@open-mercato/core 0.6.8-develop.6944.1.eef6a0ee1d → 0.6.8-develop.6950.1.912d574d60

package/dist/modules/auth/lib/grantChecks.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/grantChecks.ts"],
-  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\ntype SuperAdminUserTargetInput = GrantCheckContext & {\n  targetUserId: string\n  actorIsSuperAdmin?: boolean\n}\n\ntype SuperAdminRoleTargetInput = GrantCheckContext & {\n  targetRoleId: string\n  actorIsSuperAdmin?: boolean\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nexport async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator accounts.')\n  }\n}\n\nexport async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator roles.')\n  }\n}\n\nexport async function assertActorCanAccessUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    User,\n    { id: input.targetUserId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted, which MikroORM's soft-delete filter hides):\n  // delegate to the caller. Every wired call site is itself tenant-scoped \u2014 the\n  // ACL/consents reads filter by auth.tenantId and the user commands re-load by\n  // id within tenant \u2014 so a missing target yields a safe empty/404 there. The\n  // guard's job is to block a foreign *existing* target, below.\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'User not found' })\n  }\n\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.organizations !== null && !actorAcl.organizations.includes('__all__')) {\n    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)\n    if (!targetOrganizationId || !actorAcl.organizations.includes(targetOrganizationId)) {\n      throw forbidden('Not authorized to access this user.')\n    }\n  }\n}\n\nexport async function assertActorCanAccessRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    Role,\n    { id: input.targetRoleId } as FilterQuery<Role>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted): delegate (see assertActorCanAccessUserTarget).\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'Role not found' })\n  }\n}\n\nasync function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {\n  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin\n  const acl = await loadActorAcl(input)\n  return acl.isSuperAdmin\n}\n\nexport async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {\n  const directGrant = await em.findOne(\n    UserAcl,\n    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,\n  )\n  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roleIds = (Array.isArray(links) ? links : [])\n    .map((link) => {\n      const role = (link as { role?: { id?: unknown } | string | null }).role\n      if (!role) return null\n      if (typeof role === 'string') return role\n      return role.id ? String(role.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (!roleIds.length) return false\n  const roleGrant = await em.findOne(\n    RoleAcl,\n    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {\n  const grant = await em.findOne(\n    RoleAcl,\n    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {\n  const ids = new Set<string>()\n  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }\n  if (tenantId) userAclFilter.tenantId = tenantId\n  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)\n  for (const acl of userAcls) {\n    const userRef = (acl as { user?: { id?: unknown } | string | null }).user\n    const userId = userRef && typeof userRef === 'object'\n      ? userRef.id\n      : userRef\n    if (userId) ids.add(String(userId))\n  }\n  const roleAcls = await em.find(\n    RoleAcl,\n    { isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  const roleIds = roleAcls\n    .map((acl) => {\n      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role\n      if (!roleRef) return null\n      if (typeof roleRef === 'string') return roleRef\n      return roleRef.id ? String(roleRef.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (roleIds.length) {\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    for (const link of Array.isArray(links) ? links : []) {\n      const userRef = (link as { user?: { id?: unknown } | string | null }).user\n      const userId = userRef && typeof userRef === 'object'\n        ? userRef.id\n        : userRef\n      if (userId) ids.add(String(userId))\n    }\n  }\n  return ids\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n"],
-  "mappings": "AACA,SAAS,eAAe,iBAAiB;AACzC,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,MAAM,SAAS,MAAM,SAAS,gBAAgB;AAyCvD,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,oEAAoE;AAAA,EACtF;AACF;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,iEAAiE;AAAA,EACnF;AACF;AAEA,eAAsB,+BAA+B,OAAiD;AACpG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAMA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,kBAAkB,QAAQ,CAAC,SAAS,cAAc,SAAS,SAAS,GAAG;AAClF,UAAM,uBAAuB,wBAAyB,OAA8C,cAAc;AAClH,QAAI,CAAC,wBAAwB,CAAC,SAAS,cAAc,SAAS,oBAAoB,GAAG;AACnF,YAAM,UAAU,qCAAqC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,+BAA+B,OAAiD;AACpG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAEA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AACF;AAEA,eAAe,yBAAyB,OAA8E;AACpH,MAAI,OAAO,MAAM,sBAAsB,UAAW,QAAO,MAAM;AAC/D,QAAM,MAAM,MAAM,aAAa,KAAK;AACpC,SAAO,IAAI;AACb;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,MAAI,eAAgB,YAA2C,iBAAiB,KAAM,QAAO;AAC7F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAAkB;AAAA,IAC1B,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9C,IAAI,CAAC,SAAS;AACb,UAAM,OAAQ,KAAqD;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,YAAY,MAAM,GAAG;AAAA,IACzB;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAc,cAAc,KAAK;AAAA,EAC1D;AACA,SAAO,CAAC,CAAC,aAAc,UAAyC,iBAAiB;AACnF;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,SAAO,CAAC,CAAC,SAAU,MAAqC,iBAAiB;AAC3E;AAEA,eAAsB,sBAAsB,IAAmB,UAA+C;AAC5G,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,gBAAyC,EAAE,cAAc,KAAK;AACpE,MAAI,SAAU,eAAc,WAAW;AACvC,QAAM,WAAW,MAAM,GAAG,KAAK,SAAS,aAAqC;AAC7E,aAAW,OAAO,UAAU;AAC1B,UAAM,UAAW,IAAoD;AACrE,UAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,QAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA,EAAE,cAAc,KAAK;AAAA,EACvB;AACA,QAAM,UAAU,SACb,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAW,IAAoD;AACrE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,WAAO,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI;AAAA,EAC3C,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,QAAQ,QAAQ;AAClB,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,UAAW,KAAqD;AACtE,YAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,UAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;",
+  "sourcesContent": ["import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'\nimport { badRequest, CrudHttpError, forbidden } from '@open-mercato/shared/lib/crud/errors'\nimport { hasFeature } from '@open-mercato/shared/security/features'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport { Role, RoleAcl, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport type { OrganizationScope } from '@open-mercato/core/modules/directory/utils/organizationScope'\n\ntype ActorAcl = {\n  isSuperAdmin: boolean\n  features: string[]\n  organizations: string[] | null\n}\n\ntype GrantCheckContext = {\n  em: EntityManager\n  rbacService: RbacService\n  actorUserId: string | null | undefined\n  tenantId: string | null | undefined\n  organizationId?: string | null | undefined\n}\n\ntype RoleGrantCheckInput = GrantCheckContext & {\n  roles: Role[]\n}\n\ntype RoleTokenGrantCheckInput = GrantCheckContext & {\n  roleTokens: unknown\n}\n\ntype UserDestinationRolesInput = {\n  em: EntityManager\n  targetUserId: string\n  destinationTenantId: string | null | undefined\n  roleTokens: unknown\n}\n\ntype UserDestinationScopeCheckInput = GrantCheckContext & {\n  actorIsSuperAdmin?: boolean\n  allowedOrganizationIds?: string[] | null\n  destinationTenantId: string | null | undefined\n  destinationOrganizationId: string | null | undefined\n  roles: Role[]\n}\n\ntype FeatureGrantCheckInput = GrantCheckContext & {\n  features: unknown\n  isSuperAdmin?: boolean\n  organizations?: string[] | null\n}\n\ntype SuperAdminUserTargetInput = GrantCheckContext & {\n  targetUserId: string\n  actorIsSuperAdmin?: boolean\n}\n\ntype UserTargetAccessInput = SuperAdminUserTargetInput & {\n  organizationScope: Pick<OrganizationScope, 'allowedIds'>\n}\n\ntype SuperAdminRoleTargetInput = GrantCheckContext & {\n  targetRoleId: string\n  actorIsSuperAdmin?: boolean\n}\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i\n\nexport async function assertActorCanGrantRoleTokens(input: RoleTokenGrantCheckInput): Promise<Role[]> {\n  const tokens = normalizeStringList(input.roleTokens)\n  if (!tokens.length) return []\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const roles = await resolveRolesForGrant(input.em, tokens, tenantId)\n  await assertActorCanGrantRoles({ ...input, tenantId, roles })\n  return roles\n}\n\nexport async function resolveUserDestinationRoles(input: UserDestinationRolesInput): Promise<Role[]> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  if (Array.isArray(input.roleTokens)) {\n    return resolveRolesForGrant(input.em, normalizeStringList(input.roleTokens), destinationTenantId)\n  }\n\n  const links = await findWithDecryption(\n    input.em,\n    UserRole,\n    { user: input.targetUserId as unknown as User } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roles: Role[] = []\n  for (const link of links) {\n    const linkedRole = (link as { role?: Role | string | null }).role\n    if (linkedRole && typeof linkedRole === 'object') {\n      roles.push(linkedRole)\n      continue\n    }\n    if (typeof linkedRole === 'string') {\n      const resolvedRole = await resolveRoleForGrant(input.em, linkedRole, null)\n      if (resolvedRole) {\n        roles.push(resolvedRole)\n        continue\n      }\n    }\n    throw badRequest(await translateAuthError(\n      'auth.users.errors.invalidRoleAssignment',\n      'User has an invalid role assignment',\n    ))\n  }\n  return roles\n}\n\nexport async function assertActorCanAssignUserDestination(\n  input: UserDestinationScopeCheckInput,\n): Promise<void> {\n  const destinationTenantId = normalizeNullableString(input.destinationTenantId)\n  const destinationOrganizationId = normalizeNullableString(input.destinationOrganizationId)\n  if (!destinationTenantId || !destinationOrganizationId) {\n    return throwUserDestinationOrganizationNotFound(400)\n  }\n\n  for (const role of input.roles) {\n    if (normalizeNullableString(role.tenantId) !== destinationTenantId) {\n      throw forbidden(await translateAuthError(\n        'auth.users.errors.roleOutsideDestinationTenant',\n        'Cannot retain or assign a role outside the destination tenant.',\n      ))\n    }\n  }\n\n  if (await resolveActorIsSuperAdmin(input)) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  if (!actorTenantId || actorTenantId !== destinationTenantId) {\n    return throwUserDestinationOrganizationNotFound(404)\n  }\n\n  const actorAcl = await loadActorAcl(input)\n  const allowedOrganizationIds = input.allowedOrganizationIds === undefined\n    ? actorAcl.organizations\n    : input.allowedOrganizationIds\n  if (\n    allowedOrganizationIds !== null\n    && !allowedOrganizationIds.includes('__all__')\n    && !allowedOrganizationIds.includes(destinationOrganizationId)\n  ) {\n    throw forbidden(await translateAuthError(\n      'auth.users.errors.destinationOrganizationOutsideScope',\n      'Cannot assign user to a destination organization outside actor scope.',\n    ))\n  }\n\n  await assertActorCanGrantRoles({\n    ...input,\n    tenantId: destinationTenantId,\n    roles: input.roles,\n  })\n}\n\nexport async function throwUserDestinationOrganizationNotFound(status: 400 | 404): Promise<never> {\n  throw new CrudHttpError(status, {\n    error: await translateAuthError(\n      'auth.users.errors.organizationNotFound',\n      'Organization not found',\n    ),\n  })\n}\n\nexport async function assertActorCanGrantRoles(input: RoleGrantCheckInput): Promise<void> {\n  if (!input.roles.length) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  const actorAcl = await loadActorAcl({ ...input, tenantId })\n  if (actorAcl.isSuperAdmin) return\n\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant roles.')\n  }\n\n  for (const role of input.roles) {\n    const roleTenantId = normalizeNullableString(role.tenantId)\n    if (roleTenantId !== tenantId) {\n      throw forbidden('Cannot grant a role outside the target tenant.')\n    }\n\n    const acl = await findOneWithDecryption(\n      input.em,\n      RoleAcl,\n      { role, tenantId } as FilterQuery<RoleAcl>,\n      {},\n      { tenantId, organizationId: null },\n    )\n    if (!acl) continue\n\n    assertActorCanGrantAclSnapshot(actorAcl, {\n      isSuperAdmin: !!acl.isSuperAdmin,\n      features: normalizeStringList(acl.featuresJson),\n      organizations: normalizeOrganizationList(acl.organizationsJson),\n    })\n  }\n}\n\nexport async function assertActorCanGrantAcl(input: FeatureGrantCheckInput): Promise<void> {\n  const actorAcl = await loadActorAcl(input)\n  if (actorAcl.isSuperAdmin) return\n\n  const tenantId = normalizeNullableString(input.tenantId)\n  if (!tenantId) {\n    throw forbidden('Tenant context is required to grant ACL features.')\n  }\n\n  assertActorCanGrantAclSnapshot(actorAcl, {\n    isSuperAdmin: !!input.isSuperAdmin,\n    features: normalizeStringList(input.features),\n    organizations: input.organizations === undefined ? undefined : normalizeOrganizationList(input.organizations),\n  })\n}\n\nexport function normalizeGrantFeatureList(features: unknown): string[] {\n  return normalizeStringList(features)\n}\n\nexport async function assertActorCanModifySuperAdminUserTarget(input: SuperAdminUserTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isUserEffectivelySuperAdmin(input.em, input.targetUserId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator accounts.')\n  }\n}\n\nexport async function assertActorCanModifySuperAdminRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const actorIsSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (actorIsSuperAdmin) return\n  const targetIsSuperAdmin = await isRoleEffectivelySuperAdmin(input.em, input.targetRoleId)\n  if (targetIsSuperAdmin) {\n    throw forbidden('Only super administrators can modify super administrator roles.')\n  }\n}\n\nexport async function assertActorCanAccessUserTarget(input: UserTargetAccessInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    User,\n    { id: input.targetUserId } as FilterQuery<User>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted, which MikroORM's soft-delete filter hides):\n  // delegate to the caller. Every wired call site is itself tenant-scoped \u2014 the\n  // ACL/consents reads filter by auth.tenantId and the user commands re-load by\n  // id within tenant \u2014 so a missing target yields a safe empty/404 there. The\n  // guard's job is to block a foreign *existing* target, below.\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'User not found' })\n  }\n\n  if (input.organizationScope.allowedIds !== null) {\n    const targetOrganizationId = normalizeNullableString((target as { organizationId?: string | null }).organizationId)\n    if (!targetOrganizationId || !input.organizationScope.allowedIds.includes(targetOrganizationId)) {\n      throw forbidden('Not authorized to access this user.')\n    }\n  }\n}\n\nexport async function assertActorCanAccessRoleTarget(input: SuperAdminRoleTargetInput): Promise<void> {\n  const isSuperAdmin = await resolveActorIsSuperAdmin(input)\n  if (isSuperAdmin) return\n\n  const target = await findOneWithDecryption(\n    input.em,\n    Role,\n    { id: input.targetRoleId } as FilterQuery<Role>,\n    {},\n    { tenantId: null, organizationId: null },\n  )\n  // Not found (incl. soft-deleted): delegate (see assertActorCanAccessUserTarget).\n  if (!target) return\n\n  const actorTenantId = normalizeNullableString(input.tenantId)\n  const targetTenantId = normalizeNullableString((target as { tenantId?: string | null }).tenantId)\n  if (!targetTenantId || targetTenantId !== actorTenantId) {\n    throw new CrudHttpError(404, { error: 'Role not found' })\n  }\n}\n\nasync function resolveActorIsSuperAdmin(input: GrantCheckContext & { actorIsSuperAdmin?: boolean }): Promise<boolean> {\n  if (typeof input.actorIsSuperAdmin === 'boolean') return input.actorIsSuperAdmin\n  const acl = await loadActorAcl(input)\n  return acl.isSuperAdmin\n}\n\nexport async function isUserEffectivelySuperAdmin(em: EntityManager, userId: string): Promise<boolean> {\n  const directGrant = await em.findOne(\n    UserAcl,\n    { user: userId as unknown, isSuperAdmin: true } as FilterQuery<UserAcl>,\n  )\n  if (directGrant && (directGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true) return true\n  const links = await findWithDecryption(\n    em,\n    UserRole,\n    { user: userId as unknown } as FilterQuery<UserRole>,\n    { populate: ['role'] },\n    { tenantId: null, organizationId: null },\n  )\n  const roleIds = (Array.isArray(links) ? links : [])\n    .map((link) => {\n      const role = (link as { role?: { id?: unknown } | string | null }).role\n      if (!role) return null\n      if (typeof role === 'string') return role\n      return role.id ? String(role.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (!roleIds.length) return false\n  const roleGrant = await em.findOne(\n    RoleAcl,\n    { role: { $in: roleIds } as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!roleGrant && (roleGrant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function isRoleEffectivelySuperAdmin(em: EntityManager, roleId: string): Promise<boolean> {\n  const grant = await em.findOne(\n    RoleAcl,\n    { role: roleId as unknown, isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  return !!grant && (grant as { isSuperAdmin?: boolean }).isSuperAdmin === true\n}\n\nexport async function listSuperAdminUserIds(em: EntityManager, tenantId: string | null): Promise<Set<string>> {\n  const ids = new Set<string>()\n  const userAclFilter: Record<string, unknown> = { isSuperAdmin: true }\n  if (tenantId) userAclFilter.tenantId = tenantId\n  const userAcls = await em.find(UserAcl, userAclFilter as FilterQuery<UserAcl>)\n  for (const acl of userAcls) {\n    const userRef = (acl as { user?: { id?: unknown } | string | null }).user\n    const userId = userRef && typeof userRef === 'object'\n      ? userRef.id\n      : userRef\n    if (userId) ids.add(String(userId))\n  }\n  const roleAcls = await em.find(\n    RoleAcl,\n    { isSuperAdmin: true } as FilterQuery<RoleAcl>,\n  )\n  const roleIds = roleAcls\n    .map((acl) => {\n      const roleRef = (acl as { role?: { id?: unknown } | string | null }).role\n      if (!roleRef) return null\n      if (typeof roleRef === 'string') return roleRef\n      return roleRef.id ? String(roleRef.id) : null\n    })\n    .filter((id): id is string => typeof id === 'string' && id.length > 0)\n  if (roleIds.length) {\n    const links = await findWithDecryption(\n      em,\n      UserRole,\n      { role: { $in: roleIds } as unknown } as FilterQuery<UserRole>,\n      {},\n      { tenantId: null, organizationId: null },\n    )\n    for (const link of Array.isArray(links) ? links : []) {\n      const userRef = (link as { user?: { id?: unknown } | string | null }).user\n      const userId = userRef && typeof userRef === 'object'\n        ? userRef.id\n        : userRef\n      if (userId) ids.add(String(userId))\n    }\n  }\n  return ids\n}\n\nasync function loadActorAcl(input: GrantCheckContext): Promise<ActorAcl> {\n  const actorUserId = normalizeNullableString(input.actorUserId)\n  if (!actorUserId) throw forbidden('Not authorized to grant ACL privileges.')\n\n  const acl = await input.rbacService.loadAcl(actorUserId, {\n    tenantId: normalizeNullableString(input.tenantId),\n    organizationId: normalizeNullableString(input.organizationId),\n  })\n\n  return {\n    isSuperAdmin: !!acl?.isSuperAdmin,\n    features: normalizeStringList(acl?.features),\n    organizations: normalizeOrganizationList(acl?.organizations),\n  }\n}\n\nasync function resolveRolesForGrant(\n  em: EntityManager,\n  roleTokens: string[],\n  tenantId: string | null,\n): Promise<Role[]> {\n  const roles: Role[] = []\n  const missingRoles: string[] = []\n\n  for (const token of roleTokens) {\n    const role = await resolveRoleForGrant(em, token, tenantId)\n    if (!role) {\n      missingRoles.push(token)\n    } else {\n      roles.push(role)\n    }\n  }\n\n  if (missingRoles.length) {\n    const labels = missingRoles.map((role) => `\"${role}\"`).join(', ')\n    throw new CrudHttpError(400, { error: `Role(s) not found: ${labels}` })\n  }\n\n  return roles\n}\n\nasync function resolveRoleForGrant(\n  em: EntityManager,\n  token: string,\n  tenantId: string | null,\n): Promise<Role | null> {\n  const where: Record<string, unknown> = UUID_RE.test(token)\n    ? { id: token, deletedAt: null }\n    : { name: token, deletedAt: null }\n  if (tenantId) where.tenantId = tenantId\n  return findOneWithDecryption(\n    em,\n    Role,\n    where as FilterQuery<Role>,\n    {},\n    { tenantId, organizationId: null },\n  )\n}\n\nfunction assertActorCanGrantAclSnapshot(\n  actorAcl: ActorAcl,\n  requested: {\n    isSuperAdmin: boolean\n    features: string[]\n    organizations?: string[] | null\n  },\n): void {\n  if (requested.isSuperAdmin) {\n    throw forbidden('Only super administrators can grant super admin access.')\n  }\n\n  const actorGrantableFeatures = actorAcl.features.filter((grant) => grant !== '*')\n  for (const feature of requested.features) {\n    if (feature === '*') {\n      throw forbidden('Only super administrators can grant global wildcard access.')\n    }\n    if (isWildcardFeature(feature)) {\n      if (!hasFeature(actorGrantableFeatures, feature)) {\n        throw forbidden(`Cannot grant feature wildcard ${feature}.`)\n      }\n      continue\n    }\n    if (!hasFeature(actorGrantableFeatures, feature)) {\n      throw forbidden(`Cannot grant feature ${feature}.`)\n    }\n  }\n\n  if (requested.organizations !== undefined) {\n    assertActorCanGrantOrganizations(actorAcl.organizations, requested.organizations)\n  }\n}\n\nfunction assertActorCanGrantOrganizations(\n  actorOrganizations: string[] | null,\n  requestedOrganizations: string[] | null,\n): void {\n  if (actorOrganizations === null || actorOrganizations.includes('__all__')) return\n\n  if (requestedOrganizations === null || requestedOrganizations.includes('__all__')) {\n    throw forbidden('Cannot grant unrestricted organization access.')\n  }\n\n  for (const organizationId of requestedOrganizations) {\n    if (!actorOrganizations.includes(organizationId)) {\n      throw forbidden('Cannot grant organization access outside actor scope.')\n    }\n  }\n}\n\nfunction normalizeStringList(values: unknown): string[] {\n  if (!Array.isArray(values)) return []\n  const dedup = new Set<string>()\n  for (const value of values) {\n    if (typeof value !== 'string') continue\n    const trimmed = value.trim()\n    if (!trimmed) continue\n    dedup.add(trimmed)\n  }\n  return Array.from(dedup)\n}\n\nfunction normalizeOrganizationList(values: unknown): string[] | null {\n  if (values === null || values === undefined) return null\n  return normalizeStringList(values)\n}\n\nfunction normalizeNullableString(value: unknown): string | null {\n  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null\n}\n\nfunction isWildcardFeature(feature: string): boolean {\n  return feature.endsWith('.*')\n}\n\nasync function translateAuthError(key: string, fallback: string): Promise<string> {\n  const { translate } = await resolveTranslations()\n  return translate(key, fallback)\n}\n"],
+  "mappings": "AACA,SAAS,YAAY,eAAe,iBAAiB;AACrD,SAAS,kBAAkB;AAC3B,SAAS,uBAAuB,0BAA0B;AAC1D,SAAS,2BAA2B;AACpC,SAAS,MAAM,SAAS,MAAM,SAAS,gBAAgB;AA6DvD,MAAM,UAAU;AAEhB,eAAsB,8BAA8B,OAAkD;AACpG,QAAM,SAAS,oBAAoB,MAAM,UAAU;AACnD,MAAI,CAAC,OAAO,OAAQ,QAAO,CAAC;AAE5B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,QAAQ,MAAM,qBAAqB,MAAM,IAAI,QAAQ,QAAQ;AACnE,QAAM,yBAAyB,EAAE,GAAG,OAAO,UAAU,MAAM,CAAC;AAC5D,SAAO;AACT;AAEA,eAAsB,4BAA4B,OAAmD;AACnG,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,MAAI,MAAM,QAAQ,MAAM,UAAU,GAAG;AACnC,WAAO,qBAAqB,MAAM,IAAI,oBAAoB,MAAM,UAAU,GAAG,mBAAmB;AAAA,EAClG;AAEA,QAAM,QAAQ,MAAM;AAAA,IAClB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,MAAM,MAAM,aAAgC;AAAA,IAC9C,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,QAAgB,CAAC;AACvB,aAAW,QAAQ,OAAO;AACxB,UAAM,aAAc,KAAyC;AAC7D,QAAI,cAAc,OAAO,eAAe,UAAU;AAChD,YAAM,KAAK,UAAU;AACrB;AAAA,IACF;AACA,QAAI,OAAO,eAAe,UAAU;AAClC,YAAM,eAAe,MAAM,oBAAoB,MAAM,IAAI,YAAY,IAAI;AACzE,UAAI,cAAc;AAChB,cAAM,KAAK,YAAY;AACvB;AAAA,MACF;AAAA,IACF;AACA,UAAM,WAAW,MAAM;AAAA,MACrB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AACA,SAAO;AACT;AAEA,eAAsB,oCACpB,OACe;AACf,QAAM,sBAAsB,wBAAwB,MAAM,mBAAmB;AAC7E,QAAM,4BAA4B,wBAAwB,MAAM,yBAAyB;AACzF,MAAI,CAAC,uBAAuB,CAAC,2BAA2B;AACtD,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,QAAI,wBAAwB,KAAK,QAAQ,MAAM,qBAAqB;AAClE,YAAM,UAAU,MAAM;AAAA,QACpB;AAAA,QACA;AAAA,MACF,CAAC;AAAA,IACH;AAAA,EACF;AAEA,MAAI,MAAM,yBAAyB,KAAK,EAAG;AAE3C,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,MAAI,CAAC,iBAAiB,kBAAkB,qBAAqB;AAC3D,WAAO,yCAAyC,GAAG;AAAA,EACrD;AAEA,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,QAAM,yBAAyB,MAAM,2BAA2B,SAC5D,SAAS,gBACT,MAAM;AACV,MACE,2BAA2B,QACxB,CAAC,uBAAuB,SAAS,SAAS,KAC1C,CAAC,uBAAuB,SAAS,yBAAyB,GAC7D;AACA,UAAM,UAAU,MAAM;AAAA,MACpB;AAAA,MACA;AAAA,IACF,CAAC;AAAA,EACH;AAEA,QAAM,yBAAyB;AAAA,IAC7B,GAAG;AAAA,IACH,UAAU;AAAA,IACV,OAAO,MAAM;AAAA,EACf,CAAC;AACH;AAEA,eAAsB,yCAAyC,QAAmC;AAChG,QAAM,IAAI,cAAc,QAAQ;AAAA,IAC9B,OAAO,MAAM;AAAA,MACX;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACH;AAEA,eAAsB,yBAAyB,OAA2C;AACxF,MAAI,CAAC,MAAM,MAAM,OAAQ;AAEzB,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,QAAM,WAAW,MAAM,aAAa,EAAE,GAAG,OAAO,SAAS,CAAC;AAC1D,MAAI,SAAS,aAAc;AAE3B,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,4CAA4C;AAAA,EAC9D;AAEA,aAAW,QAAQ,MAAM,OAAO;AAC9B,UAAM,eAAe,wBAAwB,KAAK,QAAQ;AAC1D,QAAI,iBAAiB,UAAU;AAC7B,YAAM,UAAU,gDAAgD;AAAA,IAClE;AAEA,UAAM,MAAM,MAAM;AAAA,MAChB,MAAM;AAAA,MACN;AAAA,MACA,EAAE,MAAM,SAAS;AAAA,MACjB,CAAC;AAAA,MACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,IACnC;AACA,QAAI,CAAC,IAAK;AAEV,mCAA+B,UAAU;AAAA,MACvC,cAAc,CAAC,CAAC,IAAI;AAAA,MACpB,UAAU,oBAAoB,IAAI,YAAY;AAAA,MAC9C,eAAe,0BAA0B,IAAI,iBAAiB;AAAA,IAChE,CAAC;AAAA,EACH;AACF;AAEA,eAAsB,uBAAuB,OAA8C;AACzF,QAAM,WAAW,MAAM,aAAa,KAAK;AACzC,MAAI,SAAS,aAAc;AAE3B,QAAM,WAAW,wBAAwB,MAAM,QAAQ;AACvD,MAAI,CAAC,UAAU;AACb,UAAM,UAAU,mDAAmD;AAAA,EACrE;AAEA,iCAA+B,UAAU;AAAA,IACvC,cAAc,CAAC,CAAC,MAAM;AAAA,IACtB,UAAU,oBAAoB,MAAM,QAAQ;AAAA,IAC5C,eAAe,MAAM,kBAAkB,SAAY,SAAY,0BAA0B,MAAM,aAAa;AAAA,EAC9G,CAAC;AACH;AAEO,SAAS,0BAA0B,UAA6B;AACrE,SAAO,oBAAoB,QAAQ;AACrC;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,oEAAoE;AAAA,EACtF;AACF;AAEA,eAAsB,yCAAyC,OAAiD;AAC9G,QAAM,oBAAoB,MAAM,yBAAyB,KAAK;AAC9D,MAAI,kBAAmB;AACvB,QAAM,qBAAqB,MAAM,4BAA4B,MAAM,IAAI,MAAM,YAAY;AACzF,MAAI,oBAAoB;AACtB,UAAM,UAAU,iEAAiE;AAAA,EACnF;AACF;AAEA,eAAsB,+BAA+B,OAA6C;AAChG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAMA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AAEA,MAAI,MAAM,kBAAkB,eAAe,MAAM;AAC/C,UAAM,uBAAuB,wBAAyB,OAA8C,cAAc;AAClH,QAAI,CAAC,wBAAwB,CAAC,MAAM,kBAAkB,WAAW,SAAS,oBAAoB,GAAG;AAC/F,YAAM,UAAU,qCAAqC;AAAA,IACvD;AAAA,EACF;AACF;AAEA,eAAsB,+BAA+B,OAAiD;AACpG,QAAM,eAAe,MAAM,yBAAyB,KAAK;AACzD,MAAI,aAAc;AAElB,QAAM,SAAS,MAAM;AAAA,IACnB,MAAM;AAAA,IACN;AAAA,IACA,EAAE,IAAI,MAAM,aAAa;AAAA,IACzB,CAAC;AAAA,IACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AAEA,MAAI,CAAC,OAAQ;AAEb,QAAM,gBAAgB,wBAAwB,MAAM,QAAQ;AAC5D,QAAM,iBAAiB,wBAAyB,OAAwC,QAAQ;AAChG,MAAI,CAAC,kBAAkB,mBAAmB,eAAe;AACvD,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,iBAAiB,CAAC;AAAA,EAC1D;AACF;AAEA,eAAe,yBAAyB,OAA8E;AACpH,MAAI,OAAO,MAAM,sBAAsB,UAAW,QAAO,MAAM;AAC/D,QAAM,MAAM,MAAM,aAAa,KAAK;AACpC,SAAO,IAAI;AACb;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,cAAc,MAAM,GAAG;AAAA,IAC3B;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,MAAI,eAAgB,YAA2C,iBAAiB,KAAM,QAAO;AAC7F,QAAM,QAAQ,MAAM;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,MAAM,OAAkB;AAAA,IAC1B,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,EACzC;AACA,QAAM,WAAW,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAC9C,IAAI,CAAC,SAAS;AACb,UAAM,OAAQ,KAAqD;AACnE,QAAI,CAAC,KAAM,QAAO;AAClB,QAAI,OAAO,SAAS,SAAU,QAAO;AACrC,WAAO,KAAK,KAAK,OAAO,KAAK,EAAE,IAAI;AAAA,EACrC,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAC5B,QAAM,YAAY,MAAM,GAAG;AAAA,IACzB;AAAA,IACA,EAAE,MAAM,EAAE,KAAK,QAAQ,GAAc,cAAc,KAAK;AAAA,EAC1D;AACA,SAAO,CAAC,CAAC,aAAc,UAAyC,iBAAiB;AACnF;AAEA,eAAsB,4BAA4B,IAAmB,QAAkC;AACrG,QAAM,QAAQ,MAAM,GAAG;AAAA,IACrB;AAAA,IACA,EAAE,MAAM,QAAmB,cAAc,KAAK;AAAA,EAChD;AACA,SAAO,CAAC,CAAC,SAAU,MAAqC,iBAAiB;AAC3E;AAEA,eAAsB,sBAAsB,IAAmB,UAA+C;AAC5G,QAAM,MAAM,oBAAI,IAAY;AAC5B,QAAM,gBAAyC,EAAE,cAAc,KAAK;AACpE,MAAI,SAAU,eAAc,WAAW;AACvC,QAAM,WAAW,MAAM,GAAG,KAAK,SAAS,aAAqC;AAC7E,aAAW,OAAO,UAAU;AAC1B,UAAM,UAAW,IAAoD;AACrE,UAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,QAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,EACpC;AACA,QAAM,WAAW,MAAM,GAAG;AAAA,IACxB;AAAA,IACA,EAAE,cAAc,KAAK;AAAA,EACvB;AACA,QAAM,UAAU,SACb,IAAI,CAAC,QAAQ;AACZ,UAAM,UAAW,IAAoD;AACrE,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,OAAO,YAAY,SAAU,QAAO;AACxC,WAAO,QAAQ,KAAK,OAAO,QAAQ,EAAE,IAAI;AAAA,EAC3C,CAAC,EACA,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AACvE,MAAI,QAAQ,QAAQ;AAClB,UAAM,QAAQ,MAAM;AAAA,MAClB;AAAA,MACA;AAAA,MACA,EAAE,MAAM,EAAE,KAAK,QAAQ,EAAa;AAAA,MACpC,CAAC;AAAA,MACD,EAAE,UAAU,MAAM,gBAAgB,KAAK;AAAA,IACzC;AACA,eAAW,QAAQ,MAAM,QAAQ,KAAK,IAAI,QAAQ,CAAC,GAAG;AACpD,YAAM,UAAW,KAAqD;AACtE,YAAM,SAAS,WAAW,OAAO,YAAY,WACzC,QAAQ,KACR;AACJ,UAAI,OAAQ,KAAI,IAAI,OAAO,MAAM,CAAC;AAAA,IACpC;AAAA,EACF;AACA,SAAO;AACT;AAEA,eAAe,aAAa,OAA6C;AACvE,QAAM,cAAc,wBAAwB,MAAM,WAAW;AAC7D,MAAI,CAAC,YAAa,OAAM,UAAU,yCAAyC;AAE3E,QAAM,MAAM,MAAM,MAAM,YAAY,QAAQ,aAAa;AAAA,IACvD,UAAU,wBAAwB,MAAM,QAAQ;AAAA,IAChD,gBAAgB,wBAAwB,MAAM,cAAc;AAAA,EAC9D,CAAC;AAED,SAAO;AAAA,IACL,cAAc,CAAC,CAAC,KAAK;AAAA,IACrB,UAAU,oBAAoB,KAAK,QAAQ;AAAA,IAC3C,eAAe,0BAA0B,KAAK,aAAa;AAAA,EAC7D;AACF;AAEA,eAAe,qBACb,IACA,YACA,UACiB;AACjB,QAAM,QAAgB,CAAC;AACvB,QAAM,eAAyB,CAAC;AAEhC,aAAW,SAAS,YAAY;AAC9B,UAAM,OAAO,MAAM,oBAAoB,IAAI,OAAO,QAAQ;AAC1D,QAAI,CAAC,MAAM;AACT,mBAAa,KAAK,KAAK;AAAA,IACzB,OAAO;AACL,YAAM,KAAK,IAAI;AAAA,IACjB;AAAA,EACF;AAEA,MAAI,aAAa,QAAQ;AACvB,UAAM,SAAS,aAAa,IAAI,CAAC,SAAS,IAAI,IAAI,GAAG,EAAE,KAAK,IAAI;AAChE,UAAM,IAAI,cAAc,KAAK,EAAE,OAAO,sBAAsB,MAAM,GAAG,CAAC;AAAA,EACxE;AAEA,SAAO;AACT;AAEA,eAAe,oBACb,IACA,OACA,UACsB;AACtB,QAAM,QAAiC,QAAQ,KAAK,KAAK,IACrD,EAAE,IAAI,OAAO,WAAW,KAAK,IAC7B,EAAE,MAAM,OAAO,WAAW,KAAK;AACnC,MAAI,SAAU,OAAM,WAAW;AAC/B,SAAO;AAAA,IACL;AAAA,IACA;AAAA,IACA;AAAA,IACA,CAAC;AAAA,IACD,EAAE,UAAU,gBAAgB,KAAK;AAAA,EACnC;AACF;AAEA,SAAS,+BACP,UACA,WAKM;AACN,MAAI,UAAU,cAAc;AAC1B,UAAM,UAAU,yDAAyD;AAAA,EAC3E;AAEA,QAAM,yBAAyB,SAAS,SAAS,OAAO,CAAC,UAAU,UAAU,GAAG;AAChF,aAAW,WAAW,UAAU,UAAU;AACxC,QAAI,YAAY,KAAK;AACnB,YAAM,UAAU,6DAA6D;AAAA,IAC/E;AACA,QAAI,kBAAkB,OAAO,GAAG;AAC9B,UAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,cAAM,UAAU,iCAAiC,OAAO,GAAG;AAAA,MAC7D;AACA;AAAA,IACF;AACA,QAAI,CAAC,WAAW,wBAAwB,OAAO,GAAG;AAChD,YAAM,UAAU,wBAAwB,OAAO,GAAG;AAAA,IACpD;AAAA,EACF;AAEA,MAAI,UAAU,kBAAkB,QAAW;AACzC,qCAAiC,SAAS,eAAe,UAAU,aAAa;AAAA,EAClF;AACF;AAEA,SAAS,iCACP,oBACA,wBACM;AACN,MAAI,uBAAuB,QAAQ,mBAAmB,SAAS,SAAS,EAAG;AAE3E,MAAI,2BAA2B,QAAQ,uBAAuB,SAAS,SAAS,GAAG;AACjF,UAAM,UAAU,gDAAgD;AAAA,EAClE;AAEA,aAAW,kBAAkB,wBAAwB;AACnD,QAAI,CAAC,mBAAmB,SAAS,cAAc,GAAG;AAChD,YAAM,UAAU,uDAAuD;AAAA,IACzE;AAAA,EACF;AACF;AAEA,SAAS,oBAAoB,QAA2B;AACtD,MAAI,CAAC,MAAM,QAAQ,MAAM,EAAG,QAAO,CAAC;AACpC,QAAM,QAAQ,oBAAI,IAAY;AAC9B,aAAW,SAAS,QAAQ;AAC1B,QAAI,OAAO,UAAU,SAAU;AAC/B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,QAAS;AACd,UAAM,IAAI,OAAO;AAAA,EACnB;AACA,SAAO,MAAM,KAAK,KAAK;AACzB;AAEA,SAAS,0BAA0B,QAAkC;AACnE,MAAI,WAAW,QAAQ,WAAW,OAAW,QAAO;AACpD,SAAO,oBAAoB,MAAM;AACnC;AAEA,SAAS,wBAAwB,OAA+B;AAC9D,SAAO,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,IAAI,MAAM,KAAK,IAAI;AAC/E;AAEA,SAAS,kBAAkB,SAA0B;AACnD,SAAO,QAAQ,SAAS,IAAI;AAC9B;AAEA,eAAe,mBAAmB,KAAa,UAAmC;AAChF,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,SAAO,UAAU,KAAK,QAAQ;AAChC;",
   "names": []
 }

package/dist/modules/auth/lib/sessionIntegrity.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/lib/sessionIntegrity.ts"],
-  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, Session, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\nconst INVALID_SCOPE = Symbol('invalid-scope')\n\ntype NormalizedScopeId = string | null | typeof INVALID_SCOPE\n\nfunction normalizeScopeId(value: unknown): NormalizedScopeId {\n  if (value === null || value === undefined) return null\n  if (typeof value !== 'string') return INVALID_SCOPE\n  const trimmed = value.trim()\n  if (!trimmed) return null\n  return UUID_RE.test(trimmed) ? trimmed : INVALID_SCOPE\n}\n\nfunction resolveActorTenantId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorTenantId = (auth as { actorTenantId?: unknown }).actorTenantId\n  return normalizeScopeId(actorTenantId ?? auth.tenantId ?? null)\n}\n\nfunction resolveActorOrganizationId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorOrgId = (auth as { actorOrgId?: unknown }).actorOrgId\n  return normalizeScopeId(actorOrgId ?? auth.orgId ?? null)\n}\n\nexport async function resolveCanonicalStaffAuthContext(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<AuthContext> {\n  if (!auth) return null\n  if (auth.isApiKey) return auth\n\n  const subjectId = normalizeScopeId(auth.sub)\n  const actorTenantId = resolveActorTenantId(auth)\n  const actorOrganizationId = resolveActorOrganizationId(auth)\n  if (\n    subjectId === INVALID_SCOPE ||\n    actorTenantId === INVALID_SCOPE ||\n    actorOrganizationId === INVALID_SCOPE\n  ) {\n    return null\n  }\n\n  // Session binding: when the JWT carries an `sid` claim, require the referenced session to\n  // still exist (not soft-deleted, not expired). This is what makes logout / password-reset\n  // actually invalidate an already-issued JWT.\n  //\n  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period\n  // (controlled by JWT_LEGACY_GRACE_MINUTES) so that rolling deployments don't force-logout\n  // every user. Once the grace period expires these tokens will fail signature verification\n  // in `verifyJwt` before reaching this point.\n  const sessionId = normalizeScopeId(typeof auth.sid === 'string' ? auth.sid : null)\n  if (sessionId === INVALID_SCOPE) return null\n  if (sessionId === null) {\n    // Legacy token without sid \u2014 allow only if it was verified via the legacy fallback path.\n    // The `_legacyToken` flag is set by `verifyJwt` when a token passes raw-secret verification\n    // but fails audience-derived verification. Without this flag, reject.\n    if ((auth as Record<string, unknown>)._legacyToken === true) {\n      // Allow through without session validation \u2014 the token will expire naturally\n    } else {\n      return null\n    }\n  }\n  // The session-revocation check and the user load are independent (neither reads\n  // the other's result), so they run concurrently to collapse two sequential DB\n  // round-trips into one. The `em` here is a fresh request-scoped EntityManager\n  // (resolved per request, never inside an explicit transaction), so concurrent\n  // reads on it are safe.\n  //\n  // The session lookup is bound to the token subject (`user: subjectId`) so the\n  // referenced session must actually belong to the JWT's subject. Without this\n  // binding, a forged-but-otherwise-valid token could pair `sub` for one user with\n  // a still-live `sid` belonging to another, evading per-user session revocation\n  // (logout / deleteAllUserSessions / password reset).\n  const sessionPromise = sessionId !== null\n    ? findOneWithDecryption(em, Session, { id: sessionId, user: subjectId, deletedAt: null })\n    : Promise.resolve(null)\n  const userPromise = findOneWithDecryption(\n    em,\n    User,\n    { id: subjectId, deletedAt: null },\n    undefined,\n    { tenantId: actorTenantId, organizationId: actorOrganizationId },\n  )\n  const [session, user] = await Promise.all([sessionPromise, userPromise])\n\n  if (sessionId !== null) {\n    if (!session) return null\n    if (resolveSessionUserId(session) !== subjectId) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n  }\n\n  if (!user || user.isConfirmed === false) return null\n\n  const currentTenantId = normalizeScopeId(user.tenantId ?? null)\n  const currentOrganizationId = normalizeScopeId(user.organizationId ?? null)\n  if (\n    currentTenantId === INVALID_SCOPE ||\n    currentOrganizationId === INVALID_SCOPE ||\n    currentTenantId !== actorTenantId ||\n    currentOrganizationId !== actorOrganizationId\n  ) {\n    return null\n  }\n\n  // Role links and the per-user super-admin flag are likewise independent, so they\n  // run concurrently. The role-level super-admin lookup depends on the resolved\n  // role ids, so it stays sequential after the links resolve (and is skipped\n  // entirely when the per-user flag already grants super-admin).\n  const linksPromise = currentTenantId\n    ? findWithDecryption(\n        em,\n        UserRole,\n        {\n          user: user.id,\n          deletedAt: null,\n          role: { tenantId: currentTenantId, deletedAt: null } as unknown as Role,\n        } as never,\n        { populate: ['role'] },\n        { tenantId: currentTenantId, organizationId: currentOrganizationId },\n      )\n    : Promise.resolve([] as UserRole[])\n  const userAclSuperAdminPromise = currentTenantId\n    ? userAclGrantsSuperAdmin(em, user.id, currentTenantId, currentOrganizationId)\n    : Promise.resolve(false)\n  const [links, userAclSuperAdmin] = await Promise.all([linksPromise, userAclSuperAdminPromise])\n\n  const linkedRoles = links\n    .map((link) => link.role)\n    .filter((role): role is Role => !!role)\n\n  const roles = linkedRoles\n    .map((role) => role.name)\n    .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n\n  const isSuperAdmin = currentTenantId\n    ? userAclSuperAdmin || (await roleAclGrantsSuperAdmin(em, linkedRoles, currentTenantId, currentOrganizationId))\n    : false\n\n  return {\n    ...auth,\n    sub: user.id,\n    tenantId: currentTenantId,\n    orgId: currentOrganizationId,\n    roles,\n    isSuperAdmin,\n  }\n}\n\nfunction resolveSessionUserId(session: Session): string | null {\n  const owner = (session as { user?: unknown }).user\n  if (typeof owner === 'string') return owner\n  if (owner && typeof owner === 'object') {\n    const ownerId = (owner as { id?: unknown }).id\n    if (typeof ownerId === 'string') return ownerId\n  }\n  return null\n}\n\nasync function userAclGrantsSuperAdmin(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const userAcl = await findOneWithDecryption(\n    em,\n    UserAcl,\n    {\n      user: userId,\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(userAcl && (userAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nasync function roleAclGrantsSuperAdmin(\n  em: EntityManager,\n  linkedRoles: Role[],\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const roleIds = Array.from(\n    new Set(\n      linkedRoles\n        .map((role) => (role?.id ? String(role.id) : null))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0),\n    ),\n  )\n  if (!roleIds.length) return false\n\n  const roleAcl = await findOneWithDecryption(\n    em,\n    RoleAcl,\n    {\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n      role: { $in: roleIds },\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(roleAcl && (roleAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nexport async function isAuthContextValid(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<boolean> {\n  return (await resolveCanonicalStaffAuthContext(em, auth)) !== null\n}\n"],
-  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAe,SAAS,SAAS,MAAM,SAAS,gBAAgB;AAEhE,MAAM,UAAU;AAChB,MAAM,gBAAgB,uBAAO,eAAe;AAI5C,SAAS,iBAAiB,OAAmC;AAC3D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,KAAK,OAAO,IAAI,UAAU;AAC3C;AAEA,SAAS,qBAAqB,MAAmD;AAC/E,QAAM,gBAAiB,KAAqC;AAC5D,SAAO,iBAAiB,iBAAiB,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,2BAA2B,MAAmD;AACrF,QAAM,aAAc,KAAkC;AACtD,SAAO,iBAAiB,cAAc,KAAK,SAAS,IAAI;AAC1D;AAEA,eAAsB,iCACpB,IACA,MACsB;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAU,QAAO;AAE1B,QAAM,YAAY,iBAAiB,KAAK,GAAG;AAC3C,QAAM,gBAAgB,qBAAqB,IAAI;AAC/C,QAAM,sBAAsB,2BAA2B,IAAI;AAC3D,MACE,cAAc,iBACd,kBAAkB,iBAClB,wBAAwB,eACxB;AACA,WAAO;AAAA,EACT;AAUA,QAAM,YAAY,iBAAiB,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,IAAI;AACjF,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,MAAM;AAItB,QAAK,KAAiC,iBAAiB,MAAM;AAAA,IAE7D,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAYA,QAAM,iBAAiB,cAAc,OACjC,sBAAsB,IAAI,SAAS,EAAE,IAAI,WAAW,MAAM,WAAW,WAAW,KAAK,CAAC,IACtF,QAAQ,QAAQ,IAAI;AACxB,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,WAAW,WAAW,KAAK;AAAA,IACjC;AAAA,IACA,EAAE,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,EACjE;AACA,QAAM,CAAC,SAAS,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAEvE,MAAI,cAAc,MAAM;AACtB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,qBAAqB,OAAO,MAAM,UAAW,QAAO;AACxD,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAAA,EACvD;AAEA,MAAI,CAAC,QAAQ,KAAK,gBAAgB,MAAO,QAAO;AAEhD,QAAM,kBAAkB,iBAAiB,KAAK,YAAY,IAAI;AAC9D,QAAM,wBAAwB,iBAAiB,KAAK,kBAAkB,IAAI;AAC1E,MACE,oBAAoB,iBACpB,0BAA0B,iBAC1B,oBAAoB,iBACpB,0BAA0B,qBAC1B;AACA,WAAO;AAAA,EACT;AAMA,QAAM,eAAe,kBACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM,EAAE,UAAU,iBAAiB,WAAW,KAAK;AAAA,IACrD;AAAA,IACA,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,iBAAiB,gBAAgB,sBAAsB;AAAA,EACrE,IACA,QAAQ,QAAQ,CAAC,CAAe;AACpC,QAAM,2BAA2B,kBAC7B,wBAAwB,IAAI,KAAK,IAAI,iBAAiB,qBAAqB,IAC3E,QAAQ,QAAQ,KAAK;AACzB,QAAM,CAAC,OAAO,iBAAiB,IAAI,MAAM,QAAQ,IAAI,CAAC,cAAc,wBAAwB,CAAC;AAE7F,QAAM,cAAc,MACjB,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI;AAExC,QAAM,QAAQ,YACX,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAEtF,QAAM,eAAe,kBACjB,qBAAsB,MAAM,wBAAwB,IAAI,aAAa,iBAAiB,qBAAqB,IAC3G;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAiC;AAC7D,QAAM,QAAS,QAA+B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA2B;AAC5C,QAAI,OAAO,YAAY,SAAU,QAAO;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,eAAe,wBACb,IACA,QACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAe,wBACb,IACA,aACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB,IAAI;AAAA,MACF,YACG,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,MAAM,EAAE,KAAK,QAAQ;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAsB,mBACpB,IACA,MACkB;AAClB,SAAQ,MAAM,iCAAiC,IAAI,IAAI,MAAO;AAChE;",
+  "sourcesContent": ["import type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AuthContext } from '@open-mercato/shared/lib/auth/server'\nimport { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { Role, RoleAcl, Session, User, UserAcl, UserRole } from '@open-mercato/core/modules/auth/data/entities'\n\nconst UUID_RE = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-5][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\nconst INVALID_SCOPE = Symbol('invalid-scope')\n\ntype NormalizedScopeId = string | null | typeof INVALID_SCOPE\n\nfunction normalizeScopeId(value: unknown): NormalizedScopeId {\n  if (value === null || value === undefined) return null\n  if (typeof value !== 'string') return INVALID_SCOPE\n  const trimmed = value.trim()\n  if (!trimmed) return null\n  return UUID_RE.test(trimmed) ? trimmed : INVALID_SCOPE\n}\n\nfunction resolveActorTenantId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorTenantId = (auth as { actorTenantId?: unknown }).actorTenantId\n  return normalizeScopeId(actorTenantId ?? auth.tenantId ?? null)\n}\n\nfunction resolveActorOrganizationId(auth: NonNullable<AuthContext>): NormalizedScopeId {\n  const actorOrgId = (auth as { actorOrgId?: unknown }).actorOrgId\n  return normalizeScopeId(actorOrgId ?? auth.orgId ?? null)\n}\n\nexport async function resolveCanonicalStaffAuthContext(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<AuthContext> {\n  if (!auth) return null\n  if (auth.isApiKey) return auth\n\n  const subjectId = normalizeScopeId(auth.sub)\n  const actorTenantId = resolveActorTenantId(auth)\n  const actorOrganizationId = resolveActorOrganizationId(auth)\n  if (\n    subjectId === INVALID_SCOPE ||\n    actorTenantId === INVALID_SCOPE ||\n    actorOrganizationId === INVALID_SCOPE\n  ) {\n    return null\n  }\n\n  // Session binding: when the JWT carries an `sid` claim, require the referenced session to\n  // still exist (not soft-deleted, not expired). This is what makes logout / password-reset\n  // actually invalidate an already-issued JWT.\n  //\n  // Legacy tokens (pre-migration, without `sid`) are allowed through during the grace period so\n  // that rolling deployments don't force-logout every user. `verifyJwt` owns that window: it only\n  // marks a payload `_legacyToken` while the token's own `iat` is within JWT_LEGACY_GRACE_MINUTES\n  // and before JWT_LEGACY_CUTOVER_AT, so an aged or post-cutover raw-secret token fails\n  // verification before reaching this point and every remaining token must carry a live `sid`.\n  const sessionId = normalizeScopeId(typeof auth.sid === 'string' ? auth.sid : null)\n  if (sessionId === INVALID_SCOPE) return null\n  if (sessionId === null) {\n    // Legacy token without sid \u2014 allow only if it was verified via the legacy fallback path.\n    // The `_legacyToken` flag is set by `verifyJwt` when a token passes raw-secret verification\n    // but fails audience-derived verification. Without this flag, reject.\n    if ((auth as Record<string, unknown>)._legacyToken === true) {\n      // Allow through without session validation \u2014 the token will expire naturally\n    } else {\n      return null\n    }\n  }\n  // The session-revocation check and the user load are independent (neither reads\n  // the other's result), so they run concurrently to collapse two sequential DB\n  // round-trips into one. The `em` here is a fresh request-scoped EntityManager\n  // (resolved per request, never inside an explicit transaction), so concurrent\n  // reads on it are safe.\n  //\n  // The session lookup is bound to the token subject (`user: subjectId`) so the\n  // referenced session must actually belong to the JWT's subject. Without this\n  // binding, a forged-but-otherwise-valid token could pair `sub` for one user with\n  // a still-live `sid` belonging to another, evading per-user session revocation\n  // (logout / deleteAllUserSessions / password reset).\n  const sessionPromise = sessionId !== null\n    ? findOneWithDecryption(em, Session, { id: sessionId, user: subjectId, deletedAt: null })\n    : Promise.resolve(null)\n  const userPromise = findOneWithDecryption(\n    em,\n    User,\n    { id: subjectId, deletedAt: null },\n    undefined,\n    { tenantId: actorTenantId, organizationId: actorOrganizationId },\n  )\n  const [session, user] = await Promise.all([sessionPromise, userPromise])\n\n  if (sessionId !== null) {\n    if (!session) return null\n    if (resolveSessionUserId(session) !== subjectId) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n  }\n\n  if (!user || user.isConfirmed === false) return null\n\n  const currentTenantId = normalizeScopeId(user.tenantId ?? null)\n  const currentOrganizationId = normalizeScopeId(user.organizationId ?? null)\n  if (\n    currentTenantId === INVALID_SCOPE ||\n    currentOrganizationId === INVALID_SCOPE ||\n    currentTenantId !== actorTenantId ||\n    currentOrganizationId !== actorOrganizationId\n  ) {\n    return null\n  }\n\n  // Role links and the per-user super-admin flag are likewise independent, so they\n  // run concurrently. The role-level super-admin lookup depends on the resolved\n  // role ids, so it stays sequential after the links resolve (and is skipped\n  // entirely when the per-user flag already grants super-admin).\n  const linksPromise = currentTenantId\n    ? findWithDecryption(\n        em,\n        UserRole,\n        {\n          user: user.id,\n          deletedAt: null,\n          role: { tenantId: currentTenantId, deletedAt: null } as unknown as Role,\n        } as never,\n        { populate: ['role'] },\n        { tenantId: currentTenantId, organizationId: currentOrganizationId },\n      )\n    : Promise.resolve([] as UserRole[])\n  const userAclSuperAdminPromise = currentTenantId\n    ? userAclGrantsSuperAdmin(em, user.id, currentTenantId, currentOrganizationId)\n    : Promise.resolve(false)\n  const [links, userAclSuperAdmin] = await Promise.all([linksPromise, userAclSuperAdminPromise])\n\n  const linkedRoles = links\n    .map((link) => link.role)\n    .filter((role): role is Role => !!role)\n\n  const roles = linkedRoles\n    .map((role) => role.name)\n    .filter((name): name is string => typeof name === 'string' && name.trim().length > 0)\n\n  const isSuperAdmin = currentTenantId\n    ? userAclSuperAdmin || (await roleAclGrantsSuperAdmin(em, linkedRoles, currentTenantId, currentOrganizationId))\n    : false\n\n  return {\n    ...auth,\n    sub: user.id,\n    tenantId: currentTenantId,\n    orgId: currentOrganizationId,\n    roles,\n    isSuperAdmin,\n  }\n}\n\nfunction resolveSessionUserId(session: Session): string | null {\n  const owner = (session as { user?: unknown }).user\n  if (typeof owner === 'string') return owner\n  if (owner && typeof owner === 'object') {\n    const ownerId = (owner as { id?: unknown }).id\n    if (typeof ownerId === 'string') return ownerId\n  }\n  return null\n}\n\nasync function userAclGrantsSuperAdmin(\n  em: EntityManager,\n  userId: string,\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const userAcl = await findOneWithDecryption(\n    em,\n    UserAcl,\n    {\n      user: userId,\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(userAcl && (userAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nasync function roleAclGrantsSuperAdmin(\n  em: EntityManager,\n  linkedRoles: Role[],\n  tenantId: string,\n  organizationId: string | null,\n): Promise<boolean> {\n  const roleIds = Array.from(\n    new Set(\n      linkedRoles\n        .map((role) => (role?.id ? String(role.id) : null))\n        .filter((id): id is string => typeof id === 'string' && id.length > 0),\n    ),\n  )\n  if (!roleIds.length) return false\n\n  const roleAcl = await findOneWithDecryption(\n    em,\n    RoleAcl,\n    {\n      tenantId,\n      isSuperAdmin: true,\n      deletedAt: null,\n      role: { $in: roleIds },\n    } as never,\n    undefined,\n    { tenantId, organizationId },\n  )\n  return !!(roleAcl && (roleAcl as { isSuperAdmin?: boolean }).isSuperAdmin === true)\n}\n\nexport async function isAuthContextValid(\n  em: EntityManager,\n  auth: AuthContext,\n): Promise<boolean> {\n  return (await resolveCanonicalStaffAuthContext(em, auth)) !== null\n}\n"],
+  "mappings": "AAEA,SAAS,uBAAuB,0BAA0B;AAC1D,SAAe,SAAS,SAAS,MAAM,SAAS,gBAAgB;AAEhE,MAAM,UAAU;AAChB,MAAM,gBAAgB,uBAAO,eAAe;AAI5C,SAAS,iBAAiB,OAAmC;AAC3D,MAAI,UAAU,QAAQ,UAAU,OAAW,QAAO;AAClD,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,QAAM,UAAU,MAAM,KAAK;AAC3B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,QAAQ,KAAK,OAAO,IAAI,UAAU;AAC3C;AAEA,SAAS,qBAAqB,MAAmD;AAC/E,QAAM,gBAAiB,KAAqC;AAC5D,SAAO,iBAAiB,iBAAiB,KAAK,YAAY,IAAI;AAChE;AAEA,SAAS,2BAA2B,MAAmD;AACrF,QAAM,aAAc,KAAkC;AACtD,SAAO,iBAAiB,cAAc,KAAK,SAAS,IAAI;AAC1D;AAEA,eAAsB,iCACpB,IACA,MACsB;AACtB,MAAI,CAAC,KAAM,QAAO;AAClB,MAAI,KAAK,SAAU,QAAO;AAE1B,QAAM,YAAY,iBAAiB,KAAK,GAAG;AAC3C,QAAM,gBAAgB,qBAAqB,IAAI;AAC/C,QAAM,sBAAsB,2BAA2B,IAAI;AAC3D,MACE,cAAc,iBACd,kBAAkB,iBAClB,wBAAwB,eACxB;AACA,WAAO;AAAA,EACT;AAWA,QAAM,YAAY,iBAAiB,OAAO,KAAK,QAAQ,WAAW,KAAK,MAAM,IAAI;AACjF,MAAI,cAAc,cAAe,QAAO;AACxC,MAAI,cAAc,MAAM;AAItB,QAAK,KAAiC,iBAAiB,MAAM;AAAA,IAE7D,OAAO;AACL,aAAO;AAAA,IACT;AAAA,EACF;AAYA,QAAM,iBAAiB,cAAc,OACjC,sBAAsB,IAAI,SAAS,EAAE,IAAI,WAAW,MAAM,WAAW,WAAW,KAAK,CAAC,IACtF,QAAQ,QAAQ,IAAI;AACxB,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,EAAE,IAAI,WAAW,WAAW,KAAK;AAAA,IACjC;AAAA,IACA,EAAE,UAAU,eAAe,gBAAgB,oBAAoB;AAAA,EACjE;AACA,QAAM,CAAC,SAAS,IAAI,IAAI,MAAM,QAAQ,IAAI,CAAC,gBAAgB,WAAW,CAAC;AAEvE,MAAI,cAAc,MAAM;AACtB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,qBAAqB,OAAO,MAAM,UAAW,QAAO;AACxD,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AAAA,EACvD;AAEA,MAAI,CAAC,QAAQ,KAAK,gBAAgB,MAAO,QAAO;AAEhD,QAAM,kBAAkB,iBAAiB,KAAK,YAAY,IAAI;AAC9D,QAAM,wBAAwB,iBAAiB,KAAK,kBAAkB,IAAI;AAC1E,MACE,oBAAoB,iBACpB,0BAA0B,iBAC1B,oBAAoB,iBACpB,0BAA0B,qBAC1B;AACA,WAAO;AAAA,EACT;AAMA,QAAM,eAAe,kBACjB;AAAA,IACE;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM,KAAK;AAAA,MACX,WAAW;AAAA,MACX,MAAM,EAAE,UAAU,iBAAiB,WAAW,KAAK;AAAA,IACrD;AAAA,IACA,EAAE,UAAU,CAAC,MAAM,EAAE;AAAA,IACrB,EAAE,UAAU,iBAAiB,gBAAgB,sBAAsB;AAAA,EACrE,IACA,QAAQ,QAAQ,CAAC,CAAe;AACpC,QAAM,2BAA2B,kBAC7B,wBAAwB,IAAI,KAAK,IAAI,iBAAiB,qBAAqB,IAC3E,QAAQ,QAAQ,KAAK;AACzB,QAAM,CAAC,OAAO,iBAAiB,IAAI,MAAM,QAAQ,IAAI,CAAC,cAAc,wBAAwB,CAAC;AAE7F,QAAM,cAAc,MACjB,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAuB,CAAC,CAAC,IAAI;AAExC,QAAM,QAAQ,YACX,IAAI,CAAC,SAAS,KAAK,IAAI,EACvB,OAAO,CAAC,SAAyB,OAAO,SAAS,YAAY,KAAK,KAAK,EAAE,SAAS,CAAC;AAEtF,QAAM,eAAe,kBACjB,qBAAsB,MAAM,wBAAwB,IAAI,aAAa,iBAAiB,qBAAqB,IAC3G;AAEJ,SAAO;AAAA,IACL,GAAG;AAAA,IACH,KAAK,KAAK;AAAA,IACV,UAAU;AAAA,IACV,OAAO;AAAA,IACP;AAAA,IACA;AAAA,EACF;AACF;AAEA,SAAS,qBAAqB,SAAiC;AAC7D,QAAM,QAAS,QAA+B;AAC9C,MAAI,OAAO,UAAU,SAAU,QAAO;AACtC,MAAI,SAAS,OAAO,UAAU,UAAU;AACtC,UAAM,UAAW,MAA2B;AAC5C,QAAI,OAAO,YAAY,SAAU,QAAO;AAAA,EAC1C;AACA,SAAO;AACT;AAEA,eAAe,wBACb,IACA,QACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE,MAAM;AAAA,MACN;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,IACb;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAe,wBACb,IACA,aACA,UACA,gBACkB;AAClB,QAAM,UAAU,MAAM;AAAA,IACpB,IAAI;AAAA,MACF,YACG,IAAI,CAAC,SAAU,MAAM,KAAK,OAAO,KAAK,EAAE,IAAI,IAAK,EACjD,OAAO,CAAC,OAAqB,OAAO,OAAO,YAAY,GAAG,SAAS,CAAC;AAAA,IACzE;AAAA,EACF;AACA,MAAI,CAAC,QAAQ,OAAQ,QAAO;AAE5B,QAAM,UAAU,MAAM;AAAA,IACpB;AAAA,IACA;AAAA,IACA;AAAA,MACE;AAAA,MACA,cAAc;AAAA,MACd,WAAW;AAAA,MACX,MAAM,EAAE,KAAK,QAAQ;AAAA,IACvB;AAAA,IACA;AAAA,IACA,EAAE,UAAU,eAAe;AAAA,EAC7B;AACA,SAAO,CAAC,EAAE,WAAY,QAAuC,iBAAiB;AAChF;AAEA,eAAsB,mBACpB,IACA,MACkB;AAClB,SAAQ,MAAM,iCAAiC,IAAI,IAAI,MAAO;AAChE;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerAuth.js

@@ -2,7 +2,7 @@ import { NextResponse } from "next/server";
 import { verifyAudienceJwt, verifyJwt } from "@open-mercato/shared/lib/auth/jwt";
 import { findOneWithDecryption } from "@open-mercato/shared/lib/encryption/find";
 import { CUSTOMER_JWT_AUDIENCE } from "@open-mercato/core/modules/customer_accounts/services/customerSessionService";
-async function assertSessionStillActive(sessionId) {
+async function assertSessionStillActive(input) {
   try {
     const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([
       import("@open-mercato/shared/lib/di/container"),
@@ -10,7 +10,7 @@ async function assertSessionStillActive(sessionId) {
     ]);
     const container = await createRequestContainer();
     const service = container.resolve("customerSessionService");
-    const session = await service.findActiveSessionById(sessionId);
+    const session = await service.findActiveSessionForClaims(input);
     return session !== null;
   } catch {
     return false;
@@ -73,28 +73,36 @@ async function getCustomerAuthFromRequest(req) {
   try {
     let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token);
     if (!payload) {
-      payload = verifyJwt(token);
-      if (payload) payload._legacyToken = true;
+      const legacyPayload = verifyJwt(token);
+      if (legacyPayload && legacyPayload._legacyToken === true) payload = legacyPayload;
     }
     if (!payload) return null;
     if (payload.type !== "customer") return null;
     const sid = typeof payload.sid === "string" ? payload.sid : "";
     if (!sid && payload._legacyToken !== true) return null;
-    const stillActive = sid ? await assertSessionStillActive(sid) : true;
+    const userId = String(payload.sub);
+    const tenantId = String(payload.tenantId);
+    const organizationId = String(payload.orgId);
+    const stillActive = sid ? await assertSessionStillActive({
+      sessionId: sid,
+      userId,
+      tenantId,
+      organizationId
+    }) : true;
     if (!stillActive) return null;
     const userState = await validateUserState(
-      String(payload.sub),
-      String(payload.tenantId),
-      String(payload.orgId),
+      userId,
+      tenantId,
+      organizationId,
       payload.iat
     );
     if (!userState.valid) return null;
     return {
-      sub: String(payload.sub),
+      sub: userId,
       sid,
       type: "customer",
-      tenantId: String(payload.tenantId),
-      orgId: String(payload.orgId),
+      tenantId,
+      orgId: organizationId,
       email: String(payload.email || ""),
       displayName: String(payload.displayName || ""),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,

package/dist/modules/customer_accounts/lib/customerAuth.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerAuth.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { verifyAudienceJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport type { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\n\nexport interface CustomerAuthContext {\n  sub: string\n  sid: string\n  type: 'customer'\n  tenantId: string\n  orgId: string\n  email: string\n  displayName: string\n  customerEntityId?: string | null\n  personEntityId?: string | null\n  resolvedFeatures: string[]\n  isPortalAdmin?: boolean\n}\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),\n    ])\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    // Fail closed: if we cannot verify the session, treat the token as revoked to prevent\n    // replay of leaked JWTs when the backend is partially degraded.\n    return false\n  }\n}\n\nexport function readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nexport type UserValidationResult =\n  | { valid: false }\n  | { valid: true; resolvedFeatures: string[]; isPortalAdmin: boolean }\n\nexport async function validateUserState(\n  sub: string,\n  tenantId: string,\n  orgId: string,\n  iat: unknown,\n): Promise<UserValidationResult> {\n  const [{ createRequestContainer }, { CustomerUser }] = await Promise.all([\n    import('@open-mercato/shared/lib/di/container'),\n    import('@open-mercato/core/modules/customer_accounts/data/entities'),\n  ])\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const user = await findOneWithDecryption(em, CustomerUser, { id: sub }, {\n    fields: ['sessionsRevokedAt', 'deletedAt', 'isActive'],\n  })\n  if (!user) return { valid: false }\n  if (user.deletedAt) return { valid: false }\n  if (!user.isActive) return { valid: false }\n  if (user.sessionsRevokedAt && typeof iat === 'number' && iat * 1000 < user.sessionsRevokedAt.getTime()) {\n    return { valid: false }\n  }\n\n  const { CustomerRbacService } = await import(\n    '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\n  )\n  const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>\n  const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })\n  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {\n    tenantId,\n    organizationId: orgId,\n  })\n  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin }\n}\n\nexport async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const authHeader = (req.headers.get('authorization') || '').trim()\n\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) {\n    token = authHeader.slice(7).trim()\n  }\n  if (!token) {\n    const cookieValue = readCookieFromHeader(cookieHeader, 'customer_auth_token')\n    if (cookieValue) {\n      try {\n        token = decodeURIComponent(cookieValue)\n      } catch {\n        // Malformed percent-encoding; use raw value\n        token = cookieValue\n      }\n    }\n  }\n  if (!token) return null\n\n  try {\n    let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    // Legacy fallback: try raw JWT_SECRET for pre-migration customer tokens\n    if (!payload) {\n      payload = verifyJwt(token) as Record<string, unknown> | null\n      if (payload) payload._legacyToken = true\n    }\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid && payload._legacyToken !== true) return null\n    const stillActive = sid ? await assertSessionStillActive(sid) : true\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      String(payload.tenantId),\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId: String(payload.tenantId),\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\nexport async function requireCustomerAuth(req: Request): Promise<CustomerAuthContext> {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    throw NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  return auth\n}\n\nexport async function requireCustomerFeature(\n  auth: CustomerAuthContext,\n  features: string[],\n  rbac: CustomerRbacService,\n): Promise<void> {\n  if (!features.length) return\n  const ok = await rbac.userHasAllFeatures(\n    auth.sub,\n    features,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  if (!ok) {\n    throw NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB,iBAAiB;AAE7C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAgBtC,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,uBAAuB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjF,OAAO,uCAAuC;AAAA,MAC9C,OAAO,8EAA8E;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAqB,QAAmC,MAAkC;AACxG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,kBACpB,KACA,UACA,OACA,KAC+B;AAC/B,QAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvE,OAAO,uCAAuC;AAAA,IAC9C,OAAO,4DAA4D;AAAA,EACrE,CAAC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,IAAI,GAAG;AAAA,IACtE,QAAQ,CAAC,qBAAqB,aAAa,UAAU;AAAA,EACvD,CAAC;AACD,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,MAAM;AACjC,MAAI,KAAK,UAAW,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,CAAC,KAAK,SAAU,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,KAAK,qBAAqB,OAAO,QAAQ,YAAY,MAAM,MAAO,KAAK,kBAAkB,QAAQ,GAAG;AACtG,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OACpC,2EACF;AACA,QAAM,OAAO,UAAU,QAAQ,qBAAqB;AACpD,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvE,QAAM,mBAAmB,MAAM,KAAK,qBAAqB,KAAK;AAAA,IAC5D;AAAA,IACA,gBAAgB;AAAA,EAClB,CAAC;AACD,SAAO,EAAE,OAAO,MAAM,kBAAkB,eAAe,IAAI,cAAc;AAC3E;AAEA,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AAEjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,YAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EACnC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,cAAc,qBAAqB,cAAc,qBAAqB;AAC5E,QAAI,aAAa;AACf,UAAI;AACF,gBAAQ,mBAAmB,WAAW;AAAA,MACxC,QAAQ;AAEN,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,QAAI,UAAU,kBAAkB,uBAAuB,KAAK;AAE5D,QAAI,CAAC,SAAS;AACZ,gBAAU,UAAU,KAAK;AACzB,UAAI,QAAS,SAAQ,eAAe;AAAA,IACtC;AACA,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,OAAO,QAAQ,iBAAiB,KAAM,QAAO;AAClD,UAAM,cAAc,MAAM,MAAM,yBAAyB,GAAG,IAAI;AAChE,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB,OAAO,QAAQ,QAAQ;AAAA,MACvB,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN,UAAU,OAAO,QAAQ,QAAQ;AAAA,MACjC,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,KAA4C;AACpF,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,MACA,UACA,MACe;AACf,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,KAAK,MAAM,KAAK;AAAA,IACpB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,MAAI,CAAC,IAAI;AACP,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { verifyAudienceJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport type { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\nimport { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'\nimport { CUSTOMER_JWT_AUDIENCE } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\n\nexport interface CustomerAuthContext {\n  sub: string\n  sid: string\n  type: 'customer'\n  tenantId: string\n  orgId: string\n  email: string\n  displayName: string\n  customerEntityId?: string | null\n  personEntityId?: string | null\n  resolvedFeatures: string[]\n  isPortalAdmin?: boolean\n}\n\nasync function assertSessionStillActive(input: {\n  sessionId: string\n  userId: string\n  tenantId: string\n  organizationId: string\n}): Promise<boolean> {\n  try {\n    const [{ createRequestContainer }, { CustomerSessionService }] = await Promise.all([\n      import('@open-mercato/shared/lib/di/container'),\n      import('@open-mercato/core/modules/customer_accounts/services/customerSessionService'),\n    ])\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionForClaims(input)\n    return session !== null\n  } catch {\n    // Fail closed: if we cannot verify the session, treat the token as revoked to prevent\n    // replay of leaked JWTs when the backend is partially degraded.\n    return false\n  }\n}\n\nexport function readCookieFromHeader(header: string | null | undefined, name: string): string | undefined {\n  if (!header) return undefined\n  const parts = header.split(';')\n  for (const part of parts) {\n    const trimmed = part.trim()\n    if (trimmed.startsWith(`${name}=`)) {\n      return trimmed.slice(name.length + 1)\n    }\n  }\n  return undefined\n}\n\nexport type UserValidationResult =\n  | { valid: false }\n  | { valid: true; resolvedFeatures: string[]; isPortalAdmin: boolean }\n\nexport async function validateUserState(\n  sub: string,\n  tenantId: string,\n  orgId: string,\n  iat: unknown,\n): Promise<UserValidationResult> {\n  const [{ createRequestContainer }, { CustomerUser }] = await Promise.all([\n    import('@open-mercato/shared/lib/di/container'),\n    import('@open-mercato/core/modules/customer_accounts/data/entities'),\n  ])\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as import('@mikro-orm/postgresql').EntityManager\n  const user = await findOneWithDecryption(em, CustomerUser, { id: sub }, {\n    fields: ['sessionsRevokedAt', 'deletedAt', 'isActive'],\n  })\n  if (!user) return { valid: false }\n  if (user.deletedAt) return { valid: false }\n  if (!user.isActive) return { valid: false }\n  if (user.sessionsRevokedAt && typeof iat === 'number' && iat * 1000 < user.sessionsRevokedAt.getTime()) {\n    return { valid: false }\n  }\n\n  const { CustomerRbacService } = await import(\n    '@open-mercato/core/modules/customer_accounts/services/customerRbacService'\n  )\n  const rbac = container.resolve('customerRbacService') as InstanceType<typeof CustomerRbacService>\n  const acl = await rbac.loadAcl(sub, { tenantId, organizationId: orgId })\n  const resolvedFeatures = await rbac.getEffectiveFeatures(sub, {\n    tenantId,\n    organizationId: orgId,\n  })\n  return { valid: true, resolvedFeatures, isPortalAdmin: acl.isPortalAdmin }\n}\n\nexport async function getCustomerAuthFromRequest(req: Request): Promise<CustomerAuthContext | null> {\n  const cookieHeader = req.headers.get('cookie') || ''\n  const authHeader = (req.headers.get('authorization') || '').trim()\n\n  let token: string | undefined\n  if (authHeader.toLowerCase().startsWith('bearer ')) {\n    token = authHeader.slice(7).trim()\n  }\n  if (!token) {\n    const cookieValue = readCookieFromHeader(cookieHeader, 'customer_auth_token')\n    if (cookieValue) {\n      try {\n        token = decodeURIComponent(cookieValue)\n      } catch {\n        // Malformed percent-encoding; use raw value\n        token = cookieValue\n      }\n    }\n  }\n  if (!token) return null\n\n  try {\n    let payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    // Legacy fallback: accept a pre-migration customer token signed with the raw JWT_SECRET, but\n    // only while `verifyJwt` itself still considers it legacy \u2014 it owns the grace window (token\n    // `iat` vs JWT_LEGACY_GRACE_MINUTES / JWT_LEGACY_CUTOVER_AT) and marks the payload. Trusting\n    // the bare return value would also let a staff-audience token through this branch, because\n    // the default `verifyJwt` path verifies against the staff-derived key.\n    if (!payload) {\n      const legacyPayload = verifyJwt(token) as Record<string, unknown> | null\n      if (legacyPayload && legacyPayload._legacyToken === true) payload = legacyPayload\n    }\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid && payload._legacyToken !== true) return null\n    const userId = String(payload.sub)\n    const tenantId = String(payload.tenantId)\n    const organizationId = String(payload.orgId)\n    const stillActive = sid\n      ? await assertSessionStillActive({\n          sessionId: sid,\n          userId,\n          tenantId,\n          organizationId,\n        })\n      : true\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      userId,\n      tenantId,\n      organizationId,\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: userId,\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: organizationId,\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\nexport async function requireCustomerAuth(req: Request): Promise<CustomerAuthContext> {\n  const auth = await getCustomerAuthFromRequest(req)\n  if (!auth) {\n    throw NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })\n  }\n  return auth\n}\n\nexport async function requireCustomerFeature(\n  auth: CustomerAuthContext,\n  features: string[],\n  rbac: CustomerRbacService,\n): Promise<void> {\n  if (!features.length) return\n  const ok = await rbac.userHasAllFeatures(\n    auth.sub,\n    features,\n    { tenantId: auth.tenantId, organizationId: auth.orgId },\n  )\n  if (!ok) {\n    throw NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })\n  }\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,mBAAmB,iBAAiB;AAE7C,SAAS,6BAA6B;AACtC,SAAS,6BAA6B;AAgBtC,eAAe,yBAAyB,OAKnB;AACnB,MAAI;AACF,UAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,uBAAuB,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,MACjF,OAAO,uCAAuC;AAAA,MAC9C,OAAO,8EAA8E;AAAA,IACvF,CAAC;AACD,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,2BAA2B,KAAK;AAC9D,WAAO,YAAY;AAAA,EACrB,QAAQ;AAGN,WAAO;AAAA,EACT;AACF;AAEO,SAAS,qBAAqB,QAAmC,MAAkC;AACxG,MAAI,CAAC,OAAQ,QAAO;AACpB,QAAM,QAAQ,OAAO,MAAM,GAAG;AAC9B,aAAW,QAAQ,OAAO;AACxB,UAAM,UAAU,KAAK,KAAK;AAC1B,QAAI,QAAQ,WAAW,GAAG,IAAI,GAAG,GAAG;AAClC,aAAO,QAAQ,MAAM,KAAK,SAAS,CAAC;AAAA,IACtC;AAAA,EACF;AACA,SAAO;AACT;AAMA,eAAsB,kBACpB,KACA,UACA,OACA,KAC+B;AAC/B,QAAM,CAAC,EAAE,uBAAuB,GAAG,EAAE,aAAa,CAAC,IAAI,MAAM,QAAQ,IAAI;AAAA,IACvE,OAAO,uCAAuC;AAAA,IAC9C,OAAO,4DAA4D;AAAA,EACrE,CAAC;AACD,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,OAAO,MAAM,sBAAsB,IAAI,cAAc,EAAE,IAAI,IAAI,GAAG;AAAA,IACtE,QAAQ,CAAC,qBAAqB,aAAa,UAAU;AAAA,EACvD,CAAC;AACD,MAAI,CAAC,KAAM,QAAO,EAAE,OAAO,MAAM;AACjC,MAAI,KAAK,UAAW,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,CAAC,KAAK,SAAU,QAAO,EAAE,OAAO,MAAM;AAC1C,MAAI,KAAK,qBAAqB,OAAO,QAAQ,YAAY,MAAM,MAAO,KAAK,kBAAkB,QAAQ,GAAG;AACtG,WAAO,EAAE,OAAO,MAAM;AAAA,EACxB;AAEA,QAAM,EAAE,oBAAoB,IAAI,MAAM,OACpC,2EACF;AACA,QAAM,OAAO,UAAU,QAAQ,qBAAqB;AACpD,QAAM,MAAM,MAAM,KAAK,QAAQ,KAAK,EAAE,UAAU,gBAAgB,MAAM,CAAC;AACvE,QAAM,mBAAmB,MAAM,KAAK,qBAAqB,KAAK;AAAA,IAC5D;AAAA,IACA,gBAAgB;AAAA,EAClB,CAAC;AACD,SAAO,EAAE,OAAO,MAAM,kBAAkB,eAAe,IAAI,cAAc;AAC3E;AAEA,eAAsB,2BAA2B,KAAmD;AAClG,QAAM,eAAe,IAAI,QAAQ,IAAI,QAAQ,KAAK;AAClD,QAAM,cAAc,IAAI,QAAQ,IAAI,eAAe,KAAK,IAAI,KAAK;AAEjE,MAAI;AACJ,MAAI,WAAW,YAAY,EAAE,WAAW,SAAS,GAAG;AAClD,YAAQ,WAAW,MAAM,CAAC,EAAE,KAAK;AAAA,EACnC;AACA,MAAI,CAAC,OAAO;AACV,UAAM,cAAc,qBAAqB,cAAc,qBAAqB;AAC5E,QAAI,aAAa;AACf,UAAI;AACF,gBAAQ,mBAAmB,WAAW;AAAA,MACxC,QAAQ;AAEN,gBAAQ;AAAA,MACV;AAAA,IACF;AAAA,EACF;AACA,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,QAAI,UAAU,kBAAkB,uBAAuB,KAAK;AAM5D,QAAI,CAAC,SAAS;AACZ,YAAM,gBAAgB,UAAU,KAAK;AACrC,UAAI,iBAAiB,cAAc,iBAAiB,KAAM,WAAU;AAAA,IACtE;AACA,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,OAAO,QAAQ,iBAAiB,KAAM,QAAO;AAClD,UAAM,SAAS,OAAO,QAAQ,GAAG;AACjC,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,UAAM,iBAAiB,OAAO,QAAQ,KAAK;AAC3C,UAAM,cAAc,MAChB,MAAM,yBAAyB;AAAA,MAC7B,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC,IACD;AACJ,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,oBAAoB,KAA4C;AACpF,QAAM,OAAO,MAAM,2BAA2B,GAAG;AACjD,MAAI,CAAC,MAAM;AACT,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,0BAA0B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1F;AACA,SAAO;AACT;AAEA,eAAsB,uBACpB,MACA,UACA,MACe;AACf,MAAI,CAAC,SAAS,OAAQ;AACtB,QAAM,KAAK,MAAM,KAAK;AAAA,IACpB,KAAK;AAAA,IACL;AAAA,IACA,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM;AAAA,EACxD;AACA,MAAI,CAAC,IAAI;AACP,UAAM,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,2BAA2B,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC3F;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/lib/customerAuthServer.js

@@ -7,11 +7,11 @@ import { platformDomains } from "@open-mercato/core/modules/customer_accounts/li
 import { validateUserState } from "./customerAuth.js";
 import { createLogger } from "@open-mercato/shared/lib/logger";
 const logger = createLogger("customer_accounts").child({ component: "customer-auth-server" });
-async function assertSessionStillActive(sessionId) {
+async function assertSessionStillActive(input) {
   try {
     const container = await createRequestContainer();
     const service = container.resolve("customerSessionService");
-    const session = await service.findActiveSessionById(sessionId);
+    const session = await service.findActiveSessionForClaims(input);
     return session !== null;
   } catch {
     return false;
@@ -28,24 +28,31 @@ async function getCustomerAuthFromCookies(options) {
     const sid = typeof payload.sid === "string" ? payload.sid : "";
     if (!sid) return null;
     const tenantId = String(payload.tenantId);
+    const userId = String(payload.sub);
+    const organizationId = String(payload.orgId);
     if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {
       return null;
     }
-    const stillActive = await assertSessionStillActive(sid);
+    const stillActive = await assertSessionStillActive({
+      sessionId: sid,
+      userId,
+      tenantId,
+      organizationId
+    });
     if (!stillActive) return null;
     const userState = await validateUserState(
-      String(payload.sub),
+      userId,
       tenantId,
-      String(payload.orgId),
+      organizationId,
       payload.iat
     );
     if (!userState.valid) return null;
     return {
-      sub: String(payload.sub),
+      sub: userId,
       sid,
       type: "customer",
       tenantId,
-      orgId: String(payload.orgId),
+      orgId: organizationId,
       email: String(payload.email || ""),
       displayName: String(payload.displayName || ""),
       customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,

package/dist/modules/customer_accounts/lib/customerAuthServer.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/lib/customerAuthServer.ts"],
-  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'customer-auth-server' })\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(sessionId: string): Promise<boolean> {\n  try {\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionById(sessionId)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(\n  options?: { expectedTenantId?: string },\n): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const tenantId = String(payload.tenantId)\n    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {\n      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication\n      // section: the host-resolved tenant is the authoritative scope; mismatched\n      // JWTs are rejected as if unauthenticated.\n      return null\n    }\n    const stillActive = await assertSessionStillActive(sid)\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      String(payload.sub),\n      tenantId,\n      String(payload.orgId),\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: String(payload.sub),\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: String(payload.orgId),\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\n/**\n * Convenience wrapper for custom-domain pages: resolves the host, calls\n * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.\n *\n * Use from server components rendered under custom domains.\n */\nexport async function getCustomerAuthForHost(\n  host: string | null | undefined,\n): Promise<CustomerAuthContext | null> {\n  if (!host) return getCustomerAuthFromCookies()\n\n  try {\n    const hostname = tryNormalizeHostname(host)\n    if (!hostname) return getCustomerAuthFromCookies()\n    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()\n\n    const container = await createRequestContainer()\n    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>\n    const resolved = await service.resolveByHostname(hostname)\n    if (!resolved || resolved.status !== 'active') return null\n    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })\n  } catch (err) {\n    logger.warn('Domain resolve failed; falling back to platform cookie', { err })\n    return getCustomerAuthFromCookies()\n  }\n}\n"],
-  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,6BAAqD;AAE9D,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAI5F,eAAe,yBAAyB,WAAqC;AAC3E,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,sBAAsB,SAAS;AAC7D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,2BACpB,SACqC;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,QAAI,SAAS,oBAAoB,QAAQ,qBAAqB,UAAU;AAItE,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM,yBAAyB,GAAG;AACtD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB,OAAO,QAAQ,GAAG;AAAA,MAClB;AAAA,MACA,OAAO,QAAQ,KAAK;AAAA,MACpB,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK,OAAO,QAAQ,GAAG;AAAA,MACvB;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO,OAAO,QAAQ,KAAK;AAAA,MAC3B,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,uBACpB,MACqC;AACrC,MAAI,CAAC,KAAM,QAAO,2BAA2B;AAE7C,MAAI;AACF,UAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAI,CAAC,SAAU,QAAO,2BAA2B;AACjD,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO,2BAA2B;AAE5E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,UAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,QAAI,CAAC,YAAY,SAAS,WAAW,SAAU,QAAO;AACtD,WAAO,2BAA2B,EAAE,kBAAkB,SAAS,SAAS,CAAC;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO,KAAK,0DAA0D,EAAE,IAAI,CAAC;AAC7E,WAAO,2BAA2B;AAAA,EACpC;AACF;",
+  "sourcesContent": ["/**\n * Server-side customer auth helpers for Next.js server components.\n *\n * Uses the `cookies()` API from `next/headers` to read the customer auth token\n * from cookies \u2014 analogous to `getAuthFromCookies()` for staff auth.\n */\n\nimport { cookies } from 'next/headers'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { verifyAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { CUSTOMER_JWT_AUDIENCE, CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'\nimport { DomainMappingService } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'\nimport { tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'\nimport { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'\nimport { validateUserState } from './customerAuth'\nimport type { CustomerAuthContext } from './customerAuth'\nimport { createLogger } from '@open-mercato/shared/lib/logger'\n\nconst logger = createLogger('customer_accounts').child({ component: 'customer-auth-server' })\n\nexport type { CustomerAuthContext }\n\nasync function assertSessionStillActive(input: {\n  sessionId: string\n  userId: string\n  tenantId: string\n  organizationId: string\n}): Promise<boolean> {\n  try {\n    const container = await createRequestContainer()\n    const service = container.resolve('customerSessionService') as InstanceType<typeof CustomerSessionService>\n    const session = await service.findActiveSessionForClaims(input)\n    return session !== null\n  } catch {\n    return false\n  }\n}\n\n/**\n * Read and verify customer auth from cookies in server components.\n *\n * Returns the customer auth context if a valid customer JWT is found,\n * or null if not authenticated.\n *\n * @example\n * ```tsx\n * // In a server component or catch-all route\n * import { getCustomerAuthFromCookies } from '@open-mercato/core/modules/customer_accounts/lib/customerAuthServer'\n *\n * const customerAuth = await getCustomerAuthFromCookies()\n * if (!customerAuth) redirect('/login')\n * ```\n */\nexport async function getCustomerAuthFromCookies(\n  options?: { expectedTenantId?: string },\n): Promise<CustomerAuthContext | null> {\n  const cookieStore = await cookies()\n  const token = cookieStore.get('customer_auth_token')?.value\n  if (!token) return null\n\n  try {\n    const payload = verifyAudienceJwt(CUSTOMER_JWT_AUDIENCE, token) as Record<string, unknown> | null\n    if (!payload) return null\n    if (payload.type !== 'customer') return null\n    const sid = typeof payload.sid === 'string' ? payload.sid : ''\n    if (!sid) return null\n    const tenantId = String(payload.tenantId)\n    const userId = String(payload.sub)\n    const organizationId = String(payload.orgId)\n    if (options?.expectedTenantId && options.expectedTenantId !== tenantId) {\n      // Cross-host JWT replay defense. See spec rev 5 Customer Authentication\n      // section: the host-resolved tenant is the authoritative scope; mismatched\n      // JWTs are rejected as if unauthenticated.\n      return null\n    }\n    const stillActive = await assertSessionStillActive({\n      sessionId: sid,\n      userId,\n      tenantId,\n      organizationId,\n    })\n    if (!stillActive) return null\n\n    const userState = await validateUserState(\n      userId,\n      tenantId,\n      organizationId,\n      payload.iat,\n    )\n    if (!userState.valid) return null\n\n    return {\n      sub: userId,\n      sid,\n      type: 'customer',\n      tenantId,\n      orgId: organizationId,\n      email: String(payload.email || ''),\n      displayName: String(payload.displayName || ''),\n      customerEntityId: payload.customerEntityId ? String(payload.customerEntityId) : null,\n      personEntityId: payload.personEntityId ? String(payload.personEntityId) : null,\n      resolvedFeatures: userState.resolvedFeatures,\n      isPortalAdmin: userState.isPortalAdmin,\n    }\n  } catch {\n    // Invalid or expired JWT \u2014 treat as unauthenticated\n    return null\n  }\n}\n\n/**\n * Convenience wrapper for custom-domain pages: resolves the host, calls\n * getCustomerAuthFromCookies with the host-resolved tenant as expectedTenantId.\n *\n * Use from server components rendered under custom domains.\n */\nexport async function getCustomerAuthForHost(\n  host: string | null | undefined,\n): Promise<CustomerAuthContext | null> {\n  if (!host) return getCustomerAuthFromCookies()\n\n  try {\n    const hostname = tryNormalizeHostname(host)\n    if (!hostname) return getCustomerAuthFromCookies()\n    if (platformDomains().includes(hostname)) return getCustomerAuthFromCookies()\n\n    const container = await createRequestContainer()\n    const service = container.resolve('domainMappingService') as InstanceType<typeof DomainMappingService>\n    const resolved = await service.resolveByHostname(hostname)\n    if (!resolved || resolved.status !== 'active') return null\n    return getCustomerAuthFromCookies({ expectedTenantId: resolved.tenantId })\n  } catch (err) {\n    logger.warn('Domain resolve failed; falling back to platform cookie', { err })\n    return getCustomerAuthFromCookies()\n  }\n}\n"],
+  "mappings": "AAOA,SAAS,eAAe;AACxB,SAAS,8BAA8B;AACvC,SAAS,yBAAyB;AAClC,SAAS,6BAAqD;AAE9D,SAAS,4BAA4B;AACrC,SAAS,uBAAuB;AAChC,SAAS,yBAAyB;AAElC,SAAS,oBAAoB;AAE7B,MAAM,SAAS,aAAa,mBAAmB,EAAE,MAAM,EAAE,WAAW,uBAAuB,CAAC;AAI5F,eAAe,yBAAyB,OAKnB;AACnB,MAAI;AACF,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,wBAAwB;AAC1D,UAAM,UAAU,MAAM,QAAQ,2BAA2B,KAAK;AAC9D,WAAO,YAAY;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAiBA,eAAsB,2BACpB,SACqC;AACrC,QAAM,cAAc,MAAM,QAAQ;AAClC,QAAM,QAAQ,YAAY,IAAI,qBAAqB,GAAG;AACtD,MAAI,CAAC,MAAO,QAAO;AAEnB,MAAI;AACF,UAAM,UAAU,kBAAkB,uBAAuB,KAAK;AAC9D,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,SAAS,WAAY,QAAO;AACxC,UAAM,MAAM,OAAO,QAAQ,QAAQ,WAAW,QAAQ,MAAM;AAC5D,QAAI,CAAC,IAAK,QAAO;AACjB,UAAM,WAAW,OAAO,QAAQ,QAAQ;AACxC,UAAM,SAAS,OAAO,QAAQ,GAAG;AACjC,UAAM,iBAAiB,OAAO,QAAQ,KAAK;AAC3C,QAAI,SAAS,oBAAoB,QAAQ,qBAAqB,UAAU;AAItE,aAAO;AAAA,IACT;AACA,UAAM,cAAc,MAAM,yBAAyB;AAAA,MACjD,WAAW;AAAA,MACX;AAAA,MACA;AAAA,MACA;AAAA,IACF,CAAC;AACD,QAAI,CAAC,YAAa,QAAO;AAEzB,UAAM,YAAY,MAAM;AAAA,MACtB;AAAA,MACA;AAAA,MACA;AAAA,MACA,QAAQ;AAAA,IACV;AACA,QAAI,CAAC,UAAU,MAAO,QAAO;AAE7B,WAAO;AAAA,MACL,KAAK;AAAA,MACL;AAAA,MACA,MAAM;AAAA,MACN;AAAA,MACA,OAAO;AAAA,MACP,OAAO,OAAO,QAAQ,SAAS,EAAE;AAAA,MACjC,aAAa,OAAO,QAAQ,eAAe,EAAE;AAAA,MAC7C,kBAAkB,QAAQ,mBAAmB,OAAO,QAAQ,gBAAgB,IAAI;AAAA,MAChF,gBAAgB,QAAQ,iBAAiB,OAAO,QAAQ,cAAc,IAAI;AAAA,MAC1E,kBAAkB,UAAU;AAAA,MAC5B,eAAe,UAAU;AAAA,IAC3B;AAAA,EACF,QAAQ;AAEN,WAAO;AAAA,EACT;AACF;AAQA,eAAsB,uBACpB,MACqC;AACrC,MAAI,CAAC,KAAM,QAAO,2BAA2B;AAE7C,MAAI;AACF,UAAM,WAAW,qBAAqB,IAAI;AAC1C,QAAI,CAAC,SAAU,QAAO,2BAA2B;AACjD,QAAI,gBAAgB,EAAE,SAAS,QAAQ,EAAG,QAAO,2BAA2B;AAE5E,UAAM,YAAY,MAAM,uBAAuB;AAC/C,UAAM,UAAU,UAAU,QAAQ,sBAAsB;AACxD,UAAM,WAAW,MAAM,QAAQ,kBAAkB,QAAQ;AACzD,QAAI,CAAC,YAAY,SAAS,WAAW,SAAU,QAAO;AACtD,WAAO,2BAA2B,EAAE,kBAAkB,SAAS,SAAS,CAAC;AAAA,EAC3E,SAAS,KAAK;AACZ,WAAO,KAAK,0DAA0D,EAAE,IAAI,CAAC;AAC7E,WAAO,2BAA2B;AAAA,EACpC;AACF;",
   "names": []
 }

package/dist/modules/customer_accounts/services/customerSessionService.js

@@ -84,6 +84,20 @@ class CustomerSessionService {
     if (session.expiresAt.getTime() < Date.now()) return null;
     return session;
   }
+  async findActiveSessionForClaims(input) {
+    const session = await this.em.findOne(CustomerUserSession, {
+      id: input.sessionId,
+      user: {
+        id: input.userId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId
+      },
+      deletedAt: null
+    });
+    if (!session) return null;
+    if (session.expiresAt.getTime() < Date.now()) return null;
+    return session;
+  }
   async revokeSession(sessionId) {
     await this.em.nativeUpdate(CustomerUserSession, { id: sessionId }, { deletedAt: /* @__PURE__ */ new Date() });
   }

package/dist/modules/customer_accounts/services/customerSessionService.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/customer_accounts/services/customerSessionService.ts"],
-  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser, CustomerUserSession } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { signAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const CUSTOMER_JWT_AUDIENCE = 'customer'\nconst CUSTOMER_JWT_TTL_SECONDS = 60 * 60 * 8\n\nconst DEFAULT_SESSION_TTL_DAYS = 30\nconst DEFAULT_MAX_SESSIONS_PER_USER = 5\n\nfunction resolveMaxSessionsPerUser(): number {\n  const raw = process.env.MAX_CUSTOMER_SESSIONS_PER_USER\n  if (!raw) return DEFAULT_MAX_SESSIONS_PER_USER\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_SESSIONS_PER_USER\n  return Math.floor(parsed)\n}\n\nexport class CustomerSessionService {\n  constructor(private em: EntityManager) {}\n\n  async createSession(\n    user: CustomerUser,\n    resolvedFeatures: string[],\n    ip?: string | null,\n    userAgent?: string | null,\n  ): Promise<{ rawToken: string; jwt: string; session: CustomerUserSession }> {\n    const rawToken = generateSecureToken()\n    const tokenHash = hashToken(rawToken)\n    const days = Number(process.env.CUSTOMER_SESSION_TTL_DAYS || DEFAULT_SESSION_TTL_DAYS)\n    const expiresAt = new Date(Date.now() + days * 24 * 60 * 60 * 1000)\n\n    await this.enforceSessionCap(user.id, user.tenantId, user.organizationId)\n\n    const session = this.em.create(CustomerUserSession, {\n      user,\n      tokenHash,\n      ipAddress: ip || null,\n      userAgent: userAgent || null,\n      expiresAt,\n      lastUsedAt: new Date(),\n      createdAt: new Date(),\n    } as any) as CustomerUserSession\n    await this.em.persist(session).flush()\n\n    const jwt = this.signCustomerJwt(user, resolvedFeatures, session.id)\n\n    return { rawToken, jwt, session }\n  }\n\n  signCustomerJwt(user: CustomerUser, resolvedFeatures: string[], sessionId: string): string {\n    return signAudienceJwt(\n      CUSTOMER_JWT_AUDIENCE,\n      {\n        sub: user.id,\n        sid: sessionId,\n        type: 'customer',\n        tenantId: user.tenantId,\n        orgId: user.organizationId,\n        email: user.email,\n        displayName: user.displayName || '',\n        customerEntityId: user.customerEntityId || null,\n        personEntityId: user.personEntityId || null,\n        resolvedFeatures,\n      },\n      CUSTOMER_JWT_TTL_SECONDS,\n    )\n  }\n\n  async findByToken(rawToken: string, tenantId?: string): Promise<CustomerUserSession | null> {\n    const tokenHash = hashToken(rawToken)\n    const session = await this.em.findOne(CustomerUserSession, {\n      tokenHash,\n      deletedAt: null,\n    }, { populate: ['user'] })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    const user = session.user as CustomerUser\n    if (tenantId && user?.tenantId !== tenantId) return null\n    return session\n  }\n\n  async refreshSession(\n    rawToken: string,\n    resolvedFeatures: string[],\n  ): Promise<{ jwt: string; user: CustomerUser } | null> {\n    const session = await this.findByToken(rawToken)\n    if (!session) return null\n    const user = session.user as CustomerUser\n    if (!user || user.deletedAt || !user.isActive) return null\n\n    await this.em.nativeUpdate(CustomerUserSession, { id: session.id }, { lastUsedAt: new Date() })\n    const jwt = this.signCustomerJwt(user, resolvedFeatures, session.id)\n    return { jwt, user }\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<CustomerUserSession | null> {\n    const session = await this.em.findOne(CustomerUserSession, {\n      id: sessionId,\n      deletedAt: null,\n    })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async revokeSession(sessionId: string): Promise<void> {\n    await this.em.nativeUpdate(CustomerUserSession, { id: sessionId }, { deletedAt: new Date() })\n  }\n\n  private async enforceSessionCap(\n    userId: string,\n    tenantId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const cap = resolveMaxSessionsPerUser()\n    const existing = await findWithDecryption(\n      this.em,\n      CustomerUserSession,\n      {\n        user: userId as any,\n        deletedAt: null,\n        expiresAt: { $gt: new Date() },\n      },\n      { orderBy: { createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n    const toRevoke = existing.length - (cap - 1)\n    if (toRevoke <= 0) return\n    const oldestIds = existing.slice(0, toRevoke).map((s) => s.id)\n    await this.em.nativeUpdate(\n      CustomerUserSession,\n      { id: { $in: oldestIds } },\n      { deletedAt: new Date() },\n    )\n  }\n\n  async revokeAllUserSessions(userId: string, em?: EntityManager): Promise<void> {\n    const now = new Date()\n    const target = em ?? this.em\n    await target.nativeUpdate(\n      CustomerUserSession,\n      { user: userId as any, deletedAt: null },\n      { deletedAt: now },\n    )\n    await target.nativeUpdate(\n      CustomerUser,\n      { id: userId },\n      { sessionsRevokedAt: now },\n    )\n  }\n}\n"],
-  "mappings": "AACA,SAAS,cAAc,2BAA2B;AAClD,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AAE5B,MAAM,wBAAwB;AACrC,MAAM,2BAA2B,KAAK,KAAK;AAE3C,MAAM,2BAA2B;AACjC,MAAM,gCAAgC;AAEtC,SAAS,4BAAoC;AAC3C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO,KAAK,MAAM,MAAM;AAC1B;AAEO,MAAM,uBAAuB;AAAA,EAClC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,cACJ,MACA,kBACA,IACA,WAC0E;AAC1E,UAAM,WAAW,oBAAoB;AACrC,UAAM,YAAY,UAAU,QAAQ;AACpC,UAAM,OAAO,OAAO,QAAQ,IAAI,6BAA6B,wBAAwB;AACrF,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,KAAK,GAAI;AAElE,UAAM,KAAK,kBAAkB,KAAK,IAAI,KAAK,UAAU,KAAK,cAAc;AAExE,UAAM,UAAU,KAAK,GAAG,OAAO,qBAAqB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,WAAW,aAAa;AAAA,MACxB;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAErC,UAAM,MAAM,KAAK,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE;AAEnE,WAAO,EAAE,UAAU,KAAK,QAAQ;AAAA,EAClC;AAAA,EAEA,gBAAgB,MAAoB,kBAA4B,WAA2B;AACzF,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,KAAK,KAAK;AAAA,QACV,KAAK;AAAA,QACL,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK,eAAe;AAAA,QACjC,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,gBAAgB,KAAK,kBAAkB;AAAA,QACvC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAkB,UAAwD;AAC1F,UAAM,YAAY,UAAU,QAAQ;AACpC,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACzB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,UAAM,OAAO,QAAQ;AACrB,QAAI,YAAY,MAAM,aAAa,SAAU,QAAO;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,eACJ,UACA,kBACqD;AACrD,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ;AAC/C,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ;AACrB,QAAI,CAAC,QAAQ,KAAK,aAAa,CAAC,KAAK,SAAU,QAAO;AAEtD,UAAM,KAAK,GAAG,aAAa,qBAAqB,EAAE,IAAI,QAAQ,GAAG,GAAG,EAAE,YAAY,oBAAI,KAAK,EAAE,CAAC;AAC9F,UAAM,MAAM,KAAK,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE;AACnE,WAAO,EAAE,KAAK,KAAK;AAAA,EACrB;AAAA,EAEA,MAAM,sBAAsB,WAAwD;AAClF,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MACzD,IAAI;AAAA,MACJ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,WAAkC;AACpD,UAAM,KAAK,GAAG,aAAa,qBAAqB,EAAE,IAAI,UAAU,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAAA,EAC9F;AAAA,EAEA,MAAc,kBACZ,QACA,UACA,gBACe;AACf,UAAM,MAAM,0BAA0B;AACtC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,WAAW;AAAA,QACX,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,WAAW,SAAS,UAAU,MAAM;AAC1C,QAAI,YAAY,EAAG;AACnB,UAAM,YAAY,SAAS,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7D,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,MACzB,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,QAAgB,IAAmC;AAC7E,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO;AAAA,MACX;AAAA,MACA,EAAE,MAAM,QAAe,WAAW,KAAK;AAAA,MACvC,EAAE,WAAW,IAAI;AAAA,IACnB;AACA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,EAAE,IAAI,OAAO;AAAA,MACb,EAAE,mBAAmB,IAAI;AAAA,IAC3B;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { EntityManager } from '@mikro-orm/postgresql'\nimport { CustomerUser, CustomerUserSession } from '@open-mercato/core/modules/customer_accounts/data/entities'\nimport { generateSecureToken, hashToken } from '@open-mercato/core/modules/customer_accounts/lib/tokenGenerator'\nimport { signAudienceJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'\n\nexport const CUSTOMER_JWT_AUDIENCE = 'customer'\nconst CUSTOMER_JWT_TTL_SECONDS = 60 * 60 * 8\n\nconst DEFAULT_SESSION_TTL_DAYS = 30\nconst DEFAULT_MAX_SESSIONS_PER_USER = 5\n\nfunction resolveMaxSessionsPerUser(): number {\n  const raw = process.env.MAX_CUSTOMER_SESSIONS_PER_USER\n  if (!raw) return DEFAULT_MAX_SESSIONS_PER_USER\n  const parsed = Number(raw)\n  if (!Number.isFinite(parsed) || parsed <= 0) return DEFAULT_MAX_SESSIONS_PER_USER\n  return Math.floor(parsed)\n}\n\nexport class CustomerSessionService {\n  constructor(private em: EntityManager) {}\n\n  async createSession(\n    user: CustomerUser,\n    resolvedFeatures: string[],\n    ip?: string | null,\n    userAgent?: string | null,\n  ): Promise<{ rawToken: string; jwt: string; session: CustomerUserSession }> {\n    const rawToken = generateSecureToken()\n    const tokenHash = hashToken(rawToken)\n    const days = Number(process.env.CUSTOMER_SESSION_TTL_DAYS || DEFAULT_SESSION_TTL_DAYS)\n    const expiresAt = new Date(Date.now() + days * 24 * 60 * 60 * 1000)\n\n    await this.enforceSessionCap(user.id, user.tenantId, user.organizationId)\n\n    const session = this.em.create(CustomerUserSession, {\n      user,\n      tokenHash,\n      ipAddress: ip || null,\n      userAgent: userAgent || null,\n      expiresAt,\n      lastUsedAt: new Date(),\n      createdAt: new Date(),\n    } as any) as CustomerUserSession\n    await this.em.persist(session).flush()\n\n    const jwt = this.signCustomerJwt(user, resolvedFeatures, session.id)\n\n    return { rawToken, jwt, session }\n  }\n\n  signCustomerJwt(user: CustomerUser, resolvedFeatures: string[], sessionId: string): string {\n    return signAudienceJwt(\n      CUSTOMER_JWT_AUDIENCE,\n      {\n        sub: user.id,\n        sid: sessionId,\n        type: 'customer',\n        tenantId: user.tenantId,\n        orgId: user.organizationId,\n        email: user.email,\n        displayName: user.displayName || '',\n        customerEntityId: user.customerEntityId || null,\n        personEntityId: user.personEntityId || null,\n        resolvedFeatures,\n      },\n      CUSTOMER_JWT_TTL_SECONDS,\n    )\n  }\n\n  async findByToken(rawToken: string, tenantId?: string): Promise<CustomerUserSession | null> {\n    const tokenHash = hashToken(rawToken)\n    const session = await this.em.findOne(CustomerUserSession, {\n      tokenHash,\n      deletedAt: null,\n    }, { populate: ['user'] })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    const user = session.user as CustomerUser\n    if (tenantId && user?.tenantId !== tenantId) return null\n    return session\n  }\n\n  async refreshSession(\n    rawToken: string,\n    resolvedFeatures: string[],\n  ): Promise<{ jwt: string; user: CustomerUser } | null> {\n    const session = await this.findByToken(rawToken)\n    if (!session) return null\n    const user = session.user as CustomerUser\n    if (!user || user.deletedAt || !user.isActive) return null\n\n    await this.em.nativeUpdate(CustomerUserSession, { id: session.id }, { lastUsedAt: new Date() })\n    const jwt = this.signCustomerJwt(user, resolvedFeatures, session.id)\n    return { jwt, user }\n  }\n\n  async findActiveSessionById(sessionId: string): Promise<CustomerUserSession | null> {\n    const session = await this.em.findOne(CustomerUserSession, {\n      id: sessionId,\n      deletedAt: null,\n    })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async findActiveSessionForClaims(input: {\n    sessionId: string\n    userId: string\n    tenantId: string\n    organizationId: string\n  }): Promise<CustomerUserSession | null> {\n    const session = await this.em.findOne(CustomerUserSession, {\n      id: input.sessionId,\n      user: {\n        id: input.userId,\n        tenantId: input.tenantId,\n        organizationId: input.organizationId,\n      },\n      deletedAt: null,\n    })\n    if (!session) return null\n    if (session.expiresAt.getTime() < Date.now()) return null\n    return session\n  }\n\n  async revokeSession(sessionId: string): Promise<void> {\n    await this.em.nativeUpdate(CustomerUserSession, { id: sessionId }, { deletedAt: new Date() })\n  }\n\n  private async enforceSessionCap(\n    userId: string,\n    tenantId: string,\n    organizationId: string,\n  ): Promise<void> {\n    const cap = resolveMaxSessionsPerUser()\n    const existing = await findWithDecryption(\n      this.em,\n      CustomerUserSession,\n      {\n        user: userId as any,\n        deletedAt: null,\n        expiresAt: { $gt: new Date() },\n      },\n      { orderBy: { createdAt: 'asc' } },\n      { tenantId, organizationId },\n    )\n    const toRevoke = existing.length - (cap - 1)\n    if (toRevoke <= 0) return\n    const oldestIds = existing.slice(0, toRevoke).map((s) => s.id)\n    await this.em.nativeUpdate(\n      CustomerUserSession,\n      { id: { $in: oldestIds } },\n      { deletedAt: new Date() },\n    )\n  }\n\n  async revokeAllUserSessions(userId: string, em?: EntityManager): Promise<void> {\n    const now = new Date()\n    const target = em ?? this.em\n    await target.nativeUpdate(\n      CustomerUserSession,\n      { user: userId as any, deletedAt: null },\n      { deletedAt: now },\n    )\n    await target.nativeUpdate(\n      CustomerUser,\n      { id: userId },\n      { sessionsRevokedAt: now },\n    )\n  }\n}\n"],
+  "mappings": "AACA,SAAS,cAAc,2BAA2B;AAClD,SAAS,qBAAqB,iBAAiB;AAC/C,SAAS,uBAAuB;AAChC,SAAS,0BAA0B;AAE5B,MAAM,wBAAwB;AACrC,MAAM,2BAA2B,KAAK,KAAK;AAE3C,MAAM,2BAA2B;AACjC,MAAM,gCAAgC;AAEtC,SAAS,4BAAoC;AAC3C,QAAM,MAAM,QAAQ,IAAI;AACxB,MAAI,CAAC,IAAK,QAAO;AACjB,QAAM,SAAS,OAAO,GAAG;AACzB,MAAI,CAAC,OAAO,SAAS,MAAM,KAAK,UAAU,EAAG,QAAO;AACpD,SAAO,KAAK,MAAM,MAAM;AAC1B;AAEO,MAAM,uBAAuB;AAAA,EAClC,YAAoB,IAAmB;AAAnB;AAAA,EAAoB;AAAA,EAExC,MAAM,cACJ,MACA,kBACA,IACA,WAC0E;AAC1E,UAAM,WAAW,oBAAoB;AACrC,UAAM,YAAY,UAAU,QAAQ;AACpC,UAAM,OAAO,OAAO,QAAQ,IAAI,6BAA6B,wBAAwB;AACrF,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,OAAO,KAAK,KAAK,KAAK,GAAI;AAElE,UAAM,KAAK,kBAAkB,KAAK,IAAI,KAAK,UAAU,KAAK,cAAc;AAExE,UAAM,UAAU,KAAK,GAAG,OAAO,qBAAqB;AAAA,MAClD;AAAA,MACA;AAAA,MACA,WAAW,MAAM;AAAA,MACjB,WAAW,aAAa;AAAA,MACxB;AAAA,MACA,YAAY,oBAAI,KAAK;AAAA,MACrB,WAAW,oBAAI,KAAK;AAAA,IACtB,CAAQ;AACR,UAAM,KAAK,GAAG,QAAQ,OAAO,EAAE,MAAM;AAErC,UAAM,MAAM,KAAK,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE;AAEnE,WAAO,EAAE,UAAU,KAAK,QAAQ;AAAA,EAClC;AAAA,EAEA,gBAAgB,MAAoB,kBAA4B,WAA2B;AACzF,WAAO;AAAA,MACL;AAAA,MACA;AAAA,QACE,KAAK,KAAK;AAAA,QACV,KAAK;AAAA,QACL,MAAM;AAAA,QACN,UAAU,KAAK;AAAA,QACf,OAAO,KAAK;AAAA,QACZ,OAAO,KAAK;AAAA,QACZ,aAAa,KAAK,eAAe;AAAA,QACjC,kBAAkB,KAAK,oBAAoB;AAAA,QAC3C,gBAAgB,KAAK,kBAAkB;AAAA,QACvC;AAAA,MACF;AAAA,MACA;AAAA,IACF;AAAA,EACF;AAAA,EAEA,MAAM,YAAY,UAAkB,UAAwD;AAC1F,UAAM,YAAY,UAAU,QAAQ;AACpC,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MACzD;AAAA,MACA,WAAW;AAAA,IACb,GAAG,EAAE,UAAU,CAAC,MAAM,EAAE,CAAC;AACzB,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,UAAM,OAAO,QAAQ;AACrB,QAAI,YAAY,MAAM,aAAa,SAAU,QAAO;AACpD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,eACJ,UACA,kBACqD;AACrD,UAAM,UAAU,MAAM,KAAK,YAAY,QAAQ;AAC/C,QAAI,CAAC,QAAS,QAAO;AACrB,UAAM,OAAO,QAAQ;AACrB,QAAI,CAAC,QAAQ,KAAK,aAAa,CAAC,KAAK,SAAU,QAAO;AAEtD,UAAM,KAAK,GAAG,aAAa,qBAAqB,EAAE,IAAI,QAAQ,GAAG,GAAG,EAAE,YAAY,oBAAI,KAAK,EAAE,CAAC;AAC9F,UAAM,MAAM,KAAK,gBAAgB,MAAM,kBAAkB,QAAQ,EAAE;AACnE,WAAO,EAAE,KAAK,KAAK;AAAA,EACrB;AAAA,EAEA,MAAM,sBAAsB,WAAwD;AAClF,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MACzD,IAAI;AAAA,MACJ,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,2BAA2B,OAKO;AACtC,UAAM,UAAU,MAAM,KAAK,GAAG,QAAQ,qBAAqB;AAAA,MACzD,IAAI,MAAM;AAAA,MACV,MAAM;AAAA,QACJ,IAAI,MAAM;AAAA,QACV,UAAU,MAAM;AAAA,QAChB,gBAAgB,MAAM;AAAA,MACxB;AAAA,MACA,WAAW;AAAA,IACb,CAAC;AACD,QAAI,CAAC,QAAS,QAAO;AACrB,QAAI,QAAQ,UAAU,QAAQ,IAAI,KAAK,IAAI,EAAG,QAAO;AACrD,WAAO;AAAA,EACT;AAAA,EAEA,MAAM,cAAc,WAAkC;AACpD,UAAM,KAAK,GAAG,aAAa,qBAAqB,EAAE,IAAI,UAAU,GAAG,EAAE,WAAW,oBAAI,KAAK,EAAE,CAAC;AAAA,EAC9F;AAAA,EAEA,MAAc,kBACZ,QACA,UACA,gBACe;AACf,UAAM,MAAM,0BAA0B;AACtC,UAAM,WAAW,MAAM;AAAA,MACrB,KAAK;AAAA,MACL;AAAA,MACA;AAAA,QACE,MAAM;AAAA,QACN,WAAW;AAAA,QACX,WAAW,EAAE,KAAK,oBAAI,KAAK,EAAE;AAAA,MAC/B;AAAA,MACA,EAAE,SAAS,EAAE,WAAW,MAAM,EAAE;AAAA,MAChC,EAAE,UAAU,eAAe;AAAA,IAC7B;AACA,UAAM,WAAW,SAAS,UAAU,MAAM;AAC1C,QAAI,YAAY,EAAG;AACnB,UAAM,YAAY,SAAS,MAAM,GAAG,QAAQ,EAAE,IAAI,CAAC,MAAM,EAAE,EAAE;AAC7D,UAAM,KAAK,GAAG;AAAA,MACZ;AAAA,MACA,EAAE,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,MACzB,EAAE,WAAW,oBAAI,KAAK,EAAE;AAAA,IAC1B;AAAA,EACF;AAAA,EAEA,MAAM,sBAAsB,QAAgB,IAAmC;AAC7E,UAAM,MAAM,oBAAI,KAAK;AACrB,UAAM,SAAS,MAAM,KAAK;AAC1B,UAAM,OAAO;AAAA,MACX;AAAA,MACA,EAAE,MAAM,QAAe,WAAW,KAAK;AAAA,MACvC,EAAE,WAAW,IAAI;AAAA,IACnB;AACA,UAAM,OAAO;AAAA,MACX;AAAA,MACA,EAAE,IAAI,OAAO;AAAA,MACb,EAAE,mBAAmB,IAAI;AAAA,IAC3B;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/customers/api/interactions/route.js

@@ -51,6 +51,7 @@ const listSchema = z.object({
   search: z.string().trim().min(1).optional(),
   from: z.coerce.date().optional(),
   to: z.coerce.date().optional(),
+  recurrenceMasters: z.enum(["true", "false"]).optional(),
   pinned: z.enum(["true", "false"]).optional(),
   sortField: interactionSortFieldSchema.optional(),
   sortDir: z.enum(["asc", "desc"]).optional()
@@ -259,11 +260,21 @@ function applyInteractionListFilters(baseQuery, params) {
     const searchTerm = `%${escapeLikePattern(query.search)}%`;
     q = q.where(sql`coalesce(title, '') ilike ${searchTerm} or coalesce(body, '') ilike ${searchTerm}`);
   }
-  if (query.from) {
-    q = q.where(sql`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`);
-  }
-  if (query.to) {
-    q = q.where(sql`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`);
+  if (query.recurrenceMasters === "true") {
+    q = q.where("recurrence_rule", "is not", null);
+    if (query.from) {
+      q = q.where(sql`recurrence_end is null or recurrence_end >= ${query.from}`);
+    }
+    if (query.to) {
+      q = q.where(sql`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`);
+    }
+  } else {
+    if (query.from) {
+      q = q.where(sql`coalesce(occurred_at, scheduled_at, created_at) >= ${query.from}`);
+    }
+    if (query.to) {
+      q = q.where(sql`coalesce(occurred_at, scheduled_at, created_at) <= ${query.to}`);
+    }
   }
   return q;
 }