@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/src/modules/customers/search.ts

@@ -6,8 +6,6 @@ import type {
   SearchResultLink,
   SearchIndexSource,
 } from '@open-mercato/shared/modules/search'
-import type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CUSTOMER_INTERACTION_TASK_SOURCE, EXAMPLE_TODO_SOURCE } from './lib/interactionCompatibility'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -482,7 +480,6 @@ function ensureFallbackLines(lines: string[], record: Record<string, unknown>, o
 // =============================================================================
 
 function resolvePersonPresenter(
-  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -498,7 +495,7 @@ function resolvePersonPresenter(
     (nameParts.length ? nameParts : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    translate('customers.search.fallback.person', 'Person')
+    'Person'
   const subtitlePieces: string[] = []
   const jobTitle = record.job_title ?? record.jobTitle ?? customFields.job_title ?? customFields.jobTitle
   if (jobTitle) subtitlePieces.push(String(jobTitle))
@@ -518,14 +515,11 @@ function resolvePersonPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'user',
-    badge: pickValue(entity, 'display_name', 'displayName')
-      ? translate('customers.search.badge.person', 'Person')
-      : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName') ? 'Person' : undefined,
   }
 }
 
 function resolveCompanyPresenter(
-  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -543,7 +537,7 @@ function resolveCompanyPresenter(
     (entity?.id && entity?.display_name ? entity.display_name as string : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    translate('customers.search.fallback.company', 'Company')
+    'Company'
   const subtitlePieces: string[] = []
   const industry = record.industry
   if (industry) subtitlePieces.push(String(industry))
@@ -573,9 +567,7 @@ function resolveCompanyPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'building',
-    badge: pickValue(entity, 'display_name', 'displayName')
-      ? translate('customers.search.badge.company', 'Company')
-      : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName') ? 'Company' : undefined,
   }
 }
 
@@ -613,7 +605,6 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Preferred name', record.preferred_name ?? record.preferredName ?? ctx.customFields.preferred_name)
@@ -652,9 +643,9 @@ export const searchConfig: SearchModuleConfig = {
           })
         }
 
-        const presenter = resolvePersonPresenter(t, record, entity, ctx.customFields)
+        const presenter = resolvePersonPresenter(record, entity, ctx.customFields)
         logMissingPresenterTitle('person', record, entity, presenter)
-        const presenterLabel = pickLabel(presenter.title) ?? t('customers.search.link.openPerson', 'Open person')
+        const presenterLabel = pickLabel(presenter.title) ?? 'Open person'
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('person', entityId)
@@ -678,9 +669,8 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolvePersonPresenter(t, ctx.record, entity, ctx.customFields)
+        return resolvePersonPresenter(ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -689,12 +679,11 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
-        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('person', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -725,7 +714,6 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Legal name', record.legal_name ?? record.legalName ?? ctx.customFields.legal_name)
@@ -746,9 +734,9 @@ export const searchConfig: SearchModuleConfig = {
         ensureFallbackLines(lines, record)
         if (!lines.length) return null
 
-        const presenter = resolveCompanyPresenter(t, record, entity, ctx.customFields)
+        const presenter = resolveCompanyPresenter(record, entity, ctx.customFields)
         logMissingPresenterTitle('company', record, entity, presenter)
-        const primaryLabel = pickLabel(presenter.title) ?? t('customers.search.link.openCompany', 'Open company')
+        const primaryLabel = pickLabel(presenter.title) ?? 'Open company'
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('company', entityId)
@@ -772,9 +760,8 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolveCompanyPresenter(t, ctx.record, entity, ctx.customFields)
+        return resolveCompanyPresenter(ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -783,12 +770,11 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
-        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('company', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -846,9 +832,8 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
-        const title = (parent?.display_name as string | undefined) ?? t('customers.search.fallback.customerNote', 'Customer note')
+        const title = (parent?.display_name as string | undefined) ?? 'Customer note'
         return {
           title,
           subtitle: snippet(ctx.record.body),
@@ -865,16 +850,15 @@ export const searchConfig: SearchModuleConfig = {
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const parentUrl = buildCustomerUrl(parent?.kind as string ?? null, (parent?.id ?? ctx.record.entity_id ?? ctx.record.entityId) as string)
         if (parentUrl) {
-          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? t('customers.search.link.viewCustomer', 'View customer'), kind: 'primary' })
+          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? 'View customer', kind: 'primary' })
         }
         if (ctx.record.deal_id) {
           const dealUrl = `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`
-          links.push({ href: dealUrl, label: t('customers.search.link.openDeal', 'Open deal'), kind: 'secondary' })
+          links.push({ href: dealUrl, label: 'Open deal', kind: 'secondary' })
         }
         return links.length ? links : null
       },
@@ -896,7 +880,6 @@ export const searchConfig: SearchModuleConfig = {
       priority: 8,
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
-        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Title', record.title)
@@ -915,10 +898,10 @@ export const searchConfig: SearchModuleConfig = {
         return {
           text: lines,
           presenter: {
-            title: String(record.title ?? t('customers.search.fallback.deal', 'Deal')),
+            title: String(record.title ?? 'Deal'),
             subtitle: subtitleParts.join(' · ') || undefined,
             icon: 'briefcase',
-            badge: t('customers.search.badge.deal', 'Deal'),
+            badge: 'Deal',
           },
           checksumSource: {
             title: record.title,
@@ -930,9 +913,8 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
-        const { t } = await resolveTranslations()
         const { record } = ctx
-        const title = pickString(record.title as string, t('customers.search.fallback.deal', 'Deal'))
+        const title = pickString(record.title as string, 'Deal')
         const subtitleParts: string[] = []
         if (record.pipeline_stage) subtitleParts.push(String(record.pipeline_stage))
         if (record.status) subtitleParts.push(String(record.status))
@@ -943,10 +925,10 @@ export const searchConfig: SearchModuleConfig = {
         }
 
         return {
-          title: title ?? t('customers.search.fallback.deal', 'Deal'),
+          title: title ?? 'Deal',
           subtitle: subtitleParts.length ? subtitleParts.join(' · ') : undefined,
           icon: 'briefcase',
-          badge: t('customers.search.badge.deal', 'Deal'),
+          badge: 'Deal',
         }
       },
 
@@ -957,13 +939,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
-        const { t } = await resolveTranslations()
         const id = ctx.record.id
         if (!id) return null
         return [
           {
             href: `/backend/customers/deals/${encodeURIComponent(String(id))}/edit`,
-            label: t('customers.search.link.edit', 'Edit'),
+            label: 'Edit',
             kind: 'secondary',
           },
         ]
@@ -987,7 +968,6 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const lines: string[] = []
         if (parent?.display_name) lines.push(`Customer: ${parent.display_name}`)
@@ -996,11 +976,7 @@ export const searchConfig: SearchModuleConfig = {
         if (ctx.record.body) lines.push(`Body: ${ctx.record.body}`)
 
         const presenter: SearchResultPresenter = {
-          title: ctx.record.subject
-            ? String(ctx.record.subject)
-            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
-                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
-              }),
+          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
         }
@@ -1019,17 +995,12 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: ctx.record.subject
-            ? String(ctx.record.subject)
-            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
-                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
-              }),
+          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
-          badge: t('customers.search.badge.activity', 'Activity'),
+          badge: 'Activity',
         }
       },
 
@@ -1041,12 +1012,11 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
-        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         if (ctx.record.deal_id) {
           links.push({
             href: `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`,
-            label: t('customers.search.link.openDeal', 'Open deal'),
+            label: 'Open deal',
             kind: 'secondary',
           })
         }
@@ -1094,11 +1064,10 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
-        const { t } = await resolveTranslations()
         const todo = await getLinkedTodo(ctx) as Record<string, unknown> | null
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: (todo?.title as string | undefined) ?? t('customers.search.fallback.customerTask', 'Customer task'),
+          title: (todo?.title as string | undefined) ?? 'Customer task',
           subtitle: parent?.display_name as string | undefined,
           icon: 'check-square',
         }
@@ -1112,12 +1081,11 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
-        const { t } = await resolveTranslations()
         const todoId = ctx.record.todo_id ?? ctx.record.todoId
         if (!todoId) return null
         return [{
           href: `/backend/todos/${encodeURIComponent(todoId as string)}/edit`,
-          label: t('customers.search.link.openTodo', 'Open todo'),
+          label: 'Open todo',
           kind: 'secondary',
         }]
       },

package/src/modules/dashboards/api/layout/[itemId]/route.ts

@@ -4,6 +4,7 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'
 import { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -54,12 +55,8 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     organizationId: auth.orgId ?? null,
   }
 
-  const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
-    ['dashboards.configure'],
-    { tenantId: scope.tenantId, organizationId: scope.organizationId },
-  )
-  if (!canConfigure) {
+  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/layout/route.ts

@@ -6,7 +6,7 @@ import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/enti
 import { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -88,10 +88,7 @@ export async function GET(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
-    tenantId: scope.tenantId,
-    organizationId: scope.organizationId,
-  })
+  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
   const widgets = await loadAllWidgets()
   const allowedIds = await resolveAllowedWidgetIds(
     em,
@@ -99,8 +96,8 @@ export async function GET(req: Request) {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: effectiveFeatures,
-      isSuperAdmin: false,
+      features: acl.features ?? [],
+      isSuperAdmin: !!acl.isSuperAdmin,
     },
     widgets,
   )
@@ -150,9 +147,7 @@ export async function GET(req: Request) {
     await em.flush()
   }
 
-  const canConfigure = authorizeFeatures(['dashboards.configure'], {
-    grantedFeatures: effectiveFeatures,
-  })
+  const canConfigure = acl.isSuperAdmin || hasFeature(acl.features, 'dashboards.configure')
 
   let userEmail: string | null = null
   let userName: string | null = null
@@ -227,12 +222,8 @@ export async function PUT(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const canConfigure = await rbac.userHasAllFeatures(
-    scope.userId,
-    ['dashboards.configure'],
-    { tenantId: scope.tenantId, organizationId: scope.organizationId },
-  )
-  if (!canConfigure) {
+  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -252,18 +243,14 @@ export async function PUT(req: Request) {
   }
 
   const widgets = await loadAllWidgets()
-  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
-    tenantId: scope.tenantId,
-    organizationId: scope.organizationId,
-  })
   const allowedIds = await resolveAllowedWidgetIds(
     em,
     {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: effectiveFeatures,
-      isSuperAdmin: false,
+      features: acl.features ?? [],
+      isSuperAdmin: !!acl.isSuperAdmin,
     },
     widgets,
   )

package/src/modules/dashboards/api/roles/widgets/route.ts

@@ -10,7 +10,7 @@ import {
   resolveWidgetAssignmentReadScope,
   resolveWidgetAssignmentTargetAccess,
 } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -61,10 +61,7 @@ export async function GET(req: Request) {
   const em = container.resolve('em') as any
   const rbac = container.resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!authorizeFeatures([FEATURE], {
-    grantedFeatures: acl.features ?? [],
-    unrestricted: !!acl.isSuperAdmin,
-  })) {
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -123,10 +120,7 @@ export async function PUT(req: Request) {
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!authorizeFeatures([FEATURE], {
-    grantedFeatures: acl.features ?? [],
-    unrestricted: !!acl.isSuperAdmin,
-  })) {
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/users/widgets/route.ts

@@ -11,7 +11,7 @@ import {
   resolveWidgetAssignmentReadScope,
   resolveWidgetAssignmentTargetAccess,
 } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
-import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -44,10 +44,7 @@ export async function GET(req: Request) {
   const em = container.resolve('em') as any
   const rbac = container.resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!authorizeFeatures([FEATURE], {
-    grantedFeatures: acl.features ?? [],
-    unrestricted: !!acl.isSuperAdmin,
-  })) {
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -123,10 +120,7 @@ export async function PUT(req: Request) {
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!authorizeFeatures([FEATURE], {
-    grantedFeatures: acl.features ?? [],
-    unrestricted: !!acl.isSuperAdmin,
-  })) {
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/widgets/catalog.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
+import { hasFeature } from '@open-mercato/shared/security/features'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { dashboardsTag, dashboardsErrorSchema, dashboardWidgetCatalogSchema } from '../openapi'
 
@@ -15,12 +16,8 @@ export async function GET(req: Request) {
 
   const { resolve } = await createRequestContainer()
   const rbac = resolve('rbacService') as any
-  const canAssignWidgets = await rbac.userHasAllFeatures(
-    auth.sub,
-    ['dashboards.admin.assign-widgets'],
-    { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
-  )
-  if (!canAssignWidgets) {
+  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
+  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.admin.assign-widgets')) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/widgets/data/batch/route.ts

@@ -9,8 +9,6 @@ import {
   createWidgetDataService,
   type WidgetDataRequest,
   WidgetDataValidationError,
-  WidgetDataScanLimitError,
-  WidgetDataEncryptionUnavailableError,
 } from '../../../../services/widgetDataService'
 import { runWidgetDataBatch } from '../../../../lib/widgetDataBatch'
 import type { AnalyticsRegistry } from '../../../../services/analyticsRegistry'
@@ -18,7 +16,6 @@ import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib
 import { dashboardsTag, dashboardsErrorSchema } from '../../../openapi'
 import { widgetDataRequestSchema, widgetDataResponseSchema } from '../schema'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { resolveOptionalBaseCurrencyResolver } from '../../../../lib/optionalBaseCurrency'
 
 const logger = createLogger('dashboards').child({ component: 'widgets-data-batch' })
 
@@ -105,13 +102,7 @@ export async function POST(req: Request) {
   })()
 
   const cache = container.resolve<CacheStrategy>('cache')
-  const service = createWidgetDataService(
-    em,
-    { tenantId, organizationIds },
-    analyticsRegistry,
-    cache,
-    resolveOptionalBaseCurrencyResolver(container),
-  )
+  const service = createWidgetDataService(em, { tenantId, organizationIds }, analyticsRegistry, cache)
 
   const rbacService = container.resolve<{
     userHasAllFeatures: (
@@ -134,8 +125,6 @@ export async function POST(req: Request) {
       fetchOne: (request) => service.fetchWidgetData(request),
       describeError: (error) =>
         error instanceof WidgetDataValidationError
-        || error instanceof WidgetDataScanLimitError
-        || error instanceof WidgetDataEncryptionUnavailableError
           ? error.message
           : 'An error occurred while processing your request',
     })

package/src/modules/dashboards/api/widgets/data/route.ts

@@ -8,8 +8,6 @@ import {
   createWidgetDataService,
   type WidgetDataRequest,
   WidgetDataValidationError,
-  WidgetDataScanLimitError,
-  WidgetDataEncryptionUnavailableError,
 } from '../../../services/widgetDataService'
 import type { AnalyticsRegistry } from '../../../services/analyticsRegistry'
 import { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'
@@ -17,7 +15,6 @@ import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib
 import { dashboardsTag, dashboardsErrorSchema } from '../../openapi'
 import { widgetDataRequestSchema, widgetDataResponseSchema } from './schema'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { resolveOptionalBaseCurrencyResolver } from '../../../lib/optionalBaseCurrency'
 
 const logger = createLogger('dashboards').child({ component: 'widgets-data' })
 
@@ -124,13 +121,7 @@ export async function POST(req: Request) {
 
   try {
     const cache = container.resolve<CacheStrategy>('cache')
-    const service = createWidgetDataService(
-      em,
-      { tenantId, organizationIds },
-      analyticsRegistry,
-      cache,
-      resolveOptionalBaseCurrencyResolver(container),
-    )
+    const service = createWidgetDataService(em, { tenantId, organizationIds }, analyticsRegistry, cache)
     const result = await service.fetchWidgetData(requestData)
     return NextResponse.json(result)
   } catch (err) {
@@ -138,15 +129,6 @@ export async function POST(req: Request) {
     if (err instanceof WidgetDataValidationError) {
       return NextResponse.json({ error: err.message }, { status: 400 })
     }
-    // The dataset is too large to group in application code; surface why rather than a masked 500.
-    if (err instanceof WidgetDataScanLimitError) {
-      return NextResponse.json({ error: err.message }, { status: 422 })
-    }
-    // Encryption is configured but currently unresolvable. Refusing the request keeps ciphertext and
-    // silently-wrong buckets out of the response, and 503 tells the client it is worth retrying.
-    if (err instanceof WidgetDataEncryptionUnavailableError) {
-      return NextResponse.json({ error: err.message }, { status: 503 })
-    }
     return NextResponse.json(
       { error: 'An error occurred while processing your request' },
       { status: 500 },
@@ -174,18 +156,8 @@ const widgetDataPostDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },
     { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },
-    {
-      status: 422,
-      description: 'Too many rows to group an encrypted field in application code',
-      schema: dashboardsErrorSchema,
-    },
     { status: 403, description: 'Missing analytics.view feature', schema: dashboardsErrorSchema },
     { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },
-    {
-      status: 503,
-      description: 'Encryption is configured but the group source cannot currently be resolved',
-      schema: dashboardsErrorSchema,
-    },
   ],
 }