@open-mercato/core 0.6.6-develop.6507.1.cc8b36505d → 0.6.6-develop.6515.1.01911d00e2

package/src/modules/inbox_ops/api/proposals/[id]/translate/route.ts

@@ -13,7 +13,7 @@ import {
 } from '../../../routeHelpers'
 
 export const metadata = {
-  POST: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.view'] },
+  POST: { requireAuth: true, requireFeatures: ['inbox_ops.proposals.manage'] },
 }
 
 export async function POST(req: Request) {

package/src/modules/integrations/AGENTS.md

@@ -11,6 +11,7 @@ The `integrations` module is the foundation layer for all external connectors (p
 - **Always scope by organizationId + tenantId** — every entity query and service call
 - **Use `findWithDecryption`/`findOneWithDecryption`** for credential reads
 - **New providers MUST support provider-owned env preconfiguration** when credentials/settings are deployment-managed; implement it in the provider package, not in core
+- **Secret-bearing credential fields MUST use `secret`, `oauth`, or `ssh_keypair`** — never declare tokens, passwords, or private keys as `text`, and never embed credentials in a `url` field
 - **Health check services** must be registered in DI by the provider module, not by integrations
 - **API routes must export `openApi`** for documentation generation
 - **All user-facing strings** via i18n keys in `i18n/en.json`

package/src/modules/integrations/lib/credentials-field-validation.ts

@@ -17,6 +17,7 @@ export function isValidCredentialUrl(value: string): boolean {
   }
   if (!ALLOWED_CREDENTIAL_URL_PROTOCOLS.has(parsed.protocol)) return false
   if (!parsed.hostname) return false
+  if (parsed.username || parsed.password) return false
   return true
 }
 

package/src/modules/integrations/lib/credentials-masking.ts

@@ -26,6 +26,19 @@ function isSecretField(type: CredentialFieldType): boolean {
   return SECRET_CREDENTIAL_FIELD_TYPES.has(type)
 }
 
+function redactUrlUserinfo(value: unknown): unknown {
+  if (typeof value !== 'string') return value
+  try {
+    const parsed = new URL(value)
+    if (!parsed.username && !parsed.password) return value
+    parsed.username = ''
+    parsed.password = ''
+    return parsed.toString()
+  } catch {
+    return value
+  }
+}
+
 function hasPresentValue(value: unknown): boolean {
   if (value === undefined || value === null) return false
   if (typeof value === 'string') return value.length > 0
@@ -53,6 +66,10 @@ export function maskSecretCredentials(
   const secretFieldsConfigured: Record<string, boolean> = {}
 
   for (const field of schema?.fields ?? []) {
+    if (field.type === 'url') {
+      credentials[field.key] = redactUrlUserinfo(credentials[field.key])
+      continue
+    }
     if (!isSecretField(field.type)) continue
     const configured = hasPresentValue(credentials[field.key])
     secretFieldsConfigured[field.key] = configured

package/src/modules/notifications/lib/notificationRecipients.ts

@@ -34,6 +34,30 @@ function collectUsersWithFeature(
   }
 }
 
+export async function getScopedNotificationRecipientUserIds(
+  db: Kysely<any>,
+  tenantId: string,
+  organizationId: string | null,
+  recipientUserIds: string[],
+): Promise<string[]> {
+  const builder: any = db
+  let query = builder
+    .selectFrom('users')
+    .where('users.id', 'in', recipientUserIds)
+    .where('users.deleted_at', 'is', null)
+    .where('users.tenant_id', '=', tenantId)
+
+  if (organizationId) {
+    query = query.where('users.organization_id', '=', organizationId)
+  }
+
+  const users = await query
+    .select('users.id as user_id')
+    .execute() as Array<{ user_id: string }>
+
+  return users.map((user) => user.user_id)
+}
+
 export async function getRecipientUserIdsForRole(
   db: Kysely<any>,
   tenantId: string,

package/src/modules/notifications/lib/notificationService.ts

@@ -14,7 +14,11 @@ import {
   type NotificationTenantContext,
 } from './notificationFactory'
 import { toNotificationDto } from './notificationMapper'
-import { getRecipientUserIdsForFeature, getRecipientUserIdsForRole } from './notificationRecipients'
+import {
+  getRecipientUserIdsForFeature,
+  getRecipientUserIdsForRole,
+  getScopedNotificationRecipientUserIds,
+} from './notificationRecipients'
 import { assertSafeNotificationHref, sanitizeNotificationActions } from './safeHref'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -34,6 +38,23 @@ function normalizeOrgScope(organizationId: string | null | undefined): string |
   return organizationId ?? null
 }
 
+async function assertNotificationRecipientsInScope(
+  em: EntityManager,
+  recipientUserIds: string[],
+  ctx: NotificationServiceContext,
+): Promise<void> {
+  const scopedRecipientUserIds = await getScopedNotificationRecipientUserIds(
+    getDb(em),
+    ctx.tenantId,
+    normalizeOrgScope(ctx.organizationId),
+    recipientUserIds,
+  )
+
+  if (scopedRecipientUserIds.length !== recipientUserIds.length) {
+    throw new CrudHttpError(404, { error: 'Notification recipient not found' })
+  }
+}
+
 function applyNotificationContent(
   notification: Notification,
   input: NotificationContentInput,
@@ -214,6 +235,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       const { recipientUserId, ...content } = input
       const writeEm = rootEm.fork()
       const notification = await writeEm.transactional(async (tx) => {
+        await assertNotificationRecipientsInScope(tx, [recipientUserId], ctx)
         const entity = await createOrRefreshNotification(tx, content, recipientUserId, ctx)
         await tx.flush()
         return entity
@@ -237,6 +259,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       const writeEm = rootEm.fork()
 
       await writeEm.transactional(async (tx) => {
+        await assertNotificationRecipientsInScope(tx, recipientUserIds, ctx)
         for (const recipientUserId of recipientUserIds) {
           const notification = await createOrRefreshNotification(tx, content, recipientUserId, ctx)
           notifications.push(notification)

package/src/modules/sales/commands/returns.ts

@@ -4,6 +4,7 @@ import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { LockMode } from '@mikro-orm/core'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import type { CrudEventsConfig } from '@open-mercato/shared/lib/crud/types'
@@ -65,6 +66,28 @@ const returnCrudEvents: CrudEventsConfig = {
   }),
 }
 
+type OrderCacheRecord = Pick<SalesOrder, 'id' | 'organizationId' | 'tenantId'>
+
+/**
+ * Return mutations update the order aggregate, which is also the cache resource
+ * used by the order-lines and order-adjustments routes. Invalidate it after
+ * each committed return lifecycle change so reloads receive its fresh
+ * `updatedAt` optimistic-lock token.
+ */
+async function invalidateOrderCache(
+  container: Parameters<typeof invalidateCrudCache>[0],
+  order: OrderCacheRecord,
+  fallbackTenant: string | null,
+): Promise<void> {
+  await invalidateCrudCache(
+    container,
+    SALES_RESOURCE_KIND_ORDER,
+    { id: order.id, organizationId: order.organizationId, tenantId: order.tenantId },
+    fallbackTenant,
+    'updated',
+  )
+}
+
 function toNumeric(value: unknown): number {
   if (typeof value === 'number' && Number.isFinite(value)) return value
   if (typeof value === 'string' && value.trim().length) {
@@ -618,7 +641,7 @@ const createReturnCommand: CommandHandler<ReturnCreateInput, { returnId: string
     }
 
     const salesCalculationService = ctx.container.resolve<SalesCalculationService>('salesCalculationService')
-    const { header, createdLines } = await em.transactional(async (tx) => {
+    const { header, createdLines, order } = await em.transactional(async (tx) => {
       const order = await findOneWithDecryption(
         tx,
         SalesOrder,
@@ -769,9 +792,11 @@ const createReturnCommand: CommandHandler<ReturnCreateInput, { returnId: string
 
       await tx.flush()
 
-      return { header: entity, createdLines: createdReturnLines }
+      return { header: entity, createdLines: createdReturnLines, order }
     })
 
+    await invalidateOrderCache(ctx.container, order, ctx.auth?.tenantId ?? null)
+
     const dataEngine = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
       dataEngine,
@@ -827,6 +852,11 @@ const createReturnCommand: CommandHandler<ReturnCreateInput, { returnId: string
     const em = (ctx.container.resolve('em') as EntityManager).fork()
     const salesCalculationService = ctx.container.resolve<SalesCalculationService>('salesCalculationService')
     await reverseReturnEffects(em, salesCalculationService, after)
+    await invalidateOrderCache(ctx.container, {
+      id: after.orderId,
+      organizationId: after.organizationId,
+      tenantId: after.tenantId,
+    }, ctx.auth?.tenantId ?? null)
   },
   redo: async ({ ctx, logEntry }) => {
     const after = resolveRedoSnapshot<ReturnSnapshot>(logEntry)
@@ -849,6 +879,12 @@ const createReturnCommand: CommandHandler<ReturnCreateInput, { returnId: string
       throw new CrudHttpError(404, { error: 'sales.returns.orderMissing' })
     }
 
+    await invalidateOrderCache(ctx.container, {
+      id: after.orderId,
+      organizationId: after.organizationId,
+      tenantId: after.tenantId,
+    }, ctx.auth?.tenantId ?? null)
+
     const dataEngine = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
       dataEngine,
@@ -1047,6 +1083,11 @@ const deleteReturnCommand: CommandHandler<ReturnDeleteInput, { returnId: string
     await enforceSalesDocumentOptimisticLock(ctx, header, SALES_RESOURCE_KIND_RETURN)
 
     await reverseReturnEffects(em, salesCalculationService, snapshot)
+    await invalidateOrderCache(ctx.container, {
+      id: snapshot.orderId,
+      organizationId: snapshot.organizationId,
+      tenantId: snapshot.tenantId,
+    }, ctx.auth?.tenantId ?? null)
 
     const dataEngine = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
@@ -1110,6 +1151,12 @@ const deleteReturnCommand: CommandHandler<ReturnDeleteInput, { returnId: string
     )
     if (!header) return
 
+    await invalidateOrderCache(ctx.container, {
+      id: before.orderId,
+      organizationId: before.organizationId,
+      tenantId: before.tenantId,
+    }, ctx.auth?.tenantId ?? null)
+
     const dataEngine = ctx.container.resolve('dataEngine') as DataEngine
     await emitCrudSideEffects({
       dataEngine,