@open-mercato/core 0.6.7-develop.6606.1.3b1ec9b1ea → 0.6.7-develop.6621.1.cdbe9dee3d

package/src/modules/payment_gateways/lib/gateway-service.ts

@@ -45,6 +45,12 @@ function assertManualActionAllowed(action: ManualGatewayAction, transaction: Gat
   }
 }
 
+function assertCaptureAmountAllowed(amount: number | undefined, transaction: GatewayTransaction): void {
+  if (amount !== undefined && amount > Number(transaction.amount)) {
+    throw conflict(`Capture amount ${amount} exceeds authorized transaction amount ${transaction.amount}`)
+  }
+}
+
 function applyAdapterResultStatus(
   action: ManualGatewayAction,
   transaction: GatewayTransaction,
@@ -192,6 +198,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
     operationId?: string
     payload: Record<string, unknown>
     scope: { organizationId: string; tenantId: string }
+    assertInitialAllowed?: (transaction: GatewayTransaction) => void
     invoke: (context: {
       adapter: GatewayAdapter
       credentials: Record<string, unknown>
@@ -210,7 +217,10 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
       operationId: input.operationId,
       payload: input.payload,
       scope: input.scope,
-      assertInitialAllowed: () => assertManualActionAllowed(input.action, transaction),
+      assertInitialAllowed: () => {
+        assertManualActionAllowed(input.action, transaction)
+        input.assertInitialAllowed?.(transaction)
+      },
     })
     if (prepared.kind === 'completed') {
       if (prepared.result.status !== transaction.unifiedStatus) {
@@ -487,6 +497,7 @@ export function createPaymentGatewayService(deps: PaymentGatewayServiceDeps) {
         operationId,
         payload: { amount: amount ?? null },
         scope,
+        assertInitialAllowed: (transaction) => assertCaptureAmountAllowed(amount, transaction),
         invoke: ({ adapter, credentials, transaction, idempotencyKey }) => adapter.capture({
           sessionId: readProviderSessionId(transaction),
           amount,

package/src/modules/sales/api/document-history/route.ts

@@ -4,6 +4,7 @@ import { loadAuditLogDisplayMaps } from '@open-mercato/core/modules/audit_logs/a
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { NextResponse } from 'next/server'
@@ -67,12 +68,12 @@ export async function GET(req: Request) {
     }
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null
-    if (!organizationId) {
-      throw new CrudHttpError(400, {
-        error: translate('sales.documents.errors.organization_required', 'Organization context is required'),
-      })
-    }
+    // Resolve the organization scope the same way every other scoped read does.
+    // Under "All organizations" (super-admin) `rbacOrganizationId` is null and
+    // `where` is empty, so the read scopes by tenant + resource only instead of
+    // failing — the document's `id` is a tenant-unique UUID, so no cross-org leak.
+    const orgFilter = resolveOrganizationScopeFilter(scope, auth)
+    const organizationId = orgFilter.rbacOrganizationId
 
     const requiredFeature = query.kind === 'order' ? 'sales.orders.view' : 'sales.quotes.view'
     const rbac = container.resolve('rbacService') as RbacService
@@ -92,7 +93,7 @@ export async function GET(req: Request) {
     const [actionLogList, notes] = await Promise.all([
       actionLogService.list({
         tenantId: auth.tenantId,
-        organizationId,
+        organizationId: organizationId ?? undefined,
         resourceKind,
         resourceId: query.id,
         includeRelated: true,
@@ -107,11 +108,11 @@ export async function GET(req: Request) {
           contextType: query.kind,
           contextId: query.id,
           tenantId: auth.tenantId,
-          organizationId,
+          ...orgFilter.where,
           deletedAt: null,
         },
         { orderBy: { createdAt: 'DESC' } },
-        { tenantId: auth.tenantId, organizationId },
+        { tenantId: auth.tenantId, organizationId: organizationId ?? undefined },
       ),
     ])
     const logs = actionLogList.items as ActionLog[]

package/src/modules/sales/api/quotes/accept/route.ts

@@ -11,7 +11,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { getCachedRateLimiterService } from '@open-mercato/core/bootstrap'
 import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
-import { checkRateLimit, getClientIp, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { checkRateLimit, getClientIp, RATE_LIMIT_FALLBACK_KEY, rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import { validateSameOriginMutationRequest } from './originGuard'
 import { hashAuthToken } from '../../../../auth/lib/tokenHash'
 import { SalesOrder, SalesQuote } from '../../../data/entities'
@@ -52,11 +52,11 @@ export async function POST(req: Request) {
 
     const rateLimiterService = getCachedRateLimiterService()
     const clientIp = rateLimiterService ? getClientIp(req, rateLimiterService.trustProxyDepth) : null
-    if (rateLimiterService && clientIp) {
+    if (rateLimiterService) {
       const rateLimitResponse = await checkRateLimit(
         rateLimiterService,
         quoteAcceptRateLimitConfig,
-        clientIp,
+        clientIp ?? RATE_LIMIT_FALLBACK_KEY,
         translate('api.errors.rateLimit', 'Too many requests. Please try again later.'),
       )
       if (rateLimitResponse) return rateLimitResponse

package/src/modules/sales/api/returns/[id]/route.ts

@@ -5,6 +5,7 @@ import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { resolveOrganizationScopeFilter } from '@open-mercato/core/modules/directory/utils/organizationScopeFilter'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError, notFound } from '@open-mercato/shared/lib/crud/errors'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
@@ -40,20 +41,20 @@ export async function GET(req: Request, ctx: { params: { id: string } }) {
     }
 
     const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
-    const organizationId = scope?.selectedId ?? auth.orgId ?? null
-    if (!organizationId) {
-      throw new CrudHttpError(400, {
-        error: translate('sales.documents.errors.organization_required', 'Organization context is required'),
-      })
-    }
+    // Scope by the caller's visible organizations. Under "All organizations"
+    // (super-admin) `where` is empty and `rbacOrganizationId` is null, so the
+    // return is fetched by its tenant-unique id instead of 400-ing; restricted
+    // callers keep their `filterIds` `$in` guard.
+    const orgFilter = resolveOrganizationScopeFilter(scope, auth)
+    const decryptionOrganizationId = orgFilter.rbacOrganizationId ?? undefined
 
     const em = (container.resolve('em') as EntityManager).fork()
     const header = await findOneWithDecryption(
       em,
       SalesReturn,
-      { id, deletedAt: null, tenantId: auth.tenantId, organizationId },
+      { id, deletedAt: null, tenantId: auth.tenantId, ...orgFilter.where },
       { populate: ['order'] },
-      { tenantId: auth.tenantId, organizationId },
+      { tenantId: auth.tenantId, organizationId: decryptionOrganizationId },
     )
     if (!header || !header.order) {
       throw notFound(translate('sales.returns.notFound', 'Return not found.'))
@@ -64,7 +65,7 @@ export async function GET(req: Request, ctx: { params: { id: string } }) {
       SalesReturnLine,
       { salesReturn: header.id, deletedAt: null },
       { populate: ['orderLine'] },
-      { tenantId: auth.tenantId, organizationId },
+      { tenantId: auth.tenantId, organizationId: decryptionOrganizationId },
     )
 
     const totals = lines.reduce(

package/src/modules/sales/backend/sales/documents/[id]/page.tsx

@@ -27,6 +27,8 @@ import { ArrowRightLeft, Building2, CreditCard, Mail, Pencil, Plus, Send, Store,
 import { FormHeader, type ActionItem } from '@open-mercato/ui/backend/forms'
 import { VersionHistoryAction } from '@open-mercato/ui/backend/version-history'
 import { SendObjectMessageDialog } from '@open-mercato/ui/backend/messages'
+import { useBackendChrome } from '@open-mercato/ui/backend/BackendChromeProvider'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import Link from 'next/link'
 import { flash } from '@open-mercato/ui/backend/FlashMessages'
 import { apiCall, apiCallOrThrow, readApiResultOrThrow, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
@@ -3983,6 +3985,9 @@ export default function SalesDocumentDetailPage({
     []
   )
 
+  const { payload: backendChromePayload, isReady: backendChromeReady } = useBackendChrome()
+  const canComposeMessages = backendChromeReady && hasFeature(backendChromePayload?.grantedFeatures, 'messages.compose')
+
   const tabInjectionSpotId = React.useMemo(() => `sales.document.detail.${kind}:tabs`, [kind])
   const { widgets: injectedTabWidgets } = useInjectionWidgets(tabInjectionSpotId, {
     context: detailInjectionContext,
@@ -4564,25 +4569,27 @@ export default function SalesDocumentDetailPage({
           backLabel={t('sales.documents.detail.back', 'Back to documents')}
           utilityActions={record ? (
             <>
-              <SendObjectMessageDialog
-                object={{
-                  entityModule: 'sales',
-                  entityType: kind,
-                  entityId: record.id,
-                  sourceEntityType: kind === 'order' ? 'sales.order' : 'sales.quote',
-                  sourceEntityId: record.id,
-                  previewData: {
-                    title: number,
-                    status: statusDisplay?.label ?? record?.status ?? undefined,
-                    metadata: Object.keys(messagePreviewMetadata).length > 0 ? messagePreviewMetadata : undefined,
-                  },
-                }}
-                viewHref={`/backend/sales/${kind === 'order' ? 'orders' : 'quotes'}/${record.id}`}
-                defaultValues={{
-                  sourceEntityType: kind === 'order' ? 'sales.order' : 'sales.quote',
-                  sourceEntityId: record.id,
-                }}
-              />
+              {canComposeMessages ? (
+                <SendObjectMessageDialog
+                  object={{
+                    entityModule: 'sales',
+                    entityType: kind,
+                    entityId: record.id,
+                    sourceEntityType: kind === 'order' ? 'sales.order' : 'sales.quote',
+                    sourceEntityId: record.id,
+                    previewData: {
+                      title: number,
+                      status: statusDisplay?.label ?? record?.status ?? undefined,
+                      metadata: Object.keys(messagePreviewMetadata).length > 0 ? messagePreviewMetadata : undefined,
+                    },
+                  }}
+                  viewHref={`/backend/sales/${kind === 'order' ? 'orders' : 'quotes'}/${record.id}`}
+                  defaultValues={{
+                    sourceEntityType: kind === 'order' ? 'sales.order' : 'sales.quote',
+                    sourceEntityId: record.id,
+                  }}
+                />
+              ) : null}
               <VersionHistoryAction
                 config={{
                   resourceKind: kind === 'order' ? 'sales.order' : 'sales.quote',

package/src/modules/sales/components/documents/AddressesSection.tsx

@@ -200,9 +200,13 @@ export function SalesDocumentAddressesSection({
   const [addressesLoading, setAddressesLoading] = React.useState(false)
   const [addressesError, setAddressesError] = React.useState<string | null>(null)
   const [addressFormat, setAddressFormat] = React.useState<AddressFormatStrategy>('line_first')
-  const [useCustomShipping, setUseCustomShipping] = React.useState<boolean>(!!shippingAddressSnapshot)
+  const [useCustomShipping, setUseCustomShipping] = React.useState<boolean>(
+    !!shippingAddressSnapshot && !shippingAddressId
+  )
   const [useCustomBilling, setUseCustomBilling] = React.useState<boolean>(
-    billingAddressSnapshot ? true : !!shippingAddressSnapshot
+    billingAddressSnapshot && !billingAddressId
+      ? true
+      : !!shippingAddressSnapshot && !shippingAddressId
   )
   const [sameAsShipping, setSameAsShipping] = React.useState<boolean>(() => {
     if (shippingAddressSnapshot || billingAddressSnapshot) {
@@ -366,8 +370,8 @@ export function SalesDocumentAddressesSection({
   }, [documentId, kind, resolveAddressSummary, t])
 
   React.useEffect(() => {
-    const shippingCustom = !!shippingAddressSnapshot
-    const billingCustom = !!billingAddressSnapshot
+    const shippingCustom = !!shippingAddressSnapshot && !shippingAddressId
+    const billingCustom = !!billingAddressSnapshot && !billingAddressId
     const nextSame = shippingAddressSnapshot || billingAddressSnapshot
       ? deepEqual(shippingAddressSnapshot, billingAddressSnapshot)
       : !billingAddressId || billingAddressId === shippingAddressId

package/src/modules/sales/i18n/pl.json

@@ -12,9 +12,9 @@
   "sales.audit.credit_memos.create": "Utwórz notę kredytową",
   "sales.audit.credit_memos.delete": "Usuń notę kredytową",
   "sales.audit.credit_memos.update": "Zaktualizuj notę kredytową",
-  "sales.audit.delivery-windows.create": "Create delivery window",
-  "sales.audit.delivery-windows.delete": "Delete delivery window",
-  "sales.audit.delivery-windows.update": "Update delivery window",
+  "sales.audit.delivery-windows.create": "Utworzenie okna dostawy",
+  "sales.audit.delivery-windows.delete": "Usunięcie okna dostawy",
+  "sales.audit.delivery-windows.update": "Aktualizacja okna dostawy",
   "sales.audit.document_addresses.create": "Dodaj adres dokumentu",
   "sales.audit.document_addresses.delete": "Usuń adres dokumentu",
   "sales.audit.document_addresses.update": "Zaktualizuj adres dokumentu",
@@ -31,9 +31,9 @@
   "sales.audit.orders.lines.delete": "Usuń pozycję zamówienia",
   "sales.audit.orders.lines.upsert": "Zaktualizuj pozycję zamówienia",
   "sales.audit.orders.update": "Aktualizuj zamówienie sprzedaży",
-  "sales.audit.payment-methods.create": "Create payment method",
-  "sales.audit.payment-methods.delete": "Delete payment method",
-  "sales.audit.payment-methods.update": "Update payment method",
+  "sales.audit.payment-methods.create": "Utworzenie metody płatności",
+  "sales.audit.payment-methods.delete": "Usunięcie metody płatności",
+  "sales.audit.payment-methods.update": "Aktualizacja metody płatności",
   "sales.audit.payments.create": "Utwórz płatność",
   "sales.audit.payments.delete": "Usuń płatność",
   "sales.audit.payments.update": "Zaktualizuj płatność",
@@ -51,12 +51,12 @@
   "sales.audit.shipments.create": "Utwórz wysyłkę",
   "sales.audit.shipments.delete": "Usuń wysyłkę",
   "sales.audit.shipments.update": "Aktualizuj wysyłkę",
-  "sales.audit.shipping-methods.create": "Create shipping method",
-  "sales.audit.shipping-methods.delete": "Delete shipping method",
-  "sales.audit.shipping-methods.update": "Update shipping method",
-  "sales.audit.tax-rates.create": "Create tax rate",
-  "sales.audit.tax-rates.delete": "Delete tax rate",
-  "sales.audit.tax-rates.update": "Update tax rate",
+  "sales.audit.shipping-methods.create": "Utworzenie metody wysyłki",
+  "sales.audit.shipping-methods.delete": "Usunięcie metody wysyłki",
+  "sales.audit.shipping-methods.update": "Aktualizacja metody wysyłki",
+  "sales.audit.tax-rates.create": "Utworzenie stawki podatku",
+  "sales.audit.tax-rates.delete": "Usunięcie stawki podatku",
+  "sales.audit.tax-rates.update": "Aktualizacja stawki podatku",
   "sales.channels.actions.backToList": "Powrót do kanałów",
   "sales.channels.actions.create": "Dodaj kanał",
   "sales.channels.create": "Utwórz kanał sprzedaży",
@@ -1380,18 +1380,18 @@
   "sales.shipments.not_found": "Nie znaleziono wysyłki",
   "sales.shipments.payment_completed": "Nie można zmodyfikować wysyłki: płatność za zamówienie jest zakończona.",
   "sales.shipments.quantity_exceeded": "Nie można wysłać więcej niż pozostała ilość.",
-  "sales.stageBar.changeFailed": "Failed to update stage",
-  "sales.stageBar.changed": "Stage updated",
-  "sales.stageBar.closed.lost": "Lost",
-  "sales.stageBar.closed.won": "Won",
-  "sales.stageBar.closedLost": "Deal Lost",
-  "sales.stageBar.closedWon": "Deal Won",
-  "sales.stageBar.completed": "Completed",
-  "sales.stageBar.confirmChange": "Move deal to \"{{stage}}\"?",
-  "sales.stageBar.current": "Current",
-  "sales.stageBar.lost": "Lost",
-  "sales.stageBar.upcoming": "Upcoming",
-  "sales.stageBar.won": "Won",
+  "sales.stageBar.changeFailed": "Nie udało się zmienić etapu",
+  "sales.stageBar.changed": "Zmieniono etap",
+  "sales.stageBar.closed.lost": "Przegrana",
+  "sales.stageBar.closed.won": "Wygrana",
+  "sales.stageBar.closedLost": "Szansa przegrana",
+  "sales.stageBar.closedWon": "Szansa wygrana",
+  "sales.stageBar.completed": "Zakończony",
+  "sales.stageBar.confirmChange": "Przenieść szansę do etapu „{{stage}}”?",
+  "sales.stageBar.current": "Bieżący",
+  "sales.stageBar.lost": "Przegrana",
+  "sales.stageBar.upcoming": "Nadchodzący",
+  "sales.stageBar.won": "Wygrana",
   "sales.tax-rates.create": "Utwórz stawkę podatku",
   "sales.tax-rates.delete": "Usuń stawkę podatku",
   "sales.tax-rates.update": "Aktualizuj stawkę podatku",

package/src/modules/sales/workflows.ts

@@ -174,7 +174,7 @@ const orderApproval = defineWorkflow({
     triggerId: 'order_approval_trigger',
     name: 'Order Approval Trigger',
     description: 'Triggers when a new sales order is created',
-    eventPattern: 'sales.orders.created',
+    eventPattern: 'sales.order.created',
     config: { entityType: 'SalesOrder' },
     enabled: true,
     priority: 0,