@open-mercato/core 0.6.7 → 0.6.8-develop.6875.1.871a4afc94

package/src/modules/notifications/api/unread-count/route.ts

@@ -1,3 +1,4 @@
+import { createHash } from 'node:crypto'
 import type { EntityManager } from '@mikro-orm/core'
 import { runWithCacheTenant } from '@open-mercato/cache'
 import {
@@ -8,6 +9,10 @@ import {
 import { Notification } from '../../data/entities'
 import { unreadCountResponseSchema } from '../openapi'
 import { resolveNotificationContext } from '../../lib/routeHelpers'
+import {
+  buildNotificationReadScopeWhere,
+  getNotificationReadScopeTagOrganizationIds,
+} from '../../lib/notificationScope'
 
 export const metadata = {
   GET: { requireAuth: true },
@@ -16,8 +21,21 @@ export const metadata = {
 const UNREAD_COUNT_RESOURCE = 'notifications.notification'
 const UNREAD_COUNT_TTL_MS = 10_000
 
-function buildUnreadCountCacheKey(userId: string): string {
-  return `notifications:unread-count:u=${userId}`
+function buildUnreadCountCacheKey(params: {
+  userId: string
+  organizationId: string | null
+  organizationIds: string[]
+}): string {
+  const normalizedIds = Array.from(new Set(
+    params.organizationIds.filter((value) => value.trim().length > 0),
+  )).sort((left, right) => left.localeCompare(right))
+  const scopeKey = normalizedIds.length === 0
+    ? 'no-access'
+    : `${params.organizationId ?? 'none'}:scope=${createHash('sha256')
+        .update(normalizedIds.join('\0'))
+        .digest('hex')
+        .slice(0, 16)}`
+  return `notifications:unread-count:u=${params.userId}:org=${scopeKey}`
 }
 
 export async function GET(req: Request) {
@@ -25,8 +43,22 @@ export async function GET(req: Request) {
   const em = ctx.container.resolve('em') as EntityManager
 
   const userId = scope.userId
-  const cache = userId && isCrudCacheEnabled() ? resolveCrudCache(ctx.container) : null
-  const cacheKey = cache && userId ? buildUnreadCountCacheKey(userId) : null
+  const cacheableOrganizationIds = Array.isArray(scope.organizationIds)
+    ? scope.organizationIds
+    : null
+  // Unrestricted and omitted legacy scopes cannot be safely tagged for invalidation:
+  // org-specific writes only invalidate their own collection tag. Keep those scopes
+  // uncached rather than serving a stale tenant-wide total until the TTL expires.
+  const cache = userId && cacheableOrganizationIds && isCrudCacheEnabled()
+    ? resolveCrudCache(ctx.container)
+    : null
+  const cacheKey = cache && userId && cacheableOrganizationIds
+    ? buildUnreadCountCacheKey({
+        userId,
+        organizationId: scope.organizationId,
+        organizationIds: cacheableOrganizationIds,
+      })
+    : null
 
   if (cache && cacheKey) {
     try {
@@ -41,6 +73,7 @@ export async function GET(req: Request) {
     recipientUserId: userId,
     tenantId: scope.tenantId,
     status: 'unread',
+    ...buildNotificationReadScopeWhere(scope),
   })
 
   if (cache && cacheKey) {
@@ -48,7 +81,11 @@ export async function GET(req: Request) {
       await runWithCacheTenant(scope.tenantId, () =>
         cache.set(cacheKey, count, {
           ttl: UNREAD_COUNT_TTL_MS,
-          tags: buildCollectionTags(UNREAD_COUNT_RESOURCE, scope.tenantId, [null]),
+          tags: buildCollectionTags(
+            UNREAD_COUNT_RESOURCE,
+            scope.tenantId,
+            getNotificationReadScopeTagOrganizationIds(scope),
+          ),
         }),
       )
     } catch {}

package/src/modules/notifications/di.ts

@@ -5,7 +5,7 @@ import { createNotificationService } from './lib/notificationService'
 export function register(container: AppContainer): void {
   container.register({
     notificationService: asFunction(({ em, eventBus, commandBus }) =>
-      createNotificationService({ em, eventBus, commandBus })
+      createNotificationService({ em, eventBus, commandBus, container })
     ).scoped().proxy(),
   })
 }

package/src/modules/notifications/events.ts

@@ -8,6 +8,7 @@ const events = [
     entity: 'notification',
     category: 'system',
     clientBroadcast: true,
+    portalBroadcast: true,
   },
   {
     id: NOTIFICATION_SSE_EVENTS.BATCH_CREATED,
@@ -15,6 +16,7 @@ const events = [
     entity: 'notification',
     category: 'system',
     clientBroadcast: true,
+    portalBroadcast: true,
   },
 ] as const
 

package/src/modules/notifications/i18n/ko.json

@@ -0,0 +1,55 @@
+{
+  "notifications.actionTaken": "실행된 작업: {action}",
+  "notifications.actions.dismiss": "닫기",
+  "notifications.actions.markRead": "읽음으로 표시",
+  "notifications.actions.undo": "실행 취소",
+  "notifications.badge.unread": "읽지 않은 알림 {count}개",
+  "notifications.close": "알림 닫기",
+  "notifications.delivery.email.actionNotice": "작업은 Open Mercato에서 가능하며 이 이메일에서는 읽기 전용입니다.",
+  "notifications.delivery.email.bodyIntro": "알림 상세 정보를 확인하고 필요한 작업을 수행하세요.",
+  "notifications.delivery.email.footer": "Open Mercato 알림",
+  "notifications.delivery.email.heading": "새 알림이 있습니다",
+  "notifications.delivery.email.openCta": "알림 센터 열기",
+  "notifications.delivery.email.preview": "새 알림",
+  "notifications.delivery.settings.invalid": "잘못된 전달 설정입니다",
+  "notifications.empty": "알림 없음",
+  "notifications.error.action": "작업을 실행하지 못했습니다",
+  "notifications.error.load": "알림을 불러오지 못했습니다",
+  "notifications.filters.actionRequired": "조치 필요",
+  "notifications.filters.all": "전체",
+  "notifications.filters.unread": "읽지 않음",
+  "notifications.footer.manage": "알림 관리",
+  "notifications.footer.toNavigate": "이동",
+  "notifications.footer.useHint": "사용",
+  "notifications.markAllRead": "모두 읽음으로 표시",
+  "notifications.nav.title": "알림",
+  "notifications.settings.core.appUrl": "애플리케이션 URL",
+  "notifications.settings.core.appUrlHint": "이메일 알림에서 절대 링크를 생성하는 데 사용됩니다.",
+  "notifications.settings.core.databaseHint": "패널과 벨 아이콘을 위해 알림을 데이터베이스에 저장합니다.",
+  "notifications.settings.core.databaseLabel": "앱 내 알림",
+  "notifications.settings.core.description": "외부 채널에서 사용하는 기본 알림 센터와 패널 링크를 제어합니다.",
+  "notifications.settings.core.panelPath": "알림 패널 경로",
+  "notifications.settings.core.panelPathHint": "읽기 전용 알림 패널의 상대 경로입니다.",
+  "notifications.settings.core.title": "핵심 전달",
+  "notifications.settings.email.description": "React 템플릿을 사용해 Resend를 통해 알림 사본을 전송합니다.",
+  "notifications.settings.email.enabledHint": "이메일 작업은 읽기 전용이며 알림 센터로 다시 연결됩니다.",
+  "notifications.settings.email.enabledLabel": "이메일 전달 활성화",
+  "notifications.settings.email.from": "보내는 주소",
+  "notifications.settings.email.replyTo": "회신 주소",
+  "notifications.settings.email.subjectPrefix": "제목 접두사",
+  "notifications.settings.email.title": "이메일 전략",
+  "notifications.settings.loadError": "알림 설정을 불러오지 못했습니다",
+  "notifications.settings.loading": "알림 설정을 불러오는 중...",
+  "notifications.settings.pageDescription": "앱 내 알림의 전달 전략을 구성합니다.",
+  "notifications.settings.pageTitle": "알림 전달",
+  "notifications.settings.save": "설정 저장",
+  "notifications.settings.saveError": "알림 설정 저장에 실패했습니다",
+  "notifications.settings.saveSuccess": "알림 설정이 저장되었습니다",
+  "notifications.settings.saving": "저장 중...",
+  "notifications.title": "알림",
+  "notifications.toast.actionError": "작업을 실행하지 못했습니다",
+  "notifications.toast.actionSuccess": "작업이 성공적으로 완료되었습니다",
+  "notifications.toast.dismissed": "알림이 닫혔습니다",
+  "notifications.toast.new": "새 알림",
+  "notifications.unreadSummary": "읽지 않음 {count}개"
+}

package/src/modules/notifications/lib/notificationRecipients.ts

@@ -1,5 +1,5 @@
 import type { Kysely } from 'kysely'
-import { hasFeature } from '@open-mercato/shared/security/features'
+import { authorizeFeatures } from '@open-mercato/shared/security/featurePolicy'
 
 interface AclRow {
   user_id: string
@@ -22,13 +22,11 @@ function collectUsersWithFeature(
   requiredFeature: string
 ): void {
   for (const row of rows) {
-    if (row.is_super_admin) {
-      userIdsSet.add(row.user_id)
-      continue
-    }
-
-    const features = normalizeFeatures(row.features_json)
-    if (features && hasFeature(features, requiredFeature)) {
+    const features = normalizeFeatures(row.features_json) ?? []
+    if (authorizeFeatures([requiredFeature], {
+      grantedFeatures: features,
+      unrestricted: row.is_super_admin,
+    })) {
       userIdsSet.add(row.user_id)
     }
   }

package/src/modules/notifications/lib/notificationScope.ts

@@ -0,0 +1,40 @@
+export type NotificationReadOrganizationScope = {
+  organizationId?: string | null
+  organizationIds?: string[] | null
+}
+
+type NotificationReadScopeWhere = {
+  organizationId?: null
+  $or?: Array<
+    | { organizationId: { $in: string[] } }
+    | { organizationId: null }
+  >
+}
+
+function resolveOrganizationIds(scope: NotificationReadOrganizationScope): string[] | null {
+  if (scope.organizationIds === null) return null
+  if (scope.organizationIds === undefined) return null
+  const candidates = scope.organizationIds
+  return Array.from(new Set(candidates.filter((value) => value.trim().length > 0)))
+}
+
+export function buildNotificationReadScopeWhere(
+  scope: NotificationReadOrganizationScope,
+): NotificationReadScopeWhere {
+  const organizationIds = resolveOrganizationIds(scope)
+  if (organizationIds === null) return {}
+  if (organizationIds.length === 0) return { organizationId: null }
+  return {
+    $or: [
+      { organizationId: { $in: organizationIds } },
+      { organizationId: null },
+    ],
+  }
+}
+
+export function getNotificationReadScopeTagOrganizationIds(
+  scope: NotificationReadOrganizationScope,
+): Array<string | null> {
+  const organizationIds = resolveOrganizationIds(scope)
+  return organizationIds === null ? [null] : [...organizationIds, null]
+}

package/src/modules/notifications/lib/notificationService.ts

@@ -1,6 +1,7 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { type Kysely, sql } from 'kysely'
 import { CrudHttpError, conflict } from '@open-mercato/shared/lib/crud/errors'
+import { invalidateCrudCache } from '@open-mercato/shared/lib/crud/cache'
 import { Notification, type NotificationStatus } from '../data/entities'
 import type { CreateNotificationInput, CreateBatchNotificationInput, CreateRoleNotificationInput, CreateFeatureNotificationInput, ExecuteActionInput } from '../data/validators'
 import type { NotificationPollData } from '@open-mercato/shared/modules/notifications/types'
@@ -14,6 +15,7 @@ import {
   type NotificationTenantContext,
 } from './notificationFactory'
 import { toNotificationDto } from './notificationMapper'
+import { buildNotificationReadScopeWhere } from './notificationScope'
 import {
   getRecipientUserIdsForFeature,
   getRecipientUserIdsForRole,
@@ -33,11 +35,32 @@ function getDb(em: EntityManager): Kysely<any> {
 }
 
 const UNIQUE_NOTIFICATION_ACTIVE_STATUSES: NotificationStatus[] = ['unread', 'read', 'actioned']
+const NOTIFICATION_RESOURCE_KIND = 'notifications.notification'
 
 function normalizeOrgScope(organizationId: string | null | undefined): string | null {
   return organizationId ?? null
 }
 
+async function invalidateNotificationCache(
+  container: NotificationServiceDeps['container'],
+  ctx: Pick<NotificationServiceContext, 'tenantId' | 'organizationId'>,
+  reason: string,
+  notificationId?: string,
+): Promise<void> {
+  if (!container) return
+  await invalidateCrudCache(
+    container as Parameters<typeof invalidateCrudCache>[0],
+    NOTIFICATION_RESOURCE_KIND,
+    {
+      id: notificationId,
+      tenantId: ctx.tenantId,
+      organizationId: normalizeOrgScope(ctx.organizationId),
+    },
+    ctx.tenantId,
+    reason,
+  )
+}
+
 async function assertNotificationRecipientsInScope(
   em: EntityManager,
   recipientUserIds: string[],
@@ -184,6 +207,7 @@ async function createOrRefreshNotification(
 export interface NotificationServiceContext {
   tenantId: string
   organizationId?: string | null
+  organizationIds?: string[] | null
   userId?: string | null
 }
 
@@ -241,6 +265,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         return entity
       })
 
+      await invalidateNotificationCache(container, ctx, 'created')
       await emitNotificationCreated(eventBus, notification, ctx)
       await eventBus.emit(NOTIFICATION_SSE_EVENTS.CREATED, {
         tenantId: notification.tenantId,
@@ -267,6 +292,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         await tx.flush()
       })
 
+      await invalidateNotificationCache(container, ctx, 'created')
       await emitNotificationCreatedBatch(eventBus, notifications, ctx)
       await emitNotificationSseEvents(eventBus, notifications, ctx, recipientUserIds)
 
@@ -295,6 +321,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         await tx.flush()
       })
 
+      await invalidateNotificationCache(container, ctx, 'created')
       await emitNotificationCreatedBatch(eventBus, notifications, ctx)
       await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)
 
@@ -326,6 +353,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         await tx.flush()
       })
 
+      await invalidateNotificationCache(container, ctx, 'created')
       await emitNotificationCreatedBatch(eventBus, notifications, ctx)
       await emitNotificationSseEvents(eventBus, notifications, ctx, uniqueRecipientUserIds)
 
@@ -341,6 +369,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         notification.readAt = new Date()
         await em.flush()
 
+        await invalidateNotificationCache(container, ctx, 'updated', notification.id)
         await eventBus.emit(NOTIFICATION_EVENTS.READ, {
           notificationId: notification.id,
           userId: ctx.userId,
@@ -387,6 +416,8 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       ).executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined
       const result = Number(updateResult?.numUpdatedRows ?? targetRows.length)
 
+      await invalidateNotificationCache(container, ctx, 'updated')
+
       const notifications = await findWithDecryption(em, Notification, {
         id: { $in: targetRows.map((row) => row.id) },
       }, undefined, {
@@ -420,6 +451,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       notification.dismissedAt = new Date()
       await em.flush()
 
+      await invalidateNotificationCache(container, ctx, 'updated', notification.id)
       await eventBus.emit(NOTIFICATION_EVENTS.DISMISSED, {
         notificationId: notification.id,
         userId: ctx.userId,
@@ -449,6 +481,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
       await em.flush()
 
+      await invalidateNotificationCache(container, ctx, 'updated', notification.id)
       await eventBus.emit(NOTIFICATION_EVENTS.RESTORED, {
         notificationId: notification.id,
         userId: ctx.userId,
@@ -578,6 +611,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
 
       await em.flush()
 
+      await invalidateNotificationCache(container, ctx, 'updated', notification.id)
       await eventBus.emit(NOTIFICATION_EVENTS.ACTIONED, {
         notificationId: notification.id,
         actionId: input.actionId,
@@ -594,6 +628,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         recipientUserId: ctx.userId,
         tenantId: ctx.tenantId,
         status: 'unread',
+        ...buildNotificationReadScopeWhere(ctx),
       })
     },
 
@@ -602,6 +637,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       const filters: Record<string, unknown> = {
         recipientUserId: ctx.userId,
         tenantId: ctx.tenantId,
+        ...buildNotificationReadScopeWhere(ctx),
       }
 
       if (since) {
@@ -617,6 +653,7 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
           recipientUserId: ctx.userId,
           tenantId: ctx.tenantId,
           status: 'unread',
+          ...buildNotificationReadScopeWhere(ctx),
         }),
       ])
 
@@ -635,6 +672,19 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
       const em = rootEm.fork()
       const db = getDb(em)
 
+      const affectedScopes = await db
+        .selectFrom('notifications' as any)
+        .select([
+          'tenant_id' as any,
+          'organization_id' as any,
+        ])
+        .where('expires_at' as any, '<', sql`now()`)
+        .where('status' as any, 'not in', ['actioned', 'dismissed'])
+        .distinct()
+        .execute() as Array<{ tenant_id: string; organization_id: string | null }>
+
+      if (!affectedScopes.length) return 0
+
       const updateResult = await db
         .updateTable('notifications' as any)
         .set({
@@ -645,6 +695,13 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         .where('status' as any, 'not in', ['actioned', 'dismissed'])
         .executeTakeFirst() as { numUpdatedRows?: bigint | number } | undefined
 
+      for (const scope of affectedScopes) {
+        await invalidateNotificationCache(container, {
+          tenantId: scope.tenant_id,
+          organizationId: scope.organization_id,
+        }, 'updated')
+      }
+
       return Number(updateResult?.numUpdatedRows ?? 0)
     },
 
@@ -659,7 +716,12 @@ export function createNotificationService(deps: NotificationServiceDeps): Notifi
         .where('tenant_id' as any, '=', ctx.tenantId)
         .executeTakeFirst() as { numDeletedRows?: bigint | number } | undefined
 
-      return Number(deleteResult?.numDeletedRows ?? 0)
+      const deletedCount = Number(deleteResult?.numDeletedRows ?? 0)
+      if (deletedCount > 0) {
+        await invalidateNotificationCache(container, ctx, 'deleted')
+      }
+
+      return deletedCount
     },
   }
 }

package/src/modules/notifications/lib/routeHelpers.ts

@@ -4,6 +4,7 @@ import { resolveRequestContext } from '@open-mercato/shared/lib/api/context'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { resolveNotificationService, type NotificationService } from './notificationService'
 
 /**
@@ -22,6 +23,7 @@ export const NOTIFICATION_SETTINGS_RESOURCE_KIND = 'notifications.settings'
 export interface NotificationScope {
   tenantId: string
   organizationId: string | null
+  organizationIds?: string[] | null
   userId: string | null
 }
 
@@ -64,11 +66,26 @@ export function notificationCrudErrorResponse(error: unknown): Response | null {
  */
 export async function resolveNotificationContext(req: Request): Promise<NotificationRequestContext> {
   const { ctx } = await resolveRequestContext(req)
+  const organizationScope = await resolveOrganizationScopeForRequest({
+    container: ctx.container,
+    auth: ctx.auth,
+    request: req,
+    ...(ctx.selectedOrganizationId === undefined
+      ? {}
+      : { selectedId: ctx.selectedOrganizationId }),
+  })
+  const tenantId = organizationScope.tenantId ?? ctx.auth?.tenantId ?? ''
+  const organizationId = organizationScope.selectedId
+  const organizationIds = organizationScope.filterIds
+  ctx.organizationScope = organizationScope
+  ctx.selectedOrganizationId = organizationId
+  ctx.organizationIds = organizationIds
   return {
     service: resolveNotificationService(ctx.container),
     scope: {
-      tenantId: ctx.auth?.tenantId ?? '',
-      organizationId: ctx.selectedOrganizationId ?? null,
+      tenantId,
+      organizationId,
+      organizationIds,
       userId: ctx.auth?.sub ?? null,
     },
     ctx,

package/src/modules/payment_gateways/api/capture/route.ts

@@ -92,7 +92,7 @@ export const openApi = {
       tags: [paymentGatewaysTag],
       responses: [
         { status: 200, description: 'Payment captured' },
-        { status: 409, description: 'Invalid payment status transition' },
+        { status: 409, description: 'Invalid payment status transition, cumulative capture ceiling exceeded, or conflicting capture operation' },
         { status: 422, description: 'Invalid payload' },
         { status: 502, description: 'Gateway provider error' },
       ],

package/src/modules/payment_gateways/api/sessions/route.ts

@@ -2,6 +2,7 @@ import { NextResponse } from 'next/server'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { createSessionSchema } from '../../data/validators'
 import type { PaymentGatewayService } from '../../lib/gateway-service'
 import { paymentGatewaysTag } from '../openapi'
@@ -98,9 +99,10 @@ export async function POST(req: Request) {
       paymentId: transaction.paymentId,
     }, { status: 201 })
   } catch (err: unknown) {
-    const message = err instanceof Error ? err.message : 'Failed to create payment session'
-    const status = message.includes('No gateway adapter') ? 422 : 502
-    return NextResponse.json({ error: message }, { status })
+    if (isCrudHttpError(err)) {
+      return NextResponse.json(err.body, { status: err.status })
+    }
+    return NextResponse.json({ error: 'Failed to create payment session' }, { status: 502 })
   }
 }
 
@@ -113,6 +115,7 @@ export const openApi = {
       tags: [paymentGatewaysTag],
       responses: [
         { status: 201, description: 'Payment session created' },
+        { status: 409, description: 'Amount or currency does not match the referenced order' },
         { status: 422, description: 'Invalid payload or unknown provider' },
         { status: 502, description: 'Gateway provider error' },
       ],

package/src/modules/payment_gateways/api/webhook/[provider]/route.ts

@@ -14,6 +14,7 @@ import { getPaymentGatewayQueue } from '../../../lib/queue'
 import { processPaymentGatewayWebhookJob } from '../../../lib/webhook-processor'
 import { paymentGatewaysTag } from '../../openapi'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { readBoundedRequestBody, WebhookBodyTooLargeError } from '@open-mercato/shared/lib/webhooks'
 
 const logger = createLogger('payment_gateways').child({ component: 'webhook' })
 
@@ -42,7 +43,17 @@ export async function POST(req: Request, { params }: { params: Promise<{ provide
   const rateLimitResponse = await checkProviderWebhookRateLimit(container, req, providerKey)
   if (rateLimitResponse) return rateLimitResponse
 
-  const rawBody = await req.text()
+  let rawBody: string
+  try {
+    rawBody = registration.maxBodyBytes === undefined
+      ? await req.text()
+      : await readBoundedRequestBody(req, { maxBytes: registration.maxBodyBytes })
+  } catch (error) {
+    if (error instanceof WebhookBodyTooLargeError) {
+      return NextResponse.json({ error: 'Webhook payload too large' }, { status: 413 })
+    }
+    throw error
+  }
   const headers: Record<string, string> = {}
   req.headers.forEach((value, key) => {
     headers[key] = value
@@ -164,6 +175,7 @@ export const openApi = {
       responses: [
         { status: 202, description: 'Webhook accepted for async processing' },
         { status: 401, description: 'Signature verification failed' },
+        { status: 413, description: 'Webhook payload too large' },
         { status: 404, description: 'Unknown provider' },
       ],
     },

package/src/modules/payment_gateways/backend/payment-gateways/page.tsx

@@ -1,5 +1,6 @@
 "use client"
 import * as React from 'react'
+import { extensionPoints } from '@open-mercato/core/modules/payment_gateways/extension-points'
 import { useSearchParams } from 'next/navigation'
 import type { ColumnDef } from '@tanstack/react-table'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
@@ -472,7 +473,7 @@ export default function PaymentTransactionsPage() {
           searchValue={search}
           onSearchChange={(value) => { setSearch(value); setPage(1) }}
           searchPlaceholder={t('payment_gateways.transactions.searchPlaceholder', 'Search by payment, transaction, session, or gateway id')}
-          perspective={{ tableId: 'payment_gateways.transactions.list' }}
+          perspective={{ tableId: extensionPoints.hosts.transactionsTable.tableId }}
           pagination={{ page, pageSize: 20, total, totalPages, onPageChange: setPage }}
           isLoading={isLoading}
           onRowClick={(row) => setSelectedId((current) => current === row.id ? null : row.id)}
@@ -691,7 +692,7 @@ export default function PaymentTransactionsPage() {
                         className="p-4"
                       />
                       <InjectionSpot
-                        spotId="admin.page:payment-gateways/transactions:after"
+                        spotId={extensionPoints.hosts.transactionsAfter.spotId}
                         context={{ selectedPaymentId: detail.transaction.paymentId }}
                       />
                     </div>

package/src/modules/payment_gateways/data/entities.ts

@@ -6,7 +6,7 @@ import { Entity, Index, PrimaryKey, Property, Unique } from '@mikro-orm/decorato
 @Index({ properties: ['providerKey', 'providerSessionId', 'organizationId'] })
 @Index({ properties: ['organizationId', 'tenantId', 'unifiedStatus'] })
 export class GatewayTransaction {
-  [OptionalProps]?: 'unifiedStatus' | 'gatewayStatus' | 'providerSessionId' | 'gatewayPaymentId' | 'gatewayRefundId' | 'redirectUrl' | 'clientSecret' | 'gatewayMetadata' | 'webhookLog' | 'lastWebhookAt' | 'lastPolledAt' | 'expiresAt' | 'createdAt' | 'updatedAt' | 'deletedAt'
+  [OptionalProps]?: 'unifiedStatus' | 'gatewayStatus' | 'providerSessionId' | 'gatewayPaymentId' | 'gatewayRefundId' | 'redirectUrl' | 'clientSecret' | 'capturedAmount' | 'gatewayMetadata' | 'webhookLog' | 'lastWebhookAt' | 'lastPolledAt' | 'expiresAt' | 'createdAt' | 'updatedAt' | 'deletedAt'
 
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -41,6 +41,9 @@ export class GatewayTransaction {
   @Property({ name: 'amount', type: 'numeric', precision: 18, scale: 4 })
   amount!: string
 
+  @Property({ name: 'captured_amount', type: 'numeric', precision: 18, scale: 4, default: '0' })
+  capturedAmount: string = '0'
+
   @Property({ name: 'currency_code', type: 'text' })
   currencyCode!: string
 
@@ -83,7 +86,7 @@ export class GatewayTransaction {
 @Index({ properties: ['transactionId', 'operationType', 'organizationId', 'tenantId'] })
 @Index({ properties: ['status', 'leaseExpiresAt'] })
 export class GatewayPaymentOperation {
-  [OptionalProps]?: 'status' | 'attemptCount' | 'result' | 'leaseExpiresAt' | 'createdAt' | 'updatedAt'
+  [OptionalProps]?: 'status' | 'attemptCount' | 'result' | 'reservedAmount' | 'leaseExpiresAt' | 'createdAt' | 'updatedAt'
 
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string
@@ -118,6 +121,9 @@ export class GatewayPaymentOperation {
   @Property({ name: 'result', type: 'jsonb', nullable: true })
   result?: Record<string, unknown> | null
 
+  @Property({ name: 'reserved_amount', type: 'numeric', precision: 18, scale: 4, nullable: true })
+  reservedAmount?: string | null
+
   @Property({ name: 'lease_expires_at', type: Date, nullable: true })
   leaseExpiresAt?: Date | null
 
@@ -139,6 +145,11 @@ export class GatewayPaymentOperation {
   name: 'gateway_session_initializations_scope_operation_unique',
   properties: ['operationKey', 'providerKey', 'organizationId', 'tenantId'],
 })
+@Index({
+  name: 'gateway_session_initializations_prune_idx',
+  expression:
+    'create index "gateway_session_initializations_prune_idx" on "gateway_session_initializations" ("tenant_id", "organization_id", "updated_at") where "gateway_transaction_id" is not null',
+})
 export class GatewaySessionInitialization {
   [OptionalProps]?: 'claimToken' | 'claimedAt' | 'gatewayTransactionId' | 'createdAt' | 'updatedAt'