@open-mercato/core 0.6.4-develop.4371.1.8f3030407e → 0.6.4

package/dist/helpers/integration/customerAccountsFixtures.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/customerAccountsFixtures.ts"],
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test'\nimport { randomUUID } from 'node:crypto'\nimport { apiRequest } from './api'\nimport { expectId, readJsonSafe } from './generalFixtures'\n\n/**\n * Customer-portal / customer_accounts integration fixtures.\n *\n * The portal API (`/api/customer_accounts/portal/*`) authenticates with a pair\n * of httpOnly cookies (`customer_auth_token` JWT + `customer_session_token`),\n * not the staff Bearer token. Against the ephemeral PROD build the login route\n * sets those cookies with `Secure: true`, which Playwright's cookie jar refuses\n * to replay over plain `http://`. So {@link portalLogin} extracts the cookie\n * values from the `set-cookie` header and callers pass them back as an explicit\n * `Cookie:` header \u2014 this also keeps multiple portal actors isolated in one test\n * (each call sends exactly the header it is given, never a shared jar).\n *\n * Staff-admin setup calls (create role/user, set ACL, cleanup) reuse the shared\n * Bearer-token `apiRequest` helper.\n */\n\n/** Short, collision-resistant token for unique emails/slugs (crypto-backed). */\nexport function uniqueSuffix(): string {\n  return randomUUID().replace(/-/g, '').slice(0, 12)\n}\n\n/**\n * A password that satisfies common complexity rules (upper + lower + digit +\n * symbol) and the customer_accounts length bounds (8\u2013128 chars).\n */\nexport function customerTestPassword(): string {\n  return `Aa1!${uniqueSuffix()}`\n}\n\nexport type CustomerRoleFixture = { id: string; name: string; slug: string }\n\nexport type CustomerUserFixture = {\n  id: string\n  email: string\n  password: string\n  displayName: string\n  customerEntityId: string | null\n}\n\nexport type CreateCustomerRoleInput = {\n  /** Defaults to a unique generated name. */\n  name?: string\n  /** Defaults to a unique generated slug (lowercased, `[a-z0-9_-]`). */\n  slug?: string\n  /** When provided, the role's ACL is set to these features after creation. */\n  features?: string[]\n  /** When provided, sets the portal-admin bypass flag on the role ACL. */\n  isPortalAdmin?: boolean\n  /** Allow assignment via the portal `users/[id]/roles` endpoint. */\n  customerAssignable?: boolean\n}\n\n/**\n * Create a customer role (staff admin) and, when `features`/`isPortalAdmin` are\n * provided, set its ACL. Returns the created role identity.\n */\nexport async function createCustomerRoleFixture(\n  request: APIRequestContext,\n  adminToken: string,\n  input: CreateCustomerRoleInput = {},\n): Promise<CustomerRoleFixture> {\n  const suffix = uniqueSuffix()\n  const name = input.name ?? `QA Portal Role ${suffix}`\n  const slug = input.slug ?? `qa-portal-role-${suffix}`\n\n  const createRes = await apiRequest(request, 'POST', '/api/customer_accounts/admin/roles', {\n    token: adminToken,\n    data: {\n      name,\n      slug,\n      description: 'Integration fixture role',\n      customerAssignable: input.customerAssignable ?? false,\n    },\n  })\n  expect(createRes.status(), 'POST /admin/roles should return 201').toBe(201)\n  const body = await readJsonSafe<{ role?: { id?: string } }>(createRes)\n  const id = expectId(body?.role?.id, 'Role creation response should include role.id')\n\n  if (input.features || typeof input.isPortalAdmin === 'boolean') {\n    await setCustomerRoleAcl(request, adminToken, id, {\n      features: input.features ?? [],\n      isPortalAdmin: input.isPortalAdmin,\n    })\n  }\n\n  return { id, name, slug }\n}\n\n/** Set a customer role's ACL (features + optional portal-admin flag). */\nexport async function setCustomerRoleAcl(\n  request: APIRequestContext,\n  adminToken: string,\n  roleId: string,\n  input: { features: string[]; isPortalAdmin?: boolean },\n): Promise<void> {\n  const data: { features: string[]; isPortalAdmin?: boolean } = { features: input.features }\n  if (typeof input.isPortalAdmin === 'boolean') data.isPortalAdmin = input.isPortalAdmin\n  const res = await apiRequest(request, 'PUT', `/api/customer_accounts/admin/roles/${roleId}/acl`, {\n    token: adminToken,\n    data,\n  })\n  expect(res.status(), 'PUT /admin/roles/[id]/acl should return 200').toBe(200)\n}\n\n/**\n * Create a real owned CRM company (staff admin) and return its `CustomerEntity`\n * id. `POST /admin/users` validates `customerEntityId` against an owned company\n * in the caller's tenant+org (kind=company), so portal scoping fixtures must\n * link users to a company that actually exists rather than a synthetic UUID.\n */\nexport async function createCustomerCompanyFixture(\n  request: APIRequestContext,\n  adminToken: string,\n  displayName?: string,\n): Promise<string> {\n  const name = displayName ?? `QA Portal Company ${uniqueSuffix()}`\n  const res = await apiRequest(request, 'POST', '/api/customers/companies', {\n    token: adminToken,\n    data: { displayName: name },\n  })\n  expect(res.status(), 'POST /customers/companies should return 201').toBe(201)\n  const body = await readJsonSafe<{ id?: string; entityId?: string }>(res)\n  return expectId(body?.id ?? body?.entityId, 'Company creation response should include the entity id')\n}\n\n/** Best-effort soft-delete of a CRM company (cleanup). */\nexport async function deleteCustomerCompanyFixture(\n  request: APIRequestContext,\n  adminToken: string | null,\n  companyEntityId: string | null,\n): Promise<void> {\n  if (!adminToken || !companyEntityId) return\n  await apiRequest(request, 'DELETE', `/api/customers/companies?id=${companyEntityId}`, {\n    token: adminToken,\n  }).catch(() => undefined)\n}\n\nexport type CreateCustomerUserInput = {\n  email?: string\n  password?: string\n  displayName?: string\n  roleIds?: string[]\n  /**\n   * Owned CRM company id (a `CustomerEntity` of kind=company in the caller's\n   * tenant+org) used for portal company scoping. `POST /admin/users` rejects an\n   * id that is not an owned company, so create one via\n   * {@link createCustomerCompanyFixture} rather than passing a synthetic UUID.\n   */\n  customerEntityId?: string | null\n}\n\n/**\n * Create a customer user (staff admin). Admin-created users are email-verified\n * automatically, so the returned credentials can log in immediately.\n */\nexport async function createCustomerUserFixture(\n  request: APIRequestContext,\n  adminToken: string,\n  input: CreateCustomerUserInput = {},\n): Promise<CustomerUserFixture> {\n  const suffix = uniqueSuffix()\n  const email = input.email ?? `qa-portal-${suffix}@test.local`\n  const password = input.password ?? customerTestPassword()\n  const displayName = input.displayName ?? `QA Portal User ${suffix}`\n\n  const data: Record<string, unknown> = { email, password, displayName }\n  if (input.roleIds && input.roleIds.length > 0) data.roleIds = input.roleIds\n  if (input.customerEntityId) data.customerEntityId = input.customerEntityId\n\n  const res = await apiRequest(request, 'POST', '/api/customer_accounts/admin/users', {\n    token: adminToken,\n    data,\n  })\n  expect(res.status(), 'POST /admin/users should return 201').toBe(201)\n  const body = await readJsonSafe<{ user?: { id?: string } }>(res)\n  const id = expectId(body?.user?.id, 'User creation response should include user.id')\n\n  return { id, email, password, displayName, customerEntityId: input.customerEntityId ?? null }\n}\n\nexport type PortalSession = {\n  /** Raw `customer_auth_token` (JWT) cookie value. */\n  authToken: string\n  /** Raw `customer_session_token` cookie value. */\n  sessionToken: string\n  /** Ready-to-send `Cookie:` header carrying both portal cookies. */\n  cookieHeader: string\n}\n\n/** Build portal request options carrying the session's `Cookie` header. */\nexport function portalCookieHeaders(\n  session: PortalSession,\n  extra?: Record<string, string>,\n): Record<string, string> {\n  return { Cookie: session.cookieHeader, ...(extra ?? {}) }\n}\n\n/**\n * Log a customer in and return the portal cookies. Pass `session.cookieHeader`\n * as the `Cookie` request header on subsequent portal calls (see\n * {@link portalCookieHeaders}). Logging in the same user twice yields two\n * distinct sessions.\n */\nexport async function portalLogin(\n  request: APIRequestContext,\n  input: { email: string; password: string; tenantId: string },\n): Promise<PortalSession> {\n  const res = await request.post('/api/customer_accounts/login', {\n    data: { email: input.email, password: input.password, tenantId: input.tenantId },\n    headers: { 'Content-Type': 'application/json' },\n  })\n  expect(res.ok(), `portal login should succeed (status ${res.status()})`).toBeTruthy()\n\n  const setCookie = res.headers()['set-cookie'] ?? ''\n  const authMatch = setCookie.match(/customer_auth_token=([^;]+)/)\n  const sessionMatch = setCookie.match(/customer_session_token=([^;]+)/)\n  expect(authMatch, 'login must set customer_auth_token').toBeTruthy()\n  expect(sessionMatch, 'login must set customer_session_token').toBeTruthy()\n\n  const authToken = authMatch![1]\n  const sessionToken = sessionMatch![1]\n  return {\n    authToken,\n    sessionToken,\n    cookieHeader: `customer_auth_token=${authToken}; customer_session_token=${sessionToken}`,\n  }\n}\n\n/** Best-effort soft-delete of a customer user (cleanup). */\nexport async function deleteCustomerUserFixture(\n  request: APIRequestContext,\n  adminToken: string | null,\n  userId: string | null,\n): Promise<void> {\n  if (!adminToken || !userId) return\n  await apiRequest(request, 'DELETE', `/api/customer_accounts/admin/users/${userId}`, {\n    token: adminToken,\n  }).catch(() => undefined)\n}\n\n/** Best-effort delete of a customer role (cleanup). */\nexport async function deleteCustomerRoleFixture(\n  request: APIRequestContext,\n  adminToken: string | null,\n  roleId: string | null,\n): Promise<void> {\n  if (!adminToken || !roleId) return\n  await apiRequest(request, 'DELETE', `/api/customer_accounts/admin/roles/${roleId}`, {\n    token: adminToken,\n  }).catch(() => undefined)\n}\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAC3B,SAAS,kBAAkB;AAC3B,SAAS,UAAU,oBAAoB;AAmBhC,SAAS,eAAuB;AACrC,SAAO,WAAW,EAAE,QAAQ,MAAM,EAAE,EAAE,MAAM,GAAG,EAAE;AACnD;AAMO,SAAS,uBAA+B;AAC7C,SAAO,OAAO,aAAa,CAAC;AAC9B;AA6BA,eAAsB,0BACpB,SACA,YACA,QAAiC,CAAC,GACJ;AAC9B,QAAM,SAAS,aAAa;AAC5B,QAAM,OAAO,MAAM,QAAQ,kBAAkB,MAAM;AACnD,QAAM,OAAO,MAAM,QAAQ,kBAAkB,MAAM;AAEnD,QAAM,YAAY,MAAM,WAAW,SAAS,QAAQ,sCAAsC;AAAA,IACxF,OAAO;AAAA,IACP,MAAM;AAAA,MACJ;AAAA,MACA;AAAA,MACA,aAAa;AAAA,MACb,oBAAoB,MAAM,sBAAsB;AAAA,IAClD;AAAA,EACF,CAAC;AACD,SAAO,UAAU,OAAO,GAAG,qCAAqC,EAAE,KAAK,GAAG;AAC1E,QAAM,OAAO,MAAM,aAAyC,SAAS;AACrE,QAAM,KAAK,SAAS,MAAM,MAAM,IAAI,+CAA+C;AAEnF,MAAI,MAAM,YAAY,OAAO,MAAM,kBAAkB,WAAW;AAC9D,UAAM,mBAAmB,SAAS,YAAY,IAAI;AAAA,MAChD,UAAU,MAAM,YAAY,CAAC;AAAA,MAC7B,eAAe,MAAM;AAAA,IACvB,CAAC;AAAA,EACH;AAEA,SAAO,EAAE,IAAI,MAAM,KAAK;AAC1B;AAGA,eAAsB,mBACpB,SACA,YACA,QACA,OACe;AACf,QAAM,OAAwD,EAAE,UAAU,MAAM,SAAS;AACzF,MAAI,OAAO,MAAM,kBAAkB,UAAW,MAAK,gBAAgB,MAAM;AACzE,QAAM,MAAM,MAAM,WAAW,SAAS,OAAO,sCAAsC,MAAM,QAAQ;AAAA,IAC/F,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACD,SAAO,IAAI,OAAO,GAAG,6CAA6C,EAAE,KAAK,GAAG;AAC9E;AAQA,eAAsB,6BACpB,SACA,YACA,aACiB;AACjB,QAAM,OAAO,eAAe,qBAAqB,aAAa,CAAC;AAC/D,QAAM,MAAM,MAAM,WAAW,SAAS,QAAQ,4BAA4B;AAAA,IACxE,OAAO;AAAA,IACP,MAAM,EAAE,aAAa,KAAK;AAAA,EAC5B,CAAC;AACD,SAAO,IAAI,OAAO,GAAG,6CAA6C,EAAE,KAAK,GAAG;AAC5E,QAAM,OAAO,MAAM,aAAiD,GAAG;AACvE,SAAO,SAAS,MAAM,MAAM,MAAM,UAAU,wDAAwD;AACtG;AAGA,eAAsB,6BACpB,SACA,YACA,iBACe;AACf,MAAI,CAAC,cAAc,CAAC,gBAAiB;AACrC,QAAM,WAAW,SAAS,UAAU,+BAA+B,eAAe,IAAI;AAAA,IACpF,OAAO;AAAA,EACT,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAoBA,eAAsB,0BACpB,SACA,YACA,QAAiC,CAAC,GACJ;AAC9B,QAAM,SAAS,aAAa;AAC5B,QAAM,QAAQ,MAAM,SAAS,aAAa,MAAM;AAChD,QAAM,WAAW,MAAM,YAAY,qBAAqB;AACxD,QAAM,cAAc,MAAM,eAAe,kBAAkB,MAAM;AAEjE,QAAM,OAAgC,EAAE,OAAO,UAAU,YAAY;AACrE,MAAI,MAAM,WAAW,MAAM,QAAQ,SAAS,EAAG,MAAK,UAAU,MAAM;AACpE,MAAI,MAAM,iBAAkB,MAAK,mBAAmB,MAAM;AAE1D,QAAM,MAAM,MAAM,WAAW,SAAS,QAAQ,sCAAsC;AAAA,IAClF,OAAO;AAAA,IACP;AAAA,EACF,CAAC;AACD,SAAO,IAAI,OAAO,GAAG,qCAAqC,EAAE,KAAK,GAAG;AACpE,QAAM,OAAO,MAAM,aAAyC,GAAG;AAC/D,QAAM,KAAK,SAAS,MAAM,MAAM,IAAI,+CAA+C;AAEnF,SAAO,EAAE,IAAI,OAAO,UAAU,aAAa,kBAAkB,MAAM,oBAAoB,KAAK;AAC9F;AAYO,SAAS,oBACd,SACA,OACwB;AACxB,SAAO,EAAE,QAAQ,QAAQ,cAAc,GAAI,SAAS,CAAC,EAAG;AAC1D;AAQA,eAAsB,YACpB,SACA,OACwB;AACxB,QAAM,MAAM,MAAM,QAAQ,KAAK,gCAAgC;AAAA,IAC7D,MAAM,EAAE,OAAO,MAAM,OAAO,UAAU,MAAM,UAAU,UAAU,MAAM,SAAS;AAAA,IAC/E,SAAS,EAAE,gBAAgB,mBAAmB;AAAA,EAChD,CAAC;AACD,SAAO,IAAI,GAAG,GAAG,uCAAuC,IAAI,OAAO,CAAC,GAAG,EAAE,WAAW;AAEpF,QAAM,YAAY,IAAI,QAAQ,EAAE,YAAY,KAAK;AACjD,QAAM,YAAY,UAAU,MAAM,6BAA6B;AAC/D,QAAM,eAAe,UAAU,MAAM,gCAAgC;AACrE,SAAO,WAAW,oCAAoC,EAAE,WAAW;AACnE,SAAO,cAAc,uCAAuC,EAAE,WAAW;AAEzE,QAAM,YAAY,UAAW,CAAC;AAC9B,QAAM,eAAe,aAAc,CAAC;AACpC,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,cAAc,uBAAuB,SAAS,4BAA4B,YAAY;AAAA,EACxF;AACF;AAGA,eAAsB,0BACpB,SACA,YACA,QACe;AACf,MAAI,CAAC,cAAc,CAAC,OAAQ;AAC5B,QAAM,WAAW,SAAS,UAAU,sCAAsC,MAAM,IAAI;AAAA,IAClF,OAAO;AAAA,EACT,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;AAGA,eAAsB,0BACpB,SACA,YACA,QACe;AACf,MAAI,CAAC,cAAc,CAAC,OAAQ;AAC5B,QAAM,WAAW,SAAS,UAAU,sCAAsC,MAAM,IAAI;AAAA,IAClF,OAAO;AAAA,EACT,CAAC,EAAE,MAAM,MAAM,MAAS;AAC1B;",
+  "names": []
+}

package/dist/helpers/integration/dbFixtures.js

@@ -88,11 +88,19 @@ async function deleteOrganizationInDb(organizationId) {
     await client.query("delete from organizations where id = $1", [organizationId]);
   });
 }
+async function deleteIntegrationCredentialsInDb(organizationId) {
+  if (!organizationId) return;
+  await withClient(async (client) => {
+    await client.query("delete from integration_credentials where organization_id = $1", [organizationId]);
+  });
+}
 export {
   clearUserHomeOrganization,
   createOrganizationInDb,
+  deleteIntegrationCredentialsInDb,
   deleteOrganizationInDb,
   deleteUserAclInDb,
-  setUserAclInDb
+  setUserAclInDb,
+  withClient
 };
 //# sourceMappingURL=dbFixtures.js.map

package/dist/helpers/integration/dbFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/dbFixtures.ts"],
-  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { Client } from 'pg';\n\n/**\n * Database fixtures for the org-scope fail-open hardening tests.\n *\n * These helpers talk to Postgres directly via `pg` rather than bootstrapping the\n * app DI container, because:\n *  - the directory create command denies non-super-admin actors (the only\n *    loginable accounts here), so orgs cannot be created over the API; and\n *  - granting `customers.*` through the ACL API requires a super-admin actor.\n * Raw SQL keeps the test self-contained and avoids depending on built package\n * `dist/` output for an in-process MikroORM bootstrap.\n */\n\nfunction resolveAppRoot(): string {\n  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();\n  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), 'apps/mercato');\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const candidatePaths = [\n    path.resolve(resolveAppRoot(), '.env'),\n    path.resolve(process.cwd(), 'apps/mercato/.env'),\n    path.resolve(process.cwd(), '.env'),\n  ];\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n      if (match?.[1]) return match[1].trim();\n    } catch {\n      continue;\n    }\n  }\n  return undefined;\n}\n\nfunction resolveDatabaseUrl(): string {\n  const url = readEnvValue('DATABASE_URL');\n  if (!url) throw new Error('[internal] DATABASE_URL is not configured for integration DB fixtures');\n  return url;\n}\n\nasync function withClient<T>(run: (client: Client) => Promise<T>): Promise<T> {\n  const client = new Client({ connectionString: resolveDatabaseUrl() });\n  await client.connect();\n  try {\n    return await run(client);\n  } finally {\n    await client.end();\n  }\n}\n\n/**\n * Nulls a user's home organization (`organization_id`) directly in the database.\n *\n * Required to construct the \"floating restricted user\" precondition: the JWT\n * `auth.orgId` is minted from `users.organization_id` at login, so this MUST run\n * BEFORE the user logs in.\n */\nexport async function clearUserHomeOrganization(userId: string): Promise<void> {\n  await withClient(async (client) => {\n    await client.query('update users set organization_id = null where id = $1', [userId]);\n  });\n}\n\n/**\n * Upserts a per-user ACL row, setting the effective feature list and the\n * organization-visibility list.\n *\n * `organizations` maps to `OrganizationScope.allowedIds` (write path) and\n * `filterIds` (read path):\n *   - `[orgA]` => restricted to orgA (write fail-open precondition, #2239)\n *   - `[]`     => restricted to zero orgs (read fail-open precondition, #2245)\n *   - `null`   => unrestricted\n */\nexport async function setUserAclInDb(input: {\n  userId: string;\n  tenantId: string;\n  features: string[];\n  organizations: string[] | null;\n}): Promise<void> {\n  await withClient(async (client) => {\n    const existing = await client.query<{ id: string }>(\n      'select id from user_acls where user_id = $1 and tenant_id = $2 limit 1',\n      [input.userId, input.tenantId],\n    );\n    const featuresJson = JSON.stringify(input.features);\n    const organizationsJson = input.organizations === null ? null : JSON.stringify(input.organizations);\n    if (existing.rows.length > 0) {\n      await client.query(\n        'update user_acls set features_json = $2::jsonb, organizations_json = $3::jsonb, is_super_admin = false, updated_at = now() where id = $1',\n        [existing.rows[0].id, featuresJson, organizationsJson],\n      );\n      return;\n    }\n    await client.query(\n      `insert into user_acls (id, user_id, tenant_id, features_json, organizations_json, is_super_admin, created_at)\n       values (gen_random_uuid(), $1, $2, $3::jsonb, $4::jsonb, false, now())`,\n      [input.userId, input.tenantId, featuresJson, organizationsJson],\n    );\n  });\n}\n\n/** Removes any per-user ACL rows for the user (best-effort test cleanup). */\nexport async function deleteUserAclInDb(userId: string): Promise<void> {\n  if (!userId) return;\n  await withClient(async (client) => {\n    await client.query('delete from user_acls where user_id = $1', [userId]);\n  });\n}\n\n/**\n * Creates an organization directly in the database within the given tenant.\n *\n * The directory create command routes through `enforceTenantSelection`, which\n * denies the (non-super-admin) accounts loginable on this instance. Landing the\n * org in a known tenant lets the floating user (created under it) share the\n * tenant \u2014 required because cross-tenant access returns 404 before the\n * org-scope guard ever runs.\n */\nexport async function createOrganizationInDb(input: { name: string; tenantId: string }): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `insert into organizations\n         (id, tenant_id, name, is_active, ancestor_ids, child_ids, descendant_ids, depth, created_at, updated_at)\n       values (gen_random_uuid(), $1, $2, true, '[]'::jsonb, '[]'::jsonb, '[]'::jsonb, 0, now(), now())\n       returning id`,\n      [input.tenantId, input.name],\n    );\n    return result.rows[0].id;\n  });\n}\n\n/** Hard-deletes an organization row (best-effort test cleanup). */\nexport async function deleteOrganizationInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from organizations where id = $1', [organizationId]);\n  });\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,OAAO,UAAU;AACjB,SAAS,cAAc;AAcvB,SAAS,iBAAyB;AAChC,QAAM,UAAU,QAAQ,IAAI,kBAAkB,KAAK;AACnD,SAAO,UAAU,KAAK,QAAQ,OAAO,IAAI,KAAK,QAAQ,QAAQ,IAAI,GAAG,cAAc;AACrF;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,iBAAiB;AAAA,IACrB,KAAK,QAAQ,eAAe,GAAG,MAAM;AAAA,IACrC,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC/C,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACpC;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,YAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,UAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvC,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAA6B;AACpC,QAAM,MAAM,aAAa,cAAc;AACvC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAO;AACT;AAEA,eAAe,WAAc,KAAiD;AAC5E,QAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,mBAAmB,EAAE,CAAC;AACpE,QAAM,OAAO,QAAQ;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,MAAM;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,IAAI;AAAA,EACnB;AACF;AASA,eAAsB,0BAA0B,QAA+B;AAC7E,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,yDAAyD,CAAC,MAAM,CAAC;AAAA,EACtF,CAAC;AACH;AAYA,eAAsB,eAAe,OAKnB;AAChB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,WAAW,MAAM,OAAO;AAAA,MAC5B;AAAA,MACA,CAAC,MAAM,QAAQ,MAAM,QAAQ;AAAA,IAC/B;AACA,UAAM,eAAe,KAAK,UAAU,MAAM,QAAQ;AAClD,UAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO,KAAK,UAAU,MAAM,aAAa;AAClG,QAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,YAAM,OAAO;AAAA,QACX;AAAA,QACA,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,cAAc,iBAAiB;AAAA,MACvD;AACA;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX;AAAA;AAAA,MAEA,CAAC,MAAM,QAAQ,MAAM,UAAU,cAAc,iBAAiB;AAAA,IAChE;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,kBAAkB,QAA+B;AACrE,MAAI,CAAC,OAAQ;AACb,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,4CAA4C,CAAC,MAAM,CAAC;AAAA,EACzE,CAAC;AACH;AAWA,eAAsB,uBAAuB,OAA4D;AACvG,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,UAAU,MAAM,IAAI;AAAA,IAC7B;AACA,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAGA,eAAsB,uBAAuB,gBAA8C;AACzF,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,2CAA2C,CAAC,cAAc,CAAC;AAAA,EAChF,CAAC;AACH;",
+  "sourcesContent": ["import { readFileSync } from 'node:fs';\nimport path from 'node:path';\nimport { Client } from 'pg';\n\n/**\n * Database fixtures for the org-scope fail-open hardening tests.\n *\n * These helpers talk to Postgres directly via `pg` rather than bootstrapping the\n * app DI container, because:\n *  - the directory create command denies non-super-admin actors (the only\n *    loginable accounts here), so orgs cannot be created over the API; and\n *  - granting `customers.*` through the ACL API requires a super-admin actor.\n * Raw SQL keeps the test self-contained and avoids depending on built package\n * `dist/` output for an in-process MikroORM bootstrap.\n */\n\nfunction resolveAppRoot(): string {\n  const fromEnv = process.env.OM_TEST_APP_ROOT?.trim();\n  return fromEnv ? path.resolve(fromEnv) : path.resolve(process.cwd(), 'apps/mercato');\n}\n\nfunction readEnvValue(key: string): string | undefined {\n  if (process.env[key]) return process.env[key];\n  const candidatePaths = [\n    path.resolve(resolveAppRoot(), '.env'),\n    path.resolve(process.cwd(), 'apps/mercato/.env'),\n    path.resolve(process.cwd(), '.env'),\n  ];\n  for (const envPath of candidatePaths) {\n    try {\n      const content = readFileSync(envPath, 'utf-8');\n      const match = content.match(new RegExp(`^${key}=(.+)$`, 'm'));\n      if (match?.[1]) return match[1].trim();\n    } catch {\n      continue;\n    }\n  }\n  return undefined;\n}\n\nfunction resolveDatabaseUrl(): string {\n  const url = readEnvValue('DATABASE_URL');\n  if (!url) throw new Error('[internal] DATABASE_URL is not configured for integration DB fixtures');\n  return url;\n}\n\nexport async function withClient<T>(run: (client: Client) => Promise<T>): Promise<T> {\n  const client = new Client({ connectionString: resolveDatabaseUrl() });\n  await client.connect();\n  try {\n    return await run(client);\n  } finally {\n    await client.end();\n  }\n}\n\n/**\n * Nulls a user's home organization (`organization_id`) directly in the database.\n *\n * Required to construct the \"floating restricted user\" precondition: the JWT\n * `auth.orgId` is minted from `users.organization_id` at login, so this MUST run\n * BEFORE the user logs in.\n */\nexport async function clearUserHomeOrganization(userId: string): Promise<void> {\n  await withClient(async (client) => {\n    await client.query('update users set organization_id = null where id = $1', [userId]);\n  });\n}\n\n/**\n * Upserts a per-user ACL row, setting the effective feature list and the\n * organization-visibility list.\n *\n * `organizations` maps to `OrganizationScope.allowedIds` (write path) and\n * `filterIds` (read path):\n *   - `[orgA]` => restricted to orgA (write fail-open precondition, #2239)\n *   - `[]`     => restricted to zero orgs (read fail-open precondition, #2245)\n *   - `null`   => unrestricted\n */\nexport async function setUserAclInDb(input: {\n  userId: string;\n  tenantId: string;\n  features: string[];\n  organizations: string[] | null;\n}): Promise<void> {\n  await withClient(async (client) => {\n    const existing = await client.query<{ id: string }>(\n      'select id from user_acls where user_id = $1 and tenant_id = $2 limit 1',\n      [input.userId, input.tenantId],\n    );\n    const featuresJson = JSON.stringify(input.features);\n    const organizationsJson = input.organizations === null ? null : JSON.stringify(input.organizations);\n    if (existing.rows.length > 0) {\n      await client.query(\n        'update user_acls set features_json = $2::jsonb, organizations_json = $3::jsonb, is_super_admin = false, updated_at = now() where id = $1',\n        [existing.rows[0].id, featuresJson, organizationsJson],\n      );\n      return;\n    }\n    await client.query(\n      `insert into user_acls (id, user_id, tenant_id, features_json, organizations_json, is_super_admin, created_at)\n       values (gen_random_uuid(), $1, $2, $3::jsonb, $4::jsonb, false, now())`,\n      [input.userId, input.tenantId, featuresJson, organizationsJson],\n    );\n  });\n}\n\n/** Removes any per-user ACL rows for the user (best-effort test cleanup). */\nexport async function deleteUserAclInDb(userId: string): Promise<void> {\n  if (!userId) return;\n  await withClient(async (client) => {\n    await client.query('delete from user_acls where user_id = $1', [userId]);\n  });\n}\n\n/**\n * Creates an organization directly in the database within the given tenant.\n *\n * The directory create command routes through `enforceTenantSelection`, which\n * denies the (non-super-admin) accounts loginable on this instance. Landing the\n * org in a known tenant lets the floating user (created under it) share the\n * tenant \u2014 required because cross-tenant access returns 404 before the\n * org-scope guard ever runs.\n */\nexport async function createOrganizationInDb(input: { name: string; tenantId: string }): Promise<string> {\n  return withClient(async (client) => {\n    const result = await client.query<{ id: string }>(\n      `insert into organizations\n         (id, tenant_id, name, is_active, ancestor_ids, child_ids, descendant_ids, depth, created_at, updated_at)\n       values (gen_random_uuid(), $1, $2, true, '[]'::jsonb, '[]'::jsonb, '[]'::jsonb, 0, now(), now())\n       returning id`,\n      [input.tenantId, input.name],\n    );\n    return result.rows[0].id;\n  });\n}\n\n/** Hard-deletes an organization row (best-effort test cleanup). */\nexport async function deleteOrganizationInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from organizations where id = $1', [organizationId]);\n  });\n}\n\n/**\n * Hard-deletes integration credential rows for an organization (best-effort test\n * cleanup). Integration credentials are stored per (integration_id,\n * organization_id, tenant_id, user_id) with no FK to organizations, so a\n * throwaway org's credential rows must be removed explicitly when the org row is\n * torn down.\n */\nexport async function deleteIntegrationCredentialsInDb(organizationId: string | null): Promise<void> {\n  if (!organizationId) return;\n  await withClient(async (client) => {\n    await client.query('delete from integration_credentials where organization_id = $1', [organizationId]);\n  });\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,OAAO,UAAU;AACjB,SAAS,cAAc;AAcvB,SAAS,iBAAyB;AAChC,QAAM,UAAU,QAAQ,IAAI,kBAAkB,KAAK;AACnD,SAAO,UAAU,KAAK,QAAQ,OAAO,IAAI,KAAK,QAAQ,QAAQ,IAAI,GAAG,cAAc;AACrF;AAEA,SAAS,aAAa,KAAiC;AACrD,MAAI,QAAQ,IAAI,GAAG,EAAG,QAAO,QAAQ,IAAI,GAAG;AAC5C,QAAM,iBAAiB;AAAA,IACrB,KAAK,QAAQ,eAAe,GAAG,MAAM;AAAA,IACrC,KAAK,QAAQ,QAAQ,IAAI,GAAG,mBAAmB;AAAA,IAC/C,KAAK,QAAQ,QAAQ,IAAI,GAAG,MAAM;AAAA,EACpC;AACA,aAAW,WAAW,gBAAgB;AACpC,QAAI;AACF,YAAM,UAAU,aAAa,SAAS,OAAO;AAC7C,YAAM,QAAQ,QAAQ,MAAM,IAAI,OAAO,IAAI,GAAG,UAAU,GAAG,CAAC;AAC5D,UAAI,QAAQ,CAAC,EAAG,QAAO,MAAM,CAAC,EAAE,KAAK;AAAA,IACvC,QAAQ;AACN;AAAA,IACF;AAAA,EACF;AACA,SAAO;AACT;AAEA,SAAS,qBAA6B;AACpC,QAAM,MAAM,aAAa,cAAc;AACvC,MAAI,CAAC,IAAK,OAAM,IAAI,MAAM,uEAAuE;AACjG,SAAO;AACT;AAEA,eAAsB,WAAc,KAAiD;AACnF,QAAM,SAAS,IAAI,OAAO,EAAE,kBAAkB,mBAAmB,EAAE,CAAC;AACpE,QAAM,OAAO,QAAQ;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,MAAM;AAAA,EACzB,UAAE;AACA,UAAM,OAAO,IAAI;AAAA,EACnB;AACF;AASA,eAAsB,0BAA0B,QAA+B;AAC7E,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,yDAAyD,CAAC,MAAM,CAAC;AAAA,EACtF,CAAC;AACH;AAYA,eAAsB,eAAe,OAKnB;AAChB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,WAAW,MAAM,OAAO;AAAA,MAC5B;AAAA,MACA,CAAC,MAAM,QAAQ,MAAM,QAAQ;AAAA,IAC/B;AACA,UAAM,eAAe,KAAK,UAAU,MAAM,QAAQ;AAClD,UAAM,oBAAoB,MAAM,kBAAkB,OAAO,OAAO,KAAK,UAAU,MAAM,aAAa;AAClG,QAAI,SAAS,KAAK,SAAS,GAAG;AAC5B,YAAM,OAAO;AAAA,QACX;AAAA,QACA,CAAC,SAAS,KAAK,CAAC,EAAE,IAAI,cAAc,iBAAiB;AAAA,MACvD;AACA;AAAA,IACF;AACA,UAAM,OAAO;AAAA,MACX;AAAA;AAAA,MAEA,CAAC,MAAM,QAAQ,MAAM,UAAU,cAAc,iBAAiB;AAAA,IAChE;AAAA,EACF,CAAC;AACH;AAGA,eAAsB,kBAAkB,QAA+B;AACrE,MAAI,CAAC,OAAQ;AACb,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,4CAA4C,CAAC,MAAM,CAAC;AAAA,EACzE,CAAC;AACH;AAWA,eAAsB,uBAAuB,OAA4D;AACvG,SAAO,WAAW,OAAO,WAAW;AAClC,UAAM,SAAS,MAAM,OAAO;AAAA,MAC1B;AAAA;AAAA;AAAA;AAAA,MAIA,CAAC,MAAM,UAAU,MAAM,IAAI;AAAA,IAC7B;AACA,WAAO,OAAO,KAAK,CAAC,EAAE;AAAA,EACxB,CAAC;AACH;AAGA,eAAsB,uBAAuB,gBAA8C;AACzF,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,2CAA2C,CAAC,cAAc,CAAC;AAAA,EAChF,CAAC;AACH;AASA,eAAsB,iCAAiC,gBAA8C;AACnG,MAAI,CAAC,eAAgB;AACrB,QAAM,WAAW,OAAO,WAAW;AACjC,UAAM,OAAO,MAAM,kEAAkE,CAAC,cAAc,CAAC;AAAA,EACvG,CAAC;AACH;",
   "names": []
 }

package/dist/helpers/integration/inboxFixtures.js

@@ -57,8 +57,19 @@ async function listInboxProposals(request, token, params) {
   const body = await readJsonSafe(response);
   return { items: body?.items ?? [], total: body?.total ?? 0 };
 }
+async function fetchProposalDetail(request, token, proposalId) {
+  const response = await apiRequest(request, "GET", `/api/inbox_ops/proposals/${proposalId}`, { token });
+  if (!response.ok()) return null;
+  const body = await readJsonSafe(response);
+  return body?.proposal ?? null;
+}
+function findPendingAction(actions) {
+  return actions.find((action) => action.status === "pending") ?? actions[0] ?? null;
+}
 export {
   deleteInboxEmail,
+  fetchProposalDetail,
+  findPendingAction,
   listInboxEmails,
   listInboxProposals,
   submitTextExtraction,

package/dist/helpers/integration/inboxFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/inboxFixtures.ts"],
-  "sourcesContent": ["import type { APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { readJsonSafe } from './crmFixtures';\n\nexport async function submitTextExtraction(\n  request: APIRequestContext,\n  token: string,\n  input?: { text?: string; title?: string; metadata?: Record<string, unknown> },\n): Promise<{ ok: boolean; emailId?: string; error?: string; status: number }> {\n  const text = input?.text ?? 'Test email from John Doe <john@example.com> requesting 10 widgets at $5 each.'\n  const title = input?.title ?? `QA Fixture ${Date.now()}`\n\n  const response = await apiRequest(request, 'POST', '/api/inbox_ops/extract', {\n    token,\n    data: { text, title, metadata: input?.metadata },\n  });\n\n  const body = await readJsonSafe<{ ok?: boolean; emailId?: string; error?: string }>(response);\n  return {\n    ok: response.ok(),\n    emailId: body?.emailId ?? undefined,\n    error: body?.error ?? undefined,\n    status: response.status(),\n  };\n}\n\nexport async function waitForEmailProcessed(\n  request: APIRequestContext,\n  token: string,\n  emailId: string,\n  timeoutMs = 30000,\n): Promise<{ status: string; proposalId?: string } | null> {\n  const pollInterval = 1000\n  const deadline = Date.now() + timeoutMs\n\n  while (Date.now() < deadline) {\n    const response = await apiRequest(request, 'GET', `/api/inbox_ops/emails/${emailId}`, { token });\n    if (!response.ok()) return null\n\n    const body = await readJsonSafe<{ email?: { status?: string; id?: string } }>(response);\n    const status = body?.email?.status\n\n    if (status === 'processed' || status === 'needs_review' || status === 'failed') {\n      const proposalsResponse = await apiRequest(request, 'GET', '/api/inbox_ops/proposals?pageSize=5', { token });\n      const proposalsBody = await readJsonSafe<{ items?: Array<{ id: string; inboxEmailId?: string }> }>(proposalsResponse);\n      const proposal = proposalsBody?.items?.find((p) => p.inboxEmailId === emailId);\n      return { status, proposalId: proposal?.id };\n    }\n\n    await new Promise((resolve) => setTimeout(resolve, pollInterval))\n  }\n\n  return null\n}\n\nexport async function deleteInboxEmail(\n  request: APIRequestContext,\n  token: string,\n  emailId: string,\n): Promise<void> {\n  await apiRequest(request, 'DELETE', `/api/inbox_ops/emails/${emailId}`, { token }).catch(() => {})\n}\n\nexport async function listInboxEmails(\n  request: APIRequestContext,\n  token: string,\n  params?: { status?: string; page?: number; pageSize?: number },\n): Promise<{ items: Array<Record<string, unknown>>; total: number }> {\n  const searchParams = new URLSearchParams();\n  if (params?.status) searchParams.set('status', params.status);\n  if (params?.page) searchParams.set('page', String(params.page));\n  if (params?.pageSize) searchParams.set('pageSize', String(params.pageSize));\n\n  const path = `/api/inbox_ops/emails${searchParams.toString() ? `?${searchParams}` : ''}`;\n  const response = await apiRequest(request, 'GET', path, { token });\n  const body = await readJsonSafe<{ items?: Array<Record<string, unknown>>; total?: number }>(response);\n  return { items: body?.items ?? [], total: body?.total ?? 0 };\n}\n\nexport async function listInboxProposals(\n  request: APIRequestContext,\n  token: string,\n  params?: { status?: string; page?: number; pageSize?: number },\n): Promise<{ items: Array<Record<string, unknown>>; total: number }> {\n  const searchParams = new URLSearchParams();\n  if (params?.status) searchParams.set('status', params.status);\n  if (params?.page) searchParams.set('page', String(params.page));\n  if (params?.pageSize) searchParams.set('pageSize', String(params.pageSize));\n\n  const path = `/api/inbox_ops/proposals${searchParams.toString() ? `?${searchParams}` : ''}`;\n  const response = await apiRequest(request, 'GET', path, { token });\n  const body = await readJsonSafe<{ items?: Array<Record<string, unknown>>; total?: number }>(response);\n  return { items: body?.items ?? [], total: body?.total ?? 0 };\n}\n"],
-  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,eAAsB,qBACpB,SACA,OACA,OAC4E;AAC5E,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,QAAQ,OAAO,SAAS,cAAc,KAAK,IAAI,CAAC;AAEtD,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,0BAA0B;AAAA,IAC3E;AAAA,IACA,MAAM,EAAE,MAAM,OAAO,UAAU,OAAO,SAAS;AAAA,EACjD,CAAC;AAED,QAAM,OAAO,MAAM,aAAiE,QAAQ;AAC5F,SAAO;AAAA,IACL,IAAI,SAAS,GAAG;AAAA,IAChB,SAAS,MAAM,WAAW;AAAA,IAC1B,OAAO,MAAM,SAAS;AAAA,IACtB,QAAQ,SAAS,OAAO;AAAA,EAC1B;AACF;AAEA,eAAsB,sBACpB,SACA,OACA,SACA,YAAY,KAC6C;AACzD,QAAM,eAAe;AACrB,QAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,WAAW,MAAM,WAAW,SAAS,OAAO,yBAAyB,OAAO,IAAI,EAAE,MAAM,CAAC;AAC/F,QAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,aAA2D,QAAQ;AACtF,UAAM,SAAS,MAAM,OAAO;AAE5B,QAAI,WAAW,eAAe,WAAW,kBAAkB,WAAW,UAAU;AAC9E,YAAM,oBAAoB,MAAM,WAAW,SAAS,OAAO,uCAAuC,EAAE,MAAM,CAAC;AAC3G,YAAM,gBAAgB,MAAM,aAAuE,iBAAiB;AACpH,YAAM,WAAW,eAAe,OAAO,KAAK,CAAC,MAAM,EAAE,iBAAiB,OAAO;AAC7E,aAAO,EAAE,QAAQ,YAAY,UAAU,GAAG;AAAA,IAC5C;AAEA,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAAA,EAClE;AAEA,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACA,SACe;AACf,QAAM,WAAW,SAAS,UAAU,yBAAyB,OAAO,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACnG;AAEA,eAAsB,gBACpB,SACA,OACA,QACmE;AACnE,QAAM,eAAe,IAAI,gBAAgB;AACzC,MAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,MAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,MAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC;AAE1E,QAAM,OAAO,wBAAwB,aAAa,SAAS,IAAI,IAAI,YAAY,KAAK,EAAE;AACtF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,QAAM,OAAO,MAAM,aAAyE,QAAQ;AACpG,SAAO,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,SAAS,EAAE;AAC7D;AAEA,eAAsB,mBACpB,SACA,OACA,QACmE;AACnE,QAAM,eAAe,IAAI,gBAAgB;AACzC,MAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,MAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,MAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC;AAE1E,QAAM,OAAO,2BAA2B,aAAa,SAAS,IAAI,IAAI,YAAY,KAAK,EAAE;AACzF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,QAAM,OAAO,MAAM,aAAyE,QAAQ;AACpG,SAAO,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,SAAS,EAAE;AAC7D;",
+  "sourcesContent": ["import type { APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\nimport { readJsonSafe } from './crmFixtures';\n\nexport async function submitTextExtraction(\n  request: APIRequestContext,\n  token: string,\n  input?: { text?: string; title?: string; metadata?: Record<string, unknown> },\n): Promise<{ ok: boolean; emailId?: string; error?: string; status: number }> {\n  const text = input?.text ?? 'Test email from John Doe <john@example.com> requesting 10 widgets at $5 each.'\n  const title = input?.title ?? `QA Fixture ${Date.now()}`\n\n  const response = await apiRequest(request, 'POST', '/api/inbox_ops/extract', {\n    token,\n    data: { text, title, metadata: input?.metadata },\n  });\n\n  const body = await readJsonSafe<{ ok?: boolean; emailId?: string; error?: string }>(response);\n  return {\n    ok: response.ok(),\n    emailId: body?.emailId ?? undefined,\n    error: body?.error ?? undefined,\n    status: response.status(),\n  };\n}\n\nexport async function waitForEmailProcessed(\n  request: APIRequestContext,\n  token: string,\n  emailId: string,\n  timeoutMs = 30000,\n): Promise<{ status: string; proposalId?: string } | null> {\n  const pollInterval = 1000\n  const deadline = Date.now() + timeoutMs\n\n  while (Date.now() < deadline) {\n    const response = await apiRequest(request, 'GET', `/api/inbox_ops/emails/${emailId}`, { token });\n    if (!response.ok()) return null\n\n    const body = await readJsonSafe<{ email?: { status?: string; id?: string } }>(response);\n    const status = body?.email?.status\n\n    if (status === 'processed' || status === 'needs_review' || status === 'failed') {\n      const proposalsResponse = await apiRequest(request, 'GET', '/api/inbox_ops/proposals?pageSize=5', { token });\n      const proposalsBody = await readJsonSafe<{ items?: Array<{ id: string; inboxEmailId?: string }> }>(proposalsResponse);\n      const proposal = proposalsBody?.items?.find((p) => p.inboxEmailId === emailId);\n      return { status, proposalId: proposal?.id };\n    }\n\n    await new Promise((resolve) => setTimeout(resolve, pollInterval))\n  }\n\n  return null\n}\n\nexport async function deleteInboxEmail(\n  request: APIRequestContext,\n  token: string,\n  emailId: string,\n): Promise<void> {\n  await apiRequest(request, 'DELETE', `/api/inbox_ops/emails/${emailId}`, { token }).catch(() => {})\n}\n\nexport async function listInboxEmails(\n  request: APIRequestContext,\n  token: string,\n  params?: { status?: string; page?: number; pageSize?: number },\n): Promise<{ items: Array<Record<string, unknown>>; total: number }> {\n  const searchParams = new URLSearchParams();\n  if (params?.status) searchParams.set('status', params.status);\n  if (params?.page) searchParams.set('page', String(params.page));\n  if (params?.pageSize) searchParams.set('pageSize', String(params.pageSize));\n\n  const path = `/api/inbox_ops/emails${searchParams.toString() ? `?${searchParams}` : ''}`;\n  const response = await apiRequest(request, 'GET', path, { token });\n  const body = await readJsonSafe<{ items?: Array<Record<string, unknown>>; total?: number }>(response);\n  return { items: body?.items ?? [], total: body?.total ?? 0 };\n}\n\nexport async function listInboxProposals(\n  request: APIRequestContext,\n  token: string,\n  params?: { status?: string; page?: number; pageSize?: number },\n): Promise<{ items: Array<Record<string, unknown>>; total: number }> {\n  const searchParams = new URLSearchParams();\n  if (params?.status) searchParams.set('status', params.status);\n  if (params?.page) searchParams.set('page', String(params.page));\n  if (params?.pageSize) searchParams.set('pageSize', String(params.pageSize));\n\n  const path = `/api/inbox_ops/proposals${searchParams.toString() ? `?${searchParams}` : ''}`;\n  const response = await apiRequest(request, 'GET', path, { token });\n  const body = await readJsonSafe<{ items?: Array<Record<string, unknown>>; total?: number }>(response);\n  return { items: body?.items ?? [], total: body?.total ?? 0 };\n}\n\nexport type InboxProposalActionDetail = {\n  id: string;\n  actionType: string;\n  status: string;\n  payload: Record<string, unknown>;\n  description?: string;\n  createdEntityId?: string | null;\n  createdEntityType?: string | null;\n};\n\nexport type InboxProposalDetail = {\n  id: string;\n  status: string;\n  category?: string | null;\n  workingLanguage?: string | null;\n  isActive?: boolean;\n  actions: InboxProposalActionDetail[];\n};\n\nexport async function fetchProposalDetail(\n  request: APIRequestContext,\n  token: string,\n  proposalId: string,\n): Promise<InboxProposalDetail | null> {\n  const response = await apiRequest(request, 'GET', `/api/inbox_ops/proposals/${proposalId}`, { token });\n  if (!response.ok()) return null;\n  const body = await readJsonSafe<{ proposal?: InboxProposalDetail }>(response);\n  return body?.proposal ?? null;\n}\n\nexport function findPendingAction(\n  actions: InboxProposalActionDetail[],\n): InboxProposalActionDetail | null {\n  return actions.find((action) => action.status === 'pending') ?? actions[0] ?? null;\n}\n"],
+  "mappings": "AACA,SAAS,kBAAkB;AAC3B,SAAS,oBAAoB;AAE7B,eAAsB,qBACpB,SACA,OACA,OAC4E;AAC5E,QAAM,OAAO,OAAO,QAAQ;AAC5B,QAAM,QAAQ,OAAO,SAAS,cAAc,KAAK,IAAI,CAAC;AAEtD,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,0BAA0B;AAAA,IAC3E;AAAA,IACA,MAAM,EAAE,MAAM,OAAO,UAAU,OAAO,SAAS;AAAA,EACjD,CAAC;AAED,QAAM,OAAO,MAAM,aAAiE,QAAQ;AAC5F,SAAO;AAAA,IACL,IAAI,SAAS,GAAG;AAAA,IAChB,SAAS,MAAM,WAAW;AAAA,IAC1B,OAAO,MAAM,SAAS;AAAA,IACtB,QAAQ,SAAS,OAAO;AAAA,EAC1B;AACF;AAEA,eAAsB,sBACpB,SACA,OACA,SACA,YAAY,KAC6C;AACzD,QAAM,eAAe;AACrB,QAAM,WAAW,KAAK,IAAI,IAAI;AAE9B,SAAO,KAAK,IAAI,IAAI,UAAU;AAC5B,UAAM,WAAW,MAAM,WAAW,SAAS,OAAO,yBAAyB,OAAO,IAAI,EAAE,MAAM,CAAC;AAC/F,QAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAE3B,UAAM,OAAO,MAAM,aAA2D,QAAQ;AACtF,UAAM,SAAS,MAAM,OAAO;AAE5B,QAAI,WAAW,eAAe,WAAW,kBAAkB,WAAW,UAAU;AAC9E,YAAM,oBAAoB,MAAM,WAAW,SAAS,OAAO,uCAAuC,EAAE,MAAM,CAAC;AAC3G,YAAM,gBAAgB,MAAM,aAAuE,iBAAiB;AACpH,YAAM,WAAW,eAAe,OAAO,KAAK,CAAC,MAAM,EAAE,iBAAiB,OAAO;AAC7E,aAAO,EAAE,QAAQ,YAAY,UAAU,GAAG;AAAA,IAC5C;AAEA,UAAM,IAAI,QAAQ,CAAC,YAAY,WAAW,SAAS,YAAY,CAAC;AAAA,EAClE;AAEA,SAAO;AACT;AAEA,eAAsB,iBACpB,SACA,OACA,SACe;AACf,QAAM,WAAW,SAAS,UAAU,yBAAyB,OAAO,IAAI,EAAE,MAAM,CAAC,EAAE,MAAM,MAAM;AAAA,EAAC,CAAC;AACnG;AAEA,eAAsB,gBACpB,SACA,OACA,QACmE;AACnE,QAAM,eAAe,IAAI,gBAAgB;AACzC,MAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,MAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,MAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC;AAE1E,QAAM,OAAO,wBAAwB,aAAa,SAAS,IAAI,IAAI,YAAY,KAAK,EAAE;AACtF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,QAAM,OAAO,MAAM,aAAyE,QAAQ;AACpG,SAAO,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,SAAS,EAAE;AAC7D;AAEA,eAAsB,mBACpB,SACA,OACA,QACmE;AACnE,QAAM,eAAe,IAAI,gBAAgB;AACzC,MAAI,QAAQ,OAAQ,cAAa,IAAI,UAAU,OAAO,MAAM;AAC5D,MAAI,QAAQ,KAAM,cAAa,IAAI,QAAQ,OAAO,OAAO,IAAI,CAAC;AAC9D,MAAI,QAAQ,SAAU,cAAa,IAAI,YAAY,OAAO,OAAO,QAAQ,CAAC;AAE1E,QAAM,OAAO,2BAA2B,aAAa,SAAS,IAAI,IAAI,YAAY,KAAK,EAAE;AACzF,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,MAAM,EAAE,MAAM,CAAC;AACjE,QAAM,OAAO,MAAM,aAAyE,QAAQ;AACpG,SAAO,EAAE,OAAO,MAAM,SAAS,CAAC,GAAG,OAAO,MAAM,SAAS,EAAE;AAC7D;AAqBA,eAAsB,oBACpB,SACA,OACA,YACqC;AACrC,QAAM,WAAW,MAAM,WAAW,SAAS,OAAO,4BAA4B,UAAU,IAAI,EAAE,MAAM,CAAC;AACrG,MAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAC3B,QAAM,OAAO,MAAM,aAAiD,QAAQ;AAC5E,SAAO,MAAM,YAAY;AAC3B;AAEO,SAAS,kBACd,SACkC;AAClC,SAAO,QAAQ,KAAK,CAAC,WAAW,OAAO,WAAW,SAAS,KAAK,QAAQ,CAAC,KAAK;AAChF;",
   "names": []
 }

package/dist/helpers/integration/optimisticLockUi.js

@@ -0,0 +1,104 @@
+import { expect } from "@playwright/test";
+import {
+  OPTIMISTIC_LOCK_HEADER_NAME,
+  OPTIMISTIC_LOCK_CONFLICT_CODE
+} from "@open-mercato/shared/lib/crud/optimistic-lock-headers";
+const BASE_URL = process.env.BASE_URL?.trim() || "";
+function resolveApiUrl(path) {
+  return BASE_URL ? `${BASE_URL}${path}` : path;
+}
+const CONFLICT_BANNER_TESTID = "record-conflict-banner";
+const CONFLICT_DIALOG_TESTID = "record-lock-conflict-dialog";
+function authHeaders(token, lockValue) {
+  const headers = {
+    Authorization: `Bearer ${token}`,
+    "Content-Type": "application/json"
+  };
+  if (lockValue !== void 0) headers[OPTIMISTIC_LOCK_HEADER_NAME] = lockValue;
+  return headers;
+}
+async function readUpdatedAt(request, token, basePath, id, idParam = "id") {
+  const response = await request.fetch(
+    resolveApiUrl(`${basePath}?${idParam}=${encodeURIComponent(id)}`),
+    { method: "GET", headers: authHeaders(token) }
+  );
+  expect(response.status(), `GET ${basePath}?${idParam}=... should be 200`).toBe(200);
+  const body = await response.json();
+  const item = Array.isArray(body.items) ? body.items[0] : body;
+  expect(item, `response should include the record for id=${id}`).toBeTruthy();
+  const raw = item?.updated_at ?? item?.updatedAt;
+  expect(typeof raw, `record should expose updated_at, got ${String(raw)}`).toBe("string");
+  const ms = Date.parse(raw);
+  expect(Number.isFinite(ms), `updated_at should parse, got ${String(raw)}`).toBe(true);
+  return new Date(ms).toISOString();
+}
+async function bumpRecordViaApi(request, token, basePath, putBody, opts = {}) {
+  const response = await request.fetch(resolveApiUrl(basePath), {
+    method: opts.method ?? "PUT",
+    headers: authHeaders(token),
+    data: putBody
+  });
+  expect(
+    response.status(),
+    `out-of-band ${opts.method ?? "PUT"} ${basePath} should succeed (additive path), got ${response.status()}`
+  ).toBeLessThan(300);
+  const id = putBody[opts.idParam ?? "id"];
+  if (typeof id === "string") {
+    try {
+      return await readUpdatedAt(request, token, basePath, id, opts.idParam);
+    } catch {
+      return null;
+    }
+  }
+  return null;
+}
+async function putWithLock(request, token, basePath, body, lockValue) {
+  return request.fetch(resolveApiUrl(basePath), {
+    method: "PUT",
+    headers: authHeaders(token, lockValue),
+    data: body
+  });
+}
+async function expectConflictBody(response) {
+  expect(response.status(), "stale write should be 409").toBe(409);
+  const body = await response.json();
+  expect(body.code, "body.code should be the optimistic-lock conflict code").toBe(OPTIMISTIC_LOCK_CONFLICT_CODE);
+  return body;
+}
+async function expectConflictBanner(page) {
+  const conflictSurface = page.getByTestId(CONFLICT_BANNER_TESTID).or(page.getByTestId(CONFLICT_DIALOG_TESTID));
+  await expect(
+    conflictSurface.first(),
+    "a conflict surface (OSS bar or record_locks dialog) should appear after a stale save"
+  ).toBeVisible({ timeout: 1e4 });
+}
+async function expectNoConflictBanner(page) {
+  await expect(
+    page.getByTestId(CONFLICT_BANNER_TESTID),
+    "a clean save must not surface a false-positive conflict bar"
+  ).toHaveCount(0);
+  await expect(
+    page.getByTestId(CONFLICT_DIALOG_TESTID),
+    "a clean save must not surface a false-positive conflict dialog"
+  ).toHaveCount(0);
+}
+async function clickConflictRefresh(page) {
+  await page.getByTestId(CONFLICT_BANNER_TESTID).getByRole("button", { name: /refresh/i }).click();
+}
+async function dismissConflictBanner(page) {
+  await page.getByTestId(CONFLICT_BANNER_TESTID).getByRole("button", { name: /dismiss/i }).click();
+}
+export {
+  CONFLICT_BANNER_TESTID,
+  CONFLICT_DIALOG_TESTID,
+  bumpRecordViaApi,
+  clickConflictRefresh,
+  dismissConflictBanner,
+  expectConflictBanner,
+  expectConflictBody,
+  expectNoConflictBanner,
+  putWithLock,
+  readUpdatedAt,
+  resolveApiUrl
+};
+//# sourceMappingURL=optimisticLockUi.js.map

package/dist/helpers/integration/optimisticLockUi.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/helpers/integration/optimisticLockUi.ts"],
+  "sourcesContent": ["import { expect, type APIRequestContext, type Page } from '@playwright/test'\nimport {\n  OPTIMISTIC_LOCK_HEADER_NAME,\n  OPTIMISTIC_LOCK_CONFLICT_CODE,\n} from '@open-mercato/shared/lib/crud/optimistic-lock-headers'\n\n/**\n * Shared helpers for the browser-driven optimistic-lock specs\n * (`TC-LOCK-OSS-014..046`). They make the conflict deterministic without two\n * real tabs or sleeps: the spec loads an edit page in the browser (the form\n * captures the record's `updated_at`), then advances `updated_at` out-of-band\n * via a header-less API PUT (additive path, always succeeds), and finally edits\n * + saves in the browser so the now-stale header triggers the 409 \u2192 conflict bar.\n *\n * See `packages/core/src/modules/sales/__integration__/__concurrent_edit_pattern.md`\n * and the conflict bar component\n * `packages/ui/src/backend/conflicts/RecordConflictBanner.tsx`\n * (`data-testid=\"record-conflict-banner\"`).\n */\n\nconst BASE_URL = process.env.BASE_URL?.trim() || ''\n\nexport function resolveApiUrl(path: string): string {\n  return BASE_URL ? `${BASE_URL}${path}` : path\n}\n\nexport const CONFLICT_BANNER_TESTID = 'record-conflict-banner'\n\n/**\n * The enterprise `record_locks` module (enabled in CI via\n * `OM_ENABLE_ENTERPRISE_MODULES=true`) supersedes the OSS banner with a richer\n * \"Conflict detected\" resolution dialog. Both are valid surfaces for \"the stale\n * write was refused\": on a CrudForm edit page either one can win depending on\n * whether the record_locks incoming-changes SSE (fired by the out-of-band bump)\n * is processed before the browser's stale save reaches the server. Asserting one\n * fixed surface is therefore racy; we wait for whichever conflict surface appears.\n * (List-delete / non-form flows have no record_locks lock and only ever surface\n * the OSS banner, so matching either surface is safe there too.)\n */\nexport const CONFLICT_DIALOG_TESTID = 'record-lock-conflict-dialog'\n\nfunction authHeaders(token: string, lockValue?: string): Record<string, string> {\n  const headers: Record<string, string> = {\n    Authorization: `Bearer ${token}`,\n    'Content-Type': 'application/json',\n  }\n  if (lockValue !== undefined) headers[OPTIMISTIC_LOCK_HEADER_NAME] = lockValue\n  return headers\n}\n\n/**\n * Read a record's current `updated_at` from a list-shaped CRUD GET\n * (`GET <basePath>?id=<id>` \u2192 `items[0].updated_at`), normalized to ISO.\n * Works for the `makeCrudRoute` list responses (snake or camel case).\n */\nexport async function readUpdatedAt(\n  request: APIRequestContext,\n  token: string,\n  basePath: string,\n  id: string,\n  idParam = 'id',\n): Promise<string> {\n  const response = await request.fetch(\n    resolveApiUrl(`${basePath}?${idParam}=${encodeURIComponent(id)}`),\n    { method: 'GET', headers: authHeaders(token) },\n  )\n  expect(response.status(), `GET ${basePath}?${idParam}=... should be 200`).toBe(200)\n  const body = (await response.json()) as\n    | { items?: Array<Record<string, unknown>> }\n    | Record<string, unknown>\n  const item = Array.isArray((body as { items?: unknown[] }).items)\n    ? (body as { items: Array<Record<string, unknown>> }).items[0]\n    : (body as Record<string, unknown>)\n  expect(item, `response should include the record for id=${id}`).toBeTruthy()\n  const raw = (item?.updated_at ?? item?.updatedAt) as string | undefined\n  expect(typeof raw, `record should expose updated_at, got ${String(raw)}`).toBe('string')\n  const ms = Date.parse(raw as string)\n  expect(Number.isFinite(ms), `updated_at should parse, got ${String(raw)}`).toBe(true)\n  return new Date(ms).toISOString()\n}\n\n/**\n * Advance a record's `updated_at` out-of-band so the browser's loaded form now\n * holds a stale token. Uses a **header-less** PUT (the strictly-additive path\n * always succeeds and bumps `updated_at`). Returns the new ISO `updated_at`.\n */\nexport async function bumpRecordViaApi(\n  request: APIRequestContext,\n  token: string,\n  basePath: string,\n  putBody: Record<string, unknown>,\n  opts: { idParam?: string; method?: 'PUT' | 'PATCH' } = {},\n): Promise<string | null> {\n  const response = await request.fetch(resolveApiUrl(basePath), {\n    method: opts.method ?? 'PUT',\n    headers: authHeaders(token),\n    data: putBody,\n  })\n  expect(\n    response.status(),\n    `out-of-band ${opts.method ?? 'PUT'} ${basePath} should succeed (additive path), got ${response.status()}`,\n  ).toBeLessThan(300)\n  const id = putBody[opts.idParam ?? 'id']\n  if (typeof id === 'string') {\n    try {\n      return await readUpdatedAt(request, token, basePath, id, opts.idParam)\n    } catch {\n      return null\n    }\n  }\n  return null\n}\n\n/** Direct API helpers to assert the 409 contract body (used by the negative/UX specs). */\nexport async function putWithLock(\n  request: APIRequestContext,\n  token: string,\n  basePath: string,\n  body: Record<string, unknown>,\n  lockValue: string,\n) {\n  return request.fetch(resolveApiUrl(basePath), {\n    method: 'PUT',\n    headers: authHeaders(token, lockValue),\n    data: body,\n  })\n}\n\nexport async function expectConflictBody(response: { status(): number; json(): Promise<unknown> }) {\n  expect(response.status(), 'stale write should be 409').toBe(409)\n  const body = (await response.json()) as { code?: string; currentUpdatedAt?: string; expectedUpdatedAt?: string }\n  expect(body.code, 'body.code should be the optimistic-lock conflict code').toBe(OPTIMISTIC_LOCK_CONFLICT_CODE)\n  return body\n}\n\n/**\n * Assert a stale save was refused and surfaced as a conflict. Matches EITHER the\n * OSS `record-conflict-banner` OR the enterprise record_locks \"Conflict detected\"\n * dialog \u2014 see `CONFLICT_DIALOG_TESTID` for why both are valid and why pinning one\n * is racy when enterprise modules are enabled.\n */\nexport async function expectConflictBanner(page: Page): Promise<void> {\n  const conflictSurface = page\n    .getByTestId(CONFLICT_BANNER_TESTID)\n    .or(page.getByTestId(CONFLICT_DIALOG_TESTID))\n  await expect(\n    conflictSurface.first(),\n    'a conflict surface (OSS bar or record_locks dialog) should appear after a stale save',\n  ).toBeVisible({ timeout: 10_000 })\n}\n\n/** Assert no conflict surface is present (a clean single-tab save must not 409). */\nexport async function expectNoConflictBanner(page: Page): Promise<void> {\n  await expect(\n    page.getByTestId(CONFLICT_BANNER_TESTID),\n    'a clean save must not surface a false-positive conflict bar',\n  ).toHaveCount(0)\n  await expect(\n    page.getByTestId(CONFLICT_DIALOG_TESTID),\n    'a clean save must not surface a false-positive conflict dialog',\n  ).toHaveCount(0)\n}\n\n/** Click the conflict bar's Refresh button. */\nexport async function clickConflictRefresh(page: Page): Promise<void> {\n  await page.getByTestId(CONFLICT_BANNER_TESTID).getByRole('button', { name: /refresh/i }).click()\n}\n\n/** Dismiss the conflict bar via its close (X) button. */\nexport async function dismissConflictBanner(page: Page): Promise<void> {\n  await page.getByTestId(CONFLICT_BANNER_TESTID).getByRole('button', { name: /dismiss/i }).click()\n}\n"],
+  "mappings": "AAAA,SAAS,cAAiD;AAC1D;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAgBP,MAAM,WAAW,QAAQ,IAAI,UAAU,KAAK,KAAK;AAE1C,SAAS,cAAc,MAAsB;AAClD,SAAO,WAAW,GAAG,QAAQ,GAAG,IAAI,KAAK;AAC3C;AAEO,MAAM,yBAAyB;AAa/B,MAAM,yBAAyB;AAEtC,SAAS,YAAY,OAAe,WAA4C;AAC9E,QAAM,UAAkC;AAAA,IACtC,eAAe,UAAU,KAAK;AAAA,IAC9B,gBAAgB;AAAA,EAClB;AACA,MAAI,cAAc,OAAW,SAAQ,2BAA2B,IAAI;AACpE,SAAO;AACT;AAOA,eAAsB,cACpB,SACA,OACA,UACA,IACA,UAAU,MACO;AACjB,QAAM,WAAW,MAAM,QAAQ;AAAA,IAC7B,cAAc,GAAG,QAAQ,IAAI,OAAO,IAAI,mBAAmB,EAAE,CAAC,EAAE;AAAA,IAChE,EAAE,QAAQ,OAAO,SAAS,YAAY,KAAK,EAAE;AAAA,EAC/C;AACA,SAAO,SAAS,OAAO,GAAG,OAAO,QAAQ,IAAI,OAAO,oBAAoB,EAAE,KAAK,GAAG;AAClF,QAAM,OAAQ,MAAM,SAAS,KAAK;AAGlC,QAAM,OAAO,MAAM,QAAS,KAA+B,KAAK,IAC3D,KAAmD,MAAM,CAAC,IAC1D;AACL,SAAO,MAAM,6CAA6C,EAAE,EAAE,EAAE,WAAW;AAC3E,QAAM,MAAO,MAAM,cAAc,MAAM;AACvC,SAAO,OAAO,KAAK,wCAAwC,OAAO,GAAG,CAAC,EAAE,EAAE,KAAK,QAAQ;AACvF,QAAM,KAAK,KAAK,MAAM,GAAa;AACnC,SAAO,OAAO,SAAS,EAAE,GAAG,gCAAgC,OAAO,GAAG,CAAC,EAAE,EAAE,KAAK,IAAI;AACpF,SAAO,IAAI,KAAK,EAAE,EAAE,YAAY;AAClC;AAOA,eAAsB,iBACpB,SACA,OACA,UACA,SACA,OAAuD,CAAC,GAChC;AACxB,QAAM,WAAW,MAAM,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAAA,IAC5D,QAAQ,KAAK,UAAU;AAAA,IACvB,SAAS,YAAY,KAAK;AAAA,IAC1B,MAAM;AAAA,EACR,CAAC;AACD;AAAA,IACE,SAAS,OAAO;AAAA,IAChB,eAAe,KAAK,UAAU,KAAK,IAAI,QAAQ,wCAAwC,SAAS,OAAO,CAAC;AAAA,EAC1G,EAAE,aAAa,GAAG;AAClB,QAAM,KAAK,QAAQ,KAAK,WAAW,IAAI;AACvC,MAAI,OAAO,OAAO,UAAU;AAC1B,QAAI;AACF,aAAO,MAAM,cAAc,SAAS,OAAO,UAAU,IAAI,KAAK,OAAO;AAAA,IACvE,QAAQ;AACN,aAAO;AAAA,IACT;AAAA,EACF;AACA,SAAO;AACT;AAGA,eAAsB,YACpB,SACA,OACA,UACA,MACA,WACA;AACA,SAAO,QAAQ,MAAM,cAAc,QAAQ,GAAG;AAAA,IAC5C,QAAQ;AAAA,IACR,SAAS,YAAY,OAAO,SAAS;AAAA,IACrC,MAAM;AAAA,EACR,CAAC;AACH;AAEA,eAAsB,mBAAmB,UAA0D;AACjG,SAAO,SAAS,OAAO,GAAG,2BAA2B,EAAE,KAAK,GAAG;AAC/D,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,KAAK,MAAM,uDAAuD,EAAE,KAAK,6BAA6B;AAC7G,SAAO;AACT;AAQA,eAAsB,qBAAqB,MAA2B;AACpE,QAAM,kBAAkB,KACrB,YAAY,sBAAsB,EAClC,GAAG,KAAK,YAAY,sBAAsB,CAAC;AAC9C,QAAM;AAAA,IACJ,gBAAgB,MAAM;AAAA,IACtB;AAAA,EACF,EAAE,YAAY,EAAE,SAAS,IAAO,CAAC;AACnC;AAGA,eAAsB,uBAAuB,MAA2B;AACtE,QAAM;AAAA,IACJ,KAAK,YAAY,sBAAsB;AAAA,IACvC;AAAA,EACF,EAAE,YAAY,CAAC;AACf,QAAM;AAAA,IACJ,KAAK,YAAY,sBAAsB;AAAA,IACvC;AAAA,EACF,EAAE,YAAY,CAAC;AACjB;AAGA,eAAsB,qBAAqB,MAA2B;AACpE,QAAM,KAAK,YAAY,sBAAsB,EAAE,UAAU,UAAU,EAAE,MAAM,WAAW,CAAC,EAAE,MAAM;AACjG;AAGA,eAAsB,sBAAsB,MAA2B;AACrE,QAAM,KAAK,YAAY,sBAAsB,EAAE,UAAU,UAAU,EAAE,MAAM,WAAW,CAAC,EAAE,MAAM;AACjG;",
+  "names": []
+}

package/dist/helpers/integration/salesFixtures.js

@@ -46,6 +46,22 @@ async function createOrderLineFixture(request, token, orderId, data) {
     ["id", "lineId"]
   );
 }
+async function canManageSalesOrders(request, token) {
+  const response = await apiRequest(request, "POST", "/api/sales/orders", {
+    token,
+    data: { currencyCode: "USD" }
+  });
+  if (response.status() === 403) return false;
+  if (!response.ok()) return false;
+  const id = readId(await response.json(), ["id", "orderId"]);
+  if (id) {
+    try {
+      await apiRequest(request, "DELETE", "/api/sales/orders", { token, data: { id } });
+    } catch {
+    }
+  }
+  return true;
+}
 async function deleteSalesEntityIfExists(request, token, path, id) {
   if (!token || !id) return;
   try {
@@ -55,6 +71,7 @@ async function deleteSalesEntityIfExists(request, token, path, id) {
   }
 }
 export {
+  canManageSalesOrders,
   createOrderLineFixture,
   createSalesOrderFixture,
   createSalesQuoteFixture,

package/dist/helpers/integration/salesFixtures.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/helpers/integration/salesFixtures.ts"],
-  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\n\ntype JsonMap = Record<string, unknown>;\n\nfunction readId(payload: unknown, keys: string[]): string | null {\n  if (!payload || typeof payload !== 'object') return null;\n  const map = payload as JsonMap;\n  for (const key of keys) {\n    const value = map[key];\n    if (typeof value === 'string' && value.length > 0) return value;\n  }\n  for (const value of Object.values(map)) {\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      const nested = readId(value, keys);\n      if (nested) return nested;\n    }\n  }\n  return null;\n}\n\nasync function createEntity(\n  request: APIRequestContext,\n  token: string,\n  path: string,\n  data: Record<string, unknown>,\n  idKeys: string[],\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', path, { token, data });\n  const body = (await response.json()) as unknown;\n  expect(response.ok(), `Failed POST ${path}: ${response.status()}`).toBeTruthy();\n  const id = readId(body, idKeys);\n  expect(id, `No id in POST ${path} response`).toBeTruthy();\n  return id as string;\n}\n\nexport async function createSalesQuoteFixture(\n  request: APIRequestContext,\n  token: string,\n  currencyCode = 'USD',\n): Promise<string> {\n  return createEntity(request, token, '/api/sales/quotes', { currencyCode }, ['id', 'quoteId']);\n}\n\nexport async function createSalesOrderFixture(\n  request: APIRequestContext,\n  token: string,\n  currencyCode = 'USD',\n): Promise<string> {\n  return createEntity(request, token, '/api/sales/orders', { currencyCode }, ['id', 'orderId']);\n}\n\nexport async function createOrderLineFixture(\n  request: APIRequestContext,\n  token: string,\n  orderId: string,\n  data?: Record<string, unknown>,\n): Promise<string> {\n  return createEntity(\n    request,\n    token,\n    '/api/sales/order-lines',\n    {\n      orderId,\n      currencyCode: 'USD',\n      quantity: 1,\n      name: `QA line ${Date.now()}`,\n      unitPriceNet: 10,\n      unitPriceGross: 12,\n      ...(data ?? {}),\n    },\n    ['id', 'lineId'],\n  );\n}\n\nexport async function deleteSalesEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n\n"],
-  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAI3B,SAAS,OAAO,SAAkB,MAA+B;AAC/D,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,MAAM;AACZ,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,aAAW,SAAS,OAAO,OAAO,GAAG,GAAG;AACtC,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,SAAS,OAAO,OAAO,IAAI;AACjC,UAAI,OAAQ,QAAO;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aACb,SACA,OACA,MACA,MACA,QACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC;AACxE,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,SAAS,GAAG,GAAG,eAAe,IAAI,KAAK,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC9E,QAAM,KAAK,OAAO,MAAM,MAAM;AAC9B,SAAO,IAAI,iBAAiB,IAAI,WAAW,EAAE,WAAW;AACxD,SAAO;AACT;AAEA,eAAsB,wBACpB,SACA,OACA,eAAe,OACE;AACjB,SAAO,aAAa,SAAS,OAAO,qBAAqB,EAAE,aAAa,GAAG,CAAC,MAAM,SAAS,CAAC;AAC9F;AAEA,eAAsB,wBACpB,SACA,OACA,eAAe,OACE;AACjB,SAAO,aAAa,SAAS,OAAO,qBAAqB,EAAE,aAAa,GAAG,CAAC,MAAM,SAAS,CAAC;AAC9F;AAEA,eAAsB,uBACpB,SACA,OACA,SACA,MACiB;AACjB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV,MAAM,WAAW,KAAK,IAAI,CAAC;AAAA,MAC3B,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,GAAI,QAAQ,CAAC;AAAA,IACf;AAAA,IACA,CAAC,MAAM,QAAQ;AAAA,EACjB;AACF;AAEA,eAAsB,0BACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { expect, type APIRequestContext } from '@playwright/test';\nimport { apiRequest } from './api';\n\ntype JsonMap = Record<string, unknown>;\n\nfunction readId(payload: unknown, keys: string[]): string | null {\n  if (!payload || typeof payload !== 'object') return null;\n  const map = payload as JsonMap;\n  for (const key of keys) {\n    const value = map[key];\n    if (typeof value === 'string' && value.length > 0) return value;\n  }\n  for (const value of Object.values(map)) {\n    if (value && typeof value === 'object' && !Array.isArray(value)) {\n      const nested = readId(value, keys);\n      if (nested) return nested;\n    }\n  }\n  return null;\n}\n\nasync function createEntity(\n  request: APIRequestContext,\n  token: string,\n  path: string,\n  data: Record<string, unknown>,\n  idKeys: string[],\n): Promise<string> {\n  const response = await apiRequest(request, 'POST', path, { token, data });\n  const body = (await response.json()) as unknown;\n  expect(response.ok(), `Failed POST ${path}: ${response.status()}`).toBeTruthy();\n  const id = readId(body, idKeys);\n  expect(id, `No id in POST ${path} response`).toBeTruthy();\n  return id as string;\n}\n\nexport async function createSalesQuoteFixture(\n  request: APIRequestContext,\n  token: string,\n  currencyCode = 'USD',\n): Promise<string> {\n  return createEntity(request, token, '/api/sales/quotes', { currencyCode }, ['id', 'quoteId']);\n}\n\nexport async function createSalesOrderFixture(\n  request: APIRequestContext,\n  token: string,\n  currencyCode = 'USD',\n): Promise<string> {\n  return createEntity(request, token, '/api/sales/orders', { currencyCode }, ['id', 'orderId']);\n}\n\nexport async function createOrderLineFixture(\n  request: APIRequestContext,\n  token: string,\n  orderId: string,\n  data?: Record<string, unknown>,\n): Promise<string> {\n  return createEntity(\n    request,\n    token,\n    '/api/sales/order-lines',\n    {\n      orderId,\n      currencyCode: 'USD',\n      quantity: 1,\n      name: `QA line ${Date.now()}`,\n      unitPriceNet: 10,\n      unitPriceGross: 12,\n      ...(data ?? {}),\n    },\n    ['id', 'lineId'],\n  );\n}\n\n/**\n * Probe whether the authenticated principal can create a sales order on the\n * current tenant (i.e. holds `sales.orders.manage`). Sales-write integration\n * specs use this to self-skip on dev databases whose role ACLs were never\n * synced (`yarn mercato auth sync-role-acls`) rather than fail spuriously \u2014\n * CI bootstraps a fully-synced tenant so the probe passes there. The probed\n * order is deleted immediately so the check leaves no residue.\n */\nexport async function canManageSalesOrders(\n  request: APIRequestContext,\n  token: string,\n): Promise<boolean> {\n  const response = await apiRequest(request, 'POST', '/api/sales/orders', {\n    token,\n    data: { currencyCode: 'USD' },\n  });\n  if (response.status() === 403) return false;\n  if (!response.ok()) return false;\n  const id = readId((await response.json()) as unknown, ['id', 'orderId']);\n  if (id) {\n    try {\n      await apiRequest(request, 'DELETE', '/api/sales/orders', { token, data: { id } });\n    } catch {\n      // best-effort cleanup\n    }\n  }\n  return true;\n}\n\nexport async function deleteSalesEntityIfExists(\n  request: APIRequestContext,\n  token: string | null,\n  path: string,\n  id: string | null,\n): Promise<void> {\n  if (!token || !id) return;\n  try {\n    await apiRequest(request, 'DELETE', `${path}?id=${encodeURIComponent(id)}`, { token });\n  } catch {\n    return;\n  }\n}\n\n"],
+  "mappings": "AAAA,SAAS,cAAsC;AAC/C,SAAS,kBAAkB;AAI3B,SAAS,OAAO,SAAkB,MAA+B;AAC/D,MAAI,CAAC,WAAW,OAAO,YAAY,SAAU,QAAO;AACpD,QAAM,MAAM;AACZ,aAAW,OAAO,MAAM;AACtB,UAAM,QAAQ,IAAI,GAAG;AACrB,QAAI,OAAO,UAAU,YAAY,MAAM,SAAS,EAAG,QAAO;AAAA,EAC5D;AACA,aAAW,SAAS,OAAO,OAAO,GAAG,GAAG;AACtC,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,GAAG;AAC/D,YAAM,SAAS,OAAO,OAAO,IAAI;AACjC,UAAI,OAAQ,QAAO;AAAA,IACrB;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aACb,SACA,OACA,MACA,MACA,QACiB;AACjB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,MAAM,EAAE,OAAO,KAAK,CAAC;AACxE,QAAM,OAAQ,MAAM,SAAS,KAAK;AAClC,SAAO,SAAS,GAAG,GAAG,eAAe,IAAI,KAAK,SAAS,OAAO,CAAC,EAAE,EAAE,WAAW;AAC9E,QAAM,KAAK,OAAO,MAAM,MAAM;AAC9B,SAAO,IAAI,iBAAiB,IAAI,WAAW,EAAE,WAAW;AACxD,SAAO;AACT;AAEA,eAAsB,wBACpB,SACA,OACA,eAAe,OACE;AACjB,SAAO,aAAa,SAAS,OAAO,qBAAqB,EAAE,aAAa,GAAG,CAAC,MAAM,SAAS,CAAC;AAC9F;AAEA,eAAsB,wBACpB,SACA,OACA,eAAe,OACE;AACjB,SAAO,aAAa,SAAS,OAAO,qBAAqB,EAAE,aAAa,GAAG,CAAC,MAAM,SAAS,CAAC;AAC9F;AAEA,eAAsB,uBACpB,SACA,OACA,SACA,MACiB;AACjB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,UAAU;AAAA,MACV,MAAM,WAAW,KAAK,IAAI,CAAC;AAAA,MAC3B,cAAc;AAAA,MACd,gBAAgB;AAAA,MAChB,GAAI,QAAQ,CAAC;AAAA,IACf;AAAA,IACA,CAAC,MAAM,QAAQ;AAAA,EACjB;AACF;AAUA,eAAsB,qBACpB,SACA,OACkB;AAClB,QAAM,WAAW,MAAM,WAAW,SAAS,QAAQ,qBAAqB;AAAA,IACtE;AAAA,IACA,MAAM,EAAE,cAAc,MAAM;AAAA,EAC9B,CAAC;AACD,MAAI,SAAS,OAAO,MAAM,IAAK,QAAO;AACtC,MAAI,CAAC,SAAS,GAAG,EAAG,QAAO;AAC3B,QAAM,KAAK,OAAQ,MAAM,SAAS,KAAK,GAAe,CAAC,MAAM,SAAS,CAAC;AACvE,MAAI,IAAI;AACN,QAAI;AACF,YAAM,WAAW,SAAS,UAAU,qBAAqB,EAAE,OAAO,MAAM,EAAE,GAAG,EAAE,CAAC;AAAA,IAClF,QAAQ;AAAA,IAER;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAsB,0BACpB,SACA,OACA,MACA,IACe;AACf,MAAI,CAAC,SAAS,CAAC,GAAI;AACnB,MAAI;AACF,UAAM,WAAW,SAAS,UAAU,GAAG,IAAI,OAAO,mBAAmB,EAAE,CAAC,IAAI,EAAE,MAAM,CAAC;AAAA,EACvF,QAAQ;AACN;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/helpers/integration/salesUi.js

@@ -1,6 +1,6 @@
 import { expect } from "@playwright/test";
 import { apiRequest, getAuthToken } from "./api.js";
-const TEST_WAIT_TIMEOUT_MS = 1e4;
+const TEST_WAIT_TIMEOUT_MS = 15e3;
 function escapeRegExp(value) {
   return value.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
@@ -335,12 +335,19 @@ async function resolveSalesChannelId(page, token, channelQuery) {
   return exactMatch?.id ?? null;
 }
 async function resolveOrderLineId(page, token, orderId) {
-  const response = await apiRequest(page.request, "GET", `/api/sales/order-lines?page=1&pageSize=20&orderId=${orderId}`, {
-    token
-  }).catch(() => null);
-  const body = await response?.json().catch(() => null);
-  const items = readListItems(body);
-  return items.find((item) => typeof item.id === "string" && item.id.length > 0)?.id ?? null;
+  const deadline = Date.now() + TEST_WAIT_TIMEOUT_MS;
+  while (Date.now() < deadline) {
+    const response = await apiRequest(page.request, "GET", `/api/sales/order-lines?page=1&pageSize=20&orderId=${orderId}`, {
+      token
+    }).catch(() => null);
+    const body = await response?.json().catch(() => null);
+    const items = readListItems(body);
+    const lineId = items.find((item) => typeof item.id === "string" && item.id.length > 0)?.id ?? null;
+    if (lineId) return lineId;
+    await page.waitForTimeout(250).catch(() => {
+    });
+  }
+  return null;
 }
 async function resolveShippingMethodId(page, token) {
   const response = await apiRequest(
@@ -1034,7 +1041,7 @@ async function addShipment(page) {
   for (let attempt = 0; attempt < 2; attempt += 1) {
     const opened = await openShipmentDialog();
     if (!opened) break;
-    await dialog.getByText(/Loading shipments…|Loading shipments\.\.\./i).first().waitFor({ state: "hidden", timeout: 5e3 }).catch(() => {
+    await dialog.getByText(/Loading shipments…|Loading shipments\.\.\./i).first().waitFor({ state: "hidden", timeout: TEST_WAIT_TIMEOUT_MS }).catch(() => {
     });
     const shipmentNumberInput2 = dialog.locator("input, textarea").first();
     if (await shipmentNumberInput2.isVisible().catch(() => false)) {
@@ -1105,7 +1112,8 @@ async function addShipment(page) {
     }
   }
   if (!closed) {
-    return { trackingNumber, shipmentNumber, added: false };
+    const added2 = await addShipmentViaApi(page, shipmentNumber, trackingNumber);
+    return { trackingNumber, shipmentNumber, added: added2 };
   }
   await page.getByRole("button", { name: /^Shipments$/i }).click();
   const shipmentLabel = page.getByText(new RegExp(`Shipment\\s+${escapeRegExp(shipmentNumber)}`, "i")).first();