@open-mercato/core 0.6.7-develop.6795.1.8a3f27921c → 0.6.7-develop.6824.1.21fff90682

package/src/modules/configs/lib/upgrade-actions.ts

@@ -91,6 +91,20 @@ export const upgradeActions: UpgradeActionDefinition[] = [
       }
     },
   },
+  {
+    id: 'payment_gateways.register-session-initialization-prune',
+    version: '0.6.6',
+    messageKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.message',
+    ctaKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.cta',
+    successKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.success',
+    loadingKey: 'payment_gateways.upgradeActions.sessionInitializationPrune.loading',
+    run: async ({ container, tenantId, organizationId }) => {
+      const { registerSessionInitializationPruneSchedule } = await import(
+        '@open-mercato/core/modules/payment_gateways/setup'
+      )
+      await registerSessionInitializationPruneSchedule(container, { tenantId, organizationId })
+    },
+  },
 ]
 
 export function actionsUpToVersion(version: string): UpgradeActionDefinition[] {

package/src/modules/customer_accounts/api/admin/users/[id].ts

@@ -11,7 +11,7 @@ import { CustomerRbacService } from '@open-mercato/core/modules/customer_account
 import { adminUpdateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { isOwnedCompanyEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
+import { isOwnedCompanyEntity, isOwnedPersonEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
@@ -168,6 +168,21 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     }
   }
 
+  // Same guard for the person FK. Without it the invite-side check is trivially
+  // bypassable: create the user normally, then PUT an unowned personEntityId.
+  // It persists (autoLinkCrm short-circuits on any non-null value) and leaks
+  // account status into the other org's people list via the account-status
+  // enricher. A null value (unlink) needs no ownership check.
+  if (parsed.data.personEntityId) {
+    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
+    }
+  }
+
   // Always bump updated_at so the optimistic-lock version advances on every save.
   // `nativeUpdate` bypasses MikroORM's `onUpdate` hook, so set it explicitly — without
   // this the version never changes and concurrent edits cannot be detected (#2055).

package/src/modules/customer_accounts/api/admin/users-invite.ts

@@ -7,6 +7,7 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
+import { isOwnedCompanyEntity, isOwnedPersonEntity, resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import {
   checkAuthRateLimit,
@@ -14,9 +15,15 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
 
 export const metadata = {}
 
+function resolveInvitedByUserId(auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>): string | null {
+  if (auth.isApiKey) return auth.userId ?? null
+  return auth.sub
+}
+
 export async function POST(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -51,19 +58,80 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })
   }
 
+  // Reject a customerEntityId the caller does not own. customerEntityId is the
+  // CRM company FK; without this check a non-company (e.g. a person) entity id
+  // or a company from another org poisons the invitation and every later user
+  // edit fails with "Company not found" (#4362, #2693).
+  if (parsed.data.customerEntityId) {
+    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
+    const owned = await isOwnedCompanyEntity(em, parsed.data.customerEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Company not found' }, { status: 400 })
+    }
+  }
+
+  // Same guard for the person FK: it is copied onto the customer user on accept
+  // and makes `autoLinkCrm` short-circuit, so an unowned id would permanently
+  // cross-link the portal user to another org's CRM person.
+  let resolvedCustomerEntityId = parsed.data.customerEntityId || null
+  if (parsed.data.personEntityId) {
+    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
+    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
+    }
+
+    // An invitation raised from a person card carries only the person FK, and the
+    // accepted user then short-circuits `autoLinkCrm`. Resolve the person's company
+    // here so the user lands with a company scope key: the portal Users page, portal
+    // invitations, and the company detail "Portal users" group all filter on it.
+    if (!resolvedCustomerEntityId) {
+      resolvedCustomerEntityId = await resolveOwnedCompanyForPerson(em, parsed.data.personEntityId, {
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      })
+    }
+  }
+
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation } = await customerInvitationService.createInvitation(
+  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId!, organizationId: auth.orgId! },
     {
-      customerEntityId: parsed.data.customerEntityId || null,
+      customerEntityId: resolvedCustomerEntityId,
+      personEntityId: parsed.data.personEntityId || null,
       roleIds: parsed.data.roleIds,
-      invitedByUserId: auth.sub,
+      invitedByUserId: resolveInvitedByUserId(auth),
       displayName: parsed.data.displayName || null,
     },
   )
 
+  try {
+    await sendCustomerInvitationEmail({
+      container,
+      organizationId: auth.orgId!,
+      email: invitation.email,
+      rawToken,
+    })
+  } catch (error) {
+    console.error('[customer_accounts.admin.users-invite] invitation email failed', error)
+    try {
+      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
+    } catch (rollbackError) {
+      console.error('[customer_accounts.admin.users-invite] invitation rollback failed', rollbackError)
+    }
+    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
+  }
+
+  // Emit only after the email is sent, so a subscriber observing "invited" can
+  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -78,6 +146,10 @@ export async function POST(req: Request) {
     invitation: {
       id: invitation.id,
       email: invitation.email,
+      // Echo the stored CRM links so the caller can see which company the person
+      // invite resolved to. The token stays unexposed.
+      customerEntityId: invitation.customerEntityId || null,
+      personEntityId: invitation.personEntityId || null,
       expiresAt: invitation.expiresAt,
     },
   }, { status: 201 })
@@ -88,6 +160,8 @@ const successSchema = z.object({
   invitation: z.object({
     id: z.string().uuid(),
     email: z.string(),
+    customerEntityId: z.string().uuid().nullable(),
+    personEntityId: z.string().uuid().nullable(),
     expiresAt: z.string().datetime(),
   }),
 })
@@ -104,6 +178,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
+    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -16,6 +16,7 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -90,7 +91,7 @@ export async function POST(req: Request) {
 
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation } = await customerInvitationService.createInvitation(
+  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId, organizationId: auth.orgId },
     {
@@ -101,6 +102,25 @@ export async function POST(req: Request) {
     },
   )
 
+  try {
+    await sendCustomerInvitationEmail({
+      container,
+      organizationId: auth.orgId,
+      email: invitation.email,
+      rawToken,
+    })
+  } catch (error) {
+    console.error('[customer_accounts.portal.users-invite] invitation email failed', error)
+    try {
+      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
+    } catch (rollbackError) {
+      console.error('[customer_accounts.portal.users-invite] invitation rollback failed', rollbackError)
+    }
+    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
+  }
+
+  // Emit only after the email is sent, so a subscriber observing "invited" can
+  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -141,6 +161,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
+    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/data/entities.ts

@@ -291,6 +291,9 @@ export class CustomerUserInvitation {
   @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })
   customerEntityId?: string | null
 
+  @Property({ name: 'person_entity_id', type: 'uuid', nullable: true })
+  personEntityId?: string | null
+
   @Property({ name: 'role_ids_json', type: 'json', nullable: true })
   roleIdsJson?: string[] | null
 

package/src/modules/customer_accounts/data/validators.ts

@@ -81,6 +81,7 @@ export const updateRoleAclSchema = z.object({
 export const inviteUserSchema = z.object({
   email: emailField,
   customerEntityId: z.string().uuid().optional(),
+  personEntityId: z.string().uuid().optional(),
   roleIds: z.array(z.string().uuid()).min(1),
   displayName: displayNameField.optional(),
 })

package/src/modules/customer_accounts/emails/CustomerInvitationEmail.tsx

@@ -0,0 +1,45 @@
+import * as React from 'react'
+import { Html, Head, Preview, Body, Container, Text, Section, Link } from '@react-email/components'
+
+export type CustomerInvitationEmailCopy = {
+  preview: string
+  title: string
+  body: string
+  cta: string
+  hint: string
+}
+
+export type CustomerInvitationEmailProps = {
+  inviteUrl: string
+  copy: CustomerInvitationEmailCopy
+}
+
+export function CustomerInvitationEmail({ inviteUrl, copy }: CustomerInvitationEmailProps) {
+  return (
+    <Html>
+      <Head />
+      <Preview>{copy.preview}</Preview>
+      <Body style={body}>
+        <Container style={container}>
+          <Section>
+            <Text style={title}>{copy.title}</Text>
+            <Text style={paragraph}>{copy.body}</Text>
+            <Text>
+              <Link href={inviteUrl} style={button}>{copy.cta}</Link>
+            </Text>
+            <Text style={hint}>{copy.hint}</Text>
+          </Section>
+        </Container>
+      </Body>
+    </Html>
+  )
+}
+
+const body: React.CSSProperties = { backgroundColor: '#f9fafb', margin: 0, padding: '24px 0' }
+const container: React.CSSProperties = { backgroundColor: '#ffffff', borderRadius: 12, padding: 24, margin: '0 auto', maxWidth: 520, boxShadow: '0 1px 4px rgba(0,0,0,0.06)' }
+const title: React.CSSProperties = { fontSize: 20, fontWeight: 600, color: '#111827', margin: '0 0 12px' }
+const paragraph: React.CSSProperties = { fontSize: 14, color: '#4b5563', lineHeight: '20px', margin: '0 0 16px' }
+const button: React.CSSProperties = { display: 'inline-block', backgroundColor: '#111827', color: '#ffffff', padding: '10px 14px', borderRadius: 8, textDecoration: 'none', fontSize: 14 }
+const hint: React.CSSProperties = { fontSize: 12, color: '#6b7280', marginTop: 16 }
+
+export default CustomerInvitationEmail

package/src/modules/customer_accounts/i18n/de.json

@@ -274,6 +274,12 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
+  "customer_accounts.invitation.email.cta": "Accept invitation",
+  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
+  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
+  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
+  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Rolle erstellen",
   "customer_accounts.nav.role_detail": "Rollendetails",

package/src/modules/customer_accounts/i18n/en.json

@@ -274,6 +274,12 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
+  "customer_accounts.invitation.email.cta": "Accept invitation",
+  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
+  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
+  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
+  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",

package/src/modules/customer_accounts/i18n/es.json

@@ -274,6 +274,12 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
+  "customer_accounts.invitation.email.cta": "Accept invitation",
+  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
+  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
+  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
+  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",

package/src/modules/customer_accounts/i18n/pl.json

@@ -274,6 +274,12 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "Problem z certyfikatem SSL",
   "customer_accounts.domainMapping.tls.retryButton": "Ponów SSL",
   "customer_accounts.domainMapping.verifyNow": "Sprawdź teraz",
+  "customer_accounts.invitation.email.body": "Użyj bezpiecznego linku zaproszenia, aby utworzyć hasło i uzyskać dostęp do portalu klienta.",
+  "customer_accounts.invitation.email.cta": "Przyjmij zaproszenie",
+  "customer_accounts.invitation.email.hint": "Ten link zaproszenia wygasa po 72 godzinach. Jeśli nie spodziewasz się tego zaproszenia, możesz zignorować tę wiadomość.",
+  "customer_accounts.invitation.email.preview": "Przyjmij zaproszenie, aby dokończyć konfigurację dostępu do portalu.",
+  "customer_accounts.invitation.email.subject": "Masz zaproszenie do portalu klienta",
+  "customer_accounts.invitation.email.title": "Masz zaproszenie",
   "customer_accounts.nav.group": "Klienci",
   "customer_accounts.nav.role_create": "Utwórz rolę",
   "customer_accounts.nav.role_detail": "Szczegóły roli",

package/src/modules/customer_accounts/lib/customerEntityOwnership.ts

@@ -20,16 +20,82 @@ export async function isOwnedCompanyEntity(
   em: EntityManager,
   customerEntityId: string,
   scope: CustomerEntityScope,
+): Promise<boolean> {
+  return isOwnedEntityOfKind(em, customerEntityId, 'company', scope)
+}
+
+/**
+ * Confirms that a caller-supplied `personEntityId` (the CRM person FK linked
+ * onto a customer user) exists, is a person, is not soft-deleted, and belongs
+ * to the caller's tenant and organization.
+ *
+ * This is the symmetric guard to {@link isOwnedCompanyEntity}: the person FK is
+ * copied onto the customer user on accept and short-circuits CRM auto-linking,
+ * so an unvalidated id would permanently cross-link a portal user to another
+ * org's person (the #4362/#2693 class of bug, on the person side).
+ */
+export async function isOwnedPersonEntity(
+  em: EntityManager,
+  personEntityId: string,
+  scope: CustomerEntityScope,
+): Promise<boolean> {
+  return isOwnedEntityOfKind(em, personEntityId, 'person', scope)
+}
+
+/**
+ * Resolves the CRM company a person belongs to, but only when both the profile
+ * lookup and the company itself stay inside the given tenant/organization scope.
+ * Returns null when the person has no company or that company is out of scope.
+ *
+ * Both the invite route and the CRM auto-link subscriber need this answer, and
+ * both write the result into `customerEntityId` — the portal company scope key —
+ * so they must agree on what counts as an in-scope company.
+ */
+export async function resolveOwnedCompanyForPerson(
+  em: EntityManager,
+  personEntityId: string,
+  scope: CustomerEntityScope,
+): Promise<string | null> {
+  const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')
+  const profile = await em.findOne(CustomerPersonProfile as any, {
+    entity: personEntityId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  } as any)
+  const candidate = readCompanyEntityId(profile)
+  if (!candidate) return null
+  return (await isOwnedCompanyEntity(em, candidate, scope)) ? candidate : null
+}
+
+/**
+ * `CustomerPersonProfile.company` is a relation on `company_entity_id`, not a
+ * scalar — MikroORM hands back either the raw id or an entity reference, never a
+ * `companyEntityId` property. Reading the wrong one silently yields undefined and
+ * turns every company recovery into a clear.
+ */
+function readCompanyEntityId(profile: unknown): string | null {
+  const company = (profile as { company?: unknown } | null | undefined)?.company
+  if (!company) return null
+  if (typeof company === 'string') return company
+  const id = (company as { id?: unknown }).id
+  return typeof id === 'string' ? id : null
+}
+
+async function isOwnedEntityOfKind(
+  em: EntityManager,
+  entityId: string,
+  kind: 'company' | 'person',
+  scope: CustomerEntityScope,
 ): Promise<boolean> {
   const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
   const entity = await findOneWithDecryption(
     em,
     CustomerEntity,
     {
-      id: customerEntityId,
+      id: entityId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      kind: 'company',
+      kind,
       deletedAt: null,
     } as any,
     undefined,

package/src/modules/customer_accounts/lib/customerUrl.ts

@@ -5,6 +5,8 @@
 
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import type { EntityManager } from '@mikro-orm/postgresql'
 
 type DomainMappingService = {
   resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>
@@ -14,6 +16,10 @@ type OrgService = {
   findById(orgId: string): Promise<{ id: string; slug: string | null } | null>
 }
 
+type EntityManagerResolver = {
+  resolve(name: 'em'): EntityManager
+}
+
 function platformBaseUrl(): string {
   const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()
   if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, '')
@@ -32,6 +38,26 @@ function resolveContainer(container?: AppContainer): Promise<AppContainer> {
   return createRequestContainer()
 }
 
+async function resolveOrgSlug(container: AppContainer, orgId: string): Promise<string | null> {
+  try {
+    const orgService = container.resolve('orgService') as OrgService | undefined
+    if (orgService && typeof orgService.findById === 'function') {
+      const org = await orgService.findById(orgId)
+      return org?.slug ?? null
+    }
+  } catch {
+    // orgService is optional in standalone/runtime contexts — fall through to EntityManager.
+  }
+
+  try {
+    const em = (container as AppContainer & EntityManagerResolver).resolve('em')
+    const org = await em.findOne(Organization, { id: orgId, deletedAt: null })
+    return org?.slug ?? null
+  } catch {
+    return null
+  }
+}
+
 export async function urlForCustomerOrg(
   orgId: string,
   path: string,
@@ -55,17 +81,7 @@ export async function urlForCustomerOrg(
     return `https://${active.hostname}${safePath}`
   }
 
-  let orgSlug: string | null = null
-  try {
-    const orgService = container.resolve('orgService') as OrgService | undefined
-    if (orgService && typeof orgService.findById === 'function') {
-      const org = await orgService.findById(orgId)
-      orgSlug = org?.slug ?? null
-    }
-  } catch {
-    orgSlug = null
-  }
-
+  const orgSlug = await resolveOrgSlug(container, orgId)
   const base = platformBaseUrl()
   if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`
   return `${base}${safePath}`

package/src/modules/customer_accounts/lib/invitationEmail.ts

@@ -0,0 +1,42 @@
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { sendEmail } from '@open-mercato/shared/lib/email/send'
+import CustomerInvitationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail'
+import { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'
+
+export type CustomerInvitationEmailInput = {
+  container: AppContainer
+  organizationId: string
+  email: string
+  rawToken: string
+}
+
+export async function sendCustomerInvitationEmail(input: CustomerInvitationEmailInput): Promise<void> {
+  const { translate } = await resolveTranslations()
+  const inviteUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/invite?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container },
+  )
+
+  const subject = translate('customer_accounts.invitation.email.subject', 'You have been invited to the customer portal')
+  const copy = {
+    preview: translate('customer_accounts.invitation.email.preview', 'Accept your invitation to finish setting up portal access.'),
+    title: translate('customer_accounts.invitation.email.title', 'You have been invited'),
+    body: translate(
+      'customer_accounts.invitation.email.body',
+      'Use this secure invitation link to create your password and access the customer portal.',
+    ),
+    cta: translate('customer_accounts.invitation.email.cta', 'Accept invitation'),
+    hint: translate(
+      'customer_accounts.invitation.email.hint',
+      'This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.',
+    ),
+  }
+
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerInvitationEmail({ inviteUrl, copy }),
+  })
+}

package/src/modules/customer_accounts/migrations/.snapshot-open-mercato.json

@@ -923,6 +923,22 @@
           "enumItems": [],
           "mappedType": "uuid"
         },
+        "person_entity_id": {
+          "name": "person_entity_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
         "role_ids_json": {
           "name": "role_ids_json",
           "type": "jsonb",

package/src/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260723120000_customer_accounts extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "customer_user_invitations" add column "person_entity_id" uuid null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`alter table "customer_user_invitations" drop column "person_entity_id";`);
+  }
+
+}