@open-mercato/core 0.6.7-develop.6862.1.c11a64ce0a → 0.6.7

package/src/modules/customer_accounts/api/admin/users-invite.ts

@@ -7,7 +7,6 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
-import { isOwnedCompanyEntity, isOwnedPersonEntity, resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import {
   checkAuthRateLimit,
@@ -15,18 +14,9 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
-import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-
-const logger = createLogger('customer_accounts').child({ component: 'admin-users-invite' })
 
 export const metadata = {}
 
-function resolveInvitedByUserId(auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>): string | null {
-  if (auth.isApiKey) return auth.userId ?? null
-  return auth.sub
-}
-
 export async function POST(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -61,80 +51,19 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })
   }
 
-  // Reject a customerEntityId the caller does not own. customerEntityId is the
-  // CRM company FK; without this check a non-company (e.g. a person) entity id
-  // or a company from another org poisons the invitation and every later user
-  // edit fails with "Company not found" (#4362, #2693).
-  if (parsed.data.customerEntityId) {
-    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
-    const owned = await isOwnedCompanyEntity(em, parsed.data.customerEntityId, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId,
-    })
-    if (!owned) {
-      return NextResponse.json({ ok: false, error: 'Company not found' }, { status: 400 })
-    }
-  }
-
-  // Same guard for the person FK: it is copied onto the customer user on accept
-  // and makes `autoLinkCrm` short-circuit, so an unowned id would permanently
-  // cross-link the portal user to another org's CRM person.
-  let resolvedCustomerEntityId = parsed.data.customerEntityId || null
-  if (parsed.data.personEntityId) {
-    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
-    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
-      tenantId: auth.tenantId,
-      organizationId: auth.orgId,
-    })
-    if (!owned) {
-      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
-    }
-
-    // An invitation raised from a person card carries only the person FK, and the
-    // accepted user then short-circuits `autoLinkCrm`. Resolve the person's company
-    // here so the user lands with a company scope key: the portal Users page, portal
-    // invitations, and the company detail "Portal users" group all filter on it.
-    if (!resolvedCustomerEntityId) {
-      resolvedCustomerEntityId = await resolveOwnedCompanyForPerson(em, parsed.data.personEntityId, {
-        tenantId: auth.tenantId,
-        organizationId: auth.orgId,
-      })
-    }
-  }
-
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
+  const { invitation } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId!, organizationId: auth.orgId! },
     {
-      customerEntityId: resolvedCustomerEntityId,
-      personEntityId: parsed.data.personEntityId || null,
+      customerEntityId: parsed.data.customerEntityId || null,
       roleIds: parsed.data.roleIds,
-      invitedByUserId: resolveInvitedByUserId(auth),
+      invitedByUserId: auth.sub,
       displayName: parsed.data.displayName || null,
     },
   )
 
-  try {
-    await sendCustomerInvitationEmail({
-      container,
-      organizationId: auth.orgId!,
-      email: invitation.email,
-      rawToken,
-    })
-  } catch (error) {
-    logger.error('Invitation email failed', { err: error })
-    try {
-      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
-    } catch (rollbackError) {
-      logger.error('Invitation rollback failed', { err: rollbackError })
-    }
-    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
-  }
-
-  // Emit only after the email is sent, so a subscriber observing "invited" can
-  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -149,10 +78,6 @@ export async function POST(req: Request) {
     invitation: {
       id: invitation.id,
       email: invitation.email,
-      // Echo the stored CRM links so the caller can see which company the person
-      // invite resolved to. The token stays unexposed.
-      customerEntityId: invitation.customerEntityId || null,
-      personEntityId: invitation.personEntityId || null,
       expiresAt: invitation.expiresAt,
     },
   }, { status: 201 })
@@ -163,8 +88,6 @@ const successSchema = z.object({
   invitation: z.object({
     id: z.string().uuid(),
     email: z.string(),
-    customerEntityId: z.string().uuid().nullable(),
-    personEntityId: z.string().uuid().nullable(),
     expiresAt: z.string().datetime(),
   }),
 })
@@ -181,7 +104,6 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
-    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/api/invitations/accept.ts

@@ -39,10 +39,11 @@ export async function POST(req: Request) {
   }
 
   const { user, invitation } = result
-  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+  const acl = await customerRbacService.loadAcl(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
+  const resolvedFeatures = acl.features
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/login.ts

@@ -116,10 +116,8 @@ export async function POST(req: Request) {
     await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)
   }
 
-  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
-    tenantId,
-    organizationId: user.organizationId,
-  })
+  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })
+  const resolvedFeatures = acl.features
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/magic-link/verify.ts

@@ -52,10 +52,8 @@ export async function POST(req: Request) {
   await customerUserService.resetFailedAttempts(user)
   await customerUserService.updateLastLoginAt(user)
 
-  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
-    tenantId: user.tenantId,
-    organizationId: user.organizationId,
-  })
+  const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
+  const resolvedFeatures = acl.features
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/portal/feature-check.ts

@@ -4,7 +4,7 @@ import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import { matchFeature } from '@open-mercato/shared/lib/auth/featureMatch'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -32,10 +32,12 @@ export async function POST(req: Request) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   })
-  const granted = body.features.filter((feature) => authorizeFeatures([feature], {
-    grantedFeatures: acl.features,
-    unrestricted: acl.isPortalAdmin,
-  }))
+
+  const granted = acl.isPortalAdmin
+    ? [...body.features]
+    : body.features.filter((feature) =>
+        acl.features.some((g) => matchFeature(feature, g)),
+      )
 
   return NextResponse.json({ ok: true, granted })
 }

package/src/modules/customer_accounts/api/portal/nav.ts

@@ -51,15 +51,13 @@ export async function GET(req: Request) {
   }
 
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId, organizationId: auth.orgId })
-  const grantedFeatures = await rbac.getEffectiveFeatures(auth.sub, {
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
-  })
+  const grantedFeatures = acl.isPortalAdmin ? ['*'] : acl.features
 
   const groups = buildPortalNav({
     routes: getFrontendRouteManifests(),
     orgSlug,
     grantedFeatures,
+    isPortalAdmin: acl.isPortalAdmin,
   })
 
   return NextResponse.json({
@@ -74,7 +72,7 @@ export async function GET(req: Request) {
 const getMethodDoc: OpenApiMethodDoc = {
   summary: 'Portal sidebar navigation',
   description:
-    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against concrete effective features.',
+    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against the customer\'s grants (wildcards honored).',
   tags: ['Customer Portal'],
   responses: [{ status: 200, description: 'Portal sidebar groups', schema: navResponseSchema }],
   errors: [

package/src/modules/customer_accounts/api/portal/profile.ts

@@ -27,10 +27,6 @@ export async function GET(req: Request) {
   }
 
   const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
-  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
-    tenantId: user.tenantId,
-    organizationId: user.organizationId,
-  })
 
   const userRoles = await em.find(CustomerUserRole, {
     user: user.id as any,
@@ -56,7 +52,7 @@ export async function GET(req: Request) {
       createdAt: user.createdAt,
     },
     roles,
-    resolvedFeatures,
+    resolvedFeatures: acl.features,
     isPortalAdmin: acl.isPortalAdmin,
   })
 }

package/src/modules/customer_accounts/api/portal/sessions-refresh.ts

@@ -36,17 +36,17 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Account not active' }, { status: 401 })
   }
 
-  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+  const acl = await customerRbacService.loadAcl(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
 
-  const result = await customerSessionService.refreshSession(decodedToken, resolvedFeatures)
+  const result = await customerSessionService.refreshSession(decodedToken, acl.features)
   if (!result) {
     return NextResponse.json({ ok: false, error: 'Session refresh failed' }, { status: 401 })
   }
 
-  const res = NextResponse.json({ ok: true, resolvedFeatures })
+  const res = NextResponse.json({ ok: true, resolvedFeatures: acl.features })
 
   res.cookies.set('customer_auth_token', result.jwt, {
     httpOnly: true,

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -16,10 +16,6 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
-import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-
-const logger = createLogger('customer_accounts').child({ component: 'portal-users-invite' })
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -94,7 +90,7 @@ export async function POST(req: Request) {
 
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
+  const { invitation } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId, organizationId: auth.orgId },
     {
@@ -105,25 +101,6 @@ export async function POST(req: Request) {
     },
   )
 
-  try {
-    await sendCustomerInvitationEmail({
-      container,
-      organizationId: auth.orgId,
-      email: invitation.email,
-      rawToken,
-    })
-  } catch (error) {
-    logger.error('Invitation email failed', { err: error })
-    try {
-      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
-    } catch (rollbackError) {
-      logger.error('Invitation rollback failed', { err: rollbackError })
-    }
-    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
-  }
-
-  // Emit only after the email is sent, so a subscriber observing "invited" can
-  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -164,7 +141,6 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
-    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -1,7 +1,6 @@
 "use client"
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/customer_accounts/extension-points'
 import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -214,7 +213,7 @@ export default function CustomerRolesPage() {
           searchValue={search}
           onSearchChange={(value) => { setSearch(value); setPage(1) }}
           searchPlaceholder={t('customer_accounts.admin.roles.searchPlaceholder', 'Search roles...')}
-          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}
+          perspective={{ tableId: 'customer_accounts.admin.roles' }}
           emptyState={(
             <ListEmptyState
               entityName={t('customer_accounts.admin.roles.title', 'Customer Roles')}

package/src/modules/customer_accounts/backend/customer_accounts/users/page.tsx

@@ -1,7 +1,6 @@
 "use client"
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/customer_accounts/extension-points'
 import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Globe, Settings } from 'lucide-react'
@@ -546,7 +545,7 @@ export default function CustomerAccountsPage() {
           filterValues={filterValues}
           onFiltersApply={handleFiltersApply}
           onFiltersClear={handleFiltersClear}
-          perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}
+          perspective={{ tableId: 'customer_accounts.admin.users' }}
           emptyState={(
             <ListEmptyState
               entityName={t('customer_accounts.admin.title', 'Users')}

package/src/modules/customer_accounts/data/entities.ts

@@ -291,9 +291,6 @@ export class CustomerUserInvitation {
   @Property({ name: 'customer_entity_id', type: 'uuid', nullable: true })
   customerEntityId?: string | null
 
-  @Property({ name: 'person_entity_id', type: 'uuid', nullable: true })
-  personEntityId?: string | null
-
   @Property({ name: 'role_ids_json', type: 'json', nullable: true })
   roleIdsJson?: string[] | null
 

package/src/modules/customer_accounts/data/validators.ts

@@ -81,7 +81,6 @@ export const updateRoleAclSchema = z.object({
 export const inviteUserSchema = z.object({
   email: emailField,
   customerEntityId: z.string().uuid().optional(),
-  personEntityId: z.string().uuid().optional(),
   roleIds: z.array(z.string().uuid()).min(1),
   displayName: displayNameField.optional(),
 })

package/src/modules/customer_accounts/i18n/de.json

@@ -274,12 +274,6 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
-  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
-  "customer_accounts.invitation.email.cta": "Accept invitation",
-  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
-  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
-  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
-  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Rolle erstellen",
   "customer_accounts.nav.role_detail": "Rollendetails",

package/src/modules/customer_accounts/i18n/en.json

@@ -274,12 +274,6 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
-  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
-  "customer_accounts.invitation.email.cta": "Accept invitation",
-  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
-  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
-  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
-  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",

package/src/modules/customer_accounts/i18n/es.json

@@ -274,12 +274,6 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
-  "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
-  "customer_accounts.invitation.email.cta": "Accept invitation",
-  "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
-  "customer_accounts.invitation.email.preview": "Accept your invitation to finish setting up portal access.",
-  "customer_accounts.invitation.email.subject": "You have been invited to the customer portal",
-  "customer_accounts.invitation.email.title": "You have been invited",
   "customer_accounts.nav.group": "Customers",
   "customer_accounts.nav.role_create": "Create Role",
   "customer_accounts.nav.role_detail": "Role Detail",

package/src/modules/customer_accounts/i18n/pl.json

@@ -274,12 +274,6 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "Problem z certyfikatem SSL",
   "customer_accounts.domainMapping.tls.retryButton": "Ponów SSL",
   "customer_accounts.domainMapping.verifyNow": "Sprawdź teraz",
-  "customer_accounts.invitation.email.body": "Użyj bezpiecznego linku zaproszenia, aby utworzyć hasło i uzyskać dostęp do portalu klienta.",
-  "customer_accounts.invitation.email.cta": "Przyjmij zaproszenie",
-  "customer_accounts.invitation.email.hint": "Ten link zaproszenia wygasa po 72 godzinach. Jeśli nie spodziewasz się tego zaproszenia, możesz zignorować tę wiadomość.",
-  "customer_accounts.invitation.email.preview": "Przyjmij zaproszenie, aby dokończyć konfigurację dostępu do portalu.",
-  "customer_accounts.invitation.email.subject": "Masz zaproszenie do portalu klienta",
-  "customer_accounts.invitation.email.title": "Masz zaproszenie",
   "customer_accounts.nav.group": "Klienci",
   "customer_accounts.nav.role_create": "Utwórz rolę",
   "customer_accounts.nav.role_detail": "Szczegóły roli",

package/src/modules/customer_accounts/lib/customerAuth.ts

@@ -15,7 +15,6 @@ export interface CustomerAuthContext {
   customerEntityId?: string | null
   personEntityId?: string | null
   resolvedFeatures: string[]
-  isPortalAdmin?: boolean
 }
 
 async function assertSessionStillActive(sessionId: string): Promise<boolean> {
@@ -49,7 +48,7 @@ export function readCookieFromHeader(header: string | null | undefined, name: st
 
 export type UserValidationResult =
   | { valid: false }
-  | { valid: true; resolvedFeatures: string[]; isPortalAdmin: boolean }
+  | { valid: true; resolvedFeatures: string[] }
 
 export async function validateUserState(
   sub: string,
@@ -78,11 +77,7 @@ export async function validateUserState(
   )
   const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>
   const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })
-  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {
-    tenantId,
-    organizationId: orgId,
-  })
-  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin }
+  return { valid: true, resolvedFeatures: acl.isPortalAdmin ? ['*'] : acl.features }
 }
 
 export async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {
@@ -139,7 +134,6 @@ export async function getCustomerAuthFromRequest(req: Request): Promise<Customer
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
       resolvedFeatures: userState.resolvedFeatures,
-      isPortalAdmin: userState.isPortalAdmin,
     }
   } catch {
     // Invalid or expired JWT — treat as unauthenticated

package/src/modules/customer_accounts/lib/customerAuthServer.ts

@@ -88,7 +88,6 @@ export async function getCustomerAuthFromCookies(
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,
       personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,
       resolvedFeatures: userState.resolvedFeatures,
-      isPortalAdmin: userState.isPortalAdmin,
     }
   } catch {
     // Invalid or expired JWT — treat as unauthenticated

package/src/modules/customer_accounts/lib/customerEntityOwnership.ts

@@ -20,82 +20,16 @@ export async function isOwnedCompanyEntity(
   em: EntityManager,
   customerEntityId: string,
   scope: CustomerEntityScope,
-): Promise<boolean> {
-  return isOwnedEntityOfKind(em, customerEntityId, 'company', scope)
-}
-
-/**
- * Confirms that a caller-supplied `personEntityId` (the CRM person FK linked
- * onto a customer user) exists, is a person, is not soft-deleted, and belongs
- * to the caller's tenant and organization.
- *
- * This is the symmetric guard to {@link isOwnedCompanyEntity}: the person FK is
- * copied onto the customer user on accept and short-circuits CRM auto-linking,
- * so an unvalidated id would permanently cross-link a portal user to another
- * org's person (the #4362/#2693 class of bug, on the person side).
- */
-export async function isOwnedPersonEntity(
-  em: EntityManager,
-  personEntityId: string,
-  scope: CustomerEntityScope,
-): Promise<boolean> {
-  return isOwnedEntityOfKind(em, personEntityId, 'person', scope)
-}
-
-/**
- * Resolves the CRM company a person belongs to, but only when both the profile
- * lookup and the company itself stay inside the given tenant/organization scope.
- * Returns null when the person has no company or that company is out of scope.
- *
- * Both the invite route and the CRM auto-link subscriber need this answer, and
- * both write the result into `customerEntityId` — the portal company scope key —
- * so they must agree on what counts as an in-scope company.
- */
-export async function resolveOwnedCompanyForPerson(
-  em: EntityManager,
-  personEntityId: string,
-  scope: CustomerEntityScope,
-): Promise<string | null> {
-  const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')
-  const profile = await em.findOne(CustomerPersonProfile as any, {
-    entity: personEntityId,
-    tenantId: scope.tenantId,
-    organizationId: scope.organizationId,
-  } as any)
-  const candidate = readCompanyEntityId(profile)
-  if (!candidate) return null
-  return (await isOwnedCompanyEntity(em, candidate, scope)) ? candidate : null
-}
-
-/**
- * `CustomerPersonProfile.company` is a relation on `company_entity_id`, not a
- * scalar — MikroORM hands back either the raw id or an entity reference, never a
- * `companyEntityId` property. Reading the wrong one silently yields undefined and
- * turns every company recovery into a clear.
- */
-function readCompanyEntityId(profile: unknown): string | null {
-  const company = (profile as { company?: unknown } | null | undefined)?.company
-  if (!company) return null
-  if (typeof company === 'string') return company
-  const id = (company as { id?: unknown }).id
-  return typeof id === 'string' ? id : null
-}
-
-async function isOwnedEntityOfKind(
-  em: EntityManager,
-  entityId: string,
-  kind: 'company' | 'person',
-  scope: CustomerEntityScope,
 ): Promise<boolean> {
   const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
   const entity = await findOneWithDecryption(
     em,
     CustomerEntity,
     {
-      id: entityId,
+      id: customerEntityId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      kind,
+      kind: 'company',
       deletedAt: null,
     } as any,
     undefined,

package/src/modules/customer_accounts/lib/customerUrl.ts

@@ -5,8 +5,6 @@
 
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { Organization } from '@open-mercato/core/modules/directory/data/entities'
-import type { EntityManager } from '@mikro-orm/postgresql'
 
 type DomainMappingService = {
   resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>
@@ -16,10 +14,6 @@ type OrgService = {
   findById(orgId: string): Promise<{ id: string; slug: string | null } | null>
 }
 
-type EntityManagerResolver = {
-  resolve(name: 'em'): EntityManager
-}
-
 function platformBaseUrl(): string {
   const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()
   if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, '')
@@ -38,26 +32,6 @@ function resolveContainer(container?: AppContainer): Promise<AppContainer> {
   return createRequestContainer()
 }
 
-async function resolveOrgSlug(container: AppContainer, orgId: string): Promise<string | null> {
-  try {
-    const orgService = container.resolve('orgService') as OrgService | undefined
-    if (orgService && typeof orgService.findById === 'function') {
-      const org = await orgService.findById(orgId)
-      return org?.slug ?? null
-    }
-  } catch {
-    // orgService is optional in standalone/runtime contexts — fall through to EntityManager.
-  }
-
-  try {
-    const em = (container as AppContainer & EntityManagerResolver).resolve('em')
-    const org = await em.findOne(Organization, { id: orgId, deletedAt: null })
-    return org?.slug ?? null
-  } catch {
-    return null
-  }
-}
-
 export async function urlForCustomerOrg(
   orgId: string,
   path: string,
@@ -81,7 +55,17 @@ export async function urlForCustomerOrg(
     return `https://${active.hostname}${safePath}`
   }
 
-  const orgSlug = await resolveOrgSlug(container, orgId)
+  let orgSlug: string | null = null
+  try {
+    const orgService = container.resolve('orgService') as OrgService | undefined
+    if (orgService && typeof orgService.findById === 'function') {
+      const org = await orgService.findById(orgId)
+      orgSlug = org?.slug ?? null
+    }
+  } catch {
+    orgSlug = null
+  }
+
   const base = platformBaseUrl()
   if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`
   return `${base}${safePath}`