@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/src/modules/audit_logs/api/audit-logs/access/route.ts

@@ -6,7 +6,6 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { AccessLogService } from '@open-mercato/core/modules/audit_logs/services/accessLogService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { loadAuditLogDisplayMaps } from '../display'
-import { requireResolvedTenantScope } from '../readScope'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 
@@ -75,9 +74,6 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const tenantScopeGuard = requireResolvedTenantScope(auth)
-  if (tenantScopeGuard) return tenantScopeGuard
-
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
 
@@ -181,7 +177,6 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filters supplied', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
-        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/api/audit-logs/actions/export/route.ts

@@ -16,7 +16,6 @@ import {
 } from '@open-mercato/core/modules/audit_logs/lib/projections'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import { loadAuditLogDisplayMaps } from '../../display'
-import { requireResolvedTenantScope } from '../../readScope'
 
 export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['audit_logs.view_self'] },
@@ -113,9 +112,6 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const tenantScopeGuard = requireResolvedTenantScope(auth)
-  if (tenantScopeGuard) return tenantScopeGuard
-
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
   const rbac = container.resolve('rbacService') as RbacService
@@ -266,7 +262,6 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filter values', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
-        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/api/audit-logs/actions/route.ts

@@ -6,7 +6,6 @@ import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacS
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { loadAuditLogDisplayMaps } from '../display'
-import { requireResolvedTenantScope } from '../readScope'
 import { z } from 'zod'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
@@ -152,9 +151,6 @@ export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
 
-  const tenantScopeGuard = requireResolvedTenantScope(auth)
-  if (tenantScopeGuard) return tenantScopeGuard
-
   const container = await createRequestContainer()
   const { organizationId: defaultOrganizationId, scope } = await resolveFeatureCheckContext({ container, auth, request: req })
 
@@ -295,7 +291,6 @@ export const openApi: OpenApiRouteDoc = {
       errors: [
         { status: 400, description: 'Invalid filter values', schema: errorSchema },
         { status: 401, description: 'Authentication required', schema: errorSchema },
-        { status: 403, description: 'Caller has no resolved tenant scope and is not a superadmin', schema: errorSchema },
       ],
     },
   },

package/src/modules/audit_logs/components/AccessLogsTable.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/audit_logs/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
@@ -75,7 +74,7 @@ export function AccessLogsTable({ items, isLoading, actions, pagination }: { ite
       title={t('audit_logs.access.title')}
       data={accessItems}
       columns={columns}
-      perspective={{ tableId: extensionPoints.hosts.accessLogsTable.tableId }}
+      perspective={{ tableId: 'audit_logs.access.list' }}
       isLoading={Boolean(isLoading)}
       actions={actions}
       pagination={pagination}

package/src/modules/audit_logs/components/AuditLogsActions.tsx

@@ -1,7 +1,6 @@
 'use client'
 
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/audit_logs/extension-points'
 import type { ColumnDef } from '@tanstack/react-table'
 import { DataTable, type PaginationProps } from '@open-mercato/ui/backend/DataTable'
 import { Button } from '@open-mercato/ui/primitives/button'
@@ -246,7 +245,7 @@ export function AuditLogsActions({
         data={actionItems}
         columns={columns}
         actions={combinedActions}
-        perspective={{ tableId: extensionPoints.hosts.actionsTable.tableId }}
+        perspective={{ tableId: 'audit_logs.actions.list' }}
         isLoading={Boolean(isLoading) || Boolean(undoingToken) || Boolean(redoingId)}
         onRowClick={(item) => setSelected(item)}
         pagination={pagination}

package/src/modules/auth/AGENTS.md

@@ -6,7 +6,7 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
 
 1. Hash passwords with `bcryptjs` using cost >= 10.
 2. Use `findWithDecryption` / `findOneWithDecryption` for user queries.
-3. Use declarative `requireFeatures` in page/API metadata for access control; never add role-name guards such as `requireRoles: ['admin']`.
+3. Prefer `requireFeatures` in page/API metadata for access control.
 4. Declare every module feature in `acl.ts` and seed role grants through `setup.ts`.
 5. Use wildcard-aware helpers such as `matchFeature`, `hasFeature`, and `hasAllFeatures` when inspecting raw granted features.
 
@@ -20,7 +20,6 @@ The auth module handles authentication, authorization, users, roles, and RBAC.
 - Never log credentials, password reset tokens, session tokens, or decrypted user secrets.
 - Never reveal whether an email exists through auth error messages.
 - Never check raw ACL arrays with `includes(...)`, `Set.has(...)`, or ad hoc wildcard logic.
-- Never authorize a new page or API by mutable role name; declare a stable feature and gate with `requireFeatures`.
 
 ## Validation Commands
 
@@ -69,29 +68,26 @@ Features are string-based permissions: `<module>.<action>` (e.g., `users.view`,
 - Features are assigned to roles and users through ACLs
 - Pages/APIs use `requireFeatures` in metadata for access control
 - Server-side check: `rbacService.userHasAllFeatures(userId, features, { tenantId, organizationId })`
-- Wildcards are first-class stored grants, but server decisions MUST flow through `rbacService.userHasAllFeatures` or shared `authorizeFeatures`.
-- Nulled ACL overrides, disabled modules, and organization scope are evaluated before the super-admin bypass.
-- Use `rbacService.getEffectiveFeatures` for chrome/capability payloads; it expands wildcards to concrete active IDs.
-- Keep `matchFeature` / `hasFeature` / `hasAllFeatures` for browser checks over effective projections and isolated matching utilities, not server authorization.
+- Wildcards are first-class ACL grants: `module.*` and `*` must satisfy matching concrete features in every runtime check, not only in page/API guards.
+- When code inspects raw granted feature arrays instead of calling `rbacService`, MUST use shared helpers such as `matchFeature` / `hasFeature` / `hasAllFeatures` rather than `includes(...)`.
 
 ### Special Flags
 
-- `isSuperAdmin` — bypasses stored-grant matching, but not invalid scope, disabled modules, or nulled ACL features
+- `isSuperAdmin` — bypasses all feature checks (all features granted)
 - Organization visibility list — restricts which organizations a user can access
 
 ### Declarative Guards
 
-Use declarative feature guards in page/API metadata. API metadata is per HTTP method:
+Prefer declarative guards in page/API metadata:
 
 ```typescript
 export const metadata = {
-  GET: { requireAuth: true, requireFeatures: ['auth.users.list'] },
-  POST: { requireAuth: true, requireFeatures: ['auth.users.create'] },
+  requireAuth: true,
+  requireRoles: ['admin'],
+  requireFeatures: ['users.manage'],
 }
 ```
 
-For `page.meta.ts`, export the same `requireAuth: true` and `requireFeatures: [...]` fields at the page metadata top level. `requireRoles` remains a deprecated compatibility field for old registrations; never use it for new authorization.
-
 ## Key Directories
 
 | Directory | Purpose |

package/src/modules/auth/api/admin/nav.ts

@@ -5,7 +5,6 @@ import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getBackendRouteManifests } from '@open-mercato/shared/modules/registry'
-import { getModuleSurfaceFingerprint } from '@open-mercato/shared/lib/modules/surfaceFingerprint'
 import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { groupBackendRoutesByModule, resolveBackendChromePayload } from '../../lib/backendChrome'
 
@@ -13,13 +12,6 @@ export const metadata = {
   GET: { requireAuth: true },
 }
 
-// The fingerprint covers the module set, each module's declared features and
-// the serializable route manifest, so the TTL only has to bound what it cannot
-// see — chiefly a route `icon` swap, which serializes identically. Rebuilding
-// this payload is expensive (a `renderToStaticMarkup` per nav icon plus several
-// scoped queries), so the bound is generous rather than aggressive.
-const NAV_CACHE_TTL_MS = 30 * 60 * 1000
-
 const sidebarNavItemSchema: z.ZodType<{
   id?: string
   href: string
@@ -98,13 +90,6 @@ const adminNavResponseSchema = z.object({
   profilePathPrefixes: z.array(z.string()),
   grantedFeatures: z.array(z.string()),
   roles: z.array(z.string()),
-  // Present when a single organization is in scope; `null` under an all-organizations selection or
-  // when the lookup fails. Declared optional so the response contract stays additive for clients
-  // generated against an older schema.
-  currentOrganization: z.object({
-    id: z.string(),
-    name: z.string(),
-  }).nullable().optional(),
 })
 
 const adminNavErrorSchema = z.object({
@@ -119,7 +104,7 @@ export async function GET(req: Request) {
   const container = await createRequestContainer()
   const cache = container.resolve('cache') as {
     get?: (key: string) => Promise<unknown>
-    set?: (key: string, value: unknown, options?: { tags?: string[]; ttl?: number }) => Promise<void>
+    set?: (key: string, value: unknown, options?: { tags?: string[] }) => Promise<void>
   } | null
   let selectedOrganizationId: string | null | undefined
   let selectedTenantId: string | null | undefined
@@ -136,7 +121,6 @@ export async function GET(req: Request) {
 
   let cacheScopeTenantId = auth.tenantId ?? null
   let cacheScopeOrganizationId = auth.orgId ?? null
-  let cacheScopeSelectedOrganizationId = auth.orgId ?? null
   try {
     const { organizationId, scope } = await resolveFeatureCheckContext({
       container,
@@ -147,23 +131,15 @@ export async function GET(req: Request) {
     })
     cacheScopeOrganizationId = organizationId
     cacheScopeTenantId = scope.tenantId ?? auth.tenantId ?? null
-    cacheScopeSelectedOrganizationId = scope.selectedId ?? null
   } catch {
     cacheScopeOrganizationId = auth.orgId ?? null
     cacheScopeTenantId = auth.tenantId ?? null
-    cacheScopeSelectedOrganizationId = auth.orgId ?? null
     selectedOrganizationId = auth.orgId ?? null
     selectedTenantId = auth.tenantId ?? null
   }
 
-  // v6: the payload gained `currentOrganization`, and the payload also embeds the enabled-module set,
-  // its declared features, and the backend route manifest. The selection is part of the key because
-  // the resolved organization cannot distinguish "all organizations" from "my own organization";
-  // use the resolved selection so cookie-driven requests without an `orgId` query remain distinct.
-  // The fingerprint invalidates module-surface changes; the TTL bounds anything it cannot observe.
-  const cacheVersion = `v6:${getModuleSurfaceFingerprint()}`
-  const cacheSelection = cacheScopeSelectedOrganizationId ?? '__all__'
-  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${cacheSelection}`
+  const cacheVersion = 'v4'
+  const cacheKey = `nav:sidebar:${cacheVersion}:${locale}:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}`
   try {
     if (cache?.get) {
       const cached = await cache.get(cacheKey)
@@ -196,7 +172,7 @@ export async function GET(req: Request) {
         `nav:sidebar:scope:${auth.sub}:${cacheScopeTenantId || 'null'}:${cacheScopeOrganizationId || 'null'}:${locale}`,
         ...((Array.isArray(auth.roles) ? auth.roles : []).map((role) => `nav:sidebar:role:${role}`)),
       ].filter(Boolean) as string[]
-      await cache.set(cacheKey, payload, { tags, ttl: NAV_CACHE_TTL_MS })
+      await cache.set(cacheKey, payload, { tags })
     }
   } catch {
     // ignore cache write failures

package/src/modules/auth/api/profile/route.ts

@@ -18,7 +18,6 @@ const logger = createLogger('auth').child({ component: 'profile' })
 
 const profileResponseSchema = z.object({
   email: z.string().email(),
-  name: z.string().nullable().optional(),
   roles: z.array(z.string()),
 })
 
@@ -107,12 +106,7 @@ export async function GET(req: Request) {
     if (!user) {
       return NextResponse.json({ error: translate('auth.users.form.errors.notFound', 'User not found') }, { status: 404 })
     }
-    const displayName = typeof user.name === 'string' ? user.name.trim() : ''
-    return NextResponse.json({
-      email: String(user.email),
-      name: displayName.length > 0 ? displayName : null,
-      roles: auth.roles ?? [],
-    })
+    return NextResponse.json({ email: String(user.email), roles: auth.roles ?? [] })
   } catch (err) {
     logger.error('Profile load failed', { err })
     return NextResponse.json({ error: translate('auth.profile.form.errors.load', 'Failed to load profile.') }, { status: 400 })
@@ -213,7 +207,7 @@ export const openApi: OpenApiRouteDoc = {
   methods: {
     GET: {
       summary: 'Get current profile',
-      description: 'Returns the email address, display name, and roles for the signed-in user. The display name is null when unset.',
+      description: 'Returns the email address for the signed-in user.',
       responses: [
         { status: 200, description: 'Profile payload', schema: profileResponseSchema },
         { status: 401, description: 'Unauthorized', schema: z.object({ error: z.string() }) },

package/src/modules/auth/api/users/route.ts

@@ -23,7 +23,9 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
-import { findEntityIdsBySearchTokensCompat, type SearchTokenDatabase } from '@open-mercato/shared/lib/search/tokenLookup'
+import { resolveSearchConfig } from '@open-mercato/shared/lib/search/config'
+import { tokenizeText } from '@open-mercato/shared/lib/search/tokenize'
+import { sql } from 'kysely'
 import { normalizeDisplayNameInput } from '@open-mercato/core/modules/auth/lib/displayName'
 import {
   getSelectedTenantFromRequest,
@@ -502,13 +504,31 @@ async function findUserIdsBySearchTokens(
   tenantScope: string | null | undefined,
   field?: string,
 ): Promise<string[] | null> {
-  return findEntityIdsBySearchTokensCompat({
-    db: em.getKysely<SearchTokenDatabase>(),
-    entityType,
-    query: search,
-    fields: field ? [field] : undefined,
-    scope: { tenantId: tenantScope },
-  })
+  const trimmed = search.trim()
+  if (!trimmed) return null
+  const searchConfig = resolveSearchConfig()
+  if (!searchConfig.enabled) return []
+  const { hashes } = tokenizeText(trimmed, searchConfig)
+  if (!hashes.length) return []
+
+  const db = (em as any).getKysely() as any
+  let query = db
+    .selectFrom('search_tokens')
+    .select('entity_id')
+    .where('entity_type', '=', entityType)
+    .where('token_hash', 'in', hashes)
+    .groupBy('entity_id')
+    .having(sql<boolean>`count(distinct token_hash) >= ${hashes.length}`)
+  if (field) {
+    query = query.where('field', '=', field)
+  }
+  if (tenantScope !== undefined) {
+    query = query.where(sql<boolean>`tenant_id is not distinct from ${tenantScope}`)
+  }
+  const rows = (await query.execute()) as Array<{ entity_id?: unknown }>
+  return rows
+    .map((row) => (typeof row.entity_id === 'string' ? row.entity_id : null))
+    .filter((id): id is string => typeof id === 'string' && id.length > 0)
 }
 
 async function assertCanModifySuperAdminTarget(req: Request, targetUserId: string) {

package/src/modules/auth/backend/auth/profile/page.tsx

@@ -18,7 +18,6 @@ const logger = createLogger('auth').child({ component: 'profile-page' })
 
 type ProfileResponse = {
   email?: string | null
-  name?: string | null
 }
 
 type ProfileUpdateResponse = {

package/src/modules/auth/backend/profile/change-password/page.tsx

@@ -17,7 +17,6 @@ const logger = createLogger('auth').child({ component: 'change-password-page' })
 
 type ProfileResponse = {
   email?: string | null
-  name?: string | null
 }
 
 type ProfileUpdateResponse = {

package/src/modules/auth/backend/roles/page.tsx

@@ -1,6 +1,5 @@
 "use client"
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'
 import Link from 'next/link'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
 import { DataTable } from '@open-mercato/ui/backend/DataTable'
@@ -147,7 +146,7 @@ export default function RolesListPage() {
           sortable
           sorting={sorting}
           onSortingChange={setSorting}
-          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}
+          perspective={{ tableId: 'auth.roles.list' }}
           emptyState={(
             <ListEmptyState
               entityName={t('auth.roles.list.title', 'Roles')}

package/src/modules/auth/backend/settings/page.tsx

@@ -1,21 +1,12 @@
 'use client'
-import { useT } from '@open-mercato/shared/lib/i18n/context'
-import { Page, PageBody, PageHeader } from '@open-mercato/ui/backend/Page'
+import { useEffect } from 'react'
+import { useRouter } from 'next/navigation'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
 
 export default function SettingsPage() {
-  const t = useT()
-
-  return (
-    <Page>
-      <PageHeader
-        title={t('settings.page.title', 'Settings')}
-        description={t('settings.page.description', 'System configuration and administration')}
-      />
-      <PageBody>
-        <p className="text-sm text-muted-foreground">
-          {t('settings.page.selectItem', 'Select an item from the menu to configure system settings.')}
-        </p>
-      </PageBody>
-    </Page>
-  )
+  const router = useRouter()
+  useEffect(() => {
+    router.replace('/backend/config/system-status')
+  }, [router])
+  return <Spinner className="h-4 w-4" />
 }

package/src/modules/auth/backend/users/page.tsx

@@ -1,6 +1,5 @@
 "use client"
 import * as React from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'
 import Link from 'next/link'
 import { useSearchParams } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -429,7 +428,7 @@ export default function UsersListPage() {
           sortable
           sorting={sorting}
           onSortingChange={setSorting}
-          perspective={{ tableId: extensionPoints.hosts.usersTable.tableId }}
+          perspective={{ tableId: 'auth.users.list' }}
           emptyState={(
             <ListEmptyState
               entityName={t('auth.users.list.title', 'Users')}

package/src/modules/auth/cli.ts

@@ -397,7 +397,7 @@ const addOrganization: ModuleCli = {
     // Create tenant implicitly for simplicity
     const tenant = em.create(Tenant, { name: `${name} Tenant` })
     await em.persist(tenant).flush()
-    const org = em.create(Organization, { name, tenant, logoPreserveAspectRatio: false })
+    const org = em.create(Organization, { name, tenant })
     await em.persist(org).flush()
     await rebuildHierarchyForTenant(em, String(tenant.id))
     console.log('Organization created with id', org.id, 'in tenant', tenant.id)

package/src/modules/auth/components/UserConsentsPanel.tsx

@@ -65,7 +65,7 @@ export function UserConsentsPanel({ userId }: UserConsentsPanelProps) {
   }
 
   if (error) {
-    return <p className="text-sm text-status-error-text">{error}</p>
+    return <p className="text-sm text-red-600">{error}</p>
   }
 
   if (consents.length === 0) {
@@ -86,15 +86,15 @@ export function UserConsentsPanel({ userId }: UserConsentsPanelProps) {
             <span className="flex items-center gap-1.5">
               {consent.isGranted ? (
                 <>
-                  <ShieldCheck className="size-4 text-status-success-icon" />
-                  <span className="text-status-success-text font-medium">
+                  <ShieldCheck className="size-4 text-emerald-600" />
+                  <span className="text-emerald-700 font-medium">
                     {t('auth.users.consents.granted', 'Granted')}
                   </span>
                 </>
               ) : (
                 <>
-                  <ShieldX className="size-4 text-status-error-icon" />
-                  <span className="text-status-error-text font-medium">
+                  <ShieldX className="size-4 text-red-500" />
+                  <span className="text-red-600 font-medium">
                     {t('auth.users.consents.withdrawn', 'Withdrawn')}
                   </span>
                 </>
@@ -118,13 +118,13 @@ export function UserConsentsPanel({ userId }: UserConsentsPanelProps) {
             <dd className="flex items-center gap-1">
               {consent.integrityValid ? (
                 <>
-                  <ShieldCheck className="size-3 text-status-success-icon" />
-                  <span className="text-status-success-text">{t('auth.users.consents.integrityValid', 'Valid')}</span>
+                  <ShieldCheck className="size-3 text-emerald-600" />
+                  <span className="text-emerald-700">{t('auth.users.consents.integrityValid', 'Valid')}</span>
                 </>
               ) : (
                 <>
-                  <ShieldAlert className="size-3 text-status-warning-icon" />
-                  <span className="text-status-warning-text">{t('auth.users.consents.integrityInvalid', 'Tampered or missing')}</span>
+                  <ShieldAlert className="size-3 text-amber-500" />
+                  <span className="text-amber-600">{t('auth.users.consents.integrityInvalid', 'Tampered or missing')}</span>
                 </>
               )}
             </dd>

package/src/modules/auth/frontend/login.tsx

@@ -1,6 +1,5 @@
 "use client"
 import { useCallback, useEffect, useMemo, useState } from 'react'
-import { extensionPoints } from '@open-mercato/core/modules/auth/extension-points'
 import type { ReactNode } from 'react'
 import Image from 'next/image'
 import Link from 'next/link'
@@ -15,7 +14,6 @@ import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { translateWithFallback } from '@open-mercato/shared/lib/i18n/translate'
 import { clearAllOperations } from '@open-mercato/ui/backend/operations/store'
 import { notifyAuthIdentityChange } from '@open-mercato/ui/backend/AuthSessionGuard'
-import { clearAllPerspectiveState } from '@open-mercato/ui/backend/DataTable'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import { X } from 'lucide-react'
 import { Alert, AlertDescription } from '@open-mercato/ui/primitives/alert'
@@ -139,7 +137,10 @@ export default function LoginPage() {
           method: 'POST',
           headers: {
             'content-type': 'application/json',
+            // Probing for an already-active session: a 401 is the expected answer
+            // for an anonymous visitor, never a session that just expired.
             'x-om-unauthorized-redirect': '0',
+            'x-om-forbidden-redirect': '0',
           },
           body: JSON.stringify({ features: [] }),
           cache: 'no-store',
@@ -265,7 +266,6 @@ export default function LoginPage() {
       const res = await fetch('/api/auth/login', { method: 'POST', body: form })
       if (res.redirected) {
         clearAllOperations()
-        clearAllPerspectiveState()
         notifyAuthIdentityChange()
         // NextResponse.redirect from API
         router.replace(res.url)
@@ -320,7 +320,6 @@ export default function LoginPage() {
       const data = await res.json().catch(() => null) as LoginResponseEventDetail
       emitLoginResponseEvent(data)
       clearAllOperations()
-      clearAllPerspectiveState()
       notifyAuthIdentityChange()
       if (data && typeof data.redirect === 'string' && data.redirect.length > 0) {
         router.replace(data.redirect)
@@ -430,7 +429,7 @@ export default function LoginPage() {
                 />
               </div>
               <InjectionSpot<LoginFormWidgetContext>
-                spotId={extensionPoints.hosts.loginForm.spotId}
+                spotId="auth.login:form"
                 context={loginFormContext}
               />
               {authOverride?.hidePassword ? null : (

package/src/modules/auth/frontend/reset.tsx

@@ -56,11 +56,11 @@ export default function ResetPage() {
             </div>
           ) : (
             <form className="grid gap-3" onSubmit={onSubmit} noValidate>
-              {error && <div className="text-sm text-status-error-text">{error}</div>}
+              {error && <div className="text-sm text-red-600">{error}</div>}
               <div className="grid gap-1">
                 <Label htmlFor="email">{t('auth.email')}</Label>
                 <EmailInput id="email" name="email" required aria-invalid={!!fieldError} aria-describedby={fieldError ? 'email-error' : undefined} />
-                {fieldError && <p id="email-error" className="text-sm text-status-error-text">{fieldError}</p>}
+                {fieldError && <p id="email-error" className="text-sm text-red-600">{fieldError}</p>}
               </div>
               <Button type="submit" className="mt-2 w-full" disabled={submitting}>
                 {submitting ? '...' : t('auth.sendResetLink')}

package/src/modules/auth/i18n/de.json

@@ -128,7 +128,6 @@
   "auth.roles.form.group.details": "Details",
   "auth.roles.form.group.widgets": "Dashboard-Widgets",
   "auth.roles.form.loading": "Daten werden geladen...",
-  "auth.roles.form.tenantReassignWarning": "Diese Rolle wird einem anderen Mandanten zugewiesen. Die hier ausgewählten Berechtigungen werden beim Absenden unter dem neuen Mandanten gespeichert.",
   "auth.roles.form.title.create": "Rolle erstellen",
   "auth.roles.form.title.edit": "Rolle bearbeiten",
   "auth.roles.list.actions.create": "Erstellen",

package/src/modules/auth/i18n/en.json

@@ -128,7 +128,6 @@
   "auth.roles.form.group.details": "Details",
   "auth.roles.form.group.widgets": "Dashboard Widgets",
   "auth.roles.form.loading": "Loading data...",
-  "auth.roles.form.tenantReassignWarning": "This role is being reassigned to a different tenant. The permissions selected here will be saved under the new tenant when you submit.",
   "auth.roles.form.title.create": "Create Role",
   "auth.roles.form.title.edit": "Edit Role",
   "auth.roles.list.actions.create": "Create",

package/src/modules/auth/i18n/es.json

@@ -128,7 +128,6 @@
   "auth.roles.form.group.details": "Detalles",
   "auth.roles.form.group.widgets": "Widgets del panel",
   "auth.roles.form.loading": "Cargando datos...",
-  "auth.roles.form.tenantReassignWarning": "Este rol se está reasignando a otro inquilino. Los permisos seleccionados aquí se guardarán bajo el nuevo inquilino al enviar.",
   "auth.roles.form.title.create": "Crear rol",
   "auth.roles.form.title.edit": "Editar rol",
   "auth.roles.list.actions.create": "Crear",

package/src/modules/auth/i18n/pl.json

@@ -128,7 +128,6 @@
   "auth.roles.form.group.details": "Szczegóły",
   "auth.roles.form.group.widgets": "Widżety pulpitu",
   "auth.roles.form.loading": "Ładowanie danych...",
-  "auth.roles.form.tenantReassignWarning": "Ta rola jest przypisywana do innego najemcy. Wybrane tutaj uprawnienia zostaną zapisane pod nowym najemcą po zatwierdzeniu.",
   "auth.roles.form.title.create": "Utwórz rolę",
   "auth.roles.form.title.edit": "Edytuj rolę",
   "auth.roles.list.actions.create": "Utwórz",