@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/auth/lib/setup-app.ts

@@ -5,7 +5,7 @@ import { Role, RoleAcl, User, UserRole } from '@open-mercato/core/modules/auth/d
 import { Tenant, Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { rebuildHierarchyForTenant } from '@open-mercato/core/modules/directory/lib/hierarchy'
 import { normalizeTenantId } from './tenantAccess'
-import { computeEmailHash } from '@open-mercato/core/modules/auth/lib/emailHash'
+import { computeEmailHash, emailHashLookupValues } from '@open-mercato/core/modules/auth/lib/emailHash'
 import { getDefaultEncryptionMaps, type Module } from '@open-mercato/shared/modules/registry'
 import { isEncryptionDebugEnabled, isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
 import { EncryptionMap } from '@open-mercato/core/modules/entities/data/entities'
@@ -190,7 +190,20 @@ export async function setupInitialTenant(
   const defaultEncryptionMaps = getDefaultEncryptionMaps(resolvedModules)
 
   const mainEmail = primaryUser.email
-  const existingUser = await findOneWithDecryption(em, User, { email: mainEmail }, {}, { tenantId: null, organizationId: null })
+  const existingUserByHash = await findOneWithDecryption(
+    em,
+    User,
+    { emailHash: { $in: emailHashLookupValues(mainEmail) }, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
+  const existingUser = existingUserByHash ?? await findOneWithDecryption(
+    em,
+    User,
+    { email: mainEmail, deletedAt: null },
+    {},
+    { tenantId: null, organizationId: null },
+  )
   if (existingUser && failIfUserExists) {
     throw new Error('USER_EXISTS')
   }
@@ -320,6 +333,7 @@ export async function setupInitialTenant(
         ancestorIds: [],
         childIds: [],
         descendantIds: [],
+        logoPreserveAspectRatio: false,
         createdAt: new Date(),
         updatedAt: new Date(),
       })
@@ -357,7 +371,12 @@ export async function setupInitialTenant(
       await tem.flush()
 
       if (isTenantDataEncryptionEnabled()) {
+        // System-scoped maps are resolved from module code, never from a tenant row.
+        // Persisting one here would make the tenant-scoped encryption CLIs believe they
+        // own that entity and re-wrap its `system:<entityId>` ciphertext under the tenant
+        // DEK, which runtime decryption can no longer read.
         for (const spec of defaultEncryptionMaps) {
+          if (spec.keyScope === 'system') continue
           const existing = await findOneWithDecryption(tem, EncryptionMap, { entityId: spec.entityId, tenantId: tenant.id, organizationId: organization.id, deletedAt: null }, {}, { tenantId: String(tenant.id), organizationId: String(organization.id) })
           if (!existing) {
             tem.persist(tem.create(EncryptionMap, {

package/src/modules/auth/lib/tenantAccess.ts

@@ -77,3 +77,11 @@ export async function enforceTenantSelection(ctx: TenantGuardCtx, requested: unk
   if (normalized === actorTenant) return actorTenant
   throw forbidden('Not authorized to target this tenant.')
 }
+
+export async function requireSuperAdmin(ctx: TenantGuardCtx): Promise<void> {
+  const isSuperAdmin = await resolveIsSuperAdmin(ctx)
+  if (!isSuperAdmin) {
+    throw forbidden('Forbidden')
+  }
+}
+

package/src/modules/auth/services/rbacService.ts

@@ -5,8 +5,11 @@ import { UserAcl, RoleAcl, User, UserRole } from '@open-mercato/core/modules/aut
 import { ApiKey } from '@open-mercato/core/modules/api_keys/data/entities'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { buildOrgScopeUserCacheTag, buildOrgScopeTenantCacheTag } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import { matchFeature as sharedMatchFeature, hasAllFeatures as sharedHasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
-import { filterGrantsByEnabledModules, getOwningModuleId, getEnabledModuleIds } from '@open-mercato/shared/security/enabledModulesRegistry'
+import {
+  authorizeFeatures,
+  resolveEffectiveFeatures,
+} from '@open-mercato/shared/security/featurePolicy'
+import { filterGrantsByEnabledModules } from '@open-mercato/shared/security/enabledModulesRegistry'
 
 interface AclData {
   isSuperAdmin: boolean
@@ -43,32 +46,9 @@ export class RbacService {
     this.cacheTtlMs = ttlMs
   }
 
-  /**
-   * Checks if a required feature is satisfied by a granted feature permission.
-   * 
-   * Wildcard patterns:
-   * - `*` (global wildcard): Grants access to all features
-   * - `prefix.*` (module wildcard): Grants access to all features starting with `prefix.`
-   *   and also the exact prefix itself (e.g., `entities.*` matches both `entities` and `entities.records.view`)
-   * - Exact match: Feature must match exactly (e.g., `users.view` only matches `users.view`)
-   * 
-   * @param required - The feature being requested (e.g., 'entities.records.view')
-   * @param granted - The feature permission granted (e.g., 'entities.*' or '*')
-   * @returns true if the granted permission satisfies the required feature
-   * 
-   * @example
-   * matchFeature('users.view', '*') // true - global wildcard
-   * matchFeature('entities.records.view', 'entities.*') // true - module wildcard
-   * matchFeature('entities', 'entities.*') // true - exact prefix match
-   * matchFeature('users.view', 'entities.*') // false - different module
-   * matchFeature('users.view', 'users.view') // true - exact match
-   */
-  private matchFeature(required: string, granted: string): boolean {
-    return sharedMatchFeature(required, granted)
-  }
-
+  /** Compatibility wrapper for callers that already have both feature lists. */
   public hasAllFeatures(required: string[], granted: string[]): boolean {
-    return sharedHasAllFeatures(required, granted)
+    return authorizeFeatures(required, { grantedFeatures: granted })
   }
 
   private roleAclAllowsOrganization(acl: RoleAcl, organizationId: string | null | undefined): boolean {
@@ -380,9 +360,6 @@ export class RbacService {
   ): Promise<boolean> {
     if (!tenantId || !feature) return false
 
-    const enabledIds = getEnabledModuleIds()
-    if (enabledIds.length && !enabledIds.includes(getOwningModuleId(feature))) return false
-
     const em = this.em.fork()
     const roleAcls = await em.find(RoleAcl, { tenantId, deletedAt: null } as any, {})
     const list = Array.isArray(roleAcls) ? roleAcls : []
@@ -390,9 +367,13 @@ export class RbacService {
 
     for (const acl of list) {
       if (!this.roleAclAllowsOrganization(acl, organizationId)) continue
-      if (acl.isSuperAdmin) return true
       const grants = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
-      if (this.hasAllFeatures([feature], filterGrantsByEnabledModules(grants))) return true
+      if (authorizeFeatures([feature], {
+        grantedFeatures: grants,
+        unrestricted: acl.isSuperAdmin,
+      })) {
+        return true
+      }
     }
 
     return false
@@ -436,23 +417,22 @@ export class RbacService {
   async userHasAllFeatures(userId: string, required: string[], scope: { tenantId: string | null; organizationId: string | null }): Promise<boolean> {
     if (!required.length) return true
     const acl = await this.loadAcl(userId, scope)
-    if (acl.isSuperAdmin) {
-      const enabledIds = getEnabledModuleIds()
-      if (!enabledIds.length) return true
-      const enabledSet = new Set(enabledIds)
-      return required.every((feature) => enabledSet.has(getOwningModuleId(feature)))
-    }
-    if (acl.organizations && scope.organizationId && !acl.organizations.includes(scope.organizationId) && !acl.organizations.includes('__all__')) return false
-    return this.hasAllFeatures(required, filterGrantsByEnabledModules(acl.features))
+    const organizationAllowed = acl.isSuperAdmin
+      || !acl.organizations
+      || !scope.organizationId
+      || acl.organizations.includes(scope.organizationId)
+      || acl.organizations.includes('__all__')
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isSuperAdmin,
+      scopeAllowed: organizationAllowed,
+    })
   }
 
   /**
-   * Returns the effective feature grant list for a user within a scope,
-   * filtered to enabled modules only. Super admins receive `['*']` expanded
-   * to per-module wildcards via `filterGrantsByEnabledModules` — consistent
-   * with `userHasAllFeatures` which also enforces disabled-module boundaries
-   * for super admins. Returns `[]` when the requested organization is outside
-   * the user's visibility list, or when the user does not exist.
+   * Returns the user's infrastructure grant list, filtered to enabled modules.
+   * The result may contain wildcards; authoritative checks must still go through
+   * `authorizeFeatures` or `userHasAllFeatures` so null overrides are enforced.
    */
   async getGrantedFeatures(
     userId: string,
@@ -470,4 +450,19 @@ export class RbacService {
     }
     return filterGrantsByEnabledModules(acl.features)
   }
+
+  /** Returns concrete active feature IDs for browser capability payloads. */
+  async getEffectiveFeatures(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<string[]> {
+    const acl = await this.loadAcl(userId, scope)
+    const organizationAllowed = acl.isSuperAdmin
+      || !acl.organizations
+      || !scope.organizationId
+      || acl.organizations.includes(scope.organizationId)
+      || acl.organizations.includes('__all__')
+    if (!organizationAllowed) return []
+    return resolveEffectiveFeatures(acl.isSuperAdmin ? ['*'] : acl.features)
+  }
 }

package/src/modules/business_rules/api/openmercato-call-options/route.ts

@@ -0,0 +1,94 @@
+import { NextResponse } from 'next/server'
+import { z } from 'zod'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import {
+  getCurrentOpenMercatoEndpointOptions,
+  listOpenMercatoApiKeyOptions,
+} from '../../lib/openmercato-call-options'
+
+const roleOptionSchema = z.object({
+  id: z.string(),
+  name: z.string().nullable(),
+})
+
+const endpointOptionSchema = z.object({
+  id: z.string(),
+  path: z.string(),
+  method: z.enum(['GET', 'POST', 'PUT', 'PATCH', 'DELETE']),
+  label: z.string(),
+  summary: z.string().nullable(),
+  operationId: z.string().nullable(),
+})
+
+const apiKeyOptionSchema = z.object({
+  id: z.string(),
+  name: z.string(),
+  keyPrefix: z.string(),
+  organizationId: z.string().nullable(),
+  organizationName: z.string().nullable(),
+  roles: z.array(roleOptionSchema),
+})
+
+const optionsResponseSchema = z.object({
+  endpoints: z.array(endpointOptionSchema),
+  apiKeys: z.array(apiKeyOptionSchema),
+})
+
+const errorResponseSchema = z.object({
+  error: z.string(),
+})
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: ['business_rules.manage', 'api_keys.create'] },
+}
+
+export async function GET(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
+  }
+
+  if (!auth.tenantId) {
+    return NextResponse.json({ error: 'Tenant context required' }, { status: 400 })
+  }
+
+  const container = await createRequestContainer()
+  const em = container.resolve('em') as EntityManager
+
+  const [endpoints, apiKeys] = await Promise.all([
+    getCurrentOpenMercatoEndpointOptions(),
+    listOpenMercatoApiKeyOptions(em, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId ?? null,
+    }),
+  ])
+
+  return NextResponse.json({ endpoints, apiKeys })
+}
+
+export const openApi: OpenApiRouteDoc = {
+  tag: 'Business Rules',
+  summary: 'List OpenMercato call action options',
+  methods: {
+    GET: {
+      summary: 'List OpenMercato call action options',
+      description:
+        'Returns executable Open Mercato API endpoint options and safe API key profile metadata for business-rule actions.',
+      responses: [
+        {
+          status: 200,
+          description: 'OpenMercato call options',
+          schema: optionsResponseSchema,
+        },
+      ],
+      errors: [
+        { status: 400, description: 'Tenant context missing', schema: errorResponseSchema },
+        { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
+        { status: 403, description: 'Missing required features', schema: errorResponseSchema },
+      ],
+    },
+  },
+}

package/src/modules/business_rules/api/rules/route.ts

@@ -21,6 +21,7 @@ import {
   invalidateBusinessRuleDiscoveryCache,
   resolveBusinessRuleDiscoveryCache,
 } from '../../lib/rule-engine'
+import { validateOpenMercatoCallActions } from '../../lib/openmercato-call-options'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('business_rules').child({ component: 'rules-api' })
@@ -87,6 +88,41 @@ const routeMetadata = {
 
 export const metadata = routeMetadata
 
+function hasOpenMercatoCallAction(actions: unknown): boolean {
+  return Array.isArray(actions)
+    && actions.some((action) => action && typeof action === 'object' && (action as { type?: unknown }).type === 'CALL_OPEN_MERCATO')
+}
+
+async function requireOpenMercatoCallConfiguratorAccess(
+  container: ReturnType<typeof createRequestContainer> extends Promise<infer T> ? T : never,
+  auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>,
+): Promise<Response | null> {
+  if (!auth.sub) {
+    return NextResponse.json(
+      { error: 'Forbidden', requiredFeatures: ['api_keys.create'] },
+      { status: 403 },
+    )
+  }
+
+  const rbac = container.resolve('rbacService') as {
+    userHasAllFeatures?: (
+      userId: string,
+      required: string[],
+      scope: { tenantId: string | null; organizationId: string | null },
+    ) => Promise<boolean>
+  } | undefined
+  const allowed = await rbac?.userHasAllFeatures?.(auth.sub, ['api_keys.create'], {
+    tenantId: auth.tenantId ?? null,
+    organizationId: auth.orgId ?? null,
+  })
+  if (allowed) return null
+
+  return NextResponse.json(
+    { error: 'Forbidden', requiredFeatures: ['api_keys.create'] },
+    { status: 403 },
+  )
+}
+
 export async function GET(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -186,6 +222,11 @@ export async function POST(req: Request) {
   if (!auth) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: 'Tenant and organization context required' }, { status: 400 })
+  }
+  const tenantId = auth.tenantId
+  const organizationId = auth.orgId
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -200,8 +241,8 @@ export async function POST(req: Request) {
 
   const payload = {
     ...body,
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    tenantId,
+    organizationId,
     createdBy: auth.sub ?? auth.email ?? null,
   }
 
@@ -213,6 +254,25 @@ export async function POST(req: Request) {
     return NextResponse.json({ error: `Validation failed: ${errors.join(', ')}` }, { status: 400 })
   }
 
+  if (hasOpenMercatoCallAction(parsed.data.successActions) || hasOpenMercatoCallAction(parsed.data.failureActions)) {
+    const accessError = await requireOpenMercatoCallConfiguratorAccess(container, auth)
+    if (accessError) return accessError
+  }
+
+  const actionErrors = [
+    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.successActions, {
+      tenantId,
+      organizationId,
+    }),
+    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.failureActions, {
+      tenantId,
+      organizationId,
+    }),
+  ]
+  if (actionErrors.length > 0) {
+    return NextResponse.json({ error: `Validation failed: ${actionErrors.join(', ')}` }, { status: 400 })
+  }
+
   const data = {
     ...parsed.data,
     conditionExpression: parsed.data.conditionExpression ?? null,
@@ -239,6 +299,11 @@ export async function PUT(req: Request) {
   if (!auth) {
     return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
   }
+  if (!auth.tenantId || !auth.orgId) {
+    return NextResponse.json({ error: 'Tenant and organization context required' }, { status: 400 })
+  }
+  const tenantId = auth.tenantId
+  const organizationId = auth.orgId
 
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -273,8 +338,8 @@ export async function PUT(req: Request) {
 
   const rule = await em.findOne(BusinessRule, {
     id: parsed.data.id,
-    tenantId: auth.tenantId,
-    organizationId: auth.orgId,
+    tenantId,
+    organizationId,
     deletedAt: null,
   })
 
@@ -282,6 +347,29 @@ export async function PUT(req: Request) {
     return NextResponse.json({ error: 'Rule not found' }, { status: 404 })
   }
 
+  const touchesOpenMercatoCall = hasOpenMercatoCallAction(parsed.data.successActions)
+    || hasOpenMercatoCallAction(parsed.data.failureActions)
+    || hasOpenMercatoCallAction(rule.successActions)
+    || hasOpenMercatoCallAction(rule.failureActions)
+  if (touchesOpenMercatoCall) {
+    const accessError = await requireOpenMercatoCallConfiguratorAccess(container, auth)
+    if (accessError) return accessError
+  }
+
+  const actionErrors = [
+    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.successActions, {
+      tenantId,
+      organizationId,
+    }),
+    ...await validateOpenMercatoCallActions(em as EntityManager, parsed.data.failureActions, {
+      tenantId,
+      organizationId,
+    }),
+  ]
+  if (actionErrors.length > 0) {
+    return NextResponse.json({ error: `Validation failed: ${actionErrors.join(', ')}` }, { status: 400 })
+  }
+
   try {
     await enforceCommandOptimisticLockWithGuards(container, {
       resourceKind: 'business_rules.rule',

package/src/modules/business_rules/backend/rules/page.tsx

@@ -1,6 +1,7 @@
 "use client"
 
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/business_rules/extension-points'
 import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -342,7 +343,7 @@ export default function RulesListPage() {
           onFiltersApply={handleFiltersApply}
           onFiltersClear={handleFiltersClear}
           perspective={{
-            tableId: 'business-rules.rules.list',
+            tableId: extensionPoints.hosts.rulesTable.tableId,
           }}
           emptyState={(
             <ListEmptyState

package/src/modules/business_rules/components/ActionBuilder.tsx

@@ -3,11 +3,13 @@
 import * as React from 'react'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { Plus, Code } from 'lucide-react'
-import { ActionRow } from './ActionRow'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { ActionRow, type OpenMercatoCallOptionsState } from './ActionRow'
 import type { Action } from './utils/actionValidation'
 import { validateActions } from './utils/actionValidation'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { useConfirmDialog } from '@open-mercato/ui/backend/confirm-dialog'
+import type { OpenMercatoCallOptionsResponse } from '../lib/openmercato-call-options-types'
 
 export type ActionBuilderProps = {
   value: Action[] | null | undefined
@@ -29,7 +31,52 @@ export function ActionBuilder({
   const t = useT()
   const { confirm: confirmDialog, ConfirmDialogElement } = useConfirmDialog()
   const [showDebug, setShowDebug] = React.useState(false)
-  const actions = value || []
+  const [openMercatoOptions, setOpenMercatoOptions] = React.useState<OpenMercatoCallOptionsState>({
+    endpoints: [],
+    apiKeys: [],
+    loading: true,
+    error: null,
+  })
+  const actions = React.useMemo(() => value || [], [value])
+
+  React.useEffect(() => {
+    let cancelled = false
+
+    async function loadOpenMercatoOptions() {
+      setOpenMercatoOptions((current) => ({ ...current, loading: true, error: null }))
+      try {
+        const response = await apiCall<OpenMercatoCallOptionsResponse>('/api/business_rules/openmercato-call-options')
+        if (!response.ok || !response.result) {
+          const error = response.result && 'error' in response.result
+            ? String((response.result as any).error)
+            : t('business_rules.components.actionRow.openMercato.options.fetchFailed', { status: response.status })
+          throw new Error(error)
+        }
+        if (!cancelled) {
+          setOpenMercatoOptions({
+            endpoints: Array.isArray(response.result.endpoints) ? response.result.endpoints : [],
+            apiKeys: Array.isArray(response.result.apiKeys) ? response.result.apiKeys : [],
+            loading: false,
+            error: null,
+          })
+        }
+      } catch (error) {
+        if (!cancelled) {
+          setOpenMercatoOptions({
+            endpoints: [],
+            apiKeys: [],
+            loading: false,
+            error: error instanceof Error ? error.message : String(error),
+          })
+        }
+      }
+    }
+
+    void loadOpenMercatoOptions()
+    return () => {
+      cancelled = true
+    }
+  }, [t])
 
   const handleAddAction = () => {
     const newAction: Action = {
@@ -101,10 +148,11 @@ export function ActionBuilder({
         {/* Controls */}
         <div className="flex items-center gap-2">
           {showJsonPreview && actions.length > 0 && (
-            <button
+            <Button
               type="button"
               onClick={() => setShowDebug(!showDebug)}
-              className="flex items-center gap-1 text-xs text-muted-foreground hover:text-foreground"
+              variant="muted"
+              size="2xs"
               title={t('business_rules.components.actionBuilder.jsonPreview.toggle')}
             >
               <Code className="w-3 h-3" />
@@ -112,7 +160,7 @@ export function ActionBuilder({
                 ? t('business_rules.components.actionBuilder.jsonPreview.hide')
                 : t('business_rules.components.actionBuilder.jsonPreview.show')
               }
-            </button>
+            </Button>
           )}
         </div>
       </div>
@@ -143,6 +191,7 @@ export function ActionBuilder({
                 onMoveDown={index < actions.length - 1 ? handleMoveDown : undefined}
                 canMoveUp={index > 0}
                 canMoveDown={index < actions.length - 1}
+                openMercatoOptions={openMercatoOptions}
               />
             ))}
           </div>