@open-mercato/core 0.6.6-develop.6542.1.fee3e68aa6 → 0.6.6-develop.6551.1.1511bfa890

package/dist/modules/customer_accounts/api/admin/roles/[id]/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/api/admin/roles/%5Bid%5D/acl.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {}\n\nconst ROLE_RESOURCE_KIND = 'customer_accounts.role'\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // The ACL is part of the role aggregate: the role-edit screen loads and saves\n  // the role and its permissions together. Guard the write against the parent\n  // role's `updatedAt` so two admins editing the same role cannot silently\n  // overwrite each other's permission changes (#3194). Strictly additive \u2014 when\n  // the client sends no expected-version header the helper is a no-op.\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    resourceKind: ROLE_RESOURCE_KIND,\n    resourceId: role.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  // Bump the aggregate version so a stale role-edit screen (which holds the role's\n  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nconst successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AACpC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW,CAAC;AAEzB,MAAM,qBAAqB;AAE3B,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC7I,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAOA,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAKA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,cAAc,CAAC;AAEjF,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,EAChG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { updateRoleAclSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\n\nexport const metadata = {}\n\nconst ROLE_RESOURCE_KIND = 'customer_accounts.role'\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth || !auth.tenantId) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  const tenantId = auth.tenantId\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleAclSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // The ACL is part of the role aggregate: the role-edit screen loads and saves\n  // the role and its permissions together. Guard the write against the parent\n  // role's `updatedAt` so two admins editing the same role cannot silently\n  // overwrite each other's permission changes (#3194). Strictly additive \u2014 when\n  // the client sends no expected-version header the helper is a no-op.\n  try {\n    enforceCommandOptimisticLock({\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId,\n    organizationId: auth.orgId,\n    userId: auth.sub,\n    resourceKind: ROLE_RESOURCE_KIND,\n    resourceId: role.id,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: parsed.data,\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId,\n  })\n\n  if (acl) {\n    await em.nativeUpdate(CustomerRoleAcl, { id: acl.id }, {\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? acl.isPortalAdmin,\n    })\n  } else {\n    const newAcl = em.create(CustomerRoleAcl, {\n      role,\n      tenantId,\n      featuresJson: parsed.data.features,\n      isPortalAdmin: parsed.data.isPortalAdmin ?? false,\n      createdAt: new Date(),\n    } as any)\n    em.persist(newAcl)\n    await em.flush()\n  }\n\n  // Bump the aggregate version so a stale role-edit screen (which holds the role's\n  // pre-edit `updatedAt`) cannot save old permission arrays afterwards. `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { updatedAt: nextUpdatedAt })\n\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n  await customerRbacService.invalidateRoleCache(role.id)\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId,\n      organizationId: auth.orgId,\n      userId: auth.sub,\n      resourceKind: ROLE_RESOURCE_KIND,\n      resourceId: role.id,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nconst successSchema = z.object({ ok: z.literal(true), updatedAt: z.string().datetime() })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role ACL (admin)',\n  description: 'Updates the ACL (features and portal admin flag) for a customer role. Invalidates RBAC cache after update.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleAclSchema },\n  responses: [{ status: 200, description: 'ACL updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n    { status: 409, description: 'Stale ACL write (optimistic-lock conflict)', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update customer role ACL (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,uBAAuB;AAE9C,SAAS,2BAA2B;AACpC,SAAS,oCAAoC;AAC7C,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEA,MAAM,WAAW,CAAC;AAEzB,MAAM,qBAAqB;AAE3B,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,QAAQ,CAAC,KAAK,UAAU;AAC3B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACA,QAAM,WAAW,KAAK;AAEtB,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC7I,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,oBAAoB,UAAU,IAAI;AACjD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAOA,MAAI;AACF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D;AAAA,IACA,gBAAgB,KAAK;AAAA,IACrB,QAAQ,KAAK;AAAA,IACb,cAAc;AAAA,IACd,YAAY,KAAK;AAAA,IACjB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,OAAO;AAAA,EAC1B,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX;AAAA,EACF,CAAC;AAED,MAAI,KAAK;AACP,UAAM,GAAG,aAAa,iBAAiB,EAAE,IAAI,IAAI,GAAG,GAAG;AAAA,MACrD,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB,IAAI;AAAA,IAClD,CAAC;AAAA,EACH,OAAO;AACL,UAAM,SAAS,GAAG,OAAO,iBAAiB;AAAA,MACxC;AAAA,MACA;AAAA,MACA,cAAc,OAAO,KAAK;AAAA,MAC1B,eAAe,OAAO,KAAK,iBAAiB;AAAA,MAC5C,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,OAAG,QAAQ,MAAM;AACjB,UAAM,GAAG,MAAM;AAAA,EACjB;AAKA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,cAAc,CAAC;AAEjF,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AACnE,QAAM,oBAAoB,oBAAoB,KAAK,EAAE;AAErD,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD;AAAA,MACA,gBAAgB,KAAK;AAAA,MACrB,QAAQ,KAAK;AAAA,MACb,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,CAAC;AACxF,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,oBAAoB;AAAA,EAC3C,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,cAAc,CAAC;AAAA,EAC9E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,IAClE,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,YAAY;AAAA,EAChG;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/admin/roles/[id].js

@@ -27,6 +27,7 @@ async function GET(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -76,6 +77,7 @@ async function PUT(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -101,7 +103,11 @@ async function PUT(req, { params }) {
   if (parsed.data.description !== void 0) updates.description = parsed.data.description;
   if (parsed.data.isDefault !== void 0) updates.isDefault = parsed.data.isDefault;
   if (parsed.data.customerAssignable !== void 0) updates.customerAssignable = parsed.data.customerAssignable;
-  await em.nativeUpdate(CustomerRole, { id: role.id }, updates);
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  }, updates);
   void emitCustomerAccountsEvent("customer_accounts.role.updated", {
     id: role.id,
     name: updates.name || role.name,
@@ -125,6 +131,7 @@ async function DELETE(req, { params }) {
   const role = await em.findOne(CustomerRole, {
     id: params.id,
     tenantId: auth.tenantId,
+    organizationId: auth.orgId,
     deletedAt: null
   });
   if (!role) {
@@ -151,8 +158,15 @@ async function DELETE(req, { params }) {
   if (assignedUsersCount > 0) {
     return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 });
   }
-  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: /* @__PURE__ */ new Date() });
-  await em.nativeUpdate(CustomerRoleAcl, { role: role.id }, { deletedAt: /* @__PURE__ */ new Date() });
+  await em.nativeUpdate(CustomerRole, {
+    id: role.id,
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId
+  }, { deletedAt: /* @__PURE__ */ new Date() });
+  await em.nativeUpdate(CustomerRoleAcl, {
+    role: role.id,
+    tenantId: auth.tenantId
+  }, { deletedAt: /* @__PURE__ */ new Date() });
   void emitCustomerAccountsEvent("customer_accounts.role.deleted", {
     id: role.id,
     name: role.name,

package/dist/modules/customer_accounts/api/admin/roles/[id].js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/customer_accounts/api/admin/roles/%5Bid%5D.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { updateRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nexport const metadata = {}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  if (!UUID_RE.test(params.id)) {\n    return NextResponse.json({ ok: false, error: 'Invalid role ID' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  })\n\n  const features = acl && Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n\n  return NextResponse.json({\n    ok: true,\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    description: role.description || null,\n    isDefault: role.isDefault,\n    isSystem: role.isSystem,\n    customerAssignable: role.customerAssignable,\n    createdAt: role.createdAt,\n    updatedAt: role.updatedAt || null,\n    features,\n  })\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  if (role.isSystem && parsed.data.name !== undefined && parsed.data.name !== role.name) {\n    return NextResponse.json({ ok: false, error: 'Cannot change name of a system role' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale overwrite so two admins editing the same role\n  // in parallel cannot silently clobber each other (#2055). Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Always bump updated_at so the lock version advances on every save \u2014 `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  const updates: Record<string, unknown> = { updatedAt: nextUpdatedAt }\n  if (parsed.data.name !== undefined) updates.name = parsed.data.name\n  if (parsed.data.description !== undefined) updates.description = parsed.data.description\n  if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault\n  if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable\n\n  await em.nativeUpdate(CustomerRole, { id: role.id }, updates)\n\n  void emitCustomerAccountsEvent('customer_accounts.role.updated', {\n    id: role.id,\n    name: updates.name as string || role.name,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // System roles are seed-provided defaults but may still be removed once they are no\n  // longer needed (#3556). Only the default role is hard-protected here because signup\n  // auto-assigns it to new portal users \u2014 reassign the default first, then delete.\n  if (role.isDefault) {\n    return NextResponse.json({ ok: false, error: 'Cannot delete the default role. Set another role as default first.' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale delete. Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const assignedUsersCount = await em.count(CustomerUserRole, {\n    role: role.id as any,\n    deletedAt: null,\n  })\n  if (assignedUsersCount > 0) {\n    return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })\n  }\n\n  await em.nativeUpdate(CustomerRole, { id: role.id }, { deletedAt: new Date() })\n  await em.nativeUpdate(CustomerRoleAcl, { role: role.id as any }, { deletedAt: new Date() })\n\n  void emitCustomerAccountsEvent('customer_accounts.role.deleted', {\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst aclSchema = z.object({\n  features: z.array(z.string()),\n  isPortalAdmin: z.boolean(),\n})\nconst roleDetailSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  slug: z.string(),\n  description: z.string().nullable(),\n  isDefault: z.boolean(),\n  isSystem: z.boolean(),\n  customerAssignable: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime().nullable(),\n  acl: aclSchema,\n})\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get customer role detail (admin)',\n  description: 'Returns full customer role details including ACL features.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{\n    status: 200,\n    description: 'Role detail with ACL',\n    schema: z.object({ ok: z.literal(true), role: roleDetailSchema }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst putMethodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role (admin)',\n  description: 'Updates a customer role. System roles are protected from name changes.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleSchema },\n  responses: [{ status: 200, description: 'Role updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed or system role restriction', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst deleteMethodDoc: OpenApiMethodDoc = {\n  summary: 'Delete customer role (admin)',\n  description: 'Soft deletes a customer role and its ACL. The default role (auto-assigned to new portal users) and roles with assigned users cannot be deleted.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{ status: 200, description: 'Role deleted', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Default role or has assigned users', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer role detail management (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: getMethodDoc,\n    PUT: putMethodDoc,\n    DELETE: deleteMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,iBAAiB,wBAAwB;AAChE,SAAS,wBAAwB;AACjC,SAAS,iCAAiC;AAC1C,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAEzB,MAAM,WAAW,CAAC;AAEzB,MAAM,UAAU;AAEhB,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG;AAC5B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,QAAM,WAAW,OAAO,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAE9E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI,KAAK,YAAY,OAAO,KAAK,SAAS,UAAa,OAAO,KAAK,SAAS,KAAK,MAAM;AACrF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAIA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAIA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,UAAmC,EAAE,WAAW,cAAc;AACpE,MAAI,OAAO,KAAK,SAAS,OAAW,SAAQ,OAAO,OAAO,KAAK;AAC/D,MAAI,OAAO,KAAK,gBAAgB,OAAW,SAAQ,cAAc,OAAO,KAAK;AAC7E,MAAI,OAAO,KAAK,cAAc,OAAW,SAAQ,YAAY,OAAO,KAAK;AACzE,MAAI,OAAO,KAAK,uBAAuB,OAAW,SAAQ,qBAAqB,OAAO,KAAK;AAE3F,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,OAAO;AAE5D,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,QAAQ,QAAkB,KAAK;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,MAAI,KAAK,WAAW;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qEAAqE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtI;AAGA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,MAAM,GAAG,MAAM,kBAAkB;AAAA,IAC1D,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,qBAAqB,GAAG;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,kBAAkB,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzJ;AAEA,QAAM,GAAG,aAAa,cAAc,EAAE,IAAI,KAAK,GAAG,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC9E,QAAM,GAAG,aAAa,iBAAiB,EAAE,MAAM,KAAK,GAAU,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAE1F,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,QAAQ;AAC3B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA,EACpB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,KAAK;AACP,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,iBAAiB,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { CustomerRole, CustomerRoleAcl, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { updateRoleSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\n\nexport const metadata = {}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function GET(req: Request, { params }: { params: { id: string } }) {\n  if (!UUID_RE.test(params.id)) {\n    return NextResponse.json({ ok: false, error: 'Invalid role ID' }, { status: 400 })\n  }\n\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.view'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  const acl = await em.findOne(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  })\n\n  const features = acl && Array.isArray(acl.featuresJson) ? acl.featuresJson : []\n\n  return NextResponse.json({\n    ok: true,\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    description: role.description || null,\n    isDefault: role.isDefault,\n    isSystem: role.isSystem,\n    customerAssignable: role.customerAssignable,\n    createdAt: role.createdAt,\n    updatedAt: role.updatedAt || null,\n    features,\n  })\n}\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = updateRoleSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  if (role.isSystem && parsed.data.name !== undefined && parsed.data.name !== role.name) {\n    return NextResponse.json({ ok: false, error: 'Cannot change name of a system role' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale overwrite so two admins editing the same role\n  // in parallel cannot silently clobber each other (#2055). Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Always bump updated_at so the lock version advances on every save \u2014 `nativeUpdate`\n  // bypasses MikroORM's `onUpdate` hook, so set it explicitly.\n  const nextUpdatedAt = new Date()\n  const updates: Record<string, unknown> = { updatedAt: nextUpdatedAt }\n  if (parsed.data.name !== undefined) updates.name = parsed.data.name\n  if (parsed.data.description !== undefined) updates.description = parsed.data.description\n  if (parsed.data.isDefault !== undefined) updates.isDefault = parsed.data.isDefault\n  if (parsed.data.customerAssignable !== undefined) updates.customerAssignable = parsed.data.customerAssignable\n\n  await em.nativeUpdate(CustomerRole, {\n    id: role.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }, updates)\n\n  void emitCustomerAccountsEvent('customer_accounts.role.updated', {\n    id: role.id,\n    name: updates.name as string || role.name,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true, updatedAt: nextUpdatedAt.toISOString() })\n}\n\nexport async function DELETE(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const rbacService = container.resolve('rbacService') as RbacService\n  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, ['customer_accounts.roles.manage'], { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!hasAccess) {\n    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  const role = await em.findOne(CustomerRole, {\n    id: params.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n    deletedAt: null,\n  })\n  if (!role) {\n    return NextResponse.json({ ok: false, error: 'Role not found' }, { status: 404 })\n  }\n\n  // System roles are seed-provided defaults but may still be removed once they are no\n  // longer needed (#3556). Only the default role is hard-protected here because signup\n  // auto-assigns it to new portal users \u2014 reassign the default first, then delete.\n  if (role.isDefault) {\n    return NextResponse.json({ ok: false, error: 'Cannot delete the default role. Set another role as default first.' }, { status: 400 })\n  }\n\n  // Optimistic lock: refuse a stale delete. Strictly additive.\n  try {\n    await enforceCommandOptimisticLockWithGuards(container, {\n      resourceKind: 'customer_accounts.role',\n      resourceId: role.id,\n      current: role.updatedAt ?? null,\n      request: req,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  const assignedUsersCount = await em.count(CustomerUserRole, {\n    role: role.id as any,\n    deletedAt: null,\n  })\n  if (assignedUsersCount > 0) {\n    return NextResponse.json({ ok: false, error: `Cannot delete role with ${assignedUsersCount} assigned user(s). Reassign users first.` }, { status: 400 })\n  }\n\n  await em.nativeUpdate(CustomerRole, {\n    id: role.id,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }, { deletedAt: new Date() })\n  await em.nativeUpdate(CustomerRoleAcl, {\n    role: role.id as any,\n    tenantId: auth.tenantId,\n  }, { deletedAt: new Date() })\n\n  void emitCustomerAccountsEvent('customer_accounts.role.deleted', {\n    id: role.id,\n    name: role.name,\n    slug: role.slug,\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst aclSchema = z.object({\n  features: z.array(z.string()),\n  isPortalAdmin: z.boolean(),\n})\nconst roleDetailSchema = z.object({\n  id: z.string().uuid(),\n  name: z.string(),\n  slug: z.string(),\n  description: z.string().nullable(),\n  isDefault: z.boolean(),\n  isSystem: z.boolean(),\n  customerAssignable: z.boolean(),\n  createdAt: z.string().datetime(),\n  updatedAt: z.string().datetime().nullable(),\n  acl: aclSchema,\n})\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst getMethodDoc: OpenApiMethodDoc = {\n  summary: 'Get customer role detail (admin)',\n  description: 'Returns full customer role details including ACL features.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{\n    status: 200,\n    description: 'Role detail with ACL',\n    schema: z.object({ ok: z.literal(true), role: roleDetailSchema }),\n  }],\n  errors: [\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst putMethodDoc: OpenApiMethodDoc = {\n  summary: 'Update customer role (admin)',\n  description: 'Updates a customer role. System roles are protected from name changes.',\n  tags: ['Customer Accounts Admin'],\n  requestBody: { schema: updateRoleSchema },\n  responses: [{ status: 200, description: 'Role updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed or system role restriction', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nconst deleteMethodDoc: OpenApiMethodDoc = {\n  summary: 'Delete customer role (admin)',\n  description: 'Soft deletes a customer role and its ACL. The default role (auto-assigned to new portal users) and roles with assigned users cannot be deleted.',\n  tags: ['Customer Accounts Admin'],\n  responses: [{ status: 200, description: 'Role deleted', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Default role or has assigned users', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'Role not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Customer role detail management (admin)',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: {\n    GET: getMethodDoc,\n    PUT: putMethodDoc,\n    DELETE: deleteMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AAEvC,SAAS,cAAc,iBAAiB,wBAAwB;AAChE,SAAS,wBAAwB;AACjC,SAAS,iCAAiC;AAC1C,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAEzB,MAAM,WAAW,CAAC;AAEzB,MAAM,UAAU;AAEhB,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,MAAI,CAAC,QAAQ,KAAK,OAAO,EAAE,GAAG;AAC5B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,wBAAwB,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpJ,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,iBAAiB;AAAA,IAC5C,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,CAAC;AAED,QAAM,WAAW,OAAO,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAE9E,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,aAAa,KAAK,eAAe;AAAA,IACjC,WAAW,KAAK;AAAA,IAChB,UAAU,KAAK;AAAA,IACf,oBAAoB,KAAK;AAAA,IACzB,WAAW,KAAK;AAAA,IAChB,WAAW,KAAK,aAAa;AAAA,IAC7B;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAEA,MAAI,KAAK,YAAY,OAAO,KAAK,SAAS,UAAa,OAAO,KAAK,SAAS,KAAK,MAAM;AACrF,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,sCAAsC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvG;AAIA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAIA,QAAM,gBAAgB,oBAAI,KAAK;AAC/B,QAAM,UAAmC,EAAE,WAAW,cAAc;AACpE,MAAI,OAAO,KAAK,SAAS,OAAW,SAAQ,OAAO,OAAO,KAAK;AAC/D,MAAI,OAAO,KAAK,gBAAgB,OAAW,SAAQ,cAAc,OAAO,KAAK;AAC7E,MAAI,OAAO,KAAK,cAAc,OAAW,SAAQ,YAAY,OAAO,KAAK;AACzE,MAAI,OAAO,KAAK,uBAAuB,OAAW,SAAQ,qBAAqB,OAAO,KAAK;AAE3F,QAAM,GAAG,aAAa,cAAc;AAAA,IAClC,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,GAAG,OAAO;AAEV,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,QAAQ,QAAkB,KAAK;AAAA,IACrC,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,cAAc,YAAY,EAAE,CAAC;AAC/E;AAEA,eAAsB,OAAO,KAAc,EAAE,OAAO,GAA+B;AACjF,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,YAAY,MAAM,YAAY,mBAAmB,KAAK,KAAK,CAAC,gCAAgC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AAC5J,MAAI,CAAC,WAAW;AACd,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC5F;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAEjC,QAAM,OAAO,MAAM,GAAG,QAAQ,cAAc;AAAA,IAC1C,IAAI,OAAO;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,IACrB,WAAW;AAAA,EACb,CAAC;AACD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAKA,MAAI,KAAK,WAAW;AAClB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qEAAqE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACtI;AAGA,MAAI;AACF,UAAM,uCAAuC,WAAW;AAAA,MACtD,cAAc;AAAA,MACd,YAAY,KAAK;AAAA,MACjB,SAAS,KAAK,aAAa;AAAA,MAC3B,SAAS;AAAA,IACX,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAEA,QAAM,qBAAqB,MAAM,GAAG,MAAM,kBAAkB;AAAA,IAC1D,MAAM,KAAK;AAAA,IACX,WAAW;AAAA,EACb,CAAC;AACD,MAAI,qBAAqB,GAAG;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,kBAAkB,2CAA2C,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACzJ;AAEA,QAAM,GAAG,aAAa,cAAc;AAAA,IAClC,IAAI,KAAK;AAAA,IACT,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAC5B,QAAM,GAAG,aAAa,iBAAiB;AAAA,IACrC,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,EACjB,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAE5B,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,IAAI,KAAK;AAAA,IACT,MAAM,KAAK;AAAA,IACX,MAAM,KAAK;AAAA,IACX,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,QAAQ;AAC3B,CAAC;AACD,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,EACpB,MAAM,EAAE,OAAO;AAAA,EACf,MAAM,EAAE,OAAO;AAAA,EACf,aAAa,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,WAAW,EAAE,QAAQ;AAAA,EACrB,UAAU,EAAE,QAAQ;AAAA,EACpB,oBAAoB,EAAE,QAAQ;AAAA,EAC9B,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EAC/B,WAAW,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS;AAAA,EAC1C,KAAK;AACP,CAAC;AAED,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC;AAAA,IACV,QAAQ;AAAA,IACR,aAAa;AAAA,IACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,GAAG,MAAM,iBAAiB,CAAC;AAAA,EAClE,CAAC;AAAA,EACD,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,eAAiC;AAAA,EACrC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,gDAAgD,QAAQ,YAAY;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEA,MAAM,kBAAoC;AAAA,EACxC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,yBAAyB;AAAA,EAChC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,cAAc,CAAC;AAAA,EAC/E,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,YAAY;AAAA,IACtF,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,IACL,QAAQ;AAAA,EACV;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/api/portal/users/[id]/roles.js

@@ -45,7 +45,12 @@ async function PUT(req, { params }) {
   const fetchedRoles = requestedRoleIds.length > 0 ? await findWithDecryption(
     em,
     CustomerRole,
-    { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null },
+    {
+      id: { $in: requestedRoleIds },
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      deletedAt: null
+    },
     void 0,
     { tenantId: auth.tenantId, organizationId: auth.orgId }
   ) : [];

package/dist/modules/customer_accounts/api/portal/users/[id]/roles.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../src/modules/customer_accounts/api/portal/users/%5Bid%5D/roles.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { assignRolesSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.roles.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = assignRolesSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Verify target user belongs to same company\n  const targetUser = await findOneWithDecryption(em, CustomerUser, {\n    id: params.id,\n    customerEntityId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  }, undefined, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!targetUser) {\n    return NextResponse.json({ ok: false, error: 'User not found' }, { status: 404 })\n  }\n\n  // Validate all roles are customer_assignable and collect for assignment\n  const requestedRoleIds = parsed.data.roleIds\n  const fetchedRoles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const fetchedRolesById = new Map(fetchedRoles.map((role) => [role.id, role]))\n  const validatedRoles: InstanceType<typeof CustomerRole>[] = []\n  for (const roleId of requestedRoleIds) {\n    const role = fetchedRolesById.get(roleId)\n    if (!role || !role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: 'Role not found or not assignable' }, { status: 400 })\n    }\n    validatedRoles.push(role)\n  }\n\n  // Replace the role set atomically: deleting the old roles and inserting the new\n  // ones in one transaction prevents a flush failure from leaving the user with\n  // zero roles (portal lockout / privilege loss) (#2337).\n  await em.transactional(async (tx) => {\n    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id as any })\n    for (const role of validatedRoles) {\n      const userRole = tx.create(CustomerUserRole, {\n        user: targetUser,\n        role,\n        createdAt: new Date(),\n      } as any)\n      tx.persist(userRole)\n    }\n  })\n\n  await customerRbacService.invalidateUserCache(targetUser.id)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update portal user roles',\n  description: 'Assigns new roles to a company portal user.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: assignRolesSchema },\n  responses: [{ status: 200, description: 'Roles updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'User not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update portal user roles',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AACvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAEnD,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,2BAA2B,GAAG,mBAAmB;AAAA,EACvF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,aAAa,MAAM,sBAAsB,IAAI,cAAc;AAAA,IAC/D,IAAI,OAAO;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAGA,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,eAAe,iBAAiB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,mBAAmB,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5E,QAAM,iBAAsD,CAAC;AAC7D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,iBAAiB,IAAI,MAAM;AACxC,QAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB;AACrC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAKA,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,UAAM,GAAG,aAAa,kBAAkB,EAAE,MAAM,WAAW,GAAU,CAAC;AACtE,eAAW,QAAQ,gBAAgB;AACjC,YAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,QAC3C,MAAM;AAAA,QACN;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,oBAAoB,WAAW,EAAE;AAE3D,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,kBAAkB;AAAA,EACzC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,cAAc,CAAC;AAAA,EAChF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerUser, CustomerUserRole, CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { assignRolesSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function PUT(req: Request, { params }: { params: { id: string } }) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.roles.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = assignRolesSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed' }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Verify target user belongs to same company\n  const targetUser = await findOneWithDecryption(em, CustomerUser, {\n    id: params.id,\n    customerEntityId: auth.customerEntityId,\n    tenantId: auth.tenantId,\n    deletedAt: null,\n  }, undefined, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (!targetUser) {\n    return NextResponse.json({ ok: false, error: 'User not found' }, { status: 404 })\n  }\n\n  // Validate all roles are customer_assignable and collect for assignment\n  const requestedRoleIds = parsed.data.roleIds\n  const fetchedRoles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        {\n          id: { $in: requestedRoleIds },\n          tenantId: auth.tenantId,\n          organizationId: auth.orgId,\n          deletedAt: null,\n        } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const fetchedRolesById = new Map(fetchedRoles.map((role) => [role.id, role]))\n  const validatedRoles: InstanceType<typeof CustomerRole>[] = []\n  for (const roleId of requestedRoleIds) {\n    const role = fetchedRolesById.get(roleId)\n    if (!role || !role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: 'Role not found or not assignable' }, { status: 400 })\n    }\n    validatedRoles.push(role)\n  }\n\n  // Replace the role set atomically: deleting the old roles and inserting the new\n  // ones in one transaction prevents a flush failure from leaving the user with\n  // zero roles (portal lockout / privilege loss) (#2337).\n  await em.transactional(async (tx) => {\n    await tx.nativeDelete(CustomerUserRole, { user: targetUser.id as any })\n    for (const role of validatedRoles) {\n      const userRole = tx.create(CustomerUserRole, {\n        user: targetUser,\n        role,\n        createdAt: new Date(),\n      } as any)\n      tx.persist(userRole)\n    }\n  })\n\n  await customerRbacService.invalidateUserCache(targetUser.id)\n\n  return NextResponse.json({ ok: true })\n}\n\nconst successSchema = z.object({ ok: z.literal(true) })\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Update portal user roles',\n  description: 'Assigns new roles to a company portal user.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: assignRolesSchema },\n  responses: [{ status: 200, description: 'Roles updated', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions', schema: errorSchema },\n    { status: 404, description: 'User not found', schema: errorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Update portal user roles',\n  pathParams: z.object({ id: z.string().uuid() }),\n  methods: { PUT: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AACvC,SAAS,cAAc,kBAAkB,oBAAoB;AAE7D,SAAS,yBAAyB;AAClC,SAAS,uBAAuB,0BAA0B;AAEnD,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,IAAI,KAAc,EAAE,OAAO,GAA+B;AAC9E,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,2BAA2B,GAAG,mBAAmB;AAAA,EACvF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,kBAAkB,UAAU,IAAI;AAC/C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,aAAa,MAAM,sBAAsB,IAAI,cAAc;AAAA,IAC/D,IAAI,OAAO;AAAA,IACX,kBAAkB,KAAK;AAAA,IACvB,UAAU,KAAK;AAAA,IACf,WAAW;AAAA,EACb,GAAG,QAAW,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACrE,MAAI,CAAC,YAAY;AACf,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClF;AAGA,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,eAAe,iBAAiB,SAAS,IAC3C,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,EAAE,KAAK,iBAAiB;AAAA,MAC5B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,mBAAmB,IAAI,IAAI,aAAa,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC5E,QAAM,iBAAsD,CAAC;AAC7D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,iBAAiB,IAAI,MAAM;AACxC,QAAI,CAAC,QAAQ,CAAC,KAAK,oBAAoB;AACrC,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,mCAAmC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACpG;AACA,mBAAe,KAAK,IAAI;AAAA,EAC1B;AAKA,QAAM,GAAG,cAAc,OAAO,OAAO;AACnC,UAAM,GAAG,aAAa,kBAAkB,EAAE,MAAM,WAAW,GAAU,CAAC;AACtE,eAAW,QAAQ,gBAAgB;AACjC,YAAM,WAAW,GAAG,OAAO,kBAAkB;AAAA,QAC3C,MAAM;AAAA,QACN;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,SAAG,QAAQ,QAAQ;AAAA,IACrB;AAAA,EACF,CAAC;AAED,QAAM,oBAAoB,oBAAoB,WAAW,EAAE;AAE3D,SAAO,aAAa,KAAK,EAAE,IAAI,KAAK,CAAC;AACvC;AAEA,MAAM,gBAAgB,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,kBAAkB;AAAA,EACzC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,iBAAiB,QAAQ,cAAc,CAAC;AAAA,EAChF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,YAAY;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,YAAY;AAAA,EACpE;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,YAAY,EAAE,OAAO,EAAE,IAAI,EAAE,OAAO,EAAE,KAAK,EAAE,CAAC;AAAA,EAC9C,SAAS,EAAE,KAAK,UAAU;AAC5B;",
   "names": []
 }

package/dist/modules/customer_accounts/api/portal/users-invite.js

@@ -52,7 +52,12 @@ async function POST(req) {
   const roles = requestedRoleIds.length > 0 ? await findWithDecryption(
     em,
     CustomerRole,
-    { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null },
+    {
+      id: { $in: requestedRoleIds },
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      deletedAt: null
+    },
     void 0,
     { tenantId: auth.tenantId, organizationId: auth.orgId }
   ) : [];

package/dist/modules/customer_accounts/api/portal/users-invite.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/customer_accounts/api/portal/users-invite.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerInviteRateLimitConfig,\n  customerInviteIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerInviteIpRateLimitConfig,\n    compoundConfig: customerInviteRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = inviteUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Validate all roles are customer_assignable\n  const requestedRoleIds = parsed.data.roleIds\n  const roles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        { id: { $in: requestedRoleIds }, tenantId: auth.tenantId, deletedAt: null } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const rolesById = new Map(roles.map((role) => [role.id, role]))\n  for (const roleId of requestedRoleIds) {\n    const role = rolesById.get(roleId)\n    if (!role) {\n      return NextResponse.json({ ok: false, error: `Role ${roleId} not found` }, { status: 400 })\n    }\n    if (!role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: `Role \"${role.name}\" cannot be assigned by portal users` }, { status: 403 })\n    }\n  }\n\n  const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService\n\n  const { invitation } = await customerInvitationService.createInvitation(\n    parsed.data.email,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n    {\n      customerEntityId: auth.customerEntityId,\n      roleIds: parsed.data.roleIds,\n      invitedByCustomerUserId: auth.sub,\n      displayName: parsed.data.displayName || null,\n    },\n  )\n\n  void emitCustomerAccountsEvent('customer_accounts.user.invited', {\n    invitationId: invitation.id,\n    email: invitation.email,\n    customerEntityId: invitation.customerEntityId || null,\n    invitedByType: 'portal',\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({\n    ok: true,\n    invitation: {\n      id: invitation.id,\n      email: invitation.email,\n      expiresAt: invitation.expiresAt,\n    },\n  }, { status: 201 })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  invitation: z.object({\n    id: z.string().uuid(),\n    email: z.string(),\n    expiresAt: z.string().datetime(),\n  }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Invite a user to the company portal',\n  description: 'Creates an invitation for a new user to join the company portal.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: inviteUserSchema },\n  responses: [{ status: 201, description: 'Invitation created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },\n    { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Invite portal user',\n  methods: { POST: methodDoc },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AAEvC,SAAS,iCAAiC;AAE1C,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,qBAAqB,GAAG,mBAAmB;AAAA,EACjF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,QAAQ,iBAAiB,SAAS,IACpC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA,EAAE,IAAI,EAAE,KAAK,iBAAiB,GAAG,UAAU,KAAK,UAAU,WAAW,KAAK;AAAA,IAC1E;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC9D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,UAAU,IAAI,MAAM;AACjC,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,MAAM,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AACA,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,SAAS,KAAK,IAAI,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AAAA,EACF;AAEA,QAAM,4BAA4B,UAAU,QAAQ,2BAA2B;AAE/E,QAAM,EAAE,WAAW,IAAI,MAAM,0BAA0B;AAAA,IACrD,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACtD;AAAA,MACE,kBAAkB,KAAK;AAAA,MACvB,SAAS,OAAO,KAAK;AAAA,MACrB,yBAAyB,KAAK;AAAA,MAC9B,aAAa,OAAO,KAAK,eAAe;AAAA,IAC1C;AAAA,EACF;AAEA,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,cAAc,WAAW;AAAA,IACzB,OAAO,WAAW;AAAA,IAClB,kBAAkB,WAAW,oBAAoB;AAAA,IACjD,eAAe;AAAA,IACf,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,YAAY;AAAA,MACV,IAAI,WAAW;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,EACrF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,IACnG,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,qBAAqB;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,UAAU;AAC7B;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'\nimport { getCustomerAuthFromRequest, requireCustomerFeature } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'\nimport { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'\nimport { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { CustomerRole } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport {\n  checkAuthRateLimit,\n  customerInviteRateLimitConfig,\n  customerInviteIpRateLimitConfig,\n} from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'\nimport { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'\n\nexport const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }\n\nexport async function POST(req: Request) {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n\n  const rateLimitEmail = await readNormalizedEmailFromJsonRequest(req)\n  const { error: rateLimitError } = await checkAuthRateLimit({\n    req,\n    ipConfig: customerInviteIpRateLimitConfig,\n    compoundConfig: customerInviteRateLimitConfig,\n    compoundIdentifier: rateLimitEmail,\n  })\n  if (rateLimitError) return rateLimitError\n\n  const container = await createRequestContainer()\n  const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService\n\n  try {\n    await requireCustomerFeature(auth, ['portal.users.manage'], customerRbacService)\n  } catch (response) {\n    return response as NextResponse\n  }\n\n  if (!auth.customerEntityId) {\n    return NextResponse.json({ ok: false, error: 'No company association' }, { status: 403 })\n  }\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json({ ok: false, error: 'Invalid request body' }, { status: 400 })\n  }\n\n  const parsed = inviteUserSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })\n  }\n\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n\n  // Validate all roles are customer_assignable\n  const requestedRoleIds = parsed.data.roleIds\n  const roles = requestedRoleIds.length > 0\n    ? await findWithDecryption(\n        em,\n        CustomerRole,\n        {\n          id: { $in: requestedRoleIds },\n          tenantId: auth.tenantId,\n          organizationId: auth.orgId,\n          deletedAt: null,\n        } as any,\n        undefined,\n        { tenantId: auth.tenantId, organizationId: auth.orgId },\n      )\n    : []\n  const rolesById = new Map(roles.map((role) => [role.id, role]))\n  for (const roleId of requestedRoleIds) {\n    const role = rolesById.get(roleId)\n    if (!role) {\n      return NextResponse.json({ ok: false, error: `Role ${roleId} not found` }, { status: 400 })\n    }\n    if (!role.customerAssignable) {\n      return NextResponse.json({ ok: false, error: `Role \"${role.name}\" cannot be assigned by portal users` }, { status: 403 })\n    }\n  }\n\n  const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService\n\n  const { invitation } = await customerInvitationService.createInvitation(\n    parsed.data.email,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n    {\n      customerEntityId: auth.customerEntityId,\n      roleIds: parsed.data.roleIds,\n      invitedByCustomerUserId: auth.sub,\n      displayName: parsed.data.displayName || null,\n    },\n  )\n\n  void emitCustomerAccountsEvent('customer_accounts.user.invited', {\n    invitationId: invitation.id,\n    email: invitation.email,\n    customerEntityId: invitation.customerEntityId || null,\n    invitedByType: 'portal',\n    tenantId: auth.tenantId,\n    organizationId: auth.orgId,\n  }).catch(() => undefined)\n\n  return NextResponse.json({\n    ok: true,\n    invitation: {\n      id: invitation.id,\n      email: invitation.email,\n      expiresAt: invitation.expiresAt,\n    },\n  }, { status: 201 })\n}\n\nconst successSchema = z.object({\n  ok: z.literal(true),\n  invitation: z.object({\n    id: z.string().uuid(),\n    email: z.string(),\n    expiresAt: z.string().datetime(),\n  }),\n})\nconst errorSchema = z.object({ ok: z.literal(false), error: z.string() })\n\nconst methodDoc: OpenApiMethodDoc = {\n  summary: 'Invite a user to the company portal',\n  description: 'Creates an invitation for a new user to join the company portal.',\n  tags: ['Customer Portal'],\n  requestBody: { schema: inviteUserSchema },\n  responses: [{ status: 201, description: 'Invitation created', schema: successSchema }],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: errorSchema },\n    { status: 401, description: 'Not authenticated', schema: errorSchema },\n    { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },\n    { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Invite portal user',\n  methods: { POST: methodDoc },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,4BAA4B,8BAA8B;AACnE,SAAS,8BAA8B;AAEvC,SAAS,iCAAiC;AAE1C,SAAS,oBAAoB;AAC7B,SAAS,wBAAwB;AACjC,SAAS,0BAA0B;AACnC,SAAS,4BAA4B;AACrC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,0CAA0C;AAE5C,MAAM,WAAqD,EAAE,aAAa,MAAM;AAEvF,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AAEA,QAAM,iBAAiB,MAAM,mCAAmC,GAAG;AACnE,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB;AAAA,IACzD;AAAA,IACA,UAAU;AAAA,IACV,gBAAgB;AAAA,IAChB,oBAAoB;AAAA,EACtB,CAAC;AACD,MAAI,eAAgB,QAAO;AAE3B,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,sBAAsB,UAAU,QAAQ,qBAAqB;AAEnE,MAAI;AACF,UAAM,uBAAuB,MAAM,CAAC,qBAAqB,GAAG,mBAAmB;AAAA,EACjF,SAAS,UAAU;AACjB,WAAO;AAAA,EACT;AAEA,MAAI,CAAC,KAAK,kBAAkB;AAC1B,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,yBAAyB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AAEA,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,uBAAuB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACxF;AAEA,QAAM,SAAS,iBAAiB,UAAU,IAAI;AAC9C,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,qBAAqB,SAAS,OAAO,MAAM,QAAQ,EAAE,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClI;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AAGjC,QAAM,mBAAmB,OAAO,KAAK;AACrC,QAAM,QAAQ,iBAAiB,SAAS,IACpC,MAAM;AAAA,IACJ;AAAA,IACA;AAAA,IACA;AAAA,MACE,IAAI,EAAE,KAAK,iBAAiB;AAAA,MAC5B,UAAU,KAAK;AAAA,MACf,gBAAgB,KAAK;AAAA,MACrB,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD,IACA,CAAC;AACL,QAAM,YAAY,IAAI,IAAI,MAAM,IAAI,CAAC,SAAS,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC;AAC9D,aAAW,UAAU,kBAAkB;AACrC,UAAM,OAAO,UAAU,IAAI,MAAM;AACjC,QAAI,CAAC,MAAM;AACT,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,QAAQ,MAAM,aAAa,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC5F;AACA,QAAI,CAAC,KAAK,oBAAoB;AAC5B,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,SAAS,KAAK,IAAI,uCAAuC,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC1H;AAAA,EACF;AAEA,QAAM,4BAA4B,UAAU,QAAQ,2BAA2B;AAE/E,QAAM,EAAE,WAAW,IAAI,MAAM,0BAA0B;AAAA,IACrD,OAAO,KAAK;AAAA,IACZ,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,IACtD;AAAA,MACE,kBAAkB,KAAK;AAAA,MACvB,SAAS,OAAO,KAAK;AAAA,MACrB,yBAAyB,KAAK;AAAA,MAC9B,aAAa,OAAO,KAAK,eAAe;AAAA,IAC1C;AAAA,EACF;AAEA,OAAK,0BAA0B,kCAAkC;AAAA,IAC/D,cAAc,WAAW;AAAA,IACzB,OAAO,WAAW;AAAA,IAClB,kBAAkB,WAAW,oBAAoB;AAAA,IACjD,eAAe;AAAA,IACf,UAAU,KAAK;AAAA,IACf,gBAAgB,KAAK;AAAA,EACvB,CAAC,EAAE,MAAM,MAAM,MAAS;AAExB,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,YAAY;AAAA,MACV,IAAI,WAAW;AAAA,MACf,OAAO,WAAW;AAAA,MAClB,WAAW,WAAW;AAAA,IACxB;AAAA,EACF,GAAG,EAAE,QAAQ,IAAI,CAAC;AACpB;AAEA,MAAM,gBAAgB,EAAE,OAAO;AAAA,EAC7B,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,YAAY,EAAE,OAAO;AAAA,IACnB,IAAI,EAAE,OAAO,EAAE,KAAK;AAAA,IACpB,OAAO,EAAE,OAAO;AAAA,IAChB,WAAW,EAAE,OAAO,EAAE,SAAS;AAAA,EACjC,CAAC;AACH,CAAC;AACD,MAAM,cAAc,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAExE,MAAM,YAA8B;AAAA,EAClC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,iBAAiB;AAAA,EACxB,aAAa,EAAE,QAAQ,iBAAiB;AAAA,EACxC,WAAW,CAAC,EAAE,QAAQ,KAAK,aAAa,sBAAsB,QAAQ,cAAc,CAAC;AAAA,EACrF,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,YAAY;AAAA,IACrE,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,YAAY;AAAA,IACnG,EAAE,QAAQ,KAAK,aAAa,gCAAgC,QAAQ,qBAAqB;AAAA,EAC3F;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS,EAAE,MAAM,UAAU;AAC7B;",
   "names": []
 }

package/dist/modules/customer_accounts/services/customerInvitationService.js

@@ -103,6 +103,7 @@ class CustomerInvitationService {
       {
         id: { $in: roleIds },
         tenantId: invitation.tenantId,
+        organizationId: invitation.organizationId,
         deletedAt: null
       },
       void 0,

package/dist/modules/customer_accounts/services/customerInvitationService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerInvitationService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
-  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,MAAM;AAAA,IACjD;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { hash } from 'bcryptjs'\nimport {\n  CustomerUser,\n  CustomerUserInvitation,\n  CustomerUserRole,\n  CustomerRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nconst BCRYPT_COST = 10\nconst INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours\n\nexport class CustomerInvitationService {\n  constructor(private em: EntityManager) {}\n\n  async createInvitation(\n    email: string,\n    scope: { tenantId: string; organizationId: string },\n    options: {\n      customerEntityId?: string | null\n      roleIds: string[]\n      invitedByUserId?: string | null\n      invitedByCustomerUserId?: string | null\n      displayName?: string | null\n    },\n  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {\n    const token = generateSecureToken()\n    const emailHash = hashForLookup(email)\n    const normalizedEmail = email.toLowerCase().trim()\n    const expiresAt = new Date(Date.now() + INVITATION_TTL_MS)\n    const tokenHashed = hashToken(token)\n\n    // Dedupe: reuse an existing pending (not accepted, not cancelled, unexpired)\n    // invitation for the same recipient instead of inserting a new row. This caps\n    // row/token growth and keeps a single live token per concurrently-pending\n    // (tenant, organization, email) tuple.\n    const existing = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        emailHash,\n        acceptedAt: null,\n        cancelledAt: null,\n        expiresAt: { $gt: new Date() },\n      } as any,\n      undefined,\n      { tenantId: scope.tenantId, organizationId: scope.organizationId },\n    )\n\n    if (existing) {\n      existing.email = normalizedEmail\n      existing.token = tokenHashed\n      existing.customerEntityId = options.customerEntityId || null\n      existing.roleIdsJson = options.roleIds\n      existing.invitedByUserId = options.invitedByUserId || null\n      existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null\n      existing.displayName = options.displayName || null\n      existing.expiresAt = expiresAt\n      await this.em.flush()\n      return { invitation: existing, rawToken: token }\n    }\n\n    const invitation = this.em.create(CustomerUserInvitation, {\n      tenantId: scope.tenantId,\n      organizationId: scope.organizationId,\n      email: normalizedEmail,\n      emailHash,\n      token: tokenHashed,\n      customerEntityId: options.customerEntityId || null,\n      roleIdsJson: options.roleIds,\n      invitedByUserId: options.invitedByUserId || null,\n      invitedByCustomerUserId: options.invitedByCustomerUserId || null,\n      displayName: options.displayName || null,\n      expiresAt,\n      createdAt: new Date(),\n    } as any) as CustomerUserInvitation\n    await this.em.persist(invitation).flush()\n    return { invitation, rawToken: token }\n  }\n\n  async findByToken(token: string): Promise<CustomerUserInvitation | null> {\n    const tokenHashed = hashToken(token)\n    const invitation = await findOneWithDecryption(\n      this.em,\n      CustomerUserInvitation,\n      { token: tokenHashed } as any,\n    )\n    if (!invitation) return null\n    if (invitation.acceptedAt) return null\n    if (invitation.cancelledAt) return null\n    if (invitation.expiresAt.getTime() < Date.now()) return null\n    return invitation\n  }\n\n  async acceptInvitation(\n    token: string,\n    password: string,\n    displayName: string,\n  ): Promise<{ user: CustomerUser; invitation: CustomerUserInvitation } | null> {\n    const invitation = await this.findByToken(token)\n    if (!invitation) return null\n\n    const passwordHash = await hash(password, BCRYPT_COST)\n    const emailHash = hashForLookup(invitation.email)\n\n    // Create user\n    const user = this.em.create(CustomerUser, {\n      email: invitation.email,\n      emailHash,\n      passwordHash,\n      displayName: displayName || invitation.displayName || invitation.email,\n      tenantId: invitation.tenantId,\n      organizationId: invitation.organizationId,\n      customerEntityId: invitation.customerEntityId || null,\n      isActive: true,\n      emailVerifiedAt: new Date(), // Invitation implicitly verifies email\n      failedLoginAttempts: 0,\n      createdAt: new Date(),\n    } as any) as CustomerUser\n    this.em.persist(user)\n\n    // Assign roles\n    const roleIds = Array.isArray(invitation.roleIdsJson) ? invitation.roleIdsJson : []\n    const roles = roleIds.length > 0\n      ? await findWithDecryption(\n          this.em,\n          CustomerRole,\n          {\n            id: { $in: roleIds } as any,\n            tenantId: invitation.tenantId,\n            organizationId: invitation.organizationId,\n            deletedAt: null,\n          } as any,\n          undefined,\n          { tenantId: invitation.tenantId, organizationId: invitation.organizationId },\n        )\n      : []\n    for (const role of roles) {\n      const userRole = this.em.create(CustomerUserRole, {\n        user,\n        role,\n        createdAt: new Date(),\n      } as any)\n      this.em.persist(userRole)\n    }\n\n    // Mark invitation as accepted\n    invitation.acceptedAt = new Date()\n\n    await this.em.flush()\n    return { user, invitation }\n  }\n}\n"],
+  "mappings": "AACA,SAAS,YAAY;AACrB;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB,0BAA0B;AAE1D,MAAM,cAAc;AACpB,MAAM,oBAAoB,KAAK,KAAK,KAAK;AAElC,MAAM,0BAA0B;AAAA,EACrC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,iBACJ,OACA,OACA,SAOmE;AACnE,UAAM,QAAQ,oBAAoB;AAClC,UAAM,YAAY,cAAc,KAAK;AACrC,UAAM,kBAAkB,MAAM,YAAY,EAAE,KAAK;AACjD,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB;AACzD,UAAM,cAAc,UAAU,KAAK;AAMnC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB;AAAA,QACA,YAAY;AAAA,QACZ,aAAa;AAAA,QACb,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA;AAAA,MACA,EAAE,UAAU,MAAM,UAAU,gBAAgB,MAAM,eAAe;AAAA,IACnE;AAEA,QAAI,UAAU;AACZ,eAAS,QAAQ;AACjB,eAAS,QAAQ;AACjB,eAAS,mBAAmB,QAAQ,oBAAoB;AACxD,eAAS,cAAc,QAAQ;AAC/B,eAAS,kBAAkB,QAAQ,mBAAmB;AACtD,eAAS,0BAA0B,QAAQ,2BAA2B;AACtE,eAAS,cAAc,QAAQ,eAAe;AAC9C,eAAS,YAAY;AACrB,YAAM,KAAK,GAAG,MAAM;AACpB,aAAO,EAAE,YAAY,UAAU,UAAU,MAAM;AAAA,IACjD;AAEA,UAAM,aAAa,KAAK,GAAG,OAAO,wBAAwB;AAAA,MACxD,UAAU,MAAM;AAAA,MAChB,gBAAgB,MAAM;AAAA,MACtB,OAAO;AAAA,MACP;AAAA,MACA,OAAO;AAAA,MACP,kBAAkB,QAAQ,oBAAoB;AAAA,MAC9C,aAAa,QAAQ;AAAA,MACrB,iBAAiB,QAAQ,mBAAmB;AAAA,MAC5C,yBAAyB,QAAQ,2BAA2B;AAAA,MAC5D,aAAa,QAAQ,eAAe;AAAA,MACpC;AAAA,MACA,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,UAAU,EAAE,MAAM;AACxC,WAAO,EAAE,YAAY,UAAU,MAAM;AAAA,EACvC;AAAA,EAEA,MAAM,YAAY,OAAuD;AACvE,UAAM,cAAc,UAAU,KAAK;AACnC,UAAM,aAAa,MAAM;AAAA,MACvB,KAAK;AAAA,MACL;AAAA,MACA,EAAE,OAAO,YAAY;AAAA,IACvB;AACA,QAAI,CAAC,WAAY,QAAO;AACxB,QAAI,WAAW,WAAY,QAAO;AAClC,QAAI,WAAW,YAAa,QAAO;AACnC,QAAI,WAAW,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACxD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,iBACJ,OACA,UACA,aAC4E;AAC5E,UAAM,aAAa,MAAM,KAAK,YAAY,KAAK;AAC/C,QAAI,CAAC,WAAY,QAAO;AAExB,UAAM,eAAe,MAAM,KAAK,UAAU,WAAW;AACrD,UAAM,YAAY,cAAc,WAAW,KAAK;AAGhD,UAAM,OAAO,KAAK,GAAG,OAAO,cAAc;AAAA,MACxC,OAAO,WAAW;AAAA,MAClB;AAAA,MACA;AAAA,MACA,aAAa,eAAe,WAAW,eAAe,WAAW;AAAA,MACjE,UAAU,WAAW;AAAA,MACrB,gBAAgB,WAAW;AAAA,MAC3B,kBAAkB,WAAW,oBAAoB;AAAA,MACjD,UAAU;AAAA,MACV,iBAAiB,oBAAI,KAAK;AAAA;AAAA,MAC1B,qBAAqB;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,SAAK,GAAG,QAAQ,IAAI;AAGpB,UAAM,UAAU,MAAM,QAAQ,WAAW,WAAW,IAAI,WAAW,cAAc,CAAC;AAClF,UAAM,QAAQ,QAAQ,SAAS,IAC3B,MAAM;AAAA,MACJ,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,IAAI,EAAE,KAAK,QAAQ;AAAA,QACnB,UAAU,WAAW;AAAA,QACrB,gBAAgB,WAAW;AAAA,QAC3B,WAAW;AAAA,MACb;AAAA,MACA;AAAA,MACA,EAAE,UAAU,WAAW,UAAU,gBAAgB,WAAW,eAAe;AAAA,IAC7E,IACA,CAAC;AACL,eAAW,QAAQ,OAAO;AACxB,YAAM,WAAW,KAAK,GAAG,OAAO,kBAAkB;AAAA,QAChD;AAAA,QACA;AAAA,QACA,WAAW,oBAAI,KAAK;AAAA,MACtB,CAAQ;AACR,WAAK,GAAG,QAAQ,QAAQ;AAAA,IAC1B;AAGA,eAAW,aAAa,oBAAI,KAAK;AAEjC,UAAM,KAAK,GAAG,MAAM;AACpB,WAAO,EAAE,MAAM,WAAW;AAAA,EAC5B;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/services/customerRbacService.js

@@ -19,7 +19,7 @@ class CustomerRbacService {
     this.cache = cache || null;
   }
   getCacheKey(userId, scope) {
-    return `customer_rbac:${userId}:${scope.tenantId}:${scope.organizationId}`;
+    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`;
   }
   getUserTag(userId) {
     return `customer_rbac:user:${userId}`;
@@ -61,6 +61,11 @@ class CustomerRbacService {
     }
     const links = await em.find(CustomerUserRole, {
       user: userId,
+      role: {
+        tenantId: scope.tenantId,
+        organizationId: scope.organizationId,
+        deletedAt: null
+      },
       deletedAt: null
     }, { populate: ["role"] });
     const roleIds = links.map((l) => l.role?.id).filter(Boolean);

package/dist/modules/customer_accounts/services/customerRbacService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerRbacService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  CustomerUserAcl,\n  CustomerRoleAcl,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'\n\ninterface CustomerAclData {\n  isPortalAdmin: boolean\n  features: string[]\n}\n\nfunction isCustomerAclData(value: unknown): value is CustomerAclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<CustomerAclData>\n  if (typeof record.isPortalAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((f) => typeof f !== 'string')) return false\n  return true\n}\n\nexport class CustomerRbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000\n  private cache: CacheStrategy | null = null\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {\n    return `customer_rbac:${userId}:${scope.tenantId}:${scope.organizationId}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `customer_rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `customer_rbac:tenant:${tenantId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<CustomerAclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isCustomerAclData(cached) ? cached : null\n  }\n\n  private async setCache(\n    cacheKey: string,\n    data: CustomerAclData,\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<void> {\n    if (!this.cache) return\n    const tags = [\n      this.getUserTag(userId),\n      this.getTenantTag(scope.tenantId),\n      'customer_rbac:all',\n    ]\n    await this.cache.set(cacheKey, data, { ttl: this.cacheTtlMs, tags })\n  }\n\n  async loadAcl(\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerAclData> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    const em = this.em.fork()\n\n    // Per-user ACL first\n    const userAcl = await em.findOne(CustomerUserAcl, {\n      user: userId as any,\n      tenantId: scope.tenantId,\n    })\n    if (userAcl) {\n      const result: CustomerAclData = {\n        isPortalAdmin: !!userAcl.isPortalAdmin,\n        features: Array.isArray(userAcl.featuresJson) ? userAcl.featuresJson : [],\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await em.find(CustomerUserRole, {\n      user: userId as any,\n      deletedAt: null,\n    }, { populate: ['role'] })\n    const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)\n\n    let isPortalAdmin = false\n    const features: string[] = []\n    if (roleIds.length) {\n      const roleAcls = await em.find(CustomerRoleAcl, {\n        tenantId: scope.tenantId,\n        role: { $in: roleIds as any },\n      } as any)\n      for (const acl of roleAcls) {\n        isPortalAdmin = isPortalAdmin || !!acl.isPortalAdmin\n        if (Array.isArray(acl.featuresJson)) {\n          for (const f of acl.featuresJson) {\n            if (!features.includes(f)) features.push(f)\n          }\n        }\n      }\n    }\n\n    const result: CustomerAclData = { isPortalAdmin, features }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  async userHasAllFeatures(\n    userId: string,\n    required: string[],\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isPortalAdmin) return true\n    return hasAllFeatures(required, acl.features)\n  }\n\n  async invalidateUserCache(userId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getUserTag(userId)])\n  }\n\n  async invalidateRoleCache(roleId: string): Promise<void> {\n    if (!this.cache) return\n    // When a role changes, invalidate all customer RBAC caches since we don't track role\u2192user mappings\n    await this.cache.deleteByTags(['customer_rbac:all'])\n  }\n\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getTenantTag(tenantId)])\n  }\n}\n"],
-  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAO/B,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,kBAAkB,UAAW,QAAO;AACtD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAG,QAAO;AAClG,SAAO;AACT;AAEO,MAAM,oBAAoB;AAAA,EAI/B,YAAoB,IAAmB,OAAuB;AAA1C;AAHpB,SAAQ,aAAqB,IAAI,KAAK;AACtC,SAAQ,QAA8B;AAGpC,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA,EAEQ,YAAY,QAAgB,OAA6D;AAC/F,WAAO,iBAAiB,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,cAAc;AAAA,EAC1E;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,wBAAwB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,UAAmD;AAC5E,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,kBAAkB,MAAM,IAAI,SAAS;AAAA,EAC9C;AAAA,EAEA,MAAc,SACZ,UACA,MACA,QACA,OACe;AACf,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB,KAAK,aAAa,MAAM,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC;AAAA,EACrE;AAAA,EAEA,MAAM,QACJ,QACA,OAC0B;AAC1B,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK,KAAK,GAAG,KAAK;AAGxB,UAAM,UAAU,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAChD,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,QAAI,SAAS;AACX,YAAMA,UAA0B;AAAA,QAC9B,eAAe,CAAC,CAAC,QAAQ;AAAA,QACzB,UAAU,MAAM,QAAQ,QAAQ,YAAY,IAAI,QAAQ,eAAe,CAAC;AAAA,MAC1E;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM,GAAG,KAAK,kBAAkB;AAAA,MAC5C,MAAM;AAAA,MACN,WAAW;AAAA,IACb,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACzB,UAAM,UAAU,MAAM,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AAEpE,QAAI,gBAAgB;AACpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,GAAG,KAAK,iBAAiB;AAAA,QAC9C,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,QAAe;AAAA,MAC9B,CAAQ;AACR,iBAAW,OAAO,UAAU;AAC1B,wBAAgB,iBAAiB,CAAC,CAAC,IAAI;AACvC,YAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,qBAAW,KAAK,IAAI,cAAc;AAChC,gBAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA0B,EAAE,eAAe,SAAS;AAC1D,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,QACA,UACA,OACkB;AAClB,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,cAAe,QAAO;AAC9B,WAAO,eAAe,UAAU,IAAI,QAAQ;AAAA,EAC9C;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,WAAW,MAAM,CAAC,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,KAAK,MAAM,aAAa,CAAC,mBAAmB,CAAC;AAAA,EACrD;AAAA,EAEA,MAAM,sBAAsB,UAAiC;AAC3D,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,aAAa,QAAQ,CAAC,CAAC;AAAA,EAC7D;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport type { CacheStrategy } from '@open-mercato/cache'\nimport {\n  CustomerUserAcl,\n  CustomerRoleAcl,\n  CustomerUserRole,\n} from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'\n\ninterface CustomerAclData {\n  isPortalAdmin: boolean\n  features: string[]\n}\n\nfunction isCustomerAclData(value: unknown): value is CustomerAclData {\n  if (typeof value !== 'object' || value === null) return false\n  const record = value as Partial<CustomerAclData>\n  if (typeof record.isPortalAdmin !== 'boolean') return false\n  if (!Array.isArray(record.features) || record.features.some((f) => typeof f !== 'string')) return false\n  return true\n}\n\nexport class CustomerRbacService {\n  private cacheTtlMs: number = 5 * 60 * 1000\n  private cache: CacheStrategy | null = null\n\n  constructor(private em: EntityManager, cache?: CacheStrategy) {\n    this.cache = cache || null\n  }\n\n  private getCacheKey(userId: string, scope: { tenantId: string; organizationId: string }): string {\n    // Keep the authorization query versioned in the key so cache entries created\n    // before scope hardening cannot preserve grants that are no longer valid.\n    return `customer_rbac:v2:${userId}:${scope.tenantId}:${scope.organizationId}`\n  }\n\n  private getUserTag(userId: string): string {\n    return `customer_rbac:user:${userId}`\n  }\n\n  private getTenantTag(tenantId: string): string {\n    return `customer_rbac:tenant:${tenantId}`\n  }\n\n  private async getFromCache(cacheKey: string): Promise<CustomerAclData | null> {\n    if (!this.cache) return null\n    const cached = await this.cache.get(cacheKey)\n    if (!cached) return null\n    return isCustomerAclData(cached) ? cached : null\n  }\n\n  private async setCache(\n    cacheKey: string,\n    data: CustomerAclData,\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<void> {\n    if (!this.cache) return\n    const tags = [\n      this.getUserTag(userId),\n      this.getTenantTag(scope.tenantId),\n      'customer_rbac:all',\n    ]\n    await this.cache.set(cacheKey, data, { ttl: this.cacheTtlMs, tags })\n  }\n\n  async loadAcl(\n    userId: string,\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<CustomerAclData> {\n    const cacheKey = this.getCacheKey(userId, scope)\n    const cached = await this.getFromCache(cacheKey)\n    if (cached) return cached\n\n    const em = this.em.fork()\n\n    // Per-user ACL first\n    const userAcl = await em.findOne(CustomerUserAcl, {\n      user: userId as any,\n      tenantId: scope.tenantId,\n    })\n    if (userAcl) {\n      const result: CustomerAclData = {\n        isPortalAdmin: !!userAcl.isPortalAdmin,\n        features: Array.isArray(userAcl.featuresJson) ? userAcl.featuresJson : [],\n      }\n      await this.setCache(cacheKey, result, userId, scope)\n      return result\n    }\n\n    // Aggregate role ACLs\n    const links = await em.find(CustomerUserRole, {\n      user: userId as any,\n      role: {\n        tenantId: scope.tenantId,\n        organizationId: scope.organizationId,\n        deletedAt: null,\n      },\n      deletedAt: null,\n    } as any, { populate: ['role'] })\n    const roleIds = links.map((l) => (l.role as any)?.id).filter(Boolean)\n\n    let isPortalAdmin = false\n    const features: string[] = []\n    if (roleIds.length) {\n      const roleAcls = await em.find(CustomerRoleAcl, {\n        tenantId: scope.tenantId,\n        role: { $in: roleIds as any },\n      } as any)\n      for (const acl of roleAcls) {\n        isPortalAdmin = isPortalAdmin || !!acl.isPortalAdmin\n        if (Array.isArray(acl.featuresJson)) {\n          for (const f of acl.featuresJson) {\n            if (!features.includes(f)) features.push(f)\n          }\n        }\n      }\n    }\n\n    const result: CustomerAclData = { isPortalAdmin, features }\n    await this.setCache(cacheKey, result, userId, scope)\n    return result\n  }\n\n  async userHasAllFeatures(\n    userId: string,\n    required: string[],\n    scope: { tenantId: string; organizationId: string },\n  ): Promise<boolean> {\n    if (!required.length) return true\n    const acl = await this.loadAcl(userId, scope)\n    if (acl.isPortalAdmin) return true\n    return hasAllFeatures(required, acl.features)\n  }\n\n  async invalidateUserCache(userId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getUserTag(userId)])\n  }\n\n  async invalidateRoleCache(roleId: string): Promise<void> {\n    if (!this.cache) return\n    // When a role changes, invalidate all customer RBAC caches since we don't track role\u2192user mappings\n    await this.cache.deleteByTags(['customer_rbac:all'])\n  }\n\n  async invalidateTenantCache(tenantId: string): Promise<void> {\n    if (!this.cache) return\n    await this.cache.deleteByTags([this.getTenantTag(tenantId)])\n  }\n}\n"],
+  "mappings": "AAEA;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP,SAAS,sBAAsB;AAO/B,SAAS,kBAAkB,OAA0C;AACnE,MAAI,OAAO,UAAU,YAAY,UAAU,KAAM,QAAO;AACxD,QAAM,SAAS;AACf,MAAI,OAAO,OAAO,kBAAkB,UAAW,QAAO;AACtD,MAAI,CAAC,MAAM,QAAQ,OAAO,QAAQ,KAAK,OAAO,SAAS,KAAK,CAAC,MAAM,OAAO,MAAM,QAAQ,EAAG,QAAO;AAClG,SAAO;AACT;AAEO,MAAM,oBAAoB;AAAA,EAI/B,YAAoB,IAAmB,OAAuB;AAA1C;AAHpB,SAAQ,aAAqB,IAAI,KAAK;AACtC,SAAQ,QAA8B;AAGpC,SAAK,QAAQ,SAAS;AAAA,EACxB;AAAA,EAEQ,YAAY,QAAgB,OAA6D;AAG/F,WAAO,oBAAoB,MAAM,IAAI,MAAM,QAAQ,IAAI,MAAM,cAAc;AAAA,EAC7E;AAAA,EAEQ,WAAW,QAAwB;AACzC,WAAO,sBAAsB,MAAM;AAAA,EACrC;AAAA,EAEQ,aAAa,UAA0B;AAC7C,WAAO,wBAAwB,QAAQ;AAAA,EACzC;AAAA,EAEA,MAAc,aAAa,UAAmD;AAC5E,QAAI,CAAC,KAAK,MAAO,QAAO;AACxB,UAAM,SAAS,MAAM,KAAK,MAAM,IAAI,QAAQ;AAC5C,QAAI,CAAC,OAAQ,QAAO;AACpB,WAAO,kBAAkB,MAAM,IAAI,SAAS;AAAA,EAC9C;AAAA,EAEA,MAAc,SACZ,UACA,MACA,QACA,OACe;AACf,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,OAAO;AAAA,MACX,KAAK,WAAW,MAAM;AAAA,MACtB,KAAK,aAAa,MAAM,QAAQ;AAAA,MAChC;AAAA,IACF;AACA,UAAM,KAAK,MAAM,IAAI,UAAU,MAAM,EAAE,KAAK,KAAK,YAAY,KAAK,CAAC;AAAA,EACrE;AAAA,EAEA,MAAM,QACJ,QACA,OAC0B;AAC1B,UAAM,WAAW,KAAK,YAAY,QAAQ,KAAK;AAC/C,UAAM,SAAS,MAAM,KAAK,aAAa,QAAQ;AAC/C,QAAI,OAAQ,QAAO;AAEnB,UAAM,KAAK,KAAK,GAAG,KAAK;AAGxB,UAAM,UAAU,MAAM,GAAG,QAAQ,iBAAiB;AAAA,MAChD,MAAM;AAAA,MACN,UAAU,MAAM;AAAA,IAClB,CAAC;AACD,QAAI,SAAS;AACX,YAAMA,UAA0B;AAAA,QAC9B,eAAe,CAAC,CAAC,QAAQ;AAAA,QACzB,UAAU,MAAM,QAAQ,QAAQ,YAAY,IAAI,QAAQ,eAAe,CAAC;AAAA,MAC1E;AACA,YAAM,KAAK,SAAS,UAAUA,SAAQ,QAAQ,KAAK;AACnD,aAAOA;AAAA,IACT;AAGA,UAAM,QAAQ,MAAM,GAAG,KAAK,kBAAkB;AAAA,MAC5C,MAAM;AAAA,MACN,MAAM;AAAA,QACJ,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,QACtB,WAAW;AAAA,MACb;AAAA,MACA,WAAW;AAAA,IACb,GAAU,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AAChC,UAAM,UAAU,MAAM,IAAI,CAAC,MAAO,EAAE,MAAc,EAAE,EAAE,OAAO,OAAO;AAEpE,QAAI,gBAAgB;AACpB,UAAM,WAAqB,CAAC;AAC5B,QAAI,QAAQ,QAAQ;AAClB,YAAM,WAAW,MAAM,GAAG,KAAK,iBAAiB;AAAA,QAC9C,UAAU,MAAM;AAAA,QAChB,MAAM,EAAE,KAAK,QAAe;AAAA,MAC9B,CAAQ;AACR,iBAAW,OAAO,UAAU;AAC1B,wBAAgB,iBAAiB,CAAC,CAAC,IAAI;AACvC,YAAI,MAAM,QAAQ,IAAI,YAAY,GAAG;AACnC,qBAAW,KAAK,IAAI,cAAc;AAChC,gBAAI,CAAC,SAAS,SAAS,CAAC,EAAG,UAAS,KAAK,CAAC;AAAA,UAC5C;AAAA,QACF;AAAA,MACF;AAAA,IACF;AAEA,UAAM,SAA0B,EAAE,eAAe,SAAS;AAC1D,UAAM,KAAK,SAAS,UAAU,QAAQ,QAAQ,KAAK;AACnD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,mBACJ,QACA,UACA,OACkB;AAClB,QAAI,CAAC,SAAS,OAAQ,QAAO;AAC7B,UAAM,MAAM,MAAM,KAAK,QAAQ,QAAQ,KAAK;AAC5C,QAAI,IAAI,cAAe,QAAO;AAC9B,WAAO,eAAe,UAAU,IAAI,QAAQ;AAAA,EAC9C;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,WAAW,MAAM,CAAC,CAAC;AAAA,EACzD;AAAA,EAEA,MAAM,oBAAoB,QAA+B;AACvD,QAAI,CAAC,KAAK,MAAO;AAEjB,UAAM,KAAK,MAAM,aAAa,CAAC,mBAAmB,CAAC;AAAA,EACrD;AAAA,EAEA,MAAM,sBAAsB,UAAiC;AAC3D,QAAI,CAAC,KAAK,MAAO;AACjB,UAAM,KAAK,MAAM,aAAa,CAAC,KAAK,aAAa,QAAQ,CAAC,CAAC;AAAA,EAC7D;AACF;",
   "names": ["result"]
 }

package/dist/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.js

@@ -13,8 +13,8 @@ function ViewTabsRow({ active, className }) {
     list: translateWithFallback(t, "customers.deals.kanban.view.list", "List"),
     map: translateWithFallback(t, "customers.deals.kanban.view.map", "Map")
   };
-  const baseTab = "inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2";
-  const activeTab = "border-b-2 border-foreground font-semibold text-foreground";
+  const baseTab = "inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:shadow-focus";
+  const activeTab = "border-b-2 border-accent-indigo font-semibold text-foreground";
   const inactiveTab = "border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground";
   const isKanbanActive = active === "kanban";
   const isListActive = active === "list";

package/dist/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../../../src/modules/customers/backend/customers/deals/pipeline/components/ViewTabsRow.tsx"],
-  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\n\nexport type KanbanView = 'kanban' | 'list' | 'map'\n\ntype ViewTabsRowProps = {\n  active: KanbanView\n  className?: string\n}\n\nconst VIEW_KANBAN_HREF = '/backend/customers/deals/pipeline'\nconst VIEW_LIST_HREF = '/backend/customers/deals'\nconst VIEW_MAP_HREF = '/backend/customers/deals/map'\n\nexport function ViewTabsRow({ active, className }: ViewTabsRowProps): React.ReactElement {\n  const t = useT()\n  const labels = {\n    kanban: translateWithFallback(t, 'customers.deals.kanban.view.kanban', 'Kanban'),\n    list: translateWithFallback(t, 'customers.deals.kanban.view.list', 'List'),\n    map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),\n  }\n\n  const baseTab =\n    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:ring-2 focus-visible:ring-ring focus-visible:ring-offset-2'\n  const activeTab = 'border-b-2 border-foreground font-semibold text-foreground'\n  const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'\n\n  // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,\n  // so the user can always round-trip between kanban and list from either page. Previously\n  // the kanban tab was a hardcoded `<span>` because the row was only rendered on the kanban\n  // page \u2014 adding it to the list page (item 7 of the SPEC-048 UX review) requires it to\n  // navigate back to /pipeline.\n  const isKanbanActive = active === 'kanban'\n  const isListActive = active === 'list'\n  const isMapActive = active === 'map'\n\n  return (\n    <div\n      role=\"tablist\"\n      aria-label={translateWithFallback(t, 'customers.deals.kanban.view.tablistLabel', 'Deals views')}\n      className={`flex items-end gap-1 border-b border-border ${className ?? ''}`.trim()}\n    >\n      {isKanbanActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.kanban}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_KANBAN_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.kanban}\n        </Link>\n      )}\n      {isListActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.list}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_LIST_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.list}\n        </Link>\n      )}\n      {isMapActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.map}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_MAP_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.map}\n        </Link>\n      )}\n    </div>\n  )\n}\n\nexport default ViewTabsRow\n"],
-  "mappings": ";AAyCI,SAMI,KANJ;AAtCJ,OAAO,UAAU;AACjB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AAStC,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AAEf,SAAS,YAAY,EAAE,QAAQ,UAAU,GAAyC;AACvF,QAAM,IAAI,KAAK;AACf,QAAM,SAAS;AAAA,IACb,QAAQ,sBAAsB,GAAG,sCAAsC,QAAQ;AAAA,IAC/E,MAAM,sBAAsB,GAAG,oCAAoC,MAAM;AAAA,IACzE,KAAK,sBAAsB,GAAG,mCAAmC,KAAK;AAAA,EACxE;AAEA,QAAM,UACJ;AACF,QAAM,YAAY;AAClB,QAAM,cAAc;AAOpB,QAAM,iBAAiB,WAAW;AAClC,QAAM,eAAe,WAAW;AAChC,QAAM,cAAc,WAAW;AAE/B,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,cAAY,sBAAsB,GAAG,4CAA4C,aAAa;AAAA,MAC9F,WAAW,+CAA+C,aAAa,EAAE,GAAG,KAAK;AAAA,MAEhF;AAAA,yBACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA,QAED,eACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA,QAED,cACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,sBAAQ;",
+  "sourcesContent": ["\"use client\"\n\nimport * as React from 'react'\nimport Link from 'next/link'\nimport { useT } from '@open-mercato/shared/lib/i18n/context'\nimport { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'\n\nexport type KanbanView = 'kanban' | 'list' | 'map'\n\ntype ViewTabsRowProps = {\n  active: KanbanView\n  className?: string\n}\n\nconst VIEW_KANBAN_HREF = '/backend/customers/deals/pipeline'\nconst VIEW_LIST_HREF = '/backend/customers/deals'\nconst VIEW_MAP_HREF = '/backend/customers/deals/map'\n\nexport function ViewTabsRow({ active, className }: ViewTabsRowProps): React.ReactElement {\n  const t = useT()\n  const labels = {\n    kanban: translateWithFallback(t, 'customers.deals.kanban.view.kanban', 'Kanban'),\n    list: translateWithFallback(t, 'customers.deals.kanban.view.list', 'List'),\n    map: translateWithFallback(t, 'customers.deals.kanban.view.map', 'Map'),\n  }\n\n  // Link-based tab row (two routes), so the Tabs primitive (state-driven,\n  // onValueChange) does not fit \u2014 real <Link> semantics must stay. Classes\n  // mirror the Tabs underline variant: accent-indigo active border,\n  // shadow-focus halo.\n  const baseTab =\n    'inline-flex items-center px-3.5 py-2.5 text-sm leading-normal transition-colors focus-visible:outline-none focus-visible:shadow-focus'\n  const activeTab = 'border-b-2 border-accent-indigo font-semibold text-foreground'\n  const inactiveTab = 'border-b-2 border-transparent font-normal text-muted-foreground hover:text-foreground'\n\n  // Renders the active tab as a non-navigating `<span>` and the inactive tab as a `<Link>`,\n  // so the user can always round-trip between kanban and list from either page. Previously\n  // the kanban tab was a hardcoded `<span>` because the row was only rendered on the kanban\n  // page \u2014 adding it to the list page (item 7 of the SPEC-048 UX review) requires it to\n  // navigate back to /pipeline.\n  const isKanbanActive = active === 'kanban'\n  const isListActive = active === 'list'\n  const isMapActive = active === 'map'\n\n  return (\n    <div\n      role=\"tablist\"\n      aria-label={translateWithFallback(t, 'customers.deals.kanban.view.tablistLabel', 'Deals views')}\n      className={`flex items-end gap-1 border-b border-border ${className ?? ''}`.trim()}\n    >\n      {isKanbanActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.kanban}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_KANBAN_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.kanban}\n        </Link>\n      )}\n      {isListActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.list}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_LIST_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.list}\n        </Link>\n      )}\n      {isMapActive ? (\n        <span\n          role=\"tab\"\n          aria-selected={true}\n          className={`${baseTab} ${activeTab}`}\n        >\n          {labels.map}\n        </span>\n      ) : (\n        <Link\n          href={VIEW_MAP_HREF}\n          role=\"tab\"\n          aria-selected={false}\n          className={`${baseTab} ${inactiveTab}`}\n        >\n          {labels.map}\n        </Link>\n      )}\n    </div>\n  )\n}\n\nexport default ViewTabsRow\n"],
+  "mappings": ";AA6CI,SAMI,KANJ;AA1CJ,OAAO,UAAU;AACjB,SAAS,YAAY;AACrB,SAAS,6BAA6B;AAStC,MAAM,mBAAmB;AACzB,MAAM,iBAAiB;AACvB,MAAM,gBAAgB;AAEf,SAAS,YAAY,EAAE,QAAQ,UAAU,GAAyC;AACvF,QAAM,IAAI,KAAK;AACf,QAAM,SAAS;AAAA,IACb,QAAQ,sBAAsB,GAAG,sCAAsC,QAAQ;AAAA,IAC/E,MAAM,sBAAsB,GAAG,oCAAoC,MAAM;AAAA,IACzE,KAAK,sBAAsB,GAAG,mCAAmC,KAAK;AAAA,EACxE;AAMA,QAAM,UACJ;AACF,QAAM,YAAY;AAClB,QAAM,cAAc;AAOpB,QAAM,iBAAiB,WAAW;AAClC,QAAM,eAAe,WAAW;AAChC,QAAM,cAAc,WAAW;AAE/B,SACE;AAAA,IAAC;AAAA;AAAA,MACC,MAAK;AAAA,MACL,cAAY,sBAAsB,GAAG,4CAA4C,aAAa;AAAA,MAC9F,WAAW,+CAA+C,aAAa,EAAE,GAAG,KAAK;AAAA,MAEhF;AAAA,yBACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA,QAED,eACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA,QAED,cACC;AAAA,UAAC;AAAA;AAAA,YACC,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,SAAS;AAAA,YAEjC,iBAAO;AAAA;AAAA,QACV,IAEA;AAAA,UAAC;AAAA;AAAA,YACC,MAAM;AAAA,YACN,MAAK;AAAA,YACL,iBAAe;AAAA,YACf,WAAW,GAAG,OAAO,IAAI,WAAW;AAAA,YAEnC,iBAAO;AAAA;AAAA,QACV;AAAA;AAAA;AAAA,EAEJ;AAEJ;AAEA,IAAO,sBAAQ;",
   "names": []
 }