@open-mercato/core 0.6.7-develop.6863.1.61001cf9a8 → 0.6.7

package/src/modules/attachments/lib/quota-service.ts

@@ -1,442 +0,0 @@
-import { randomUUID } from 'node:crypto'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { sql } from 'kysely'
-import { AttachmentQuotaReservation } from '../data/entities'
-import { resolveAttachmentTenantQuotaBytes } from './upload-limits'
-
-const DEFAULT_RESERVATION_TTL_MS = 15 * 60 * 1000
-
-export type AttachmentQuotaSource =
-  | 'attachment'
-  | 'storage_s3_upload'
-  | 'storage_s3_signed'
-  | 'storage_service'
-
-export type AttachmentQuotaReservationHandle = {
-  id: string
-  leaseToken: string
-  expiresAt: Date
-}
-
-export type AttachmentQuotaReservationRecord = {
-  id: string
-  tenantId: string
-  organizationId: string
-  reservedBytes: number
-  actualBytes: number | null
-  status: 'reserved' | 'storing' | 'stored' | 'recovering' | 'committed'
-  source: AttachmentQuotaSource
-  storageDriver: string
-  partitionCode: string | null
-  storagePath: string
-  leaseToken: string
-  uploadTokenHash: string | null
-  expiresAt: Date | null
-}
-
-type AttachmentQuotaReservationRow = {
-  id: string
-  tenant_id: string
-  organization_id: string
-  reserved_bytes: unknown
-  actual_bytes: unknown | null
-  status: AttachmentQuotaReservationRecord['status']
-  source: AttachmentQuotaSource
-  storage_driver: string
-  partition_code: string | null
-  storage_path: string
-  lease_token: string
-  upload_token_hash: string | null
-  expires_at: Date | string | null
-  created_at: Date
-  updated_at: Date
-}
-
-type AttachmentUsageRow = {
-  id: string
-  tenant_id: string
-  storage_driver: string
-  storage_path: string
-  file_size: unknown
-}
-
-type AttachmentQuotaDatabase = {
-  attachments: AttachmentUsageRow
-  attachment_quota_reservations: AttachmentQuotaReservationRow
-}
-
-export class AttachmentQuotaError extends Error {
-  constructor(
-    public readonly code:
-      | 'quota_exceeded'
-      | 'quota_accounting_unavailable'
-      | 'quota_target_exists'
-      | 'quota_lease_lost',
-    message: string,
-  ) {
-    super(message)
-    this.name = 'AttachmentQuotaError'
-  }
-}
-
-function parseUsage(value: unknown): number {
-  if (typeof value === 'number' && Number.isFinite(value) && value >= 0) return value
-  if (typeof value === 'string' && value.trim() !== '') {
-    const parsed = Number(value)
-    if (Number.isFinite(parsed) && parsed >= 0) return parsed
-  }
-  throw new AttachmentQuotaError('quota_accounting_unavailable', 'Storage quota accounting returned an invalid value.')
-}
-
-function isUniqueViolation(error: unknown): boolean {
-  return Boolean(error && typeof error === 'object' && 'code' in error && error.code === '23505')
-}
-
-function changedRow(result: unknown): boolean {
-  if (Array.isArray(result)) return result.length > 0
-  if (!result || typeof result !== 'object') return false
-  if ('id' in result) return true
-  if ('numUpdatedRows' in result) return Number((result as { numUpdatedRows?: unknown }).numUpdatedRows ?? 0) > 0
-  if ('numDeletedRows' in result) return Number((result as { numDeletedRows?: unknown }).numDeletedRows ?? 0) > 0
-  return false
-}
-
-function mapReservationRow(row: AttachmentQuotaReservationRow): AttachmentQuotaReservationRecord {
-  return {
-    id: String(row.id),
-    tenantId: String(row.tenant_id),
-    organizationId: String(row.organization_id),
-    reservedBytes: parseUsage(row.reserved_bytes),
-    actualBytes: row.actual_bytes == null ? null : parseUsage(row.actual_bytes),
-    status: row.status,
-    source: row.source,
-    storageDriver: String(row.storage_driver),
-    partitionCode: row.partition_code == null ? null : String(row.partition_code),
-    storagePath: String(row.storage_path),
-    leaseToken: String(row.lease_token),
-    uploadTokenHash: row.upload_token_hash == null ? null : String(row.upload_token_hash),
-    expiresAt: row.expires_at == null ? null : new Date(row.expires_at),
-  }
-}
-
-export class AttachmentQuotaService {
-  constructor(private readonly em: EntityManager) {}
-
-  async reserve(input: {
-    tenantId: string
-    organizationId: string
-    bytes: number
-    source: AttachmentQuotaSource
-    storageDriver: string
-    storagePath: string
-    partitionCode?: string | null
-    uploadTokenHash?: string | null
-    ttlMs?: number
-  }): Promise<AttachmentQuotaReservationHandle> {
-    if (!Number.isSafeInteger(input.bytes) || input.bytes < 0) {
-      throw new AttachmentQuotaError('quota_accounting_unavailable', 'Reservation bytes must be a non-negative safe integer.')
-    }
-    const id = randomUUID()
-    const leaseToken = randomUUID()
-    const expiresAt = new Date(Date.now() + Math.max(1_000, input.ttlMs ?? DEFAULT_RESERVATION_TTL_MS))
-
-    try {
-      await this.em.transactional(async (tx) => {
-        const db = tx.getKysely<AttachmentQuotaDatabase>()
-        await sql`select pg_advisory_xact_lock(hashtextextended(${`attachment-quota:${input.tenantId}`}, 0))`.execute(db)
-
-        const attachmentUsage = await db
-          .selectFrom('attachments')
-          .select(sql<string>`coalesce(sum(file_size), 0)`.as('total_size'))
-          .where('tenant_id', '=', input.tenantId)
-          .executeTakeFirst()
-        const ledgerUsage = await db
-          .selectFrom('attachment_quota_reservations')
-          .select(
-            sql<string>`coalesce(sum(case when status = 'committed' then actual_bytes else reserved_bytes end), 0)`.as('total_size'),
-          )
-          .where('tenant_id', '=', input.tenantId)
-          .executeTakeFirst()
-
-        const usedBytes = parseUsage(attachmentUsage?.total_size) + parseUsage(ledgerUsage?.total_size)
-        if (usedBytes + input.bytes > resolveAttachmentTenantQuotaBytes()) {
-          throw new AttachmentQuotaError('quota_exceeded', 'Attachment storage quota exceeded for this tenant.')
-        }
-
-        const reservation = tx.create(AttachmentQuotaReservation, {
-          id,
-          tenantId: input.tenantId,
-          organizationId: input.organizationId,
-          reservedBytes: input.bytes,
-          actualBytes: null,
-          status: 'reserved',
-          source: input.source,
-          storageDriver: input.storageDriver,
-          partitionCode: input.partitionCode ?? null,
-          storagePath: input.storagePath,
-          leaseToken,
-          uploadTokenHash: input.uploadTokenHash ?? null,
-          expiresAt,
-        })
-        await tx.persist(reservation).flush()
-      })
-    } catch (error) {
-      if (error instanceof AttachmentQuotaError) throw error
-      if (isUniqueViolation(error)) {
-        throw new AttachmentQuotaError('quota_target_exists', 'The target storage path already has an active allocation.')
-      }
-      throw new AttachmentQuotaError('quota_accounting_unavailable', 'Storage quota accounting is unavailable.')
-    }
-
-    return { id, leaseToken, expiresAt }
-  }
-
-  async beginStorage(id: string, leaseToken: string, ttlMs = DEFAULT_RESERVATION_TTL_MS): Promise<void> {
-    await this.transition(id, leaseToken, 'reserved', 'storing', {
-      expires_at: new Date(Date.now() + Math.max(1_000, ttlMs)),
-    })
-  }
-
-  async markStored(id: string, leaseToken: string): Promise<void> {
-    await this.transition(id, leaseToken, 'storing', 'stored')
-  }
-
-  async completeAttachment(id: string, leaseToken: string, manager: EntityManager = this.em): Promise<void> {
-    const db = manager.getKysely<AttachmentQuotaDatabase>()
-    const result = await db
-      .deleteFrom('attachment_quota_reservations')
-      .where('id', '=', id)
-      .where('lease_token', '=', leaseToken)
-      .where('status', '=', 'stored')
-      .returning('id')
-      .executeTakeFirst()
-    if (!changedRow(result)) throw new AttachmentQuotaError('quota_lease_lost', 'The upload reservation lease was lost.')
-  }
-
-  async completeStandalone(id: string, leaseToken: string, actualBytes: number): Promise<void> {
-    if (!Number.isSafeInteger(actualBytes) || actualBytes < 0) {
-      throw new AttachmentQuotaError('quota_accounting_unavailable', 'Actual bytes must be a non-negative safe integer.')
-    }
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const result = await db
-      .updateTable('attachment_quota_reservations')
-      .set({ status: 'committed', actual_bytes: actualBytes, expires_at: null, upload_token_hash: null, updated_at: new Date() })
-      .where('id', '=', id)
-      .where('lease_token', '=', leaseToken)
-      .where('status', '=', 'stored')
-      .where('reserved_bytes', '>=', actualBytes)
-      .returning('id')
-      .executeTakeFirst()
-    if (!changedRow(result)) throw new AttachmentQuotaError('quota_lease_lost', 'The upload reservation lease was lost.')
-  }
-
-  async release(id: string, leaseToken?: string): Promise<void> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    let query = db
-      .deleteFrom('attachment_quota_reservations')
-      .where('id', '=', id)
-      .where('status', '!=', 'committed')
-    if (leaseToken) query = query.where('lease_token', '=', leaseToken)
-    await query.execute()
-  }
-
-  async releaseCommittedByPath(input: {
-    tenantId: string
-    storageDriver: string
-    storagePath: string
-  }): Promise<void> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    await db
-      .deleteFrom('attachment_quota_reservations')
-      .where('tenant_id', '=', input.tenantId)
-      .where('storage_driver', '=', input.storageDriver)
-      .where('storage_path', '=', input.storagePath)
-      .where('status', '=', 'committed')
-      .execute()
-  }
-
-  async findPendingByUploadTokenHash(uploadTokenHash: string): Promise<AttachmentQuotaReservationRecord | null> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const row = await db
-      .selectFrom('attachment_quota_reservations')
-      .selectAll()
-      .where('upload_token_hash', '=', uploadTokenHash)
-      .where('status', '=', 'reserved')
-      .where('expires_at', '>', new Date())
-      .executeTakeFirst()
-    if (!row) return null
-    return mapReservationRow(row)
-  }
-
-  async claimPendingByUploadTokenHash(
-    uploadTokenHash: string,
-    ttlMs = DEFAULT_RESERVATION_TTL_MS,
-  ): Promise<AttachmentQuotaReservationRecord | null> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const leaseToken = randomUUID()
-    const row = await db
-      .updateTable('attachment_quota_reservations')
-      .set({
-        status: 'storing',
-        lease_token: leaseToken,
-        expires_at: new Date(Date.now() + Math.max(1_000, ttlMs)),
-        updated_at: new Date(),
-      })
-      .where('upload_token_hash', '=', uploadTokenHash)
-      .where('status', '=', 'reserved')
-      .where('expires_at', '>', new Date())
-      .returningAll()
-      .executeTakeFirst()
-    return row ? mapReservationRow(row) : null
-  }
-
-  async getReservation(
-    id: string,
-    scope: { tenantId: string; organizationId: string },
-  ): Promise<AttachmentQuotaReservationRecord | null> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const row = await db
-      .selectFrom('attachment_quota_reservations')
-      .selectAll()
-      .where('id', '=', id)
-      .where('tenant_id', '=', scope.tenantId)
-      .where('organization_id', '=', scope.organizationId)
-      .executeTakeFirst()
-    return row ? mapReservationRow(row) : null
-  }
-
-  async claimExpired(
-    id: string,
-    scope: { tenantId: string; organizationId: string },
-    recoveryTtlMs = DEFAULT_RESERVATION_TTL_MS,
-  ): Promise<AttachmentQuotaReservationRecord | null> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const leaseToken = randomUUID()
-    const row = await db
-      .updateTable('attachment_quota_reservations')
-      .set({
-        status: 'recovering',
-        lease_token: leaseToken,
-        expires_at: new Date(Date.now() + Math.max(1_000, recoveryTtlMs)),
-        updated_at: new Date(),
-      })
-      .where('id', '=', id)
-      .where('tenant_id', '=', scope.tenantId)
-      .where('organization_id', '=', scope.organizationId)
-      .where('status', 'in', ['reserved', 'storing', 'stored', 'recovering'])
-      .where('expires_at', '<=', new Date())
-      .returningAll()
-      .executeTakeFirst()
-    return row ? mapReservationRow(row) : null
-  }
-
-  async commitRecoveredStandalone(id: string, leaseToken: string, actualBytes: number): Promise<void> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const result = await db
-      .updateTable('attachment_quota_reservations')
-      .set({ status: 'committed', actual_bytes: actualBytes, expires_at: null, upload_token_hash: null, updated_at: new Date() })
-      .where('id', '=', id)
-      .where('lease_token', '=', leaseToken)
-      .where('status', '=', 'recovering')
-      .where('reserved_bytes', '>=', actualBytes)
-      .returning('id')
-      .executeTakeFirst()
-    if (!changedRow(result)) throw new AttachmentQuotaError('quota_lease_lost', 'The recovery reservation lease was lost.')
-  }
-
-  async reconcileStandaloneObjects(input: {
-    tenantId: string
-    organizationId: string
-    storageDriver: string
-    objects: Array<{ path: string; bytes: number }>
-  }): Promise<void> {
-    const uniqueObjects = Array.from(new Map(input.objects.map((object) => [object.path, object])).values())
-    for (const object of uniqueObjects) {
-      if (!Number.isSafeInteger(object.bytes) || object.bytes < 0) {
-        throw new AttachmentQuotaError('quota_accounting_unavailable', 'Standalone storage accounting returned an invalid size.')
-      }
-    }
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    for (let offset = 0; offset < uniqueObjects.length; offset += 500) {
-      const batch = uniqueObjects.slice(offset, offset + 500)
-      const paths = batch.map((object) => object.path)
-      if (paths.length === 0) continue
-
-      const attachmentRows = await db
-        .selectFrom('attachments')
-        .select('storage_path')
-        .where('tenant_id', '=', input.tenantId)
-        .where('storage_driver', '=', input.storageDriver)
-        .where('storage_path', 'in', paths)
-        .execute()
-      const attachmentPaths = new Set(attachmentRows.map((row) => String(row.storage_path)))
-
-      const ledgerRows = await db
-        .selectFrom('attachment_quota_reservations')
-        .select(['storage_path', 'status'])
-        .where('tenant_id', '=', input.tenantId)
-        .where('storage_driver', '=', input.storageDriver)
-        .where('storage_path', 'in', paths)
-        .execute()
-      const ledgerPaths = new Set(ledgerRows.map((row) => String(row.storage_path)))
-
-      const doubleCountedPaths = ledgerRows
-        .filter((row) => row.status === 'committed' && attachmentPaths.has(String(row.storage_path)))
-        .map((row) => String(row.storage_path))
-      if (doubleCountedPaths.length > 0) {
-        await db
-          .deleteFrom('attachment_quota_reservations')
-          .where('tenant_id', '=', input.tenantId)
-          .where('storage_driver', '=', input.storageDriver)
-          .where('storage_path', 'in', doubleCountedPaths)
-          .where('status', '=', 'committed')
-          .execute()
-      }
-
-      for (const object of batch) {
-        if (attachmentPaths.has(object.path) || ledgerPaths.has(object.path)) continue
-        await sql`
-          insert into attachment_quota_reservations (
-            id, tenant_id, organization_id, reserved_bytes, actual_bytes, status, source,
-            storage_driver, partition_code, storage_path, lease_token, upload_token_hash,
-            expires_at, created_at, updated_at
-          )
-          select ${randomUUID()}::uuid, ${input.tenantId}::uuid, ${input.organizationId}::uuid,
-            ${object.bytes}::bigint, ${object.bytes}::bigint, 'committed', 'storage_s3_upload',
-            ${input.storageDriver}, null, ${object.path}, ${randomUUID()}::uuid, null,
-            null, now(), now()
-          where not exists (
-            select 1 from attachments
-            where tenant_id = ${input.tenantId}::uuid
-              and storage_driver = ${input.storageDriver}
-              and storage_path = ${object.path}
-          )
-          on conflict (tenant_id, storage_driver, storage_path) do nothing
-        `.execute(db)
-      }
-    }
-  }
-
-  private async transition(
-    id: string,
-    leaseToken: string,
-    from: AttachmentQuotaReservationRecord['status'],
-    to: AttachmentQuotaReservationRecord['status'],
-    extra: Record<string, unknown> = {},
-  ): Promise<void> {
-    const db = this.em.getKysely<AttachmentQuotaDatabase>()
-    const result = await db
-      .updateTable('attachment_quota_reservations')
-      .set({ status: to, updated_at: new Date(), ...extra })
-      .where('id', '=', id)
-      .where('lease_token', '=', leaseToken)
-      .where('status', '=', from)
-      .returning('id')
-      .executeTakeFirst()
-    if (!changedRow(result)) throw new AttachmentQuotaError('quota_lease_lost', 'The upload reservation lease was lost.')
-  }
-}
-
-export function createAttachmentQuotaService(em: EntityManager): AttachmentQuotaService {
-  return new AttachmentQuotaService(em)
-}

package/src/modules/attachments/migrations/Migration20260709234741_attachments.ts

@@ -1,12 +0,0 @@
-import { Migration } from '@mikro-orm/migrations';
-
-export class Migration20260709234741_attachments extends Migration {
-
-  override up(): void | Promise<void> {
-    this.addSql(`create table "attachment_quota_reservations" ("id" uuid not null, "tenant_id" uuid not null, "organization_id" uuid not null, "reserved_bytes" bigint not null, "actual_bytes" bigint null, "status" text not null default 'reserved', "source" text not null, "storage_driver" text not null, "partition_code" text null, "storage_path" text not null, "lease_token" uuid not null, "upload_token_hash" text null, "expires_at" timestamptz null, "created_at" timestamptz not null, "updated_at" timestamptz not null, primary key ("id"));`);
-    this.addSql(`create index "attachment_quota_reservations_expires_idx" on "attachment_quota_reservations" ("expires_at");`);
-    this.addSql(`create index "attachment_quota_reservations_tenant_status_idx" on "attachment_quota_reservations" ("tenant_id", "status");`);
-    this.addSql(`alter table "attachment_quota_reservations" add constraint "attachment_quota_reservations_scope_path_unique" unique ("tenant_id", "storage_driver", "storage_path");`);
-  }
-
-}

package/src/modules/attachments/workers/quota-recovery.ts

@@ -1,68 +0,0 @@
-import type { JobContext, QueuedJob, WorkerMeta } from '@open-mercato/queue'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { AttachmentQuotaService } from '../lib/quota-service'
-import type { StorageDriverFactory } from '../lib/drivers'
-import { scheduleAttachmentQuotaRecovery, type AttachmentQuotaRecoveryJob } from '../lib/quota-recovery-queue'
-
-export const metadata: WorkerMeta = {
-  queue: 'attachments-quota-recovery',
-  id: 'attachments:quota-recovery',
-  concurrency: 2,
-}
-
-type HandlerContext = JobContext & { resolve: <T = unknown>(name: string) => T }
-
-type AttachmentLookupDatabase = {
-  attachments: {
-    id: string
-    tenant_id: string
-    storage_driver: string
-    storage_path: string
-  }
-}
-
-export default async function handle(
-  job: QueuedJob<AttachmentQuotaRecoveryJob>,
-  ctx: HandlerContext,
-): Promise<void> {
-  const quotaService = ctx.resolve<AttachmentQuotaService>('attachmentQuotaService')
-  const scope = {
-    tenantId: job.payload.tenantId,
-    organizationId: job.payload.organizationId,
-  }
-  const record = await quotaService.getReservation(job.payload.reservationId, scope)
-  if (!record || record.status === 'committed') return
-  if (record.expiresAt && record.expiresAt.getTime() > Date.now()) {
-    await scheduleAttachmentQuotaRecovery(job.payload, record.expiresAt.getTime() - Date.now())
-    return
-  }
-
-  const claimed = await quotaService.claimExpired(record.id, scope)
-  if (!claimed) return
-  try {
-    const em = ctx.resolve<EntityManager>('em')
-    const existingAttachment = await em.getKysely<AttachmentLookupDatabase>()
-      .selectFrom('attachments')
-      .select('id')
-      .where('tenant_id', '=', claimed.tenantId)
-      .where('storage_driver', '=', claimed.storageDriver)
-      .where('storage_path', '=', claimed.storagePath)
-      .executeTakeFirst()
-    if (!existingAttachment) {
-      if (!claimed.partitionCode) throw new Error('Attachment quota recovery is missing its partition code.')
-      const factory = ctx.resolve<StorageDriverFactory>('storageDriverFactory')
-      const driver = await factory.resolveForPartition(claimed.partitionCode, {
-        tenantId: claimed.tenantId,
-        organizationId: claimed.organizationId,
-      })
-      await (driver.deleteStrict?.(claimed.partitionCode, claimed.storagePath)
-        ?? driver.delete(claimed.partitionCode, claimed.storagePath))
-    }
-    await quotaService.release(claimed.id, claimed.leaseToken)
-  } catch (error) {
-    if (claimed.expiresAt) {
-      await scheduleAttachmentQuotaRecovery(job.payload, claimed.expiresAt.getTime() - Date.now())
-    }
-    throw error
-  }
-}

package/src/modules/audit_logs/api/audit-logs/readScope.ts

@@ -1,28 +0,0 @@
-import { NextResponse } from 'next/server'
-import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
-
-type ResolvedAuth = NonNullable<AuthContext>
-
-// `isSuperAdmin` is not part of the declared `AuthContext` shape — it reaches callers
-// through the type's index signature — so read it exactly the way
-// `shared/lib/auth/server.ts` does instead of widening the shared contract here.
-function isSuperAdmin(auth: ResolvedAuth): boolean {
-  return (auth as Record<string, unknown>).isSuperAdmin === true
-}
-
-/**
- * Fail closed on tenant scope for audit-log reads.
- *
- * `audit_logs.view_tenant` only widens visibility WITHIN a tenant, so cross-tenant reads
- * must be gated on `isSuperAdmin`, never on the caller's tenant being empty: a tenant-less
- * principal (unscoped API key or global account) holding `view_tenant` otherwise drops the
- * tenant, organization and actor predicates at once and reads decrypted action-log rows for
- * every tenant in the instance (issues #3817, #3818).
- *
- * Plain truthiness is deliberate — it matches the `if (parsed.tenantId)` predicate guard in
- * ActionLogService/AccessLogService, so every value that would skip it is rejected here.
- */
-export function requireResolvedTenantScope(auth: ResolvedAuth): NextResponse | null {
-  if (auth.tenantId || isSuperAdmin(auth)) return null
-  return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
-}

package/src/modules/audit_logs/extension-points.ts

@@ -1,11 +0,0 @@
-import { dataTableExtensionHost, defineModuleExtensionPoints } from '@open-mercato/shared/modules/widgets/extension-points'
-
-export const extensionPoints = defineModuleExtensionPoints({
-  moduleId: 'audit_logs',
-  hosts: {
-    accessLogsTable: dataTableExtensionHost({ tableId: 'audit_logs.access.list', source: 'components/AccessLogsTable.tsx' }),
-    actionsTable: dataTableExtensionHost({ tableId: 'audit_logs.actions.list', source: 'components/AuditLogsActions.tsx' }),
-  },
-})
-
-export default extensionPoints

package/src/modules/audit_logs/i18n/ko.json

@@ -1,66 +0,0 @@
-{
-  "audit_logs.access.columns.access": "접근",
-  "audit_logs.access.columns.fields": "필드",
-  "audit_logs.access.columns.organization": "조직",
-  "audit_logs.access.columns.resource": "리소스",
-  "audit_logs.access.columns.tenant": "테넌트",
-  "audit_logs.access.columns.user": "사용자",
-  "audit_logs.access.columns.when": "시간",
-  "audit_logs.access.title": "접근 로그",
-  "audit_logs.actions.columns.action": "작업",
-  "audit_logs.actions.columns.controls": "제어",
-  "audit_logs.actions.columns.organization": "조직",
-  "audit_logs.actions.columns.resource": "리소스",
-  "audit_logs.actions.columns.status": "상태",
-  "audit_logs.actions.columns.tenant": "테넌트",
-  "audit_logs.actions.columns.user": "사용자",
-  "audit_logs.actions.columns.when": "시간",
-  "audit_logs.actions.details.after": "이후",
-  "audit_logs.actions.details.before": "이전",
-  "audit_logs.actions.details.changed_fields": "변경된 필드",
-  "audit_logs.actions.details.close": "상세 정보 닫기",
-  "audit_logs.actions.details.context": "컨텍스트",
-  "audit_logs.actions.details.field": "필드",
-  "audit_logs.actions.details.no_changes": "추적된 필드 변경 사항 없음",
-  "audit_logs.actions.details.snapshot_after": "변경 후 스냅샷",
-  "audit_logs.actions.details.snapshot_before": "변경 전 스냅샷",
-  "audit_logs.actions.details.title": "작업 상세 정보",
-  "audit_logs.actions.redo": "마지막 작업 다시 실행",
-  "audit_logs.actions.title": "작업 로그",
-  "audit_logs.actions.undo": "마지막 작업 실행 취소",
-  "audit_logs.actions.undoing": "실행 취소 중…",
-  "audit_logs.banner.last_operation": "마지막 작업:",
-  "audit_logs.banner.undo": "실행 취소",
-  "audit_logs.banner.undo_error": "실행 취소 실패",
-  "audit_logs.banner.undo_success": "작업이 실행 취소되었습니다",
-  "audit_logs.common.loading": "불러오는 중…",
-  "audit_logs.common.none": "—",
-  "audit_logs.common.refresh": "새로고침",
-  "audit_logs.common.refreshing": "새로고침 중…",
-  "audit_logs.error.load": "감사 로그를 불러오지 못했습니다",
-  "audit_logs.error.redo": "작업을 다시 실행할 수 없습니다",
-  "audit_logs.error.undo": "작업을 실행 취소할 수 없습니다",
-  "audit_logs.filters.undoable_only": "실행 취소 가능한 항목만",
-  "audit_logs.hint.view_self_only": "본인의 변경 사항만 표시됩니다. 더 넓은 범위의 접근이 필요하면 관리자에게 문의하세요.",
-  "audit_logs.nav.title": "감사 로그",
-  "audit_logs.tabs.label": "감사 로그 보기",
-  "audit_logs.version_history.action.redo": "{action} 다시 실행",
-  "audit_logs.version_history.action.undo": "{action} 실행 취소",
-  "audit_logs.version_history.close": "닫기",
-  "audit_logs.version_history.detail.action": "작업",
-  "audit_logs.version_history.detail.actor": "변경한 사람",
-  "audit_logs.version_history.detail.back": "뒤로",
-  "audit_logs.version_history.detail.date": "날짜",
-  "audit_logs.version_history.detail.status": "상태",
-  "audit_logs.version_history.detail.title": "변경 상세 정보",
-  "audit_logs.version_history.empty": "기록된 변경 사항 없음",
-  "audit_logs.version_history.error": "버전 기록을 불러오지 못했습니다",
-  "audit_logs.version_history.load_more": "더 보기",
-  "audit_logs.version_history.loading": "기록을 불러오는 중…",
-  "audit_logs.version_history.show_related": "관련 변경 사항 표시",
-  "audit_logs.version_history.status.done": "완료",
-  "audit_logs.version_history.status.failed": "실패",
-  "audit_logs.version_history.status.redone": "다시 실행됨",
-  "audit_logs.version_history.status.undone": "실행 취소됨",
-  "audit_logs.version_history.title": "버전 기록"
-}

package/src/modules/auth/extension-points.ts

@@ -1,18 +0,0 @@
-import { dataTableExtensionHost, defineModuleExtensionPoints, injectionExtensionHost } from '@open-mercato/shared/modules/widgets/extension-points'
-
-export const extensionPoints = defineModuleExtensionPoints({
-  moduleId: 'auth',
-  hosts: {
-    loginForm: injectionExtensionHost({
-      family: 'generic',
-      spotId: 'auth.login:form',
-      supported: ['render-widget'],
-      contextContract: 'auth.login-form.v1',
-      source: 'frontend/login.tsx',
-    }),
-    usersTable: dataTableExtensionHost({ tableId: 'auth.users.list', source: 'backend/users/page.tsx' }),
-    rolesTable: dataTableExtensionHost({ tableId: 'auth.roles.list', source: 'backend/roles/page.tsx' }),
-  },
-})
-
-export default extensionPoints