@open-mercato/core 0.6.7 → 0.6.8-develop.6874.1.982d6097d8

package/src/modules/customers/migrations/Migration20260723210000_customers.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260723210000_customers extends Migration {
+
+  override up(): void | Promise<void> {
+    this.addSql(`alter table "customer_deal_people" add "is_primary" boolean not null default false;`);
+    this.addSql(`create unique index "customer_deal_people_primary_uq" on "customer_deal_people" ("deal_id") where "is_primary";`);
+  }
+
+  override down(): void | Promise<void> {
+    this.addSql(`drop index "customer_deal_people_primary_uq";`);
+    this.addSql(`alter table "customer_deal_people" drop column "is_primary";`);
+  }
+
+}

package/src/modules/customers/search.ts

@@ -6,6 +6,8 @@ import type {
   SearchResultLink,
   SearchIndexSource,
 } from '@open-mercato/shared/modules/search'
+import type { TranslateFn } from '@open-mercato/shared/lib/i18n/context'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CUSTOMER_INTERACTION_TASK_SOURCE, EXAMPLE_TODO_SOURCE } from './lib/interactionCompatibility'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
@@ -480,6 +482,7 @@ function ensureFallbackLines(lines: string[], record: Record<string, unknown>, o
 // =============================================================================
 
 function resolvePersonPresenter(
+  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -495,7 +498,7 @@ function resolvePersonPresenter(
     (nameParts.length ? nameParts : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    'Person'
+    translate('customers.search.fallback.person', 'Person')
   const subtitlePieces: string[] = []
   const jobTitle = record.job_title ?? record.jobTitle ?? customFields.job_title ?? customFields.jobTitle
   if (jobTitle) subtitlePieces.push(String(jobTitle))
@@ -515,11 +518,14 @@ function resolvePersonPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'user',
-    badge: pickValue(entity, 'display_name', 'displayName') ? 'Person' : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName')
+      ? translate('customers.search.badge.person', 'Person')
+      : undefined,
   }
 }
 
 function resolveCompanyPresenter(
+  translate: TranslateFn,
   record: Record<string, unknown>,
   entity: Record<string, unknown> | null,
   customFields: Record<string, unknown>,
@@ -537,7 +543,7 @@ function resolveCompanyPresenter(
     (entity?.id && entity?.display_name ? entity.display_name as string : undefined) ??
     fallbackEntityId ??
     (record.id as string | undefined) ??
-    'Company'
+    translate('customers.search.fallback.company', 'Company')
   const subtitlePieces: string[] = []
   const industry = record.industry
   if (industry) subtitlePieces.push(String(industry))
@@ -567,7 +573,9 @@ function resolveCompanyPresenter(
     title: String(title),
     subtitle: subtitlePieces.length ? subtitlePieces.join(' · ') : undefined,
     icon: 'building',
-    badge: pickValue(entity, 'display_name', 'displayName') ? 'Company' : undefined,
+    badge: pickValue(entity, 'display_name', 'displayName')
+      ? translate('customers.search.badge.company', 'Company')
+      : undefined,
   }
 }
 
@@ -605,6 +613,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Preferred name', record.preferred_name ?? record.preferredName ?? ctx.customFields.preferred_name)
@@ -643,9 +652,9 @@ export const searchConfig: SearchModuleConfig = {
           })
         }
 
-        const presenter = resolvePersonPresenter(record, entity, ctx.customFields)
+        const presenter = resolvePersonPresenter(t, record, entity, ctx.customFields)
         logMissingPresenterTitle('person', record, entity, presenter)
-        const presenterLabel = pickLabel(presenter.title) ?? 'Open person'
+        const presenterLabel = pickLabel(presenter.title) ?? t('customers.search.link.openPerson', 'Open person')
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('person', entityId)
@@ -669,8 +678,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolvePersonPresenter(ctx.record, entity, ctx.customFields)
+        return resolvePersonPresenter(t, ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -679,11 +689,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('person', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -714,6 +725,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Legal name', record.legal_name ?? record.legalName ?? ctx.customFields.legal_name)
@@ -734,9 +746,9 @@ export const searchConfig: SearchModuleConfig = {
         ensureFallbackLines(lines, record)
         if (!lines.length) return null
 
-        const presenter = resolveCompanyPresenter(record, entity, ctx.customFields)
+        const presenter = resolveCompanyPresenter(t, record, entity, ctx.customFields)
         logMissingPresenterTitle('company', record, entity, presenter)
-        const primaryLabel = pickLabel(presenter.title) ?? 'Open company'
+        const primaryLabel = pickLabel(presenter.title) ?? t('customers.search.link.openCompany', 'Open company')
         const links: SearchResultLink[] = []
         if (entityId) {
           const href = buildCustomerUrl('company', entityId)
@@ -760,8 +772,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const entity = await getCustomerEntity(ctx, resolveCustomerEntityId(ctx.record))
-        return resolveCompanyPresenter(ctx.record, entity, ctx.customFields)
+        return resolveCompanyPresenter(t, ctx.record, entity, ctx.customFields)
       },
 
       resolveUrl: async (ctx: SearchBuildContext): Promise<string | null> => {
@@ -770,11 +783,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const entityId = resolveCustomerEntityId(ctx.record)
         if (!entityId) return null
         const href = buildCustomerUrl('company', entityId)
         if (!href) return null
-        return [{ href: `${href}/edit`, label: 'Edit', kind: 'secondary' }]
+        return [{ href: `${href}/edit`, label: t('customers.search.link.edit', 'Edit'), kind: 'secondary' }]
       },
 
       fieldPolicy: {
@@ -832,8 +846,9 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
-        const title = (parent?.display_name as string | undefined) ?? 'Customer note'
+        const title = (parent?.display_name as string | undefined) ?? t('customers.search.fallback.customerNote', 'Customer note')
         return {
           title,
           subtitle: snippet(ctx.record.body),
@@ -850,15 +865,16 @@ export const searchConfig: SearchModuleConfig = {
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const parentUrl = buildCustomerUrl(parent?.kind as string ?? null, (parent?.id ?? ctx.record.entity_id ?? ctx.record.entityId) as string)
         if (parentUrl) {
-          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? 'View customer', kind: 'primary' })
+          links.push({ href: parentUrl, label: (parent?.display_name as string | undefined) ?? t('customers.search.link.viewCustomer', 'View customer'), kind: 'primary' })
         }
         if (ctx.record.deal_id) {
           const dealUrl = `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`
-          links.push({ href: dealUrl, label: 'Open deal', kind: 'secondary' })
+          links.push({ href: dealUrl, label: t('customers.search.link.openDeal', 'Open deal'), kind: 'secondary' })
         }
         return links.length ? links : null
       },
@@ -880,6 +896,7 @@ export const searchConfig: SearchModuleConfig = {
       priority: 8,
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
+        const { t } = await resolveTranslations()
         const lines: string[] = []
         const record = ctx.record
         appendLine(lines, 'Title', record.title)
@@ -898,10 +915,10 @@ export const searchConfig: SearchModuleConfig = {
         return {
           text: lines,
           presenter: {
-            title: String(record.title ?? 'Deal'),
+            title: String(record.title ?? t('customers.search.fallback.deal', 'Deal')),
             subtitle: subtitleParts.join(' · ') || undefined,
             icon: 'briefcase',
-            badge: 'Deal',
+            badge: t('customers.search.badge.deal', 'Deal'),
           },
           checksumSource: {
             title: record.title,
@@ -913,8 +930,9 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
+        const { t } = await resolveTranslations()
         const { record } = ctx
-        const title = pickString(record.title as string, 'Deal')
+        const title = pickString(record.title as string, t('customers.search.fallback.deal', 'Deal'))
         const subtitleParts: string[] = []
         if (record.pipeline_stage) subtitleParts.push(String(record.pipeline_stage))
         if (record.status) subtitleParts.push(String(record.status))
@@ -925,10 +943,10 @@ export const searchConfig: SearchModuleConfig = {
         }
 
         return {
-          title: title ?? 'Deal',
+          title: title ?? t('customers.search.fallback.deal', 'Deal'),
           subtitle: subtitleParts.length ? subtitleParts.join(' · ') : undefined,
           icon: 'briefcase',
-          badge: 'Deal',
+          badge: t('customers.search.badge.deal', 'Deal'),
         }
       },
 
@@ -939,12 +957,13 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const id = ctx.record.id
         if (!id) return null
         return [
           {
             href: `/backend/customers/deals/${encodeURIComponent(String(id))}/edit`,
-            label: 'Edit',
+            label: t('customers.search.link.edit', 'Edit'),
             kind: 'secondary',
           },
         ]
@@ -968,6 +987,7 @@ export const searchConfig: SearchModuleConfig = {
 
       buildSource: async (ctx: SearchBuildContext): Promise<SearchIndexSource | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         const lines: string[] = []
         if (parent?.display_name) lines.push(`Customer: ${parent.display_name}`)
@@ -976,7 +996,11 @@ export const searchConfig: SearchModuleConfig = {
         if (ctx.record.body) lines.push(`Body: ${ctx.record.body}`)
 
         const presenter: SearchResultPresenter = {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
+          title: ctx.record.subject
+            ? String(ctx.record.subject)
+            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
+                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
+              }),
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
         }
@@ -995,12 +1019,17 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: ctx.record.subject ? String(ctx.record.subject) : `Activity: ${ctx.record.activity_type ?? 'update'}`,
+          title: ctx.record.subject
+            ? String(ctx.record.subject)
+            : t('customers.search.fallback.activity', 'Activity: {{type}}', {
+                type: String(ctx.record.activity_type ?? t('customers.search.fallback.activityUpdate', 'update')),
+              }),
           subtitle: (parent?.display_name as string | undefined) ?? snippet(ctx.record.body),
           icon: 'bolt',
-          badge: 'Activity',
+          badge: t('customers.search.badge.activity', 'Activity'),
         }
       },
 
@@ -1012,11 +1041,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const links: SearchResultLink[] = []
         if (ctx.record.deal_id) {
           links.push({
             href: `/backend/customers/deals/${encodeURIComponent(ctx.record.deal_id as string)}`,
-            label: 'Open deal',
+            label: t('customers.search.link.openDeal', 'Open deal'),
             kind: 'secondary',
           })
         }
@@ -1064,10 +1094,11 @@ export const searchConfig: SearchModuleConfig = {
 
       formatResult: async (ctx: SearchBuildContext): Promise<SearchResultPresenter | null> => {
         assertTenantContext(ctx)
+        const { t } = await resolveTranslations()
         const todo = await getLinkedTodo(ctx) as Record<string, unknown> | null
         const parent = await getCustomerEntity(ctx, ctx.record.entity_id as string ?? ctx.record.entityId as string)
         return {
-          title: (todo?.title as string | undefined) ?? 'Customer task',
+          title: (todo?.title as string | undefined) ?? t('customers.search.fallback.customerTask', 'Customer task'),
           subtitle: parent?.display_name as string | undefined,
           icon: 'check-square',
         }
@@ -1081,11 +1112,12 @@ export const searchConfig: SearchModuleConfig = {
       },
 
       resolveLinks: async (ctx: SearchBuildContext): Promise<SearchResultLink[] | null> => {
+        const { t } = await resolveTranslations()
         const todoId = ctx.record.todo_id ?? ctx.record.todoId
         if (!todoId) return null
         return [{
           href: `/backend/todos/${encodeURIComponent(todoId as string)}/edit`,
-          label: 'Open todo',
+          label: t('customers.search.link.openTodo', 'Open todo'),
           kind: 'secondary',
         }]
       },

package/src/modules/customers/utils/phoneDuplicates.ts

@@ -22,7 +22,7 @@ export async function lookupPhoneDuplicate(
   for (let page = 1; page <= MAX_PAGES; page += 1) {
     try {
       const url = `/api/customers/people?hasPhone=true&page=${page}&pageSize=${PAGE_SIZE}&sortField=createdAt&sortDir=desc`
-      const call = await apiCall<{ items?: unknown[]; total?: number }>(url)
+      const call = await apiCall<{ items?: unknown[] }>(url)
       if (!call.ok) continue
       const payload = call.result ?? {}
       const items = Array.isArray(payload?.items) ? payload.items : []
@@ -45,8 +45,11 @@ export async function lookupPhoneDuplicate(
           }
         }
       }
-      const total = typeof payload?.total === 'number' ? payload.total : null
-      if (total !== null && page * PAGE_SIZE >= total) {
+      // Short-page termination: a page shorter than requested is the end of the result
+      // set. `total` is a display value and may under-report (capped counts), so it is
+      // no longer consulted. MAX_PAGES stays as the deliberate best-effort bound — this
+      // is a duplicate hint, not an exhaustive check.
+      if (items.length < PAGE_SIZE) {
         break
       }
     } catch {

package/src/modules/dashboards/api/layout/[itemId]/route.ts

@@ -4,7 +4,6 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/entities'
 import { dashboardLayoutItemPatchSchema } from '@open-mercato/core/modules/dashboards/data/validators'
-import { hasFeature } from '@open-mercato/shared/security/features'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -55,8 +54,12 @@ export async function PATCH(req: Request, ctx: { params?: { itemId?: string } })
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
+  const canConfigure = await rbac.userHasAllFeatures(
+    scope.userId,
+    ['dashboards.configure'],
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  if (!canConfigure) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/layout/route.ts

@@ -6,7 +6,7 @@ import { DashboardLayout } from '@open-mercato/core/modules/dashboards/data/enti
 import { dashboardLayoutSchema } from '@open-mercato/core/modules/dashboards/data/validators'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
 import { resolveAllowedWidgetIds } from '@open-mercato/core/modules/dashboards/lib/access'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import { User } from '@open-mercato/core/modules/auth/data/entities'
 import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import {
@@ -88,7 +88,10 @@ export async function GET(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
+  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   const widgets = await loadAllWidgets()
   const allowedIds = await resolveAllowedWidgetIds(
     em,
@@ -96,8 +99,8 @@ export async function GET(req: Request) {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: acl.features ?? [],
-      isSuperAdmin: !!acl.isSuperAdmin,
+      features: effectiveFeatures,
+      isSuperAdmin: false,
     },
     widgets,
   )
@@ -147,7 +150,9 @@ export async function GET(req: Request) {
     await em.flush()
   }
 
-  const canConfigure = acl.isSuperAdmin || hasFeature(acl.features, 'dashboards.configure')
+  const canConfigure = authorizeFeatures(['dashboards.configure'], {
+    grantedFeatures: effectiveFeatures,
+  })
 
   let userEmail: string | null = null
   let userName: string | null = null
@@ -222,8 +227,12 @@ export async function PUT(req: Request) {
     organizationId: auth.orgId ?? null,
   }
 
-  const acl = await rbac.loadAcl(scope.userId, { tenantId: scope.tenantId, organizationId: scope.organizationId })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.configure')) {
+  const canConfigure = await rbac.userHasAllFeatures(
+    scope.userId,
+    ['dashboards.configure'],
+    { tenantId: scope.tenantId, organizationId: scope.organizationId },
+  )
+  if (!canConfigure) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -243,14 +252,18 @@ export async function PUT(req: Request) {
   }
 
   const widgets = await loadAllWidgets()
+  const effectiveFeatures = await rbac.getEffectiveFeatures(scope.userId, {
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  })
   const allowedIds = await resolveAllowedWidgetIds(
     em,
     {
       userId: scope.userId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      features: acl.features ?? [],
-      isSuperAdmin: !!acl.isSuperAdmin,
+      features: effectiveFeatures,
+      isSuperAdmin: false,
     },
     widgets,
   )

package/src/modules/dashboards/api/roles/widgets/route.ts

@@ -10,7 +10,7 @@ import {
   resolveWidgetAssignmentReadScope,
   resolveWidgetAssignmentTargetAccess,
 } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -61,7 +61,10 @@ export async function GET(req: Request) {
   const em = container.resolve('em') as any
   const rbac = container.resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin,
+  })) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -120,7 +123,10 @@ export async function PUT(req: Request) {
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin,
+  })) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/users/widgets/route.ts

@@ -11,7 +11,7 @@ import {
   resolveWidgetAssignmentReadScope,
   resolveWidgetAssignmentTargetAccess,
 } from '@open-mercato/core/modules/dashboards/lib/widgetAssignmentScope'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 import {
   runCrudMutationGuardAfterSuccess,
   validateCrudMutationGuard,
@@ -44,7 +44,10 @@ export async function GET(req: Request) {
   const em = container.resolve('em') as any
   const rbac = container.resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin,
+  })) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 
@@ -120,7 +123,10 @@ export async function PUT(req: Request) {
   const em = resolve('em') as any
   const rbac = resolve('rbacService') as any
   const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, FEATURE)) {
+  if (!authorizeFeatures([FEATURE], {
+    grantedFeatures: acl.features ?? [],
+    unrestricted: !!acl.isSuperAdmin,
+  })) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/widgets/catalog.ts

@@ -2,7 +2,6 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { loadAllWidgets } from '@open-mercato/core/modules/dashboards/lib/widgets'
-import { hasFeature } from '@open-mercato/shared/security/features'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { dashboardsTag, dashboardsErrorSchema, dashboardWidgetCatalogSchema } from '../openapi'
 
@@ -16,8 +15,12 @@ export async function GET(req: Request) {
 
   const { resolve } = await createRequestContainer()
   const rbac = resolve('rbacService') as any
-  const acl = await rbac.loadAcl(auth.sub, { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null })
-  if (!acl.isSuperAdmin && !hasFeature(acl.features, 'dashboards.admin.assign-widgets')) {
+  const canAssignWidgets = await rbac.userHasAllFeatures(
+    auth.sub,
+    ['dashboards.admin.assign-widgets'],
+    { tenantId: auth.tenantId ?? null, organizationId: auth.orgId ?? null },
+  )
+  if (!canAssignWidgets) {
     return NextResponse.json({ error: 'Forbidden' }, { status: 403 })
   }
 

package/src/modules/dashboards/api/widgets/data/batch/route.ts

@@ -9,6 +9,8 @@ import {
   createWidgetDataService,
   type WidgetDataRequest,
   WidgetDataValidationError,
+  WidgetDataScanLimitError,
+  WidgetDataEncryptionUnavailableError,
 } from '../../../../services/widgetDataService'
 import { runWidgetDataBatch } from '../../../../lib/widgetDataBatch'
 import type { AnalyticsRegistry } from '../../../../services/analyticsRegistry'
@@ -16,6 +18,7 @@ import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib
 import { dashboardsTag, dashboardsErrorSchema } from '../../../openapi'
 import { widgetDataRequestSchema, widgetDataResponseSchema } from '../schema'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { resolveOptionalBaseCurrencyResolver } from '../../../../lib/optionalBaseCurrency'
 
 const logger = createLogger('dashboards').child({ component: 'widgets-data-batch' })
 
@@ -102,7 +105,13 @@ export async function POST(req: Request) {
   })()
 
   const cache = container.resolve<CacheStrategy>('cache')
-  const service = createWidgetDataService(em, { tenantId, organizationIds }, analyticsRegistry, cache)
+  const service = createWidgetDataService(
+    em,
+    { tenantId, organizationIds },
+    analyticsRegistry,
+    cache,
+    resolveOptionalBaseCurrencyResolver(container),
+  )
 
   const rbacService = container.resolve<{
     userHasAllFeatures: (
@@ -125,6 +134,8 @@ export async function POST(req: Request) {
       fetchOne: (request) => service.fetchWidgetData(request),
       describeError: (error) =>
         error instanceof WidgetDataValidationError
+        || error instanceof WidgetDataScanLimitError
+        || error instanceof WidgetDataEncryptionUnavailableError
           ? error.message
           : 'An error occurred while processing your request',
     })

package/src/modules/dashboards/api/widgets/data/route.ts

@@ -8,6 +8,8 @@ import {
   createWidgetDataService,
   type WidgetDataRequest,
   WidgetDataValidationError,
+  WidgetDataScanLimitError,
+  WidgetDataEncryptionUnavailableError,
 } from '../../../services/widgetDataService'
 import type { AnalyticsRegistry } from '../../../services/analyticsRegistry'
 import { runApiInterceptorsBefore } from '@open-mercato/shared/lib/crud/interceptor-runner'
@@ -15,6 +17,7 @@ import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib
 import { dashboardsTag, dashboardsErrorSchema } from '../../openapi'
 import { widgetDataRequestSchema, widgetDataResponseSchema } from './schema'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { resolveOptionalBaseCurrencyResolver } from '../../../lib/optionalBaseCurrency'
 
 const logger = createLogger('dashboards').child({ component: 'widgets-data' })
 
@@ -121,7 +124,13 @@ export async function POST(req: Request) {
 
   try {
     const cache = container.resolve<CacheStrategy>('cache')
-    const service = createWidgetDataService(em, { tenantId, organizationIds }, analyticsRegistry, cache)
+    const service = createWidgetDataService(
+      em,
+      { tenantId, organizationIds },
+      analyticsRegistry,
+      cache,
+      resolveOptionalBaseCurrencyResolver(container),
+    )
     const result = await service.fetchWidgetData(requestData)
     return NextResponse.json(result)
   } catch (err) {
@@ -129,6 +138,15 @@ export async function POST(req: Request) {
     if (err instanceof WidgetDataValidationError) {
       return NextResponse.json({ error: err.message }, { status: 400 })
     }
+    // The dataset is too large to group in application code; surface why rather than a masked 500.
+    if (err instanceof WidgetDataScanLimitError) {
+      return NextResponse.json({ error: err.message }, { status: 422 })
+    }
+    // Encryption is configured but currently unresolvable. Refusing the request keeps ciphertext and
+    // silently-wrong buckets out of the response, and 503 tells the client it is worth retrying.
+    if (err instanceof WidgetDataEncryptionUnavailableError) {
+      return NextResponse.json({ error: err.message }, { status: 503 })
+    }
     return NextResponse.json(
       { error: 'An error occurred while processing your request' },
       { status: 500 },
@@ -156,8 +174,18 @@ const widgetDataPostDoc: OpenApiMethodDoc = {
   errors: [
     { status: 400, description: 'Invalid request payload', schema: dashboardsErrorSchema },
     { status: 401, description: 'Authentication required', schema: dashboardsErrorSchema },
+    {
+      status: 422,
+      description: 'Too many rows to group an encrypted field in application code',
+      schema: dashboardsErrorSchema,
+    },
     { status: 403, description: 'Missing analytics.view feature', schema: dashboardsErrorSchema },
     { status: 500, description: 'Internal server error', schema: dashboardsErrorSchema },
+    {
+      status: 503,
+      description: 'Encryption is configured but the group source cannot currently be resolved',
+      schema: dashboardsErrorSchema,
+    },
   ],
 }