@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/currencies/i18n/ko.json

@@ -0,0 +1,160 @@
+{
+  "audit_logs.resource_kind.currencies.exchange_rate": "환율",
+  "currencies.audit.create": "통화 생성",
+  "currencies.audit.delete": "통화 삭제",
+  "currencies.audit.update": "통화 수정",
+  "currencies.create.title": "통화 생성",
+  "currencies.currencies.update": "통화 수정",
+  "currencies.edit.title": "통화 편집",
+  "currencies.exchange_rates.update": "환율 수정",
+  "currencies.fetch.description": "외부 제공업체로부터 자동 환율 가져오기를 관리합니다",
+  "currencies.fetch.disabled": "비활성화됨",
+  "currencies.fetch.enabled": "활성화됨",
+  "currencies.fetch.error_load_configs": "구성을 불러오지 못했습니다",
+  "currencies.fetch.error_update_config": "구성 업데이트에 실패했습니다",
+  "currencies.fetch.error_update_sync_time": "동기화 시간 업데이트에 실패했습니다",
+  "currencies.fetch.fetch_now": "지금 가져오기",
+  "currencies.fetch.fetching": "가져오는 중...",
+  "currencies.fetch.initialize_providers": "제공업체 초기화",
+  "currencies.fetch.initializing_providers": "제공업체 초기화 중...",
+  "currencies.fetch.last_sync": "마지막 동기화",
+  "currencies.fetch.last_sync_count": "가져온 환율 수",
+  "currencies.fetch.last_sync_never": "없음",
+  "currencies.fetch.last_sync_status": "상태",
+  "currencies.fetch.loading": "불러오는 중...",
+  "currencies.fetch.no_providers": "아직 구성된 통화 제공업체가 없습니다.",
+  "currencies.fetch.provider_disabled": "제공업체 비활성화됨",
+  "currencies.fetch.provider_enabled": "제공업체 활성화됨",
+  "currencies.fetch.provider_nbp": "NBP (폴란드 국립은행)",
+  "currencies.fetch.provider_nbp_description": "폴란드 국립은행의 매수/매도 환율이 포함된 약 13개 통화",
+  "currencies.fetch.provider_raiffeisen": "라이파이젠 은행 폴란드",
+  "currencies.fetch.provider_raiffeisen_description": "매수/매도 환율이 포함된 4개 주요 통화 (EUR, USD, CHF, GBP)",
+  "currencies.fetch.sync_error": "환율 가져오기에 실패했습니다",
+  "currencies.fetch.sync_no_rates": "가져온 환율이 없습니다. 정의된 통화가 없습니다. 가져올 통화 쌍을 생성하세요",
+  "currencies.fetch.sync_success": "환율을 성공적으로 가져왔습니다: {{count}}",
+  "currencies.fetch.sync_time": "일일 동기화 시간",
+  "currencies.fetch.title": "환율 가져오기",
+  "currencies.flash.baseSet": "기준 통화가 성공적으로 업데이트되었습니다",
+  "currencies.flash.baseSetError": "기준 통화 설정에 실패했습니다",
+  "currencies.flash.created": "통화가 성공적으로 생성되었습니다",
+  "currencies.flash.deleteError": "통화 삭제에 실패했습니다",
+  "currencies.flash.deleted": "통화가 성공적으로 삭제되었습니다",
+  "currencies.flash.updated": "통화가 성공적으로 수정되었습니다",
+  "currencies.form.action.create": "통화 생성",
+  "currencies.form.action.save": "변경 사항 저장",
+  "currencies.form.actions.backToList": "통화 목록으로 돌아가기",
+  "currencies.form.errors.codeFormat": "통화 코드는 정확히 3자리 대문자여야 합니다 (예: USD)",
+  "currencies.form.errors.delete": "통화 삭제에 실패했습니다",
+  "currencies.form.errors.load": "통화를 불러오지 못했습니다",
+  "currencies.form.errors.notFound": "통화를 찾을 수 없습니다",
+  "currencies.form.field.code": "통화 코드",
+  "currencies.form.field.codeHelp": "ISO 4217 3자리 코드 (예: USD, EUR, GBP)",
+  "currencies.form.field.codePlaceholder": "USD",
+  "currencies.form.field.decimalPlaces": "소수 자릿수",
+  "currencies.form.field.decimalSeparator": "소수 구분 기호",
+  "currencies.form.field.isActive": "활성",
+  "currencies.form.field.isBase": "기준 통화",
+  "currencies.form.field.name": "통화 이름",
+  "currencies.form.field.namePlaceholder": "미국 달러",
+  "currencies.form.field.symbol": "기호",
+  "currencies.form.field.symbolPlaceholder": "$",
+  "currencies.form.field.thousandsSeparator": "천 단위 구분 기호",
+  "currencies.form.group.details": "통화 상세 정보",
+  "currencies.form.group.formatting": "형식 및 설정",
+  "currencies.form.loading": "통화를 불러오는 중...",
+  "currencies.list.actions.create": "통화 추가",
+  "currencies.list.actions.setBase": "기준으로 설정",
+  "currencies.list.base": "기준",
+  "currencies.list.columns.active": "활성",
+  "currencies.list.columns.code": "코드",
+  "currencies.list.columns.createdAt": "생성일",
+  "currencies.list.columns.decimalPlaces": "소수점",
+  "currencies.list.columns.name": "이름",
+  "currencies.list.columns.symbol": "기호",
+  "currencies.list.columns.updatedAt": "수정일",
+  "currencies.list.confirmDelete": "통화 {{code}}를 삭제하시겠습니까? 이 통화의 모든 환율도 함께 제거됩니다.",
+  "currencies.list.description": "환율은 매일 밤 새로고침됩니다.",
+  "currencies.list.error.load": "통화를 불러오지 못했습니다",
+  "currencies.list.filters.active": "활성",
+  "currencies.list.filters.all": "전체",
+  "currencies.list.filters.baseOnly": "기준 통화만 표시",
+  "currencies.list.filters.inactive": "비활성",
+  "currencies.list.filters.status": "상태",
+  "currencies.list.searchPlaceholder": "코드 또는 이름으로 통화 검색",
+  "currencies.list.title": "통화",
+  "currencies.module.description": "다중 통화 거래를 위한 통화 및 환율을 관리합니다.",
+  "currencies.module.title": "통화 및 환율",
+  "currencies.nav.group": "통화",
+  "currencies.page.title": "통화",
+  "currencies.rates.audit.create": "환율 생성",
+  "currencies.rates.audit.delete": "환율 삭제",
+  "currencies.rates.audit.update": "환율 수정",
+  "exchangeRates.create.title": "환율 생성",
+  "exchangeRates.edit.title": "환율 편집",
+  "exchangeRates.flash.created": "환율이 성공적으로 생성되었습니다",
+  "exchangeRates.flash.deleteError": "환율 삭제에 실패했습니다",
+  "exchangeRates.flash.deleted": "환율이 성공적으로 삭제되었습니다",
+  "exchangeRates.flash.updated": "환율이 성공적으로 수정되었습니다",
+  "exchangeRates.form.action.create": "환율 생성",
+  "exchangeRates.form.action.save": "변경 사항 저장",
+  "exchangeRates.form.actions.backToList": "환율 목록으로 돌아가기",
+  "exchangeRates.form.errors.currencyCodeFormat": "정확히 3자리 대문자여야 합니다",
+  "exchangeRates.form.errors.fromCurrencyFormat": "잘못된 원본 통화 코드입니다",
+  "exchangeRates.form.errors.invalidDate": "날짜와 시간은 필수입니다",
+  "exchangeRates.form.errors.invalidRate": "환율은 양수여야 합니다",
+  "exchangeRates.form.errors.load": "환율을 불러오지 못했습니다",
+  "exchangeRates.form.errors.notFound": "환율을 찾을 수 없습니다",
+  "exchangeRates.form.errors.sameCurrency": "원본 통화와 대상 통화는 서로 달라야 합니다",
+  "exchangeRates.form.errors.sourceInvalidFormat": "소스는 문자, 숫자, 공백, 하이픈, 밑줄만 포함할 수 있습니다",
+  "exchangeRates.form.errors.sourceTooLong": "소스는 50자를 초과할 수 없습니다",
+  "exchangeRates.form.errors.sourceTooShort": "소스는 최소 2자 이상이어야 합니다",
+  "exchangeRates.form.errors.toCurrencyFormat": "잘못된 대상 통화 코드입니다",
+  "exchangeRates.form.field.date": "날짜 및 시간",
+  "exchangeRates.form.field.dateHelp": "이 환율이 적용되는 날짜 및 시간 (현지 표준 시간대 기준)",
+  "exchangeRates.form.field.fromCurrency": "원본 통화",
+  "exchangeRates.form.field.fromCurrencyHelp": "변환할 원본 통화",
+  "exchangeRates.form.field.fromCurrencyPlaceholder": "통화 선택",
+  "exchangeRates.form.field.isActive": "활성",
+  "exchangeRates.form.field.rate": "환율",
+  "exchangeRates.form.field.rateHelp": "원본 통화 1단위당 대상 통화의 단위 수 (최대 소수점 8자리)",
+  "exchangeRates.form.field.source": "소스",
+  "exchangeRates.form.field.sourceHelp": "이 환율의 출처 (필수, 2~50자)",
+  "exchangeRates.form.field.sourcePlaceholder": "예: ECB, 수동",
+  "exchangeRates.form.field.toCurrency": "대상 통화",
+  "exchangeRates.form.field.toCurrencyHelp": "변환 대상 통화",
+  "exchangeRates.form.field.toCurrencyPlaceholder": "통화 선택",
+  "exchangeRates.form.field.type": "환율 유형",
+  "exchangeRates.form.field.typeBuy": "매수",
+  "exchangeRates.form.field.typeBuyDescription": "은행이 귀하로부터 외화를 매수합니다",
+  "exchangeRates.form.field.typeHelp": "은행 관점: 매수 또는 매도 환율 (해당 없으면 비워두세요)",
+  "exchangeRates.form.field.typeNone": "없음 (지정 안 함)",
+  "exchangeRates.form.field.typePlaceholder": "환율 유형 선택 (선택 사항)",
+  "exchangeRates.form.field.typeSell": "매도",
+  "exchangeRates.form.field.typeSellDescription": "은행이 귀하에게 외화를 매도합니다",
+  "exchangeRates.form.group.metadata": "메타데이터",
+  "exchangeRates.form.loading": "환율을 불러오는 중...",
+  "exchangeRates.list.actions.create": "환율 추가",
+  "exchangeRates.list.columns.active": "활성",
+  "exchangeRates.list.columns.createdAt": "생성일",
+  "exchangeRates.list.columns.currencyPair": "통화 쌍",
+  "exchangeRates.list.columns.date": "날짜 및 시간",
+  "exchangeRates.list.columns.rate": "환율",
+  "exchangeRates.list.columns.source": "소스",
+  "exchangeRates.list.columns.type": "유형",
+  "exchangeRates.list.columns.updatedAt": "수정일",
+  "exchangeRates.list.confirmDelete": "환율 {{pair}}을(를) 삭제하시겠습니까?",
+  "exchangeRates.list.error.load": "환율을 불러오지 못했습니다",
+  "exchangeRates.list.filters.active": "활성",
+  "exchangeRates.list.filters.all": "전체",
+  "exchangeRates.list.filters.fromCurrency": "원본 통화",
+  "exchangeRates.list.filters.inactive": "비활성",
+  "exchangeRates.list.filters.source": "소스",
+  "exchangeRates.list.filters.status": "상태",
+  "exchangeRates.list.filters.toCurrency": "대상 통화",
+  "exchangeRates.list.filters.type": "환율 유형",
+  "exchangeRates.list.searchPlaceholder": "환율 검색",
+  "exchangeRates.list.title": "환율",
+  "exchangeRates.list.type.buy": "매수",
+  "exchangeRates.list.type.sell": "매도",
+  "exchangeRates.page.title": "환율"
+}

package/src/modules/currencies/i18n/pl.json

@@ -73,6 +73,7 @@
   "currencies.list.columns.symbol": "Symbol",
   "currencies.list.columns.updatedAt": "Data aktualizacji",
   "currencies.list.confirmDelete": "Usunąć walutę {{code}}? Spowoduje to również usunięcie wszystkich kursów wymiany dla tej waluty.",
+  "currencies.list.description": "Kursy wymiany są odświeżane każdej nocy.",
   "currencies.list.error.load": "Nie udało się załadować walut",
   "currencies.list.filters.active": "Aktywne",
   "currencies.list.filters.all": "Wszystkie",

package/src/modules/currencies/services/baseCurrencyService.ts

@@ -0,0 +1,59 @@
+import type { EntityManager } from '@mikro-orm/core'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('currencies').child({ component: 'base-currency-service' })
+
+export type BaseCurrencyResolution =
+  | { status: 'resolved'; code: string }
+  | { status: 'missing' }
+  | { status: 'ambiguous' }
+  | { status: 'unavailable' }
+
+export type BaseCurrencyScope = {
+  tenantId: string
+  organizationIds: string[]
+}
+
+export class BaseCurrencyService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveBaseCurrency(scope: BaseCurrencyScope): Promise<BaseCurrencyResolution> {
+    const organizationIds = [...new Set(scope.organizationIds)]
+    if (organizationIds.length === 0) return { status: 'ambiguous' }
+
+    let rows: Array<Record<string, unknown>>
+    try {
+      const result = await this.em.getConnection().execute(
+        'SELECT organization_id, code FROM currencies WHERE tenant_id = ? AND organization_id = ANY(?::uuid[]) AND is_base = true AND deleted_at IS NULL',
+        [scope.tenantId, `{${organizationIds.join(',')}}`],
+      )
+      rows = (Array.isArray(result) ? result : []) as Array<Record<string, unknown>>
+    } catch (err) {
+      logger.warn('Base currency lookup unavailable', { err })
+      return { status: 'unavailable' }
+    }
+
+    const expectedOrganizations = new Set(organizationIds)
+    const resolvedOrganizations = new Set<string>()
+    const codes = new Set<string>()
+
+    for (const row of rows) {
+      const organizationId = typeof row.organization_id === 'string' ? row.organization_id : ''
+      const code = typeof row.code === 'string' ? row.code.trim().toUpperCase() : ''
+      if (
+        !expectedOrganizations.has(organizationId)
+        || resolvedOrganizations.has(organizationId)
+        || !code
+      ) {
+        return { status: 'ambiguous' }
+      }
+      resolvedOrganizations.add(organizationId)
+      codes.add(code)
+    }
+
+    if (resolvedOrganizations.size !== expectedOrganizations.size) return { status: 'missing' }
+    if (codes.size !== 1) return { status: 'ambiguous' }
+    const [code] = codes
+    return code ? { status: 'resolved', code } : { status: 'ambiguous' }
+  }
+}

package/src/modules/customer_accounts/AGENTS.md

@@ -136,7 +136,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 ### Portal Admin Flag
 
-`isPortalAdmin: true` on a role/user ACL bypasses all feature checks (equivalent to staff `isSuperAdmin`).
+`isPortalAdmin: true` on a role/user ACL bypasses stored-grant matching (equivalent to staff `isSuperAdmin`). Nulled ACL features and disabled modules remain denied.
 
 ### Default Roles (seeded on tenant creation)
 
@@ -150,7 +150,7 @@ Effective permissions = User ACL (if exists) OR aggregated Role ACLs.
 
 Customer portal features use the `portal.<area>.<action>` naming convention (e.g., `portal.orders.view`, `portal.catalog.view`).
 
-Treat `portal.*` and `*` as first-class ACL grants. When portal code reads raw feature arrays directly (for example menu filtering, injected portal navigation, or local runtime guards), use shared wildcard-aware matching instead of exact `includes(...)` checks.
+Treat `portal.*` and `*` as first-class stored ACL grants. Server authorization calls `CustomerRbacService.userHasAllFeatures`; already-loaded snapshots call shared `authorizeFeatures`. Portal UI and navigation consume `getEffectiveFeatures`, which returns concrete active IDs without wildcards.
 
 ### Cross-Module Feature Merging
 
@@ -172,7 +172,7 @@ const customerRbacService = container.resolve('customerRbacService')
 const hasAccess = await customerRbacService.userHasAllFeatures(userId, ['portal.orders.view'], { tenantId, organizationId })
 ```
 
-When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. If it evaluates raw granted features directly, it must preserve wildcard semantics.
+When a portal UI/client helper needs batch checks, prefer `/api/customer_accounts/portal/feature-check`. Client helpers receive concrete effective features and may use the pure shared matcher without implementing portal-admin or removal bypasses.
 
 ## Services and DI
 

package/src/modules/customer_accounts/api/admin/users/[id].ts

@@ -11,7 +11,7 @@ import { CustomerRbacService } from '@open-mercato/core/modules/customer_account
 import { adminUpdateUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { isOwnedCompanyEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
+import { isOwnedCompanyEntity, isOwnedPersonEntity } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 
@@ -168,6 +168,21 @@ export async function PUT(req: Request, { params }: { params: { id: string } })
     }
   }
 
+  // Same guard for the person FK. Without it the invite-side check is trivially
+  // bypassable: create the user normally, then PUT an unowned personEntityId.
+  // It persists (autoLinkCrm short-circuits on any non-null value) and leaks
+  // account status into the other org's people list via the account-status
+  // enricher. A null value (unlink) needs no ownership check.
+  if (parsed.data.personEntityId) {
+    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
+    }
+  }
+
   // Always bump updated_at so the optimistic-lock version advances on every save.
   // `nativeUpdate` bypasses MikroORM's `onUpdate` hook, so set it explicitly — without
   // this the version never changes and concurrent edits cannot be detected (#2055).

package/src/modules/customer_accounts/api/admin/users-invite.ts

@@ -7,6 +7,7 @@ import { RbacService } from '@open-mercato/core/modules/auth/services/rbacServic
 import { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { inviteUserSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
+import { isOwnedCompanyEntity, isOwnedPersonEntity, resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
 import {
   checkAuthRateLimit,
@@ -14,9 +15,18 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('customer_accounts').child({ component: 'admin-users-invite' })
 
 export const metadata = {}
 
+function resolveInvitedByUserId(auth: NonNullable<Awaited<ReturnType<typeof getAuthFromRequest>>>): string | null {
+  if (auth.isApiKey) return auth.userId ?? null
+  return auth.sub
+}
+
 export async function POST(req: Request) {
   const auth = await getAuthFromRequest(req)
   if (!auth) {
@@ -51,19 +61,80 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Validation failed', details: parsed.error.flatten().fieldErrors }, { status: 400 })
   }
 
+  // Reject a customerEntityId the caller does not own. customerEntityId is the
+  // CRM company FK; without this check a non-company (e.g. a person) entity id
+  // or a company from another org poisons the invitation and every later user
+  // edit fails with "Company not found" (#4362, #2693).
+  if (parsed.data.customerEntityId) {
+    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
+    const owned = await isOwnedCompanyEntity(em, parsed.data.customerEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Company not found' }, { status: 400 })
+    }
+  }
+
+  // Same guard for the person FK: it is copied onto the customer user on accept
+  // and makes `autoLinkCrm` short-circuit, so an unowned id would permanently
+  // cross-link the portal user to another org's CRM person.
+  let resolvedCustomerEntityId = parsed.data.customerEntityId || null
+  if (parsed.data.personEntityId) {
+    const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager
+    const owned = await isOwnedPersonEntity(em, parsed.data.personEntityId, {
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+    })
+    if (!owned) {
+      return NextResponse.json({ ok: false, error: 'Person not found' }, { status: 400 })
+    }
+
+    // An invitation raised from a person card carries only the person FK, and the
+    // accepted user then short-circuits `autoLinkCrm`. Resolve the person's company
+    // here so the user lands with a company scope key: the portal Users page, portal
+    // invitations, and the company detail "Portal users" group all filter on it.
+    if (!resolvedCustomerEntityId) {
+      resolvedCustomerEntityId = await resolveOwnedCompanyForPerson(em, parsed.data.personEntityId, {
+        tenantId: auth.tenantId,
+        organizationId: auth.orgId,
+      })
+    }
+  }
+
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation } = await customerInvitationService.createInvitation(
+  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId!, organizationId: auth.orgId! },
     {
-      customerEntityId: parsed.data.customerEntityId || null,
+      customerEntityId: resolvedCustomerEntityId,
+      personEntityId: parsed.data.personEntityId || null,
       roleIds: parsed.data.roleIds,
-      invitedByUserId: auth.sub,
+      invitedByUserId: resolveInvitedByUserId(auth),
       displayName: parsed.data.displayName || null,
     },
   )
 
+  try {
+    await sendCustomerInvitationEmail({
+      container,
+      organizationId: auth.orgId!,
+      email: invitation.email,
+      rawToken,
+    })
+  } catch (error) {
+    logger.error('Invitation email failed', { err: error })
+    try {
+      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
+    } catch (rollbackError) {
+      logger.error('Invitation rollback failed', { err: rollbackError })
+    }
+    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
+  }
+
+  // Emit only after the email is sent, so a subscriber observing "invited" can
+  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -78,6 +149,10 @@ export async function POST(req: Request) {
     invitation: {
       id: invitation.id,
       email: invitation.email,
+      // Echo the stored CRM links so the caller can see which company the person
+      // invite resolved to. The token stays unexposed.
+      customerEntityId: invitation.customerEntityId || null,
+      personEntityId: invitation.personEntityId || null,
       expiresAt: invitation.expiresAt,
     },
   }, { status: 201 })
@@ -88,6 +163,8 @@ const successSchema = z.object({
   invitation: z.object({
     id: z.string().uuid(),
     email: z.string(),
+    customerEntityId: z.string().uuid().nullable(),
+    personEntityId: z.string().uuid().nullable(),
     expiresAt: z.string().datetime(),
   }),
 })
@@ -104,6 +181,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
+    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/api/invitations/accept.ts

@@ -39,11 +39,10 @@ export async function POST(req: Request) {
   }
 
   const { user, invitation } = result
-  const acl = await customerRbacService.loadAcl(user.id, {
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
-  const resolvedFeatures = acl.features
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/login.ts

@@ -116,8 +116,10 @@ export async function POST(req: Request) {
     await resetAuthRateLimit(compoundKey, customerLoginRateLimitConfig)
   }
 
-  const acl = await customerRbacService.loadAcl(user.id, { tenantId, organizationId: user.organizationId })
-  const resolvedFeatures = acl.features
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId,
+    organizationId: user.organizationId,
+  })
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/magic-link/verify.ts

@@ -52,8 +52,10 @@ export async function POST(req: Request) {
   await customerUserService.resetFailedAttempts(user)
   await customerUserService.updateLastLoginAt(user)
 
-  const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
-  const resolvedFeatures = acl.features
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId: user.tenantId,
+    organizationId: user.organizationId,
+  })
 
   const ip = getClientIp(req, 0)
   const userAgent = req.headers.get('user-agent') || null

package/src/modules/customer_accounts/api/portal/feature-check.ts

@@ -4,7 +4,7 @@ import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib
 import { getCustomerAuthFromRequest } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
-import { matchFeature } from '@open-mercato/shared/lib/auth/featureMatch'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -32,12 +32,10 @@ export async function POST(req: Request) {
     tenantId: auth.tenantId,
     organizationId: auth.orgId,
   })
-
-  const granted = acl.isPortalAdmin
-    ? [...body.features]
-    : body.features.filter((feature) =>
-        acl.features.some((g) => matchFeature(feature, g)),
-      )
+  const granted = body.features.filter((feature) => authorizeFeatures([feature], {
+    grantedFeatures: acl.features,
+    unrestricted: acl.isPortalAdmin,
+  }))
 
   return NextResponse.json({ ok: true, granted })
 }

package/src/modules/customer_accounts/api/portal/nav.ts

@@ -51,13 +51,15 @@ export async function GET(req: Request) {
   }
 
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId, organizationId: auth.orgId })
-  const grantedFeatures = acl.isPortalAdmin ? ['*'] : acl.features
+  const grantedFeatures = await rbac.getEffectiveFeatures(auth.sub, {
+    tenantId: auth.tenantId,
+    organizationId: auth.orgId,
+  })
 
   const groups = buildPortalNav({
     routes: getFrontendRouteManifests(),
     orgSlug,
     grantedFeatures,
-    isPortalAdmin: acl.isPortalAdmin,
   })
 
   return NextResponse.json({
@@ -72,7 +74,7 @@ export async function GET(req: Request) {
 const getMethodDoc: OpenApiMethodDoc = {
   summary: 'Portal sidebar navigation',
   description:
-    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against the customer\'s grants (wildcards honored).',
+    'Returns the portal sidebar for the authenticated customer. Items are derived from each portal page\'s `nav` metadata and filtered by `requireCustomerFeatures` against concrete effective features.',
   tags: ['Customer Portal'],
   responses: [{ status: 200, description: 'Portal sidebar groups', schema: navResponseSchema }],
   errors: [

package/src/modules/customer_accounts/api/portal/profile.ts

@@ -27,6 +27,10 @@ export async function GET(req: Request) {
   }
 
   const acl = await customerRbacService.loadAcl(user.id, { tenantId: user.tenantId, organizationId: user.organizationId })
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
+    tenantId: user.tenantId,
+    organizationId: user.organizationId,
+  })
 
   const userRoles = await em.find(CustomerUserRole, {
     user: user.id as any,
@@ -52,7 +56,7 @@ export async function GET(req: Request) {
       createdAt: user.createdAt,
     },
     roles,
-    resolvedFeatures: acl.features,
+    resolvedFeatures,
     isPortalAdmin: acl.isPortalAdmin,
   })
 }

package/src/modules/customer_accounts/api/portal/sessions-refresh.ts

@@ -36,17 +36,17 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: false, error: 'Account not active' }, { status: 401 })
   }
 
-  const acl = await customerRbacService.loadAcl(user.id, {
+  const resolvedFeatures = await customerRbacService.getEffectiveFeatures(user.id, {
     tenantId: user.tenantId,
     organizationId: user.organizationId,
   })
 
-  const result = await customerSessionService.refreshSession(decodedToken, acl.features)
+  const result = await customerSessionService.refreshSession(decodedToken, resolvedFeatures)
   if (!result) {
     return NextResponse.json({ ok: false, error: 'Session refresh failed' }, { status: 401 })
   }
 
-  const res = NextResponse.json({ ok: true, resolvedFeatures: acl.features })
+  const res = NextResponse.json({ ok: true, resolvedFeatures })
 
   res.cookies.set('customer_auth_token', result.jwt, {
     httpOnly: true,

package/src/modules/customer_accounts/api/portal/users-invite.ts

@@ -16,6 +16,10 @@ import {
   customerInviteIpRateLimitConfig,
 } from '@open-mercato/core/modules/customer_accounts/lib/rateLimiter'
 import { readNormalizedEmailFromJsonRequest } from '@open-mercato/core/modules/customer_accounts/lib/rateLimitIdentifier'
+import { sendCustomerInvitationEmail } from '@open-mercato/core/modules/customer_accounts/lib/invitationEmail'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('customer_accounts').child({ component: 'portal-users-invite' })
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -90,7 +94,7 @@ export async function POST(req: Request) {
 
   const customerInvitationService = container.resolve('customerInvitationService') as CustomerInvitationService
 
-  const { invitation } = await customerInvitationService.createInvitation(
+  const { invitation, rawToken, rollbackState } = await customerInvitationService.createInvitation(
     parsed.data.email,
     { tenantId: auth.tenantId, organizationId: auth.orgId },
     {
@@ -101,6 +105,25 @@ export async function POST(req: Request) {
     },
   )
 
+  try {
+    await sendCustomerInvitationEmail({
+      container,
+      organizationId: auth.orgId,
+      email: invitation.email,
+      rawToken,
+    })
+  } catch (error) {
+    logger.error('Invitation email failed', { err: error })
+    try {
+      await customerInvitationService.rollbackInvitation(invitation, rollbackState)
+    } catch (rollbackError) {
+      logger.error('Invitation rollback failed', { err: rollbackError })
+    }
+    return NextResponse.json({ ok: false, error: 'Invitation email could not be sent' }, { status: 502 })
+  }
+
+  // Emit only after the email is sent, so a subscriber observing "invited" can
+  // assume the recipient was actually notified (no event fires on the 502 path).
   void emitCustomerAccountsEvent('customer_accounts.user.invited', {
     invitationId: invitation.id,
     email: invitation.email,
@@ -141,6 +164,7 @@ const methodDoc: OpenApiMethodDoc = {
     { status: 401, description: 'Not authenticated', schema: errorSchema },
     { status: 403, description: 'Insufficient permissions or non-assignable role', schema: errorSchema },
     { status: 429, description: 'Too many invitation requests', schema: rateLimitErrorSchema },
+    { status: 502, description: 'Invitation email could not be sent', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/backend/customer_accounts/roles/page.tsx

@@ -1,6 +1,7 @@
 "use client"
 
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/customer_accounts/extension-points'
 import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { Page, PageBody } from '@open-mercato/ui/backend/Page'
@@ -213,7 +214,7 @@ export default function CustomerRolesPage() {
           searchValue={search}
           onSearchChange={(value) => { setSearch(value); setPage(1) }}
           searchPlaceholder={t('customer_accounts.admin.roles.searchPlaceholder', 'Search roles...')}
-          perspective={{ tableId: 'customer_accounts.admin.roles' }}
+          perspective={{ tableId: extensionPoints.hosts.rolesTable.tableId }}
           emptyState={(
             <ListEmptyState
               entityName={t('customer_accounts.admin.roles.title', 'Customer Roles')}