() => handleFeatureToggle(featureId)}\n                      className=\"mt-0.5 rounded border-border\"\n                    />\n                    <div className=\"space-y-0.5\">\n                      <div className=\"text-sm font-medium\">{feature ? t(feature.labelKey, feature.fallback) : featureId}</div>\n                      {feature && (\n                        <div className=\"text-xs text-muted-foreground\">{t(feature.descriptionKey, feature.descriptionFallback)}</div>\n                      )}\n                    </div>\n                  </label>\n                )\n              })}\n            </div>\n          </div>\n        )\n      })}\n    </div>\n  )\n}\n\nexport default function CustomerRoleDetailPage({ params }: { params?: { id?: string } }) {\n  const id = params?.id\n  const t = useT()\n  const router = useRouter()\n  const [data, setData] = React.useState<RoleDetail | null>(null)\n  const [isLoading, setIsLoading] = React.useState(true)\n  const [error, setError] = React.useState<string | null>(null)\n  const [isNotFound, setIsNotFound] = React.useState(false)\n\n  React.useEffect(() => {\n    if (!id) {\n      setIsNotFound(true)\n      setIsLoading(false)\n      return\n    }\n    let cancelled = false\n    async function load() {\n      setIsLoading(true)\n      setError(null)\n      setIsNotFound(false)\n      try {\n        const payload = await readApiResultOrThrow<RoleDetail>(\n          `/api/customer_accounts/admin/roles/${encodeURIComponent(id!)}`,\n          undefined,\n          { errorMessage: t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role') },\n        )\n        if (cancelled) return\n        setData(payload)\n      } catch (err) {\n        if (cancelled) return\n        if ((err as { status?: number }).status === 404) {\n          setIsNotFound(true)\n        } else {\n          const message = err instanceof Error ? err.message : t('customer_accounts.admin.roleDetail.error.load', 'Failed to load role')\n          setError(message)\n        }\n      } finally {\n        if (!cancelled) setIsLoading(false)\n      }\n    }\n    load()\n    return () => { cancelled = true }\n  }, [id, t])\n\n  const fields = React.useMemo<CrudField[]>(() => {\n    if (!data) return []\n    return [\n      {\n        id: 'name',\n        type: 'text' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.name', 'Name'),\n        required: true,\n        disabled: data.isSystem,\n      },\n      {\n        id: 'description',\n        type: 'textarea' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.description', 'Description'),\n      },\n      {\n        id: 'isDefault',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.isDefault', 'Default role (auto-assigned to new users)'),\n      },\n      {\n        id: 'customerAssignable',\n        type: 'checkbox' as const,\n        label: t('customer_accounts.admin.roleDetail.fields.customerAssignable', 'Customers can self-assign'),\n      },\n    ]\n  }, [data, t])\n\n  const groups = React.useMemo<CrudFormGroup[]>(() => [\n    {\n      id: 'details',\n      title: t('customer_accounts.admin.roleDetail.sections.details', 'Role Details'),\n      column: 1,\n      fields: ['name', 'description'],\n    },\n    {\n      id: 'options',\n      title: t('customer_accounts.admin.roleDetail.sections.options', 'Options'),\n      column: 1,\n      fields: ['isDefault', 'customerAssignable'],\n    },\n    {\n      id: 'permissions',\n      title: t('customer_accounts.admin.roleDetail.sections.permissions', 'Portal Permissions'),\n      column: 1,\n      component: PortalPermissionsEditor,\n    },\n  ], [t])\n\n  const initialValues = React.useMemo(() => {\n    if (!data) return {}\n    return {\n      name: data.name,\n      description: data.description || '',\n      isDefault: data.isDefault,\n      customerAssignable: data.customerAssignable,\n      features: data.features,\n    }\n  }, [data])\n\n  const handleSubmit = React.useCallback(async (values: Record<string, unknown>) => {\n    if (!id) return\n    const roleCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({\n          name: (values.name as string)?.trim(),\n          description: (values.description as string)?.trim() || null,\n          isDefault: values.isDefault,\n          customerAssignable: values.customerAssignable,\n        }),\n      },\n    )\n    if (!roleCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.save', 'Failed to save role'), 'error')\n      return\n    }\n    const features = Array.isArray(values.features) ? values.features : []\n    const aclCall = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}/acl`,\n      {\n        method: 'PUT',\n        headers: { 'content-type': 'application/json' },\n        body: JSON.stringify({ features }),\n      },\n    )\n    if (!aclCall.ok) {\n      flash(t('customer_accounts.admin.roleDetail.error.saveAcl', 'Failed to save permissions'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roleDetail.flash.saved', 'Role updated'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  const handleDelete = React.useCallback(async () => {\n    if (!id) return\n    const call = await apiCall(\n      `/api/customer_accounts/admin/roles/${encodeURIComponent(id)}`,\n      { method: 'DELETE' },\n    )\n    if (!call.ok) {\n      flash(t('customer_accounts.admin.roles.error.delete', 'Failed to delete role'), 'error')\n      return\n    }\n    flash(t('customer_accounts.admin.roles.flash.deleted', 'Role deleted'), 'success')\n    router.push('/backend/customer_accounts/roles')\n  }, [id, router, t])\n\n  if (isLoading) {\n    return (\n      <Page>\n        <PageBody>\n          <div className=\"flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground\">\n            <Spinner className=\"h-6 w-6\" />\n            <span>{t('customer_accounts.admin.roleDetail.loading', 'Loading role...')}</span>\n          </div>\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (isNotFound) {\n    return (\n      <Page>\n        <PageBody>\n          <RecordNotFoundState\n            label={t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            backHref=\"/backend/customer_accounts/roles\"\n            backLabel={t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  if (error || !data) {\n    return (\n      <Page>\n        <PageBody>\n          <ErrorMessage\n            label={error ?? t('customer_accounts.admin.roleDetail.error.notFound', 'Role not found')}\n            action={\n              <Button asChild variant=\"outline\" size=\"sm\">\n                <Link href=\"/backend/customer_accounts/roles\">\n                  {t('customer_accounts.admin.roleDetail.actions.backToList', 'Back to roles')}\n                </Link>\n              </Button>\n            }\n          />\n        </PageBody>\n      </Page>\n    )\n  }\n\n  return (\n    <Page>\n      <PageBody>\n        <CrudForm\n          title={data.name}\n          backHref=\"/backend/customer_accounts/roles\"\n          fields={fields}\n          groups={groups}\n          initialValues={initialValues}\n          entityId=\"customer_accounts:customer_role\"\n          onSubmit={handleSubmit}\n          onDelete={!data.isSystem ? handleDelete : undefined}\n          cancelHref=\"/backend/customer_accounts/roles\"\n        />\n      </PageBody>\n    </Page>\n  )\n}\n"],
+  "mappings": ";AAsGc,cACA,YADA;AApGd,YAAY,WAAW;AACvB,OAAO,UAAU;AACjB,SAAS,iBAAiB;AAC1B,SAAS,MAAM,gBAAgB;AAC/B,SAAS,gBAAgB;AAEzB,SAAS,cAAc;AACvB,SAAS,eAAe;AACxB,SAAS,SAAS,4BAA4B;AAC9C,SAAS,aAAa;AACtB,SAAS,YAAY;AACrB,SAAS,qBAAqB,oBAAoB;AAalD,MAAM,kBAAkB;AAAA,EACtB,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,6DAA6D;AAAA,EAC7R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,gBAAgB,gBAAgB,mEAAmE,qBAAqB,yDAAyD;AAAA,EACzR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,iDAAiD;AAAA,EAC7Q,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,+CAA+C;AAAA,EACnR,EAAE,IAAI,wBAAwB,UAAU,wDAAwD,UAAU,iBAAiB,gBAAgB,oEAAoE,qBAAqB,8CAA8C;AAAA,EAClR,EAAE,IAAI,sBAAsB,UAAU,sDAAsD,UAAU,eAAe,gBAAgB,kEAAkE,qBAAqB,mDAAmD;AAAA,EAC/Q,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,gDAAgD;AAAA,EACxR,EAAE,IAAI,yBAAyB,UAAU,yDAAyD,UAAU,kBAAkB,gBAAgB,qEAAqE,qBAAqB,sDAAsD;AAAA,EAC9R,EAAE,IAAI,2BAA2B,UAAU,2DAA2D,UAAU,oBAAoB,gBAAgB,uEAAuE,qBAAqB,iDAAiD;AAAA,EACjS,EAAE,IAAI,qBAAqB,UAAU,qDAAqD,UAAU,qBAAqB,gBAAgB,iEAAiE,qBAAqB,wDAAwD;AAAA,EACvR,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,wDAAwD;AAAA,EAC/R,EAAE,IAAI,uBAAuB,UAAU,uDAAuD,UAAU,uBAAuB,gBAAgB,mEAAmE,qBAAqB,iDAAiD;AAC1R;AAEA,MAAM,kBAAiG,MAAM;AAC3G,QAAM,SAAS,oBAAI,IAAsB;AACzC,aAAW,WAAW,iBAAiB;AACrC,UAAM,QAAQ,QAAQ,GAAG,MAAM,GAAG;AAClC,UAAM,WAAW,MAAM,UAAU,IAAI,GAAG,MAAM,CAAC,CAAC,IAAI,MAAM,CAAC,CAAC,KAAK,MAAM,CAAC;AACxE,UAAM,WAAW,OAAO,IAAI,QAAQ;AACpC,QAAI,UAAU;AACZ,eAAS,KAAK,QAAQ,EAAE;AAAA,IAC1B,OAAO;AACL,aAAO,IAAI,UAAU,CAAC,QAAQ,EAAE,CAAC;AAAA,IACnC;AAAA,EACF;AACA,SAAO,MAAM,KAAK,OAAO,QAAQ,CAAC,EAAE,IAAI,CAAC,CAAC,SAAS,QAAQ,MAAM;AAC/D,UAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,MAAM,CAAC,EAAE,KAAK,EAAE;AACjD,UAAM,WAAW,MAAM,QAAQ,OAAO,CAAC,OAAO,GAAG,YAAY,CAAC;AAC9D,WAAO;AAAA,MACL,IAAI;AAAA,MACJ,UAAU,iDAAiD,KAAK;AAAA,MAChE;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH,GAAG;AAEH,SAAS,wBAAwB,EAAE,QAAQ,SAAS,GAAgC;AAClF,QAAM,IAAI,KAAK;AACf,QAAM,WAAW,MAAM;AAAA,IACrB,MAAM,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAuB,CAAC;AAAA,IACtE,CAAC,OAAO,QAAQ;AAAA,EAClB;AAEA,QAAM,sBAAsB,MAAM,YAAY,CAAC,cAAsB;AACnE,UAAM,OAAO,SAAS,SAAS,SAAS,IACpC,SAAS,OAAO,CAAC,eAAe,eAAe,SAAS,IACxD,CAAC,GAAG,UAAU,SAAS;AAC3B,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,QAAM,oBAAoB,MAAM,YAAY,CAAC,eAAyB;AACpE,UAAM,cAAc,WAAW,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AAChF,QAAI;AACJ,QAAI,aAAa;AACf,aAAO,SAAS,OAAO,CAAC,cAAc,CAAC,WAAW,SAAS,SAAS,CAAC;AAAA,IACvE,OAAO;AACL,aAAO,CAAC,GAAG,QAAQ;AACnB,iBAAW,aAAa,YAAY;AAClC,YAAI,CAAC,KAAK,SAAS,SAAS,EAAG,MAAK,KAAK,SAAS;AAAA,MACpD;AAAA,IACF;AACA,aAAS,YAAY,IAAI;AAAA,EAC3B,GAAG,CAAC,UAAU,QAAQ,CAAC;AAEvB,SACE,oBAAC,SAAI,WAAU,6BACZ,yBAAe,IAAI,CAAC,UAAU;AAC7B,UAAM,gBAAgB,MAAM;AAC5B,UAAM,cAAc,cAAc,MAAM,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,UAAM,eAAe,cAAc,KAAK,CAAC,cAAc,SAAS,SAAS,SAAS,CAAC;AACnF,WACE,qBAAC,SAAmB,WAAU,qBAC5B;AAAA,2BAAC,SAAI,WAAU,wDACb;AAAA,4BAAC,UAAK,WAAU,yBAAyB,YAAE,MAAM,UAAU,MAAM,QAAQ,GAAE;AAAA,QAC3E,qBAAC,WAAM,WAAU,yDACf;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS;AAAA,cACT,KAAK,CAAC,OAAO;AAAE,oBAAI,GAAI,IAAG,gBAAgB,gBAAgB,CAAC;AAAA,cAAY;AAAA,cACvE,UAAU,MAAM,kBAAkB,aAAa;AAAA,cAC/C,WAAU;AAAA;AAAA,UACZ;AAAA,UACC,EAAE,gDAAgD,YAAY;AAAA,WACjE;AAAA,SACF;AAAA,MACA,oBAAC,SAAI,WAAU,YACZ,wBAAc,IAAI,CAAC,cAAc;AAChC,cAAM,UAAU,gBAAgB,KAAK,CAAC,kBAAkB,cAAc,OAAO,SAAS;AACtF,eACE,qBAAC,WAAsB,WAAU,uFAC/B;AAAA;AAAA,YAAC;AAAA;AAAA,cACC,MAAK;AAAA,cACL,SAAS,SAAS,SAAS,SAAS;AAAA,cACpC,UAAU,MAAM,oBAAoB,SAAS;AAAA,cAC7C,WAAU;AAAA;AAAA,UACZ;AAAA,UACA,qBAAC,SAAI,WAAU,eACb;AAAA,gCAAC,SAAI,WAAU,uBAAuB,oBAAU,EAAE,QAAQ,UAAU,QAAQ,QAAQ,IAAI,WAAU;AAAA,YACjG,WACC,oBAAC,SAAI,WAAU,iCAAiC,YAAE,QAAQ,gBAAgB,QAAQ,mBAAmB,GAAE;AAAA,aAE3G;AAAA,aAZU,SAaZ;AAAA,MAEJ,CAAC,GACH;AAAA,SAlCQ,MAAM,EAmChB;AAAA,EAEJ,CAAC,GACH;AAEJ;AAEe,SAAR,uBAAwC,EAAE,OAAO,GAAiC;AACvF,QAAM,KAAK,QAAQ;AACnB,QAAM,IAAI,KAAK;AACf,QAAM,SAAS,UAAU;AACzB,QAAM,CAAC,MAAM,OAAO,IAAI,MAAM,SAA4B,IAAI;AAC9D,QAAM,CAAC,WAAW,YAAY,IAAI,MAAM,SAAS,IAAI;AACrD,QAAM,CAAC,OAAO,QAAQ,IAAI,MAAM,SAAwB,IAAI;AAC5D,QAAM,CAAC,YAAY,aAAa,IAAI,MAAM,SAAS,KAAK;AAExD,QAAM,UAAU,MAAM;AACpB,QAAI,CAAC,IAAI;AACP,oBAAc,IAAI;AAClB,mBAAa,KAAK;AAClB;AAAA,IACF;AACA,QAAI,YAAY;AAChB,mBAAe,OAAO;AACpB,mBAAa,IAAI;AACjB,eAAS,IAAI;AACb,oBAAc,KAAK;AACnB,UAAI;AACF,cAAM,UAAU,MAAM;AAAA,UACpB,sCAAsC,mBAAmB,EAAG,CAAC;AAAA,UAC7D;AAAA,UACA,EAAE,cAAc,EAAE,iDAAiD,qBAAqB,EAAE;AAAA,QAC5F;AACA,YAAI,UAAW;AACf,gBAAQ,OAAO;AAAA,MACjB,SAAS,KAAK;AACZ,YAAI,UAAW;AACf,YAAK,IAA4B,WAAW,KAAK;AAC/C,wBAAc,IAAI;AAAA,QACpB,OAAO;AACL,gBAAM,UAAU,eAAe,QAAQ,IAAI,UAAU,EAAE,iDAAiD,qBAAqB;AAC7H,mBAAS,OAAO;AAAA,QAClB;AAAA,MACF,UAAE;AACA,YAAI,CAAC,UAAW,cAAa,KAAK;AAAA,MACpC;AAAA,IACF;AACA,SAAK;AACL,WAAO,MAAM;AAAE,kBAAY;AAAA,IAAK;AAAA,EAClC,GAAG,CAAC,IAAI,CAAC,CAAC;AAEV,QAAM,SAAS,MAAM,QAAqB,MAAM;AAC9C,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,kDAAkD,MAAM;AAAA,QACjE,UAAU;AAAA,QACV,UAAU,KAAK;AAAA,MACjB;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,yDAAyD,aAAa;AAAA,MACjF;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,uDAAuD,2CAA2C;AAAA,MAC7G;AAAA,MACA;AAAA,QACE,IAAI;AAAA,QACJ,MAAM;AAAA,QACN,OAAO,EAAE,gEAAgE,2BAA2B;AAAA,MACtG;AAAA,IACF;AAAA,EACF,GAAG,CAAC,MAAM,CAAC,CAAC;AAEZ,QAAM,SAAS,MAAM,QAAyB,MAAM;AAAA,IAClD;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,cAAc;AAAA,MAC9E,QAAQ;AAAA,MACR,QAAQ,CAAC,QAAQ,aAAa;AAAA,IAChC;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,uDAAuD,SAAS;AAAA,MACzE,QAAQ;AAAA,MACR,QAAQ,CAAC,aAAa,oBAAoB;AAAA,IAC5C;AAAA,IACA;AAAA,MACE,IAAI;AAAA,MACJ,OAAO,EAAE,2DAA2D,oBAAoB;AAAA,MACxF,QAAQ;AAAA,MACR,WAAW;AAAA,IACb;AAAA,EACF,GAAG,CAAC,CAAC,CAAC;AAEN,QAAM,gBAAgB,MAAM,QAAQ,MAAM;AACxC,QAAI,CAAC,KAAM,QAAO,CAAC;AACnB,WAAO;AAAA,MACL,MAAM,KAAK;AAAA,MACX,aAAa,KAAK,eAAe;AAAA,MACjC,WAAW,KAAK;AAAA,MAChB,oBAAoB,KAAK;AAAA,MACzB,UAAU,KAAK;AAAA,IACjB;AAAA,EACF,GAAG,CAAC,IAAI,CAAC;AAET,QAAM,eAAe,MAAM,YAAY,OAAO,WAAoC;AAChF,QAAI,CAAC,GAAI;AACT,UAAM,WAAW,MAAM;AAAA,MACrB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU;AAAA,UACnB,MAAO,OAAO,MAAiB,KAAK;AAAA,UACpC,aAAc,OAAO,aAAwB,KAAK,KAAK;AAAA,UACvD,WAAW,OAAO;AAAA,UAClB,oBAAoB,OAAO;AAAA,QAC7B,CAAC;AAAA,MACH;AAAA,IACF;AACA,QAAI,CAAC,SAAS,IAAI;AAChB,YAAM,EAAE,iDAAiD,qBAAqB,GAAG,OAAO;AACxF;AAAA,IACF;AACA,UAAM,WAAW,MAAM,QAAQ,OAAO,QAAQ,IAAI,OAAO,WAAW,CAAC;AACrE,UAAM,UAAU,MAAM;AAAA,MACpB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D;AAAA,QACE,QAAQ;AAAA,QACR,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,QAC9C,MAAM,KAAK,UAAU,EAAE,SAAS,CAAC;AAAA,MACnC;AAAA,IACF;AACA,QAAI,CAAC,QAAQ,IAAI;AACf,YAAM,EAAE,oDAAoD,4BAA4B,GAAG,OAAO;AAClG;AAAA,IACF;AACA,UAAM,EAAE,kDAAkD,cAAc,GAAG,SAAS;AACpF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,QAAM,eAAe,MAAM,YAAY,YAAY;AACjD,QAAI,CAAC,GAAI;AACT,UAAM,OAAO,MAAM;AAAA,MACjB,sCAAsC,mBAAmB,EAAE,CAAC;AAAA,MAC5D,EAAE,QAAQ,SAAS;AAAA,IACrB;AACA,QAAI,CAAC,KAAK,IAAI;AACZ,YAAM,EAAE,8CAA8C,uBAAuB,GAAG,OAAO;AACvF;AAAA,IACF;AACA,UAAM,EAAE,+CAA+C,cAAc,GAAG,SAAS;AACjF,WAAO,KAAK,kCAAkC;AAAA,EAChD,GAAG,CAAC,IAAI,QAAQ,CAAC,CAAC;AAElB,MAAI,WAAW;AACb,WACE,oBAAC,QACC,8BAAC,YACC,+BAAC,SAAI,WAAU,kFACb;AAAA,0BAAC,WAAQ,WAAU,WAAU;AAAA,MAC7B,oBAAC,UAAM,YAAE,8CAA8C,iBAAiB,GAAE;AAAA,OAC5E,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,YAAY;AACd,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,EAAE,qDAAqD,gBAAgB;AAAA,QAC9E,UAAS;AAAA,QACT,WAAW,EAAE,yDAAyD,eAAe;AAAA;AAAA,IACvF,GACF,GACF;AAAA,EAEJ;AAEA,MAAI,SAAS,CAAC,MAAM;AAClB,WACE,oBAAC,QACC,8BAAC,YACC;AAAA,MAAC;AAAA;AAAA,QACC,OAAO,SAAS,EAAE,qDAAqD,gBAAgB;AAAA,QACvF,QACE,oBAAC,UAAO,SAAO,MAAC,SAAQ,WAAU,MAAK,MACrC,8BAAC,QAAK,MAAK,oCACR,YAAE,yDAAyD,eAAe,GAC7E,GACF;AAAA;AAAA,IAEJ,GACF,GACF;AAAA,EAEJ;AAEA,SACE,oBAAC,QACC,8BAAC,YACC;AAAA,IAAC;AAAA;AAAA,MACC,OAAO,KAAK;AAAA,MACZ,UAAS;AAAA,MACT;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAS;AAAA,MACT,UAAU;AAAA,MACV,UAAU,CAAC,KAAK,WAAW,eAAe;AAAA,MAC1C,YAAW;AAAA;AAAA,EACb,GACF,GACF;AAEJ;",
   "names": []
 }

package/dist/modules/customer_accounts/backend/customer_accounts/users/[id]/page.js

@@ -16,6 +16,7 @@ import { flash } from "@open-mercato/ui/backend/FlashMessages";
 import { useT } from "@open-mercato/shared/lib/i18n/context";
 import { useConfirmDialog } from "@open-mercato/ui/backend/confirm-dialog";
 import { useGuardedMutation } from "@open-mercato/ui/backend/injection/useGuardedMutation";
+import { RecordNotFoundState, ErrorMessage } from "@open-mercato/ui/backend/detail";
 function formatDate(value, fallback) {
   if (!value) return fallback;
   const date = new Date(value);
@@ -111,6 +112,7 @@ function CustomerUserDetailPage({ params }) {
   const [data, setData] = React.useState(null);
   const [isLoading, setIsLoading] = React.useState(true);
   const [error, setError] = React.useState(null);
+  const [isNotFound, setIsNotFound] = React.useState(false);
   const [isSaving, setIsSaving] = React.useState(false);
   const [editActive, setEditActive] = React.useState(null);
   const [editDisplayName, setEditDisplayName] = React.useState("");
@@ -144,7 +146,7 @@ function CustomerUserDetailPage({ params }) {
   );
   React.useEffect(() => {
     if (!id) {
-      setError(t("customer_accounts.admin.detail.error.notFound", "User not found"));
+      setIsNotFound(true);
       setIsLoading(false);
       return;
     }
@@ -152,6 +154,7 @@ function CustomerUserDetailPage({ params }) {
     async function load() {
       setIsLoading(true);
       setError(null);
+      setIsNotFound(false);
       try {
         const payload = await readApiResultOrThrow(
           `/api/customer_accounts/admin/users/${encodeURIComponent(id)}`,
@@ -167,8 +170,12 @@ function CustomerUserDetailPage({ params }) {
         setEditCustomerEntityId(payload.customerEntityId);
       } catch (err) {
         if (cancelled) return;
-        const message = err instanceof Error ? err.message : t("customer_accounts.admin.detail.error.load", "Failed to load user");
-        setError(message);
+        if (err.status === 404) {
+          setIsNotFound(true);
+        } else {
+          const message = err instanceof Error ? err.message : t("customer_accounts.admin.detail.error.load", "Failed to load user");
+          setError(message);
+        }
       } finally {
         if (!cancelled) setIsLoading(false);
       }
@@ -416,11 +423,24 @@ function CustomerUserDetailPage({ params }) {
       /* @__PURE__ */ jsx("span", { children: t("customer_accounts.admin.detail.loading", "Loading user...") })
     ] }) }) });
   }
+  if (isNotFound) {
+    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+      RecordNotFoundState,
+      {
+        label: t("customer_accounts.admin.detail.error.notFound", "User not found"),
+        backHref: "/backend/customer_accounts/users",
+        backLabel: t("customer_accounts.admin.detail.actions.backToList", "Back to list")
+      }
+    ) }) });
+  }
   if (error || !data) {
-    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsxs("div", { className: "flex h-[50vh] flex-col items-center justify-center gap-2 text-muted-foreground", children: [
-      /* @__PURE__ */ jsx("p", { children: error || t("customer_accounts.admin.detail.error.notFound", "User not found") }),
-      /* @__PURE__ */ jsx(Button, { asChild: true, variant: "outline", children: /* @__PURE__ */ jsx(Link, { href: "/backend/customer_accounts/users", children: t("customer_accounts.admin.detail.actions.backToList", "Back to list") }) })
-    ] }) }) });
+    return /* @__PURE__ */ jsx(Page, { children: /* @__PURE__ */ jsx(PageBody, { children: /* @__PURE__ */ jsx(
+      ErrorMessage,
+      {
+        label: error ?? t("customer_accounts.admin.detail.error.notFound", "User not found"),
+        action: /* @__PURE__ */ jsx(Button, { asChild: true, variant: "outline", size: "sm", children: /* @__PURE__ */ jsx(Link, { href: "/backend/customer_accounts/users", children: t("customer_accounts.admin.detail.actions.backToList", "Back to list") }) })
+      }
+    ) }) });
   }
   return /* @__PURE__ */ jsxs(Page, { children: [
     /* @__PURE__ */ jsxs(PageBody, { className: "space-y-6", children: [