@open-mercato/core 0.6.6-develop.5612.1.d382eb2f33 → 0.6.6-develop.5617.1.62538c48ca

package/src/modules/auth/commands/roles.ts

@@ -24,7 +24,7 @@ import {
 } from '@open-mercato/shared/lib/commands/customFieldSnapshots'
 import { extractUndoPayload } from '@open-mercato/shared/lib/commands/undo'
 import { resolveRedoSnapshot } from '@open-mercato/shared/lib/commands/redo'
-import { normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
+import { resolveIsSuperAdmin, normalizeTenantId } from '@open-mercato/core/modules/auth/lib/tenantAccess'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 
 type SerializedRole = {
@@ -84,6 +84,22 @@ function assertRoleNameAllowed(name: string | undefined | null) {
   }
 }
 
+type ResolvedActorScope = { isSuperAdmin: boolean; actorTenantId: string | null }
+
+async function resolveActorScope(ctx: { auth: { tenantId?: string | null; sub?: string | null; orgId?: string | null; isSuperAdmin?: boolean } | null; container: { resolve<T = unknown>(name: string): T } }): Promise<ResolvedActorScope> {
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  const actorTenantId = normalizeTenantId(ctx.auth?.tenantId ?? null) ?? null
+  return { isSuperAdmin, actorTenantId }
+}
+
+function buildScopedRoleFilter(roleId: string, scope: ResolvedActorScope): FilterQuery<Role> {
+  const filter: FilterQuery<Role> = { id: roleId, deletedAt: null }
+  if (!scope.isSuperAdmin) {
+    ;(filter as Record<string, unknown>).tenantId = scope.actorTenantId
+  }
+  return filter
+}
+
 const createSchema = z.object({
   name: z.string().min(2).max(100),
   tenantId: z.string().uuid().optional(),
@@ -128,7 +144,14 @@ const createRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     }
     const { parsed, custom } = parseWithCustomFields(createSchema, rawInput)
     assertRoleNameAllowed(parsed.name)
-    const resolvedTenantId = parsed.tenantId ?? ctx.auth?.tenantId ?? null
+    const scope = await resolveActorScope(ctx)
+    const requestedTenantId = parsed.tenantId ?? null
+    if (!scope.isSuperAdmin && requestedTenantId && requestedTenantId !== scope.actorTenantId) {
+      throw new CrudHttpError(403, { error: 'Not authorized to target this tenant.' })
+    }
+    const resolvedTenantId = scope.isSuperAdmin
+      ? (requestedTenantId ?? scope.actorTenantId)
+      : scope.actorTenantId
     if (!resolvedTenantId) {
       throw new CrudHttpError(400, { error: 'tenantId is required — global roles are not supported' })
     }
@@ -279,7 +302,8 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
   async prepare(rawInput, ctx) {
     const { parsed } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const existing = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!existing) throw new CrudHttpError(404, { error: 'Role not found' })
     assertRoleTenantInScope(resolveActorTenantScope(ctx), existing.tenantId)
     const acls = await loadRoleAclSnapshots(em, parsed.id)
@@ -293,7 +317,8 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
   async execute(rawInput, ctx) {
     const { parsed, custom } = parseWithCustomFields(updateSchema, rawInput)
     const em = (ctx.container.resolve('em') as EntityManager)
-    const current = await findOneWithDecryption(em, Role, { id: parsed.id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const current = await findOneWithDecryption(em, Role, buildScopedRoleFilter(parsed.id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!current) throw new CrudHttpError(404, { error: 'Role not found' })
     const actorTenantScope = resolveActorTenantScope(ctx)
     assertRoleTenantInScope(actorTenantScope, current.tenantId)
@@ -309,21 +334,22 @@ const updateRoleCommand: CommandHandler<Record<string, unknown>, Role> = {
     }
     const wantsTenantChange = parsed.tenantId !== undefined && parsed.tenantId !== current.tenantId
     if (wantsTenantChange) {
+      if (!scope.isSuperAdmin) {
+        throw new CrudHttpError(403, { error: 'Not authorized to target this tenant.' })
+      }
       const assignments = await em.count(UserRole, { role: current, deletedAt: null })
       if (assignments > 0) {
         throw new CrudHttpError(400, { error: 'Role cannot be moved to another tenant while users are assigned' })
       }
       await em.nativeDelete(RoleAcl, { role: parsed.id as unknown as Role })
     }
-    const updateWhere: Record<string, unknown> = { id: parsed.id, deletedAt: null }
-    if (actorTenantScope) updateWhere.tenantId = actorTenantScope
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const role = await de.updateOrmEntity({
       entity: Role,
-      where: updateWhere as FilterQuery<Role>,
+      where: buildScopedRoleFilter(parsed.id, scope),
       apply: (entity) => {
         if (parsed.name !== undefined) entity.name = parsed.name
-        if (parsed.tenantId !== undefined) entity.tenantId = parsed.tenantId
+        if (parsed.tenantId !== undefined && scope.isSuperAdmin) entity.tenantId = parsed.tenantId
       },
     })
     if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
@@ -446,7 +472,8 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async prepare(input, ctx) {
     const id = requireId(input, 'Role id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-    const existing = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const existing = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!existing) return {}
     const actorTenantScope = resolveActorTenantScope(ctx)
     if (actorTenantScope) {
@@ -464,7 +491,8 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
   async execute(input, ctx) {
     const id = requireId(input, 'Role id required')
     const em = (ctx.container.resolve('em') as EntityManager)
-    const role = await findOneWithDecryption(em, Role, { id, deletedAt: null }, {}, { tenantId: null, organizationId: null })
+    const scope = await resolveActorScope(ctx)
+    const role = await findOneWithDecryption(em, Role, buildScopedRoleFilter(id, scope), {}, { tenantId: scope.actorTenantId, organizationId: null })
     if (!role) throw new CrudHttpError(404, { error: 'Role not found' })
     assertRoleTenantInScope(resolveActorTenantScope(ctx), role.tenantId)
     const activeAssignments = await em.count(UserRole, { role, deletedAt: null })
@@ -475,7 +503,7 @@ const deleteRoleCommand: CommandHandler<{ body?: Record<string, unknown>; query?
     const de = (ctx.container.resolve('dataEngine') as DataEngine)
     const deleted = await de.deleteOrmEntity({
       entity: Role,
-      where: { id, deletedAt: null } as FilterQuery<Role>,
+      where: buildScopedRoleFilter(id, scope),
       soft: false,
     })
     if (!deleted) throw new CrudHttpError(404, { error: 'Role not found' })

package/src/modules/auth/lib/roleTenantGuard.ts

@@ -1,8 +1,13 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
-import { forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { Role } from '@open-mercato/core/modules/auth/data/entities'
 import { enforceTenantSelection, normalizeTenantId, resolveIsSuperAdmin } from './tenantAccess'
 
+function roleNotFound(): never {
+  throw new CrudHttpError(404, { error: 'Role not found' })
+}
+
 type RoleTenantAccessCtx = {
   auth: {
     tenantId?: string | null
@@ -17,40 +22,74 @@ type RoleTenantAccessCtx = {
 type RoleTenantPayload = {
   id?: unknown
   tenantId?: unknown
+  body?: { id?: unknown } | null
+  query?: { id?: unknown } | null
+}
+
+function extractRoleId(input: Record<string, unknown>): string | null {
+  const payload = input as RoleTenantPayload
+  const candidates: unknown[] = [payload.id, payload.body?.id, payload.query?.id]
+  for (const candidate of candidates) {
+    if (typeof candidate === 'string' && candidate.length) return candidate
+  }
+  return null
+}
+
+async function assertActorOwnsRole(
+  roleId: string,
+  ctx: RoleTenantAccessCtx,
+): Promise<{ matched: boolean }> {
+  const auth = ctx.auth
+  if (!auth) throw forbidden('Not authorized')
+  const em = (ctx.container.resolve('em') as EntityManager)
+  const existing = await findOneWithDecryption(
+    em,
+    Role,
+    { id: roleId, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  if (!existing) return { matched: false }
+
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  if (isSuperAdmin) return { matched: true }
+
+  const actorTenant = normalizeTenantId(auth.tenantId ?? null) ?? null
+  const existingTenantId = normalizeTenantId(existing.tenantId ?? null) ?? null
+  // Unified 404 for "out of scope" — matches grantChecks.assertActorCanAccessRoleTarget
+  // and prevents existence enumeration of foreign-tenant or global roles.
+  if (!actorTenant) roleNotFound()
+  if (existingTenantId !== actorTenant) roleNotFound()
+  return { matched: true }
 }
 
 export async function enforceRoleTenantAccess(
-  mode: 'create' | 'update',
+  mode: 'create' | 'update' | 'delete',
   input: Record<string, unknown>,
   ctx: RoleTenantAccessCtx,
 ): Promise<Record<string, unknown>> {
   const auth = ctx.auth
   if (!auth) throw forbidden('Not authorized')
-  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
 
   if (mode === 'create') {
     const tenantId = await enforceTenantSelection(ctx, (input as RoleTenantPayload).tenantId)
     return { ...input, tenantId }
   }
 
+  if (mode === 'delete') {
+    const roleId = extractRoleId(input)
+    if (!roleId) return input
+    await assertActorOwnsRole(roleId, ctx)
+    return input
+  }
+
+  // mode === 'update'
   const roleIdCandidate = (input as RoleTenantPayload).id
   const roleId = typeof roleIdCandidate === 'string' ? roleIdCandidate : null
   if (!roleId) return input
 
-  const em = (ctx.container.resolve('em') as EntityManager)
-  const existing = await em.findOne(Role, { id: roleId, deletedAt: null })
-  if (!existing) return input
-
-  const actorTenant = normalizeTenantId(auth.tenantId ?? null) ?? null
-  const existingTenantId = normalizeTenantId(existing.tenantId ?? null) ?? null
-
-  if (!isSuperAdmin && !actorTenant) {
-    throw forbidden('Not authorized')
-  }
-
-  if (!isSuperAdmin && existingTenantId !== actorTenant) {
-    throw forbidden('Not authorized')
-  }
+  const ownership = await assertActorOwnsRole(roleId, ctx)
+  if (!ownership.matched) return input
 
   if ((input as RoleTenantPayload).tenantId === undefined) {
     return input

package/src/modules/auth/lib/setup-app.ts

@@ -1,4 +1,5 @@
 import { hash } from 'bcryptjs'
+import { randomBytes } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
@@ -80,6 +81,29 @@ const DERIVED_EMAIL_ENV = {
   employee: 'OM_INIT_EMPLOYEE_EMAIL',
 } as const
 
+export type DemoUserRole = 'superadmin' | 'admin' | 'employee'
+export type DemoUserEmail = { role: DemoUserRole; email: string }
+
+/**
+ * Returns the canonical list of demo user emails the setup path may have
+ * seeded. Honors OM_INIT_ADMIN_EMAIL / OM_INIT_EMPLOYEE_EMAIL exactly the
+ * same way the derived-user seeding branch does, so the deactivation loop
+ * never drifts from the seeding loop.
+ *
+ * Pure function — no side effects, safe to unit-test in isolation.
+ *
+ * @internal Exported for tests; not part of the public auth API.
+ */
+export function resolveDemoUserEmails(): DemoUserEmail[] {
+  const adminEmail = readEnvValue(DERIVED_EMAIL_ENV.admin) ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`
+  const employeeEmail = readEnvValue(DERIVED_EMAIL_ENV.employee) ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`
+  return [
+    { role: 'superadmin', email: DEMO_SUPERADMIN_EMAIL },
+    { role: 'admin', email: adminEmail },
+    { role: 'employee', email: employeeEmail },
+  ]
+}
+
 export type SetupInitialTenantOptions = {
   orgName: string
   primaryUser: PrimaryUserInput
@@ -97,6 +121,20 @@ export type SetupInitialTenantOptions = {
    * reusing or clobbering an existing organization.
    */
   orgSlug?: string
+  /**
+   * Opt-in flag that allows seeding the derived admin/employee accounts when
+   * the OM_INIT_ADMIN_PASSWORD / OM_INIT_EMPLOYEE_PASSWORD env vars are unset.
+   *
+   * - In non-production (`NODE_ENV !== 'production'`): the demo accounts are
+   *   seeded with the well-known `'secret'` password so local dev workflows
+   *   (e.g. `mercato init`) stay predictable for developers.
+   * - In production: the fallback uses a randomly generated 96-bit password
+   *   (printed once by the CLI) so an operator who deliberately opts in still
+   *   avoids the historical hardcoded credential. When this flag is false/unset
+   *   in production and the env vars are missing, `DerivedUserPasswordRequiredError`
+   *   is thrown instead of silently seeding any account.
+   */
+  allowDemoDerivedPasswords?: boolean
 }
 
 export class OrgSlugExistsError extends Error {
@@ -106,10 +144,19 @@ export class OrgSlugExistsError extends Error {
   }
 }
 
+export class DerivedUserPasswordRequiredError extends Error {
+  constructor(public readonly missing: string[]) {
+    super(
+      `DERIVED_USER_PASSWORD_REQUIRED: missing ${missing.join(', ')} (set the env vars, pass allowDemoDerivedPasswords: true / --include-demo-users in non-production, or disable derived user seeding)`,
+    )
+    this.name = 'DerivedUserPasswordRequiredError'
+  }
+}
+
 export type SetupInitialTenantResult = {
   tenantId: string
   organizationId: string
-  users: Array<{ user: User; roles: string[]; created: boolean }>
+  users: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }>
   reusedExistingUser: boolean
 }
 
@@ -161,7 +208,7 @@ export async function setupInitialTenant(
   let tenantId: string | undefined
   let organizationId: string | undefined
   let reusedExistingUser = false
-  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean }> = []
+  const userSnapshots: Array<{ user: User; roles: string[]; created: boolean; generatedPassword?: string | null }> = []
 
   await em.transactional(async (tem) => {
     if (!existingUser) return
@@ -202,6 +249,7 @@ export async function setupInitialTenant(
       roles: string[]
       name?: string | null
       passwordHash?: string | null
+      generatedPassword?: string | null
     }> = [
       { email: primaryUser.email, roles: primaryRoles, name: resolvePrimaryName(primaryUser) },
     ]
@@ -210,14 +258,43 @@ export async function setupInitialTenant(
       const employeeOverride = readEnvValue(DERIVED_EMAIL_ENV.employee)
       const adminEmail = adminOverride ?? `admin@${DEFAULT_DERIVED_EMAIL_DOMAIN}`
       const employeeEmail = employeeOverride ?? `employee@${DEFAULT_DERIVED_EMAIL_DOMAIN}`
-      const adminPassword = readEnvValue('OM_INIT_ADMIN_PASSWORD') || 'secret'
-      const employeePassword = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD') || 'secret'
-      const adminPasswordHash = adminPassword ? await resolvePasswordHash({ email: adminEmail, password: adminPassword }) : null
-      const employeePasswordHash = employeePassword
-        ? await resolvePasswordHash({ email: employeeEmail, password: employeePassword })
-        : null
-      addUniqueBaseUser(baseUsers, { email: adminEmail, roles: ['admin'], passwordHash: adminPasswordHash })
-      addUniqueBaseUser(baseUsers, { email: employeeEmail, roles: ['employee'], passwordHash: employeePasswordHash })
+      const envAdminPwd = readEnvValue('OM_INIT_ADMIN_PASSWORD')
+      const envEmployeePwd = readEnvValue('OM_INIT_EMPLOYEE_PASSWORD')
+      const isProduction = process.env.NODE_ENV === 'production'
+      const allowDemo = options.allowDemoDerivedPasswords === true
+      if (isProduction && !allowDemo) {
+        const missing: string[] = []
+        if (!envAdminPwd) missing.push('OM_INIT_ADMIN_PASSWORD')
+        if (!envEmployeePwd) missing.push('OM_INIT_EMPLOYEE_PASSWORD')
+        if (missing.length) {
+          throw new DerivedUserPasswordRequiredError(missing)
+        }
+      }
+      // In non-production, fall back to the well-known DEMO_DERIVED_PASSWORD so
+      // local dev workflows stay predictable (admin@/employee@ login with the
+      // documented demo password). In production we either have env-supplied
+      // values, or — for opt-in --include-demo-users flows — we generate a
+      // random one-time password and surface it via `generatedPassword` so the
+      // operator can capture it. Production callers without env vars and
+      // without the opt-in already threw above.
+      const fallbackAdminPwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD
+      const fallbackEmployeePwd = isProduction ? generateDerivedPassword() : DEMO_DERIVED_PASSWORD
+      const adminPasswordPlain = envAdminPwd ?? fallbackAdminPwd
+      const employeePasswordPlain = envEmployeePwd ?? fallbackEmployeePwd
+      const adminPasswordHash = await hash(adminPasswordPlain, 10)
+      const employeePasswordHash = await hash(employeePasswordPlain, 10)
+      addUniqueBaseUser(baseUsers, {
+        email: adminEmail,
+        roles: ['admin'],
+        passwordHash: adminPasswordHash,
+        generatedPassword: envAdminPwd ? null : adminPasswordPlain,
+      })
+      addUniqueBaseUser(baseUsers, {
+        email: employeeEmail,
+        roles: ['employee'],
+        passwordHash: employeePasswordHash,
+        generatedPassword: envEmployeePwd ? null : employeePasswordPlain,
+      })
     }
     const passwordHash = await resolvePasswordHash(primaryUser)
 
@@ -327,7 +404,7 @@ export async function setupInitialTenant(
           if (base.name) user.name = base.name
           if (confirm) user.isConfirmed = true
           tem.persist(user)
-          userSnapshots.push({ user, roles: base.roles, created: false })
+          userSnapshots.push({ user, roles: base.roles, created: false, generatedPassword: base.generatedPassword ?? null })
         } else {
           user = tem.create(User, {
             email: (encryptedPayload as any).email ?? base.email,
@@ -340,7 +417,7 @@ export async function setupInitialTenant(
             createdAt: new Date(),
           })
           tem.persist(user)
-          userSnapshots.push({ user, roles: base.roles, created: true })
+          userSnapshots.push({ user, roles: base.roles, created: true, generatedPassword: base.generatedPassword ?? null })
         }
         await tem.flush()
         for (const roleName of base.roles) {
@@ -362,7 +439,7 @@ export async function setupInitialTenant(
   }
 
   await ensureDefaultRoleAcls(em, tenantId, resolvedModules, { includeSuperadminRole })
-  await deactivateDemoSuperAdminIfSelfOnboardingEnabled(em)
+  await deactivateDemoUsersIfSelfOnboardingEnabled(em)
 
   // Call module onTenantCreated hooks
   for (const mod of resolvedModules) {
@@ -394,8 +471,8 @@ function readEnvValue(key: string): string | undefined {
 }
 
 function addUniqueBaseUser(
-  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null }>,
-  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null },
+  baseUsers: Array<{ email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null }>,
+  entry: { email: string; roles: string[]; name?: string | null; passwordHash?: string | null; generatedPassword?: string | null },
 ) {
   if (!entry.email) return
   const normalized = entry.email.toLowerCase()
@@ -403,6 +480,26 @@ function addUniqueBaseUser(
   baseUsers.push(entry)
 }
 
+/**
+ * Well-known demo password seeded for derived admin@/employee@ accounts in
+ * non-production (`NODE_ENV !== 'production'`) when no env override is set.
+ * Keeps the documented `yarn dev` / `mercato init` DX predictable. Never used
+ * in production: the production branch either consumes env-supplied values or
+ * falls back to `generateDerivedPassword()` so credentials remain non-guessable.
+ */
+const DEMO_DERIVED_PASSWORD = 'secret'
+
+/**
+ * Generate a 16-character base64url password (96 bits of entropy) for a derived
+ * demo user in production when no env override is provided AND the caller
+ * explicitly opted in via `allowDemoDerivedPasswords`. Surfaced via the
+ * `users[].generatedPassword` snapshot so CLI callers can print it to the
+ * operator — there is no other recovery path for these credentials.
+ */
+function generateDerivedPassword(): string {
+  return randomBytes(12).toString('base64url')
+}
+
 function isDemoModeEnabled(): boolean {
   const parsed = parseBooleanToken(process.env.DEMO_MODE ?? '')
   return parsed === false ? false : true
@@ -562,29 +659,60 @@ async function ensureRoleAclFor(
   }
 }
 
-async function deactivateDemoSuperAdminIfSelfOnboardingEnabled(em: EntityManager) {
+/**
+ * Neutralizes every demo account the setup path may have seeded
+ * (superadmin, admin, employee — honoring OM_INIT_*_EMAIL overrides)
+ * when SELF_SERVICE_ONBOARDING_ENABLED is on and the operator did not
+ * opt in to keeping demo credentials via shouldKeepDemoSuperadminDuringInit.
+ *
+ * Each user is processed in its own try/catch so a single failure (e.g.
+ * decryption error on a legacy row) does not skip the remaining accounts.
+ *
+ * @internal Exported for tests; not part of the public auth API.
+ */
+export async function deactivateDemoUsersIfSelfOnboardingEnabled(em: EntityManager) {
   if (process.env.SELF_SERVICE_ONBOARDING_ENABLED !== 'true') return
   if (shouldKeepDemoSuperadminDuringInit()) return
-  try {
-    const user = await findOneWithDecryption(em, User, { email: DEMO_SUPERADMIN_EMAIL }, {}, { tenantId: null, organizationId: null })
-    if (!user) return
-    let dirty = false
-    if (user.passwordHash) {
-      user.passwordHash = null
-      dirty = true
-    }
-    if (user.isConfirmed !== false) {
-      user.isConfirmed = false
-      dirty = true
-    }
-    if (dirty) {
-      await em.persist(user).flush()
+  for (const { role, email } of resolveDemoUserEmails()) {
+    try {
+      const user = await findOneWithDecryption(
+        em,
+        User,
+        { email },
+        {},
+        { tenantId: null, organizationId: null },
+      )
+      if (!user) continue
+      let dirty = false
+      if (user.passwordHash) {
+        user.passwordHash = null
+        dirty = true
+      }
+      if (user.isConfirmed !== false) {
+        user.isConfirmed = false
+        dirty = true
+      }
+      if (dirty) {
+        await em.persist(user).flush()
+      }
+    } catch (error) {
+      console.error(
+        `[auth.setup] failed to deactivate demo ${role} user (${email})`,
+        error,
+      )
     }
-  } catch (error) {
-    console.error('[auth.setup] failed to deactivate demo superadmin user', error)
   }
 }
 
+/**
+ * @deprecated Renamed to {@link deactivateDemoUsersIfSelfOnboardingEnabled}
+ * because the helper now neutralizes admin/employee demo accounts in addition
+ * to superadmin (security tracker finding #5). Kept as an internal alias to
+ * avoid breaking any out-of-tree caller that imported the old name; will be
+ * removed in a future major.
+ */
+const deactivateDemoSuperAdminIfSelfOnboardingEnabled = deactivateDemoUsersIfSelfOnboardingEnabled
+
 /** Try to get modules from runtime registry; returns empty array if not yet registered. */
 function tryGetModules(): Module[] {
   try {

package/src/modules/currencies/api/fetch-configs/route.ts

@@ -13,8 +13,10 @@ import {
 import { currencyFetchConfigCreateSchema, currencyFetchConfigUpdateSchema } from '../../data/validators'
 
 export const metadata = {
-  requireAuth: true,
-  requireFeatures: ['currencies.fetch.view'],
+  GET: { requireAuth: true, requireFeatures: ['currencies.fetch.view'] },
+  POST: { requireAuth: true, requireFeatures: ['currencies.fetch.manage'] },
+  PUT: { requireAuth: true, requireFeatures: ['currencies.fetch.manage'] },
+  DELETE: { requireAuth: true, requireFeatures: ['currencies.fetch.manage'] },
 }
 
 export async function GET(req: NextRequest) {

package/src/modules/integrations/api/[id]/route.ts

@@ -3,7 +3,7 @@ import { z } from 'zod'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getBundle, getBundleIntegrations, getIntegration } from '@open-mercato/shared/modules/integrations/types'
-import type { CredentialsService } from '../../lib/credentials-service'
+import { CredentialsEncryptionUnavailableError, type CredentialsService } from '../../lib/credentials-service'
 import type { IntegrationStateService } from '../../lib/state-service'
 import type { IntegrationLogService } from '../../lib/log-service'
 import { deriveIntegrationHealthStatus, getEffectiveHealthCheckConfig } from '../../lib/health-service'
@@ -60,7 +60,10 @@ export async function GET(req: Request, ctx: { params?: Promise<{ id?: string }>
   const scope = { organizationId: auth.orgId as string, tenantId: auth.tenantId }
 
   const [credentials, state, analyticsMap] = await Promise.all([
-    credentialsService.resolve(integration.id, scope),
+    credentialsService.resolve(integration.id, scope).catch((err) => {
+      if (err instanceof CredentialsEncryptionUnavailableError) return null
+      throw err
+    }),
     stateService.resolveState(integration.id, scope),
     logService.aggregateAnalytics([integration.id], scope, 30),
   ])

package/src/modules/integrations/api/route.ts

@@ -1,7 +1,7 @@
 import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import type { CredentialsService } from '../lib/credentials-service'
+import { CredentialsEncryptionUnavailableError, type CredentialsService } from '../lib/credentials-service'
 import type { IntegrationStateService } from '../lib/state-service'
 import type { IntegrationLogService } from '../lib/log-service'
 import { deriveIntegrationHealthStatus, getEffectiveHealthCheckConfig } from '../lib/health-service'
@@ -101,7 +101,10 @@ export async function GET(req: Request) {
   const baseRows: ListRow[] = await Promise.all(
     getAllIntegrations().map(async (integration) => {
       const [resolvedCredentials, state] = await Promise.all([
-        credentialsService.resolve(integration.id, scope),
+        credentialsService.resolve(integration.id, scope).catch((err) => {
+          if (err instanceof CredentialsEncryptionUnavailableError) return null
+          throw err
+        }),
         stateService.resolveState(integration.id, scope),
       ])
 

package/src/modules/integrations/lib/credentials-service.ts

@@ -13,12 +13,22 @@ import { EncryptionMap } from '../../entities/data/entities'
 import { IntegrationCredentials } from '../data/entities'
 
 const ENCRYPTED_CREDENTIALS_BLOB_KEY = '__om_encrypted_credentials_blob_v1'
-const CREDENTIALS_ENCRYPTION_UNAVAILABLE_MESSAGE =
-  'Integration credentials encryption key is unavailable. Configure Vault KMS or TENANT_DATA_ENCRYPTION_FALLBACK_KEY.'
 
+/**
+ * Raised when integration credentials cannot be encrypted or decrypted because
+ * no tenant DEK is available — typically a production deployment with neither
+ * Vault nor `TENANT_DATA_ENCRYPTION_FALLBACK_KEY` (or equivalent env vars)
+ * configured. The credentials path deliberately fails closed instead of using
+ * a hardcoded fallback secret; see security tracker finding #7.
+ */
 export class CredentialsEncryptionUnavailableError extends Error {
-  constructor() {
-    super(CREDENTIALS_ENCRYPTION_UNAVAILABLE_MESSAGE)
+  readonly code = 'CREDENTIALS_ENCRYPTION_UNAVAILABLE'
+  constructor(tenantId: string) {
+    super(
+      `Cannot encrypt or decrypt integration credentials for tenant ${tenantId}: ` +
+        `no tenant DEK is available. Configure Vault (VAULT_ADDR/VAULT_TOKEN) or ` +
+        `set TENANT_DATA_ENCRYPTION_FALLBACK_KEY in the environment.`,
+    )
     this.name = 'CredentialsEncryptionUnavailableError'
   }
 }
@@ -110,7 +120,7 @@ export function createCredentialsService(em: EntityManager) {
     const created = await kms.createTenantDek(scope.tenantId)
     if (created?.key) return created.key
 
-    throw new CredentialsEncryptionUnavailableError()
+    throw new CredentialsEncryptionUnavailableError(scope.tenantId)
   }
 
   async function encryptCredentialsBlob(