@open-mercato/core 0.6.8-develop.6918.1.7b3f32b0c8 → 0.6.8-develop.6925.1.cefa200fa4

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.6918.1.7b3f32b0c8",
+  "version": "0.6.8-develop.6925.1.cefa200fa4",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -254,16 +254,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6918.1.7b3f32b0c8",
-    "@open-mercato/shared": "0.6.8-develop.6918.1.7b3f32b0c8",
-    "@open-mercato/ui": "0.6.8-develop.6918.1.7b3f32b0c8",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6925.1.cefa200fa4",
+    "@open-mercato/shared": "0.6.8-develop.6925.1.cefa200fa4",
+    "@open-mercato/ui": "0.6.8-develop.6925.1.cefa200fa4",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.6918.1.7b3f32b0c8",
-    "@open-mercato/shared": "0.6.8-develop.6918.1.7b3f32b0c8",
-    "@open-mercato/ui": "0.6.8-develop.6918.1.7b3f32b0c8",
+    "@open-mercato/ai-assistant": "0.6.8-develop.6925.1.cefa200fa4",
+    "@open-mercato/shared": "0.6.8-develop.6925.1.cefa200fa4",
+    "@open-mercato/ui": "0.6.8-develop.6925.1.cefa200fa4",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/bootstrap.ts

@@ -136,7 +136,9 @@ export async function bootstrap(container: AwilixContainer) {
     try {
       eventBus = createEventBus({ resolve: container.resolve.bind(container) as any, queueStrategy: 'local' })
     } catch {
-      // In extreme cases, provide a no-op bus to avoid crashes
+      // In extreme cases, provide a no-op bus to avoid crashes. It deliberately
+      // omits `dispatchQueued` so the events worker fails its job loudly instead
+      // of quietly completing it with zero subscribers dispatched.
       eventBus = {
         emit: async () => {},
         on: () => {},
@@ -154,7 +156,12 @@ export async function bootstrap(container: AwilixContainer) {
     try {
       const { getModules } = await import('@open-mercato/shared/lib/i18n/server')
       loadedModules = getModules()
-    } catch {}
+    } catch (err) {
+      // The events worker dispatches persistent subscribers through this bus, so
+      // an empty registry here means queued events silently run nothing. Swallowing
+      // it made that failure invisible; log it.
+      logger.warn('Module registry unavailable; event bus starts with no module subscribers', { err })
+    }
     const subs = loadedModules.flatMap((m) =>
       (m.subscribers || []).map((subscriber: ModuleSubscriber) => ({
         ...subscriber,

package/src/helpers/integration/api.ts

@@ -13,6 +13,19 @@ function resolveUrl(path: string): string {
 const tokenCache = new Map<string, { token: string; mintedAt: number }>();
 const TOKEN_TTL_MS = 45 * 60 * 1000; // 45 min; well under the default 2h session TTL.
 
+/**
+ * Drops cached tokens so the next getAuthToken() mints a fresh session.
+ *
+ * A cached token points at a `sessions` row. Anything that deletes those rows —
+ * deactivating the user, a password change, an explicit session purge — leaves the
+ * cached token resolving to 401 for the rest of the TTL, and `apiRequest` neither
+ * retries nor re-mints. A spec that revokes sessions for an account other specs also
+ * use MUST call this afterwards.
+ */
+export function clearAuthTokenCache(): void {
+  tokenCache.clear();
+}
+
 export async function getAuthToken(
   request: APIRequestContext,
   roleOrEmail: Role | string = 'admin',

package/src/modules/audit_logs/api/audit-logs/actions/redo/route.ts

@@ -4,6 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext, CommandLogMetadata } from '@open-mercato/shared/lib/commands'
 import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
@@ -160,6 +161,12 @@ export async function POST(req: Request) {
     }
     return response
   } catch (err) {
+    // Same contract as undo: a domain refusal carries an already-localized body the
+    // operator can act on, so surface it instead of a generic message.
+    if (isCrudHttpError(err)) {
+      logger.warn('Redo rejected', { err })
+      return NextResponse.json(err.body, { status: err.status })
+    }
     logger.error('Redo failed', { err })
     return NextResponse.json({ error: 'Redo failed' }, { status: 400 })
   }

package/src/modules/audit_logs/api/audit-logs/actions/undo/route.ts

@@ -4,6 +4,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { resolveFeatureCheckContext, resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import { CommandBus } from '@open-mercato/shared/lib/commands/command-bus'
+import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { ActionLogService } from '@open-mercato/core/modules/audit_logs/services/actionLogService'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
@@ -121,6 +122,14 @@ export async function POST(req: Request) {
     await commandBus.undo(undoToken, ctx)
     return NextResponse.json({ ok: true, logId: target.id })
   } catch (err) {
+    // A command can refuse an undo for a domain reason the operator can act on — e.g.
+    // reverting a role grant would drop a tenant below a protected role's active-holder
+    // floor. Those arrive as CrudHttpError with an already-localized body, so pass them
+    // through verbatim instead of flattening every failure to a generic message.
+    if (isCrudHttpError(err)) {
+      logger.warn('Undo rejected', { err, logId: target.id })
+      return NextResponse.json(err.body, { status: err.status })
+    }
     // A beforeUndo interceptor that blocked with an explicit status is a deliberate business
     // rejection, not an undo failure — surface its status and message (issue #5045).
     const interceptorRejection = getCommandInterceptorHttpRejection(err)

package/src/modules/audit_logs/backend/audit-logs/page.tsx

@@ -146,11 +146,11 @@ export default function AuditLogsPage() {
     </Button>
   ), [loadWithState, actionsPage, actionsPageSize, accessPage, accessPageSize, loading, t])
 
-  const handleUndoError = React.useCallback(() => {
-    setError(t('audit_logs.error.undo'))
+  const handleUndoError = React.useCallback((reason?: string) => {
+    setError(reason || t('audit_logs.error.undo'))
   }, [t])
-  const handleRedoError = React.useCallback(() => {
-    setError(t('audit_logs.error.redo'))
+  const handleRedoError = React.useCallback((reason?: string) => {
+    setError(reason || t('audit_logs.error.redo'))
   }, [t])
 
   const handleActionsPageChange = React.useCallback((nextPage: number) => {

package/src/modules/audit_logs/components/AuditLogsActions.tsx

@@ -16,6 +16,21 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 
 const logger = createLogger('audit_logs').child({ component: 'AuditLogsActions' })
 
+/**
+ * `raiseCrudError` prefers the server's `error` body over the fallback message and stamps
+ * `status` on anything it builds from an HTTP response, so a numeric `status` is what
+ * distinguishes a route's refusal from a client-side failure. Without that check an
+ * offline or aborted request would put a raw "Failed to fetch" into the operator's
+ * banner; those keep the generic fallback instead.
+ */
+function resolveServerReason(err: unknown): string | undefined {
+  if (!(err instanceof Error)) return undefined
+  const status = (err as Error & { status?: unknown }).status
+  if (typeof status !== 'number') return undefined
+  const message = err.message?.trim()
+  return message ? message : undefined
+}
+
 export type ActionLogItem = {
   id: string
   commandId: string
@@ -51,8 +66,9 @@ export function AuditLogsActions({
   onRefresh: () => Promise<void>
   isLoading?: boolean
   headerExtras?: React.ReactNode
-  onUndoError?: () => void
-  onRedoError?: () => void
+  /** Receives the server's reason when it sent one, so the page can show why the undo was refused. */
+  onUndoError?: (reason?: string) => void
+  onRedoError?: (reason?: string) => void
   pagination?: PaginationProps
 }) {
   const t = useT()
@@ -109,7 +125,7 @@ export function AuditLogsActions({
       await onRefresh()
     } catch (err) {
       logger.error('Undo action failed', { err })
-      onUndoError?.()
+      onUndoError?.(resolveServerReason(err))
     } finally {
       setUndoingToken(null)
     }
@@ -128,7 +144,7 @@ export function AuditLogsActions({
       await onRefresh()
     } catch (err) {
       logger.error('Redo action failed', { err })
-      onRedoError?.()
+      onRedoError?.(resolveServerReason(err))
     } finally {
       setRedoingId(null)
     }

package/src/modules/auth/api/login.ts

@@ -120,8 +120,15 @@ export async function POST(req: Request) {
   // wrong-password, and multi-tenant cases return an identical 401 with
   // identical latency.
   const ok = await auth.verifyPassword(user, parsed.data.password)
-  if (!user || !ok) {
-    const reason = user?.passwordHash ? 'invalid_password' : 'invalid_credentials'
+  if (!user || !ok || user.isConfirmed === false) {
+    // The 401 body stays identical for every branch so the response never reveals
+    // which one fired. `reason` goes to the audit stream instead, where separating a
+    // deactivated account from a mistyped password is the whole point — otherwise
+    // repeated attempts against a disabled account look like ordinary fat-fingering.
+    let reason: string
+    if (user && user.isConfirmed === false) reason = 'account_deactivated'
+    else if (user?.passwordHash) reason = 'invalid_password'
+    else reason = 'invalid_credentials'
     void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)
     return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })
   }

package/src/modules/auth/api/users/route.ts

@@ -72,6 +72,7 @@ const userUpdateSchema = z.object({
   password: passwordSchema.optional(),
   organizationId: z.string().uuid().optional(),
   roles: z.array(z.string()).optional(),
+  isConfirmed: z.boolean().optional(),
 })
 
 const userListItemSchema = z.object({
@@ -85,6 +86,7 @@ const userListItemSchema = z.object({
   roles: z.array(z.string()),
   roleIds: z.array(z.string().uuid()).optional(),
   hasPassword: z.boolean().optional(),
+  isConfirmed: z.boolean(),
   updatedAt: z.string().nullable().optional(),
 })
 
@@ -476,6 +478,7 @@ export async function GET(req: Request) {
       roles: roleMap[uid] || [],
       roleIds: roleIdMap[uid] || [],
       ...(id ? { hasPassword: !!u.passwordHash } : {}),
+      isConfirmed: u.isConfirmed !== false,
       updatedAt: u.updatedAt instanceof Date ? u.updatedAt.toISOString() : null,
       ...(cfByUser[uid] || {}),
     }
@@ -662,7 +665,8 @@ export const openApi: OpenApiRouteDoc = {
     },
     PUT: {
       summary: 'Update user',
-      description: 'Updates profile fields including display name, organization assignment, credentials, or role memberships.',
+      description:
+        'Updates profile fields including display name, organization assignment, credentials, or role memberships. Setting isConfirmed=false deactivates the account: the user can no longer sign in and every active session is revoked; isConfirmed=true reactivates it. A tenant cannot drop below a protected role\'s minimum active holder count, so revoking the role from, deactivating, moving, or deleting the last active administrator is rejected.',
       requestBody: {
         contentType: 'application/json',
         schema: userUpdateSchema,
@@ -671,7 +675,7 @@ export const openApi: OpenApiRouteDoc = {
         { status: 200, description: 'User updated', schema: okResponseSchema },
       ],
       errors: [
-        { status: 400, description: 'Invalid payload', schema: errorResponseSchema },
+        { status: 400, description: 'Invalid payload, duplicate email, or the update would remove the last active holder of a protected role', schema: errorResponseSchema },
         { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
         { status: 403, description: 'Attempted to assign privileged roles', schema: errorResponseSchema },
         { status: 404, description: 'User not found', schema: errorResponseSchema },
@@ -679,13 +683,13 @@ export const openApi: OpenApiRouteDoc = {
     },
     DELETE: {
       summary: 'Delete user',
-      description: 'Deletes a user by identifier. Undo support is provided via the command bus.',
+      description: 'Deletes a user by identifier. Rejected when the target is the last active holder of a protected role in the tenant. Undo support is provided via the command bus.',
       query: z.object({ id: z.string().uuid().describe('User identifier') }),
       responses: [
         { status: 200, description: 'User deleted', schema: okResponseSchema },
       ],
       errors: [
-        { status: 400, description: 'User cannot be deleted', schema: errorResponseSchema },
+        { status: 400, description: 'User cannot be deleted, or is the last active holder of a protected role', schema: errorResponseSchema },
         { status: 401, description: 'Unauthorized', schema: errorResponseSchema },
         { status: 404, description: 'User not found', schema: errorResponseSchema },
       ],

package/src/modules/auth/backend/users/[id]/edit/page.tsx

@@ -47,6 +47,7 @@ type LoadedUser = {
   roles: string[]
   roleIds: string[]
   hasPassword: boolean
+  isConfirmed: boolean
   updatedAt: string | null
 }
 
@@ -61,6 +62,7 @@ type UserApiItem = {
   roles?: unknown
   roleIds?: unknown
   hasPassword?: boolean
+  isConfirmed?: boolean
   updatedAt?: string | null
   updated_at?: string | null
 }
@@ -268,6 +270,7 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
               roles: roleNames,
               roleIds: roleIds.length > 0 ? roleIds : roleNames,
               hasPassword: item.hasPassword !== false,
+              isConfirmed: item.isConfirmed !== false,
               updatedAt: typeof item.updatedAt === 'string'
                 ? item.updatedAt
                 : typeof item.updated_at === 'string'
@@ -399,11 +402,20 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
       options: initialRoleOptions,
       loadOptions: loadRoleOptions,
     })
+    items.push({
+      id: 'isConfirmed',
+      label: t('auth.users.form.field.active', 'Active'),
+      type: 'checkbox',
+      description: t(
+        'auth.users.form.field.activeHint',
+        'Clearing this deactivates the account: the user can no longer sign in and every active session is revoked.',
+      ),
+    })
     return items
   }, [actorIsSuperAdmin, initialRoleOptions, loadRoleOptions, passwordDescription, preloadedTenants, selectedOrgId, selectedTenantId, t, userHasPassword])
 
   const detailFieldIds = React.useMemo(() => {
-    const base: string[] = ['email', 'name', 'password', 'organizationId', 'roles']
+    const base: string[] = ['email', 'name', 'password', 'organizationId', 'roles', 'isConfirmed']
     if (actorIsSuperAdmin) base.splice(2, 0, 'tenantId')
     return base
   }, [actorIsSuperAdmin])
@@ -464,6 +476,7 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
         tenantId: initialUser.tenantId,
         organizationId: initialUser.organizationId,
         roles: initialUser.roleIds,
+        isConfirmed: initialUser.isConfirmed,
         updatedAt: initialUser.updatedAt,
         ...customFieldValues,
       }
@@ -555,6 +568,9 @@ export default function EditUserPage({ params }: { params?: { id?: string } }) {
               password: values.password && values.password.trim() ? values.password : undefined,
               organizationId: values.organizationId ? values.organizationId : undefined,
               roles: Array.isArray(values.roles) ? values.roles : [],
+              // Only sent when the checkbox actually resolved to a boolean — never
+              // default a missing value to `false`, which would silently deactivate.
+              ...(typeof values.isConfirmed === 'boolean' ? { isConfirmed: values.isConfirmed } : {}),
               ...(Object.keys(customFields).length ? { customFields } : {}),
             }
             const userOptimisticLockHeader = buildOptimisticLockHeader(initialUser?.updatedAt)

package/src/modules/auth/backend/users/page.tsx

@@ -9,6 +9,7 @@ import type { LegacyColumnDef as ColumnDef } from '@tanstack/react-table/legacy'
 import type { SortingState } from '@tanstack/react-table'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { Button } from '@open-mercato/ui/primitives/button'
+import { Badge } from '@open-mercato/ui/primitives/badge'
 import { RowActions } from '@open-mercato/ui/backend/RowActions'
 import { apiCall, withScopedApiRequestHeaders } from '@open-mercato/ui/backend/utils/apiCall'
 import { buildOptimisticLockHeader } from '@open-mercato/ui/backend/utils/optimisticLock'
@@ -30,6 +31,7 @@ type Row = {
   tenantId: string | null
   tenantName?: string | null
   roles: string[]
+  isConfirmed?: boolean
   updatedAt?: string | null
 }
 
@@ -378,6 +380,15 @@ export default function UsersListPage() {
       { accessorKey: 'name', header: t('auth.users.list.columns.name', 'Display name') },
       { accessorKey: 'organizationName', header: 'Organization' },
       { accessorKey: 'roles', header: 'Roles', cell: ({ row }) => (row.original.roles || []).join(', ') },
+      {
+        accessorKey: 'isConfirmed',
+        header: t('auth.users.list.columns.status', 'Status'),
+        cell: ({ row }) => (
+          row.original.isConfirmed === false
+            ? <Badge variant="neutral" dot>{t('auth.users.list.status.deactivated', 'Deactivated')}</Badge>
+            : <Badge variant="success" dot>{t('auth.users.list.status.active', 'Active')}</Badge>
+        ),
+      },
     ]
     if (showTenantColumn) {
       base.splice(1, 0, { accessorKey: 'tenantName', header: 'Tenant' })