@open-mercato/core 0.6.8-develop.6944.1.eef6a0ee1d → 0.6.8-develop.6948.1.8369fc4c97

package/src/modules/auth/lib/grantChecks.ts

@@ -1,9 +1,11 @@
 import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
-import { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
+import { badRequest, CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'
 import { hasFeature } from '@open-mercato/shared/security/features'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import type { OrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'
 
 type ActorAcl = {
   isSuperAdmin: boolean
@@ -27,6 +29,21 @@ type RoleTokenGrantCheckInput = GrantCheckContext & {
   roleTokens: unknown
 }
 
+type UserDestinationRolesInput = {
+  em: EntityManager
+  targetUserId: string
+  destinationTenantId: string | null | undefined
+  roleTokens: unknown
+}
+
+type UserDestinationScopeCheckInput = GrantCheckContext & {
+  actorIsSuperAdmin?: boolean
+  allowedOrganizationIds?: string[] | null
+  destinationTenantId: string | null | undefined
+  destinationOrganizationId: string | null | undefined
+  roles: Role[]
+}
+
 type FeatureGrantCheckInput = GrantCheckContext & {
   features: unknown
   isSuperAdmin?: boolean
@@ -38,6 +55,10 @@ type SuperAdminUserTargetInput = GrantCheckContext & {
   actorIsSuperAdmin?: boolean
 }
 
+type UserTargetAccessInput = SuperAdminUserTargetInput & {
+  organizationScope: Pick<OrganizationScope, 'allowedIds'>
+}
+
 type SuperAdminRoleTargetInput = GrantCheckContext & {
   targetRoleId: string
   actorIsSuperAdmin?: boolean
@@ -55,6 +76,97 @@ export async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckIn
   return roles
 }
 
+export async function resolveUserDestinationRoles(input: UserDestinationRolesInput): Promise<Role[]> {
+  const destinationTenantId = normalizeNullableString(input.destinationTenantId)
+  if (Array.isArray(input.roleTokens)) {
+    return resolveRolesForGrant(input.em, normalizeStringList(input.roleTokens), destinationTenantId)
+  }
+
+  const links = await findWithDecryption(
+    input.em,
+    UserRole,
+    { user: input.targetUserId as unknown as User } as FilterQuery<UserRole>,
+    { populate: ['role'] },
+    { tenantId: null, organizationId: null },
+  )
+  const roles: Role[] = []
+  for (const link of links) {
+    const linkedRole = (link as { role?: Role | string | null }).role
+    if (linkedRole && typeof linkedRole === 'object') {
+      roles.push(linkedRole)
+      continue
+    }
+    if (typeof linkedRole === 'string') {
+      const resolvedRole = await resolveRoleForGrant(input.em, linkedRole, null)
+      if (resolvedRole) {
+        roles.push(resolvedRole)
+        continue
+      }
+    }
+    throw badRequest(await translateAuthError(
+      'auth.users.errors.invalidRoleAssignment',
+      'User has an invalid role assignment',
+    ))
+  }
+  return roles
+}
+
+export async function assertActorCanAssignUserDestination(
+  input: UserDestinationScopeCheckInput,
+): Promise<void> {
+  const destinationTenantId = normalizeNullableString(input.destinationTenantId)
+  const destinationOrganizationId = normalizeNullableString(input.destinationOrganizationId)
+  if (!destinationTenantId || !destinationOrganizationId) {
+    return throwUserDestinationOrganizationNotFound(400)
+  }
+
+  for (const role of input.roles) {
+    if (normalizeNullableString(role.tenantId) !== destinationTenantId) {
+      throw forbidden(await translateAuthError(
+        'auth.users.errors.roleOutsideDestinationTenant',
+        'Cannot retain or assign a role outside the destination tenant.',
+      ))
+    }
+  }
+
+  if (await resolveActorIsSuperAdmin(input)) return
+
+  const actorTenantId = normalizeNullableString(input.tenantId)
+  if (!actorTenantId || actorTenantId !== destinationTenantId) {
+    return throwUserDestinationOrganizationNotFound(404)
+  }
+
+  const actorAcl = await loadActorAcl(input)
+  const allowedOrganizationIds = input.allowedOrganizationIds === undefined
+    ? actorAcl.organizations
+    : input.allowedOrganizationIds
+  if (
+    allowedOrganizationIds !== null
+    && !allowedOrganizationIds.includes('__all__')
+    && !allowedOrganizationIds.includes(destinationOrganizationId)
+  ) {
+    throw forbidden(await translateAuthError(
+      'auth.users.errors.destinationOrganizationOutsideScope',
+      'Cannot assign user to a destination organization outside actor scope.',
+    ))
+  }
+
+  await assertActorCanGrantRoles({
+    ...input,
+    tenantId: destinationTenantId,
+    roles: input.roles,
+  })
+}
+
+export async function throwUserDestinationOrganizationNotFound(status: 400 | 404): Promise<never> {
+  throw new CrudHttpError(status, {
+    error: await translateAuthError(
+      'auth.users.errors.organizationNotFound',
+      'Organization not found',
+    ),
+  })
+}
+
 export async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {
   if (!input.roles.length) return
 
@@ -127,7 +239,7 @@ export async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdmin
   }
 }
 
-export async function assertActorCanAccessUserTarget(input: SuperAdminUserTargetInput): Promise<void> {
+export async function assertActorCanAccessUserTarget(input: UserTargetAccessInput): Promise<void> {
   const isSuperAdmin = await resolveActorIsSuperAdmin(input)
   if (isSuperAdmin) return
 
@@ -151,10 +263,9 @@ export async function assertActorCanAccessUserTarget(input: SuperAdminUserTarget
     throw new CrudHttpError(404, { error: 'User not found' })
   }
 
-  const actorAcl = await loadActorAcl(input)
-  if (actorAcl.organizations !== null && !actorAcl.organizations.includes('__all__')) {
+  if (input.organizationScope.allowedIds !== null) {
     const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)
-    if (!targetOrganizationId || !actorAcl.organizations.includes(targetOrganizationId)) {
+    if (!targetOrganizationId || !input.organizationScope.allowedIds.includes(targetOrganizationId)) {
       throw forbidden('Not authorized to access this user.')
     }
   }
@@ -400,3 +511,8 @@ function normalizeNullableString(value: unknown): string | null {
 function isWildcardFeature(feature: string): boolean {
   return feature.endsWith('.*')
 }
+
+async function translateAuthError(key: string, fallback: string): Promise<string> {
+  const { translate } = await resolveTranslations()
+  return translate(key, fallback)
+}

package/src/modules/auth/lib/sessionIntegrity.ts

@@ -48,10 +48,11 @@ export async function resolveCanonicalStaffAuthContext(
   // still exist (not soft-deleted, not expired). This is what makes logout / password-reset
   // actually invalidate an already-issued JWT.
   //
-  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period
-  // (controlled by JWT_LEGACY_GRACE_MINUTES) so that rolling deployments don't force-logout
-  // every user. Once the grace period expires these tokens will fail signature verification
-  // in `verifyJwt` before reaching this point.
+  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period so
+  // that rolling deployments don't force-logout every user. `verifyJwt` owns that window: it only
+  // marks a payload `_legacyToken` while the token's own `iat` is within JWT_LEGACY_GRACE_MINUTES
+  // and before JWT_LEGACY_CUTOVER_AT, so an aged or post-cutover raw-secret token fails
+  // verification before reaching this point and every remaining token must carry a live `sid`.
   const sessionId = normalizeScopeId(typeof auth.sid === 'string' ? auth.sid : null)
   if (sessionId === INVALID_SCOPE) return null
   if (sessionId === null) {

package/src/modules/customer_accounts/lib/customerAuth.ts

@@ -18,7 +18,12 @@ export interface CustomerAuthContext {
   isPortalAdmin?: boolean
 }
 
-async function assertSessionStillActive(sessionId: string): Promise<boolean> {
+async function assertSessionStillActive(input: {
+  sessionId: string
+  userId: string
+  tenantId: string
+  organizationId: string
+}): Promise<boolean> {
   try {
     const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
       import('@open-mercato/shared/lib/di/container'),
@@ -26,7 +31,7 @@ async function assertSessionStillActive(sessionId: string): Promise<boolean> {
     ])
     const container = await createRequestContainer()
     const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>
-    const session = await service.findActiveSessionById(sessionId)
+    const session = await service.findActiveSessionForClaims(input)
     return session !== null
   } catch {
     // Fail closed: if we cannot verify the session, treat the token as revoked to prevent
@@ -108,32 +113,46 @@ export async function getCustomerAuthFromRequest(req: Request): Promise<Customer
 
   try {
     let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null
-    // Legacy fallback: try raw JWT_SECRET for pre-migration customer tokens
+    // Legacy fallback: accept a pre-migration customer token signed with the raw JWT_SECRET, but
+    // only while `verifyJwt` itself still considers it legacy — it owns the grace window (token
+    // `iat` vs JWT_LEGACY_GRACE_MINUTES / JWT_LEGACY_CUTOVER_AT) and marks the payload. Trusting
+    // the bare return value would also let a staff-audience token through this branch, because
+    // the default `verifyJwt` path verifies against the staff-derived key.
     if (!payload) {
-      payload = verifyJwt(token) as Record<string, unknown> | null
-      if (payload) payload._legacyToken = true
+      const legacyPayload = verifyJwt(token) as Record<string, unknown> | null
+      if (legacyPayload && legacyPayload._legacyToken === true) payload = legacyPayload
     }
     if (!payload) return null
     if (payload.type !== 'customer') return null
     const sid = typeof payload.sid === 'string' ? payload.sid : ''
     if (!sid && payload._legacyToken !== true) return null
-    const stillActive = sid ? await assertSessionStillActive(sid) : true
+    const userId = String(payload.sub)
+    const tenantId = String(payload.tenantId)
+    const organizationId = String(payload.orgId)
+    const stillActive = sid
+      ? await assertSessionStillActive({
+          sessionId: sid,
+          userId,
+          tenantId,
+          organizationId,
+        })
+      : true
     if (!stillActive) return null
 
     const userState = await validateUserState(
-      String(payload.sub),
-      String(payload.tenantId),
-      String(payload.orgId),
+      userId,
+      tenantId,
+      organizationId,
       payload.iat,
     )
     if (!userState.valid) return null
 
     return {
-      sub: String(payload.sub),
+      sub: userId,
       sid,
       type: 'customer',
-      tenantId: String(payload.tenantId),
-      orgId: String(payload.orgId),
+      tenantId,
+      orgId: organizationId,
       email: String(payload.email || ''),
       displayName: String(payload.displayName || ''),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,

package/src/modules/customer_accounts/lib/customerAuthServer.ts

@@ -20,11 +20,16 @@ const logger = createLogger('customer_accounts').child({ component: 'customer-au
 
 export type { CustomerAuthContext }
 
-async function assertSessionStillActive(sessionId: string): Promise<boolean> {
+async function assertSessionStillActive(input: {
+  sessionId: string
+  userId: string
+  tenantId: string
+  organizationId: string
+}): Promise<boolean> {
   try {
     const container = await createRequestContainer()
     const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>
-    const session = await service.findActiveSessionById(sessionId)
+    const session = await service.findActiveSessionForClaims(input)
     return session !== null
   } catch {
     return false
@@ -60,29 +65,36 @@ export async function getCustomerAuthFromCookies(
     const sid = typeof payload.sid === 'string' ? payload.sid : ''
     if (!sid) return null
     const tenantId = String(payload.tenantId)
+    const userId = String(payload.sub)
+    const organizationId = String(payload.orgId)
     if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {
       // Cross-host JWT replay defense. See spec rev 5 Customer Authentication
       // section: the host-resolved tenant is the authoritative scope; mismatched
       // JWTs are rejected as if unauthenticated.
       return null
     }
-    const stillActive = await assertSessionStillActive(sid)
+    const stillActive = await assertSessionStillActive({
+      sessionId: sid,
+      userId,
+      tenantId,
+      organizationId,
+    })
     if (!stillActive) return null
 
     const userState = await validateUserState(
-      String(payload.sub),
+      userId,
       tenantId,
-      String(payload.orgId),
+      organizationId,
       payload.iat,
     )
     if (!userState.valid) return null
 
     return {
-      sub: String(payload.sub),
+      sub: userId,
       sid,
       type: 'customer',
       tenantId,
-      orgId: String(payload.orgId),
+      orgId: organizationId,
       email: String(payload.email || ''),
       displayName: String(payload.displayName || ''),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,

package/src/modules/customer_accounts/services/customerSessionService.ts

@@ -106,6 +106,26 @@ export class CustomerSessionService {
     return session
   }
 
+  async findActiveSessionForClaims(input: {
+    sessionId: string
+    userId: string
+    tenantId: string
+    organizationId: string
+  }): Promise<CustomerUserSession | null> {
+    const session = await this.em.findOne(CustomerUserSession, {
+      id: input.sessionId,
+      user: {
+        id: input.userId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      },
+      deletedAt: null,
+    })
+    if (!session) return null
+    if (session.expiresAt.getTime() < Date.now()) return null
+    return session
+  }
+
   async revokeSession(sessionId: string): Promise<void> {
     await this.em.nativeUpdate(CustomerUserSession, { id: sessionId }, { deletedAt: new Date() })
   }

package/src/modules/customers/api/interactions/route.ts

@@ -59,6 +59,7 @@ export const listSchema = z
     search: z.string().trim().min(1).optional(),
     from: z.coerce.date().optional(),
     to: z.coerce.date().optional(),
+    recurrenceMasters: z.enum(['true', 'false']).optional(),
     pinned: z.enum(['true', 'false']).optional(),
     sortField: interactionSortFieldSchema.optional(),
     sortDir: z.enum(['asc', 'desc']).optional(),
@@ -360,11 +361,21 @@ function applyInteractionListFilters(
     const searchTerm = `%${escapeLikePattern(query.search)}%`
     q = q.where(sql<boolean>`coalesce(title, '') ilike ${searchTerm} or coalesce(body, '') ilike ${searchTerm}`)
   }
-  if (query.from) {
-    q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`)
-  }
-  if (query.to) {
-    q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)
+  if (query.recurrenceMasters === 'true') {
+    q = q.where('recurrence_rule', 'is not', null)
+    if (query.from) {
+      q = q.where(sql<boolean>`recurrence_end is null or recurrence_end >= ${query.from}`)
+    }
+    if (query.to) {
+      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)
+    }
+  } else {
+    if (query.from) {
+      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`)
+    }
+    if (query.to) {
+      q = q.where(sql<boolean>`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`)
+    }
   }
   return q
 }

package/src/modules/customers/components/calendar/CalendarScreen.tsx

@@ -228,15 +228,15 @@ export function CalendarScreen({ resourcesEnabled = false, staffEnabled = true }
 
   const typeOptions = React.useMemo(() => {
     const values = new Set<string>(Object.keys(typeLabels))
-    for (const item of items) values.add(item.interactionType)
+    for (const item of visibleItems) values.add(item.interactionType)
     return [...values]
       .sort((a, b) => a.localeCompare(b))
       .map((value) => ({ value, label: typeLabels[value] ?? value }))
-  }, [items, typeLabels])
+  }, [visibleItems, typeLabels])
 
   const ownerOptions = React.useMemo(() => {
     const participantNames = new Map<string, string>()
-    for (const item of items) {
+    for (const item of visibleItems) {
       for (const participant of item.participants) {
         if (participant.name && !participantNames.has(participant.userId)) {
           participantNames.set(participant.userId, participant.name)
@@ -244,14 +244,14 @@ export function CalendarScreen({ resourcesEnabled = false, staffEnabled = true }
       }
     }
     const owners = new Map<string, string>()
-    for (const item of items) {
+    for (const item of visibleItems) {
       if (!item.ownerUserId || owners.has(item.ownerUserId)) continue
       owners.set(item.ownerUserId, participantNames.get(item.ownerUserId) ?? item.ownerUserId)
     }
     return [...owners.entries()]
       .map(([value, label]) => ({ value, label }))
       .sort((first, second) => first.label.localeCompare(second.label))
-  }, [items])
+  }, [visibleItems])
 
   const timezoneLabel = React.useMemo(() => buildTimezoneLabel(), [])
 

package/src/modules/customers/components/calendar/editor/hooks.ts

@@ -11,7 +11,7 @@ import { mapInteractionToCalendarItem } from '../../../lib/calendar/mapItem'
 import { expandOccurrences } from '../../../lib/calendar/recurrence'
 import { getFetchWindow } from '../../../lib/calendar/range'
 import type { CalendarItem } from '../types'
-import { fetchInteractionWindow } from '../useCalendarItems'
+import { fetchCalendarCandidates } from '../useCalendarItems'
 import { fetchDealById, fetchRelatedEntityById, findStaffMemberName } from './lookups'
 
 // Edit-mode prefill stores ids only (parseItemToFormState is pure); resolve the
@@ -118,7 +118,7 @@ export function useConflictProbe(
     let active = true
     const timer = setTimeout(async () => {
       try {
-        const { payloads } = await fetchInteractionWindow(fetchWindow, controller.signal)
+        const { payloads } = await fetchCalendarCandidates(fetchWindow, controller.signal)
         if (!active) return
         const others: CalendarItem[] = []
         for (const payload of payloads) {

package/src/modules/customers/components/calendar/useCalendarItems.ts

@@ -15,6 +15,10 @@ import {
 const PAGE_LIMIT = 100
 export const MAX_WINDOW_ITEMS = 500
 
+type FetchInteractionWindowOptions = {
+  recurrenceMasters?: boolean
+}
+
 /**
  * Cursor-follows `/api/customers/interactions` across the given window (already
  * padded by the caller) up to `MAX_WINDOW_ITEMS`. Shared by the grid data hook
@@ -23,6 +27,7 @@ export const MAX_WINDOW_ITEMS = 500
 export async function fetchInteractionWindow(
   window: CalendarRange,
   signal?: AbortSignal,
+  options: FetchInteractionWindowOptions = {},
 ): Promise<{ payloads: CalendarInteractionPayload[]; truncated: boolean }> {
   const collected: CalendarInteractionPayload[] = []
   let cursor: string | undefined
@@ -33,6 +38,7 @@ export async function fetchInteractionWindow(
       to: window.to.toISOString(),
       limit: String(PAGE_LIMIT),
     })
+    if (options.recurrenceMasters) params.set('recurrenceMasters', 'true')
     if (cursor) params.set('cursor', cursor)
     const call = await apiCall<{ items?: unknown[]; nextCursor?: string }>(
       `/api/customers/interactions?${params.toString()}`,
@@ -53,6 +59,40 @@ export async function fetchInteractionWindow(
   return { payloads: collected.slice(0, MAX_WINDOW_ITEMS), truncated }
 }
 
+export function mergeInteractionPayloads(
+  windowPayloads: CalendarInteractionPayload[],
+  recurringPayloads: CalendarInteractionPayload[],
+): { payloads: CalendarInteractionPayload[]; truncated: boolean } {
+  const windowById = new Map(windowPayloads.map((payload) => [payload.id, payload]))
+  const byId = new Map<string, CalendarInteractionPayload>()
+  for (const payload of recurringPayloads) {
+    byId.set(payload.id, windowById.get(payload.id) ?? payload)
+  }
+  for (const payload of windowPayloads) {
+    if (!byId.has(payload.id)) byId.set(payload.id, payload)
+  }
+  const payloads = Array.from(byId.values())
+  return {
+    payloads: payloads.slice(0, MAX_WINDOW_ITEMS),
+    truncated: payloads.length > MAX_WINDOW_ITEMS,
+  }
+}
+
+export async function fetchCalendarCandidates(
+  window: CalendarRange,
+  signal?: AbortSignal,
+): Promise<{ payloads: CalendarInteractionPayload[]; truncated: boolean }> {
+  const [windowResult, recurringResult] = await Promise.all([
+    fetchInteractionWindow(window, signal),
+    fetchInteractionWindow(window, signal, { recurrenceMasters: true }),
+  ])
+  const merged = mergeInteractionPayloads(windowResult.payloads, recurringResult.payloads)
+  return {
+    payloads: merged.payloads,
+    truncated: windowResult.truncated || recurringResult.truncated || merged.truncated,
+  }
+}
+
 type ActivityTypeDictionaryEntry = {
   value?: unknown
   label?: unknown
@@ -127,13 +167,10 @@ export function useCalendarItems(range: CalendarRange): UseCalendarItemsResult {
       setError(null)
       try {
         const fetchWindow = getFetchWindow({ from: new Date(fromTime), to: new Date(toTime) })
-        const { payloads: collected, truncated: windowTruncated } = await fetchInteractionWindow(
-          fetchWindow,
-          controller.signal,
-        )
+        const result = await fetchCalendarCandidates(fetchWindow, controller.signal)
         if (cancelled) return
-        setPayloads(collected)
-        setTruncated(windowTruncated)
+        setPayloads(result.payloads)
+        setTruncated(result.truncated)
       } catch (err) {
         if (cancelled || controller.signal.aborted) return
         setPayloads([])