@open-mercato/core 0.6.6-develop.6542.1.fee3e68aa6 → 0.6.6-develop.6551.1.1511bfa890

package/dist/modules/sync_excel/lib/upload-storage.js

@@ -1,4 +1,5 @@
-import { promises as fs } from "fs";
+import { createReadStream, promises as fs } from "fs";
+import { Readable } from "stream";
 import { randomUUID } from "crypto";
 import { Attachment, AttachmentPartition } from "../../attachments/data/entities.js";
 import { buildAttachmentFileUrl } from "../../attachments/lib/imageUrls.js";
@@ -59,8 +60,26 @@ async function readSyncExcelUploadBuffer(attachment) {
     throw error;
   }
 }
+async function createSyncExcelUploadReadStream(attachment) {
+  const inlineCsvBase64 = attachment.storageMetadata?.inlineCsvBase64;
+  try {
+    const absolutePath = resolveAttachmentAbsolutePath(
+      attachment.partitionCode,
+      attachment.storagePath,
+      attachment.storageDriver
+    );
+    await fs.access(absolutePath);
+    return createReadStream(absolutePath);
+  } catch (error) {
+    if (typeof inlineCsvBase64 === "string" && inlineCsvBase64.length > 0) {
+      return Readable.from([Buffer.from(inlineCsvBase64, "base64")]);
+    }
+    throw error;
+  }
+}
 export {
   createSyncExcelUploadAttachment,
+  createSyncExcelUploadReadStream,
   readSyncExcelUploadBuffer
 };
 //# sourceMappingURL=upload-storage.js.map

package/dist/modules/sync_excel/lib/upload-storage.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/sync_excel/lib/upload-storage.ts"],
-  "sourcesContent": ["import { promises as fs } from 'fs'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../../attachments/data/entities'\nimport { buildAttachmentFileUrl } from '../../attachments/lib/imageUrls'\nimport { ensureDefaultPartitions } from '../../attachments/lib/partitions'\nimport { resolveAttachmentAbsolutePath, storePartitionFile } from '../../attachments/lib/storage'\n\nconst SYNC_EXCEL_ATTACHMENT_ENTITY_ID = 'sync_excel:upload'\nconst SYNC_EXCEL_PARTITION_CODE = 'privateAttachments'\n\nexport async function createSyncExcelUploadAttachment(input: {\n  em: EntityManager\n  uploadId: string\n  organizationId: string\n  tenantId: string\n  fileName: string\n  mimeType: string\n  buffer: Buffer\n}): Promise<Attachment> {\n  await ensureDefaultPartitions(input.em)\n\n  // Attachment partitions are global storage configuration, not tenant-scoped payload data.\n  const partition = await input.em.findOne(AttachmentPartition, { code: SYNC_EXCEL_PARTITION_CODE })\n  if (!partition) {\n    throw new Error('Storage partition is not configured.')\n  }\n\n  const stored = await storePartitionFile({\n    partitionCode: partition.code,\n    orgId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    buffer: input.buffer,\n  })\n\n  const attachmentId = randomUUID()\n  const attachment = input.em.create(Attachment, {\n    id: attachmentId,\n    entityId: SYNC_EXCEL_ATTACHMENT_ENTITY_ID,\n    recordId: input.uploadId,\n    organizationId: input.organizationId,\n    tenantId: input.tenantId,\n    partitionCode: partition.code,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: stored.storagePath,\n    url: buildAttachmentFileUrl(attachmentId),\n    storageMetadata: {\n      module: 'sync_excel',\n      temporary: true,\n      uploadId: input.uploadId,\n    },\n  })\n\n  input.em.persist(attachment)\n  await input.em.flush()\n\n  return attachment\n}\n\nexport async function readSyncExcelUploadBuffer(\n  attachment: Pick<Attachment, 'partitionCode' | 'storagePath' | 'storageDriver' | 'storageMetadata'>,\n): Promise<Buffer> {\n  const inlineCsvBase64 = attachment.storageMetadata?.inlineCsvBase64\n  const absolutePath = resolveAttachmentAbsolutePath(\n    attachment.partitionCode,\n    attachment.storagePath,\n    attachment.storageDriver,\n  )\n  try {\n    return await fs.readFile(absolutePath)\n  } catch (error) {\n    if (typeof inlineCsvBase64 === 'string' && inlineCsvBase64.length > 0) {\n      return Buffer.from(inlineCsvBase64, 'base64')\n    }\n    throw error\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,YAAY,UAAU;AAC/B,SAAS,kBAAkB;AAE3B,SAAS,YAAY,2BAA2B;AAChD,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B,0BAA0B;AAElE,MAAM,kCAAkC;AACxC,MAAM,4BAA4B;AAElC,eAAsB,gCAAgC,OAQ9B;AACtB,QAAM,wBAAwB,MAAM,EAAE;AAGtC,QAAM,YAAY,MAAM,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjG,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,SAAS,MAAM,mBAAmB;AAAA,IACtC,eAAe,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,QAAM,eAAe,WAAW;AAChC,QAAM,aAAa,MAAM,GAAG,OAAO,YAAY;AAAA,IAC7C,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,eAAe,UAAU;AAAA,IACzB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa,OAAO;AAAA,IACpB,KAAK,uBAAuB,YAAY;AAAA,IACxC,iBAAiB;AAAA,MACf,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,UAAU,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,QAAM,GAAG,QAAQ,UAAU;AAC3B,QAAM,MAAM,GAAG,MAAM;AAErB,SAAO;AACT;AAEA,eAAsB,0BACpB,YACiB;AACjB,QAAM,kBAAkB,WAAW,iBAAiB;AACpD,QAAM,eAAe;AAAA,IACnB,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACA,MAAI;AACF,WAAO,MAAM,GAAG,SAAS,YAAY;AAAA,EACvC,SAAS,OAAO;AACd,QAAI,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,GAAG;AACrE,aAAO,OAAO,KAAK,iBAAiB,QAAQ;AAAA,IAC9C;AACA,UAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { createReadStream, promises as fs } from 'fs'\nimport { Readable } from 'stream'\nimport { randomUUID } from 'crypto'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { Attachment, AttachmentPartition } from '../../attachments/data/entities'\nimport { buildAttachmentFileUrl } from '../../attachments/lib/imageUrls'\nimport { ensureDefaultPartitions } from '../../attachments/lib/partitions'\nimport { resolveAttachmentAbsolutePath, storePartitionFile } from '../../attachments/lib/storage'\n\nconst SYNC_EXCEL_ATTACHMENT_ENTITY_ID = 'sync_excel:upload'\nconst SYNC_EXCEL_PARTITION_CODE = 'privateAttachments'\n\nexport async function createSyncExcelUploadAttachment(input: {\n  em: EntityManager\n  uploadId: string\n  organizationId: string\n  tenantId: string\n  fileName: string\n  mimeType: string\n  buffer: Buffer\n}): Promise<Attachment> {\n  await ensureDefaultPartitions(input.em)\n\n  // Attachment partitions are global storage configuration, not tenant-scoped payload data.\n  const partition = await input.em.findOne(AttachmentPartition, { code: SYNC_EXCEL_PARTITION_CODE })\n  if (!partition) {\n    throw new Error('Storage partition is not configured.')\n  }\n\n  const stored = await storePartitionFile({\n    partitionCode: partition.code,\n    orgId: input.organizationId,\n    tenantId: input.tenantId,\n    fileName: input.fileName,\n    buffer: input.buffer,\n  })\n\n  const attachmentId = randomUUID()\n  const attachment = input.em.create(Attachment, {\n    id: attachmentId,\n    entityId: SYNC_EXCEL_ATTACHMENT_ENTITY_ID,\n    recordId: input.uploadId,\n    organizationId: input.organizationId,\n    tenantId: input.tenantId,\n    partitionCode: partition.code,\n    fileName: input.fileName,\n    mimeType: input.mimeType,\n    fileSize: input.buffer.length,\n    storageDriver: partition.storageDriver || 'local',\n    storagePath: stored.storagePath,\n    url: buildAttachmentFileUrl(attachmentId),\n    storageMetadata: {\n      module: 'sync_excel',\n      temporary: true,\n      uploadId: input.uploadId,\n    },\n  })\n\n  input.em.persist(attachment)\n  await input.em.flush()\n\n  return attachment\n}\n\nexport async function readSyncExcelUploadBuffer(\n  attachment: Pick<Attachment, 'partitionCode' | 'storagePath' | 'storageDriver' | 'storageMetadata'>,\n): Promise<Buffer> {\n  const inlineCsvBase64 = attachment.storageMetadata?.inlineCsvBase64\n  const absolutePath = resolveAttachmentAbsolutePath(\n    attachment.partitionCode,\n    attachment.storagePath,\n    attachment.storageDriver,\n  )\n  try {\n    return await fs.readFile(absolutePath)\n  } catch (error) {\n    if (typeof inlineCsvBase64 === 'string' && inlineCsvBase64.length > 0) {\n      return Buffer.from(inlineCsvBase64, 'base64')\n    }\n    throw error\n  }\n}\n\nexport async function createSyncExcelUploadReadStream(\n  attachment: Pick<Attachment, 'partitionCode' | 'storagePath' | 'storageDriver' | 'storageMetadata'>,\n): Promise<Readable> {\n  const inlineCsvBase64 = attachment.storageMetadata?.inlineCsvBase64\n\n  try {\n    const absolutePath = resolveAttachmentAbsolutePath(\n      attachment.partitionCode,\n      attachment.storagePath,\n      attachment.storageDriver,\n    )\n    await fs.access(absolutePath)\n    return createReadStream(absolutePath)\n  } catch (error) {\n    if (typeof inlineCsvBase64 === 'string' && inlineCsvBase64.length > 0) {\n      return Readable.from([Buffer.from(inlineCsvBase64, 'base64')])\n    }\n    throw error\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,kBAAkB,YAAY,UAAU;AACjD,SAAS,gBAAgB;AACzB,SAAS,kBAAkB;AAE3B,SAAS,YAAY,2BAA2B;AAChD,SAAS,8BAA8B;AACvC,SAAS,+BAA+B;AACxC,SAAS,+BAA+B,0BAA0B;AAElE,MAAM,kCAAkC;AACxC,MAAM,4BAA4B;AAElC,eAAsB,gCAAgC,OAQ9B;AACtB,QAAM,wBAAwB,MAAM,EAAE;AAGtC,QAAM,YAAY,MAAM,MAAM,GAAG,QAAQ,qBAAqB,EAAE,MAAM,0BAA0B,CAAC;AACjG,MAAI,CAAC,WAAW;AACd,UAAM,IAAI,MAAM,sCAAsC;AAAA,EACxD;AAEA,QAAM,SAAS,MAAM,mBAAmB;AAAA,IACtC,eAAe,UAAU;AAAA,IACzB,OAAO,MAAM;AAAA,IACb,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,QAAQ,MAAM;AAAA,EAChB,CAAC;AAED,QAAM,eAAe,WAAW;AAChC,QAAM,aAAa,MAAM,GAAG,OAAO,YAAY;AAAA,IAC7C,IAAI;AAAA,IACJ,UAAU;AAAA,IACV,UAAU,MAAM;AAAA,IAChB,gBAAgB,MAAM;AAAA,IACtB,UAAU,MAAM;AAAA,IAChB,eAAe,UAAU;AAAA,IACzB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM;AAAA,IAChB,UAAU,MAAM,OAAO;AAAA,IACvB,eAAe,UAAU,iBAAiB;AAAA,IAC1C,aAAa,OAAO;AAAA,IACpB,KAAK,uBAAuB,YAAY;AAAA,IACxC,iBAAiB;AAAA,MACf,QAAQ;AAAA,MACR,WAAW;AAAA,MACX,UAAU,MAAM;AAAA,IAClB;AAAA,EACF,CAAC;AAED,QAAM,GAAG,QAAQ,UAAU;AAC3B,QAAM,MAAM,GAAG,MAAM;AAErB,SAAO;AACT;AAEA,eAAsB,0BACpB,YACiB;AACjB,QAAM,kBAAkB,WAAW,iBAAiB;AACpD,QAAM,eAAe;AAAA,IACnB,WAAW;AAAA,IACX,WAAW;AAAA,IACX,WAAW;AAAA,EACb;AACA,MAAI;AACF,WAAO,MAAM,GAAG,SAAS,YAAY;AAAA,EACvC,SAAS,OAAO;AACd,QAAI,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,GAAG;AACrE,aAAO,OAAO,KAAK,iBAAiB,QAAQ;AAAA,IAC9C;AACA,UAAM;AAAA,EACR;AACF;AAEA,eAAsB,gCACpB,YACmB;AACnB,QAAM,kBAAkB,WAAW,iBAAiB;AAEpD,MAAI;AACF,UAAM,eAAe;AAAA,MACnB,WAAW;AAAA,MACX,WAAW;AAAA,MACX,WAAW;AAAA,IACb;AACA,UAAM,GAAG,OAAO,YAAY;AAC5B,WAAO,iBAAiB,YAAY;AAAA,EACtC,SAAS,OAAO;AACd,QAAI,OAAO,oBAAoB,YAAY,gBAAgB,SAAS,GAAG;AACrE,aAAO,SAAS,KAAK,CAAC,OAAO,KAAK,iBAAiB,QAAQ,CAAC,CAAC;AAAA,IAC/D;AACA,UAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/generated/entities/gateway_session_initialization/index.ts

@@ -0,0 +1,10 @@
+export const id = "id";
+export const operation_key = "operation_key";
+export const provider_key = "provider_key";
+export const claim_token = "claim_token";
+export const claimed_at = "claimed_at";
+export const gateway_transaction_id = "gateway_transaction_id";
+export const organization_id = "organization_id";
+export const tenant_id = "tenant_id";
+export const created_at = "created_at";
+export const updated_at = "updated_at";

package/generated/entities.ids.generated.ts

@@ -267,6 +267,7 @@ export const M = {
     },
     "payment_gateways": {
       "gateway_transaction": "payment_gateways:gateway_transaction",
+      "gateway_session_initialization": "payment_gateways:gateway_session_initialization",
       "webhook_processed_event": "payment_gateways:webhook_processed_event"
     },
     "shipping_carriers": {

package/generated/entity-fields-registry.ts

@@ -1225,6 +1225,18 @@ export const entityFieldsRegistry: Record<string, Record<string, string>> = {
       "updated_at": "updated_at",
       "value": "value"
     },
+    "gateway_session_initialization": {
+      "id": "id",
+      "operation_key": "operation_key",
+      "provider_key": "provider_key",
+      "claim_token": "claim_token",
+      "claimed_at": "claimed_at",
+      "gateway_transaction_id": "gateway_transaction_id",
+      "organization_id": "organization_id",
+      "tenant_id": "tenant_id",
+      "created_at": "created_at",
+      "updated_at": "updated_at"
+    },
     "gateway_transaction": {
       "id": "id",
       "payment_id": "payment_id",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.6-develop.6542.1.fee3e68aa6",
+  "version": "0.6.6-develop.6551.1.1511bfa890",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -253,16 +253,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6542.1.fee3e68aa6",
-    "@open-mercato/shared": "0.6.6-develop.6542.1.fee3e68aa6",
-    "@open-mercato/ui": "0.6.6-develop.6542.1.fee3e68aa6",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/shared": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/ui": "0.6.6-develop.6551.1.1511bfa890",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.6-develop.6542.1.fee3e68aa6",
-    "@open-mercato/shared": "0.6.6-develop.6542.1.fee3e68aa6",
-    "@open-mercato/ui": "0.6.6-develop.6542.1.fee3e68aa6",
+    "@open-mercato/ai-assistant": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/shared": "0.6.6-develop.6551.1.1511bfa890",
+    "@open-mercato/ui": "0.6.6-develop.6551.1.1511bfa890",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^6.9.1",
     "@testing-library/react": "^16.3.1",

package/src/modules/api_keys/api/keys/route.ts

@@ -299,10 +299,15 @@ const crud = makeCrudRoute<
 
       const allowedIds = ctx.organizationScope?.allowedIds ?? null
       const organizationId = input.organizationId ?? ctx.selectedOrganizationId ?? auth.orgId ?? null
-      if (organizationId && Array.isArray(allowedIds) && allowedIds.length > 0) {
-        if (!allowedIds.includes(organizationId)) {
-          throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
-        }
+      const isSuperAdmin = await resolveIsSuperAdmin(scopedCtx)
+      if (
+        !isOrganizationAccessAllowed({
+          isSuperAdmin,
+          allowedOrganizationIds: allowedIds,
+          targetOrganizationId: organizationId,
+        })
+      ) {
+        throw json({ error: translate('api_keys.errors.organizationOutOfScope', 'Organization out of scope') }, { status: 403 })
       }
       scopedCtx.__apiKeyOrganizationId = organizationId ?? null
 

package/src/modules/attachments/components/AttachmentContentPreview.tsx

@@ -1,6 +1,7 @@
 import * as React from 'react'
 import { MarkdownContent } from '@open-mercato/ui/backend/markdown'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 
 type Props = {
   content?: string | null
@@ -25,12 +26,6 @@ export function AttachmentContentPreview({
   const [tab, setTab] = React.useState<'source' | 'preview'>('source')
   const text = (content ?? '').trim()
 
-  // ARIA IDs for accessibility
-  const sourceTabId = 'attachment-content-preview-tab-source'
-  const previewTabId = 'attachment-content-preview-tab-preview'
-  const sourcePanelId = 'attachment-content-preview-panel-source'
-  const previewPanelId = 'attachment-content-preview-panel-preview'
-
   if (!text) {
     return <div className="text-xs text-muted-foreground italic">{emptyLabel}</div>
   }
@@ -41,47 +36,18 @@ export function AttachmentContentPreview({
   return (
     <div className="space-y-2">
       {/* Tab Navigation */}
-      <div className="border-b border-border">
-        <nav className="flex items-center gap-4 text-xs" role="tablist" aria-label="Content preview mode">
-          <button
-            type="button"
-            id={sourceTabId}
-            role="tab"
-            aria-selected={tab === 'source'}
-            aria-controls={sourcePanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'source'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('source')}
-          >
-            {sourceLabel}
-          </button>
-          <button
-            type="button"
-            id={previewTabId}
-            role="tab"
-            aria-selected={tab === 'preview'}
-            aria-controls={previewPanelId}
-            className={`-mb-px border-b-2 px-0 pb-2 font-medium transition-colors ${
-              tab === 'preview'
-                ? 'border-accent-indigo text-foreground'
-                : 'border-transparent text-muted-foreground hover:text-foreground'
-            }`}
-            onClick={() => setTab('preview')}
-          >
-            {previewLabel}
-          </button>
-        </nav>
-      </div>
+      <Tabs value={tab} onValueChange={(value) => setTab(value as 'source' | 'preview')} variant="underline">
+        <TabsList className="w-full">
+          <TabsTrigger value="source">{sourceLabel}</TabsTrigger>
+          <TabsTrigger value="preview">{previewLabel}</TabsTrigger>
+        </TabsList>
+      </Tabs>
 
       {/* Tab Panels */}
       {tab === 'source' ? (
         <div
           role="tabpanel"
-          id={sourcePanelId}
-          aria-labelledby={sourceTabId}
+          aria-label={sourceLabel}
           data-testid="attachment-content-preview"
           className="whitespace-pre-wrap text-sm text-muted-foreground"
         >
@@ -90,8 +56,7 @@ export function AttachmentContentPreview({
       ) : (
         <div
           role="tabpanel"
-          id={previewPanelId}
-          aria-labelledby={previewTabId}
+          aria-label={previewLabel}
           data-testid="markdown-preview"
         >
           <MarkdownContent

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -4,6 +4,7 @@ import React from 'react'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { readApiResultOrThrow } from '@open-mercato/ui/backend/utils/apiCall'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Tabs, TabsList, TabsTrigger } from '@open-mercato/ui/primitives/tabs'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { ActionLogItem } from '../../components/AuditLogsActions'
 import { AuditLogsActions } from '../../components/AuditLogsActions'
@@ -182,28 +183,17 @@ export default function AuditLogsPage() {
   return (
     <Page>
       <PageBody>
-        <div className="mb-6 border-b border-border">
-      <nav className="flex items-center gap-6 text-sm" role="tablist" aria-label={t('audit_logs.tabs.label')}>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'actions'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'actions' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('actions')}
-            >
-              {t('audit_logs.actions.title')}
-            </button>
-            <button
-              type="button"
-              role="tab"
-              aria-selected={tab === 'access'}
-              className={`relative -mb-px border-b-2 px-0 pb-3 pt-2 font-medium transition-colors ${tab === 'access' ? 'border-accent-indigo text-foreground' : 'border-transparent text-muted-foreground hover:text-foreground'}`}
-              onClick={() => setTab('access')}
-            >
-              {t('audit_logs.access.title')}
-            </button>
-          </nav>
-        </div>
+        <Tabs
+          value={tab}
+          onValueChange={(value) => setTab(value as TabOption)}
+          variant="underline"
+          className="mb-6"
+        >
+          <TabsList className="w-full flex-wrap" aria-label={t('audit_logs.tabs.label')}>
+            <TabsTrigger value="actions">{t('audit_logs.actions.title')}</TabsTrigger>
+            <TabsTrigger value="access">{t('audit_logs.access.title')}</TabsTrigger>
+          </TabsList>
+        </Tabs>
 
         {error && <div className="mb-4 rounded-md border border-status-error-border bg-status-error-bg p-3 text-sm text-status-error-text">{error}</div>}
 

package/src/modules/auth/api/autologin.ts

@@ -0,0 +1,100 @@
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
+import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { buildSafeRedirectResponse, resolveTrustedRedirectBase } from '@open-mercato/core/modules/auth/lib/requestRedirect'
+import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
+import { resolveAutoLoginCredentials } from '@open-mercato/core/modules/auth/lib/autologin'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
+
+export const metadata = { requireAuth: false }
+
+const accessTokenMaxAgeSeconds = 60 * 60 * 8
+const logger = createLogger('auth').child({ component: 'autologin' })
+
+// Demo-only convenience: when OM_AUTOLOGIN_* credentials are configured, sign the
+// visitor in with those credentials and redirect into the app. Gated entirely
+// behind env vars — the homepage only routes here when they are set. On any
+// failure (feature off, bad credentials) it falls back to the manual login form
+// so a misconfigured demo can never loop.
+export async function GET(req: Request) {
+  const url = new URL(req.url)
+  const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin
+  const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/backend')
+
+  const credentials = resolveAutoLoginCredentials()
+  if (!credentials) {
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  // Already signed in — go straight to the app instead of re-issuing a session.
+  const existing = await getAuthFromRequest(req)
+  if (existing) {
+    return buildSafeRedirectResponse(req, redirectTo)
+  }
+
+  const container = await createRequestContainer()
+  const auth = container.resolve<AuthService>('authService')
+
+  let user = null
+  if (credentials.tenantId) {
+    user = await auth.findUserByEmailAndTenant(credentials.email, credentials.tenantId)
+  } else {
+    const users = await auth.findUsersByEmail(credentials.email)
+    user = users.length === 1 ? users[0] : null
+  }
+
+  const ok = await auth.verifyPassword(user, credentials.password)
+  if (!user || !ok) {
+    // Misconfigured demo credentials — never loop; drop to the manual form.
+    logger.warn('OM_AUTOLOGIN credentials did not resolve to a single valid user; falling back to login')
+    return buildSafeRedirectResponse(req, '/login')
+  }
+
+  const resolvedTenantId = credentials.tenantId ?? (user.tenantId ? String(user.tenantId) : null)
+  const roles = await auth.getUserRoles(user, resolvedTenantId)
+  await auth.updateLastLoginAt(user)
+  const expiresAt = new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)
+  const { session } = await auth.createSession(user, expiresAt)
+  const token = signJwt({
+    sub: String(user.id),
+    sid: String(session.id),
+    tenantId: resolvedTenantId,
+    orgId: user.organizationId ? String(user.organizationId) : null,
+    email: user.email,
+    roles,
+  })
+  void emitAuthEvent('auth.login.success', {
+    id: String(user.id),
+    email: user.email,
+    tenantId: resolvedTenantId,
+    organizationId: user.organizationId ? String(user.organizationId) : null,
+  }).catch(() => undefined)
+
+  const res = buildSafeRedirectResponse(req, redirectTo)
+  res.cookies.set('auth_token', token, {
+    httpOnly: true,
+    path: '/',
+    sameSite: 'lax',
+    secure: process.env.NODE_ENV === 'production',
+    maxAge: accessTokenMaxAgeSeconds,
+  })
+  return res
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Authentication & Accounts',
+  summary: 'Demo autologin',
+  methods: {
+    GET: {
+      summary: 'Auto sign-in using env-configured demo credentials',
+      description:
+        'When OM_AUTOLOGIN_EMAIL / OM_AUTOLOGIN_PASSWORD are configured, signs the visitor in with those credentials and redirects into the app. Intended for single-tenant demo instances only. Falls back to the login page when disabled or misconfigured.',
+      responses: [
+        { status: 307, description: 'Redirect into the app (or to /login on failure)', mediaType: 'text/html' },
+      ],
+    },
+  },
+}

package/src/modules/auth/lib/autologin.ts

@@ -0,0 +1,36 @@
+export type AutoLoginCredentials = {
+  email: string
+  password: string
+  tenantId: string | null
+}
+
+function readEnvValue(env: Record<string, string | undefined>, key: string): string {
+  const value = env[key]
+  return typeof value === 'string' ? value.trim() : ''
+}
+
+/**
+ * Reads the optional demo-autologin credentials from env. When both
+ * `OM_AUTOLOGIN_EMAIL` and `OM_AUTOLOGIN_PASSWORD` are set, the homepage hands
+ * unauthenticated visitors to the autologin route which signs them in and drops
+ * them into the app. Unset (the default) → `null` → normal login flow.
+ *
+ * `OM_AUTOLOGIN_TENANT` is optional and only needed when the same email exists
+ * across multiple tenants. Pure: pass the env bag so it stays testable.
+ */
+export function resolveAutoLoginCredentials(
+  env: Record<string, string | undefined> = process.env,
+): AutoLoginCredentials | null {
+  const email = readEnvValue(env, 'OM_AUTOLOGIN_EMAIL')
+  const password = env.OM_AUTOLOGIN_PASSWORD ?? ''
+  if (!email || !password) return null
+  const tenantId = readEnvValue(env, 'OM_AUTOLOGIN_TENANT')
+  return { email, password, tenantId: tenantId || null }
+}
+
+/** True when demo autologin credentials are configured via env. */
+export function isAutoLoginEnabled(
+  env: Record<string, string | undefined> = process.env,
+): boolean {
+  return resolveAutoLoginCredentials(env) !== null
+}

package/src/modules/customer_accounts/api/admin/roles/[id]/acl.ts

@@ -49,6 +49,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {

package/src/modules/customer_accounts/api/admin/roles/[id].ts

@@ -36,6 +36,7 @@ export async function GET(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -94,6 +95,7 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -127,7 +129,11 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
   if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault
   if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable
 
-  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  }, updates)
 
   void emitCustomerAccountsEvent('customer_accounts.role.updated', {
     id: role.id,
@@ -157,6 +163,7 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null,
   })
   if (!role) {
@@ -191,8 +198,15 @@ export async function DELETE(req: Request, { params }: { params: { id: string }
     return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })
   }
 
-  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: new Date() })
-  await em.nativeUpdate(CustomerRoleAcl, { role: role.id as any }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  }, { deletedAt: new Date() })
+  await em.nativeUpdate(CustomerRoleAcl, {
+    role: role.id as any,
+    tenantId: auth.tenantId,
+  }, { deletedAt: new Date() })
 
   void emitCustomerAccountsEvent('customer_accounts.role.deleted', {
     id: role.id,

package/src/modules/customer_accounts/api/portal/users/[id]/roles.ts

@@ -60,7 +60,12 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     ? await findWithDecryption(
         em,
         CustomerRole,
-        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
+        {
+          id: { $in: requestedRoleIds },
+          tenantId: auth.tenantId,
+          organizationId: auth.orgId,
+          deletedAt: null,
+        } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -67,7 +67,12 @@ export async function POST(req: Request) {
     ? await findWithDecryption(
         em,
         CustomerRole,
-        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,
+        {
+          id: { $in: requestedRoleIds },
+          tenantId: auth.tenantId,
+          organizationId: auth.orgId,
+          deletedAt: null,
+        } as any,
         undefined,
         { tenantId: auth.tenantId, organizationId: auth.orgId },
       )

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -133,6 +133,7 @@ export class CustomerInvitationService {
           {
             id: { $in: roleIds } as any,
             tenantId: invitation.tenantId,
+            organizationId: invitation.organizationId,
             deletedAt: null,
           } as any,
           undefined,

package/src/modules/customer_accounts/services/customerRbacService.ts

@@ -29,7 +29,9 @@ export class CustomerRbacService {
   }
 
   private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {
-    return `customer_rbac:${userId}:${scope.tenantId}:${scope.organizationId}`
+    // Keep the authorization query versioned in the key so cache entries created
+    // before scope hardening cannot preserve grants that are no longer valid.
+    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`
   }
 
   private getUserTag(userId: string): string {
@@ -89,8 +91,13 @@ export class CustomerRbacService {
     // Aggregate role ACLs
     const links = await em.find(CustomerUserRole, {
       user: userId as any,
+      role: {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        deletedAt: null,
+      },
       deletedAt: null,
-    }, { populate: ['role'] })
+    } as any, { populate: ['role'] })
     const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)
 
     let isPortalAdmin = false

package/src/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.tsx

@@ -24,9 +24,13 @@ export function ViewTabsRow({ active, className }: ViewTabsRowProps): React.Reac
     map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),
   }
 
+  // Link-based tab row (two routes), so the Tabs primitive (state-driven,
+  // onValueChange) does not fit — real <Link> semantics must stay. Classes
+  // mirror the Tabs underline variant: accent-indigo active border,
+  // shadow-focus halo.
   const baseTab =
-    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2'
-  const activeTab = 'border-b-2 border-foreground font-semibold text-foreground'
+    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:shadow-focus'
+  const activeTab = 'border-b-2 border-accent-indigo font-semibold text-foreground'
   const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'
 
   // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,