npm - @open-mercato/core - Versions diffs - 0.6.5-develop.5296.1.799a610136 → 0.6.5-develop.5382.1.f542de69af - Mend

@open-mercato/core 0.6.5-develop.5296.1.799a610136 → 0.6.5-develop.5382.1.f542de69af

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (119) hide show

package/.turbo/turbo-build.log CHANGED Viewed

@@ -1,4 +1,4 @@
-[build:core] found 3311 entry points
+[build:core] found 3313 entry points
 [build:core] built successfully
 [build:core:generated] found 185 entry points
 [build:core:generated] built successfully

package/AGENTS.md CHANGED Viewed

@@ -506,7 +506,7 @@ When adding features to `acl.ts`, also add them to `setup.ts` `defaultRoleFeatur
 ## Entity Update Safety — `withAtomicFlush`
-MikroORM's identity-map and subscriber infrastructure can silently discard pending scalar changes when a query (`em.find`, `em.findOne`, etc.) runs on the same `EntityManager` before an explicit `em.flush()`. Additionally, multiple `em.flush()` calls without transaction wrapping risk partial commits. See [SPEC-018](../../.ai/specs/SPEC-018-2026-02-05-safe-entity-flush.md) for the full analysis.
+MikroORM's identity-map and subscriber infrastructure can silently discard pending scalar changes when a query (`em.find`, `em.findOne`, etc.) runs on the same `EntityManager` before an explicit `em.flush()`. Additionally, multiple `em.flush()` calls without transaction wrapping risk partial commits. See [SPEC-018](../../.ai/specs/implemented/SPEC-018-2026-02-05-safe-entity-flush.md) for the full analysis.
 ### Rules

package/dist/modules/attachments/api/library/route.js CHANGED Viewed

@@ -7,7 +7,7 @@ import { Attachment, AttachmentPartition } from "../../data/entities.js";
 import { buildAttachmentImageUrl, slugifyAttachmentFileName } from "../../lib/imageUrls.js";
 import { readAttachmentMetadata } from "../../lib/metadata.js";
 import { applyAssignmentEnrichments, resolveAssignmentEnrichments } from "../../lib/assignmentDetails.js";
-import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import { buildIlikeTerm } from "@open-mercato/shared/lib/db/buildIlikeTerm";
 import { ensureDefaultPartitions } from "../../lib/partitions.js";
 import {
   attachmentsTag,
@@ -73,7 +73,7 @@ async function GET(req) {
   }
   qb.where(baseFilter);
   if (search && search.trim().length > 0) {
-    qb.andWhere({ fileName: { $ilike: `%${escapeLikePattern(search.trim())}%` } });
+    qb.andWhere({ fileName: { $ilike: buildIlikeTerm(search.trim()) } });
   }
   if (partition && partition.trim().length > 0) {
     qb.andWhere({ partitionCode: partition.trim() });

package/dist/modules/attachments/api/library/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/attachments/api/library/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { Attachment, AttachmentPartition } from '../../data/entities'\nimport { buildAttachmentImageUrl, slugifyAttachmentFileName } from '../../lib/imageUrls'\nimport { readAttachmentMetadata } from '../../lib/metadata'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../lib/assignmentDetails'\nimport { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport { ensureDefaultPartitions } from '../../lib/partitions'\nimport {\n  attachmentsTag,\n  attachmentListQuerySchema as openApiListQuerySchema,\n  attachmentListResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  search: z.string().optional(),\n  partition: z.string().optional(),\n  tags: z.string().optional(),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n}\n\nfunction buildTagFilter(raw?: string): string[] {\n  if (!raw) return []\n  return raw\n    .split(',')\n    .map((tag) => tag.trim())\n    .filter((tag) => tag.length > 0)\n}\n\nfunction formatDateValue(value: unknown): string {\n  const toDate = (): Date => {\n    if (value instanceof Date) return value\n    if (typeof value === 'string') {\n      const parsed = new Date(value)\n      if (!Number.isNaN(parsed.getTime())) return parsed\n    }\n    const fallback = new Date(value as any)\n    if (!Number.isNaN(fallback.getTime())) return fallback\n    return new Date()\n  }\n  return toDate().toISOString()\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query' }, { status: 400 })\n  }\n\n  const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data\n  const tagList = buildTagFilter(tags)\n  const offset = (page - 1) * pageSize\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  await ensureDefaultPartitions(em)\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const qb = em.createQueryBuilder(Attachment, 'a')\n  const baseFilter: Record<string, unknown> = { tenantId: auth.tenantId }\n  if (auth.orgId) {\n    baseFilter.organizationId = auth.orgId\n  }\n  qb.where(baseFilter)\n  if (search && search.trim().length > 0) {\n    qb.andWhere({ fileName: { $ilike: `%${escapeLikePattern(search.trim())}%` } })\n  }\n  if (partition && partition.trim().length > 0) {\n    qb.andWhere({ partitionCode: partition.trim() })\n  }\n  if (tagList.length > 0) {\n    qb.andWhere(`coalesce(a.storage_metadata->'tags', '[]'::jsonb) @> ?::jsonb`, [JSON.stringify(tagList)])\n  }\n  const countQb = qb.clone()\n  const orderMap: Record<string, string> = {\n    fileName: 'a.file_name',\n    fileSize: 'a.file_size',\n    createdAt: 'a.created_at',\n  }\n  const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'\n  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })\n  qb.limit(pageSize).offset(offset)\n\n  const partitionsPromise = em.find(\n    AttachmentPartition,\n    {},\n    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },\n  )\n  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])\n  const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {\n    if (entry.code) acc[entry.code] = entry.title ?? entry.code\n    return acc\n  }, {})\n  const items = records.map((record) => {\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const fileName = record.fileName || ''\n    const isImage = typeof record.mimeType === 'string' && record.mimeType.toLowerCase().startsWith('image/')\n    const thumbnailUrl = isImage\n      ? buildAttachmentImageUrl(record.id, {\n          width: 200,\n          height: 200,\n          slug: slugifyAttachmentFileName(fileName),\n        })\n      : undefined\n    return {\n      id: record.id,\n      fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partitionTitleByCode[record.partitionCode] ?? null,\n      url: record.url,\n      createdAt: formatDateValue(record.createdAt),\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      thumbnailUrl,\n      content: record.content && record.content.trim() ? record.content : null,\n    }\n  })\n\n  const allAssignments = items.flatMap((item) => item.assignments ?? [])\n  const enrichments = await resolveAssignmentEnrichments(allAssignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedItems = enrichments.size\n    ? items.map((item) => ({\n        ...item,\n        assignments: applyAssignmentEnrichments(item.assignments ?? [], enrichments),\n      }))\n    : items\n\n  const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))\n  const db = em.getKysely<any>() as any\n  let tagQuery = db\n    .selectFrom('attachments')\n    .select(sql<string>`distinct jsonb_array_elements_text(coalesce(storage_metadata->'tags', '[]'::jsonb))`.as('tag'))\n    .where('tenant_id', '=', auth.tenantId)\n  if (auth.orgId) {\n    tagQuery = tagQuery.where('organization_id', '=', auth.orgId)\n  }\n  const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>\n  const availableTags = tagRows\n    .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))\n    .filter((tag) => tag.length > 0)\n\n  return NextResponse.json({\n    items: enrichedItems,\n    page,\n    pageSize,\n    total,\n    totalPages,\n    availableTags,\n    partitions: partitions.map((entry) => ({\n      code: entry.code,\n      title: entry.title,\n      description: entry.description ?? null,\n      isPublic: entry.isPublic ?? false,\n    })),\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment library management',\n  methods: {\n    GET: {\n      summary: 'List attachments',\n      description: 'Returns paginated list of attachments with optional filtering by search term, partition, and tags. Includes available tags and partitions.',\n      query: openApiListQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments list with pagination and metadata', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,WAAW;AACpB,SAAS,YAAY,2BAA2B;AAChD,SAAS,yBAAyB,iCAAiC;AACnE,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,oCAAoC;AACzE,SAAS,yBAAyB;AAClC,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AAEP,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,EAClE,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,SAAS,eAAe,KAAwB;AAC9C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EACvB,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnC;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,SAAS,MAAY;AACzB,QAAI,iBAAiB,KAAM,QAAO;AAClC,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,UAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,IAC9C;AACA,UAAM,WAAW,IAAI,KAAK,KAAY;AACtC,QAAI,CAAC,OAAO,MAAM,SAAS,QAAQ,CAAC,EAAG,QAAO;AAC9C,WAAO,oBAAI,KAAK;AAAA,EAClB;AACA,SAAO,OAAO,EAAE,YAAY;AAC9B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACvF,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,EAAE,MAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,QAAQ,IAAI,OAAO;AAC/E,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,wBAAwB,EAAE;AAChC,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,KAAK,GAAG,mBAAmB,YAAY,GAAG;AAChD,QAAM,aAAsC,EAAE,UAAU,KAAK,SAAS;AACtE,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,KAAG,MAAM,UAAU;AACnB,MAAI,UAAU,OAAO,KAAK,EAAE,SAAS,GAAG;AACtC,OAAG,SAAS,EAAE,UAAU,EAAE,QAAQ,IAAI,kBAAkB,OAAO,KAAK,CAAC,CAAC,IAAI,EAAE,CAAC;AAAA,EAC/E;AACA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,OAAG,SAAS,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC;AAAA,EACjD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,OAAG,SAAS,iEAAiE,CAAC,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACxG;AACA,QAAM,UAAU,GAAG,MAAM;AACzB,QAAM,WAAmC;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACA,QAAM,cAAc,SAAS,aAAa,WAAW,KAAK;AAC1D,KAAG,QAAQ,EAAE,CAAC,WAAW,GAAG,YAAY,QAAQ,QAAQ,OAAO,CAAC;AAChE,KAAG,MAAM,QAAQ,EAAE,OAAO,MAAM;AAEhC,QAAM,oBAAoB,GAAG;AAAA,IAC3B;AAAA,IACA,CAAC;AAAA,IACD,EAAE,SAAS,EAAE,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,SAAS,aAAa,EAAS;AAAA,EAC/E;AACA,QAAM,CAAC,SAAS,OAAO,UAAU,IAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,cAAc,GAAG,QAAQ,SAAS,QAAQ,IAAI,GAAG,iBAAiB,CAAC;AAC9H,QAAM,uBAAuB,WAAW,OAA+B,CAAC,KAAK,UAAU;AACrF,QAAI,MAAM,KAAM,KAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM;AACvD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,QAAQ,QAAQ,IAAI,CAAC,WAAW;AACpC,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,YAAY,EAAE,WAAW,QAAQ;AACxG,UAAM,eAAe,UACjB,wBAAwB,OAAO,IAAI;AAAA,MACjC,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,MAAM,0BAA0B,QAAQ;AAAA,IAC1C,CAAC,IACD;AACJ,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,qBAAqB,OAAO,aAAa,KAAK;AAAA,MAC9D,KAAK,OAAO;AAAA,MACZ,WAAW,gBAAgB,OAAO,SAAS;AAAA,MAC3C,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC;AAAA,MACA,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,MAAM,QAAQ,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC;AACrE,QAAM,cAAc,MAAM,6BAA6B,gBAAgB;AAAA,IACrE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,gBAAgB,YAAY,OAC9B,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,aAAa,2BAA2B,KAAK,eAAe,CAAC,GAAG,WAAW;AAAA,EAC7E,EAAE,IACF;AAEJ,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK,IAAI,QAAQ,CAAC;AAClE,QAAM,KAAK,GAAG,UAAe;AAC7B,MAAI,WAAW,GACZ,WAAW,aAAa,EACxB,OAAO,yFAAiG,GAAG,KAAK,CAAC,EACjH,MAAM,aAAa,KAAK,KAAK,QAAQ;AACxC,MAAI,KAAK,OAAO;AACd,eAAW,SAAS,MAAM,mBAAmB,KAAK,KAAK,KAAK;AAAA,EAC9D;AACA,QAAM,UAAU,MAAM,SAAS,QAAQ,OAAO,KAAK,EAAE,QAAQ;AAC7D,QAAM,gBAAgB,QACnB,IAAI,CAAC,QAAS,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI,EAAG,EAChE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AAEjC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,IAC9B,EAAE;AAAA,EACJ,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,6BAA6B;AAAA,MACpH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { sql } from 'kysely'\nimport { Attachment, AttachmentPartition } from '../../data/entities'\nimport { buildAttachmentImageUrl, slugifyAttachmentFileName } from '../../lib/imageUrls'\nimport { readAttachmentMetadata } from '../../lib/metadata'\nimport type { QueryEngine } from '@open-mercato/shared/lib/query/types'\nimport { applyAssignmentEnrichments, resolveAssignmentEnrichments } from '../../lib/assignmentDetails'\nimport { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'\nimport { ensureDefaultPartitions } from '../../lib/partitions'\nimport {\n  attachmentsTag,\n  attachmentListQuerySchema as openApiListQuerySchema,\n  attachmentListResponseSchema,\n  attachmentErrorSchema,\n} from '../openapi'\n\nconst listQuerySchema = z.object({\n  page: z.coerce.number().min(1).default(1),\n  pageSize: z.coerce.number().min(1).max(100).default(25),\n  search: z.string().optional(),\n  partition: z.string().optional(),\n  tags: z.string().optional(),\n  sortField: z.enum(['fileName', 'fileSize', 'createdAt']).optional(),\n  sortDir: z.enum(['asc', 'desc']).optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['attachments.view'] },\n}\n\nfunction buildTagFilter(raw?: string): string[] {\n  if (!raw) return []\n  return raw\n    .split(',')\n    .map((tag) => tag.trim())\n    .filter((tag) => tag.length > 0)\n}\n\nfunction formatDateValue(value: unknown): string {\n  const toDate = (): Date => {\n    if (value instanceof Date) return value\n    if (typeof value === 'string') {\n      const parsed = new Date(value)\n      if (!Number.isNaN(parsed.getTime())) return parsed\n    }\n    const fallback = new Date(value as any)\n    if (!Number.isNaN(fallback.getTime())) return fallback\n    return new Date()\n  }\n  return toDate().toISOString()\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) {\n    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  }\n  const url = new URL(req.url)\n  const parsed = listQuerySchema.safeParse(Object.fromEntries(url.searchParams.entries()))\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid query' }, { status: 400 })\n  }\n\n  const { page, pageSize, search, partition, tags, sortField, sortDir } = parsed.data\n  const tagList = buildTagFilter(tags)\n  const offset = (page - 1) * pageSize\n  const { resolve } = await createRequestContainer()\n  const em = resolve('em') as EntityManager\n  await ensureDefaultPartitions(em)\n  let queryEngine: QueryEngine | null = null\n  try {\n    queryEngine = resolve('queryEngine') as QueryEngine\n  } catch {\n    queryEngine = null\n  }\n  const qb = em.createQueryBuilder(Attachment, 'a')\n  const baseFilter: Record<string, unknown> = { tenantId: auth.tenantId }\n  if (auth.orgId) {\n    baseFilter.organizationId = auth.orgId\n  }\n  qb.where(baseFilter)\n  if (search && search.trim().length > 0) {\n    qb.andWhere({ fileName: { $ilike: buildIlikeTerm(search.trim()) } })\n  }\n  if (partition && partition.trim().length > 0) {\n    qb.andWhere({ partitionCode: partition.trim() })\n  }\n  if (tagList.length > 0) {\n    qb.andWhere(`coalesce(a.storage_metadata->'tags', '[]'::jsonb) @> ?::jsonb`, [JSON.stringify(tagList)])\n  }\n  const countQb = qb.clone()\n  const orderMap: Record<string, string> = {\n    fileName: 'a.file_name',\n    fileSize: 'a.file_size',\n    createdAt: 'a.created_at',\n  }\n  const orderColumn = orderMap[sortField ?? 'createdAt'] ?? 'a.created_at'\n  qb.orderBy({ [orderColumn]: sortDir === 'asc' ? 'asc' : 'desc' })\n  qb.limit(pageSize).offset(offset)\n\n  const partitionsPromise = em.find(\n    AttachmentPartition,\n    {},\n    { orderBy: { title: 'asc' }, fields: ['code', 'title', 'description'] as any },\n  )\n  const [records, total, partitions] = await Promise.all([qb.getResultList(), countQb.getCount('a.id', true), partitionsPromise])\n  const partitionTitleByCode = partitions.reduce<Record<string, string>>((acc, entry) => {\n    if (entry.code) acc[entry.code] = entry.title ?? entry.code\n    return acc\n  }, {})\n  const items = records.map((record) => {\n    const metadata = readAttachmentMetadata(record.storageMetadata)\n    const fileName = record.fileName || ''\n    const isImage = typeof record.mimeType === 'string' && record.mimeType.toLowerCase().startsWith('image/')\n    const thumbnailUrl = isImage\n      ? buildAttachmentImageUrl(record.id, {\n          width: 200,\n          height: 200,\n          slug: slugifyAttachmentFileName(fileName),\n        })\n      : undefined\n    return {\n      id: record.id,\n      fileName,\n      fileSize: record.fileSize,\n      mimeType: record.mimeType,\n      partitionCode: record.partitionCode,\n      partitionTitle: partitionTitleByCode[record.partitionCode] ?? null,\n      url: record.url,\n      createdAt: formatDateValue(record.createdAt),\n      tags: metadata.tags ?? [],\n      assignments: metadata.assignments ?? [],\n      thumbnailUrl,\n      content: record.content && record.content.trim() ? record.content : null,\n    }\n  })\n\n  const allAssignments = items.flatMap((item) => item.assignments ?? [])\n  const enrichments = await resolveAssignmentEnrichments(allAssignments, {\n    queryEngine,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  })\n  const enrichedItems = enrichments.size\n    ? items.map((item) => ({\n        ...item,\n        assignments: applyAssignmentEnrichments(item.assignments ?? [], enrichments),\n      }))\n    : items\n\n  const totalPages = Math.max(1, Math.ceil(Number(total) / pageSize))\n  const db = em.getKysely<any>() as any\n  let tagQuery = db\n    .selectFrom('attachments')\n    .select(sql<string>`distinct jsonb_array_elements_text(coalesce(storage_metadata->'tags', '[]'::jsonb))`.as('tag'))\n    .where('tenant_id', '=', auth.tenantId)\n  if (auth.orgId) {\n    tagQuery = tagQuery.where('organization_id', '=', auth.orgId)\n  }\n  const tagRows = await tagQuery.orderBy('tag', 'asc').execute() as Array<{ tag?: string | null }>\n  const availableTags = tagRows\n    .map((row) => (typeof row.tag === 'string' ? row.tag.trim() : ''))\n    .filter((tag) => tag.length > 0)\n\n  return NextResponse.json({\n    items: enrichedItems,\n    page,\n    pageSize,\n    total,\n    totalPages,\n    availableTags,\n    partitions: partitions.map((entry) => ({\n      code: entry.code,\n      title: entry.title,\n      description: entry.description ?? null,\n      isPublic: entry.isPublic ?? false,\n    })),\n  })\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: attachmentsTag,\n  summary: 'Attachment library management',\n  methods: {\n    GET: {\n      summary: 'List attachments',\n      description: 'Returns paginated list of attachments with optional filtering by search term, partition, and tags. Includes available tags and partitions.',\n      query: openApiListQuerySchema,\n      responses: [\n        { status: 200, description: 'Attachments list with pagination and metadata', schema: attachmentListResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid query parameters', schema: attachmentErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: attachmentErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,WAAW;AACpB,SAAS,YAAY,2BAA2B;AAChD,SAAS,yBAAyB,iCAAiC;AACnE,SAAS,8BAA8B;AAEvC,SAAS,4BAA4B,oCAAoC;AACzE,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA,6BAA6B;AAAA,EAC7B;AAAA,EACA;AAAA,OACK;AAEP,MAAM,kBAAkB,EAAE,OAAO;AAAA,EAC/B,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAAA,EAC5B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,MAAM,EAAE,OAAO,EAAE,SAAS;AAAA,EAC1B,WAAW,EAAE,KAAK,CAAC,YAAY,YAAY,WAAW,CAAC,EAAE,SAAS;AAAA,EAClE,SAAS,EAAE,KAAK,CAAC,OAAO,MAAM,CAAC,EAAE,SAAS;AAC5C,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,kBAAkB,EAAE;AAClE;AAEA,SAAS,eAAe,KAAwB;AAC9C,MAAI,CAAC,IAAK,QAAO,CAAC;AAClB,SAAO,IACJ,MAAM,GAAG,EACT,IAAI,CAAC,QAAQ,IAAI,KAAK,CAAC,EACvB,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AACnC;AAEA,SAAS,gBAAgB,OAAwB;AAC/C,QAAM,SAAS,MAAY;AACzB,QAAI,iBAAiB,KAAM,QAAO;AAClC,QAAI,OAAO,UAAU,UAAU;AAC7B,YAAM,SAAS,IAAI,KAAK,KAAK;AAC7B,UAAI,CAAC,OAAO,MAAM,OAAO,QAAQ,CAAC,EAAG,QAAO;AAAA,IAC9C;AACA,UAAM,WAAW,IAAI,KAAK,KAAY;AACtC,QAAI,CAAC,OAAO,MAAM,SAAS,QAAQ,CAAC,EAAG,QAAO;AAC9C,WAAO,oBAAI,KAAK;AAAA,EAClB;AACA,SAAO,OAAO,EAAE,YAAY;AAC9B;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,YAAa,CAAC,KAAK,SAAS,CAAC,KAAK,cAAe;AAClE,WAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrE;AACA,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,gBAAgB,UAAU,OAAO,YAAY,IAAI,aAAa,QAAQ,CAAC,CAAC;AACvF,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,EAAE,MAAM,UAAU,QAAQ,WAAW,MAAM,WAAW,QAAQ,IAAI,OAAO;AAC/E,QAAM,UAAU,eAAe,IAAI;AACnC,QAAM,UAAU,OAAO,KAAK;AAC5B,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,wBAAwB,EAAE;AAChC,MAAI,cAAkC;AACtC,MAAI;AACF,kBAAc,QAAQ,aAAa;AAAA,EACrC,QAAQ;AACN,kBAAc;AAAA,EAChB;AACA,QAAM,KAAK,GAAG,mBAAmB,YAAY,GAAG;AAChD,QAAM,aAAsC,EAAE,UAAU,KAAK,SAAS;AACtE,MAAI,KAAK,OAAO;AACd,eAAW,iBAAiB,KAAK;AAAA,EACnC;AACA,KAAG,MAAM,UAAU;AACnB,MAAI,UAAU,OAAO,KAAK,EAAE,SAAS,GAAG;AACtC,OAAG,SAAS,EAAE,UAAU,EAAE,QAAQ,eAAe,OAAO,KAAK,CAAC,EAAE,EAAE,CAAC;AAAA,EACrE;AACA,MAAI,aAAa,UAAU,KAAK,EAAE,SAAS,GAAG;AAC5C,OAAG,SAAS,EAAE,eAAe,UAAU,KAAK,EAAE,CAAC;AAAA,EACjD;AACA,MAAI,QAAQ,SAAS,GAAG;AACtB,OAAG,SAAS,iEAAiE,CAAC,KAAK,UAAU,OAAO,CAAC,CAAC;AAAA,EACxG;AACA,QAAM,UAAU,GAAG,MAAM;AACzB,QAAM,WAAmC;AAAA,IACvC,UAAU;AAAA,IACV,UAAU;AAAA,IACV,WAAW;AAAA,EACb;AACA,QAAM,cAAc,SAAS,aAAa,WAAW,KAAK;AAC1D,KAAG,QAAQ,EAAE,CAAC,WAAW,GAAG,YAAY,QAAQ,QAAQ,OAAO,CAAC;AAChE,KAAG,MAAM,QAAQ,EAAE,OAAO,MAAM;AAEhC,QAAM,oBAAoB,GAAG;AAAA,IAC3B;AAAA,IACA,CAAC;AAAA,IACD,EAAE,SAAS,EAAE,OAAO,MAAM,GAAG,QAAQ,CAAC,QAAQ,SAAS,aAAa,EAAS;AAAA,EAC/E;AACA,QAAM,CAAC,SAAS,OAAO,UAAU,IAAI,MAAM,QAAQ,IAAI,CAAC,GAAG,cAAc,GAAG,QAAQ,SAAS,QAAQ,IAAI,GAAG,iBAAiB,CAAC;AAC9H,QAAM,uBAAuB,WAAW,OAA+B,CAAC,KAAK,UAAU;AACrF,QAAI,MAAM,KAAM,KAAI,MAAM,IAAI,IAAI,MAAM,SAAS,MAAM;AACvD,WAAO;AAAA,EACT,GAAG,CAAC,CAAC;AACL,QAAM,QAAQ,QAAQ,IAAI,CAAC,WAAW;AACpC,UAAMA,YAAW,uBAAuB,OAAO,eAAe;AAC9D,UAAM,WAAW,OAAO,YAAY;AACpC,UAAM,UAAU,OAAO,OAAO,aAAa,YAAY,OAAO,SAAS,YAAY,EAAE,WAAW,QAAQ;AACxG,UAAM,eAAe,UACjB,wBAAwB,OAAO,IAAI;AAAA,MACjC,OAAO;AAAA,MACP,QAAQ;AAAA,MACR,MAAM,0BAA0B,QAAQ;AAAA,IAC1C,CAAC,IACD;AACJ,WAAO;AAAA,MACL,IAAI,OAAO;AAAA,MACX;AAAA,MACA,UAAU,OAAO;AAAA,MACjB,UAAU,OAAO;AAAA,MACjB,eAAe,OAAO;AAAA,MACtB,gBAAgB,qBAAqB,OAAO,aAAa,KAAK;AAAA,MAC9D,KAAK,OAAO;AAAA,MACZ,WAAW,gBAAgB,OAAO,SAAS;AAAA,MAC3C,MAAMA,UAAS,QAAQ,CAAC;AAAA,MACxB,aAAaA,UAAS,eAAe,CAAC;AAAA,MACtC;AAAA,MACA,SAAS,OAAO,WAAW,OAAO,QAAQ,KAAK,IAAI,OAAO,UAAU;AAAA,IACtE;AAAA,EACF,CAAC;AAED,QAAM,iBAAiB,MAAM,QAAQ,CAAC,SAAS,KAAK,eAAe,CAAC,CAAC;AACrE,QAAM,cAAc,MAAM,6BAA6B,gBAAgB;AAAA,IACrE;AAAA,IACA,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC;AACD,QAAM,gBAAgB,YAAY,OAC9B,MAAM,IAAI,CAAC,UAAU;AAAA,IACnB,GAAG;AAAA,IACH,aAAa,2BAA2B,KAAK,eAAe,CAAC,GAAG,WAAW;AAAA,EAC7E,EAAE,IACF;AAEJ,QAAM,aAAa,KAAK,IAAI,GAAG,KAAK,KAAK,OAAO,KAAK,IAAI,QAAQ,CAAC;AAClE,QAAM,KAAK,GAAG,UAAe;AAC7B,MAAI,WAAW,GACZ,WAAW,aAAa,EACxB,OAAO,yFAAiG,GAAG,KAAK,CAAC,EACjH,MAAM,aAAa,KAAK,KAAK,QAAQ;AACxC,MAAI,KAAK,OAAO;AACd,eAAW,SAAS,MAAM,mBAAmB,KAAK,KAAK,KAAK;AAAA,EAC9D;AACA,QAAM,UAAU,MAAM,SAAS,QAAQ,OAAO,KAAK,EAAE,QAAQ;AAC7D,QAAM,gBAAgB,QACnB,IAAI,CAAC,QAAS,OAAO,IAAI,QAAQ,WAAW,IAAI,IAAI,KAAK,IAAI,EAAG,EAChE,OAAO,CAAC,QAAQ,IAAI,SAAS,CAAC;AAEjC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO;AAAA,IACP;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA;AAAA,IACA,YAAY,WAAW,IAAI,CAAC,WAAW;AAAA,MACrC,MAAM,MAAM;AAAA,MACZ,OAAO,MAAM;AAAA,MACb,aAAa,MAAM,eAAe;AAAA,MAClC,UAAU,MAAM,YAAY;AAAA,IAC9B,EAAE;AAAA,EACJ,CAAC;AACH;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iDAAiD,QAAQ,6BAA6B;AAAA,MACpH;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,sBAAsB;AAAA,QACtF,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,sBAAsB;AAAA,MAC5E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/attachments/components/AttachmentContentPreview.js CHANGED Viewed

@@ -1,7 +1,6 @@
 import { jsx, jsxs } from "react/jsx-runtime";
 import * as React from "react";
-import ReactMarkdown from "react-markdown";
-import remarkGfm from "remark-gfm";
+import { MarkdownContent } from "@open-mercato/ui/backend/markdown";
 import { Button } from "@open-mercato/ui/primitives/button";
 function AttachmentContentPreview({
   content,
@@ -15,7 +14,6 @@ function AttachmentContentPreview({
   const [expanded, setExpanded] = React.useState(false);
   const [tab, setTab] = React.useState("source");
   const text = (content ?? "").trim();
-  const markdownPlugins = React.useMemo(() => [remarkGfm], []);
   const sourceTabId = "attachment-content-preview-tab-source";
   const previewTabId = "attachment-content-preview-tab-preview";
   const sourcePanelId = "attachment-content-preview-panel-source";
@@ -71,8 +69,14 @@ function AttachmentContentPreview({
         id: previewPanelId,
         "aria-labelledby": previewTabId,
         "data-testid": "markdown-preview",
-        className: "text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs",
-        children: /* @__PURE__ */ jsx(ReactMarkdown, { remarkPlugins: markdownPlugins, children: text })
+        children: /* @__PURE__ */ jsx(
+          MarkdownContent,
+          {
+            body: text,
+            format: "markdown",
+            className: "text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs"
+          }
+        )
       }
     ),
     tab === "source" && text.length > maxLength ? /* @__PURE__ */ jsx(

package/dist/modules/attachments/components/AttachmentContentPreview.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/attachments/components/AttachmentContentPreview.tsx"],
-  "sourcesContent": ["import * as React from 'react'\nimport ReactMarkdown from 'react-markdown'\nimport remarkGfm from 'remark-gfm'\nimport type { PluggableList } from 'unified'\nimport { Button } from '@open-mercato/ui/primitives/button'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n  const markdownPlugins = React.useMemo<PluggableList>(() => [remarkGfm], [])\n\n  // ARIA IDs for accessibility\n  const sourceTabId = 'attachment-content-preview-tab-source'\n  const previewTabId = 'attachment-content-preview-tab-preview'\n  const sourcePanelId = 'attachment-content-preview-panel-source'\n  const previewPanelId = 'attachment-content-preview-panel-preview'\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <div className=\"border-b border-border\">\n        <nav className=\"flex items-center gap-4 text-xs\" role=\"tablist\" aria-label=\"Content preview mode\">\n          <button\n            type=\"button\"\n            id={sourceTabId}\n            role=\"tab\"\n            aria-selected={tab === 'source'}\n            aria-controls={sourcePanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'source'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('source')}\n          >\n            {sourceLabel}\n          </button>\n          <button\n            type=\"button\"\n            id={previewTabId}\n            role=\"tab\"\n            aria-selected={tab === 'preview'}\n            aria-controls={previewPanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'preview'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('preview')}\n          >\n            {previewLabel}\n          </button>\n        </nav>\n      </div>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          id={sourcePanelId}\n          aria-labelledby={sourceTabId}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          id={previewPanelId}\n          aria-labelledby={previewTabId}\n          data-testid=\"markdown-preview\"\n          className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n        >\n          <ReactMarkdown remarkPlugins={markdownPlugins}>{text}</ReactMarkdown>\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
-  "mappings": "AAqCW,cAUH,YAVG;AArCX,YAAY,WAAW;AACvB,OAAO,mBAAmB;AAC1B,OAAO,eAAe;AAEtB,SAAS,cAAc;AAYhB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAClC,QAAM,kBAAkB,MAAM,QAAuB,MAAM,CAAC,SAAS,GAAG,CAAC,CAAC;AAG1E,QAAM,cAAc;AACpB,QAAM,eAAe;AACrB,QAAM,gBAAgB;AACtB,QAAM,iBAAiB;AAEvB,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,SAAI,WAAU,0BACb,+BAAC,SAAI,WAAU,mCAAkC,MAAK,WAAU,cAAW,wBACzE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,WACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,QAAQ;AAAA,UAE7B;AAAA;AAAA,MACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,YACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,SAAS;AAAA,UAE9B;AAAA;AAAA,MACH;AAAA,OACF,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QACZ,WAAU;AAAA,QAEV,8BAAC,iBAAc,eAAe,iBAAkB,gBAAK;AAAA;AAAA,IACvD;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
+  "sourcesContent": ["import * as React from 'react'\nimport { MarkdownContent } from '@open-mercato/ui/backend/markdown'\nimport { Button } from '@open-mercato/ui/primitives/button'\n\ntype Props = {\n  content?: string | null\n  maxLength?: number\n  emptyLabel?: string\n  showMoreLabel?: string\n  showLessLabel?: string\n  sourceLabel?: string\n  previewLabel?: string\n}\n\nexport function AttachmentContentPreview({\n  content,\n  maxLength = 480,\n  emptyLabel = 'No text extracted',\n  showMoreLabel = 'Show more',\n  showLessLabel = 'Show less',\n  sourceLabel = 'Source',\n  previewLabel = 'Preview',\n}: Props) {\n  const [expanded, setExpanded] = React.useState(false)\n  const [tab, setTab] = React.useState<'source' | 'preview'>('source')\n  const text = (content ?? '').trim()\n\n  // ARIA IDs for accessibility\n  const sourceTabId = 'attachment-content-preview-tab-source'\n  const previewTabId = 'attachment-content-preview-tab-preview'\n  const sourcePanelId = 'attachment-content-preview-panel-source'\n  const previewPanelId = 'attachment-content-preview-panel-preview'\n\n  if (!text) {\n    return <div className=\"text-xs text-muted-foreground italic\">{emptyLabel}</div>\n  }\n\n  const shouldTruncate = !expanded && text.length > maxLength\n  const display = tab === 'source' && shouldTruncate ? `${text.slice(0, maxLength)}\u2026` : text\n\n  return (\n    <div className=\"space-y-2\">\n      {/* Tab Navigation */}\n      <div className=\"border-b border-border\">\n        <nav className=\"flex items-center gap-4 text-xs\" role=\"tablist\" aria-label=\"Content preview mode\">\n          <button\n            type=\"button\"\n            id={sourceTabId}\n            role=\"tab\"\n            aria-selected={tab === 'source'}\n            aria-controls={sourcePanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'source'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('source')}\n          >\n            {sourceLabel}\n          </button>\n          <button\n            type=\"button\"\n            id={previewTabId}\n            role=\"tab\"\n            aria-selected={tab === 'preview'}\n            aria-controls={previewPanelId}\n            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${\n              tab === 'preview'\n                ? 'border-accent-indigo text-foreground'\n                : 'border-transparent text-muted-foreground hover:text-foreground'\n            }`}\n            onClick={() => setTab('preview')}\n          >\n            {previewLabel}\n          </button>\n        </nav>\n      </div>\n\n      {/* Tab Panels */}\n      {tab === 'source' ? (\n        <div\n          role=\"tabpanel\"\n          id={sourcePanelId}\n          aria-labelledby={sourceTabId}\n          data-testid=\"attachment-content-preview\"\n          className=\"whitespace-pre-wrap text-sm text-muted-foreground\"\n        >\n          {display}\n        </div>\n      ) : (\n        <div\n          role=\"tabpanel\"\n          id={previewPanelId}\n          aria-labelledby={previewTabId}\n          data-testid=\"markdown-preview\"\n        >\n          <MarkdownContent\n            body={text}\n            format=\"markdown\"\n            className=\"text-sm text-muted-foreground [&>*]:mb-2 [&>*:last-child]:mb-0 [&_ul]:ml-4 [&_ul]:list-disc [&_ol]:ml-4 [&_ol]:list-decimal [&_code]:rounded [&_code]:bg-muted [&_code]:px-1 [&_code]:py-0.5 [&_pre]:rounded-md [&_pre]:bg-muted [&_pre]:p-3 [&_pre]:text-xs\"\n          />\n        </div>\n      )}\n\n      {/* Show More/Less Button (only on source tab) */}\n      {tab === 'source' && text.length > maxLength ? (\n        <Button\n          type=\"button\"\n          variant=\"ghost\"\n          size=\"sm\"\n          className=\"h-auto px-0 py-1 text-xs\"\n          onClick={() => setExpanded((prev) => !prev)}\n        >\n          {expanded ? showLessLabel : showMoreLabel}\n        </Button>\n      ) : null}\n    </div>\n  )\n}\n"],
+  "mappings": "AAkCW,cAUH,YAVG;AAlCX,YAAY,WAAW;AACvB,SAAS,uBAAuB;AAChC,SAAS,cAAc;AAYhB,SAAS,yBAAyB;AAAA,EACvC;AAAA,EACA,YAAY;AAAA,EACZ,aAAa;AAAA,EACb,gBAAgB;AAAA,EAChB,gBAAgB;AAAA,EAChB,cAAc;AAAA,EACd,eAAe;AACjB,GAAU;AACR,QAAM,CAAC,UAAU,WAAW,IAAI,MAAM,SAAS,KAAK;AACpD,QAAM,CAAC,KAAK,MAAM,IAAI,MAAM,SAA+B,QAAQ;AACnE,QAAM,QAAQ,WAAW,IAAI,KAAK;AAGlC,QAAM,cAAc;AACpB,QAAM,eAAe;AACrB,QAAM,gBAAgB;AACtB,QAAM,iBAAiB;AAEvB,MAAI,CAAC,MAAM;AACT,WAAO,oBAAC,SAAI,WAAU,wCAAwC,sBAAW;AAAA,EAC3E;AAEA,QAAM,iBAAiB,CAAC,YAAY,KAAK,SAAS;AAClD,QAAM,UAAU,QAAQ,YAAY,iBAAiB,GAAG,KAAK,MAAM,GAAG,SAAS,CAAC,WAAM;AAEtF,SACE,qBAAC,SAAI,WAAU,aAEb;AAAA,wBAAC,SAAI,WAAU,0BACb,+BAAC,SAAI,WAAU,mCAAkC,MAAK,WAAU,cAAW,wBACzE;AAAA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,WACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,QAAQ;AAAA,UAE7B;AAAA;AAAA,MACH;AAAA,MACA;AAAA,QAAC;AAAA;AAAA,UACC,MAAK;AAAA,UACL,IAAI;AAAA,UACJ,MAAK;AAAA,UACL,iBAAe,QAAQ;AAAA,UACvB,iBAAe;AAAA,UACf,WAAW,6DACT,QAAQ,YACJ,yCACA,gEACN;AAAA,UACA,SAAS,MAAM,OAAO,SAAS;AAAA,UAE9B;AAAA;AAAA,MACH;AAAA,OACF,GACF;AAAA,IAGC,QAAQ,WACP;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QACZ,WAAU;AAAA,QAET;AAAA;AAAA,IACH,IAEA;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,IAAI;AAAA,QACJ,mBAAiB;AAAA,QACjB,eAAY;AAAA,QAEZ;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,QAAO;AAAA,YACP,WAAU;AAAA;AAAA,QACZ;AAAA;AAAA,IACF;AAAA,IAID,QAAQ,YAAY,KAAK,SAAS,YACjC;AAAA,MAAC;AAAA;AAAA,QACC,MAAK;AAAA,QACL,SAAQ;AAAA,QACR,MAAK;AAAA,QACL,WAAU;AAAA,QACV,SAAS,MAAM,YAAY,CAAC,SAAS,CAAC,IAAI;AAAA,QAEzC,qBAAW,gBAAgB;AAAA;AAAA,IAC9B,IACE;AAAA,KACN;AAEJ;",
   "names": []
 }

package/dist/modules/audit_logs/api/audit-logs/actions/redo/route.js CHANGED Viewed

@@ -46,10 +46,11 @@ async function POST(req) {
   if (log.actorUserId && log.actorUserId !== auth.sub && !canRedoTenant) {
     return NextResponse.json({ error: "Redo target not available" }, { status: 400 });
   }
-  if (log.tenantId && auth.tenantId && log.tenantId !== auth.tenantId) {
+  if (log.tenantId && log.tenantId !== (auth.tenantId ?? null)) {
     return NextResponse.json({ error: "Redo target not available" }, { status: 400 });
   }
-  if (log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId) {
+  const orgScopeMismatch = canRedoTenant ? Boolean(log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId) : Boolean(log.organizationId && log.organizationId !== scopedOrgId);
+  if (orgScopeMismatch) {
     return NextResponse.json({ error: "Redo target not available" }, { status: 400 });
   }
   const lookupActorId = canRedoTenant ? log.actorUserId ?? auth.sub : auth.sub;

package/dist/modules/audit_logs/api/audit-logs/actions/redo/route.js.map CHANGED Viewed

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/audit_logs/api/audit-logs/actions/redo/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { AwilixContainer } from 'awilix'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.redo_self'] },\n}\n\ntype RedoRequestBody = {\n  logId?: string\n}\n\nconst redoRequestSchema = z.object({\n  logId: z.string().min(1).describe('Identifier of the previously undone action log'),\n})\n\nconst redoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().nullable().describe('Identifier of the new redo log entry, if available'),\n  undoToken: z.string().nullable().describe('New undo token associated with the redone action'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as RedoRequestBody | null\n  const logId = typeof body?.logId === 'string' ? body.logId.trim() : ''\n  if (!logId) return NextResponse.json({ error: 'Invalid log id' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canRedoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.redo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const scopedOrgId = canRedoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  const log = await logs.findById(logId)\n\n  if (!log || log.executionState !== 'undone') {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.actorUserId && log.actorUserId !== auth.sub && !canRedoTenant) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.tenantId && auth.tenantId && log.tenantId !== auth.tenantId) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canRedoTenant ? (log.actorUserId ?? auth.sub) : auth.sub\n  const latestUndoneOrganizationId = log.organizationId ?? null\n  const latestUndone = await logs.latestUndoneForActor(lookupActorId, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: latestUndoneOrganizationId,\n  })\n  if (!latestUndone || latestUndone.id !== log.id) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    const contextRecord = log.contextJson && typeof log.contextJson === 'object' ? (log.contextJson as Record<string, unknown>) : null\n    const cacheAliasesRaw = Array.isArray(contextRecord?.cacheAliases as unknown[])\n      ? (contextRecord!.cacheAliases as unknown[])\n      : []\n    const cacheAliases = cacheAliasesRaw\n      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)\n      .map((value) => value.trim())\n    const metadataContext: Record<string, unknown> = {\n      historyAction: 'redo',\n      sourceLogId: log.id,\n      sourceCommandId: log.commandId,\n    }\n    if (cacheAliases.length) metadataContext.cacheAliases = cacheAliases\n    const metadata: CommandLogMetadata = {\n      tenantId: log.tenantId,\n      organizationId: log.organizationId,\n      actorUserId: auth.sub,\n      actionLabel: log.actionLabel,\n      resourceKind: log.resourceKind,\n      resourceId: log.resourceId,\n      context: metadataContext,\n    }\n    const resolvedInput = resolveRedoInput(log.commandPayload, log)\n    if (!resolvedInput) {\n      return NextResponse.json({ error: 'Redo data unavailable for this action' }, { status: 400 })\n    }\n    const commandInput = resolvedInput\n    const { logEntry } = await commandBus.execute(log.commandId, {\n      input: commandInput,\n      ctx,\n      metadata,\n      redoLogEntry: log,\n    })\n    await logs.markRedone(log.id)\n    const actionLog = asActionLog(logEntry)\n    const response = NextResponse.json({\n      ok: true,\n      logId: actionLog?.id ?? null,\n      undoToken: actionLog?.undoToken ?? null,\n    })\n    if (actionLog?.undoToken && actionLog.id) {\n      const createdAt = actionLog.createdAt instanceof Date\n        ? actionLog.createdAt.toISOString()\n        : (typeof actionLog.createdAt === 'string' ? actionLog.createdAt : new Date().toISOString())\n      response.headers.set('x-om-operation', serializeOperationMetadata({\n        id: actionLog.id,\n        undoToken: actionLog.undoToken,\n        commandId: actionLog.commandId ?? log.commandId,\n        actionLabel: actionLog.actionLabel ?? log.actionLabel ?? null,\n        resourceKind: typeof actionLog.resourceKind === 'string' ? actionLog.resourceKind : log.resourceKind ?? null,\n        resourceId: typeof actionLog.resourceId === 'string' ? actionLog.resourceId : log.resourceId ?? null,\n        executedAt: createdAt,\n      }))\n    }\n    return response\n  } catch (err) {\n    console.error('Redo failed', err)\n    return NextResponse.json({ error: 'Redo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nfunction asActionLog(entry: unknown): ActionLog | null {\n  if (!entry || typeof entry !== 'object') return null\n  if (typeof (entry as { id?: unknown }).id !== 'string') return null\n  return entry as ActionLog\n}\n\nfunction resolveRedoInput(payload: unknown, log: ActionLog): unknown | null {\n  if (payload && typeof payload === 'object' && !Array.isArray(payload) && '__redoInput' in payload) {\n    const envelope = payload as { __redoInput?: unknown }\n    return envelope.__redoInput ?? {}\n  }\n  const updateFallback = deriveUpdateInput(log)\n  if (updateFallback) return updateFallback\n  return null\n}\n\nfunction deriveUpdateInput(log: ActionLog): Record<string, unknown> | null {\n  if (!log.commandId.endsWith('.update')) return null\n  if (!log.resourceId) return null\n  const changes = log.changesJson\n  if (!changes || typeof changes !== 'object' || Array.isArray(changes)) return { id: log.resourceId }\n  const payload: Record<string, unknown> = { id: log.resourceId }\n  for (const [key, value] of Object.entries(changes)) {\n    if (value && typeof value === 'object' && !Array.isArray(value) && 'to' in value) {\n      payload[key] = (value as Record<string, unknown>).to\n    } else {\n      payload[key] = value\n    }\n  }\n  return payload\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Redo a previously undone action',\n  description: 'Replays the command associated with a recently undone action, reapplying the change and issuing a fresh undo token.',\n  methods: {\n    POST: {\n      summary: 'Redo by action log id',\n      description:\n        'Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: redoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Redo executed successfully', schema: redoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Log not eligible for redo', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Redo blocked by scope checks', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAK/E,SAAS,kCAAkC;AAG3C,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,gDAAgD;AACpF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EAC1F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAC9F,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACpE,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,QAAM,MAAM,MAAM,KAAK,SAAS,KAAK;AAErC,MAAI,CAAC,OAAO,IAAI,mBAAmB,UAAU;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,eAAe,IAAI,gBAAgB,KAAK,OAAO,CAAC,eAAe;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,YAAY,KAAK,YAAY,IAAI,aAAa,KAAK,UAAU;AACnE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,kBAAkB,eAAe,IAAI,mBAAmB,aAAa;AAC3E,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,gBAAgB,gBAAiB,IAAI,eAAe,KAAK,MAAO,KAAK;AAC3E,QAAM,6BAA6B,IAAI,kBAAkB;AACzD,QAAM,eAAe,MAAM,KAAK,qBAAqB,eAAe;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,gBAAgB,aAAa,OAAO,IAAI,IAAI;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,gBAAgB,IAAI,eAAe,OAAO,IAAI,gBAAgB,WAAY,IAAI,cAA0C;AAC9H,UAAM,kBAAkB,MAAM,QAAQ,eAAe,YAAyB,IACzE,cAAe,eAChB,CAAC;AACL,UAAM,eAAe,gBAClB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC9B,UAAM,kBAA2C;AAAA,MAC/C,eAAe;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,iBAAiB,IAAI;AAAA,IACvB;AACA,QAAI,aAAa,OAAQ,iBAAgB,eAAe;AACxD,UAAMA,YAA+B;AAAA,MACnC,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,aAAa,KAAK;AAAA,MAClB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AACA,UAAM,gBAAgB,iBAAiB,IAAI,gBAAgB,GAAG;AAC9D,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,UAAM,eAAe;AACrB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,IAAI,WAAW;AAAA,MAC3D,OAAO;AAAA,MACP;AAAA,MACA,UAAAA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,WAAW,IAAI,EAAE;AAC5B,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO,WAAW,MAAM;AAAA,MACxB,WAAW,WAAW,aAAa;AAAA,IACrC,CAAC;AACD,QAAI,WAAW,aAAa,UAAU,IAAI;AACxC,YAAM,YAAY,UAAU,qBAAqB,OAC7C,UAAU,UAAU,YAAY,IAC/B,OAAO,UAAU,cAAc,WAAW,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY;AAC5F,eAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,QAChE,IAAI,UAAU;AAAA,QACd,WAAW,UAAU;AAAA,QACrB,WAAW,UAAU,aAAa,IAAI;AAAA,QACtC,aAAa,UAAU,eAAe,IAAI,eAAe;AAAA,QACzD,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe,IAAI,gBAAgB;AAAA,QACxG,YAAY,OAAO,UAAU,eAAe,WAAW,UAAU,aAAa,IAAI,cAAc;AAAA,QAChG,YAAY;AAAA,MACd,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,GAAG;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAkC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAQ,MAA2B,OAAO,SAAU,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkB,KAAgC;AAC1E,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,iBAAiB,SAAS;AACjG,UAAM,WAAW;AACjB,WAAO,SAAS,eAAe,CAAC;AAAA,EAClC;AACA,QAAM,iBAAiB,kBAAkB,GAAG;AAC5C,MAAI,eAAgB,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAgD;AACzE,MAAI,CAAC,IAAI,UAAU,SAAS,SAAS,EAAG,QAAO;AAC/C,MAAI,CAAC,IAAI,WAAY,QAAO;AAC5B,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO,EAAE,IAAI,IAAI,WAAW;AACnG,QAAM,UAAmC,EAAE,IAAI,IAAI,WAAW;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,QAAQ,OAAO;AAChF,cAAQ,GAAG,IAAK,MAAkC;AAAA,IACpD,OAAO;AACL,cAAQ,GAAG,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mBAAmB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest, type AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'\nimport { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'\nimport type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'\nimport { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'\nimport type { AwilixContainer } from 'awilix'\nimport type { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\n\nexport const metadata = {\n  POST: { requireAuth: true, requireFeatures: ['audit_logs.redo_self'] },\n}\n\ntype RedoRequestBody = {\n  logId?: string\n}\n\nconst redoRequestSchema = z.object({\n  logId: z.string().min(1).describe('Identifier of the previously undone action log'),\n})\n\nconst redoResponseSchema = z.object({\n  ok: z.literal(true),\n  logId: z.string().nullable().describe('Identifier of the new redo log entry, if available'),\n  undoToken: z.string().nullable().describe('New undo token associated with the redone action'),\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const body = (await req.json().catch(() => null)) as RedoRequestBody | null\n  const logId = typeof body?.logId === 'string' ? body.logId.trim() : ''\n  if (!logId) return NextResponse.json({ error: 'Invalid log id' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const commandBus = (container.resolve('commandBus') as CommandBus)\n  const logs = (container.resolve('actionLogService') as ActionLogService)\n  let rbac: RbacService | null = null\n  try {\n    rbac = (container.resolve('rbacService') as RbacService)\n  } catch {\n    rbac = null\n  }\n\n  const { organizationId } = await resolveFeatureCheckContext({ container, auth, request: req })\n\n  const canRedoTenant = rbac\n    ? await rbac.userHasAllFeatures(auth.sub, ['audit_logs.redo_tenant'], {\n        tenantId: auth.tenantId ?? null,\n        organizationId,\n      })\n    : false\n\n  const scopedOrgId = canRedoTenant ? organizationId ?? null : organizationId ?? auth.orgId ?? null\n  const log = await logs.findById(logId)\n\n  if (!log || log.executionState !== 'undone') {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  if (log.actorUserId && log.actorUserId !== auth.sub && !canRedoTenant) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Fail closed on tenant scope: `audit_logs.redo_tenant` only widens scope WITHIN a\n  // tenant, never across tenants, so a tenant-scoped target always requires a caller\n  // bound to that same tenant. A caller whose tenantId is null (tenant-less global\n  // account or unscoped API key) must never redo a tenant-scoped row. Mirrors the\n  // hardened undo route (issue #2685, ported in #2931).\n  if (log.tenantId && log.tenantId !== (auth.tenantId ?? null)) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n  // Tenant-level redoers may redo across organizations within the tenant, so an\n  // unresolved (null) caller org is allowed and only an explicit mismatch is rejected.\n  // Every other caller must resolve to the target's own organization \u2014 a null caller\n  // org must not bypass an org-scoped target (issue #2685, ported in #2931).\n  const orgScopeMismatch = canRedoTenant\n    ? Boolean(log.organizationId && scopedOrgId && log.organizationId !== scopedOrgId)\n    : Boolean(log.organizationId && log.organizationId !== scopedOrgId)\n  if (orgScopeMismatch) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  const lookupActorId = canRedoTenant ? (log.actorUserId ?? auth.sub) : auth.sub\n  const latestUndoneOrganizationId = log.organizationId ?? null\n  const latestUndone = await logs.latestUndoneForActor(lookupActorId, {\n    tenantId: auth.tenantId ?? null,\n    organizationId: latestUndoneOrganizationId,\n  })\n  if (!latestUndone || latestUndone.id !== log.id) {\n    return NextResponse.json({ error: 'Redo target not available' }, { status: 400 })\n  }\n\n  try {\n    const ctx = await createRuntimeContext(container, auth, req)\n    const contextRecord = log.contextJson && typeof log.contextJson === 'object' ? (log.contextJson as Record<string, unknown>) : null\n    const cacheAliasesRaw = Array.isArray(contextRecord?.cacheAliases as unknown[])\n      ? (contextRecord!.cacheAliases as unknown[])\n      : []\n    const cacheAliases = cacheAliasesRaw\n      .filter((value): value is string => typeof value === 'string' && value.trim().length > 0)\n      .map((value) => value.trim())\n    const metadataContext: Record<string, unknown> = {\n      historyAction: 'redo',\n      sourceLogId: log.id,\n      sourceCommandId: log.commandId,\n    }\n    if (cacheAliases.length) metadataContext.cacheAliases = cacheAliases\n    const metadata: CommandLogMetadata = {\n      tenantId: log.tenantId,\n      organizationId: log.organizationId,\n      actorUserId: auth.sub,\n      actionLabel: log.actionLabel,\n      resourceKind: log.resourceKind,\n      resourceId: log.resourceId,\n      context: metadataContext,\n    }\n    const resolvedInput = resolveRedoInput(log.commandPayload, log)\n    if (!resolvedInput) {\n      return NextResponse.json({ error: 'Redo data unavailable for this action' }, { status: 400 })\n    }\n    const commandInput = resolvedInput\n    const { logEntry } = await commandBus.execute(log.commandId, {\n      input: commandInput,\n      ctx,\n      metadata,\n      redoLogEntry: log,\n    })\n    await logs.markRedone(log.id)\n    const actionLog = asActionLog(logEntry)\n    const response = NextResponse.json({\n      ok: true,\n      logId: actionLog?.id ?? null,\n      undoToken: actionLog?.undoToken ?? null,\n    })\n    if (actionLog?.undoToken && actionLog.id) {\n      const createdAt = actionLog.createdAt instanceof Date\n        ? actionLog.createdAt.toISOString()\n        : (typeof actionLog.createdAt === 'string' ? actionLog.createdAt : new Date().toISOString())\n      response.headers.set('x-om-operation', serializeOperationMetadata({\n        id: actionLog.id,\n        undoToken: actionLog.undoToken,\n        commandId: actionLog.commandId ?? log.commandId,\n        actionLabel: actionLog.actionLabel ?? log.actionLabel ?? null,\n        resourceKind: typeof actionLog.resourceKind === 'string' ? actionLog.resourceKind : log.resourceKind ?? null,\n        resourceId: typeof actionLog.resourceId === 'string' ? actionLog.resourceId : log.resourceId ?? null,\n        executedAt: createdAt,\n      }))\n    }\n    return response\n  } catch (err) {\n    console.error('Redo failed', err)\n    return NextResponse.json({ error: 'Redo failed' }, { status: 400 })\n  }\n}\n\nasync function createRuntimeContext(container: AwilixContainer, auth: AuthContext, request: Request): Promise<CommandRuntimeContext> {\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request })\n  return {\n    container,\n    auth,\n    organizationScope: scope,\n    selectedOrganizationId: scope.selectedId,\n    organizationIds: scope.filterIds,\n    request,\n  }\n}\n\nfunction asActionLog(entry: unknown): ActionLog | null {\n  if (!entry || typeof entry !== 'object') return null\n  if (typeof (entry as { id?: unknown }).id !== 'string') return null\n  return entry as ActionLog\n}\n\nfunction resolveRedoInput(payload: unknown, log: ActionLog): unknown | null {\n  if (payload && typeof payload === 'object' && !Array.isArray(payload) && '__redoInput' in payload) {\n    const envelope = payload as { __redoInput?: unknown }\n    return envelope.__redoInput ?? {}\n  }\n  const updateFallback = deriveUpdateInput(log)\n  if (updateFallback) return updateFallback\n  return null\n}\n\nfunction deriveUpdateInput(log: ActionLog): Record<string, unknown> | null {\n  if (!log.commandId.endsWith('.update')) return null\n  if (!log.resourceId) return null\n  const changes = log.changesJson\n  if (!changes || typeof changes !== 'object' || Array.isArray(changes)) return { id: log.resourceId }\n  const payload: Record<string, unknown> = { id: log.resourceId }\n  for (const [key, value] of Object.entries(changes)) {\n    if (value && typeof value === 'object' && !Array.isArray(value) && 'to' in value) {\n      payload[key] = (value as Record<string, unknown>).to\n    } else {\n      payload[key] = value\n    }\n  }\n  return payload\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Redo a previously undone action',\n  description: 'Replays the command associated with a recently undone action, reapplying the change and issuing a fresh undo token.',\n  methods: {\n    POST: {\n      summary: 'Redo by action log id',\n      description:\n        'Redoes the latest undone command owned by the caller. Requires the action to still be eligible for redo within tenant and organization scope.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: redoRequestSchema,\n      },\n      responses: [\n        { status: 200, description: 'Redo executed successfully', schema: redoResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Log not eligible for redo', schema: errorSchema },\n        { status: 401, description: 'Authentication required', schema: errorSchema },\n        { status: 403, description: 'Redo blocked by scope checks', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA4C;AACrD,SAAS,8BAA8B;AACvC,SAAS,4BAA4B,0CAA0C;AAK/E,SAAS,kCAAkC;AAG3C,SAAS,SAAS;AAGX,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACvE;AAMA,MAAM,oBAAoB,EAAE,OAAO;AAAA,EACjC,OAAO,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,gDAAgD;AACpF,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAAA,EAC1F,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,kDAAkD;AAC9F,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,OAAQ,MAAM,IAAI,KAAK,EAAE,MAAM,MAAM,IAAI;AAC/C,QAAM,QAAQ,OAAO,MAAM,UAAU,WAAW,KAAK,MAAM,KAAK,IAAI;AACpE,MAAI,CAAC,MAAO,QAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEjF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,aAAc,UAAU,QAAQ,YAAY;AAClD,QAAM,OAAQ,UAAU,QAAQ,kBAAkB;AAClD,MAAI,OAA2B;AAC/B,MAAI;AACF,WAAQ,UAAU,QAAQ,aAAa;AAAA,EACzC,QAAQ;AACN,WAAO;AAAA,EACT;AAEA,QAAM,EAAE,eAAe,IAAI,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AAE7F,QAAM,gBAAgB,OAClB,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B;AAAA,EACF,CAAC,IACD;AAEJ,QAAM,cAAc,gBAAgB,kBAAkB,OAAO,kBAAkB,KAAK,SAAS;AAC7F,QAAM,MAAM,MAAM,KAAK,SAAS,KAAK;AAErC,MAAI,CAAC,OAAO,IAAI,mBAAmB,UAAU;AAC3C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AACA,MAAI,IAAI,eAAe,IAAI,gBAAgB,KAAK,OAAO,CAAC,eAAe;AACrE,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAMA,MAAI,IAAI,YAAY,IAAI,cAAc,KAAK,YAAY,OAAO;AAC5D,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,QAAM,mBAAmB,gBACrB,QAAQ,IAAI,kBAAkB,eAAe,IAAI,mBAAmB,WAAW,IAC/E,QAAQ,IAAI,kBAAkB,IAAI,mBAAmB,WAAW;AACpE,MAAI,kBAAkB;AACpB,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,gBAAgB,gBAAiB,IAAI,eAAe,KAAK,MAAO,KAAK;AAC3E,QAAM,6BAA6B,IAAI,kBAAkB;AACzD,QAAM,eAAe,MAAM,KAAK,qBAAqB,eAAe;AAAA,IAClE,UAAU,KAAK,YAAY;AAAA,IAC3B,gBAAgB;AAAA,EAClB,CAAC;AACD,MAAI,CAAC,gBAAgB,aAAa,OAAO,IAAI,IAAI;AAC/C,WAAO,aAAa,KAAK,EAAE,OAAO,4BAA4B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI;AACF,UAAM,MAAM,MAAM,qBAAqB,WAAW,MAAM,GAAG;AAC3D,UAAM,gBAAgB,IAAI,eAAe,OAAO,IAAI,gBAAgB,WAAY,IAAI,cAA0C;AAC9H,UAAM,kBAAkB,MAAM,QAAQ,eAAe,YAAyB,IACzE,cAAe,eAChB,CAAC;AACL,UAAM,eAAe,gBAClB,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC;AAC9B,UAAM,kBAA2C;AAAA,MAC/C,eAAe;AAAA,MACf,aAAa,IAAI;AAAA,MACjB,iBAAiB,IAAI;AAAA,IACvB;AACA,QAAI,aAAa,OAAQ,iBAAgB,eAAe;AACxD,UAAMA,YAA+B;AAAA,MACnC,UAAU,IAAI;AAAA,MACd,gBAAgB,IAAI;AAAA,MACpB,aAAa,KAAK;AAAA,MAClB,aAAa,IAAI;AAAA,MACjB,cAAc,IAAI;AAAA,MAClB,YAAY,IAAI;AAAA,MAChB,SAAS;AAAA,IACX;AACA,UAAM,gBAAgB,iBAAiB,IAAI,gBAAgB,GAAG;AAC9D,QAAI,CAAC,eAAe;AAClB,aAAO,aAAa,KAAK,EAAE,OAAO,wCAAwC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9F;AACA,UAAM,eAAe;AACrB,UAAM,EAAE,SAAS,IAAI,MAAM,WAAW,QAAQ,IAAI,WAAW;AAAA,MAC3D,OAAO;AAAA,MACP;AAAA,MACA,UAAAA;AAAA,MACA,cAAc;AAAA,IAChB,CAAC;AACD,UAAM,KAAK,WAAW,IAAI,EAAE;AAC5B,UAAM,YAAY,YAAY,QAAQ;AACtC,UAAM,WAAW,aAAa,KAAK;AAAA,MACjC,IAAI;AAAA,MACJ,OAAO,WAAW,MAAM;AAAA,MACxB,WAAW,WAAW,aAAa;AAAA,IACrC,CAAC;AACD,QAAI,WAAW,aAAa,UAAU,IAAI;AACxC,YAAM,YAAY,UAAU,qBAAqB,OAC7C,UAAU,UAAU,YAAY,IAC/B,OAAO,UAAU,cAAc,WAAW,UAAU,aAAY,oBAAI,KAAK,GAAE,YAAY;AAC5F,eAAS,QAAQ,IAAI,kBAAkB,2BAA2B;AAAA,QAChE,IAAI,UAAU;AAAA,QACd,WAAW,UAAU;AAAA,QACrB,WAAW,UAAU,aAAa,IAAI;AAAA,QACtC,aAAa,UAAU,eAAe,IAAI,eAAe;AAAA,QACzD,cAAc,OAAO,UAAU,iBAAiB,WAAW,UAAU,eAAe,IAAI,gBAAgB;AAAA,QACxG,YAAY,OAAO,UAAU,eAAe,WAAW,UAAU,aAAa,IAAI,cAAc;AAAA,QAChG,YAAY;AAAA,MACd,CAAC,CAAC;AAAA,IACJ;AACA,WAAO;AAAA,EACT,SAAS,KAAK;AACZ,YAAQ,MAAM,eAAe,GAAG;AAChC,WAAO,aAAa,KAAK,EAAE,OAAO,cAAc,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpE;AACF;AAEA,eAAe,qBAAqB,WAA4B,MAAmB,SAAkD;AACnI,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,QAAQ,CAAC;AACnF,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,IACnB,wBAAwB,MAAM;AAAA,IAC9B,iBAAiB,MAAM;AAAA,IACvB;AAAA,EACF;AACF;AAEA,SAAS,YAAY,OAAkC;AACrD,MAAI,CAAC,SAAS,OAAO,UAAU,SAAU,QAAO;AAChD,MAAI,OAAQ,MAA2B,OAAO,SAAU,QAAO;AAC/D,SAAO;AACT;AAEA,SAAS,iBAAiB,SAAkB,KAAgC;AAC1E,MAAI,WAAW,OAAO,YAAY,YAAY,CAAC,MAAM,QAAQ,OAAO,KAAK,iBAAiB,SAAS;AACjG,UAAM,WAAW;AACjB,WAAO,SAAS,eAAe,CAAC;AAAA,EAClC;AACA,QAAM,iBAAiB,kBAAkB,GAAG;AAC5C,MAAI,eAAgB,QAAO;AAC3B,SAAO;AACT;AAEA,SAAS,kBAAkB,KAAgD;AACzE,MAAI,CAAC,IAAI,UAAU,SAAS,SAAS,EAAG,QAAO;AAC/C,MAAI,CAAC,IAAI,WAAY,QAAO;AAC5B,QAAM,UAAU,IAAI;AACpB,MAAI,CAAC,WAAW,OAAO,YAAY,YAAY,MAAM,QAAQ,OAAO,EAAG,QAAO,EAAE,IAAI,IAAI,WAAW;AACnG,QAAM,UAAmC,EAAE,IAAI,IAAI,WAAW;AAC9D,aAAW,CAAC,KAAK,KAAK,KAAK,OAAO,QAAQ,OAAO,GAAG;AAClD,QAAI,SAAS,OAAO,UAAU,YAAY,CAAC,MAAM,QAAQ,KAAK,KAAK,QAAQ,OAAO;AAChF,cAAQ,GAAG,IAAK,MAAkC;AAAA,IACpD,OAAO;AACL,cAAQ,GAAG,IAAI;AAAA,IACjB;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aACE;AAAA,MACF,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,8BAA8B,QAAQ,mBAAmB;AAAA,MACvF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6BAA6B,QAAQ,YAAY;AAAA,QAC7E,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,YAAY;AAAA,QAC3E,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,YAAY;AAAA,MAClF;AAAA,IACF;AAAA,EACF;AACF;",
   "names": ["metadata"]
 }

package/dist/modules/auth/commands/users.js CHANGED Viewed

@@ -144,15 +144,15 @@ const createUserCommand = {
       { tenantId: null, organizationId: parsed.organizationId }
     );
     if (!organization) throw new CrudHttpError(400, { error: "Organization not found" });
+    const tenantId = organization.tenant?.id ? String(organization.tenant.id) : null;
     const emailHash = computeEmailHash(parsed.email);
-    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }], deletedAt: null }, {}, { tenantId: null, organizationId: null });
+    const duplicate = await findOneWithDecryption(em, User, { $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }], deletedAt: null, tenantId }, {}, { tenantId: null, organizationId: null });
     if (duplicate) await throwDuplicateEmailError();
     let passwordHash = null;
     if (parsed.password) {
       const { hash } = await import("bcryptjs");
       passwordHash = await hash(parsed.password, 10);
     }
-    const tenantId = organization.tenant?.id ? String(organization.tenant.id) : null;
     const de = ctx.container.resolve("dataEngine");
     let user;
     try {
@@ -423,13 +423,27 @@ const updateUserCommand = {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput);
     const em = ctx.container.resolve("em");
     const rolesBefore = Array.isArray(parsed.roles) ? await loadUserRoleNames(em, parsed.id) : null;
+    let tenantId;
+    if (parsed.organizationId !== void 0) {
+      const organization = await findOneWithDecryption(
+        em,
+        Organization,
+        { id: parsed.organizationId },
+        { populate: ["tenant"] },
+        { tenantId: null, organizationId: parsed.organizationId ?? null }
+      );
+      if (!organization) throw new CrudHttpError(400, { error: "Organization not found" });
+      tenantId = organization.tenant?.id ? String(organization.tenant.id) : null;
+    }
     if (parsed.email !== void 0) {
+      const targetTenantId = tenantId !== void 0 ? tenantId : await resolveUserTenantId(em, parsed.id);
       const duplicate = await findOneWithDecryption(
         em,
         User,
         {
           $or: [{ email: parsed.email }, { emailHash: { $in: emailHashLookupValues(parsed.email) } }],
           deletedAt: null,
+          tenantId: targetTenantId,
           id: { $ne: parsed.id }
         },
         {},
@@ -446,18 +460,6 @@ const updateUserCommand = {
     if (parsed.email !== void 0) {
       emailHash = computeEmailHash(parsed.email);
     }
-    let tenantId;
-    if (parsed.organizationId !== void 0) {
-      const organization = await findOneWithDecryption(
-        em,
-        Organization,
-        { id: parsed.organizationId },
-        { populate: ["tenant"] },
-        { tenantId: null, organizationId: parsed.organizationId ?? null }
-      );
-      if (!organization) throw new CrudHttpError(400, { error: "Organization not found" });
-      tenantId = organization.tenant?.id ? String(organization.tenant.id) : null;
-    }
     const actorTenantScope = resolveActorTenantScope(ctx);
     const updateWhere = { id: parsed.id, deletedAt: null };
     if (actorTenantScope) updateWhere.tenantId = actorTenantScope;
@@ -908,6 +910,10 @@ function arrayEquals(left, right) {
   if (left.length !== right.length) return false;
   return left.every((value, idx) => value === right[idx]);
 }
+async function resolveUserTenantId(em, id) {
+  const existing = await findOneWithDecryption(em, User, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null });
+  return existing?.tenantId ? String(existing.tenantId) : null;
+}
 async function throwDuplicateEmailError() {
   const { translate } = await resolveTranslations();
   const message = translate("auth.users.errors.emailExists", "Email already in use");