@open-mercato/core 0.6.8-develop.6930.1.1e5976efc3 → 0.6.8-develop.6940.1.177ea30c6e

package/src/modules/currencies/services/providers/registry.ts

@@ -0,0 +1,35 @@
+import type { RateProvider } from './base'
+
+const CURRENCY_RATE_PROVIDER_REGISTRY_KEY = Symbol.for('@open-mercato/currencies/rate-provider-registry')
+
+type GlobalWithCurrencyRateProviderRegistry = typeof globalThis & {
+  [CURRENCY_RATE_PROVIDER_REGISTRY_KEY]?: Map<string, RateProvider>
+}
+
+function getProviderRegistry(): Map<string, RateProvider> {
+  const globalScope = globalThis as GlobalWithCurrencyRateProviderRegistry
+  if (!globalScope[CURRENCY_RATE_PROVIDER_REGISTRY_KEY]) {
+    globalScope[CURRENCY_RATE_PROVIDER_REGISTRY_KEY] = new Map<string, RateProvider>()
+  }
+  return globalScope[CURRENCY_RATE_PROVIDER_REGISTRY_KEY]
+}
+
+export function registerCurrencyRateProvider(provider: RateProvider): () => void {
+  const providerRegistry = getProviderRegistry()
+  providerRegistry.set(provider.source, provider)
+  return () => {
+    if (providerRegistry.get(provider.source) === provider) providerRegistry.delete(provider.source)
+  }
+}
+
+export function getCurrencyRateProvider(source: string): RateProvider | undefined {
+  return getProviderRegistry().get(source)
+}
+
+export function listCurrencyRateProviders(): RateProvider[] {
+  return Array.from(getProviderRegistry().values())
+}
+
+export function clearCurrencyRateProviders(): void {
+  getProviderRegistry().clear()
+}

package/src/modules/directory/api/organization-switcher/route.ts

@@ -129,7 +129,19 @@ export async function GET(req: NextRequest) {
 
     const rawTenantParam = url.searchParams.get('tenantId')
     const cookieTenant = getSelectedTenantFromRequest(req)
-    const actorTenantId = typeof auth.tenantId === 'string' && auth.tenantId.trim().length > 0 ? auth.tenantId.trim() : null
+    const normalizeTenantId = (value: unknown): string | null =>
+      typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
+
+    const authTenantId = normalizeTenantId(auth.tenantId)
+    // `auth.tenantId` is the tenant the session is currently scoped to, which a super-admin's
+    // cookie override replaces. The tenant they actually belong to survives under `actorTenantId`,
+    // so the "no selection" fallback below has to read that field — mirroring `organizationScope`.
+    // Reading `auth.tenantId` instead landed a scoped-away super-admin on `tenantRecords[0]`, the
+    // alphabetically-first tenant in the instance, rather than their own.
+    const actorTenantField = (auth as { actorTenantId?: string | null }).actorTenantId
+    const actorHomeTenantId = actorTenantField === undefined
+      ? authTenantId
+      : normalizeTenantId(actorTenantField)
     const actorIsSuperAdmin = auth.isSuperAdmin === true
 
     let requestedTenantId = rawTenantParam ?? (cookieTenant ?? undefined)
@@ -144,12 +156,12 @@ export async function GET(req: NextRequest) {
         name: typeof tenant.name === 'string' && tenant.name.length > 0 ? tenant.name : String(tenant.id),
         isActive: tenant.isActive !== false,
       }))
-      if (!tenantId) tenantId = actorTenantId ?? (tenantRecords[0]?.id ?? null)
+      if (!tenantId) tenantId = actorHomeTenantId ?? (tenantRecords[0]?.id ?? null)
       if (tenantId && tenantRecords.length && !tenantRecords.some((record) => record.id === tenantId)) {
         tenantId = tenantRecords[0]?.id ?? tenantId
       }
     } else {
-      tenantId = actorTenantId
+      tenantId = authTenantId
     }
 
     if (!tenantId) {
@@ -206,7 +218,7 @@ export async function GET(req: NextRequest) {
       }
     }
 
-    const scopedOrgId = actorTenantId && actorTenantId === tenantId ? auth.orgId ?? null : null
+    const scopedOrgId = authTenantId && authTenantId === tenantId ? auth.orgId ?? null : null
     const acl = await rbac.loadAcl(auth.sub, { tenantId, organizationId: scopedOrgId })
     const aclIsSuperAdmin = acl?.isSuperAdmin === true
     const effectiveIsSuperAdmin = actorIsSuperAdmin || aclIsSuperAdmin

package/src/modules/entities/api/encryption.ts

@@ -11,6 +11,7 @@ import {
   validateCrudMutationGuard,
 } from '@open-mercato/shared/lib/crud/mutation-guard'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 
 const ENCRYPTION_MAP_RESOURCE_KIND = 'entities.encryption_map'
 
@@ -19,13 +20,6 @@ export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['entities.definitions.manage'] },
 }
 
-function resolveScope(auth: { tenantId?: string | null; orgId?: string | null }) {
-  return {
-    tenantId: auth.tenantId ?? null,
-    organizationId: auth.orgId ?? null,
-  }
-}
-
 function toIsoOrNull(value: Date | string | null | undefined): string | null {
   if (value == null) return null
   if (value instanceof Date) {
@@ -42,9 +36,11 @@ export async function GET(req: Request) {
   if (!entityId) return NextResponse.json({ error: 'entityId is required' }, { status: 400 })
   const auth = await getAuthFromRequest(req)
   if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-  const { tenantId, organizationId } = resolveScope(auth)
 
   const container = await createRequestContainer()
+  const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+  const tenantId = scope.tenantId ?? auth.tenantId
+  const organizationId = scope.selectedId
   const em = container.resolve('em') as any
   const repo = em.getRepository(EncryptionMap)
   // Prefer tenant+org, then tenant-global, then global
@@ -55,7 +51,6 @@ export async function GET(req: Request) {
   ]
   let record: any = null
   for (const where of candidates) {
-    // eslint-disable-next-line no-await-in-loop
     const found = await repo.findOne({ ...where, deletedAt: null })
     if (found) {
       record = found
@@ -82,12 +77,21 @@ export async function POST(req: Request) {
     }
     const auth = await getAuthFromRequest(req)
     if (!auth?.tenantId) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })
-    const scope = resolveScope(auth)
     const payload = parsed.data
-    const tenantId: string = auth.tenantId
-    const organizationId = scope.organizationId
 
     const container = await createRequestContainer()
+    const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
+    if (scope.selectionRejected) {
+      return NextResponse.json(
+        {
+          error: 'Your selected organization is no longer available. Please re-select an organization and try again.',
+          code: 'organization_selection_invalid',
+        },
+        { status: 422 },
+      )
+    }
+    const tenantId = scope.tenantId ?? auth.tenantId
+    const organizationId = scope.selectedId
     const em = container.resolve('em') as any
     const repo = em.getRepository(EncryptionMap)
     const existing = await repo.findOne({ entityId: payload.entityId, tenantId, organizationId, deletedAt: null })
@@ -177,6 +181,11 @@ const conflictResponseSchema = z.object({
   expectedUpdatedAt: z.string(),
 })
 
+const organizationSelectionInvalidResponseSchema = z.object({
+  error: z.string(),
+  code: z.literal('organization_selection_invalid'),
+})
+
 export const openApi: OpenApiRouteDoc = {
   tag: 'Entities',
   summary: 'Manage encryption maps',
@@ -194,6 +203,7 @@ export const openApi: OpenApiRouteDoc = {
       responses: [
         { status: 200, description: 'Saved', schema: z.object({ ok: z.boolean(), updatedAt: z.string().nullable().optional() }) },
         { status: 409, description: 'Optimistic-lock conflict (stale write)', schema: conflictResponseSchema },
+        { status: 422, description: 'Selected organization is unavailable', schema: organizationSelectionInvalidResponseSchema },
       ],
     },
   },

package/src/modules/notifications/api/openapi.ts

@@ -48,6 +48,11 @@ export const errorResponseSchema = z.object({
   error: z.string(),
 })
 
+export const scopeErrorResponseSchema = z.object({
+  error: z.string(),
+  code: z.string(),
+})
+
 export const unreadCountResponseSchema = z.object({
   unreadCount: z.number(),
 })

package/src/modules/notifications/api/route.ts

@@ -8,6 +8,7 @@ import {
   isCrudCacheEnabled,
   resolveCrudCache,
 } from '@open-mercato/shared/lib/crud/cache'
+import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi/types'
 import { Notification } from '../data/entities'
 import { listNotificationsSchema, createNotificationSchema } from '../data/validators'
 import { toNotificationDto } from '../lib/notificationMapper'
@@ -19,13 +20,16 @@ import {
   NOTIFICATION_RESOURCE_KIND,
   notificationCrudErrorResponse,
   notificationValidationErrorResponse,
+  resolveGuardedNotificationContext,
   resolveNotificationContext,
   runGuardedNotificationWrite,
+  TENANT_SCOPE_REQUIRED_ERROR_CODE,
 } from '../lib/routeHelpers'
 import {
   buildNotificationsCrudOpenApi,
   createPagedListResponseSchema,
   notificationItemSchema,
+  scopeErrorResponseSchema,
 } from './openapi'
 
 export const metadata = {
@@ -89,7 +93,9 @@ function isNotificationsListPayload(value: unknown): value is NotificationsListP
 }
 
 export async function GET(req: Request) {
-  const { ctx, scope } = await resolveNotificationContext(req)
+  const resolved = await resolveGuardedNotificationContext(req)
+  if (!resolved.ok) return resolved.response
+  const { ctx, scope } = resolved
   const em = ctx.container.resolve('em') as EntityManager
 
   const url = new URL(req.url)
@@ -226,7 +232,7 @@ export async function POST(req: Request) {
   }
 }
 
-export const openApi = buildNotificationsCrudOpenApi({
+const notificationsCrudOpenApi = buildNotificationsCrudOpenApi({
   resourceName: 'Notification',
   querySchema: listNotificationsSchema,
   listResponseSchema: createPagedListResponseSchema(notificationItemSchema),
@@ -236,3 +242,26 @@ export const openApi = buildNotificationsCrudOpenApi({
     description: 'Creates a notification for a user.',
   },
 })
+
+const notificationsCrudGet = notificationsCrudOpenApi.methods?.GET ?? {}
+
+// The CRUD factory documents errors only for DELETE, and POST already gets an auto-generated 403
+// from its `requireFeatures` metadata. GET is authenticated-only, so its tenant-scope rejection has
+// to be declared here to reach the generated spec.
+export const openApi: OpenApiRouteDoc = {
+  ...notificationsCrudOpenApi,
+  methods: {
+    ...notificationsCrudOpenApi.methods,
+    GET: {
+      ...notificationsCrudGet,
+      errors: [
+        ...(notificationsCrudGet.errors ?? []),
+        {
+          status: 403,
+          description: `Request could not be resolved to a tenant scope (code: ${TENANT_SCOPE_REQUIRED_ERROR_CODE})`,
+          schema: scopeErrorResponseSchema,
+        },
+      ],
+    },
+  },
+}

package/src/modules/notifications/api/settings/route.ts

@@ -69,12 +69,19 @@ export async function POST(req: Request) {
     )
   }
 
+  // Unlike the other write routes this one does not go through `resolveNotificationContext`, so it
+  // never sees the organization scope's `actorTenantId` fallback. A super-admin scoped away from
+  // their own tenant has `auth.tenantId === null` with the real tenant preserved in `actorTenantId`,
+  // and delivery settings are instance-global anyway — reading it here keeps that caller working
+  // while a genuinely tenant-less principal still fails the guard below.
+  const actorTenantId = (auth as { actorTenantId?: string | null }).actorTenantId ?? null
+
   const container = await createRequestContainer()
   try {
     const guarded = await runGuardedNotificationWrite(
       container,
       {
-        tenantId: auth.tenantId ?? '',
+        tenantId: auth.tenantId ?? actorTenantId ?? '',
         organizationId: auth.orgId ?? null,
         userId: auth.sub ?? null,
       },

package/src/modules/notifications/api/unread-count/route.ts

@@ -8,7 +8,7 @@ import {
 } from '@open-mercato/shared/lib/crud/cache'
 import { Notification } from '../../data/entities'
 import { unreadCountResponseSchema } from '../openapi'
-import { resolveNotificationContext } from '../../lib/routeHelpers'
+import { resolveGuardedNotificationContext } from '../../lib/routeHelpers'
 import {
   buildNotificationReadScopeWhere,
   getNotificationReadScopeTagOrganizationIds,
@@ -39,7 +39,9 @@ function buildUnreadCountCacheKey(params: {
 }
 
 export async function GET(req: Request) {
-  const { scope, ctx } = await resolveNotificationContext(req)
+  const resolved = await resolveGuardedNotificationContext(req)
+  if (!resolved.ok) return resolved.response
+  const { scope, ctx } = resolved
   const em = ctx.container.resolve('em') as EntityManager
 
   const userId = scope.userId

package/src/modules/notifications/lib/routeHelpers.ts

@@ -60,6 +60,42 @@ export function notificationCrudErrorResponse(error: unknown): Response | null {
   return Response.json(error.body ?? { error: 'Notification request failed' }, { status: error.status })
 }
 
+/**
+ * Machine-readable discriminator for the tenant-scope rejection, mirroring
+ * `ORGANIZATION_SCOPE_REQUIRED_ERROR_CODE`. Without it a client cannot tell an unresolved scope
+ * apart from an ordinary permission denial, since both are a 403 carrying only a message.
+ */
+export const TENANT_SCOPE_REQUIRED_ERROR_CODE = 'tenant_scope_required'
+
+/**
+ * Fail closed when a request cannot be resolved to a tenant.
+ *
+ * `resolveNotificationContext` falls back to `''` when neither the organization scope nor the auth
+ * context yields a tenant — reachable for a genuinely tenant-less principal such as an unscoped
+ * super-admin API key. `notifications.tenant_id` is a NOT NULL uuid, so that `''` makes the driver
+ * reject every read and write built from the scope; dropping the tenant predicate instead would
+ * leave `recipientUserId` as the only thing keeping a read inside one tenant.
+ *
+ * Unlike the audit-log read guard there is no `isSuperAdmin` escape hatch: notification rows are
+ * per-recipient and per-tenant, so there is no cross-tenant read mode to preserve.
+ *
+ * Plain truthiness is deliberate — it matches the `?? ''` sentinel and also rejects a null or
+ * omitted tenant reaching this helper from a caller that builds its own scope.
+ */
+export async function requireResolvedNotificationTenantScope(
+  scope: { tenantId?: string | null },
+): Promise<Response | null> {
+  if (scope.tenantId) return null
+  const { t } = await resolveTranslations()
+  return Response.json(
+    {
+      error: t('api.errors.forbidden', 'Forbidden'),
+      code: TENANT_SCOPE_REQUIRED_ERROR_CODE,
+    },
+    { status: 403 },
+  )
+}
+
 /**
  * Resolve notification service and scope from a request.
  * Centralizes the common pattern used across all notification API routes.
@@ -92,6 +128,25 @@ export async function resolveNotificationContext(req: Request): Promise<Notifica
   }
 }
 
+export type GuardedNotificationContext =
+  | ({ ok: true } & NotificationRequestContext)
+  | { ok: false; response: Response }
+
+/**
+ * Resolve the notification context and reject the request when it has no tenant.
+ *
+ * Writes are structurally safe because every one of them funnels through
+ * `runGuardedNotificationWrite`. Reads have no such choke point, so they resolve their context
+ * through this wrapper instead: a route that forgets to check cannot compile past the discriminated
+ * result, which makes the guard impossible to skip by omission rather than by convention.
+ */
+export async function resolveGuardedNotificationContext(req: Request): Promise<GuardedNotificationContext> {
+  const resolved = await resolveNotificationContext(req)
+  const tenantScopeGuard = await requireResolvedNotificationTenantScope(resolved.scope)
+  if (tenantScopeGuard) return { ok: false, response: tenantScopeGuard }
+  return { ok: true, ...resolved }
+}
+
 /**
  * Mutation-guard options for a notification write.
  */
@@ -120,6 +175,11 @@ export async function runGuardedNotificationWrite<T>(
   options: NotificationMutationGuardOptions,
   write: () => Promise<T>,
 ): Promise<GuardedNotificationWriteResult<T>> {
+  const tenantScopeGuard = await requireResolvedNotificationTenantScope(scope)
+  if (tenantScopeGuard) {
+    return { ok: false, response: tenantScopeGuard }
+  }
+
   const guarded = await runRouteMutationGuards({
     container,
     req,

package/src/modules/payment_gateways/lib/descriptor-service.ts

@@ -1,5 +1,6 @@
 import {
   getAllIntegrations,
+  resolveIntegrationCredentialsSchema,
   type IntegrationScope,
 } from '@open-mercato/shared/modules/integrations/types'
 import {
@@ -52,6 +53,17 @@ async function resolveDescriptor(
     }
   }
 
+  const credentialsSchema = resolveIntegrationCredentialsSchema(integration.id)
+  if (credentialsSchema?.fields.length === 0) {
+    return {
+      ...descriptor,
+      integrationId: integration.id,
+      requiresConfiguration: false,
+      isConfigured: true,
+      configurationStatus: 'unmanaged',
+    }
+  }
+
   const [credentials, state] = await Promise.all([
     deps.integrationCredentialsService.resolve(integration.id, scope),
     deps.integrationStateService.resolveState(integration.id, scope),

package/src/modules/progress/data/validators.ts

@@ -29,6 +29,7 @@ export const completeJobSchema = z.object({
 export const failJobSchema = z.object({
   errorMessage: z.string().max(2000),
   errorStack: z.string().max(10000).optional(),
+  resultSummary: z.record(z.string(), z.unknown()).optional(),
 })
 
 export const listProgressJobsSchema = z.object({

package/src/modules/progress/lib/progressServiceImpl.ts

@@ -387,6 +387,7 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
         finishedAt: now,
         errorMessage: input.errorMessage,
         errorStack: input.errorStack,
+        ...(input.resultSummary ? { resultSummary: input.resultSummary } : {}),
         updatedAt: now,
         ...(entry
           ? {
@@ -412,6 +413,9 @@ export function createProgressService(em: EntityManager, eventBus: { emit: (even
       snapshot.finishedAt = now
       snapshot.errorMessage = input.errorMessage
       snapshot.errorStack = input.errorStack
+      if (input.resultSummary) {
+        snapshot.resultSummary = input.resultSummary
+      }
 
       const persistedJob = (await loadFreshJob(jobId, ctx)) ?? snapshot
 

package/src/modules/sales/commands/payments.ts

@@ -539,10 +539,14 @@ const createPaymentCommand: CommandHandler<
           linkHref: `/backend/sales/orders/${order.id}`,
         })
 
-        await notificationService.createForFeature(notificationInput, {
-          tenantId: payment.tenantId,
-          organizationId: payment.organizationId ?? null,
-        })
+        // Bulk-import backfills opt out of the per-record notification fan-out (and its inline
+        // e-mail delivery); interactive creates are unaffected.
+        if (!ctx.bulkImport?.skipNotifications) {
+          await notificationService.createForFeature(notificationInput, {
+            tenantId: payment.tenantId,
+            organizationId: payment.organizationId ?? null,
+          })
+        }
       }
     } catch (err) {
       // Notification creation is non-critical, don't fail the command

package/src/modules/sales/widgets/injection-table.ts

@@ -17,10 +17,13 @@ export const injectionTable: ModuleInjectionTable = {
       priority: 50,
     },
   ],
-  'data-table:sales.payments:columns': {
-    widgetId: 'sales.injection.payment-gateway-status-column',
-    priority: 50,
-  },
+  // NOTE: the 'data-table:sales.payments:columns' binding for
+  // 'sales.injection.payment-gateway-status-column' was removed here — it could never
+  // resolve. PaymentsSection.tsx renders its DataTable with no perspective/injectionSpotId/
+  // extensionTableId, so extensionTableId is null and the columns spot degrades to
+  // '__disabled__:columns'. The widget itself is still registered and is now UNBOUND: giving
+  // the payments table a real tableId so the gateway-status column finally renders is a sales
+  // feature gap, tracked in #5142 rather than silently reintroduced here.
   'crud-form:sales.payment_method:fields': {
     widgetId: 'sales.injection.payment-gateway-config-field',
     priority: 40,