@open-mercato/core 0.6.7-develop.6775.1.c2313bb8a3 → 0.6.7-develop.6785.1.1dd7cfac55

package/src/modules/auth/lib/backendChrome.tsx

@@ -21,7 +21,6 @@ import {
 import { resolveRegisteredLucideIconNode } from '@open-mercato/ui/backend/icons/lucideRegistry'
 import { profilePathPrefixes, profileSections } from './profile-sections'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
 import { getNavGroupOrderOverride } from '@open-mercato/shared/modules/overrides'
 import {
   getSelectedOrganizationFromRequest,
@@ -283,10 +282,7 @@ export async function resolveBackendChromePayload({
   const container = await loadScopedContainer()
   const em = container.resolve('em') as EntityManager
   const rbac = container.resolve('rbacService') as {
-    loadAcl: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<{
-      isSuperAdmin: boolean
-      features: string[]
-    }>
+    getEffectiveFeatures: (userId: string, scope: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>
     userHasAllFeatures: (userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }) => Promise<boolean>
   }
 
@@ -319,15 +315,12 @@ export async function resolveBackendChromePayload({
     concretelySelectedOrganizationId = null
   }
 
-  const acl = allowNavigation
-    ? await rbac.loadAcl(auth.sub, {
+  const grantedFeatures = allowNavigation
+    ? await rbac.getEffectiveFeatures(auth.sub, {
         tenantId: scopedTenantId,
         organizationId: scopedOrganizationId,
       })
-    : { isSuperAdmin: false, features: [] }
-
-  const rawGrantedFeatures = acl.isSuperAdmin ? ['*'] : acl.features
-  const grantedFeatures = filterGrantsByEnabledModules(rawGrantedFeatures)
+    : []
   const featureChecker = async (features: string[]): Promise<string[]> => {
     if (!allowNavigation || !features.length) return []
     const context = {
@@ -461,6 +454,7 @@ export async function resolveBackendChromePayload({
           logo: {
             src: organization.logoUrl,
             alt: `${organization.name} logo`,
+            preserveAspectRatio: !!organization.logoPreserveAspectRatio,
           },
         }
       }

package/src/modules/auth/lib/setup-app.ts

@@ -320,6 +320,7 @@ export async function setupInitialTenant(
         ancestorIds: [],
         childIds: [],
         descendantIds: [],
+        logoPreserveAspectRatio: false,
         createdAt: new Date(),
         updatedAt: new Date(),
       })

package/src/modules/auth/services/rbacService.ts

@@ -5,8 +5,11 @@ import { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/aut
 import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import { matchFeature as sharedMatchFeature, hasAllFeatures as sharedHasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
-import { filterGrantsByEnabledModules, getOwningModuleId, getEnabledModuleIds } from '@open-mercato/shared/security/enabledModulesRegistry'
+import {
+  authorizeFeatures,
+  resolveEffectiveFeatures,
+} from '@open-mercato/shared/security/featurePolicy'
+import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
 
 interface AclData {
   isSuperAdmin: boolean
@@ -43,32 +46,9 @@ export class RbacService {
     this.cacheTtlMs = ttlMs
   }
 
-  /**
-   * Checks if a required feature is satisfied by a granted feature permission.
-   * 
-   * Wildcard patterns:
-   * - `*` (global wildcard): Grants access to all features
-   * - `prefix.*` (module wildcard): Grants access to all features starting with `prefix.`
-   *   and also the exact prefix itself (e.g., `entities.*` matches both `entities` and `entities.records.view`)
-   * - Exact match: Feature must match exactly (e.g., `users.view` only matches `users.view`)
-   * 
-   * @param required - The feature being requested (e.g., 'entities.records.view')
-   * @param granted - The feature permission granted (e.g., 'entities.*' or '*')
-   * @returns true if the granted permission satisfies the required feature
-   * 
-   * @example
-   * matchFeature('users.view', '*') // true - global wildcard
-   * matchFeature('entities.records.view', 'entities.*') // true - module wildcard
-   * matchFeature('entities', 'entities.*') // true - exact prefix match
-   * matchFeature('users.view', 'entities.*') // false - different module
-   * matchFeature('users.view', 'users.view') // true - exact match
-   */
-  private matchFeature(required: string, granted: string): boolean {
-    return sharedMatchFeature(required, granted)
-  }
-
+  /** Compatibility wrapper for callers that already have both feature lists. */
   public hasAllFeatures(required: string[], granted: string[]): boolean {
-    return sharedHasAllFeatures(required, granted)
+    return authorizeFeatures(required, { grantedFeatures: granted })
   }
 
   private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {
@@ -380,9 +360,6 @@ export class RbacService {
   ): Promise<boolean> {
     if (!tenantId || !feature) return false
 
-    const enabledIds = getEnabledModuleIds()
-    if (enabledIds.length && !enabledIds.includes(getOwningModuleId(feature))) return false
-
     const em = this.em.fork()
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})
     const list = Array.isArray(roleAcls) ? roleAcls : []
@@ -390,9 +367,13 @@ export class RbacService {
 
     for (const acl of list) {
       if (!this.roleAclAllowsOrganization(acl, organizationId)) continue
-      if (acl.isSuperAdmin) return true
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
-      if (this.hasAllFeatures([feature], filterGrantsByEnabledModules(grants))) return true
+      if (authorizeFeatures([feature], {
+        grantedFeatures: grants,
+        unrestricted: acl.isSuperAdmin,
+      })) {
+        return true
+      }
     }
 
     return false
@@ -436,23 +417,22 @@ export class RbacService {
   async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {
     if (!required.length) return true
     const acl = await this.loadAcl(userId, scope)
-    if (acl.isSuperAdmin) {
-      const enabledIds = getEnabledModuleIds()
-      if (!enabledIds.length) return true
-      const enabledSet = new Set(enabledIds)
-      return required.every((feature) => enabledSet.has(getOwningModuleId(feature)))
-    }
-    if (acl.organizations && scope.organizationId && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes('__all__')) return false
-    return this.hasAllFeatures(required, filterGrantsByEnabledModules(acl.features))
+    const organizationAllowed = acl.isSuperAdmin
+      || !acl.organizations
+      || !scope.organizationId
+      || acl.organizations.includes(scope.organizationId)
+      || acl.organizations.includes('__all__')
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isSuperAdmin,
+      scopeAllowed: organizationAllowed,
+    })
   }
 
   /**
-   * Returns the effective feature grant list for a user within a scope,
-   * filtered to enabled modules only. Super admins receive `['*']` expanded
-   * to per-module wildcards via `filterGrantsByEnabledModules` — consistent
-   * with `userHasAllFeatures` which also enforces disabled-module boundaries
-   * for super admins. Returns `[]` when the requested organization is outside
-   * the user's visibility list, or when the user does not exist.
+   * Returns the user's infrastructure grant list, filtered to enabled modules.
+   * The result may contain wildcards; authoritative checks must still go through
+   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.
    */
   async getGrantedFeatures(
     userId: string,
@@ -470,4 +450,19 @@ export class RbacService {
     }
     return filterGrantsByEnabledModules(acl.features)
   }
+
+  /** Returns concrete active feature IDs for browser capability payloads. */
+  async getEffectiveFeatures(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<string[]> {
+    const acl = await this.loadAcl(userId, scope)
+    const organizationAllowed = acl.isSuperAdmin
+      || !acl.organizations
+      || !scope.organizationId
+      || acl.organizations.includes(scope.organizationId)
+      || acl.organizations.includes('__all__')
+    if (!organizationAllowed) return []
+    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)
+  }
 }

package/src/modules/catalog/widgets/injection/product-seo/widget.ts

@@ -8,7 +8,7 @@ const widget: InjectionWidgetModule<any, any> = {
     id: 'catalog.injection.product-seo',
     title: 'Product SEO Helper',
     description: 'Helps optimize product metadata for search engines',
-    features: ['catalog.products.edit'],
+    features: ['catalog.products.manage'],
     priority: 90,
     enabled: true,
     requiredFields: ['description'],

package/src/modules/communication_channels/lib/access-control.ts

@@ -1,4 +1,4 @@
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 
 /**
  * Per-user channel access control — service-layer authorization helpers.
@@ -67,7 +67,7 @@ export function assertCanAccessChannel(
  *   - **Tenant-wide / shared channel** (`userId == null`, e.g. WhatsApp
  *     Business / Slack workspaces): requires the route's `elevatedFeature`
  *     (`communication_channels.manage`, `…channel.push.manage`, or
- *     `…channel.import_history`). Wildcard-aware via {@link hasFeature}.
+ *     `…channel.import_history`). Evaluated by the shared feature policy.
  *
  * Throws `ChannelAccessDeniedError` (route handlers map it to 404, masking
  * existence) when the caller may not manage the channel.
@@ -94,7 +94,7 @@ export function assertCanManageChannel(
   }
   // Tenant-wide / shared channel — requires the elevated management feature.
   const grantedFeatures = Array.isArray(userFeatures) ? userFeatures : []
-  if (!hasFeature(grantedFeatures, elevatedFeature)) {
+  if (!authorizeFeatures([elevatedFeature], { grantedFeatures })) {
     throw new ChannelAccessDeniedError(`Managing a shared channel requires '${elevatedFeature}'`)
   }
 }

package/src/modules/customer_accounts/AGENTS.md

@@ -136,7 +136,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 ### Portal Admin Flag
 
-`isPortalAdmin: true` on a role/user ACL bypasses all feature checks (equivalent to staff `isSuperAdmin`).
+`isPortalAdmin: true` on a role/user ACL bypasses stored-grant matching (equivalent to staff `isSuperAdmin`). Nulled ACL features and disabled modules remain denied.
 
 ### Default Roles (seeded on tenant creation)
 
@@ -150,7 +150,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 Customer portal features use the `portal.<area>.<action>` naming convention (e.g., `portal.orders.view`, `portal.catalog.view`).
 
-Treat `portal.*` and `*` as first-class ACL grants. When portal code reads raw feature arrays directly (for example menu filtering, injected portal navigation, or local runtime guards), use shared wildcard-aware matching instead of exact `includes(...)` checks.
+Treat `portal.*` and `*` as first-class stored ACL grants. Server authorization calls `CustomerRbacService.userHasAllFeatures`; already-loaded snapshots call shared `authorizeFeatures`. Portal UI and navigation consume `getEffectiveFeatures`, which returns concrete active IDs without wildcards.
 
 ### Cross-Module Feature Merging
 
@@ -172,7 +172,7 @@ const customerRbacService = container.resolve('customerRbacService')
 const hasAccess = await customerRbacService.userHasAllFeatures(userId, ['portal.orders.view'], { tenantId, organizationId })
 ```
 
-When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. If it evaluates raw granted features directly, it must preserve wildcard semantics.
+When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. Client helpers receive concrete effective features and may use the pure shared matcher without implementing portal-admin or removal bypasses.
 
 ## Services and DI
 

package/src/modules/customer_accounts/api/invitations/accept.ts

@@ -39,11 +39,10 @@ export async function POST(req: Request) {
   }
 
   const { user, invitation } = result
-  const acl = await customerRbacService.loadAcl(user.id, {
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
-  const resolvedFeatures = acl.features
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/login.ts

@@ -116,8 +116,10 @@ export async function POST(req: Request) {
     await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)
   }
 
-  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })
-  const resolvedFeatures = acl.features
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId,
+    organizationId: user.organizationId,
+  })
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/magic-link/verify.ts

@@ -52,8 +52,10 @@ export async function POST(req: Request) {
   await customerUserService.resetFailedAttempts(user)
   await customerUserService.updateLastLoginAt(user)
 
-  const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
-  const resolvedFeatures = acl.features
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId: user.tenantId,
+    organizationId: user.organizationId,
+  })
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/portal/feature-check.ts

@@ -4,7 +4,7 @@ import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
-import { matchFeature } from '@open-mercato/shared/lib/auth/featureMatch'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -32,12 +32,10 @@ export async function POST(req: Request) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   })
-
-  const granted = acl.isPortalAdmin
-    ? [...body.features]
-    : body.features.filter((feature) =>
-        acl.features.some((g) => matchFeature(feature, g)),
-      )
+  const granted = body.features.filter((feature) => authorizeFeatures([feature], {
+    grantedFeatures: acl.features,
+    unrestricted: acl.isPortalAdmin,
+  }))
 
   return NextResponse.json({ ok: true, granted })
 }

package/src/modules/customer_accounts/api/portal/nav.ts

@@ -51,13 +51,15 @@ export async function GET(req: Request) {
   }
 
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId, organizationId: auth.orgId })
-  const grantedFeatures = acl.isPortalAdmin ? ['*'] : acl.features
+  const grantedFeatures = await rbac.getEffectiveFeatures(auth.sub, {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
 
   const groups = buildPortalNav({
     routes: getFrontendRouteManifests(),
     orgSlug,
     grantedFeatures,
-    isPortalAdmin: acl.isPortalAdmin,
   })
 
   return NextResponse.json({
@@ -72,7 +74,7 @@ export async function GET(req: Request) {
 const getMethodDoc: OpenApiMethodDoc = {
   summary: 'Portal sidebar navigation',
   description:
-    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against the customer\'s grants (wildcards honored).',
+    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against concrete effective features.',
   tags: ['Customer Portal'],
   responses: [{ status: 200, description: 'Portal sidebar groups', schema: navResponseSchema }],
   errors: [

package/src/modules/customer_accounts/api/portal/profile.ts

@@ -27,6 +27,10 @@ export async function GET(req: Request) {
   }
 
   const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId: user.tenantId,
+    organizationId: user.organizationId,
+  })
 
   const userRoles = await em.find(CustomerUserRole, {
     user: user.id as any,
@@ -52,7 +56,7 @@ export async function GET(req: Request) {
       createdAt: user.createdAt,
     },
     roles,
-    resolvedFeatures: acl.features,
+    resolvedFeatures,
     isPortalAdmin: acl.isPortalAdmin,
   })
 }

package/src/modules/customer_accounts/api/portal/sessions-refresh.ts

@@ -36,17 +36,17 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Account not active' }, { status: 401 })
   }
 
-  const acl = await customerRbacService.loadAcl(user.id, {
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
 
-  const result = await customerSessionService.refreshSession(decodedToken, acl.features)
+  const result = await customerSessionService.refreshSession(decodedToken, resolvedFeatures)
   if (!result) {
     return NextResponse.json({ ok: false, error: 'Session refresh failed' }, { status: 401 })
   }
 
-  const res = NextResponse.json({ ok: true, resolvedFeatures: acl.features })
+  const res = NextResponse.json({ ok: true, resolvedFeatures })
 
   res.cookies.set('customer_auth_token', result.jwt, {
     httpOnly: true,

package/src/modules/customer_accounts/lib/customerAuth.ts

@@ -15,6 +15,7 @@ export interface CustomerAuthContext {
   customerEntityId?: string | null
   personEntityId?: string | null
   resolvedFeatures: string[]
+  isPortalAdmin?: boolean
 }
 
 async function assertSessionStillActive(sessionId: string): Promise<boolean> {
@@ -48,7 +49,7 @@ export function readCookieFromHeader(header: string | null | undefined, name: st
 
 export type UserValidationResult =
   | { valid: false }
-  | { valid: true; resolvedFeatures: string[] }
+  | { valid: true; resolvedFeatures: string[]; isPortalAdmin: boolean }
 
 export async function validateUserState(
   sub: string,
@@ -77,7 +78,11 @@ export async function validateUserState(
   )
   const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>
   const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })
-  return { valid: true, resolvedFeatures: acl.isPortalAdmin ? ['*'] : acl.features }
+  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {
+    tenantId,
+    organizationId: orgId,
+  })
+  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin }
 }
 
 export async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {
@@ -134,6 +139,7 @@ export async function getCustomerAuthFromRequest(req: Request): Promise<Customer
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
       resolvedFeatures: userState.resolvedFeatures,
+      isPortalAdmin: userState.isPortalAdmin,
     }
   } catch {
     // Invalid or expired JWT — treat as unauthenticated

package/src/modules/customer_accounts/lib/customerAuthServer.ts

@@ -88,6 +88,7 @@ export async function getCustomerAuthFromCookies(
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
       resolvedFeatures: userState.resolvedFeatures,
+      isPortalAdmin: userState.isPortalAdmin,
     }
   } catch {
     // Invalid or expired JWT — treat as unauthenticated

package/src/modules/customer_accounts/services/customerRbacService.ts

@@ -5,7 +5,10 @@ import {
   CustomerRoleAcl,
   CustomerUserRole,
 } from '@open-mercato/core/modules/customer_accounts/data/entities'
-import { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
+import {
+  authorizeFeatures,
+  resolveEffectiveFeatures,
+} from '@open-mercato/shared/security/featurePolicy'
 
 interface CustomerAclData {
   isPortalAdmin: boolean
@@ -129,8 +132,18 @@ export class CustomerRbacService {
   ): Promise<boolean> {
     if (!required.length) return true
     const acl = await this.loadAcl(userId, scope)
-    if (acl.isPortalAdmin) return true
-    return hasAllFeatures(required, acl.features)
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isPortalAdmin,
+    })
+  }
+
+  async getEffectiveFeatures(
+    userId: string,
+    scope: { tenantId: string; organizationId: string },
+  ): Promise<string[]> {
+    const acl = await this.loadAcl(userId, scope)
+    return resolveEffectiveFeatures(acl.isPortalAdmin ? ['portal.*'] : acl.features)
   }
 
   async invalidateUserCache(userId: string): Promise<void> {

package/src/modules/customer_accounts/setup.ts

@@ -137,6 +137,10 @@ const DEFAULT_ROLES = [
   },
 ]
 
+const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
+  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),
+)
+
 /**
  * Collect defaultCustomerRoleFeatures from all enabled modules and merge
  * them into the corresponding CustomerRoleAcl records.
@@ -220,6 +224,9 @@ export const setup: ModuleSetupConfig = {
     superadmin: ['customer_accounts.*'],
     admin: ['customer_accounts.*'],
   },
+  // Keep the portal feature catalog declarative so the shared feature policy
+  // can project portal.* into concrete capabilities without importing core.
+  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,
 
   async onTenantCreated({ em, tenantId, organizationId }) {
     await seedDefaultRoles(em, { tenantId, organizationId })

package/src/modules/customer_accounts/widgets/injection/portal-ai-assistant-trigger/widget.client.tsx

@@ -69,9 +69,7 @@ export default function PortalAiAssistantTriggerWidget({ context }: PortalAiAssi
   const resolvedFeatures = Array.isArray(context?.resolvedFeatures)
     ? (context?.resolvedFeatures as string[])
     : []
-  const featureAllowed =
-    context?.isPortalAdmin === true ||
-    hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE)
+  const featureAllowed = hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE)
 
   const pageContext = React.useMemo<PortalAiInjectPageContext>(() => ({
     view: 'portal.profile',

package/src/modules/customers/lib/visibilityFilter.ts

@@ -1,5 +1,5 @@
 import type { FilterQuery } from '@mikro-orm/postgresql'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { CustomerInteraction } from '../data/entities'
 
 /**
@@ -22,7 +22,9 @@ export const EMAIL_VIEW_PRIVATE_FEATURE = 'customers.email.view_private'
  */
 export function callerHasEmailViewPrivate(userFeatures: string[] | null | undefined): boolean {
   if (!Array.isArray(userFeatures) || userFeatures.length === 0) return false
-  return hasFeature(userFeatures, EMAIL_VIEW_PRIVATE_FEATURE)
+  return authorizeFeatures([EMAIL_VIEW_PRIVATE_FEATURE], {
+    grantedFeatures: userFeatures,
+  })
 }
 
 /**
@@ -92,7 +94,7 @@ export function applyEmailVisibilityFilter<T extends { where: (...args: any[]) =
 }
 
 type RbacServiceLike = {
-  getGrantedFeatures?: (
+  getEffectiveFeatures?: (
     userId: string,
     scope: { tenantId: string | null; organizationId: string | null },
   ) => Promise<string[] | undefined>
@@ -118,8 +120,8 @@ export async function resolveCallerEmailFeatures(
   if (!userId) return undefined
   try {
     const rbac = container.resolve('rbacService') as RbacServiceLike | undefined
-    if (!rbac?.getGrantedFeatures) return undefined
-    return await rbac.getGrantedFeatures(userId, { tenantId, organizationId })
+    if (!rbac?.getEffectiveFeatures) return undefined
+    return await rbac.getEffectiveFeatures(userId, { tenantId, organizationId })
   } catch {
     return undefined
   }

package/src/modules/dashboards/api/layout/[itemId]/route.ts

@@ -4,7 +4,6 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'
 import { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'
-import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -55,8 +54,12 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
+  const canConfigure = await rbac.userHasAllFeatures(
+    scope.userId,
+    ['dashboards.configure'],
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  if (!canConfigure) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/layout/route.ts

@@ -6,7 +6,7 @@ import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/enti
 import { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -88,7 +88,10 @@ export async function GET(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
+  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   const widgets = await loadAllWidgets()
   const allowedIds = await resolveAllowedWidgetIds(
     em,
@@ -96,8 +99,8 @@ export async function GET(req: Request) {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: acl.features ?? [],
-      isSuperAdmin: !!acl.isSuperAdmin,
+      features: effectiveFeatures,
+      isSuperAdmin: false,
     },
     widgets,
   )
@@ -147,7 +150,9 @@ export async function GET(req: Request) {
     await em.flush()
   }
 
-  const canConfigure = acl.isSuperAdmin || hasFeature(acl.features, 'dashboards.configure')
+  const canConfigure = authorizeFeatures(['dashboards.configure'], {
+    grantedFeatures: effectiveFeatures,
+  })
 
   let userEmail: string | null = null
   let userName: string | null = null
@@ -222,8 +227,12 @@ export async function PUT(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
+  const canConfigure = await rbac.userHasAllFeatures(
+    scope.userId,
+    ['dashboards.configure'],
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  if (!canConfigure) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -243,14 +252,18 @@ export async function PUT(req: Request) {
   }
 
   const widgets = await loadAllWidgets()
+  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   const allowedIds = await resolveAllowedWidgetIds(
     em,
     {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: acl.features ?? [],
-      isSuperAdmin: !!acl.isSuperAdmin,
+      features: effectiveFeatures,
+      isSuperAdmin: false,
     },
     widgets,
   )