@open-mercato/core 0.6.7-develop.6661.1.0043ed1d03 → 0.6.7-develop.6670.1.4efa7961c6

package/src/modules/sales/commands/documents.ts

@@ -23,6 +23,7 @@ import {
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { resolveNotificationService } from "../../notifications/lib/notificationService";
 import { buildFeatureNotificationFromType } from "../../notifications/lib/notificationBuilder";
+import { emitSalesEvent } from "../events";
 import { setRecordCustomFields } from "@open-mercato/core/modules/entities/lib/helpers";
 import { loadCustomFieldValues } from "@open-mercato/shared/lib/crud/custom-fields";
 import { normalizeCustomFieldValues } from "@open-mercato/shared/lib/custom-fields/normalize";
@@ -858,6 +859,70 @@ function normalizeStatusValue(raw: unknown): string | null {
   return trimmed.length ? trimmed : null;
 }
 
+function isConfirmedOrderStatus(status: string | null): boolean {
+  return status === "confirmed";
+}
+
+function isCancelledOrderStatus(status: string | null): boolean {
+  return status === "canceled" || status === "cancelled";
+}
+
+async function emitOrderLifecycleEvent(input: {
+  eventId: "sales.order.confirmed" | "sales.order.cancelled";
+  order: SalesOrder;
+  previousStatus: string | null;
+}): Promise<void> {
+  await emitSalesEvent(input.eventId, {
+    id: input.order.id,
+    orderId: input.order.id,
+    orderNumber: input.order.orderNumber,
+    previousStatus: input.previousStatus,
+    status: normalizeStatusValue(input.order.status),
+    tenantId: input.order.tenantId,
+    organizationId: input.order.organizationId,
+  });
+}
+
+function emitOrderLifecycleEventsForTransition(input: {
+  order: SalesOrder;
+  previousStatus: string | null;
+}): void {
+  const nextStatus = normalizeStatusValue(input.order.status);
+  if (input.previousStatus === nextStatus) return;
+
+  if (isConfirmedOrderStatus(nextStatus)) {
+    void emitOrderLifecycleEvent({
+      eventId: "sales.order.confirmed",
+      order: input.order,
+      previousStatus: input.previousStatus,
+    }).catch((err) => {
+      // Surface as warning so downstream automations (e.g. WMS reservation
+      // subscriber) failing to register/persist their own follow-up state is
+      // observable in logs instead of being silently dropped. The order
+      // status transition itself is already committed at this point.
+      logger.warn("order lifecycle event emit failed", {
+        eventId: "sales.order.confirmed",
+        orderId: input.order.id,
+        err,
+      });
+    });
+  }
+
+  if (isCancelledOrderStatus(nextStatus)) {
+    void emitOrderLifecycleEvent({
+      eventId: "sales.order.cancelled",
+      order: input.order,
+      previousStatus: input.previousStatus,
+    }).catch((err) => {
+      logger.warn("order lifecycle event emit failed", {
+        eventId: "sales.order.cancelled",
+        orderId: input.order.id,
+        err,
+      });
+    });
+  }
+}
+
 function resolveNoteAuthorFromAuth(auth: AuthContext | null): string | null {
   if (!auth || auth.isApiKey) return null;
   const sub = typeof auth.sub === "string" ? auth.sub.trim() : "";
@@ -5359,6 +5424,7 @@ const updateOrderCommand: CommandHandler<
       ],
       { transaction: true },
     );
+    emitOrderLifecycleEventsForTransition({ order, previousStatus });
     if (statusChangeNote) {
       const dataEngine = ctx.container.resolve("dataEngine");
       await emitCrudSideEffects({
@@ -5800,6 +5866,11 @@ const createOrderCommand: CommandHandler<
       "created",
     );
 
+    emitOrderLifecycleEventsForTransition({
+      order,
+      previousStatus: null,
+    });
+
     return { orderId: order.id };
   },
   captureAfter: async (_input, result, ctx) => {

package/src/modules/sales/components/documents/ItemsSection.tsx

@@ -27,6 +27,9 @@ import type { SectionAction } from "@open-mercato/ui/backend/detail";
 import { extractCustomFieldValues } from "./customFieldHelpers";
 import { canonicalizeUnitCode } from "@open-mercato/shared/lib/units/unitCodes";
 import type { SalesLineUomSnapshot } from "../../lib/types";
+import { useInjectionDataWidgets } from "@open-mercato/ui/backend/injection/useInjectionDataWidgets";
+import type { InjectionColumnDefinition } from "@open-mercato/shared/modules/widgets/injection";
+import { OrderItemsInjectionContext } from "../../widgets/injection/order-items-context";
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('sales')
@@ -110,6 +113,19 @@ function getUomFields(item: Record<string, unknown>) {
   };
 }
 
+function resolveInjectedColumnValue(
+  row: Record<string, unknown>,
+  accessorKey: string,
+): unknown {
+  const segments = accessorKey.split(".").filter(Boolean);
+  let current: unknown = row;
+  for (const segment of segments) {
+    if (!current || typeof current !== "object") return undefined;
+    current = (current as Record<string, unknown>)[segment];
+  }
+  return current;
+}
+
 type SalesDocumentItemsSectionProps = {
   documentId: string;
   kind: "order" | "quote";
@@ -148,6 +164,22 @@ export function SalesDocumentItemsSection({
     new Map(),
   );
 
+  const { widgets: allColumnWidgets } = useInjectionDataWidgets(
+    "data-table:sales.order.items:columns",
+  );
+  const columnWidgets = kind === "order" ? allColumnWidgets : [];
+  const injectedColumns = React.useMemo<InjectionColumnDefinition[]>(() => {
+    const cols: InjectionColumnDefinition[] = [];
+    for (const widget of columnWidgets) {
+      if (!("columns" in widget)) continue;
+      for (const def of (widget as { columns?: InjectionColumnDefinition[] })
+        .columns ?? []) {
+        cols.push(def);
+      }
+    }
+    return cols;
+  }, [columnWidgets]);
+
   const resourcePath = React.useMemo(
     () => (kind === "order" ? "sales/order-lines" : "sales/quote-lines"),
     [kind],
@@ -575,6 +607,7 @@ export function SalesDocumentItemsSection({
   };
 
   return (
+    <OrderItemsInjectionContext.Provider value={{ documentId, kind }}>
     <div className="space-y-4">
       {loading ? (
         <LoadingMessage
@@ -615,6 +648,14 @@ export function SalesDocumentItemsSection({
                 <th className="px-3 py-2 font-medium">
                   {t("sales.documents.items.table.total", "Total")}
                 </th>
+                {injectedColumns.map((col) => (
+                  <th
+                    key={col.id}
+                    className="px-3 py-2 font-medium whitespace-nowrap"
+                  >
+                    {col.headerKey ? t(col.headerKey, col.header) : col.header}
+                  </th>
+                ))}
                 <th className="px-3 py-2 font-medium sr-only">
                   {t("sales.documents.items.table.actions", "Actions")}
                 </th>
@@ -770,6 +811,22 @@ export function SalesDocumentItemsSection({
                         </span>
                       </div>
                     </td>
+                    {injectedColumns.map((col) => {
+                      const colValue = resolveInjectedColumnValue(
+                        item as unknown as Record<string, unknown>,
+                        col.accessorKey,
+                      );
+                      const Cell = col.cell;
+                      return (
+                        <td
+                          key={col.id}
+                          className="px-3 py-3"
+                          onClick={(e) => e.stopPropagation()}
+                        >
+                          {Cell ? <Cell getValue={() => colValue} /> : null}
+                        </td>
+                      );
+                    })}
                     <td className="px-3 py-3">
                       <div className="flex items-center gap-2 justify-end">
                         <Button
@@ -829,5 +886,6 @@ export function SalesDocumentItemsSection({
       />
       {ConfirmDialogElement}
     </div>
+    </OrderItemsInjectionContext.Provider>
   );
 }

package/src/modules/sales/events.ts

@@ -10,6 +10,8 @@ const events = [
   { id: 'sales.order.created', label: 'Sales Order Created', entity: 'order', category: 'crud' },
   { id: 'sales.order.updated', label: 'Sales Order Updated', entity: 'order', category: 'crud' },
   { id: 'sales.order.deleted', label: 'Sales Order Deleted', entity: 'order', category: 'crud' },
+  { id: 'sales.order.confirmed', label: 'Sales Order Confirmed', entity: 'order', category: 'lifecycle' },
+  { id: 'sales.order.cancelled', label: 'Sales Order Cancelled', entity: 'order', category: 'lifecycle' },
 
   // Quotes
   { id: 'sales.quote.created', label: 'Quote Created', entity: 'quote', category: 'crud' },

package/src/modules/sales/lib/publicQuoteTenantScope.ts

@@ -0,0 +1,49 @@
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+
+const UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i
+
+function normalizeTenantValue(value: unknown): string | null {
+  if (typeof value !== 'string') return null
+  const trimmed = value.trim()
+  if (!UUID_RE.test(trimmed)) return null
+  return trimmed.toLowerCase()
+}
+
+/**
+ * The tenant a signed-in actor's reads and writes are scoped to, or null when none can be
+ * resolved (including anonymous requests).
+ *
+ * `applySuperAdminScope` rewrites `auth.tenantId` from the `om_selected_tenant` cookie and
+ * preserves the actor's own tenant under `actorTenantId`. An explicit selection is an intentional
+ * scope and wins; an empty cookie ("all tenants") sets `auth.tenantId` to null on an otherwise
+ * fully authenticated session, so the actor's own tenant is the fallback. `auth.tenantId` alone
+ * cannot decide the scope, which is what defeated the public quote guard in #4309.
+ *
+ * A value that is not a well-formed UUID is treated as unresolvable rather than passed through to
+ * a `uuid` column filter, since the cookie is attacker-controllable by the actor themselves.
+ */
+export function resolveEffectiveTenantId(auth: AuthContext): string | null {
+  if (!auth) return null
+  const selectedTenantId = normalizeTenantValue(auth.tenantId)
+  if (selectedTenantId !== null) return selectedTenantId
+  return normalizeTenantValue((auth as { actorTenantId?: unknown }).actorTenantId)
+}
+
+/**
+ * True when the request carries a session belonging to a tenant other than the document's.
+ *
+ * An authenticated session whose tenant cannot be resolved counts as foreign — treating
+ * "tenant unknown" as "allow" is the #4309 bug. Two cases are deliberately NOT foreign:
+ *
+ * - Anonymous requests. The public quote link is meant to work without a session, and denying
+ *   here would break the endpoint's entire purpose.
+ * - API keys with no tenant. `ApiKey.tenantId` is nullable, so a global key legitimately resolves
+ *   to no tenant. Denying it would reject a more-privileged caller than the anonymous one that
+ *   the same link already serves.
+ */
+export function isForeignTenantActor(auth: AuthContext, documentTenantId: unknown): boolean {
+  if (!auth) return false
+  const effectiveTenantId = resolveEffectiveTenantId(auth)
+  if (effectiveTenantId === null) return auth.isApiKey !== true
+  return effectiveTenantId !== normalizeTenantValue(documentTenantId)
+}

package/src/modules/sales/widgets/injection/order-items-context.ts

@@ -0,0 +1,15 @@
+'use client'
+
+import * as React from 'react'
+
+export type OrderItemsInjectionContextValue = {
+  documentId: string
+  kind: 'order' | 'quote'
+}
+
+export const OrderItemsInjectionContext =
+  React.createContext<OrderItemsInjectionContextValue | null>(null)
+
+export function useOrderItemsInjectionContext(): OrderItemsInjectionContextValue | null {
+  return React.useContext(OrderItemsInjectionContext)
+}

package/src/modules/wms/acl.ts

@@ -0,0 +1,14 @@
+export const features = [
+  { id: 'wms.view', title: 'View WMS data', module: 'wms' },
+  { id: 'wms.manage_warehouses', title: 'Manage warehouses', module: 'wms' },
+  { id: 'wms.manage_zones', title: 'Manage warehouse zones', module: 'wms' },
+  { id: 'wms.manage_locations', title: 'Manage warehouse locations', module: 'wms' },
+  { id: 'wms.manage_inventory', title: 'Manage inventory profiles and stock state', module: 'wms' },
+  { id: 'wms.manage_reservations', title: 'Manage inventory reservations', module: 'wms' },
+  { id: 'wms.adjust_inventory', title: 'Adjust and move inventory', module: 'wms' },
+  { id: 'wms.receive_inventory', title: 'Receive inbound inventory', module: 'wms' },
+  { id: 'wms.cycle_count', title: 'Run cycle counts', module: 'wms' },
+  { id: 'wms.import', title: 'Import inventory from CSV', module: 'wms' },
+]
+
+export default features

package/src/modules/wms/analytics.ts

@@ -0,0 +1,9 @@
+import type { AnalyticsModuleConfig } from '@open-mercato/shared/modules/analytics'
+
+export const analyticsConfig: AnalyticsModuleConfig = {
+  entities: [],
+}
+
+export const config = analyticsConfig
+
+export default analyticsConfig

package/src/modules/wms/api/dashboard/operational/route.ts

@@ -0,0 +1,83 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
+import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import {
+  operationalDashboardQuerySchema,
+  operationalDashboardResponseSchema,
+} from '../../../data/validators'
+import {
+  loadOperationalDashboard,
+  OperationalDashboardWarehouseNotFoundError,
+} from '../../../lib/loadOperationalDashboard'
+
+const logger = createLogger('wms')
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['wms.view'] },
+}
+
+export async function GET(request: Request) {
+  try {
+    const url = new URL(request.url)
+    const parsedQuery = operationalDashboardQuerySchema.parse(Object.fromEntries(url.searchParams.entries()))
+    const container = await createRequestContainer()
+    const auth = await getAuthFromRequest(request)
+    if (!auth?.tenantId) {
+      throw new CrudHttpError(401, { error: 'Unauthorized' })
+    }
+    const organizationScope = await resolveOrganizationScopeForRequest({
+      container,
+      auth,
+      request,
+    })
+    const organizationId = organizationScope?.selectedId ?? auth.orgId ?? null
+    if (!organizationId) {
+      throw new CrudHttpError(401, { error: 'Unauthorized' })
+    }
+
+    const em = (container.resolve('em') as EntityManager).fork()
+    const payload = await loadOperationalDashboard(em, {
+      organizationId,
+      tenantId: auth.tenantId,
+      warehouseId: parsedQuery.warehouseId ?? null,
+    })
+
+    return NextResponse.json(operationalDashboardResponseSchema.parse(payload))
+  } catch (error) {
+    if (error instanceof OperationalDashboardWarehouseNotFoundError) {
+      return NextResponse.json({ error: 'Warehouse not found' }, { status: 404 })
+    }
+    if (error instanceof CrudHttpError) {
+      return NextResponse.json(error.body, { status: error.status })
+    }
+    if (error instanceof z.ZodError) {
+      return NextResponse.json({ error: 'Validation failed', details: error.issues }, { status: 400 })
+    }
+    logger.error('GET operational dashboard failed', { err: error })
+    return NextResponse.json({ error: 'Internal server error' }, { status: 500 })
+  }
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Operational dashboard',
+  description:
+    'Aggregated KPIs, expiry watch lot rows (`expiryLots`), monthly movement trends, and recent activity for the WMS operational dashboard.',
+  methods: {
+    GET: {
+      summary: 'Load operational dashboard data',
+      query: operationalDashboardQuerySchema,
+      responses: [
+        { status: 200, description: 'Dashboard payload', schema: operationalDashboardResponseSchema },
+        { status: 401, description: 'Unauthorized' },
+        { status: 404, description: 'Warehouse not found' },
+      ],
+    },
+  },
+}

package/src/modules/wms/api/interceptors.ts

@@ -0,0 +1,108 @@
+import type { ApiInterceptor } from '@open-mercato/shared/lib/crud/api-interceptor'
+import {
+  decodeCatalogInventoryProfileIntent,
+  WMS_CATALOG_PROFILE_HEADER,
+} from '../lib/catalogInventoryProfileIntent'
+import {
+  syncCatalogInventoryProfile,
+} from '../lib/catalogInventoryProfileSync'
+
+function resolveRecordId(
+  requestBody: Record<string, unknown> | undefined,
+  responseBody: Record<string, unknown> | undefined,
+): string | null {
+  const responseId = responseBody?.id
+  if (typeof responseId === 'string' && responseId.trim().length > 0) {
+    return responseId
+  }
+
+  const requestId = requestBody?.id
+  if (typeof requestId === 'string' && requestId.trim().length > 0) {
+    return requestId
+  }
+
+  return null
+}
+
+export const interceptors: ApiInterceptor[] = [
+  {
+    id: 'wms.catalog-products.inventory-profile-sync',
+    targetRoute: 'catalog/products',
+    methods: ['POST', 'PUT'],
+    priority: 120,
+    async before(request) {
+      const rawHeader = request.headers[WMS_CATALOG_PROFILE_HEADER]
+      if (!rawHeader) return { ok: true }
+
+      const intent = decodeCatalogInventoryProfileIntent(rawHeader)
+      return {
+        ok: true,
+        metadata: { intent, target: 'product' },
+      }
+    },
+    async after(request, response, context) {
+      if (response.statusCode >= 400) return {}
+
+      const metadata = context.metadata as
+        | { intent?: ReturnType<typeof decodeCatalogInventoryProfileIntent>; target?: 'product' | 'variant' }
+        | undefined
+      if (!metadata?.intent) return {}
+
+      const recordId = resolveRecordId(request.body, response.body)
+      if (!recordId) return {}
+
+      await syncCatalogInventoryProfile({
+        intent: metadata.intent,
+        target: 'product',
+        recordId,
+        organizationId: context.organizationId,
+        tenantId: context.tenantId,
+        userId: context.userId,
+        container: context.container,
+      })
+
+      return {}
+    },
+  },
+  {
+    id: 'wms.catalog-variants.inventory-profile-sync',
+    targetRoute: 'catalog/variants',
+    methods: ['POST', 'PUT'],
+    priority: 120,
+    async before(request) {
+      const rawHeader = request.headers[WMS_CATALOG_PROFILE_HEADER]
+      if (!rawHeader) return { ok: true }
+
+      const intent = decodeCatalogInventoryProfileIntent(rawHeader)
+      return {
+        ok: true,
+        metadata: { intent, target: 'variant' },
+      }
+    },
+    async after(request, response, context) {
+      if (response.statusCode >= 400) return {}
+
+      const metadata = context.metadata as
+        | { intent?: ReturnType<typeof decodeCatalogInventoryProfileIntent>; target?: 'product' | 'variant' }
+        | undefined
+      if (!metadata?.intent) return {}
+
+      const recordId = resolveRecordId(request.body, response.body)
+      if (!recordId) return {}
+
+      await syncCatalogInventoryProfile({
+        intent: metadata.intent,
+        target: 'variant',
+        recordId,
+        organizationId: context.organizationId,
+        tenantId: context.tenantId,
+        userId: context.userId,
+        container: context.container,
+      })
+
+      return {}
+    },
+  },
+]
+
+export default interceptors

package/src/modules/wms/api/inventory/adjust/route.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { inventoryAdjustSchema } from '../../../data/validators'
+import { executeWmsCustomPostRoute } from '../helpers'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['wms.adjust_inventory'] },
+}
+
+export async function POST(request: Request) {
+  return executeWmsCustomPostRoute({
+    request,
+    routePath: 'wms/inventory/adjust',
+    inputSchema: inventoryAdjustSchema,
+    commandId: 'wms.inventory.adjust',
+    describeResource: (input) => ({
+      resourceKind: 'wms.inventory',
+      resourceId: `${input.warehouseId}:${input.locationId}:${input.catalogVariantId}`,
+    }),
+    mapSuccess: (result: { movementId: string }) => ({
+      ok: true,
+      movementId: result.movementId,
+    }),
+  })
+}
+
+const successSchema = z.object({
+  ok: z.literal(true),
+  movementId: z.string().uuid(),
+})
+const errorSchema = z.object({ error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Adjust inventory',
+  methods: {
+    POST: {
+      summary: 'Adjust inventory',
+      description: 'Applies a manual inventory adjustment and appends a movement ledger row.',
+      requestBody: { contentType: 'application/json', schema: inventoryAdjustSchema },
+      responses: [{ status: 200, description: 'Inventory adjusted', schema: successSchema }],
+      errors: [
+        { status: 400, description: 'Validation failed', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 409, description: 'Insufficient stock', schema: errorSchema },
+        { status: 422, description: 'Invalid location', schema: errorSchema },
+      ],
+    },
+  },
+}

package/src/modules/wms/api/inventory/allocate/route.ts

@@ -0,0 +1,50 @@
+import { z } from 'zod'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { inventoryReservationAllocateSchema } from '../../../data/validators'
+import { executeWmsCustomPostRoute } from '../helpers'
+
+export const metadata = {
+  POST: { requireAuth: true, requireFeatures: ['wms.manage_reservations'] },
+}
+
+export async function POST(request: Request) {
+  return executeWmsCustomPostRoute({
+    request,
+    routePath: 'wms/inventory/allocate',
+    inputSchema: inventoryReservationAllocateSchema,
+    commandId: 'wms.inventory.allocate',
+    describeResource: (input) => ({
+      resourceKind: 'wms.inventoryReservation',
+      resourceId: input.reservationId,
+    }),
+    mapSuccess: (result: { allocationState: 'allocated' }) => ({
+      ok: true,
+      allocationState: result.allocationState,
+    }),
+  })
+}
+
+const successSchema = z.object({
+  ok: z.literal(true),
+  allocationState: z.literal('allocated'),
+})
+const errorSchema = z.object({ error: z.string() })
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'WMS',
+  summary: 'Allocate reservation',
+  methods: {
+    POST: {
+      summary: 'Allocate reservation',
+      description: 'Converts a reservation from reserved quantity into allocated quantity on the selected stock buckets.',
+      requestBody: { contentType: 'application/json', schema: inventoryReservationAllocateSchema },
+      responses: [{ status: 200, description: 'Reservation allocated', schema: successSchema }],
+      errors: [
+        { status: 400, description: 'Validation failed', schema: errorSchema },
+        { status: 401, description: 'Unauthorized', schema: errorSchema },
+        { status: 404, description: 'Reservation not found', schema: errorSchema },
+        { status: 409, description: 'Invalid reservation state', schema: errorSchema },
+      ],
+    },
+  },
+}