@open-mercato/core 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6784.1.f80b9afce5

package/dist/modules/dashboards/api/roles/widgets/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dashboards/api/roles/widgets/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { roleWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport {\n  resolveWidgetAssignmentReadScope,\n  resolveWidgetAssignmentTargetAccess,\n} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardRoleWidgetsResponseSchema,\n  dashboardRoleWidgetsUpdateResponseSchema,\n} from '../../openapi'\n\nconst FEATURE = 'dashboards.admin.assign-widgets'\nconst RESOURCE_KIND = 'dashboards.roleWidgets'\n\nfunction pickBestRecord(records: DashboardRoleWidgets[], tenantId: string | null, organizationId: string | null): DashboardRoleWidgets | null {\n  let best: DashboardRoleWidgets | null = null\n  let bestScore = -1\n  for (const record of records) {\n    if (record.deletedAt) continue\n    if (record.tenantId && tenantId && record.tenantId !== tenantId) continue\n    if (record.tenantId && !tenantId) continue\n    if (record.organizationId && organizationId && record.organizationId !== organizationId) continue\n    if (record.organizationId && !organizationId) continue\n    const score = (record.tenantId ? 1 : 0) + (record.organizationId ? 2 : 0)\n    if (score > bestScore) {\n      best = record\n      bestScore = score\n    }\n  }\n  return best\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const roleId = url.searchParams.get('roleId')\n  if (!roleId) return NextResponse.json({ error: 'roleId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbac = container.resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const { tenantId, organizationId } = resolveWidgetAssignmentReadScope({\n    auth: { tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    isSuperAdmin: !!acl.isSuperAdmin,\n    queryTenantId: url.searchParams.get('tenantId'),\n    queryOrganizationId: url.searchParams.get('organizationId'),\n  })\n\n  const role = await em.findOne(Role, { id: roleId, deletedAt: null })\n  const access = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: role,\n  })\n  if (access === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (access === 'not-found') {\n    return NextResponse.json({ error: 'Role not found' }, { status: 404 })\n  }\n\n  const records = await em.find(DashboardRoleWidgets, { roleId, deletedAt: null })\n  const best = pickBestRecord(records, tenantId, organizationId)\n\n  const response = {\n    widgetIds: best ? best.widgetIdsJson : [],\n    hasCustom: !!best,\n    scope: {\n      tenantId,\n      organizationId,\n    },\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = roleWidgetSettingsSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const validWidgetIds = new Set(widgets.map((w) => w.metadata.id))\n  const widgetIds = parsed.data.widgetIds.filter((id) => validWidgetIds.has(id))\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = auth.orgId ?? null\n\n  const role = await em.findOne(Role, { id: parsed.data.roleId, deletedAt: null })\n  const access = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: role,\n  })\n  if (access === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (access === 'not-found') {\n    return NextResponse.json({ error: 'Role not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: tenantId ?? '',\n    organizationId,\n    userId: String(auth.sub),\n    resourceKind: RESOURCE_KIND,\n    resourceId: parsed.data.roleId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { roleId: parsed.data.roleId, widgetIds },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let record = await em.findOne(DashboardRoleWidgets, {\n    roleId: parsed.data.roleId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  if (!widgetIds.length) {\n    if (record) {\n      await em.remove(record).flush()\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId,\n        userId: String(auth.sub),\n        resourceKind: RESOURCE_KIND,\n        resourceId: parsed.data.roleId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json({ ok: true, widgetIds: [] })\n  }\n\n  if (!record) {\n    record = em.create(DashboardRoleWidgets, {\n      roleId: parsed.data.roleId,\n      tenantId,\n      organizationId,\n      widgetIdsJson: widgetIds,\n    })\n    em.persist(record)\n  } else {\n    record.widgetIdsJson = widgetIds\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: tenantId ?? '',\n      organizationId,\n      userId: String(auth.sub),\n      resourceKind: RESOURCE_KIND,\n      resourceId: parsed.data.roleId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, widgetIds })\n}\n\nconst roleWidgetsQuerySchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nconst roleWidgetsGetDoc: OpenApiMethodDoc = {\n  summary: 'Fetch widget assignments for a role',\n  description: 'Returns the widgets explicitly assigned to the given role together with the evaluation scope.',\n  tags: [dashboardsTag],\n  query: roleWidgetsQuerySchema,\n  responses: [\n    { status: 200, description: 'Current widget configuration for the role.', schema: dashboardRoleWidgetsResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Missing role identifier', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage role widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst roleWidgetsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update widgets assigned to a role',\n  description: 'Persists the widget list for a role within the provided tenant and organization scope.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: roleWidgetSettingsSchema,\n    description: 'Role identifier and the widget ids that should remain assigned. Scope is derived from the authenticated session.',\n  },\n  responses: [\n    { status: 200, description: 'Widgets updated successfully.', schema: dashboardRoleWidgetsUpdateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or unknown widgets', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage role widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage dashboard widgets assigned to a role',\n  methods: {\n    GET: roleWidgetsGetDoc,\n    PUT: roleWidgetsPutDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,UAAU;AAChB,MAAM,gBAAgB;AAEtB,SAAS,eAAe,SAAiC,UAAyB,gBAA4D;AAC5I,MAAI,OAAoC;AACxC,MAAI,YAAY;AAChB,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,UAAW;AACtB,QAAI,OAAO,YAAY,YAAY,OAAO,aAAa,SAAU;AACjE,QAAI,OAAO,YAAY,CAAC,SAAU;AAClC,QAAI,OAAO,kBAAkB,kBAAkB,OAAO,mBAAmB,eAAgB;AACzF,QAAI,OAAO,kBAAkB,CAAC,eAAgB;AAC9C,UAAM,SAAS,OAAO,WAAW,IAAI,MAAM,OAAO,iBAAiB,IAAI;AACvE,QAAI,QAAQ,WAAW;AACrB,aAAO;AACP,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACrD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACvD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEtF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,EAAE,UAAU,eAAe,IAAI,iCAAiC;AAAA,IACpE,MAAM,EAAE,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IACnE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe,IAAI,aAAa,IAAI,UAAU;AAAA,IAC9C,qBAAqB,IAAI,aAAa,IAAI,gBAAgB;AAAA,EAC5D,CAAC;AAED,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,CAAC;AACnE,QAAM,SAAS,oCAAoC;AAAA,IACjD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,GAAG,KAAK,sBAAsB,EAAE,QAAQ,WAAW,KAAK,CAAC;AAC/E,QAAM,OAAO,eAAe,SAAS,UAAU,cAAc;AAE7D,QAAM,WAAW;AAAA,IACf,WAAW,OAAO,KAAK,gBAAgB,CAAC;AAAA,IACxC,WAAW,CAAC,CAAC;AAAA,IACb,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,QAAM,YAAY,OAAO,KAAK,UAAU,OAAO,CAAC,OAAO,eAAe,IAAI,EAAE,CAAC;AAE7E,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,KAAK,SAAS;AAErC,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC;AAC/E,QAAM,SAAS,oCAAoC;AAAA,IACjD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,cAAc;AAAA,IACd,YAAY,OAAO,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU;AAAA,EAC3D,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IAClD,QAAQ,OAAO,KAAK;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU,QAAQ;AACrB,QAAI,QAAQ;AACV,YAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAAA,IAChC;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB;AAAA,QACA,QAAQ,OAAO,KAAK,GAAG;AAAA,QACvB,cAAc;AAAA,QACd,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,CAAC,EAAE,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,sBAAsB;AAAA,MACvC,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,gBAAgB;AAAA,EACzB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,KAAK,GAAG;AAAA,MACvB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,UAAU,CAAC;AAClD;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mCAAmC;AAAA,EACvH;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,yCAAyC;AAAA,EAChH;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardRoleWidgets } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { Role } from '@open-mercato/core/modules/auth/data/entities'\nimport { roleWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport {\n  resolveWidgetAssignmentReadScope,\n  resolveWidgetAssignmentTargetAccess,\n} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardRoleWidgetsResponseSchema,\n  dashboardRoleWidgetsUpdateResponseSchema,\n} from '../../openapi'\n\nconst FEATURE = 'dashboards.admin.assign-widgets'\nconst RESOURCE_KIND = 'dashboards.roleWidgets'\n\nfunction pickBestRecord(records: DashboardRoleWidgets[], tenantId: string | null, organizationId: string | null): DashboardRoleWidgets | null {\n  let best: DashboardRoleWidgets | null = null\n  let bestScore = -1\n  for (const record of records) {\n    if (record.deletedAt) continue\n    if (record.tenantId && tenantId && record.tenantId !== tenantId) continue\n    if (record.tenantId && !tenantId) continue\n    if (record.organizationId && organizationId && record.organizationId !== organizationId) continue\n    if (record.organizationId && !organizationId) continue\n    const score = (record.tenantId ? 1 : 0) + (record.organizationId ? 2 : 0)\n    if (score > bestScore) {\n      best = record\n      bestScore = score\n    }\n  }\n  return best\n}\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const roleId = url.searchParams.get('roleId')\n  if (!roleId) return NextResponse.json({ error: 'roleId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbac = container.resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!authorizeFeatures([FEATURE], {\n    grantedFeatures: acl.features ?? [],\n    unrestricted: !!acl.isSuperAdmin,\n  })) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const { tenantId, organizationId } = resolveWidgetAssignmentReadScope({\n    auth: { tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    isSuperAdmin: !!acl.isSuperAdmin,\n    queryTenantId: url.searchParams.get('tenantId'),\n    queryOrganizationId: url.searchParams.get('organizationId'),\n  })\n\n  const role = await em.findOne(Role, { id: roleId, deletedAt: null })\n  const access = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: role,\n  })\n  if (access === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (access === 'not-found') {\n    return NextResponse.json({ error: 'Role not found' }, { status: 404 })\n  }\n\n  const records = await em.find(DashboardRoleWidgets, { roleId, deletedAt: null })\n  const best = pickBestRecord(records, tenantId, organizationId)\n\n  const response = {\n    widgetIds: best ? best.widgetIdsJson : [],\n    hasCustom: !!best,\n    scope: {\n      tenantId,\n      organizationId,\n    },\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = roleWidgetSettingsSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!authorizeFeatures([FEATURE], {\n    grantedFeatures: acl.features ?? [],\n    unrestricted: !!acl.isSuperAdmin,\n  })) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const validWidgetIds = new Set(widgets.map((w) => w.metadata.id))\n  const widgetIds = parsed.data.widgetIds.filter((id) => validWidgetIds.has(id))\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = auth.orgId ?? null\n\n  const role = await em.findOne(Role, { id: parsed.data.roleId, deletedAt: null })\n  const access = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: role,\n  })\n  if (access === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (access === 'not-found') {\n    return NextResponse.json({ error: 'Role not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: tenantId ?? '',\n    organizationId,\n    userId: String(auth.sub),\n    resourceKind: RESOURCE_KIND,\n    resourceId: parsed.data.roleId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { roleId: parsed.data.roleId, widgetIds },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let record = await em.findOne(DashboardRoleWidgets, {\n    roleId: parsed.data.roleId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  if (!widgetIds.length) {\n    if (record) {\n      await em.remove(record).flush()\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId,\n        userId: String(auth.sub),\n        resourceKind: RESOURCE_KIND,\n        resourceId: parsed.data.roleId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json({ ok: true, widgetIds: [] })\n  }\n\n  if (!record) {\n    record = em.create(DashboardRoleWidgets, {\n      roleId: parsed.data.roleId,\n      tenantId,\n      organizationId,\n      widgetIdsJson: widgetIds,\n    })\n    em.persist(record)\n  } else {\n    record.widgetIdsJson = widgetIds\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: tenantId ?? '',\n      organizationId,\n      userId: String(auth.sub),\n      resourceKind: RESOURCE_KIND,\n      resourceId: parsed.data.roleId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, widgetIds })\n}\n\nconst roleWidgetsQuerySchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nconst roleWidgetsGetDoc: OpenApiMethodDoc = {\n  summary: 'Fetch widget assignments for a role',\n  description: 'Returns the widgets explicitly assigned to the given role together with the evaluation scope.',\n  tags: [dashboardsTag],\n  query: roleWidgetsQuerySchema,\n  responses: [\n    { status: 200, description: 'Current widget configuration for the role.', schema: dashboardRoleWidgetsResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Missing role identifier', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage role widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst roleWidgetsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update widgets assigned to a role',\n  description: 'Persists the widget list for a role within the provided tenant and organization scope.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: roleWidgetSettingsSchema,\n    description: 'Role identifier and the widget ids that should remain assigned. Scope is derived from the authenticated session.',\n  },\n  responses: [\n    { status: 200, description: 'Widgets updated successfully.', schema: dashboardRoleWidgetsUpdateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or unknown widgets', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage role widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage dashboard widgets assigned to a role',\n  methods: {\n    GET: roleWidgetsGetDoc,\n    PUT: roleWidgetsPutDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,UAAU;AAChB,MAAM,gBAAgB;AAEtB,SAAS,eAAe,SAAiC,UAAyB,gBAA4D;AAC5I,MAAI,OAAoC;AACxC,MAAI,YAAY;AAChB,aAAW,UAAU,SAAS;AAC5B,QAAI,OAAO,UAAW;AACtB,QAAI,OAAO,YAAY,YAAY,OAAO,aAAa,SAAU;AACjE,QAAI,OAAO,YAAY,CAAC,SAAU;AAClC,QAAI,OAAO,kBAAkB,kBAAkB,OAAO,mBAAmB,eAAgB;AACzF,QAAI,OAAO,kBAAkB,CAAC,eAAgB;AAC9C,UAAM,SAAS,OAAO,WAAW,IAAI,MAAM,OAAO,iBAAiB,IAAI;AACvE,QAAI,QAAQ,WAAW;AACrB,aAAO;AACP,kBAAY;AAAA,IACd;AAAA,EACF;AACA,SAAO;AACT;AAEO,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACrD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACvD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEtF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,kBAAkB,CAAC,OAAO,GAAG;AAAA,IAChC,iBAAiB,IAAI,YAAY,CAAC;AAAA,IAClC,cAAc,CAAC,CAAC,IAAI;AAAA,EACtB,CAAC,GAAG;AACF,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,EAAE,UAAU,eAAe,IAAI,iCAAiC;AAAA,IACpE,MAAM,EAAE,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IACnE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe,IAAI,aAAa,IAAI,UAAU;AAAA,IAC9C,qBAAqB,IAAI,aAAa,IAAI,gBAAgB;AAAA,EAC5D,CAAC;AAED,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,CAAC;AACnE,QAAM,SAAS,oCAAoC;AAAA,IACjD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,GAAG,KAAK,sBAAsB,EAAE,QAAQ,WAAW,KAAK,CAAC;AAC/E,QAAM,OAAO,eAAe,SAAS,UAAU,cAAc;AAE7D,QAAM,WAAW;AAAA,IACf,WAAW,OAAO,KAAK,gBAAgB,CAAC;AAAA,IACxC,WAAW,CAAC,CAAC;AAAA,IACb,OAAO;AAAA,MACL;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,kBAAkB,CAAC,OAAO,GAAG;AAAA,IAChC,iBAAiB,IAAI,YAAY,CAAC;AAAA,IAClC,cAAc,CAAC,CAAC,IAAI;AAAA,EACtB,CAAC,GAAG;AACF,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,QAAM,YAAY,OAAO,KAAK,UAAU,OAAO,CAAC,OAAO,eAAe,IAAI,EAAE,CAAC;AAE7E,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,KAAK,SAAS;AAErC,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC;AAC/E,QAAM,SAAS,oCAAoC;AAAA,IACjD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,WAAW,aAAa;AAC1B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,cAAc;AAAA,IACd,YAAY,OAAO,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU;AAAA,EAC3D,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IAClD,QAAQ,OAAO,KAAK;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,CAAC,UAAU,QAAQ;AACrB,QAAI,QAAQ;AACV,YAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAAA,IAChC;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB;AAAA,QACA,QAAQ,OAAO,KAAK,GAAG;AAAA,QACvB,cAAc;AAAA,QACd,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,WAAW,CAAC,EAAE,CAAC;AAAA,EACtD;AAEA,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,sBAAsB;AAAA,MACvC,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA,eAAe;AAAA,IACjB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,gBAAgB;AAAA,EACzB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,KAAK,GAAG;AAAA,MACvB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,UAAU,CAAC;AAClD;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,8CAA8C,QAAQ,mCAAmC;AAAA,EACvH;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,yCAAyC;AAAA,EAChH;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/dashboards/api/users/widgets/route.js

@@ -11,7 +11,7 @@ import {
   resolveWidgetAssignmentReadScope,
   resolveWidgetAssignmentTargetAccess
 } from "@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope";
-import { hasFeature } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard
@@ -38,7 +38,10 @@ async function GET(req) {
   const em = container.resolve("em");
   const rbac = container.resolve("rbacService");
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null });
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin
+  })) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
   const { tenantId, organizationId } = resolveWidgetAssignmentReadScope({
@@ -105,7 +108,10 @@ async function PUT(req) {
   const em = resolve("em");
   const rbac = resolve("rbacService");
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null });
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin
+  })) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
   const widgets = await loadAllWidgets();

package/dist/modules/dashboards/api/users/widgets/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/dashboards/api/users/widgets/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardUserWidgets } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { userWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport {\n  resolveWidgetAssignmentReadScope,\n  resolveWidgetAssignmentTargetAccess,\n} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardUserWidgetsResponseSchema,\n  dashboardUserWidgetsUpdateResponseSchema,\n} from '../../openapi'\n\nconst FEATURE = 'dashboards.admin.assign-widgets'\nconst RESOURCE_KIND = 'dashboards.userWidgets'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const userId = url.searchParams.get('userId')\n  if (!userId) return NextResponse.json({ error: 'userId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbac = container.resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const { tenantId, organizationId } = resolveWidgetAssignmentReadScope({\n    auth: { tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    isSuperAdmin: !!acl.isSuperAdmin,\n    queryTenantId: url.searchParams.get('tenantId'),\n    queryOrganizationId: url.searchParams.get('organizationId'),\n  })\n\n  const targetUserForRead = await em.findOne(User, { id: userId, deletedAt: null })\n  const readAccess = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: targetUserForRead,\n  })\n  if (readAccess === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (readAccess === 'not-found') {\n    return NextResponse.json({ error: 'User not found' }, { status: 404 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const targetAcl = await rbac.loadAcl(userId, { tenantId, organizationId })\n  const allowed = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId,\n      tenantId,\n      organizationId,\n      features: targetAcl.features ?? [],\n      isSuperAdmin: !!targetAcl.isSuperAdmin,\n    },\n    widgets,\n  )\n\n  const record = await em.findOne(DashboardUserWidgets, {\n    userId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  const response = {\n    mode: record ? record.mode : 'inherit',\n    widgetIds: record && record.mode === 'override' ? record.widgetIdsJson : [],\n    hasCustom: !!record && record.mode === 'override',\n    effectiveWidgetIds: allowed,\n    scope: { tenantId, organizationId },\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = userWidgetSettingsSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const validWidgetIds = new Set(widgets.map((w) => w.metadata.id))\n  const widgetIds = parsed.data.widgetIds.filter((id) => validWidgetIds.has(id))\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = auth.orgId ?? null\n\n  const targetUser = await em.findOne(User, { id: parsed.data.userId, deletedAt: null })\n  const writeAccess = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: targetUser,\n  })\n  if (writeAccess === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (writeAccess === 'not-found') {\n    return NextResponse.json({ error: 'User not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: tenantId ?? '',\n    organizationId,\n    userId: String(auth.sub),\n    resourceKind: RESOURCE_KIND,\n    resourceId: parsed.data.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { userId: parsed.data.userId, mode: parsed.data.mode, widgetIds },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let record = await em.findOne(DashboardUserWidgets, {\n    userId: parsed.data.userId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  if (parsed.data.mode === 'inherit') {\n    if (record) {\n      await em.remove(record).flush()\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId,\n        userId: String(auth.sub),\n        resourceKind: RESOURCE_KIND,\n        resourceId: parsed.data.userId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json({ ok: true, mode: 'inherit', widgetIds: [] })\n  }\n\n  if (!record) {\n    record = em.create(DashboardUserWidgets, {\n      userId: parsed.data.userId,\n      tenantId,\n      organizationId,\n      mode: 'override',\n      widgetIdsJson: widgetIds,\n    })\n    em.persist(record)\n  } else {\n    record.mode = 'override'\n    record.widgetIdsJson = widgetIds\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: tenantId ?? '',\n      organizationId,\n      userId: String(auth.sub),\n      resourceKind: RESOURCE_KIND,\n      resourceId: parsed.data.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, mode: 'override', widgetIds })\n}\n\nconst userWidgetsQuerySchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nconst userWidgetsGetDoc: OpenApiMethodDoc = {\n  summary: 'Read widget overrides for a user',\n  description: 'Returns the widgets inherited and explicitly configured for the requested user within the current scope.',\n  tags: [dashboardsTag],\n  query: userWidgetsQuerySchema,\n  responses: [\n    { status: 200, description: 'Widget settings for the user.', schema: dashboardUserWidgetsResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Missing user identifier', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage user widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst userWidgetsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update user-specific dashboard widgets',\n  description: 'Sets the widget override mode and allowed widgets for a user. Passing `mode: inherit` clears overrides.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: userWidgetSettingsSchema,\n    description: 'User identifier, override mode, and widget ids. Scope is derived from the authenticated session.',\n  },\n  responses: [\n    { status: 200, description: 'Overrides saved.', schema: dashboardUserWidgetsUpdateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or unknown widgets', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage user widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage user-level dashboard widgets',\n  methods: {\n    GET: userWidgetsGetDoc,\n    PUT: userWidgetsPutDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,kBAAkB;AAC3B;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,UAAU;AAChB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACrD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACvD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEtF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,EAAE,UAAU,eAAe,IAAI,iCAAiC;AAAA,IACpE,MAAM,EAAE,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IACnE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe,IAAI,aAAa,IAAI,UAAU;AAAA,IAC9C,qBAAqB,IAAI,aAAa,IAAI,gBAAgB;AAAA,EAC5D,CAAC;AAED,QAAM,oBAAoB,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,CAAC;AAChF,QAAM,aAAa,oCAAoC;AAAA,IACrD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,eAAe,aAAa;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,eAAe,aAAa;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ,EAAE,UAAU,eAAe,CAAC;AACzE,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,UAAU,YAAY,CAAC;AAAA,MACjC,cAAc,CAAC,CAAC,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACpD;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW;AAAA,IACf,MAAM,SAAS,OAAO,OAAO;AAAA,IAC7B,WAAW,UAAU,OAAO,SAAS,aAAa,OAAO,gBAAgB,CAAC;AAAA,IAC1E,WAAW,CAAC,CAAC,UAAU,OAAO,SAAS;AAAA,IACvC,oBAAoB;AAAA,IACpB,OAAO,EAAE,UAAU,eAAe;AAAA,EACpC;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,IAAI,UAAU,OAAO,GAAG;AAC3D,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,QAAM,YAAY,OAAO,KAAK,UAAU,OAAO,CAAC,OAAO,eAAe,IAAI,EAAE,CAAC;AAE7E,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,KAAK,SAAS;AAErC,QAAM,aAAa,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC;AACrF,QAAM,cAAc,oCAAoC;AAAA,IACtD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,gBAAgB,aAAa;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,gBAAgB,aAAa;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,cAAc;AAAA,IACd,YAAY,OAAO,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,OAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,MAAM,UAAU;AAAA,EACnF,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IAClD,QAAQ,OAAO,KAAK;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,OAAO,KAAK,SAAS,WAAW;AAClC,QAAI,QAAQ;AACV,YAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAAA,IAChC;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB;AAAA,QACA,QAAQ,OAAO,KAAK,GAAG;AAAA,QACvB,cAAc;AAAA,QACd,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,WAAW,WAAW,CAAC,EAAE,CAAC;AAAA,EACvE;AAEA,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,sBAAsB;AAAA,MACvC,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,eAAe;AAAA,IACjB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,OAAO;AACd,WAAO,gBAAgB;AAAA,EACzB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,KAAK,GAAG;AAAA,MACvB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,YAAY,UAAU,CAAC;AACpE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,mCAAmC;AAAA,EAC1G;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,yCAAyC;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { DashboardUserWidgets } from '@open-mercato/core/modules/dashboards/data/entities'\nimport { User } from '@open-mercato/core/modules/auth/data/entities'\nimport { userWidgetSettingsSchema } from '@open-mercato/core/modules/dashboards/data/validators'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'\nimport {\n  resolveWidgetAssignmentReadScope,\n  resolveWidgetAssignmentTargetAccess,\n} from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport {\n  dashboardsTag,\n  dashboardsErrorSchema,\n  dashboardUserWidgetsResponseSchema,\n  dashboardUserWidgetsUpdateResponseSchema,\n} from '../../openapi'\n\nconst FEATURE = 'dashboards.admin.assign-widgets'\nconst RESOURCE_KIND = 'dashboards.userWidgets'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: [FEATURE] },\n  PUT: { requireAuth: true, requireFeatures: [FEATURE] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const url = new URL(req.url)\n  const userId = url.searchParams.get('userId')\n  if (!userId) return NextResponse.json({ error: 'userId is required' }, { status: 400 })\n\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as any\n  const rbac = container.resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!authorizeFeatures([FEATURE], {\n    grantedFeatures: acl.features ?? [],\n    unrestricted: !!acl.isSuperAdmin,\n  })) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const { tenantId, organizationId } = resolveWidgetAssignmentReadScope({\n    auth: { tenantId: auth.tenantId ?? null, orgId: auth.orgId ?? null },\n    isSuperAdmin: !!acl.isSuperAdmin,\n    queryTenantId: url.searchParams.get('tenantId'),\n    queryOrganizationId: url.searchParams.get('organizationId'),\n  })\n\n  const targetUserForRead = await em.findOne(User, { id: userId, deletedAt: null })\n  const readAccess = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: targetUserForRead,\n  })\n  if (readAccess === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (readAccess === 'not-found') {\n    return NextResponse.json({ error: 'User not found' }, { status: 404 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const targetAcl = await rbac.loadAcl(userId, { tenantId, organizationId })\n  const allowed = await resolveAllowedWidgetIds(\n    em,\n    {\n      userId,\n      tenantId,\n      organizationId,\n      features: targetAcl.features ?? [],\n      isSuperAdmin: !!targetAcl.isSuperAdmin,\n    },\n    widgets,\n  )\n\n  const record = await em.findOne(DashboardUserWidgets, {\n    userId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  const response = {\n    mode: record ? record.mode : 'inherit',\n    widgetIds: record && record.mode === 'override' ? record.widgetIdsJson : [],\n    hasCustom: !!record && record.mode === 'override',\n    effectiveWidgetIds: allowed,\n    scope: { tenantId, organizationId },\n  }\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  let payload: unknown\n  try {\n    payload = await req.json()\n  } catch {\n    return NextResponse.json({ error: 'Invalid JSON body' }, { status: 400 })\n  }\n  const parsed = userWidgetSettingsSchema.safeParse(payload)\n  if (!parsed.success) {\n    return NextResponse.json({ error: 'Invalid payload', issues: parsed.error.issues }, { status: 400 })\n  }\n\n  const container = await createRequestContainer()\n  const { resolve } = container\n  const em = resolve('em') as any\n  const rbac = resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!authorizeFeatures([FEATURE], {\n    grantedFeatures: acl.features ?? [],\n    unrestricted: !!acl.isSuperAdmin,\n  })) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  const validWidgetIds = new Set(widgets.map((w) => w.metadata.id))\n  const widgetIds = parsed.data.widgetIds.filter((id) => validWidgetIds.has(id))\n\n  const tenantId = auth.tenantId ?? null\n  const organizationId = auth.orgId ?? null\n\n  const targetUser = await em.findOne(User, { id: parsed.data.userId, deletedAt: null })\n  const writeAccess = resolveWidgetAssignmentTargetAccess({\n    isSuperAdmin: !!acl.isSuperAdmin,\n    scopeTenantId: tenantId,\n    target: targetUser,\n  })\n  if (writeAccess === 'forbidden') {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (writeAccess === 'not-found') {\n    return NextResponse.json({ error: 'User not found' }, { status: 404 })\n  }\n\n  const guardResult = await validateCrudMutationGuard(container, {\n    tenantId: tenantId ?? '',\n    organizationId,\n    userId: String(auth.sub),\n    resourceKind: RESOURCE_KIND,\n    resourceId: parsed.data.userId,\n    operation: 'update',\n    requestMethod: req.method,\n    requestHeaders: req.headers,\n    mutationPayload: { userId: parsed.data.userId, mode: parsed.data.mode, widgetIds },\n  })\n  if (guardResult && !guardResult.ok) {\n    return NextResponse.json(guardResult.body, { status: guardResult.status })\n  }\n\n  let record = await em.findOne(DashboardUserWidgets, {\n    userId: parsed.data.userId,\n    tenantId,\n    organizationId,\n    deletedAt: null,\n  })\n\n  if (parsed.data.mode === 'inherit') {\n    if (record) {\n      await em.remove(record).flush()\n    }\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(container, {\n        tenantId: tenantId ?? '',\n        organizationId,\n        userId: String(auth.sub),\n        resourceKind: RESOURCE_KIND,\n        resourceId: parsed.data.userId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n    return NextResponse.json({ ok: true, mode: 'inherit', widgetIds: [] })\n  }\n\n  if (!record) {\n    record = em.create(DashboardUserWidgets, {\n      userId: parsed.data.userId,\n      tenantId,\n      organizationId,\n      mode: 'override',\n      widgetIdsJson: widgetIds,\n    })\n    em.persist(record)\n  } else {\n    record.mode = 'override'\n    record.widgetIdsJson = widgetIds\n  }\n  await em.flush()\n\n  if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n    await runCrudMutationGuardAfterSuccess(container, {\n      tenantId: tenantId ?? '',\n      organizationId,\n      userId: String(auth.sub),\n      resourceKind: RESOURCE_KIND,\n      resourceId: parsed.data.userId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      metadata: guardResult.metadata ?? null,\n    })\n  }\n\n  return NextResponse.json({ ok: true, mode: 'override', widgetIds })\n}\n\nconst userWidgetsQuerySchema = z.object({\n  userId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n  organizationId: z.string().uuid().optional(),\n})\n\nconst userWidgetsGetDoc: OpenApiMethodDoc = {\n  summary: 'Read widget overrides for a user',\n  description: 'Returns the widgets inherited and explicitly configured for the requested user within the current scope.',\n  tags: [dashboardsTag],\n  query: userWidgetsQuerySchema,\n  responses: [\n    { status: 200, description: 'Widget settings for the user.', schema: dashboardUserWidgetsResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Missing user identifier', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage user widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nconst userWidgetsPutDoc: OpenApiMethodDoc = {\n  summary: 'Update user-specific dashboard widgets',\n  description: 'Sets the widget override mode and allowed widgets for a user. Passing `mode: inherit` clears overrides.',\n  tags: [dashboardsTag],\n  requestBody: {\n    contentType: 'application/json',\n    schema: userWidgetSettingsSchema,\n    description: 'User identifier, override mode, and widget ids. Scope is derived from the authenticated session.',\n  },\n  responses: [\n    { status: 200, description: 'Overrides saved.', schema: dashboardUserWidgetsUpdateResponseSchema },\n  ],\n  errors: [\n    { status: 400, description: 'Invalid payload or unknown widgets', schema: dashboardsErrorSchema },\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to manage user widgets', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Manage user-level dashboard widgets',\n  methods: {\n    GET: userWidgetsGetDoc,\n    PUT: userWidgetsPutDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAClB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,4BAA4B;AACrC,SAAS,YAAY;AACrB,SAAS,gCAAgC;AACzC,SAAS,sBAAsB;AAC/B,SAAS,+BAA+B;AACxC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AAEP;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAEP,MAAM,UAAU;AAChB,MAAM,gBAAgB;AAEf,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AAAA,EACrD,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,OAAO,EAAE;AACvD;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,IAAI,aAAa,IAAI,QAAQ;AAC5C,MAAI,CAAC,OAAQ,QAAO,aAAa,KAAK,EAAE,OAAO,qBAAqB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAEtF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,UAAU,QAAQ,aAAa;AAC5C,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,kBAAkB,CAAC,OAAO,GAAG;AAAA,IAChC,iBAAiB,IAAI,YAAY,CAAC;AAAA,IAClC,cAAc,CAAC,CAAC,IAAI;AAAA,EACtB,CAAC,GAAG;AACF,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,EAAE,UAAU,eAAe,IAAI,iCAAiC;AAAA,IACpE,MAAM,EAAE,UAAU,KAAK,YAAY,MAAM,OAAO,KAAK,SAAS,KAAK;AAAA,IACnE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe,IAAI,aAAa,IAAI,UAAU;AAAA,IAC9C,qBAAqB,IAAI,aAAa,IAAI,gBAAgB;AAAA,EAC5D,CAAC;AAED,QAAM,oBAAoB,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,QAAQ,WAAW,KAAK,CAAC;AAChF,QAAM,aAAa,oCAAoC;AAAA,IACrD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,eAAe,aAAa;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,eAAe,aAAa;AAC9B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,YAAY,MAAM,KAAK,QAAQ,QAAQ,EAAE,UAAU,eAAe,CAAC;AACzE,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,MACE;AAAA,MACA;AAAA,MACA;AAAA,MACA,UAAU,UAAU,YAAY,CAAC;AAAA,MACjC,cAAc,CAAC,CAAC,UAAU;AAAA,IAC5B;AAAA,IACA;AAAA,EACF;AAEA,QAAM,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACpD;AAAA,IACA;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,QAAM,WAAW;AAAA,IACf,MAAM,SAAS,OAAO,OAAO;AAAA,IAC7B,WAAW,UAAU,OAAO,SAAS,aAAa,OAAO,gBAAgB,CAAC;AAAA,IAC1E,WAAW,CAAC,CAAC,UAAU,OAAO,SAAS;AAAA,IACvC,oBAAoB;AAAA,IACpB,OAAO,EAAE,UAAU,eAAe;AAAA,EACpC;AAEA,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,MAAI;AACJ,MAAI;AACF,cAAU,MAAM,IAAI,KAAK;AAAA,EAC3B,QAAQ;AACN,WAAO,aAAa,KAAK,EAAE,OAAO,oBAAoB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1E;AACA,QAAM,SAAS,yBAAyB,UAAU,OAAO;AACzD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,OAAO,mBAAmB,QAAQ,OAAO,MAAM,OAAO,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACrG;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,EAAE,QAAQ,IAAI;AACpB,QAAM,KAAK,QAAQ,IAAI;AACvB,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,kBAAkB,CAAC,OAAO,GAAG;AAAA,IAChC,iBAAiB,IAAI,YAAY,CAAC;AAAA,IAClC,cAAc,CAAC,CAAC,IAAI;AAAA,EACtB,CAAC,GAAG;AACF,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,QAAM,iBAAiB,IAAI,IAAI,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC;AAChE,QAAM,YAAY,OAAO,KAAK,UAAU,OAAO,CAAC,OAAO,eAAe,IAAI,EAAE,CAAC;AAE7E,QAAM,WAAW,KAAK,YAAY;AAClC,QAAM,iBAAiB,KAAK,SAAS;AAErC,QAAM,aAAa,MAAM,GAAG,QAAQ,MAAM,EAAE,IAAI,OAAO,KAAK,QAAQ,WAAW,KAAK,CAAC;AACrF,QAAM,cAAc,oCAAoC;AAAA,IACtD,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,eAAe;AAAA,IACf,QAAQ;AAAA,EACV,CAAC;AACD,MAAI,gBAAgB,aAAa;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,MAAI,gBAAgB,aAAa;AAC/B,WAAO,aAAa,KAAK,EAAE,OAAO,iBAAiB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AAEA,QAAM,cAAc,MAAM,0BAA0B,WAAW;AAAA,IAC7D,UAAU,YAAY;AAAA,IACtB;AAAA,IACA,QAAQ,OAAO,KAAK,GAAG;AAAA,IACvB,cAAc;AAAA,IACd,YAAY,OAAO,KAAK;AAAA,IACxB,WAAW;AAAA,IACX,eAAe,IAAI;AAAA,IACnB,gBAAgB,IAAI;AAAA,IACpB,iBAAiB,EAAE,QAAQ,OAAO,KAAK,QAAQ,MAAM,OAAO,KAAK,MAAM,UAAU;AAAA,EACnF,CAAC;AACD,MAAI,eAAe,CAAC,YAAY,IAAI;AAClC,WAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,EAC3E;AAEA,MAAI,SAAS,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IAClD,QAAQ,OAAO,KAAK;AAAA,IACpB;AAAA,IACA;AAAA,IACA,WAAW;AAAA,EACb,CAAC;AAED,MAAI,OAAO,KAAK,SAAS,WAAW;AAClC,QAAI,QAAQ;AACV,YAAM,GAAG,OAAO,MAAM,EAAE,MAAM;AAAA,IAChC;AACA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,WAAW;AAAA,QAChD,UAAU,YAAY;AAAA,QACtB;AAAA,QACA,QAAQ,OAAO,KAAK,GAAG;AAAA,QACvB,cAAc;AAAA,QACd,YAAY,OAAO,KAAK;AAAA,QACxB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AACA,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,WAAW,WAAW,CAAC,EAAE,CAAC;AAAA,EACvE;AAEA,MAAI,CAAC,QAAQ;AACX,aAAS,GAAG,OAAO,sBAAsB;AAAA,MACvC,QAAQ,OAAO,KAAK;AAAA,MACpB;AAAA,MACA;AAAA,MACA,MAAM;AAAA,MACN,eAAe;AAAA,IACjB,CAAC;AACD,OAAG,QAAQ,MAAM;AAAA,EACnB,OAAO;AACL,WAAO,OAAO;AACd,WAAO,gBAAgB;AAAA,EACzB;AACA,QAAM,GAAG,MAAM;AAEf,MAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,UAAM,iCAAiC,WAAW;AAAA,MAChD,UAAU,YAAY;AAAA,MACtB;AAAA,MACA,QAAQ,OAAO,KAAK,GAAG;AAAA,MACvB,cAAc;AAAA,MACd,YAAY,OAAO,KAAK;AAAA,MACxB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,UAAU,YAAY,YAAY;AAAA,IACpC,CAAC;AAAA,EACH;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,YAAY,UAAU,CAAC;AACpE;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAAA,EACrC,gBAAgB,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AAC7C,CAAC;AAED,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,OAAO;AAAA,EACP,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,mCAAmC;AAAA,EAC1G;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEA,MAAM,oBAAsC;AAAA,EAC1C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,yCAAyC;AAAA,EACnG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,sBAAsB;AAAA,IAChG,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,IACL,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/dashboards/api/widgets/catalog.js

@@ -2,7 +2,6 @@ import { NextResponse } from "next/server";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { loadAllWidgets } from "@open-mercato/core/modules/dashboards/lib/widgets";
-import { hasFeature } from "@open-mercato/shared/security/features";
 import { dashboardsTag, dashboardsErrorSchema, dashboardWidgetCatalogSchema } from "../openapi.js";
 const metadata = {
   GET: { requireAuth: true, requireFeatures: ["dashboards.admin.assign-widgets"] }
@@ -12,8 +11,12 @@ async function GET(req) {
   if (!auth) return NextResponse.json({ error: "Unauthorized" }, { status: 401 });
   const { resolve } = await createRequestContainer();
   const rbac = resolve("rbacService");
-  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null });
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, "dashboards.admin.assign-widgets")) {
+  const canAssignWidgets = await rbac.userHasAllFeatures(
+    auth.sub,
+    ["dashboards.admin.assign-widgets"],
+    { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null }
+  );
+  if (!canAssignWidgets) {
     return NextResponse.json({ error: "Forbidden" }, { status: 403 });
   }
   const widgets = await loadAllWidgets();

package/dist/modules/dashboards/api/widgets/catalog.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/dashboards/api/widgets/catalog.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema, dashboardWidgetCatalogSchema } from '../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.admin.assign-widgets'] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const rbac = resolve('rbacService') as any\n  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })\n  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.admin.assign-widgets')) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  return NextResponse.json({\n    items: widgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? 'md',\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  })\n}\n\nconst widgetCatalogGetDoc: OpenApiMethodDoc = {\n  summary: 'List available dashboard widgets',\n  description: 'Returns the catalog of widgets that modules expose, including defaults and feature requirements.',\n  tags: [dashboardsTag],\n  responses: [\n    { status: 200, description: 'Widgets available for assignment.', schema: dashboardWidgetCatalogSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to view widget catalog', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Dashboard widget catalog',\n  methods: {\n    GET: widgetCatalogGetDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAC/B,SAAS,kBAAkB;AAE3B,SAAS,eAAe,uBAAuB,oCAAoC;AAE5E,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,KAAK,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK,CAAC;AAChH,MAAI,CAAC,IAAI,gBAAgB,CAAC,WAAW,IAAI,UAAU,iCAAiC,GAAG;AACrF,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC9B,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,6BAA6B;AAAA,EACxG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { dashboardsTag, dashboardsErrorSchema, dashboardWidgetCatalogSchema } from '../openapi'\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['dashboards.admin.assign-widgets'] },\n}\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n\n  const { resolve } = await createRequestContainer()\n  const rbac = resolve('rbacService') as any\n  const canAssignWidgets = await rbac.userHasAllFeatures(\n    auth.sub,\n    ['dashboards.admin.assign-widgets'],\n    { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },\n  )\n  if (!canAssignWidgets) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  const widgets = await loadAllWidgets()\n  return NextResponse.json({\n    items: widgets.map((widget) => ({\n      id: widget.metadata.id,\n      title: widget.metadata.title,\n      description: widget.metadata.description ?? null,\n      defaultSize: widget.metadata.defaultSize ?? 'md',\n      defaultEnabled: !!widget.metadata.defaultEnabled,\n      defaultSettings: widget.metadata.defaultSettings ?? null,\n      features: widget.metadata.features ?? [],\n      moduleId: widget.moduleId,\n      icon: widget.metadata.icon ?? null,\n      loaderKey: widget.key,\n      supportsRefresh: !!widget.metadata.supportsRefresh,\n    })),\n  })\n}\n\nconst widgetCatalogGetDoc: OpenApiMethodDoc = {\n  summary: 'List available dashboard widgets',\n  description: 'Returns the catalog of widgets that modules expose, including defaults and feature requirements.',\n  tags: [dashboardsTag],\n  responses: [\n    { status: 200, description: 'Widgets available for assignment.', schema: dashboardWidgetCatalogSchema },\n  ],\n  errors: [\n    { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },\n    { status: 403, description: 'Insufficient permissions to view widget catalog', schema: dashboardsErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: dashboardsTag,\n  summary: 'Dashboard widget catalog',\n  methods: {\n    GET: widgetCatalogGetDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,sBAAsB;AAE/B,SAAS,eAAe,uBAAuB,oCAAoC;AAE5E,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iCAAiC,EAAE;AACjF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE9E,QAAM,EAAE,QAAQ,IAAI,MAAM,uBAAuB;AACjD,QAAM,OAAO,QAAQ,aAAa;AAClC,QAAM,mBAAmB,MAAM,KAAK;AAAA,IAClC,KAAK;AAAA,IACL,CAAC,iCAAiC;AAAA,IAClC,EAAE,UAAU,KAAK,YAAY,MAAM,gBAAgB,KAAK,SAAS,KAAK;AAAA,EACxE;AACA,MAAI,CAAC,kBAAkB;AACrB,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,QAAM,UAAU,MAAM,eAAe;AACrC,SAAO,aAAa,KAAK;AAAA,IACvB,OAAO,QAAQ,IAAI,CAAC,YAAY;AAAA,MAC9B,IAAI,OAAO,SAAS;AAAA,MACpB,OAAO,OAAO,SAAS;AAAA,MACvB,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,aAAa,OAAO,SAAS,eAAe;AAAA,MAC5C,gBAAgB,CAAC,CAAC,OAAO,SAAS;AAAA,MAClC,iBAAiB,OAAO,SAAS,mBAAmB;AAAA,MACpD,UAAU,OAAO,SAAS,YAAY,CAAC;AAAA,MACvC,UAAU,OAAO;AAAA,MACjB,MAAM,OAAO,SAAS,QAAQ;AAAA,MAC9B,WAAW,OAAO;AAAA,MAClB,iBAAiB,CAAC,CAAC,OAAO,SAAS;AAAA,IACrC,EAAE;AAAA,EACJ,CAAC;AACH;AAEA,MAAM,sBAAwC;AAAA,EAC5C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,aAAa;AAAA,EACpB,WAAW;AAAA,IACT,EAAE,QAAQ,KAAK,aAAa,qCAAqC,QAAQ,6BAA6B;AAAA,EACxG;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,sBAAsB;AAAA,IACrF,EAAE,QAAQ,KAAK,aAAa,mDAAmD,QAAQ,sBAAsB;AAAA,EAC/G;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,EACP;AACF;",
   "names": []
 }

package/dist/modules/dashboards/lib/access.js

@@ -1,6 +1,6 @@
 import { DashboardRoleWidgets, DashboardUserWidgets } from "../data/entities.js";
 import { UserRole } from "@open-mercato/core/modules/auth/data/entities";
-import { hasAllFeatures as userHasAllFeatures } from "@open-mercato/shared/security/features";
+import { authorizeFeatures } from "@open-mercato/shared/security/featurePolicy";
 import { findWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 function specificity(record) {
   let score = 0;
@@ -62,8 +62,10 @@ async function resolveAllowedWidgetIds(em, ctx, widgets) {
   if (baseSet.size === 0) return [];
   const filtered = widgets.filter((widget) => {
     if (!baseSet.has(widget.metadata.id)) return false;
-    if (ctx.isSuperAdmin) return true;
-    return userHasAllFeatures(ctx.features, widget.metadata.features ?? []);
+    return authorizeFeatures(widget.metadata.features ?? [], {
+      grantedFeatures: ctx.features,
+      unrestricted: ctx.isSuperAdmin
+    });
   });
   return filtered.map((widget) => widget.metadata.id);
 }

package/dist/modules/dashboards/lib/access.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/dashboards/lib/access.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { DashboardRoleWidgets, DashboardUserWidgets } from '../data/entities'\nimport { UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { hasAllFeatures as userHasAllFeatures } from '@open-mercato/shared/security/features'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype LoadedWidget = {\n  metadata: {\n    id: string\n    features?: string[]\n  }\n}\n\ntype AccessContext = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n  features: string[]\n  isSuperAdmin: boolean\n}\n\nfunction specificity(record: DashboardRoleWidgets): number {\n  let score = 0\n  if (record.tenantId) score += 1\n  if (record.organizationId) score += 2\n  return score\n}\n\nexport async function resolveAllowedWidgetIds(\n  em: EntityManager,\n  ctx: AccessContext,\n  widgets: LoadedWidget[],\n): Promise<string[]> {\n  const allWidgetIds = widgets.map((w) => w.metadata.id)\n\n  // Load user override (if any)\n  const userRecord = await em.findOne(DashboardUserWidgets, {\n    userId: ctx.userId,\n    tenantId: ctx.tenantId,\n    organizationId: ctx.organizationId,\n    deletedAt: null,\n  })\n\n  let allowedByUser: Set<string> | null = null\n  if (userRecord) {\n    if (userRecord.mode === 'override') {\n      allowedByUser = new Set(userRecord.widgetIdsJson.filter((id) => allWidgetIds.includes(id)))\n    } else {\n      allowedByUser = null\n    }\n  }\n\n  let baseSet: Set<string>\n  if (allowedByUser) {\n    // A user override fully determines visibility, so role-level lookups would\n    // be discarded \u2014 skip them entirely. An empty override is handled by the\n    // shared `baseSet.size === 0` guard below.\n    baseSet = allowedByUser\n  } else {\n    // No user override: aggregate role-level settings.\n    const userRoles = await findWithDecryption(\n      em,\n      UserRole,\n      { user: ctx.userId as any, deletedAt: null },\n      { populate: ['role'] },\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n    )\n    const roleRecords = await em.find(DashboardRoleWidgets, {\n      roleId: { $in: userRoles.map((ur) => String(ur.role?.id || ur.role)) },\n      deletedAt: null,\n    })\n\n    const byRole = new Map<string, DashboardRoleWidgets>()\n    for (const record of roleRecords) {\n      const role = String(record.roleId)\n      if (record.tenantId && ctx.tenantId && record.tenantId !== ctx.tenantId) continue\n      if (record.tenantId && !ctx.tenantId) continue\n      if (record.organizationId && ctx.organizationId && record.organizationId !== ctx.organizationId) continue\n      if (record.organizationId && !ctx.organizationId) continue\n      const current = byRole.get(role)\n      if (!current || specificity(record) > specificity(current)) {\n        byRole.set(role, record)\n      }\n    }\n\n    const allowedByRole = new Set<string>()\n    for (const record of byRole.values()) {\n      for (const id of record.widgetIdsJson) {\n        if (allWidgetIds.includes(id)) allowedByRole.add(id)\n      }\n    }\n\n    baseSet = allowedByRole.size > 0 ? allowedByRole : new Set(allWidgetIds)\n  }\n\n  if (baseSet.size === 0) return []\n\n  const filtered = widgets.filter((widget) => {\n    if (!baseSet.has(widget.metadata.id)) return false\n    if (ctx.isSuperAdmin) return true\n    return userHasAllFeatures(ctx.features, widget.metadata.features ?? [])\n  })\n\n  return filtered.map((widget) => widget.metadata.id)\n}\n"],
-  "mappings": "AACA,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,gBAAgB;AACzB,SAAS,kBAAkB,0BAA0B;AACrD,SAAS,0BAA0B;AAiBnC,SAAS,YAAY,QAAsC;AACzD,MAAI,QAAQ;AACZ,MAAI,OAAO,SAAU,UAAS;AAC9B,MAAI,OAAO,eAAgB,UAAS;AACpC,SAAO;AACT;AAEA,eAAsB,wBACpB,IACA,KACA,SACmB;AACnB,QAAM,eAAe,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;AAGrD,QAAM,aAAa,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACxD,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,gBAAgB,IAAI;AAAA,IACpB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,gBAAoC;AACxC,MAAI,YAAY;AACd,QAAI,WAAW,SAAS,YAAY;AAClC,sBAAgB,IAAI,IAAI,WAAW,cAAc,OAAO,CAAC,OAAO,aAAa,SAAS,EAAE,CAAC,CAAC;AAAA,IAC5F,OAAO;AACL,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,eAAe;AAIjB,cAAU;AAAA,EACZ,OAAO;AAEL,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,IAAI,QAAe,WAAW,KAAK;AAAA,MAC3C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,IAC/D;AACA,UAAM,cAAc,MAAM,GAAG,KAAK,sBAAsB;AAAA,MACtD,QAAQ,EAAE,KAAK,UAAU,IAAI,CAAC,OAAO,OAAO,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;AAAA,MACrE,WAAW;AAAA,IACb,CAAC;AAED,UAAM,SAAS,oBAAI,IAAkC;AACrD,eAAW,UAAU,aAAa;AAChC,YAAM,OAAO,OAAO,OAAO,MAAM;AACjC,UAAI,OAAO,YAAY,IAAI,YAAY,OAAO,aAAa,IAAI,SAAU;AACzE,UAAI,OAAO,YAAY,CAAC,IAAI,SAAU;AACtC,UAAI,OAAO,kBAAkB,IAAI,kBAAkB,OAAO,mBAAmB,IAAI,eAAgB;AACjG,UAAI,OAAO,kBAAkB,CAAC,IAAI,eAAgB;AAClD,YAAM,UAAU,OAAO,IAAI,IAAI;AAC/B,UAAI,CAAC,WAAW,YAAY,MAAM,IAAI,YAAY,OAAO,GAAG;AAC1D,eAAO,IAAI,MAAM,MAAM;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,gBAAgB,oBAAI,IAAY;AACtC,eAAW,UAAU,OAAO,OAAO,GAAG;AACpC,iBAAW,MAAM,OAAO,eAAe;AACrC,YAAI,aAAa,SAAS,EAAE,EAAG,eAAc,IAAI,EAAE;AAAA,MACrD;AAAA,IACF;AAEA,cAAU,cAAc,OAAO,IAAI,gBAAgB,IAAI,IAAI,YAAY;AAAA,EACzE;AAEA,MAAI,QAAQ,SAAS,EAAG,QAAO,CAAC;AAEhC,QAAM,WAAW,QAAQ,OAAO,CAAC,WAAW;AAC1C,QAAI,CAAC,QAAQ,IAAI,OAAO,SAAS,EAAE,EAAG,QAAO;AAC7C,QAAI,IAAI,aAAc,QAAO;AAC7B,WAAO,mBAAmB,IAAI,UAAU,OAAO,SAAS,YAAY,CAAC,CAAC;AAAA,EACxE,CAAC;AAED,SAAO,SAAS,IAAI,CAAC,WAAW,OAAO,SAAS,EAAE;AACpD;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport { DashboardRoleWidgets, DashboardUserWidgets } from '../data/entities'\nimport { UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\ntype LoadedWidget = {\n  metadata: {\n    id: string\n    features?: string[]\n  }\n}\n\ntype AccessContext = {\n  userId: string\n  tenantId: string | null\n  organizationId: string | null\n  features: string[]\n  isSuperAdmin: boolean\n}\n\nfunction specificity(record: DashboardRoleWidgets): number {\n  let score = 0\n  if (record.tenantId) score += 1\n  if (record.organizationId) score += 2\n  return score\n}\n\nexport async function resolveAllowedWidgetIds(\n  em: EntityManager,\n  ctx: AccessContext,\n  widgets: LoadedWidget[],\n): Promise<string[]> {\n  const allWidgetIds = widgets.map((w) => w.metadata.id)\n\n  // Load user override (if any)\n  const userRecord = await em.findOne(DashboardUserWidgets, {\n    userId: ctx.userId,\n    tenantId: ctx.tenantId,\n    organizationId: ctx.organizationId,\n    deletedAt: null,\n  })\n\n  let allowedByUser: Set<string> | null = null\n  if (userRecord) {\n    if (userRecord.mode === 'override') {\n      allowedByUser = new Set(userRecord.widgetIdsJson.filter((id) => allWidgetIds.includes(id)))\n    } else {\n      allowedByUser = null\n    }\n  }\n\n  let baseSet: Set<string>\n  if (allowedByUser) {\n    // A user override fully determines visibility, so role-level lookups would\n    // be discarded \u2014 skip them entirely. An empty override is handled by the\n    // shared `baseSet.size === 0` guard below.\n    baseSet = allowedByUser\n  } else {\n    // No user override: aggregate role-level settings.\n    const userRoles = await findWithDecryption(\n      em,\n      UserRole,\n      { user: ctx.userId as any, deletedAt: null },\n      { populate: ['role'] },\n      { tenantId: ctx.tenantId, organizationId: ctx.organizationId },\n    )\n    const roleRecords = await em.find(DashboardRoleWidgets, {\n      roleId: { $in: userRoles.map((ur) => String(ur.role?.id || ur.role)) },\n      deletedAt: null,\n    })\n\n    const byRole = new Map<string, DashboardRoleWidgets>()\n    for (const record of roleRecords) {\n      const role = String(record.roleId)\n      if (record.tenantId && ctx.tenantId && record.tenantId !== ctx.tenantId) continue\n      if (record.tenantId && !ctx.tenantId) continue\n      if (record.organizationId && ctx.organizationId && record.organizationId !== ctx.organizationId) continue\n      if (record.organizationId && !ctx.organizationId) continue\n      const current = byRole.get(role)\n      if (!current || specificity(record) > specificity(current)) {\n        byRole.set(role, record)\n      }\n    }\n\n    const allowedByRole = new Set<string>()\n    for (const record of byRole.values()) {\n      for (const id of record.widgetIdsJson) {\n        if (allWidgetIds.includes(id)) allowedByRole.add(id)\n      }\n    }\n\n    baseSet = allowedByRole.size > 0 ? allowedByRole : new Set(allWidgetIds)\n  }\n\n  if (baseSet.size === 0) return []\n\n  const filtered = widgets.filter((widget) => {\n    if (!baseSet.has(widget.metadata.id)) return false\n    return authorizeFeatures(widget.metadata.features ?? [], {\n      grantedFeatures: ctx.features,\n      unrestricted: ctx.isSuperAdmin,\n    })\n  })\n\n  return filtered.map((widget) => widget.metadata.id)\n}\n"],
+  "mappings": "AACA,SAAS,sBAAsB,4BAA4B;AAC3D,SAAS,gBAAgB;AACzB,SAAS,yBAAyB;AAClC,SAAS,0BAA0B;AAiBnC,SAAS,YAAY,QAAsC;AACzD,MAAI,QAAQ;AACZ,MAAI,OAAO,SAAU,UAAS;AAC9B,MAAI,OAAO,eAAgB,UAAS;AACpC,SAAO;AACT;AAEA,eAAsB,wBACpB,IACA,KACA,SACmB;AACnB,QAAM,eAAe,QAAQ,IAAI,CAAC,MAAM,EAAE,SAAS,EAAE;AAGrD,QAAM,aAAa,MAAM,GAAG,QAAQ,sBAAsB;AAAA,IACxD,QAAQ,IAAI;AAAA,IACZ,UAAU,IAAI;AAAA,IACd,gBAAgB,IAAI;AAAA,IACpB,WAAW;AAAA,EACb,CAAC;AAED,MAAI,gBAAoC;AACxC,MAAI,YAAY;AACd,QAAI,WAAW,SAAS,YAAY;AAClC,sBAAgB,IAAI,IAAI,WAAW,cAAc,OAAO,CAAC,OAAO,aAAa,SAAS,EAAE,CAAC,CAAC;AAAA,IAC5F,OAAO;AACL,sBAAgB;AAAA,IAClB;AAAA,EACF;AAEA,MAAI;AACJ,MAAI,eAAe;AAIjB,cAAU;AAAA,EACZ,OAAO;AAEL,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,IAAI,QAAe,WAAW,KAAK;AAAA,MAC3C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,MACrB,EAAE,UAAU,IAAI,UAAU,gBAAgB,IAAI,eAAe;AAAA,IAC/D;AACA,UAAM,cAAc,MAAM,GAAG,KAAK,sBAAsB;AAAA,MACtD,QAAQ,EAAE,KAAK,UAAU,IAAI,CAAC,OAAO,OAAO,GAAG,MAAM,MAAM,GAAG,IAAI,CAAC,EAAE;AAAA,MACrE,WAAW;AAAA,IACb,CAAC;AAED,UAAM,SAAS,oBAAI,IAAkC;AACrD,eAAW,UAAU,aAAa;AAChC,YAAM,OAAO,OAAO,OAAO,MAAM;AACjC,UAAI,OAAO,YAAY,IAAI,YAAY,OAAO,aAAa,IAAI,SAAU;AACzE,UAAI,OAAO,YAAY,CAAC,IAAI,SAAU;AACtC,UAAI,OAAO,kBAAkB,IAAI,kBAAkB,OAAO,mBAAmB,IAAI,eAAgB;AACjG,UAAI,OAAO,kBAAkB,CAAC,IAAI,eAAgB;AAClD,YAAM,UAAU,OAAO,IAAI,IAAI;AAC/B,UAAI,CAAC,WAAW,YAAY,MAAM,IAAI,YAAY,OAAO,GAAG;AAC1D,eAAO,IAAI,MAAM,MAAM;AAAA,MACzB;AAAA,IACF;AAEA,UAAM,gBAAgB,oBAAI,IAAY;AACtC,eAAW,UAAU,OAAO,OAAO,GAAG;AACpC,iBAAW,MAAM,OAAO,eAAe;AACrC,YAAI,aAAa,SAAS,EAAE,EAAG,eAAc,IAAI,EAAE;AAAA,MACrD;AAAA,IACF;AAEA,cAAU,cAAc,OAAO,IAAI,gBAAgB,IAAI,IAAI,YAAY;AAAA,EACzE;AAEA,MAAI,QAAQ,SAAS,EAAG,QAAO,CAAC;AAEhC,QAAM,WAAW,QAAQ,OAAO,CAAC,WAAW;AAC1C,QAAI,CAAC,QAAQ,IAAI,OAAO,SAAS,EAAE,EAAG,QAAO;AAC7C,WAAO,kBAAkB,OAAO,SAAS,YAAY,CAAC,GAAG;AAAA,MACvD,iBAAiB,IAAI;AAAA,MACrB,cAAc,IAAI;AAAA,IACpB,CAAC;AAAA,EACH,CAAC;AAED,SAAO,SAAS,IAAI,CAAC,WAAW,OAAO,SAAS,EAAE;AACpD;",
   "names": []
 }

package/dist/modules/directory/api/organization-branding/route.js

@@ -26,10 +26,12 @@ const brandingResponseSchema = z.object({
   organizationName: z.string(),
   tenantId: z.string().uuid(),
   logoUrl: z.string().nullable(),
+  logoPreserveAspectRatio: z.boolean(),
   updatedAt: z.string().nullable()
 });
 const brandingUpdateSchema = z.object({
-  logoUrl: organizationUpdateSchema.shape.logoUrl
+  logoUrl: organizationUpdateSchema.shape.logoUrl,
+  logoPreserveAspectRatio: organizationUpdateSchema.shape.logoPreserveAspectRatio
 });
 const errorSchema = z.object({
   error: z.string()
@@ -109,6 +111,7 @@ function toResponsePayload(organization, tenantId) {
     organizationName: organization.name,
     tenantId,
     logoUrl: organization.logoUrl ?? null,
+    logoPreserveAspectRatio: !!organization.logoPreserveAspectRatio,
     updatedAt: toIsoOrNull(organization.updatedAt)
   };
 }
@@ -174,7 +177,10 @@ async function PUT(req) {
       operation: "update",
       requestMethod: req.method,
       requestHeaders: req.headers,
-      mutationPayload: { logoUrl: parsed.data.logoUrl ?? null }
+      mutationPayload: {
+        logoUrl: parsed.data.logoUrl ?? null,
+        ...parsed.data.logoPreserveAspectRatio !== void 0 ? { logoPreserveAspectRatio: parsed.data.logoPreserveAspectRatio } : {}
+      }
     });
     if (guardResult && !guardResult.ok) {
       return NextResponse.json(guardResult.body, { status: guardResult.status });
@@ -193,7 +199,8 @@ async function PUT(req) {
         input: {
           id: resolved.organizationId,
           tenantId: resolved.tenantId,
-          logoUrl: parsed.data.logoUrl ?? null
+          logoUrl: parsed.data.logoUrl ?? null,
+          ...parsed.data.logoPreserveAspectRatio !== void 0 ? { logoPreserveAspectRatio: parsed.data.logoPreserveAspectRatio } : {}
         },
         ctx
       }

package/dist/modules/directory/api/organization-branding/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../src/modules/directory/api/organization-branding/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { organizationUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport '@open-mercato/core/modules/directory/commands/organizations'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'organization-branding' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['directory.organizations.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n}\n\nconst brandingResponseSchema = z.object({\n  organizationId: z.string().uuid(),\n  organizationName: z.string(),\n  tenantId: z.string().uuid(),\n  logoUrl: z.string().nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst brandingUpdateSchema = z.object({\n  logoUrl: organizationUpdateSchema.shape.logoUrl,\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\ntype RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>\n\nfunction buildCommandContext(\n  container: RequestContainer,\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,\n  req: Request,\n  organizationId: string,\n  tenantId: string,\n): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: {\n      selectedId: organizationId,\n      filterIds: [organizationId],\n      allowedIds: null,\n      tenantId,\n    },\n    selectedOrganizationId: organizationId,\n    organizationIds: [organizationId],\n    request: req,\n  }\n}\n\nasync function resolveCurrentOrganization(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return {\n      response: NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 }),\n    }\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope.selectedId ?? auth.orgId ?? null\n  const tenantId = scope.tenantId ?? auth.tenantId ?? null\n  if (!organizationId || !tenantId) {\n    return {\n      response: NextResponse.json(\n        {\n          error: translate(\n            'directory.branding.errors.organizationRequired',\n            'Select a single organization before changing sidebar branding.',\n          ),\n        },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const em = container.resolve('em') as EntityManager\n  const organization = await findOneWithDecryption(\n    em,\n    Organization,\n    { id: organizationId, tenant: tenantId, deletedAt: null },\n    { populate: ['tenant'] },\n    { tenantId, organizationId },\n  )\n  if (!organization) {\n    return {\n      response: NextResponse.json(\n        { error: translate('directory.branding.errors.notFound', 'Organization not found') },\n        { status: 404 },\n      ),\n    }\n  }\n\n  return { auth, container, organization, organizationId, tenantId, translate }\n}\n\nfunction toIsoOrNull(value: Date | string | null | undefined): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    const ms = value.getTime()\n    return Number.isFinite(ms) ? new Date(ms).toISOString() : null\n  }\n  const trimmed = String(value).trim()\n  if (!trimmed) return null\n  const parsed = new Date(trimmed)\n  return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : null\n}\n\nfunction toResponsePayload(organization: Organization, tenantId: string) {\n  return {\n    organizationId: String(organization.id),\n    organizationName: organization.name,\n    tenantId,\n    logoUrl: organization.logoUrl ?? null,\n    updatedAt: toIsoOrNull(organization.updatedAt),\n  }\n}\n\nasync function invalidateSidebarBrandingCache(container: RequestContainer, organizationId: string, tenantId: string) {\n  try {\n    const cache = container.resolve('cache') as {\n      deleteByTags?: (tags: string[]) => Promise<unknown>\n    } | null\n    await runWithCacheTenant(tenantId, () =>\n      cache?.deleteByTags?.([\n        `nav:sidebar:organization:${organizationId}`,\n        `nav:sidebar:tenant:${tenantId}`,\n      ]),\n    )\n  } catch {\n    // Cache invalidation is best-effort; the persisted branding is the source of truth.\n  }\n}\n\nexport async function GET(req: Request) {\n  const resolved = await resolveCurrentOrganization(req)\n  if ('response' in resolved) return resolved.response\n\n  return NextResponse.json(toResponsePayload(resolved.organization, resolved.tenantId))\n}\n\nexport async function PUT(req: Request) {\n  const resolved = await resolveCurrentOrganization(req)\n  if ('response' in resolved) return resolved.response\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.') },\n      { status: 422 },\n    )\n  }\n  if (!body || typeof body !== 'object' || !Object.prototype.hasOwnProperty.call(body, 'logoUrl')) {\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.') },\n      { status: 422 },\n    )\n  }\n\n  const parsed = brandingUpdateSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      {\n        error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.'),\n        issues: parsed.error.issues,\n      },\n      { status: 422 },\n    )\n  }\n\n  try {\n    // Refuse a stale overwrite when two tabs edit the same organization branding.\n    // Strictly additive \u2014 a no-op when the client omits the expected-version header.\n    enforceCommandOptimisticLock({\n      resourceKind: 'directory.organization',\n      resourceId: resolved.organizationId,\n      current: resolved.organization.updatedAt ?? null,\n      request: req,\n    })\n\n    // Mutation-guard contract for custom write routes: validate before the write,\n    // then run the after-success hook once the command persists.\n    const guardResult = await validateCrudMutationGuard(resolved.container, {\n      tenantId: resolved.tenantId,\n      organizationId: resolved.organizationId,\n      userId: resolved.auth.sub,\n      resourceKind: 'directory.organization',\n      resourceId: resolved.organizationId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: { logoUrl: parsed.data.logoUrl ?? null },\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = resolved.container.resolve('commandBus') as CommandBus\n    const ctx = buildCommandContext(\n      resolved.container,\n      resolved.auth,\n      req,\n      resolved.organizationId,\n      resolved.tenantId,\n    )\n    const { result } = await commandBus.execute<Record<string, unknown>, Organization>(\n      'directory.organizations.update',\n      {\n        input: {\n          id: resolved.organizationId,\n          tenantId: resolved.tenantId,\n          logoUrl: parsed.data.logoUrl ?? null,\n        },\n        ctx,\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(resolved.container, {\n        tenantId: resolved.tenantId,\n        organizationId: resolved.organizationId,\n        userId: resolved.auth.sub,\n        resourceKind: 'directory.organization',\n        resourceId: resolved.organizationId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    await invalidateSidebarBrandingCache(resolved.container, resolved.organizationId, resolved.tenantId)\n    return NextResponse.json(toResponsePayload(result, resolved.tenantId))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Organization branding update failed', { err })\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.save', 'Failed to update organization branding.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Directory',\n  summary: 'Current organization branding',\n  methods: {\n    GET: {\n      summary: 'Read sidebar branding for the selected organization',\n      description: 'Returns the logo URL used by the backend sidebar for the currently selected organization.',\n      responses: [\n        { status: 200, description: 'Organization branding', schema: brandingResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'A concrete organization scope is required', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Organization not found', schema: errorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update sidebar branding for the selected organization',\n      description: 'Stores an external image URL or an internal attachment image URL as the selected organization logo.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: brandingUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated organization branding', schema: brandingResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Save failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Organization branding changed since it was loaded', schema: errorSchema },\n        { status: 422, description: 'Invalid logo URL', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,OAAO;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAChF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,yBAAyB,MAAM;AAC1C,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAID,SAAS,oBACP,WACA,MACA,KACA,gBACA,UACuB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,WAAW,CAAC,cAAc;AAAA,MAC1B,YAAY;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,IACxB,iBAAiB,CAAC,cAAc;AAAA,IAChC,SAAS;AAAA,EACX;AACF;AAEA,eAAe,2BAA2B,KAAc;AACtD,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO;AAAA,MACL,UAAU,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9G;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,MAAM,cAAc,KAAK,SAAS;AACzD,QAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,WAAO;AAAA,MACL,UAAU,aAAa;AAAA,QACrB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,gBAAgB,QAAQ,UAAU,WAAW,KAAK;AAAA,IACxD,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,IACvB,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,MACL,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,QACnF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,WAAW,cAAc,gBAAgB,UAAU,UAAU;AAC9E;AAEA,SAAS,YAAY,OAAwD;AAC3E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,UAAM,KAAK,MAAM,QAAQ;AACzB,WAAO,OAAO,SAAS,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,YAAY,IAAI;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,SAAO,OAAO,SAAS,OAAO,QAAQ,CAAC,IAAI,OAAO,YAAY,IAAI;AACpE;AAEA,SAAS,kBAAkB,cAA4B,UAAkB;AACvE,SAAO;AAAA,IACL,gBAAgB,OAAO,aAAa,EAAE;AAAA,IACtC,kBAAkB,aAAa;AAAA,IAC/B;AAAA,IACA,SAAS,aAAa,WAAW;AAAA,IACjC,WAAW,YAAY,aAAa,SAAS;AAAA,EAC/C;AACF;AAEA,eAAe,+BAA+B,WAA6B,gBAAwB,UAAkB;AACnH,MAAI;AACF,UAAM,QAAQ,UAAU,QAAQ,OAAO;AAGvC,UAAM;AAAA,MAAmB;AAAA,MAAU,MACjC,OAAO,eAAe;AAAA,QACpB,4BAA4B,cAAc;AAAA,QAC1C,sBAAsB,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,MAAM,2BAA2B,GAAG;AACrD,MAAI,cAAc,SAAU,QAAO,SAAS;AAE5C,SAAO,aAAa,KAAK,kBAAkB,SAAS,cAAc,SAAS,QAAQ,CAAC;AACtF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,MAAM,2BAA2B,GAAG;AACrD,MAAI,cAAc,SAAU,QAAO,SAAS;AAE5C,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,SAAS,GAAG;AAC/F,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,qBAAqB,UAAU,IAAI;AAClD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B;AAAA,QAChG,QAAQ,OAAO,MAAM;AAAA,MACvB;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS,aAAa,aAAa;AAAA,MAC5C,SAAS;AAAA,IACX,CAAC;AAID,UAAM,cAAc,MAAM,0BAA0B,SAAS,WAAW;AAAA,MACtE,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ,SAAS,KAAK;AAAA,MACtB,cAAc;AAAA,MACd,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB,EAAE,SAAS,OAAO,KAAK,WAAW,KAAK;AAAA,IAC1D,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAa,SAAS,UAAU,QAAQ,YAAY;AAC1D,UAAM,MAAM;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,SAAS;AAAA,UACb,UAAU,SAAS;AAAA,UACnB,SAAS,OAAO,KAAK,WAAW;AAAA,QAClC;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,SAAS,WAAW;AAAA,QACzD,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,SAAS,KAAK;AAAA,QACtB,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,+BAA+B,SAAS,WAAW,SAAS,gBAAgB,SAAS,QAAQ;AACnG,WAAO,aAAa,KAAK,kBAAkB,QAAQ,SAAS,QAAQ,CAAC;AAAA,EACvE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,kCAAkC,yCAAyC,EAAE;AAAA,MACzG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,uBAAuB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,MAC5E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,uBAAuB;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,YAAY;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,YAAY;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { runWithCacheTenant } from '@open-mercato/cache'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport {\n  runCrudMutationGuardAfterSuccess,\n  validateCrudMutationGuard,\n} from '@open-mercato/shared/lib/crud/mutation-guard'\nimport { enforceCommandOptimisticLock } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Organization } from '@open-mercato/core/modules/directory/data/entities'\nimport { organizationUpdateSchema } from '@open-mercato/core/modules/directory/data/validators'\nimport { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport '@open-mercato/core/modules/directory/commands/organizations'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('directory').child({ component: 'organization-branding' })\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['directory.organizations.view'] },\n  PUT: { requireAuth: true, requireFeatures: ['directory.organizations.manage'] },\n}\n\nconst brandingResponseSchema = z.object({\n  organizationId: z.string().uuid(),\n  organizationName: z.string(),\n  tenantId: z.string().uuid(),\n  logoUrl: z.string().nullable(),\n  logoPreserveAspectRatio: z.boolean(),\n  updatedAt: z.string().nullable(),\n})\n\nconst brandingUpdateSchema = z.object({\n  logoUrl: organizationUpdateSchema.shape.logoUrl,\n  logoPreserveAspectRatio: organizationUpdateSchema.shape.logoPreserveAspectRatio,\n})\n\nconst errorSchema = z.object({\n  error: z.string(),\n})\n\ntype RequestContainer = Awaited<ReturnType<typeof createRequestContainer>>\n\nfunction buildCommandContext(\n  container: RequestContainer,\n  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,\n  req: Request,\n  organizationId: string,\n  tenantId: string,\n): CommandRuntimeContext {\n  return {\n    container,\n    auth,\n    organizationScope: {\n      selectedId: organizationId,\n      filterIds: [organizationId],\n      allowedIds: null,\n      tenantId,\n    },\n    selectedOrganizationId: organizationId,\n    organizationIds: [organizationId],\n    request: req,\n  }\n}\n\nasync function resolveCurrentOrganization(req: Request) {\n  const { translate } = await resolveTranslations()\n  const auth = await getAuthFromRequest(req)\n  if (!auth?.sub) {\n    return {\n      response: NextResponse.json({ error: translate('api.errors.unauthorized', 'Unauthorized') }, { status: 401 }),\n    }\n  }\n\n  const container = await createRequestContainer()\n  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })\n  const organizationId = scope.selectedId ?? auth.orgId ?? null\n  const tenantId = scope.tenantId ?? auth.tenantId ?? null\n  if (!organizationId || !tenantId) {\n    return {\n      response: NextResponse.json(\n        {\n          error: translate(\n            'directory.branding.errors.organizationRequired',\n            'Select a single organization before changing sidebar branding.',\n          ),\n        },\n        { status: 400 },\n      ),\n    }\n  }\n\n  const em = container.resolve('em') as EntityManager\n  const organization = await findOneWithDecryption(\n    em,\n    Organization,\n    { id: organizationId, tenant: tenantId, deletedAt: null },\n    { populate: ['tenant'] },\n    { tenantId, organizationId },\n  )\n  if (!organization) {\n    return {\n      response: NextResponse.json(\n        { error: translate('directory.branding.errors.notFound', 'Organization not found') },\n        { status: 404 },\n      ),\n    }\n  }\n\n  return { auth, container, organization, organizationId, tenantId, translate }\n}\n\nfunction toIsoOrNull(value: Date | string | null | undefined): string | null {\n  if (value == null) return null\n  if (value instanceof Date) {\n    const ms = value.getTime()\n    return Number.isFinite(ms) ? new Date(ms).toISOString() : null\n  }\n  const trimmed = String(value).trim()\n  if (!trimmed) return null\n  const parsed = new Date(trimmed)\n  return Number.isFinite(parsed.getTime()) ? parsed.toISOString() : null\n}\n\nfunction toResponsePayload(organization: Organization, tenantId: string) {\n  return {\n    organizationId: String(organization.id),\n    organizationName: organization.name,\n    tenantId,\n    logoUrl: organization.logoUrl ?? null,\n    logoPreserveAspectRatio: !!organization.logoPreserveAspectRatio,\n    updatedAt: toIsoOrNull(organization.updatedAt),\n  }\n}\n\nasync function invalidateSidebarBrandingCache(container: RequestContainer, organizationId: string, tenantId: string) {\n  try {\n    const cache = container.resolve('cache') as {\n      deleteByTags?: (tags: string[]) => Promise<unknown>\n    } | null\n    await runWithCacheTenant(tenantId, () =>\n      cache?.deleteByTags?.([\n        `nav:sidebar:organization:${organizationId}`,\n        `nav:sidebar:tenant:${tenantId}`,\n      ]),\n    )\n  } catch {\n    // Cache invalidation is best-effort; the persisted branding is the source of truth.\n  }\n}\n\nexport async function GET(req: Request) {\n  const resolved = await resolveCurrentOrganization(req)\n  if ('response' in resolved) return resolved.response\n\n  return NextResponse.json(toResponsePayload(resolved.organization, resolved.tenantId))\n}\n\nexport async function PUT(req: Request) {\n  const resolved = await resolveCurrentOrganization(req)\n  if ('response' in resolved) return resolved.response\n\n  let body: unknown\n  try {\n    body = await req.json()\n  } catch {\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.') },\n      { status: 422 },\n    )\n  }\n  if (!body || typeof body !== 'object' || !Object.prototype.hasOwnProperty.call(body, 'logoUrl')) {\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.') },\n      { status: 422 },\n    )\n  }\n\n  const parsed = brandingUpdateSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json(\n      {\n        error: resolved.translate('directory.branding.errors.invalidLogoUrl', 'Enter a valid image URL.'),\n        issues: parsed.error.issues,\n      },\n      { status: 422 },\n    )\n  }\n\n  try {\n    // Refuse a stale overwrite when two tabs edit the same organization branding.\n    // Strictly additive \u2014 a no-op when the client omits the expected-version header.\n    enforceCommandOptimisticLock({\n      resourceKind: 'directory.organization',\n      resourceId: resolved.organizationId,\n      current: resolved.organization.updatedAt ?? null,\n      request: req,\n    })\n\n    // Mutation-guard contract for custom write routes: validate before the write,\n    // then run the after-success hook once the command persists.\n    const guardResult = await validateCrudMutationGuard(resolved.container, {\n      tenantId: resolved.tenantId,\n      organizationId: resolved.organizationId,\n      userId: resolved.auth.sub,\n      resourceKind: 'directory.organization',\n      resourceId: resolved.organizationId,\n      operation: 'update',\n      requestMethod: req.method,\n      requestHeaders: req.headers,\n      mutationPayload: {\n        logoUrl: parsed.data.logoUrl ?? null,\n        ...(parsed.data.logoPreserveAspectRatio !== undefined\n          ? { logoPreserveAspectRatio: parsed.data.logoPreserveAspectRatio }\n          : {}),\n      },\n    })\n    if (guardResult && !guardResult.ok) {\n      return NextResponse.json(guardResult.body, { status: guardResult.status })\n    }\n\n    const commandBus = resolved.container.resolve('commandBus') as CommandBus\n    const ctx = buildCommandContext(\n      resolved.container,\n      resolved.auth,\n      req,\n      resolved.organizationId,\n      resolved.tenantId,\n    )\n    const { result } = await commandBus.execute<Record<string, unknown>, Organization>(\n      'directory.organizations.update',\n      {\n        input: {\n          id: resolved.organizationId,\n          tenantId: resolved.tenantId,\n          logoUrl: parsed.data.logoUrl ?? null,\n          ...(parsed.data.logoPreserveAspectRatio !== undefined\n            ? { logoPreserveAspectRatio: parsed.data.logoPreserveAspectRatio }\n            : {}),\n        },\n        ctx,\n      },\n    )\n\n    if (guardResult?.ok && guardResult.shouldRunAfterSuccess) {\n      await runCrudMutationGuardAfterSuccess(resolved.container, {\n        tenantId: resolved.tenantId,\n        organizationId: resolved.organizationId,\n        userId: resolved.auth.sub,\n        resourceKind: 'directory.organization',\n        resourceId: resolved.organizationId,\n        operation: 'update',\n        requestMethod: req.method,\n        requestHeaders: req.headers,\n        metadata: guardResult.metadata ?? null,\n      })\n    }\n\n    await invalidateSidebarBrandingCache(resolved.container, resolved.organizationId, resolved.tenantId)\n    return NextResponse.json(toResponsePayload(result, resolved.tenantId))\n  } catch (err) {\n    if (isCrudHttpError(err)) {\n      return NextResponse.json(err.body, { status: err.status })\n    }\n    logger.error('Organization branding update failed', { err })\n    return NextResponse.json(\n      { error: resolved.translate('directory.branding.errors.save', 'Failed to update organization branding.') },\n      { status: 400 },\n    )\n  }\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Directory',\n  summary: 'Current organization branding',\n  methods: {\n    GET: {\n      summary: 'Read sidebar branding for the selected organization',\n      description: 'Returns the logo URL used by the backend sidebar for the currently selected organization.',\n      responses: [\n        { status: 200, description: 'Organization branding', schema: brandingResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'A concrete organization scope is required', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 404, description: 'Organization not found', schema: errorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update sidebar branding for the selected organization',\n      description: 'Stores an external image URL or an internal attachment image URL as the selected organization logo.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: brandingUpdateSchema,\n      },\n      responses: [\n        { status: 200, description: 'Updated organization branding', schema: brandingResponseSchema },\n      ],\n      errors: [\n        { status: 400, description: 'Save failed', schema: errorSchema },\n        { status: 401, description: 'Unauthorized', schema: errorSchema },\n        { status: 409, description: 'Organization branding changed since it was loaded', schema: errorSchema },\n        { status: 422, description: 'Invalid logo URL', schema: errorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AAGnC,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,uBAAuB;AAChC;AAAA,EACE;AAAA,EACA;AAAA,OACK;AACP,SAAS,oCAAoC;AAC7C,SAAS,6BAA6B;AACtC,SAAS,2BAA2B;AACpC,SAAS,oBAAoB;AAC7B,SAAS,gCAAgC;AACzC,SAAS,0CAA0C;AACnD,OAAO;AACP,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,WAAW,EAAE,MAAM,EAAE,WAAW,wBAAwB,CAAC;AAE9E,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,8BAA8B,EAAE;AAAA,EAC5E,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,gCAAgC,EAAE;AAChF;AAEA,MAAM,yBAAyB,EAAE,OAAO;AAAA,EACtC,gBAAgB,EAAE,OAAO,EAAE,KAAK;AAAA,EAChC,kBAAkB,EAAE,OAAO;AAAA,EAC3B,UAAU,EAAE,OAAO,EAAE,KAAK;AAAA,EAC1B,SAAS,EAAE,OAAO,EAAE,SAAS;AAAA,EAC7B,yBAAyB,EAAE,QAAQ;AAAA,EACnC,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,uBAAuB,EAAE,OAAO;AAAA,EACpC,SAAS,yBAAyB,MAAM;AAAA,EACxC,yBAAyB,yBAAyB,MAAM;AAC1D,CAAC;AAED,MAAM,cAAc,EAAE,OAAO;AAAA,EAC3B,OAAO,EAAE,OAAO;AAClB,CAAC;AAID,SAAS,oBACP,WACA,MACA,KACA,gBACA,UACuB;AACvB,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA,mBAAmB;AAAA,MACjB,YAAY;AAAA,MACZ,WAAW,CAAC,cAAc;AAAA,MAC1B,YAAY;AAAA,MACZ;AAAA,IACF;AAAA,IACA,wBAAwB;AAAA,IACxB,iBAAiB,CAAC,cAAc;AAAA,IAChC,SAAS;AAAA,EACX;AACF;AAEA,eAAe,2BAA2B,KAAc;AACtD,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM,KAAK;AACd,WAAO;AAAA,MACL,UAAU,aAAa,KAAK,EAAE,OAAO,UAAU,2BAA2B,cAAc,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAC9G;AAAA,EACF;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,QAAQ,MAAM,mCAAmC,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACxF,QAAM,iBAAiB,MAAM,cAAc,KAAK,SAAS;AACzD,QAAM,WAAW,MAAM,YAAY,KAAK,YAAY;AACpD,MAAI,CAAC,kBAAkB,CAAC,UAAU;AAChC,WAAO;AAAA,MACL,UAAU,aAAa;AAAA,QACrB;AAAA,UACE,OAAO;AAAA,YACL;AAAA,YACA;AAAA,UACF;AAAA,QACF;AAAA,QACA,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM;AAAA,IACzB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,gBAAgB,QAAQ,UAAU,WAAW,KAAK;AAAA,IACxD,EAAE,UAAU,CAAC,QAAQ,EAAE;AAAA,IACvB,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,MAAI,CAAC,cAAc;AACjB,WAAO;AAAA,MACL,UAAU,aAAa;AAAA,QACrB,EAAE,OAAO,UAAU,sCAAsC,wBAAwB,EAAE;AAAA,QACnF,EAAE,QAAQ,IAAI;AAAA,MAChB;AAAA,IACF;AAAA,EACF;AAEA,SAAO,EAAE,MAAM,WAAW,cAAc,gBAAgB,UAAU,UAAU;AAC9E;AAEA,SAAS,YAAY,OAAwD;AAC3E,MAAI,SAAS,KAAM,QAAO;AAC1B,MAAI,iBAAiB,MAAM;AACzB,UAAM,KAAK,MAAM,QAAQ;AACzB,WAAO,OAAO,SAAS,EAAE,IAAI,IAAI,KAAK,EAAE,EAAE,YAAY,IAAI;AAAA,EAC5D;AACA,QAAM,UAAU,OAAO,KAAK,EAAE,KAAK;AACnC,MAAI,CAAC,QAAS,QAAO;AACrB,QAAM,SAAS,IAAI,KAAK,OAAO;AAC/B,SAAO,OAAO,SAAS,OAAO,QAAQ,CAAC,IAAI,OAAO,YAAY,IAAI;AACpE;AAEA,SAAS,kBAAkB,cAA4B,UAAkB;AACvE,SAAO;AAAA,IACL,gBAAgB,OAAO,aAAa,EAAE;AAAA,IACtC,kBAAkB,aAAa;AAAA,IAC/B;AAAA,IACA,SAAS,aAAa,WAAW;AAAA,IACjC,yBAAyB,CAAC,CAAC,aAAa;AAAA,IACxC,WAAW,YAAY,aAAa,SAAS;AAAA,EAC/C;AACF;AAEA,eAAe,+BAA+B,WAA6B,gBAAwB,UAAkB;AACnH,MAAI;AACF,UAAM,QAAQ,UAAU,QAAQ,OAAO;AAGvC,UAAM;AAAA,MAAmB;AAAA,MAAU,MACjC,OAAO,eAAe;AAAA,QACpB,4BAA4B,cAAc;AAAA,QAC1C,sBAAsB,QAAQ;AAAA,MAChC,CAAC;AAAA,IACH;AAAA,EACF,QAAQ;AAAA,EAER;AACF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,MAAM,2BAA2B,GAAG;AACrD,MAAI,cAAc,SAAU,QAAO,SAAS;AAE5C,SAAO,aAAa,KAAK,kBAAkB,SAAS,cAAc,SAAS,QAAQ,CAAC;AACtF;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,WAAW,MAAM,2BAA2B,GAAG;AACrD,MAAI,cAAc,SAAU,QAAO,SAAS;AAE5C,MAAI;AACJ,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AACN,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAO,SAAS,YAAY,CAAC,OAAO,UAAU,eAAe,KAAK,MAAM,SAAS,GAAG;AAC/F,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B,EAAE;AAAA,MACpG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,QAAM,SAAS,qBAAqB,UAAU,IAAI;AAClD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa;AAAA,MAClB;AAAA,QACE,OAAO,SAAS,UAAU,4CAA4C,0BAA0B;AAAA,QAChG,QAAQ,OAAO,MAAM;AAAA,MACvB;AAAA,MACA,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AAEA,MAAI;AAGF,iCAA6B;AAAA,MAC3B,cAAc;AAAA,MACd,YAAY,SAAS;AAAA,MACrB,SAAS,SAAS,aAAa,aAAa;AAAA,MAC5C,SAAS;AAAA,IACX,CAAC;AAID,UAAM,cAAc,MAAM,0BAA0B,SAAS,WAAW;AAAA,MACtE,UAAU,SAAS;AAAA,MACnB,gBAAgB,SAAS;AAAA,MACzB,QAAQ,SAAS,KAAK;AAAA,MACtB,cAAc;AAAA,MACd,YAAY,SAAS;AAAA,MACrB,WAAW;AAAA,MACX,eAAe,IAAI;AAAA,MACnB,gBAAgB,IAAI;AAAA,MACpB,iBAAiB;AAAA,QACf,SAAS,OAAO,KAAK,WAAW;AAAA,QAChC,GAAI,OAAO,KAAK,4BAA4B,SACxC,EAAE,yBAAyB,OAAO,KAAK,wBAAwB,IAC/D,CAAC;AAAA,MACP;AAAA,IACF,CAAC;AACD,QAAI,eAAe,CAAC,YAAY,IAAI;AAClC,aAAO,aAAa,KAAK,YAAY,MAAM,EAAE,QAAQ,YAAY,OAAO,CAAC;AAAA,IAC3E;AAEA,UAAM,aAAa,SAAS,UAAU,QAAQ,YAAY;AAC1D,UAAM,MAAM;AAAA,MACV,SAAS;AAAA,MACT,SAAS;AAAA,MACT;AAAA,MACA,SAAS;AAAA,MACT,SAAS;AAAA,IACX;AACA,UAAM,EAAE,OAAO,IAAI,MAAM,WAAW;AAAA,MAClC;AAAA,MACA;AAAA,QACE,OAAO;AAAA,UACL,IAAI,SAAS;AAAA,UACb,UAAU,SAAS;AAAA,UACnB,SAAS,OAAO,KAAK,WAAW;AAAA,UAChC,GAAI,OAAO,KAAK,4BAA4B,SACxC,EAAE,yBAAyB,OAAO,KAAK,wBAAwB,IAC/D,CAAC;AAAA,QACP;AAAA,QACA;AAAA,MACF;AAAA,IACF;AAEA,QAAI,aAAa,MAAM,YAAY,uBAAuB;AACxD,YAAM,iCAAiC,SAAS,WAAW;AAAA,QACzD,UAAU,SAAS;AAAA,QACnB,gBAAgB,SAAS;AAAA,QACzB,QAAQ,SAAS,KAAK;AAAA,QACtB,cAAc;AAAA,QACd,YAAY,SAAS;AAAA,QACrB,WAAW;AAAA,QACX,eAAe,IAAI;AAAA,QACnB,gBAAgB,IAAI;AAAA,QACpB,UAAU,YAAY,YAAY;AAAA,MACpC,CAAC;AAAA,IACH;AAEA,UAAM,+BAA+B,SAAS,WAAW,SAAS,gBAAgB,SAAS,QAAQ;AACnG,WAAO,aAAa,KAAK,kBAAkB,QAAQ,SAAS,QAAQ,CAAC;AAAA,EACvE,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,GAAG;AACxB,aAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AAAA,IAC3D;AACA,WAAO,MAAM,uCAAuC,EAAE,IAAI,CAAC;AAC3D,WAAO,aAAa;AAAA,MAClB,EAAE,OAAO,SAAS,UAAU,kCAAkC,yCAAyC,EAAE;AAAA,MACzG,EAAE,QAAQ,IAAI;AAAA,IAChB;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,yBAAyB,QAAQ,uBAAuB;AAAA,MACtF;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,6CAA6C,QAAQ,YAAY;AAAA,QAC7F,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,0BAA0B,QAAQ,YAAY;AAAA,MAC5E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,iCAAiC,QAAQ,uBAAuB;AAAA,MAC9F;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,eAAe,QAAQ,YAAY;AAAA,QAC/D,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,YAAY;AAAA,QAChE,EAAE,QAAQ,KAAK,aAAa,qDAAqD,QAAQ,YAAY;AAAA,QACrG,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,YAAY;AAAA,MACtE;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/directory/api/organizations/route.js

@@ -212,6 +212,7 @@ async function GET(req) {
       id: stringId(org.id),
       name: org.name,
       logoUrl: org.logoUrl ?? null,
+      logoPreserveAspectRatio: !!org.logoPreserveAspectRatio,
       parentId: org.parentId ?? null,
       tenantId,
       isActive: !!org.isActive,
@@ -300,10 +301,12 @@ async function GET(req) {
     const slugByOrgId2 = /* @__PURE__ */ new Map();
     const updatedAtByOrgId2 = /* @__PURE__ */ new Map();
     const logoUrlByOrgId2 = /* @__PURE__ */ new Map();
+    const logoPreserveAspectRatioByOrgId2 = /* @__PURE__ */ new Map();
     for (const org of allOrgs) {
       slugByOrgId2.set(String(org.id), org.slug ?? null);
       updatedAtByOrgId2.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null);
       logoUrlByOrgId2.set(String(org.id), org.logoUrl ?? null);
+      logoPreserveAspectRatioByOrgId2.set(String(org.id), !!org.logoPreserveAspectRatio);
     }
     const tenantIds = Array.from(byTenant.keys());
     const tenants = tenantIds.length ? await em.find(Tenant, { id: { $in: tenantIds } }) : [];
@@ -379,6 +382,7 @@ async function GET(req) {
         slug: slugByOrgId2.get(recordId) ?? null,
         updatedAt: updatedAtByOrgId2.get(recordId) ?? null,
         logoUrl: logoUrlByOrgId2.get(recordId) ?? null,
+        logoPreserveAspectRatio: logoPreserveAspectRatioByOrgId2.get(recordId) ?? false,
         tenantId: tid,
         tenantName: tenantNameMap[tid] ?? tid,
         parentId: node.parentId,
@@ -419,10 +423,12 @@ async function GET(req) {
   const hierarchy = computeHierarchyForOrganizations(orgs, tenantId);
   const slugByOrgId = /* @__PURE__ */ new Map();
   const logoUrlByOrgId = /* @__PURE__ */ new Map();
+  const logoPreserveAspectRatioByOrgId = /* @__PURE__ */ new Map();
   const updatedAtByOrgId = /* @__PURE__ */ new Map();
   for (const org of orgs) {
     slugByOrgId.set(String(org.id), org.slug ?? null);
     logoUrlByOrgId.set(String(org.id), org.logoUrl ?? null);
+    logoPreserveAspectRatioByOrgId.set(String(org.id), !!org.logoPreserveAspectRatio);
     updatedAtByOrgId.set(String(org.id), org.updatedAt instanceof Date ? org.updatedAt.toISOString() : null);
   }
   const search = (query.search || "").trim().toLowerCase();
@@ -481,6 +487,7 @@ async function GET(req) {
       name: node.name,
       slug: slugByOrgId.get(recordId) ?? null,
       logoUrl: logoUrlByOrgId.get(recordId) ?? null,
+      logoPreserveAspectRatio: logoPreserveAspectRatioByOrgId.get(recordId) ?? false,
       updatedAt: updatedAtByOrgId.get(recordId) ?? null,
       tenantId: node.tenantId,
       tenantName,