@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/customer_accounts/lib/customerEntityOwnership.ts

@@ -20,16 +20,82 @@ export async function isOwnedCompanyEntity(
   em: EntityManager,
   customerEntityId: string,
   scope: CustomerEntityScope,
+): Promise<boolean> {
+  return isOwnedEntityOfKind(em, customerEntityId, 'company', scope)
+}
+
+/**
+ * Confirms that a caller-supplied `personEntityId` (the CRM person FK linked
+ * onto a customer user) exists, is a person, is not soft-deleted, and belongs
+ * to the caller's tenant and organization.
+ *
+ * This is the symmetric guard to {@link isOwnedCompanyEntity}: the person FK is
+ * copied onto the customer user on accept and short-circuits CRM auto-linking,
+ * so an unvalidated id would permanently cross-link a portal user to another
+ * org's person (the #4362/#2693 class of bug, on the person side).
+ */
+export async function isOwnedPersonEntity(
+  em: EntityManager,
+  personEntityId: string,
+  scope: CustomerEntityScope,
+): Promise<boolean> {
+  return isOwnedEntityOfKind(em, personEntityId, 'person', scope)
+}
+
+/**
+ * Resolves the CRM company a person belongs to, but only when both the profile
+ * lookup and the company itself stay inside the given tenant/organization scope.
+ * Returns null when the person has no company or that company is out of scope.
+ *
+ * Both the invite route and the CRM auto-link subscriber need this answer, and
+ * both write the result into `customerEntityId` — the portal company scope key —
+ * so they must agree on what counts as an in-scope company.
+ */
+export async function resolveOwnedCompanyForPerson(
+  em: EntityManager,
+  personEntityId: string,
+  scope: CustomerEntityScope,
+): Promise<string | null> {
+  const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')
+  const profile = await em.findOne(CustomerPersonProfile as any, {
+    entity: personEntityId,
+    tenantId: scope.tenantId,
+    organizationId: scope.organizationId,
+  } as any)
+  const candidate = readCompanyEntityId(profile)
+  if (!candidate) return null
+  return (await isOwnedCompanyEntity(em, candidate, scope)) ? candidate : null
+}
+
+/**
+ * `CustomerPersonProfile.company` is a relation on `company_entity_id`, not a
+ * scalar — MikroORM hands back either the raw id or an entity reference, never a
+ * `companyEntityId` property. Reading the wrong one silently yields undefined and
+ * turns every company recovery into a clear.
+ */
+function readCompanyEntityId(profile: unknown): string | null {
+  const company = (profile as { company?: unknown } | null | undefined)?.company
+  if (!company) return null
+  if (typeof company === 'string') return company
+  const id = (company as { id?: unknown }).id
+  return typeof id === 'string' ? id : null
+}
+
+async function isOwnedEntityOfKind(
+  em: EntityManager,
+  entityId: string,
+  kind: 'company' | 'person',
+  scope: CustomerEntityScope,
 ): Promise<boolean> {
   const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
   const entity = await findOneWithDecryption(
     em,
     CustomerEntity,
     {
-      id: customerEntityId,
+      id: entityId,
       tenantId: scope.tenantId,
       organizationId: scope.organizationId,
-      kind: 'company',
+      kind,
       deletedAt: null,
     } as any,
     undefined,

package/src/modules/customer_accounts/lib/customerUrl.ts

@@ -5,6 +5,8 @@
 
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { Organization } from '@open-mercato/core/modules/directory/data/entities'
+import type { EntityManager } from '@mikro-orm/postgresql'
 
 type DomainMappingService = {
   resolveActiveByOrg(orgId: string): Promise<{ hostname: string } | null>
@@ -14,6 +16,10 @@ type OrgService = {
   findById(orgId: string): Promise<{ id: string; slug: string | null } | null>
 }
 
+type EntityManagerResolver = {
+  resolve(name: 'em'): EntityManager
+}
+
 function platformBaseUrl(): string {
   const fromEnv = process.env.PLATFORM_PORTAL_BASE_URL?.trim()
   if (fromEnv && fromEnv.length > 0) return fromEnv.replace(/\/+$/, '')
@@ -32,6 +38,26 @@ function resolveContainer(container?: AppContainer): Promise<AppContainer> {
   return createRequestContainer()
 }
 
+async function resolveOrgSlug(container: AppContainer, orgId: string): Promise<string | null> {
+  try {
+    const orgService = container.resolve('orgService') as OrgService | undefined
+    if (orgService && typeof orgService.findById === 'function') {
+      const org = await orgService.findById(orgId)
+      return org?.slug ?? null
+    }
+  } catch {
+    // orgService is optional in standalone/runtime contexts — fall through to EntityManager.
+  }
+
+  try {
+    const em = (container as AppContainer & EntityManagerResolver).resolve('em')
+    const org = await em.findOne(Organization, { id: orgId, deletedAt: null })
+    return org?.slug ?? null
+  } catch {
+    return null
+  }
+}
+
 export async function urlForCustomerOrg(
   orgId: string,
   path: string,
@@ -55,17 +81,7 @@ export async function urlForCustomerOrg(
     return `https://${active.hostname}${safePath}`
   }
 
-  let orgSlug: string | null = null
-  try {
-    const orgService = container.resolve('orgService') as OrgService | undefined
-    if (orgService && typeof orgService.findById === 'function') {
-      const org = await orgService.findById(orgId)
-      orgSlug = org?.slug ?? null
-    }
-  } catch {
-    orgSlug = null
-  }
-
+  const orgSlug = await resolveOrgSlug(container, orgId)
   const base = platformBaseUrl()
   if (orgSlug) return `${base}/${orgSlug}/portal${safePath}`
   return `${base}${safePath}`

package/src/modules/customer_accounts/lib/invitationEmail.ts

@@ -0,0 +1,42 @@
+import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { sendEmail } from '@open-mercato/shared/lib/email/send'
+import CustomerInvitationEmail from '@open-mercato/core/modules/customer_accounts/emails/CustomerInvitationEmail'
+import { urlForCustomerOrg } from '@open-mercato/core/modules/customer_accounts/lib/customerUrl'
+
+export type CustomerInvitationEmailInput = {
+  container: AppContainer
+  organizationId: string
+  email: string
+  rawToken: string
+}
+
+export async function sendCustomerInvitationEmail(input: CustomerInvitationEmailInput): Promise<void> {
+  const { translate } = await resolveTranslations()
+  const inviteUrl = await urlForCustomerOrg(
+    input.organizationId,
+    `/invite?token=${encodeURIComponent(input.rawToken)}`,
+    { container: input.container },
+  )
+
+  const subject = translate('customer_accounts.invitation.email.subject', 'You have been invited to the customer portal')
+  const copy = {
+    preview: translate('customer_accounts.invitation.email.preview', 'Accept your invitation to finish setting up portal access.'),
+    title: translate('customer_accounts.invitation.email.title', 'You have been invited'),
+    body: translate(
+      'customer_accounts.invitation.email.body',
+      'Use this secure invitation link to create your password and access the customer portal.',
+    ),
+    cta: translate('customer_accounts.invitation.email.cta', 'Accept invitation'),
+    hint: translate(
+      'customer_accounts.invitation.email.hint',
+      'This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.',
+    ),
+  }
+
+  await sendEmail({
+    to: input.email,
+    subject,
+    react: CustomerInvitationEmail({ inviteUrl, copy }),
+  })
+}

package/src/modules/customer_accounts/migrations/.snapshot-open-mercato.json

@@ -923,6 +923,22 @@
           "enumItems": [],
           "mappedType": "uuid"
         },
+        "person_entity_id": {
+          "name": "person_entity_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "unique": false,
+          "length": null,
+          "precision": null,
+          "scale": null,
+          "default": null,
+          "comment": null,
+          "enumItems": [],
+          "mappedType": "uuid"
+        },
         "role_ids_json": {
           "name": "role_ids_json",
           "type": "jsonb",

package/src/modules/customer_accounts/migrations/Migration20260723120000_customer_accounts.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260723120000_customer_accounts extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "customer_user_invitations" add column "person_entity_id" uuid null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`alter table "customer_user_invitations" drop column "person_entity_id";`);
+  }
+
+}

package/src/modules/customer_accounts/services/customerInvitationService.ts

@@ -13,6 +13,18 @@ import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/
 const BCRYPT_COST = 10
 const INVITATION_TTL_MS = 72 * 60 * 60 * 1000 // 72 hours
 
+export type CustomerInvitationRollbackState = {
+  email: string
+  token: string
+  customerEntityId: string | null
+  personEntityId: string | null
+  roleIdsJson: string[]
+  invitedByUserId: string | null
+  invitedByCustomerUserId: string | null
+  displayName: string | null
+  expiresAt: Date
+}
+
 export class CustomerInvitationService {
   constructor(private em: EntityManager) {}
 
@@ -21,12 +33,18 @@ export class CustomerInvitationService {
     scope: { tenantId: string; organizationId: string },
     options: {
       customerEntityId?: string | null
+      personEntityId?: string | null
       roleIds: string[]
       invitedByUserId?: string | null
       invitedByCustomerUserId?: string | null
       displayName?: string | null
     },
-  ): Promise<{ invitation: CustomerUserInvitation; rawToken: string }> {
+  ): Promise<{
+    invitation: CustomerUserInvitation
+    rawToken: string
+    reused: boolean
+    rollbackState: CustomerInvitationRollbackState | null
+  }> {
     const token = generateSecureToken()
     const emailHash = hashForLookup(email)
     const normalizedEmail = email.toLowerCase().trim()
@@ -53,16 +71,28 @@ export class CustomerInvitationService {
     )
 
     if (existing) {
+      const rollbackState: CustomerInvitationRollbackState = {
+        email: existing.email,
+        token: existing.token,
+        customerEntityId: existing.customerEntityId ?? null,
+        personEntityId: existing.personEntityId ?? null,
+        roleIdsJson: [...(existing.roleIdsJson ?? [])],
+        invitedByUserId: existing.invitedByUserId ?? null,
+        invitedByCustomerUserId: existing.invitedByCustomerUserId ?? null,
+        displayName: existing.displayName ?? null,
+        expiresAt: new Date(existing.expiresAt),
+      }
       existing.email = normalizedEmail
       existing.token = tokenHashed
       existing.customerEntityId = options.customerEntityId || null
+      existing.personEntityId = options.personEntityId || null
       existing.roleIdsJson = options.roleIds
       existing.invitedByUserId = options.invitedByUserId || null
       existing.invitedByCustomerUserId = options.invitedByCustomerUserId || null
       existing.displayName = options.displayName || null
       existing.expiresAt = expiresAt
       await this.em.flush()
-      return { invitation: existing, rawToken: token }
+      return { invitation: existing, rawToken: token, reused: true, rollbackState }
     }
 
     const invitation = this.em.create(CustomerUserInvitation, {
@@ -72,6 +102,7 @@ export class CustomerInvitationService {
       emailHash,
       token: tokenHashed,
       customerEntityId: options.customerEntityId || null,
+      personEntityId: options.personEntityId || null,
       roleIdsJson: options.roleIds,
       invitedByUserId: options.invitedByUserId || null,
       invitedByCustomerUserId: options.invitedByCustomerUserId || null,
@@ -80,7 +111,28 @@ export class CustomerInvitationService {
       createdAt: new Date(),
     } as any) as CustomerUserInvitation
     await this.em.persist(invitation).flush()
-    return { invitation, rawToken: token }
+    return { invitation, rawToken: token, reused: false, rollbackState: null }
+  }
+
+  async rollbackInvitation(
+    invitation: CustomerUserInvitation,
+    rollbackState: CustomerInvitationRollbackState | null,
+  ): Promise<void> {
+    if (!rollbackState) {
+      await this.em.remove(invitation).flush()
+      return
+    }
+
+    invitation.email = rollbackState.email
+    invitation.token = rollbackState.token
+    invitation.customerEntityId = rollbackState.customerEntityId
+    invitation.personEntityId = rollbackState.personEntityId
+    invitation.roleIdsJson = [...rollbackState.roleIdsJson]
+    invitation.invitedByUserId = rollbackState.invitedByUserId
+    invitation.invitedByCustomerUserId = rollbackState.invitedByCustomerUserId
+    invitation.displayName = rollbackState.displayName
+    invitation.expiresAt = new Date(rollbackState.expiresAt)
+    await this.em.flush()
   }
 
   async findByToken(token: string): Promise<CustomerUserInvitation | null> {
@@ -117,6 +169,7 @@ export class CustomerInvitationService {
       tenantId: invitation.tenantId,
       organizationId: invitation.organizationId,
       customerEntityId: invitation.customerEntityId || null,
+      personEntityId: invitation.personEntityId || null,
       isActive: true,
       emailVerifiedAt: new Date(), // Invitation implicitly verifies email
       failedLoginAttempts: 0,

package/src/modules/customer_accounts/services/customerRbacService.ts

@@ -5,7 +5,10 @@ import {
   CustomerRoleAcl,
   CustomerUserRole,
 } from '@open-mercato/core/modules/customer_accounts/data/entities'
-import { hasAllFeatures } from '@open-mercato/shared/lib/auth/featureMatch'
+import {
+  authorizeFeatures,
+  resolveEffectiveFeatures,
+} from '@open-mercato/shared/security/featurePolicy'
 
 interface CustomerAclData {
   isPortalAdmin: boolean
@@ -129,8 +132,18 @@ export class CustomerRbacService {
   ): Promise<boolean> {
     if (!required.length) return true
     const acl = await this.loadAcl(userId, scope)
-    if (acl.isPortalAdmin) return true
-    return hasAllFeatures(required, acl.features)
+    return authorizeFeatures(required, {
+      grantedFeatures: acl.features,
+      unrestricted: acl.isPortalAdmin,
+    })
+  }
+
+  async getEffectiveFeatures(
+    userId: string,
+    scope: { tenantId: string; organizationId: string },
+  ): Promise<string[]> {
+    const acl = await this.loadAcl(userId, scope)
+    return resolveEffectiveFeatures(acl.isPortalAdmin ? ['portal.*'] : acl.features)
   }
 
   async invalidateUserCache(userId: string): Promise<void> {

package/src/modules/customer_accounts/setup.ts

@@ -137,6 +137,10 @@ const DEFAULT_ROLES = [
   },
 ]
 
+const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
+  DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),
+)
+
 /**
  * Collect defaultCustomerRoleFeatures from all enabled modules and merge
  * them into the corresponding CustomerRoleAcl records.
@@ -220,6 +224,9 @@ export const setup: ModuleSetupConfig = {
     superadmin: ['customer_accounts.*'],
     admin: ['customer_accounts.*'],
   },
+  // Keep the portal feature catalog declarative so the shared feature policy
+  // can project portal.* into concrete capabilities without importing core.
+  defaultCustomerRoleFeatures: DEFAULT_CUSTOMER_ROLE_FEATURES,
 
   async onTenantCreated({ em, tenantId, organizationId }) {
     await seedDefaultRoles(em, { tenantId, organizationId })

package/src/modules/customer_accounts/subscribers/autoLinkCrm.ts

@@ -1,6 +1,7 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { CustomerUser } from '@open-mercato/core/modules/customer_accounts/data/entities'
 import { findWithDecryption, findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveOwnedCompanyForPerson } from '@open-mercato/core/modules/customer_accounts/lib/customerEntityOwnership'
 import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('customer_accounts').child({ component: 'auto-link-crm' })
@@ -26,17 +27,81 @@ export default async function handle(
   try {
     const user = await findOneWithDecryption(em, CustomerUser, { id: userId, tenantId, deletedAt: null }, undefined, { tenantId, organizationId })
     if (!user) return
-    if (user.personEntityId) return
+
+    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
+
+    // Every lookup and write below normalizes against the user's OWN org, not just
+    // the tenant: customerEntityId is the portal's company scope key (portal user
+    // and invite routes filter on it), so adopting an entity from another org would
+    // widen the user's portal access instead of repairing it.
+    const ownScope = { tenantId, organizationId: user.organizationId }
+
+    // Defensive normalization for NEW users only — this subscriber runs on
+    // `customer_accounts.user.created`, which is never re-emitted for an existing
+    // row. customerEntityId is the CRM company FK, and earlier invite flows (#4362)
+    // could poison it with a person entity id, which then breaks every later user
+    // edit ("Company not found"). If the linked entity is a person (not a company)
+    // or sits outside the user's org, drop it — or recover the person's real company
+    // from their profile. Correct company links are left untouched. Rows created
+    // before this change keep their bad FK; see #4473 for the backfill.
+    if (user.customerEntityId) {
+      const linked = await findOneWithDecryption(
+        em,
+        CustomerEntity,
+        { id: user.customerEntityId, tenantId, organizationId: user.organizationId, deletedAt: null } as any,
+        undefined,
+        { tenantId, organizationId },
+      ) as any
+      if (!linked) {
+        // Not resolvable inside the user's own org — a cross-org (or deleted)
+        // entity. Clear it rather than leave it: this FK is the portal scope key.
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: null },
+        )
+        user.customerEntityId = null
+      } else if (linked.kind === 'person') {
+        // Only adopt a recovered company that is itself in the user's org.
+        const replacement = await resolveOwnedCompanyForPerson(em, user.customerEntityId, ownScope)
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: replacement },
+        )
+        user.customerEntityId = replacement
+      }
+    }
+
+    // A user invited from a CRM person card arrives with personEntityId already
+    // set, so the email-matching path below never runs for it. Derive the company
+    // FK from that person's own profile instead of leaving it null forever — the
+    // portal Users page, portal invitations, and the company detail "Portal users"
+    // group all key off customerEntityId (#4362).
+    if (user.personEntityId) {
+      if (user.customerEntityId) return
+      const recovered = await resolveOwnedCompanyForPerson(em, user.personEntityId, ownScope)
+      if (recovered) {
+        await em.nativeUpdate(
+          CustomerUser,
+          { id: userId, tenantId, organizationId: user.organizationId },
+          { customerEntityId: recovered },
+        )
+      }
+      return
+    }
 
     const email = (data?.email ? (data.email as string) : user.email)?.toLowerCase().trim()
     if (!email) return
 
-    const { CustomerEntity } = await import('@open-mercato/core/modules/customers/data/entities')
-
+    // Scope the candidate lookup to the user's own org. The fifth argument is a
+    // decryption scope, not a filter, so without organizationId in the `where`
+    // this matches people across every org in the tenant and writes a cross-org
+    // link that the normalization block above just cleared.
     const personEntities = await findWithDecryption(
       em,
       CustomerEntity,
-      { tenantId, kind: 'person', deletedAt: null } as any,
+      { tenantId, organizationId: user.organizationId, kind: 'person', deletedAt: null } as any,
       { limit: 500 } as any,
       { tenantId, organizationId },
     )
@@ -47,16 +112,18 @@ export default async function handle(
 
     if (!matchingEntity) return
 
-    const { CustomerPersonProfile } = await import('@open-mercato/core/modules/customers/data/entities')
-    const profile = await em.findOne(CustomerPersonProfile as any, { entity: matchingEntity.id } as any) as any
-    const companyEntityId = profile?.companyEntityId as string | undefined
+    const companyEntityId = await resolveOwnedCompanyForPerson(em, matchingEntity.id, ownScope)
 
     const updates: Record<string, unknown> = { personEntityId: matchingEntity.id }
     if (companyEntityId) {
       updates.customerEntityId = companyEntityId
     }
 
-    await em.nativeUpdate(CustomerUser, { id: userId }, updates)
+    await em.nativeUpdate(
+      CustomerUser,
+      { id: userId, tenantId, organizationId: user.organizationId },
+      updates,
+    )
   } catch (err) {
     logger.error('Failed to link customer user to CRM person', { err })
   }

package/src/modules/customer_accounts/widgets/injection/account-status/widget.client.tsx

@@ -130,7 +130,7 @@ function InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onS
     try {
       await runMutation({
         context: { entityType: 'customer_accounts:user' },
-        mutationPayload: { customerEntityId: personEntityId, roleIds: selectedRoleIds },
+        mutationPayload: { personEntityId, roleIds: selectedRoleIds },
         operation: async () => {
           // optimistic-lock-exempt: creates a new portal invitation, not a concurrent record edit
           const call = await apiCall<{ ok: boolean; error?: string }>(
@@ -142,7 +142,7 @@ function InviteForm({ personEntityId, onSuccess }: { personEntityId: string; onS
                 email: trimmedEmail,
                 roleIds: selectedRoleIds,
                 displayName: displayName.trim() || undefined,
-                customerEntityId: personEntityId,
+                personEntityId,
               }),
             },
           )

package/src/modules/customer_accounts/widgets/injection/portal-ai-assistant-trigger/widget.client.tsx

@@ -69,9 +69,7 @@ export default function PortalAiAssistantTriggerWidget({ context }: PortalAiAssi
   const resolvedFeatures = Array.isArray(context?.resolvedFeatures)
     ? (context?.resolvedFeatures as string[])
     : []
-  const featureAllowed =
-    context?.isPortalAdmin === true ||
-    hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE)
+  const featureAllowed = hasFeature(resolvedFeatures, PORTAL_AI_INJECT_REQUIRED_FEATURE)
 
   const pageContext = React.useMemo<PortalAiInjectPageContext>(() => ({
     view: 'portal.profile',

package/src/modules/customer_accounts/widgets/injection-table.ts

@@ -8,10 +8,13 @@ const accountStatusWidget = {
   priority: 200,
 } as const
 
+// Column 1 on purpose (#4400): any column-2 group makes CrudForm switch the
+// company detail page to the narrow 7fr/3fr two-column layout, compressing the
+// left-side groups. Portal users belongs in the left stack as a full-width row.
 const companyUsersWidget = {
   widgetId: 'customer_accounts.injection.company-users',
   kind: 'group',
-  column: 2,
+  column: 1,
   groupLabel: 'customer_accounts.widgets.portalUsers',
   priority: 200,
 } as const

package/src/modules/customers/analytics.ts

@@ -26,11 +26,14 @@ export const analyticsConfig: AnalyticsModuleConfig = {
         tableName: 'customer_deals',
         dateField: 'created_at',
         defaultScopeFields: ['tenant_id', 'organization_id'],
+        currencyField: 'valueCurrency',
       },
       fieldMappings: {
         id: { dbColumn: 'id', type: 'uuid' },
         valueAmount: { dbColumn: 'value_amount', type: 'numeric' },
+        valueCurrency: { dbColumn: 'value_currency', type: 'text' },
         status: { dbColumn: 'status', type: 'text' },
+        closureOutcome: { dbColumn: 'closure_outcome', type: 'text' },
         pipelineStage: { dbColumn: 'pipeline_stage', type: 'text' },
         probability: { dbColumn: 'probability', type: 'numeric' },
         createdAt: { dbColumn: 'created_at', type: 'timestamp' },

package/src/modules/customers/api/companies/[id]/route.ts

@@ -29,6 +29,7 @@ import {
   mergeCompanyCustomFieldValues,
 } from '../../../lib/customFieldRouting'
 import { isOpenInteractionStatus, TERMINAL_INTERACTION_STATUS_LIST } from '../../../lib/interactionStatus'
+import { isOpenDealStatus, isWonDealStatus } from '../../../lib/dealStatus'
 import {
   CUSTOMER_INTERACTION_ACTIVITY_ADAPTER_SOURCE,
   EXAMPLE_TODO_SOURCE,
@@ -1015,10 +1016,8 @@ export async function GET(_req: Request, ctx: { params?: { id?: string } }) {
       .map((value) => (value instanceof Date ? value.toISOString() : typeof value === 'string' ? value : ''))
       .filter((value) => value.length > 0),
   )
-  const activeDeals = dealLinksForMetrics.filter(
-    (deal) => deal.status !== 'won' && deal.status !== 'lost' && deal.status !== 'closed',
-  )
-  const wonDeals = dealLinksForMetrics.filter((deal) => deal.status === 'won')
+  const activeDeals = dealLinksForMetrics.filter((deal) => isOpenDealStatus(deal.status))
+  const wonDeals = dealLinksForMetrics.filter((deal) => isWonDealStatus(deal.status))
   const activeDealsValue = activeDeals.reduce((sum, deal) => sum + (parseDealAmount(deal.valueAmount) ?? 0), 0)
   const ltvValue = wonDeals.length
     ? wonDeals.reduce((sum, deal) => sum + (parseDealAmount(deal.valueAmount) ?? 0), 0)

package/src/modules/customers/api/deals/[id]/people/route.ts

@@ -39,6 +39,7 @@ type DealPersonItem = {
   subtitle: string | null
   kind: 'person'
   linkedAt: string
+  isPrimary: boolean
 }
 
 function matchesSearch(item: DealPersonItem, query: string): boolean {
@@ -124,6 +125,7 @@ export async function GET(req: Request, ctx: { params?: { id?: string } }) {
           subtitle: person.primaryEmail ?? person.primaryPhone ?? null,
           kind: 'person',
           linkedAt: link.createdAt.toISOString(),
+          isPrimary: link.isPrimary === true,
         } satisfies DealPersonItem
       })
       .filter((item): item is DealPersonItem => item !== null)
@@ -169,6 +171,7 @@ export const openApi: OpenApiRouteDoc = {
                 subtitle: z.string().nullable(),
                 kind: z.literal('person'),
                 linkedAt: z.string(),
+                isPrimary: z.boolean(),
               }),
             ),
             total: z.number().int().nonnegative(),