@open-mercato/core 0.6.6-develop.6404.1.e2f8d5025a → 0.6.6-develop.6407.1.9a4c26cf6a

package/dist/modules/staff/api/team-members/assignable/route.js

@@ -4,6 +4,7 @@ import { CrudHttpError, isCrudHttpError } from "@open-mercato/shared/lib/crud/er
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { createPagedListResponseSchema as createSharedPagedListResponseSchema } from "@open-mercato/shared/lib/openapi/crud";
+import { resolveOrganizationScopeFilter } from "@open-mercato/core/modules/directory/utils/organizationScopeFilter";
 import { User } from "@open-mercato/core/modules/auth/data/entities";
 import {
   resolveAuthActorId,
@@ -49,16 +50,11 @@ async function GET(request) {
   const { translate } = await resolveTranslations();
   try {
     const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams));
-    const { container, em, auth, selectedOrganizationId } = await resolveCustomersRequestContext(request);
-    if (!selectedOrganizationId) {
-      throw new CrudHttpError(
-        400,
-        { error: translate("customers.errors.organization_required", "Organization context is required") }
-      );
-    }
+    const { container, em, auth, scope: organizationScope } = await resolveCustomersRequestContext(request);
+    const orgFilter = resolveOrganizationScopeFilter(organizationScope, auth);
     const actorId = resolveAuthActorId(auth);
     const rbacService = container.resolve("rbacService");
-    const scope = { tenantId: auth.tenantId, organizationId: selectedOrganizationId };
+    const scope = { tenantId: auth.tenantId, organizationId: orgFilter.rbacOrganizationId };
     const hasAccess = await canAccessAssignableStaff(rbacService, actorId, scope);
     if (!hasAccess) {
       throw new CrudHttpError(
@@ -77,7 +73,7 @@ async function GET(request) {
       StaffTeamMember,
       {
         tenantId: auth.tenantId,
-        organizationId: selectedOrganizationId,
+        ...orgFilter.where,
         deletedAt: null,
         isActive: true
       },
@@ -102,7 +98,7 @@ async function GET(request) {
           id: { $in: userIds },
           deletedAt: null,
           tenantId: auth.tenantId,
-          organizationId: selectedOrganizationId
+          ...orgFilter.where
         },
         void 0,
         scope
@@ -114,7 +110,7 @@ async function GET(request) {
           id: { $in: teamIds },
           deletedAt: null,
           tenantId: auth.tenantId,
-          organizationId: selectedOrganizationId
+          ...orgFilter.where
         },
         void 0,
         scope

package/dist/modules/staff/api/team-members/assignable/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/staff/api/team-members/assignable/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createPagedListResponseSchema as createSharedPagedListResponseSchema } from '@open-mercato/shared/lib/openapi/crud'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  resolveAuthActorId,\n  resolveCustomersRequestContext,\n} from '@open-mercato/core/modules/customers/lib/interactionRequestContext'\nimport { StaffTeam, StaffTeamMember } from '../../../data/entities'\n\nconst querySchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(24),\n    search: z.string().optional(),\n  })\n  .passthrough()\n\nconst itemSchema = z.object({\n  id: z.string().uuid(),\n  teamMemberId: z.string().uuid(),\n  userId: z.string().uuid(),\n  displayName: z.string(),\n  email: z.string().nullable().optional(),\n  teamName: z.string().nullable().optional(),\n  user: z\n    .object({\n      id: z.string().uuid(),\n      email: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n  team: z\n    .object({\n      id: z.string().uuid(),\n      name: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nconst pagedListSchema = createSharedPagedListResponseSchema(itemSchema, {\n  paginationMetaOptional: true,\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.roles.view'] },\n}\n\nasync function canAccessAssignableStaff(\n  rbac: RbacService | undefined,\n  userId: string,\n  scope: { tenantId: string; organizationId: string },\n): Promise<boolean> {\n  if (!rbac) return false\n  if (\n    await rbac.userHasAllFeatures(userId, ['customers.roles.manage'], scope)\n  ) {\n    return true\n  }\n  return rbac.userHasAllFeatures(userId, ['customers.activities.manage'], scope)\n}\n\nexport async function GET(request: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n    const { container, em, auth, selectedOrganizationId } = await resolveCustomersRequestContext(request)\n\n    if (!selectedOrganizationId) {\n      throw new CrudHttpError(\n        400,\n        { error: translate('customers.errors.organization_required', 'Organization context is required') },\n      )\n    }\n\n    const actorId = resolveAuthActorId(auth)\n    const rbacService = container.resolve('rbacService') as RbacService | undefined\n    const scope = { tenantId: auth.tenantId, organizationId: selectedOrganizationId }\n    const hasAccess = await canAccessAssignableStaff(rbacService, actorId, scope)\n    if (!hasAccess) {\n      throw new CrudHttpError(\n        403,\n        {\n          error: translate(\n            'customers.assignableStaff.forbidden',\n            'Insufficient permissions to load assignable staff.',\n          ),\n        },\n      )\n    }\n\n    const normalizedSearch = query.search?.trim().toLowerCase() ?? ''\n\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      {\n        tenantId: auth.tenantId,\n        organizationId: selectedOrganizationId,\n        deletedAt: null,\n        isActive: true,\n      },\n      { orderBy: { displayName: 'asc' } },\n      scope,\n    )\n\n    const userIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.userId === 'string' && member.userId.trim().length > 0 ? member.userId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n    const teamIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.teamId === 'string' && member.teamId.trim().length > 0 ? member.teamId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n\n    const [users, teams] = await Promise.all([\n      userIds.length > 0\n        ? findWithDecryption(\n            em,\n            User,\n            {\n              id: { $in: userIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              organizationId: selectedOrganizationId,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n      teamIds.length > 0\n        ? findWithDecryption(\n            em,\n            StaffTeam,\n            {\n              id: { $in: teamIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              organizationId: selectedOrganizationId,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n    ])\n\n    const userById = new Map(\n      users.map((user) => [\n        user.id,\n        {\n          id: user.id,\n          email: user.email ?? null,\n        },\n      ]),\n    )\n    const teamById = new Map(\n      teams.map((team) => [\n        team.id,\n        {\n          id: team.id,\n          name: team.name ?? null,\n        },\n      ]),\n    )\n\n    const items = members\n      .filter((member) => typeof member.userId === 'string' && member.userId.trim().length > 0)\n      .map((member) => {\n        const userId = member.userId as string\n        const user = userById.get(userId) ?? { id: userId, email: null }\n        const team = member.teamId ? teamById.get(member.teamId) ?? null : null\n        return {\n          id: member.id,\n          teamMemberId: member.id,\n          userId,\n          displayName: member.displayName?.trim() || user.email || userId,\n          email: user.email,\n          teamName: team?.name ?? null,\n          user,\n          team,\n        }\n      })\n      .filter((item) => {\n        if (!normalizedSearch) return true\n        const haystack = [item.displayName, item.email, item.teamName]\n          .filter((value): value is string => typeof value === 'string' && value.length > 0)\n          .join(' ')\n          .toLowerCase()\n        return haystack.includes(normalizedSearch)\n      })\n\n    const deduped = Array.from(\n      items.reduce((acc, item) => {\n        if (!acc.has(item.userId)) {\n          acc.set(item.userId, item)\n        }\n        return acc\n      }, new Map<string, (typeof items)[number]>()),\n    ).map(([, item]) => item)\n\n    const start = (query.page - 1) * query.pageSize\n    return NextResponse.json({\n      items: deduped.slice(start, start + query.pageSize),\n      total: deduped.length,\n      page: query.page,\n      pageSize: query.pageSize,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('customers.errors.validationFailed', 'Validation failed') }, { status: 400 })\n    }\n    console.error('staff.assignable-team-members.get failed', error)\n    return NextResponse.json({ error: translate('customers.errors.assignable_staff_load_failed', 'Failed to load assignable staff') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Assignable staff candidates',\n  methods: {\n    GET: {\n      summary: 'List staff members that can be assigned from customer flows',\n      query: querySchema,\n      description:\n        'Returns active staff members linked to auth users. Access requires either customers.roles.manage or customers.activities.manage. Owned by the staff module; consumed from customer flows via this canonical URL. Replaces the deprecated /api/customers/assignable-staff route.',\n      responses: [\n        {\n          status: 200,\n          description: 'Assignable staff members',\n          schema: pagedListSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC,2CAA2C;AAErF,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,uBAAuB;AAE3C,MAAM,cAAc,EACjB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY;AAEf,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,EACZ,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,MAAM,kBAAkB,oCAAoC,YAAY;AAAA,EACtE,wBAAwB;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAe,yBACb,MACA,QACA,OACkB;AAClB,MAAI,CAAC,KAAM,QAAO;AAClB,MACE,MAAM,KAAK,mBAAmB,QAAQ,CAAC,wBAAwB,GAAG,KAAK,GACvE;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,mBAAmB,QAAQ,CAAC,6BAA6B,GAAG,KAAK;AAC/E;AAEA,eAAsB,IAAI,SAAkB;AAC1C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AACrF,UAAM,EAAE,WAAW,IAAI,MAAM,uBAAuB,IAAI,MAAM,+BAA+B,OAAO;AAEpG,QAAI,CAAC,wBAAwB;AAC3B,YAAM,IAAI;AAAA,QACR;AAAA,QACA,EAAE,OAAO,UAAU,0CAA0C,kCAAkC,EAAE;AAAA,MACnG;AAAA,IACF;AAEA,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,QAAQ,EAAE,UAAU,KAAK,UAAU,gBAAgB,uBAAuB;AAChF,UAAM,YAAY,MAAM,yBAAyB,aAAa,SAAS,KAAK;AAC5E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,MAAM,QAAQ,KAAK,EAAE,YAAY,KAAK;AAE/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,UAAU,KAAK;AAAA,QACf,gBAAgB;AAAA,QAChB,WAAW;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,MACA,EAAE,SAAS,EAAE,aAAa,MAAM,EAAE;AAAA,MAClC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AAEA,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACtB,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,gBAAgB;AAAA,QAClB;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,OAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,MAAM,KAAK,QAAQ;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,QACX,OAAO,CAAC,WAAW,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,WAAW;AACf,YAAM,SAAS,OAAO;AACtB,YAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,QAAQ,OAAO,KAAK;AAC/D,YAAM,OAAO,OAAO,SAAS,SAAS,IAAI,OAAO,MAAM,KAAK,OAAO;AACnE,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,cAAc,OAAO;AAAA,QACrB;AAAA,QACA,aAAa,OAAO,aAAa,KAAK,KAAK,KAAK,SAAS;AAAA,QACzD,OAAO,KAAK;AAAA,QACZ,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAS;AAChB,UAAI,CAAC,iBAAkB,QAAO;AAC9B,YAAM,WAAW,CAAC,KAAK,aAAa,KAAK,OAAO,KAAK,QAAQ,EAC1D,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,GAAG,EACR,YAAY;AACf,aAAO,SAAS,SAAS,gBAAgB;AAAA,IAC3C,CAAC;AAEH,UAAM,UAAU,MAAM;AAAA,MACpB,MAAM,OAAO,CAAC,KAAK,SAAS;AAC1B,YAAI,CAAC,IAAI,IAAI,KAAK,MAAM,GAAG;AACzB,cAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,GAAG,oBAAI,IAAoC,CAAC;AAAA,IAC9C,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,IAAI;AAExB,UAAM,SAAS,MAAM,OAAO,KAAK,MAAM;AACvC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,OAAO,QAAQ;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AACA,YAAQ,MAAM,4CAA4C,KAAK;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iDAAiD,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpJ;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { createPagedListResponseSchema as createSharedPagedListResponseSchema } from '@open-mercato/shared/lib/openapi/crud'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport {\n  resolveAuthActorId,\n  resolveCustomersRequestContext,\n} from '@open-mercato/core/modules/customers/lib/interactionRequestContext'\nimport { StaffTeam, StaffTeamMember } from '../../../data/entities'\n\nconst querySchema = z\n  .object({\n    page: z.coerce.number().min(1).default(1),\n    pageSize: z.coerce.number().min(1).max(100).default(24),\n    search: z.string().optional(),\n  })\n  .passthrough()\n\nconst itemSchema = z.object({\n  id: z.string().uuid(),\n  teamMemberId: z.string().uuid(),\n  userId: z.string().uuid(),\n  displayName: z.string(),\n  email: z.string().nullable().optional(),\n  teamName: z.string().nullable().optional(),\n  user: z\n    .object({\n      id: z.string().uuid(),\n      email: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n  team: z\n    .object({\n      id: z.string().uuid(),\n      name: z.string().nullable().optional(),\n    })\n    .nullable()\n    .optional(),\n})\n\nconst errorSchema = z.object({ error: z.string() })\n\nconst pagedListSchema = createSharedPagedListResponseSchema(itemSchema, {\n  paginationMetaOptional: true,\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['customers.roles.view'] },\n}\n\nasync function canAccessAssignableStaff(\n  rbac: RbacService | undefined,\n  userId: string,\n  scope: { tenantId: string; organizationId: string | null },\n): Promise<boolean> {\n  if (!rbac) return false\n  if (\n    await rbac.userHasAllFeatures(userId, ['customers.roles.manage'], scope)\n  ) {\n    return true\n  }\n  return rbac.userHasAllFeatures(userId, ['customers.activities.manage'], scope)\n}\n\nexport async function GET(request: Request) {\n  const { translate } = await resolveTranslations()\n  try {\n    const query = querySchema.parse(Object.fromEntries(new URL(request.url).searchParams))\n    const { container, em, auth, scope: organizationScope } = await resolveCustomersRequestContext(request)\n\n    const orgFilter = resolveOrganizationScopeFilter(organizationScope, auth)\n\n    const actorId = resolveAuthActorId(auth)\n    const rbacService = container.resolve('rbacService') as RbacService | undefined\n    const scope = { tenantId: auth.tenantId, organizationId: orgFilter.rbacOrganizationId }\n    const hasAccess = await canAccessAssignableStaff(rbacService, actorId, scope)\n    if (!hasAccess) {\n      throw new CrudHttpError(\n        403,\n        {\n          error: translate(\n            'customers.assignableStaff.forbidden',\n            'Insufficient permissions to load assignable staff.',\n          ),\n        },\n      )\n    }\n\n    const normalizedSearch = query.search?.trim().toLowerCase() ?? ''\n\n    const members = await findWithDecryption(\n      em,\n      StaffTeamMember,\n      {\n        tenantId: auth.tenantId,\n        ...orgFilter.where,\n        deletedAt: null,\n        isActive: true,\n      },\n      { orderBy: { displayName: 'asc' } },\n      scope,\n    )\n\n    const userIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.userId === 'string' && member.userId.trim().length > 0 ? member.userId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n    const teamIds = Array.from(\n      new Set(\n        members\n          .map((member) => (typeof member.teamId === 'string' && member.teamId.trim().length > 0 ? member.teamId : null))\n          .filter((value): value is string => typeof value === 'string'),\n      ),\n    )\n\n    const [users, teams] = await Promise.all([\n      userIds.length > 0\n        ? findWithDecryption(\n            em,\n            User,\n            {\n              id: { $in: userIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              ...orgFilter.where,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n      teamIds.length > 0\n        ? findWithDecryption(\n            em,\n            StaffTeam,\n            {\n              id: { $in: teamIds },\n              deletedAt: null,\n              tenantId: auth.tenantId,\n              ...orgFilter.where,\n            },\n            undefined,\n            scope,\n          )\n        : Promise.resolve([]),\n    ])\n\n    const userById = new Map(\n      users.map((user) => [\n        user.id,\n        {\n          id: user.id,\n          email: user.email ?? null,\n        },\n      ]),\n    )\n    const teamById = new Map(\n      teams.map((team) => [\n        team.id,\n        {\n          id: team.id,\n          name: team.name ?? null,\n        },\n      ]),\n    )\n\n    const items = members\n      .filter((member) => typeof member.userId === 'string' && member.userId.trim().length > 0)\n      .map((member) => {\n        const userId = member.userId as string\n        const user = userById.get(userId) ?? { id: userId, email: null }\n        const team = member.teamId ? teamById.get(member.teamId) ?? null : null\n        return {\n          id: member.id,\n          teamMemberId: member.id,\n          userId,\n          displayName: member.displayName?.trim() || user.email || userId,\n          email: user.email,\n          teamName: team?.name ?? null,\n          user,\n          team,\n        }\n      })\n      .filter((item) => {\n        if (!normalizedSearch) return true\n        const haystack = [item.displayName, item.email, item.teamName]\n          .filter((value): value is string => typeof value === 'string' && value.length > 0)\n          .join(' ')\n          .toLowerCase()\n        return haystack.includes(normalizedSearch)\n      })\n\n    const deduped = Array.from(\n      items.reduce((acc, item) => {\n        if (!acc.has(item.userId)) {\n          acc.set(item.userId, item)\n        }\n        return acc\n      }, new Map<string, (typeof items)[number]>()),\n    ).map(([, item]) => item)\n\n    const start = (query.page - 1) * query.pageSize\n    return NextResponse.json({\n      items: deduped.slice(start, start + query.pageSize),\n      total: deduped.length,\n      page: query.page,\n      pageSize: query.pageSize,\n    })\n  } catch (error) {\n    if (isCrudHttpError(error)) {\n      return NextResponse.json(error.body, { status: error.status })\n    }\n    if (error instanceof z.ZodError) {\n      return NextResponse.json({ error: translate('customers.errors.validationFailed', 'Validation failed') }, { status: 400 })\n    }\n    console.error('staff.assignable-team-members.get failed', error)\n    return NextResponse.json({ error: translate('customers.errors.assignable_staff_load_failed', 'Failed to load assignable staff') }, { status: 500 })\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Staff',\n  summary: 'Assignable staff candidates',\n  methods: {\n    GET: {\n      summary: 'List staff members that can be assigned from customer flows',\n      query: querySchema,\n      description:\n        'Returns active staff members linked to auth users. Access requires either customers.roles.manage or customers.activities.manage. Owned by the staff module; consumed from customer flows via this canonical URL. Replaces the deprecated /api/customers/assignable-staff route.',\n      responses: [\n        {\n          status: 200,\n          description: 'Assignable staff members',\n          schema: pagedListSchema,\n        },\n      ],\n      errors: [\n        { status: 400, description: 'Invalid request', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 403, description: 'Forbidden', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,eAAe,uBAAuB;AAC/C,SAAS,0BAA0B;AACnC,SAAS,2BAA2B;AACpC,SAAS,iCAAiC,2CAA2C;AAErF,SAAS,sCAAsC;AAC/C,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,WAAW,uBAAuB;AAE3C,MAAM,cAAc,EACjB,OAAO;AAAA,EACN,MAAM,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,QAAQ,CAAC;AAAA,EACxC,UAAU,EAAE,OAAO,OAAO,EAAE,IAAI,CAAC,EAAE,IAAI,GAAG,EAAE,QAAQ,EAAE;AAAA,EACtD,QAAQ,EAAE,OAAO,EAAE,SAAS;AAC9B,CAAC,EACA,YAAY;AAEf,MAAM,aAAa,EAAE,OAAO;AAAA,EAC1B,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,cAAc,EAAE,OAAO,EAAE,KAAK;AAAA,EAC9B,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,aAAa,EAAE,OAAO;AAAA,EACtB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACtC,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACzC,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACxC,CAAC,EACA,SAAS,EACT,SAAS;AAAA,EACZ,MAAM,EACH,OAAO;AAAA,IACN,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,MAAM,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EACvC,CAAC,EACA,SAAS,EACT,SAAS;AACd,CAAC;AAED,MAAM,cAAc,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAElD,MAAM,kBAAkB,oCAAoC,YAAY;AAAA,EACtE,wBAAwB;AAC1B,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,sBAAsB,EAAE;AACtE;AAEA,eAAe,yBACb,MACA,QACA,OACkB;AAClB,MAAI,CAAC,KAAM,QAAO;AAClB,MACE,MAAM,KAAK,mBAAmB,QAAQ,CAAC,wBAAwB,GAAG,KAAK,GACvE;AACA,WAAO;AAAA,EACT;AACA,SAAO,KAAK,mBAAmB,QAAQ,CAAC,6BAA6B,GAAG,KAAK;AAC/E;AAEA,eAAsB,IAAI,SAAkB;AAC1C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,MAAI;AACF,UAAM,QAAQ,YAAY,MAAM,OAAO,YAAY,IAAI,IAAI,QAAQ,GAAG,EAAE,YAAY,CAAC;AACrF,UAAM,EAAE,WAAW,IAAI,MAAM,OAAO,kBAAkB,IAAI,MAAM,+BAA+B,OAAO;AAEtG,UAAM,YAAY,+BAA+B,mBAAmB,IAAI;AAExE,UAAM,UAAU,mBAAmB,IAAI;AACvC,UAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,UAAM,QAAQ,EAAE,UAAU,KAAK,UAAU,gBAAgB,UAAU,mBAAmB;AACtF,UAAM,YAAY,MAAM,yBAAyB,aAAa,SAAS,KAAK;AAC5E,QAAI,CAAC,WAAW;AACd,YAAM,IAAI;AAAA,QACR;AAAA,QACA;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,mBAAmB,MAAM,QAAQ,KAAK,EAAE,YAAY,KAAK;AAE/D,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,MACA;AAAA,QACE,UAAU,KAAK;AAAA,QACf,GAAG,UAAU;AAAA,QACb,WAAW;AAAA,QACX,UAAU;AAAA,MACZ;AAAA,MACA,EAAE,SAAS,EAAE,aAAa,MAAM,EAAE;AAAA,MAClC;AAAA,IACF;AAEA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AACA,UAAM,UAAU,MAAM;AAAA,MACpB,IAAI;AAAA,QACF,QACG,IAAI,CAAC,WAAY,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,IAAI,OAAO,SAAS,IAAK,EAC7G,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,MACjE;AAAA,IACF;AAEA,UAAM,CAAC,OAAO,KAAK,IAAI,MAAM,QAAQ,IAAI;AAAA,MACvC,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,GAAG,UAAU;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,MACtB,QAAQ,SAAS,IACb;AAAA,QACE;AAAA,QACA;AAAA,QACA;AAAA,UACE,IAAI,EAAE,KAAK,QAAQ;AAAA,UACnB,WAAW;AAAA,UACX,UAAU,KAAK;AAAA,UACf,GAAG,UAAU;AAAA,QACf;AAAA,QACA;AAAA,QACA;AAAA,MACF,IACA,QAAQ,QAAQ,CAAC,CAAC;AAAA,IACxB,CAAC;AAED,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,OAAO,KAAK,SAAS;AAAA,QACvB;AAAA,MACF,CAAC;AAAA,IACH;AACA,UAAM,WAAW,IAAI;AAAA,MACnB,MAAM,IAAI,CAAC,SAAS;AAAA,QAClB,KAAK;AAAA,QACL;AAAA,UACE,IAAI,KAAK;AAAA,UACT,MAAM,KAAK,QAAQ;AAAA,QACrB;AAAA,MACF,CAAC;AAAA,IACH;AAEA,UAAM,QAAQ,QACX,OAAO,CAAC,WAAW,OAAO,OAAO,WAAW,YAAY,OAAO,OAAO,KAAK,EAAE,SAAS,CAAC,EACvF,IAAI,CAAC,WAAW;AACf,YAAM,SAAS,OAAO;AACtB,YAAM,OAAO,SAAS,IAAI,MAAM,KAAK,EAAE,IAAI,QAAQ,OAAO,KAAK;AAC/D,YAAM,OAAO,OAAO,SAAS,SAAS,IAAI,OAAO,MAAM,KAAK,OAAO;AACnE,aAAO;AAAA,QACL,IAAI,OAAO;AAAA,QACX,cAAc,OAAO;AAAA,QACrB;AAAA,QACA,aAAa,OAAO,aAAa,KAAK,KAAK,KAAK,SAAS;AAAA,QACzD,OAAO,KAAK;AAAA,QACZ,UAAU,MAAM,QAAQ;AAAA,QACxB;AAAA,QACA;AAAA,MACF;AAAA,IACF,CAAC,EACA,OAAO,CAAC,SAAS;AAChB,UAAI,CAAC,iBAAkB,QAAO;AAC9B,YAAM,WAAW,CAAC,KAAK,aAAa,KAAK,OAAO,KAAK,QAAQ,EAC1D,OAAO,CAAC,UAA2B,OAAO,UAAU,YAAY,MAAM,SAAS,CAAC,EAChF,KAAK,GAAG,EACR,YAAY;AACf,aAAO,SAAS,SAAS,gBAAgB;AAAA,IAC3C,CAAC;AAEH,UAAM,UAAU,MAAM;AAAA,MACpB,MAAM,OAAO,CAAC,KAAK,SAAS;AAC1B,YAAI,CAAC,IAAI,IAAI,KAAK,MAAM,GAAG;AACzB,cAAI,IAAI,KAAK,QAAQ,IAAI;AAAA,QAC3B;AACA,eAAO;AAAA,MACT,GAAG,oBAAI,IAAoC,CAAC;AAAA,IAC9C,EAAE,IAAI,CAAC,CAAC,EAAE,IAAI,MAAM,IAAI;AAExB,UAAM,SAAS,MAAM,OAAO,KAAK,MAAM;AACvC,WAAO,aAAa,KAAK;AAAA,MACvB,OAAO,QAAQ,MAAM,OAAO,QAAQ,MAAM,QAAQ;AAAA,MAClD,OAAO,QAAQ;AAAA,MACf,MAAM,MAAM;AAAA,MACZ,UAAU,MAAM;AAAA,IAClB,CAAC;AAAA,EACH,SAAS,OAAO;AACd,QAAI,gBAAgB,KAAK,GAAG;AAC1B,aAAO,aAAa,KAAK,MAAM,MAAM,EAAE,QAAQ,MAAM,OAAO,CAAC;AAAA,IAC/D;AACA,QAAI,iBAAiB,EAAE,UAAU;AAC/B,aAAO,aAAa,KAAK,EAAE,OAAO,UAAU,qCAAqC,mBAAmB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AACA,YAAQ,MAAM,4CAA4C,KAAK;AAC/D,WAAO,aAAa,KAAK,EAAE,OAAO,UAAU,iDAAiD,iCAAiC,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACpJ;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,OAAO;AAAA,MACP,aACE;AAAA,MACF,WAAW;AAAA,QACT;AAAA,UACE,QAAQ;AAAA,UACR,aAAa;AAAA,UACb,QAAQ;AAAA,QACV;AAAA,MACF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,YAAY;AAAA,QACnE,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,aAAa,QAAQ,YAAY;AAAA,MAC/D;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6404.1.e2f8d5025a",
+  "version": "0.6.6-develop.6407.1.9a4c26cf6a",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -248,16 +248,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6404.1.e2f8d5025a",
-    "@open-mercato/shared": "0.6.6-develop.6404.1.e2f8d5025a",
-    "@open-mercato/ui": "0.6.6-develop.6404.1.e2f8d5025a",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6407.1.9a4c26cf6a",
+    "@open-mercato/shared": "0.6.6-develop.6407.1.9a4c26cf6a",
+    "@open-mercato/ui": "0.6.6-develop.6407.1.9a4c26cf6a",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6404.1.e2f8d5025a",
-    "@open-mercato/shared": "0.6.6-develop.6404.1.e2f8d5025a",
-    "@open-mercato/ui": "0.6.6-develop.6404.1.e2f8d5025a",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6407.1.9a4c26cf6a",
+    "@open-mercato/shared": "0.6.6-develop.6407.1.9a4c26cf6a",
+    "@open-mercato/ui": "0.6.6-develop.6407.1.9a4c26cf6a",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/attachments/api/route.ts

@@ -259,7 +259,18 @@ export async function GET(req: Request) {
 export async function POST(req: Request) {
   const { t } = await resolveTranslations()
   const auth = await getAuthFromRequest(req)
-  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  // A superadmin browsing with "All organizations" selected has no concrete
+  // organization scope, but an attachment must be stored under exactly one
+  // organization (the scope invariant forbids partial-null rows). Reject with a
+  // clear, actionable error instead of a 401 — a 401 makes the client-side
+  // fetch layer treat it as session expiry, show a misleading toast, and reset
+  // the in-progress form (#3764).
+  if (!auth.orgId) {
+    return NextResponse.json({
+      error: t('attachments.errors.selectOrganization', 'Select a specific organization before uploading an attachment.'),
+    }, { status: 400 })
+  }
   const tenantId = auth.tenantId
   const orgId = auth.orgId
 
@@ -527,7 +538,7 @@ async function readTenantAttachmentUsageBytes(em: EntityManager, tenantId: strin
 
 export async function DELETE(req: Request) {
   const auth = await getAuthFromRequest(req)
-  if (!auth || !auth.tenantId || !auth.orgId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  if (!auth || !auth.tenantId || (!auth.orgId && !auth.isSuperAdmin)) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   const url = new URL(req.url)
   const id = url.searchParams.get('id') || ''
   if (!id) return NextResponse.json({ error: 'Attachment id is required' }, { status: 400 })
@@ -536,7 +547,12 @@ export async function DELETE(req: Request) {
   const dataEngine = resolve('dataEngine')
   const storageDriverFactory =
     (resolve('storageDriverFactory') as StorageDriverFactory | null) ?? new StorageDriverFactory(em)
-  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId!, organizationId: auth.orgId }
+  // Mirror the GET handler's superadmin bypass: a superadmin browsing with "All
+  // organizations" selected has no concrete org, so scope the delete by tenant
+  // only and let them remove any attachment in the tenant. Non-superadmins stay
+  // scoped to their own organization (#3764).
+  const deleteFilter: Record<string, unknown> = { id, tenantId: auth.tenantId! }
+  if (auth.orgId) deleteFilter.organizationId = auth.orgId
   const record = await em.findOne(Attachment, deleteFilter)
   if (!record) return NextResponse.json({ error: 'Attachment not found' }, { status: 404 })
   await em.remove(record).flush()
@@ -546,7 +562,7 @@ export async function DELETE(req: Request) {
   if (record.storagePath) {
     const delDriver = await storageDriverFactory.resolveForPartition(record.partitionCode, {
       tenantId: record.tenantId ?? auth.tenantId!,
-      organizationId: record.organizationId ?? auth.orgId,
+      organizationId: record.organizationId ?? auth.orgId ?? '',
     })
     await delDriver.delete(record.partitionCode, record.storagePath)
   }

package/src/modules/attachments/i18n/de.json

@@ -5,6 +5,7 @@
   "attachments.errors.maxUploadSize": "Der Anhang überschreitet die maximal zulässige Upload-Größe.",
   "attachments.errors.publicPartitionBlocked": "Öffentliche Speicherpartitionen können für diesen Upload nicht explizit ausgewählt werden.",
   "attachments.errors.quotaExceeded": "Das Speicherlimit für Anhänge dieses Tenants wurde überschritten.",
+  "attachments.errors.selectOrganization": "Wählen Sie eine bestimmte Organisation aus, bevor Sie einen Anhang hochladen.",
   "attachments.library.actions.copied": "Link kopiert.",
   "attachments.library.actions.copyError": "Link konnte nicht kopiert werden.",
   "attachments.library.actions.copyUrl": "URL kopieren",

package/src/modules/attachments/i18n/en.json

@@ -5,6 +5,7 @@
   "attachments.errors.maxUploadSize": "Attachment exceeds the maximum upload size.",
   "attachments.errors.publicPartitionBlocked": "Public storage partitions cannot be selected explicitly for this upload.",
   "attachments.errors.quotaExceeded": "Attachment storage quota exceeded for this tenant.",
+  "attachments.errors.selectOrganization": "Select a specific organization before uploading an attachment.",
   "attachments.library.actions.copied": "Link copied.",
   "attachments.library.actions.copyError": "Unable to copy link.",
   "attachments.library.actions.copyUrl": "Copy URL",

package/src/modules/attachments/i18n/es.json

@@ -5,6 +5,7 @@
   "attachments.errors.maxUploadSize": "El archivo adjunto supera el tamaño máximo de carga permitido.",
   "attachments.errors.publicPartitionBlocked": "No se pueden seleccionar explícitamente particiones de almacenamiento públicas para esta carga.",
   "attachments.errors.quotaExceeded": "Se superó la cuota de almacenamiento de adjuntos para este tenant.",
+  "attachments.errors.selectOrganization": "Selecciona una organización específica antes de subir un adjunto.",
   "attachments.library.actions.copied": "Enlace copiado.",
   "attachments.library.actions.copyError": "No se pudo copiar el enlace.",
   "attachments.library.actions.copyUrl": "Copiar URL",

package/src/modules/attachments/i18n/pl.json

@@ -5,6 +5,7 @@
   "attachments.errors.maxUploadSize": "Załącznik przekracza maksymalny dopuszczalny rozmiar przesyłania.",
   "attachments.errors.publicPartitionBlocked": "Nie można jawnie wybrać publicznej partycji do tego przesyłania.",
   "attachments.errors.quotaExceeded": "Przekroczono limit miejsca na załączniki dla tego tenantu.",
+  "attachments.errors.selectOrganization": "Wybierz konkretną organizację przed przesłaniem załącznika.",
   "attachments.library.actions.copied": "Link skopiowany.",
   "attachments.library.actions.copyError": "Nie można skopiować linku.",
   "attachments.library.actions.copyUrl": "Kopiuj URL",

package/src/modules/catalog/api/settings/route.ts

@@ -0,0 +1,165 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import {
+  runCrudMutationGuardAfterSuccess,
+  validateCrudMutationGuard,
+} from '@open-mercato/shared/lib/crud/mutation-guard'
+import type { ModuleConfigService } from '@open-mercato/core/modules/configs/lib/module-config-service'
+import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import {
+  CATALOG_SETTINGS_MODULE_ID,
+  UNIT_PRICE_DISPLAY_ENABLED_DEFAULT,
+  UNIT_PRICE_DISPLAY_ENABLED_KEY,
+} from '../../lib/settings'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['catalog.products.view'] },
+  PUT: { requireAuth: true, requireFeatures: ['catalog.settings.manage'] },
+}
+
+const bodySchema = z.object({
+  unitPriceDisplayEnabled: z.boolean(),
+})
+
+const responseSchema = z.object({
+  unitPriceDisplayEnabled: z.boolean(),
+})
+
+type SettingsContext = {
+  container: Awaited<ReturnType<typeof createRequestContainer>>
+  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>
+  tenantId: string
+  organizationId: string | null
+  actorId: string
+}
+
+async function resolveSettingsContext(req: Request): Promise<SettingsContext> {
+  const container = await createRequestContainer()
+  const auth = await getAuthFromRequest(req)
+  if (!auth || !auth.tenantId) {
+    throw new CrudHttpError(401, { error: 'Unauthorized' })
+  }
+  const actorId =
+    (typeof auth.sub === 'string' && auth.sub.trim().length > 0 && auth.sub) ||
+    (typeof auth.userId === 'string' && auth.userId.trim().length > 0 && auth.userId) ||
+    (typeof auth.keyId === 'string' && auth.keyId.trim().length > 0 && auth.keyId) ||
+    'system'
+  return {
+    container,
+    auth,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId ?? null,
+    actorId,
+  }
+}
+
+async function readUnitPriceDisplayEnabled(context: SettingsContext): Promise<boolean> {
+  const configService = context.container.resolve('moduleConfigService') as ModuleConfigService
+  const value = await configService.getValue<boolean>(
+    CATALOG_SETTINGS_MODULE_ID,
+    UNIT_PRICE_DISPLAY_ENABLED_KEY,
+    { defaultValue: UNIT_PRICE_DISPLAY_ENABLED_DEFAULT, scope: { tenantId: context.tenantId } },
+  )
+  return typeof value === 'boolean' ? value : UNIT_PRICE_DISPLAY_ENABLED_DEFAULT
+}
+
+async function GET(req: Request) {
+  try {
+    const context = await resolveSettingsContext(req)
+    const unitPriceDisplayEnabled = await readUnitPriceDisplayEnabled(context)
+    return NextResponse.json({ unitPriceDisplayEnabled })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    console.error('[catalog/settings.GET] Unexpected error', err)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+async function PUT(req: Request) {
+  try {
+    const context = await resolveSettingsContext(req)
+    const body = bodySchema.parse(await req.json())
+
+    const guardResult = await validateCrudMutationGuard(context.container, {
+      tenantId: context.tenantId,
+      organizationId: context.organizationId,
+      userId: context.actorId,
+      resourceKind: 'catalog.settings',
+      resourceId: UNIT_PRICE_DISPLAY_ENABLED_KEY,
+      operation: 'custom',
+      requestMethod: req.method,
+      requestHeaders: req.headers,
+      mutationPayload: { unitPriceDisplayEnabled: body.unitPriceDisplayEnabled },
+    })
+    if (guardResult && !guardResult.ok) {
+      return NextResponse.json(guardResult.body, { status: guardResult.status })
+    }
+
+    const configService = context.container.resolve('moduleConfigService') as ModuleConfigService
+    await configService.setValue(
+      CATALOG_SETTINGS_MODULE_ID,
+      UNIT_PRICE_DISPLAY_ENABLED_KEY,
+      body.unitPriceDisplayEnabled,
+      { tenantId: context.tenantId },
+    )
+
+    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {
+      await runCrudMutationGuardAfterSuccess(context.container, {
+        tenantId: context.tenantId,
+        organizationId: context.organizationId,
+        userId: context.actorId,
+        resourceKind: 'catalog.settings',
+        resourceId: UNIT_PRICE_DISPLAY_ENABLED_KEY,
+        operation: 'custom',
+        requestMethod: req.method,
+        requestHeaders: req.headers,
+        metadata: guardResult.metadata ?? null,
+      })
+    }
+
+    return NextResponse.json({ unitPriceDisplayEnabled: body.unitPriceDisplayEnabled })
+  } catch (err) {
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    if (err instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Invalid request', details: err.issues }, { status: 400 })
+    }
+    console.error('[catalog/settings.PUT] Unexpected error', err)
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+const getDoc: OpenApiMethodDoc = {
+  summary: 'Read catalog settings',
+  tags: ['Catalog'],
+  responses: [
+    { status: 200, description: 'Catalog settings', schema: responseSchema },
+  ],
+}
+
+const putDoc: OpenApiMethodDoc = {
+  summary: 'Update catalog settings',
+  tags: ['Catalog'],
+  requestBody: { schema: bodySchema },
+  responses: [
+    { status: 200, description: 'Updated catalog settings', schema: responseSchema },
+  ],
+  errors: [{ status: 400, description: 'Invalid request body' }],
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Catalog',
+  summary: 'Catalog module settings',
+  methods: {
+    GET: getDoc,
+    PUT: putDoc,
+  },
+}
+
+export { GET, PUT }

package/src/modules/catalog/backend/config/catalog/page.tsx

@@ -1,11 +1,13 @@
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { PriceKindSettings } from '../../../components/PriceKindSettings'
+import { UnitPriceDisplaySettings } from '../../../components/UnitPriceDisplaySettings'
 
 export default function CatalogConfigurationPage() {
   return (
     <Page>
       <PageBody className="space-y-8">
         <PriceKindSettings />
+        <UnitPriceDisplaySettings />
       </PageBody>
     </Page>
   )

package/src/modules/catalog/components/UnitPriceDisplaySettings.tsx

@@ -0,0 +1,106 @@
+"use client"
+
+import * as React from 'react'
+import { SwitchField } from '@open-mercato/ui/primitives/switch-field'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
+import { flash } from '@open-mercato/ui/backend/FlashMessages'
+import { apiCall, readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+import { raiseCrudError } from '@open-mercato/ui/backend/utils/serverErrors'
+import { useOrganizationScopeVersion } from '@open-mercato/shared/lib/frontend/useOrganizationScope'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
+
+type CatalogSettingsResponse = {
+  unitPriceDisplayEnabled?: boolean
+}
+
+export function UnitPriceDisplaySettings() {
+  const t = useT()
+  const scopeVersion = useOrganizationScopeVersion()
+  const [enabled, setEnabled] = React.useState<boolean | null>(null)
+  const [saving, setSaving] = React.useState(false)
+
+  const loadError = t('catalog.settings.unitPriceDisplay.errors.load', 'Failed to load catalog settings.')
+
+  const load = React.useCallback(async () => {
+    try {
+      const payload = await readApiResultOrThrow<CatalogSettingsResponse>(
+        '/api/catalog/settings',
+        undefined,
+        { errorMessage: loadError, fallback: { unitPriceDisplayEnabled: true } },
+      )
+      setEnabled(payload.unitPriceDisplayEnabled !== false)
+    } catch (err) {
+      console.error('catalog.settings.load failed', err)
+      flash(loadError, 'error')
+      setEnabled(true)
+    }
+  }, [loadError])
+
+  React.useEffect(() => {
+    load().catch(() => {})
+  }, [load, scopeVersion])
+
+  const handleChange = React.useCallback(async (next: boolean) => {
+    const previous = enabled
+    setEnabled(next)
+    setSaving(true)
+    try {
+      // optimistic-lock-exempt: tenant-scoped module-config toggle (single
+      // settings row via ModuleConfigService), not a versioned editable entity —
+      // no updated_at to lock against and no lost-update concern for this admin preference.
+      const call = await apiCall('/api/catalog/settings', {
+        method: 'PUT',
+        headers: { 'content-type': 'application/json' },
+        body: JSON.stringify({ unitPriceDisplayEnabled: next }),
+      })
+      if (!call.ok) {
+        await raiseCrudError(call.response, t('catalog.settings.unitPriceDisplay.errors.save', 'Failed to save catalog settings.'))
+      }
+      flash(t('catalog.settings.messages.saved', 'Settings saved.'), 'success')
+    } catch (err) {
+      console.error('catalog.settings.save failed', err)
+      setEnabled(previous)
+      const message = err instanceof Error
+        ? err.message
+        : t('catalog.settings.unitPriceDisplay.errors.save', 'Failed to save catalog settings.')
+      flash(message, 'error')
+    } finally {
+      setSaving(false)
+    }
+  }, [enabled, t])
+
+  return (
+    <section className="border bg-card text-card-foreground shadow-sm">
+      <div className="border-b px-6 py-4 space-y-1">
+        <h2 className="text-lg font-semibold">
+          {t('catalog.settings.unitPriceDisplay.title', 'Unit price presentation')}
+        </h2>
+        <p className="text-sm text-muted-foreground">
+          {t(
+            'catalog.settings.unitPriceDisplay.description',
+            'Controls whether the EU unit price presentation feature is available on the product form.',
+          )}
+        </p>
+      </div>
+      <div className="px-6 py-4">
+        {enabled === null ? (
+          <div className="flex items-center gap-2 text-sm text-muted-foreground">
+            <Spinner className="h-4 w-4" />
+            {t('catalog.settings.loading', 'Loading…')}
+          </div>
+        ) : (
+          <SwitchField
+            label={t('catalog.settings.unitPriceDisplay.toggleLabel', 'Enable EU unit price presentation')}
+            description={t(
+              'catalog.settings.unitPriceDisplay.toggleDescription',
+              'When off, the EU unit price settings are hidden from every product form. Turn this off for manufacturers or other tenants that do not sell to consumers.',
+            )}
+            checked={enabled}
+            disabled={saving}
+            onCheckedChange={(next) => { void handleChange(next) }}
+          />
+        )}
+      </div>
+    </section>
+  )
+}

package/src/modules/catalog/components/products/ProductUomSection.tsx

@@ -23,6 +23,7 @@ import type {
 import { createProductUnitConversionDraft } from "./productForm";
 import { REFERENCE_UNIT_CODES } from "@open-mercato/shared/lib/units/unitCodes";
 import { toTrimmedOrNull } from "./productFormUtils";
+import { useUnitPriceDisplayEnabled } from "./hooks/useUnitPriceDisplayEnabled";
 
 type UnitDictionaryEntry = {
   id?: string;
@@ -134,6 +135,7 @@ export function ProductUomSection({
   embedded = false,
 }: ProductUomSectionProps) {
   const t = useT();
+  const { enabled: unitPriceDisplayEnabled } = useUnitPriceDisplayEnabled();
   const [unitOptions, setUnitOptions] = React.useState<UnitOption[]>([]);
   const [loadingUnits, setLoadingUnits] = React.useState(false);
   const [errorLoadingUnits, setErrorLoadingUnits] = React.useState(false);
@@ -473,6 +475,7 @@ export function ProductUomSection({
         </div>
       </div>
 
+      {unitPriceDisplayEnabled ? (
       <div className="space-y-3">
         <div className="flex items-center gap-2">
           <Checkbox
@@ -564,6 +567,7 @@ export function ProductUomSection({
           </p>
         ) : null}
       </div>
+      ) : null}
 
       <div className="space-y-3">
         <div className="flex items-center justify-between gap-2">

package/src/modules/catalog/components/products/hooks/useUnitPriceDisplayEnabled.ts

@@ -0,0 +1,39 @@
+"use client"
+
+import { useQuery } from '@tanstack/react-query'
+import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
+
+type CatalogSettingsResponse = {
+  unitPriceDisplayEnabled?: boolean
+}
+
+export type UseUnitPriceDisplayEnabledResult = {
+  enabled: boolean
+  isLoading: boolean
+}
+
+/**
+ * Resolves the tenant-scoped catalog setting that controls whether the EU unit
+ * price presentation feature is available on the product form. Defaults to
+ * enabled while loading (and on failure) so the common retail case is never
+ * hidden by a transient error.
+ */
+export function useUnitPriceDisplayEnabled(): UseUnitPriceDisplayEnabledResult {
+  const query = useQuery({
+    queryKey: ['catalog', 'settings', 'unitPriceDisplayEnabled'],
+    queryFn: async () => {
+      const result = await readApiResultOrThrow<CatalogSettingsResponse>(
+        '/api/catalog/settings',
+        undefined,
+        { errorMessage: 'Failed to load catalog settings.', fallback: { unitPriceDisplayEnabled: true } },
+      )
+      return result.unitPriceDisplayEnabled !== false
+    },
+    staleTime: 60_000,
+  })
+
+  return {
+    enabled: query.data ?? true,
+    isLoading: query.isLoading,
+  }
+}

package/src/modules/catalog/i18n/de.json

@@ -614,6 +614,14 @@
   "catalog.search.priceKind.promotion": "Aktion",
   "catalog.search.status.inactive": "Inaktiv",
   "catalog.search.variant.default": "Standard",
+  "catalog.settings.loading": "Wird geladen…",
+  "catalog.settings.messages.saved": "Einstellungen gespeichert.",
+  "catalog.settings.unitPriceDisplay.description": "Legt fest, ob die EU-Grundpreisdarstellung im Produktformular verfügbar ist.",
+  "catalog.settings.unitPriceDisplay.errors.load": "Katalogeinstellungen konnten nicht geladen werden.",
+  "catalog.settings.unitPriceDisplay.errors.save": "Katalogeinstellungen konnten nicht gespeichert werden.",
+  "catalog.settings.unitPriceDisplay.title": "Grundpreisdarstellung",
+  "catalog.settings.unitPriceDisplay.toggleDescription": "Wenn deaktiviert, werden die EU-Grundpreiseinstellungen in jedem Produktformular ausgeblendet. Deaktivieren Sie dies für Hersteller oder andere Mandanten, die nicht an Verbraucher verkaufen.",
+  "catalog.settings.unitPriceDisplay.toggleLabel": "EU-Grundpreisdarstellung aktivieren",
   "catalog.stats.active": "Aktiv",
   "catalog.stats.categories": "Kategorien",
   "catalog.stats.products": "Produkte",

package/src/modules/catalog/i18n/en.json

@@ -614,6 +614,14 @@
   "catalog.search.priceKind.promotion": "Promotion",
   "catalog.search.status.inactive": "Inactive",
   "catalog.search.variant.default": "Default",
+  "catalog.settings.loading": "Loading…",
+  "catalog.settings.messages.saved": "Settings saved.",
+  "catalog.settings.unitPriceDisplay.description": "Controls whether the EU unit price presentation feature is available on the product form.",
+  "catalog.settings.unitPriceDisplay.errors.load": "Failed to load catalog settings.",
+  "catalog.settings.unitPriceDisplay.errors.save": "Failed to save catalog settings.",
+  "catalog.settings.unitPriceDisplay.title": "Unit price presentation",
+  "catalog.settings.unitPriceDisplay.toggleDescription": "When off, the EU unit price settings are hidden from every product form. Turn this off for manufacturers or other tenants that do not sell to consumers.",
+  "catalog.settings.unitPriceDisplay.toggleLabel": "Enable EU unit price presentation",
   "catalog.stats.active": "Active",
   "catalog.stats.categories": "Categories",
   "catalog.stats.products": "Products",