@open-mercato/core 0.6.8-develop.6983.1.e4f794099e → 0.6.8-develop.6985.1.fb93574faa

package/src/modules/devices/i18n/de.json

@@ -0,0 +1,45 @@
+{
+  "devices.errors.already_registered": "Dieses Gerät ist bereits registriert",
+  "devices.errors.delete_failed": "Gerät konnte nicht gelöscht werden",
+  "devices.errors.forbidden": "Zugriff verweigert",
+  "devices.errors.invalid_id": "Ungültige Geräte-ID",
+  "devices.errors.invalid_payload": "Ungültige Gerätedaten",
+  "devices.errors.load_failed": "Gerät konnte nicht geladen werden",
+  "devices.errors.not_found": "Gerät nicht gefunden",
+  "devices.errors.register_failed": "Gerät konnte nicht registriert werden",
+  "devices.errors.unauthorized": "Nicht autorisiert",
+  "devices.errors.update_failed": "Gerät konnte nicht aktualisiert werden",
+  "devices.errors.user_not_found": "Zielbenutzer in diesem Mandanten nicht gefunden",
+  "devices.form.appVersion": "App-Version",
+  "devices.form.createTitle": "Gerät registrieren",
+  "devices.form.details": "Gerät",
+  "devices.form.deviceId": "Geräte-ID",
+  "devices.form.editTitle": "Gerät bearbeiten",
+  "devices.form.error.loadFailed": "Gerät konnte nicht geladen werden",
+  "devices.form.osVersion": "OS-Version",
+  "devices.form.platform": "Plattform",
+  "devices.form.pushProvider": "Push-Anbieter",
+  "devices.form.pushToken": "Push-Token",
+  "devices.form.pushTokenHint": "Optional. Sicher gespeichert und nie wieder angezeigt.",
+  "devices.form.success.created": "Gerät registriert",
+  "devices.form.success.updated": "Gerät aktualisiert",
+  "devices.form.userId": "Benutzer-ID",
+  "devices.form.userIdHint": "UUID des Benutzers, dem dieses Gerät gehört.",
+  "devices.list.actions.deactivate": "Deaktivieren",
+  "devices.list.actions.edit": "Bearbeiten",
+  "devices.list.actions.register": "Gerät registrieren",
+  "devices.list.columns.appVersion": "App-Version",
+  "devices.list.columns.device": "Geräte-ID",
+  "devices.list.columns.lastSeen": "Zuletzt gesehen",
+  "devices.list.columns.osVersion": "OS-Version",
+  "devices.list.columns.platform": "Plattform",
+  "devices.list.columns.pushProvider": "Push-Anbieter",
+  "devices.list.columns.user": "Benutzer",
+  "devices.list.confirmDeactivate": "Dieses Gerät deaktivieren?",
+  "devices.list.error.deactivateFailed": "Gerät konnte nicht deaktiviert werden",
+  "devices.list.error.loadFailed": "Geräte konnten nicht geladen werden",
+  "devices.list.noValue": "—",
+  "devices.list.success.deactivated": "Gerät deaktiviert",
+  "devices.list.title": "Geräte",
+  "devices.nav.devices": "Geräte"
+}

package/src/modules/devices/i18n/en.json

@@ -0,0 +1,45 @@
+{
+  "devices.errors.already_registered": "This device is already registered",
+  "devices.errors.delete_failed": "Failed to delete device",
+  "devices.errors.forbidden": "Access denied",
+  "devices.errors.invalid_id": "Invalid device id",
+  "devices.errors.invalid_payload": "Invalid device payload",
+  "devices.errors.load_failed": "Failed to load device",
+  "devices.errors.not_found": "Device not found",
+  "devices.errors.register_failed": "Failed to register device",
+  "devices.errors.unauthorized": "Unauthorized",
+  "devices.errors.update_failed": "Failed to update device",
+  "devices.errors.user_not_found": "Target user not found in this tenant",
+  "devices.form.appVersion": "App version",
+  "devices.form.createTitle": "Register device",
+  "devices.form.details": "Device",
+  "devices.form.deviceId": "Device ID",
+  "devices.form.editTitle": "Edit device",
+  "devices.form.error.loadFailed": "Failed to load device",
+  "devices.form.osVersion": "OS version",
+  "devices.form.platform": "Platform",
+  "devices.form.pushProvider": "Push provider",
+  "devices.form.pushToken": "Push token",
+  "devices.form.pushTokenHint": "Optional. Stored securely and never shown again.",
+  "devices.form.success.created": "Device registered",
+  "devices.form.success.updated": "Device updated",
+  "devices.form.userId": "User ID",
+  "devices.form.userIdHint": "UUID of the user who owns this device.",
+  "devices.list.actions.deactivate": "Deactivate",
+  "devices.list.actions.edit": "Edit",
+  "devices.list.actions.register": "Register device",
+  "devices.list.columns.appVersion": "App version",
+  "devices.list.columns.device": "Device ID",
+  "devices.list.columns.lastSeen": "Last seen",
+  "devices.list.columns.osVersion": "OS version",
+  "devices.list.columns.platform": "Platform",
+  "devices.list.columns.pushProvider": "Push provider",
+  "devices.list.columns.user": "User",
+  "devices.list.confirmDeactivate": "Deactivate this device?",
+  "devices.list.error.deactivateFailed": "Failed to deactivate device",
+  "devices.list.error.loadFailed": "Failed to load devices",
+  "devices.list.noValue": "—",
+  "devices.list.success.deactivated": "Device deactivated",
+  "devices.list.title": "Devices",
+  "devices.nav.devices": "Devices"
+}

package/src/modules/devices/i18n/es.json

@@ -0,0 +1,45 @@
+{
+  "devices.errors.already_registered": "Este dispositivo ya está registrado",
+  "devices.errors.delete_failed": "No se pudo eliminar el dispositivo",
+  "devices.errors.forbidden": "Acceso denegado",
+  "devices.errors.invalid_id": "ID de dispositivo no válido",
+  "devices.errors.invalid_payload": "Datos de dispositivo no válidos",
+  "devices.errors.load_failed": "No se pudo cargar el dispositivo",
+  "devices.errors.not_found": "Dispositivo no encontrado",
+  "devices.errors.register_failed": "No se pudo registrar el dispositivo",
+  "devices.errors.unauthorized": "No autorizado",
+  "devices.errors.update_failed": "No se pudo actualizar el dispositivo",
+  "devices.errors.user_not_found": "Usuario de destino no encontrado en este inquilino",
+  "devices.form.appVersion": "Versión de la app",
+  "devices.form.createTitle": "Registrar dispositivo",
+  "devices.form.details": "Dispositivo",
+  "devices.form.deviceId": "ID de dispositivo",
+  "devices.form.editTitle": "Editar dispositivo",
+  "devices.form.error.loadFailed": "No se pudo cargar el dispositivo",
+  "devices.form.osVersion": "Versión del SO",
+  "devices.form.platform": "Plataforma",
+  "devices.form.pushProvider": "Proveedor de push",
+  "devices.form.pushToken": "Token de push",
+  "devices.form.pushTokenHint": "Opcional. Se almacena de forma segura y no se vuelve a mostrar.",
+  "devices.form.success.created": "Dispositivo registrado",
+  "devices.form.success.updated": "Dispositivo actualizado",
+  "devices.form.userId": "ID de usuario",
+  "devices.form.userIdHint": "UUID del usuario propietario de este dispositivo.",
+  "devices.list.actions.deactivate": "Desactivar",
+  "devices.list.actions.edit": "Editar",
+  "devices.list.actions.register": "Registrar dispositivo",
+  "devices.list.columns.appVersion": "Versión de la app",
+  "devices.list.columns.device": "ID de dispositivo",
+  "devices.list.columns.lastSeen": "Última conexión",
+  "devices.list.columns.osVersion": "Versión del SO",
+  "devices.list.columns.platform": "Plataforma",
+  "devices.list.columns.pushProvider": "Proveedor de push",
+  "devices.list.columns.user": "Usuario",
+  "devices.list.confirmDeactivate": "¿Desactivar este dispositivo?",
+  "devices.list.error.deactivateFailed": "No se pudo desactivar el dispositivo",
+  "devices.list.error.loadFailed": "No se pudieron cargar los dispositivos",
+  "devices.list.noValue": "—",
+  "devices.list.success.deactivated": "Dispositivo desactivado",
+  "devices.list.title": "Dispositivos",
+  "devices.nav.devices": "Dispositivos"
+}

package/src/modules/devices/i18n/ko.json

@@ -0,0 +1,45 @@
+{
+  "devices.errors.already_registered": "이미 등록된 기기입니다",
+  "devices.errors.delete_failed": "기기를 삭제하지 못했습니다",
+  "devices.errors.forbidden": "접근이 거부되었습니다",
+  "devices.errors.invalid_id": "잘못된 기기 ID입니다",
+  "devices.errors.invalid_payload": "잘못된 기기 데이터입니다",
+  "devices.errors.load_failed": "기기를 불러오지 못했습니다",
+  "devices.errors.not_found": "기기를 찾을 수 없습니다",
+  "devices.errors.register_failed": "기기를 등록하지 못했습니다",
+  "devices.errors.unauthorized": "권한이 없습니다",
+  "devices.errors.update_failed": "기기를 수정하지 못했습니다",
+  "devices.errors.user_not_found": "이 테넌트에서 대상 사용자를 찾을 수 없습니다",
+  "devices.form.appVersion": "앱 버전",
+  "devices.form.createTitle": "기기 등록",
+  "devices.form.details": "기기",
+  "devices.form.deviceId": "기기 ID",
+  "devices.form.editTitle": "기기 수정",
+  "devices.form.error.loadFailed": "기기를 불러오지 못했습니다",
+  "devices.form.osVersion": "OS 버전",
+  "devices.form.platform": "플랫폼",
+  "devices.form.pushProvider": "푸시 제공자",
+  "devices.form.pushToken": "푸시 토큰",
+  "devices.form.pushTokenHint": "선택 사항입니다. 안전하게 저장되며 다시 표시되지 않습니다.",
+  "devices.form.success.created": "기기가 등록되었습니다",
+  "devices.form.success.updated": "기기가 수정되었습니다",
+  "devices.form.userId": "사용자 ID",
+  "devices.form.userIdHint": "이 기기를 소유한 사용자의 UUID입니다.",
+  "devices.list.actions.deactivate": "비활성화",
+  "devices.list.actions.edit": "수정",
+  "devices.list.actions.register": "기기 등록",
+  "devices.list.columns.appVersion": "앱 버전",
+  "devices.list.columns.device": "기기 ID",
+  "devices.list.columns.lastSeen": "마지막 접속",
+  "devices.list.columns.osVersion": "OS 버전",
+  "devices.list.columns.platform": "플랫폼",
+  "devices.list.columns.pushProvider": "푸시 제공자",
+  "devices.list.columns.user": "사용자",
+  "devices.list.confirmDeactivate": "이 기기를 비활성화할까요?",
+  "devices.list.error.deactivateFailed": "기기를 비활성화하지 못했습니다",
+  "devices.list.error.loadFailed": "기기 목록을 불러오지 못했습니다",
+  "devices.list.noValue": "—",
+  "devices.list.success.deactivated": "기기가 비활성화되었습니다",
+  "devices.list.title": "기기",
+  "devices.nav.devices": "기기"
+}

package/src/modules/devices/i18n/pl.json

@@ -0,0 +1,45 @@
+{
+  "devices.errors.already_registered": "To urządzenie jest już zarejestrowane",
+  "devices.errors.delete_failed": "Nie udało się usunąć urządzenia",
+  "devices.errors.forbidden": "Odmowa dostępu",
+  "devices.errors.invalid_id": "Nieprawidłowy identyfikator urządzenia",
+  "devices.errors.invalid_payload": "Nieprawidłowe dane urządzenia",
+  "devices.errors.load_failed": "Nie udało się załadować urządzenia",
+  "devices.errors.not_found": "Nie znaleziono urządzenia",
+  "devices.errors.register_failed": "Nie udało się zarejestrować urządzenia",
+  "devices.errors.unauthorized": "Brak autoryzacji",
+  "devices.errors.update_failed": "Nie udało się zaktualizować urządzenia",
+  "devices.errors.user_not_found": "Nie znaleziono użytkownika docelowego w tym najemcy",
+  "devices.form.appVersion": "Wersja aplikacji",
+  "devices.form.createTitle": "Zarejestruj urządzenie",
+  "devices.form.details": "Urządzenie",
+  "devices.form.deviceId": "ID urządzenia",
+  "devices.form.editTitle": "Edytuj urządzenie",
+  "devices.form.error.loadFailed": "Nie udało się załadować urządzenia",
+  "devices.form.osVersion": "Wersja systemu",
+  "devices.form.platform": "Platforma",
+  "devices.form.pushProvider": "Dostawca push",
+  "devices.form.pushToken": "Token push",
+  "devices.form.pushTokenHint": "Opcjonalne. Token jest przechowywany bezpiecznie i nigdy więcej niewyświetlany.",
+  "devices.form.success.created": "Urządzenie zarejestrowane",
+  "devices.form.success.updated": "Urządzenie zaktualizowane",
+  "devices.form.userId": "ID użytkownika",
+  "devices.form.userIdHint": "UUID użytkownika, do którego należy to urządzenie.",
+  "devices.list.actions.deactivate": "Dezaktywuj",
+  "devices.list.actions.edit": "Edytuj",
+  "devices.list.actions.register": "Zarejestruj urządzenie",
+  "devices.list.columns.appVersion": "Wersja aplikacji",
+  "devices.list.columns.device": "Identyfikator urządzenia",
+  "devices.list.columns.lastSeen": "Ostatnio widziane",
+  "devices.list.columns.osVersion": "Wersja systemu",
+  "devices.list.columns.platform": "Platforma",
+  "devices.list.columns.pushProvider": "Dostawca push",
+  "devices.list.columns.user": "Użytkownik",
+  "devices.list.confirmDeactivate": "Dezaktywować to urządzenie?",
+  "devices.list.error.deactivateFailed": "Nie udało się dezaktywować urządzenia",
+  "devices.list.error.loadFailed": "Nie udało się załadować urządzeń",
+  "devices.list.noValue": "—",
+  "devices.list.success.deactivated": "Urządzenie dezaktywowane",
+  "devices.list.title": "Urządzenia",
+  "devices.nav.devices": "Urządzenia"
+}

package/src/modules/devices/index.ts

@@ -0,0 +1,15 @@
+import type { ModuleInfo } from '@open-mercato/shared/modules/registry'
+import './commands'
+
+export const metadata: ModuleInfo = {
+  name: 'devices',
+  title: 'Devices',
+  version: '0.1.0',
+  description: 'Per-tenant user device registry (platform, app/OS metadata, push token storage).',
+  author: 'Open Mercato Team',
+  license: 'MIT',
+  requires: ['auth'],
+  ejectable: true,
+}
+
+export { features } from './acl'

package/src/modules/devices/lib/operationMetadata.ts

@@ -0,0 +1,35 @@
+import { serializeOperationMetadata } from '@open-mercato/shared/lib/commands/operationMetadata'
+
+type OperationLogEntry = {
+  id?: string | null
+  undoToken?: string | null
+  commandId?: string | null
+  actionLabel?: string | null
+  resourceKind?: string | null
+  resourceId?: string | null
+  createdAt?: Date | null
+}
+
+/**
+ * Attaches the `x-om-operation` undo header to a response when the command produced an
+ * undoable log entry. No-op otherwise.
+ */
+export function attachOperationMetadataHeader(
+  response: Response,
+  logEntry: OperationLogEntry | null | undefined,
+  fallback: { resourceKind: string; resourceId: string },
+): void {
+  if (!logEntry?.undoToken || !logEntry.id || !logEntry.commandId) return
+  response.headers.set(
+    'x-om-operation',
+    serializeOperationMetadata({
+      id: logEntry.id,
+      undoToken: logEntry.undoToken,
+      commandId: logEntry.commandId,
+      actionLabel: logEntry.actionLabel ?? null,
+      resourceKind: logEntry.resourceKind ?? fallback.resourceKind,
+      resourceId: logEntry.resourceId ?? fallback.resourceId,
+      executedAt: logEntry.createdAt instanceof Date ? logEntry.createdAt.toISOString() : new Date().toISOString(),
+    }),
+  )
+}

package/src/modules/devices/migrations/.snapshot-open-mercato.json

@@ -0,0 +1,200 @@
+{
+  "namespaces": [
+    "public"
+  ],
+  "name": "public",
+  "tables": [
+    {
+      "columns": {
+        "id": {
+          "name": "id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "default": "gen_random_uuid()",
+          "mappedType": "uuid"
+        },
+        "tenant_id": {
+          "name": "tenant_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "mappedType": "uuid"
+        },
+        "organization_id": {
+          "name": "organization_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "uuid"
+        },
+        "user_id": {
+          "name": "user_id",
+          "type": "uuid",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "mappedType": "uuid"
+        },
+        "device_id": {
+          "name": "device_id",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "mappedType": "text"
+        },
+        "platform": {
+          "name": "platform",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "mappedType": "text"
+        },
+        "client_app_version": {
+          "name": "client_app_version",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
+        "os_version": {
+          "name": "os_version",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
+        "locale": {
+          "name": "locale",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
+        "push_token": {
+          "name": "push_token",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
+        "push_provider": {
+          "name": "push_provider",
+          "type": "text",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "mappedType": "text"
+        },
+        "push_token_updated_at": {
+          "name": "push_token_updated_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "length": 6,
+          "mappedType": "datetime"
+        },
+        "last_seen_at": {
+          "name": "last_seen_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "length": 6,
+          "mappedType": "datetime"
+        },
+        "created_at": {
+          "name": "created_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "length": 6,
+          "mappedType": "datetime"
+        },
+        "updated_at": {
+          "name": "updated_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": false,
+          "length": 6,
+          "mappedType": "datetime"
+        },
+        "deleted_at": {
+          "name": "deleted_at",
+          "type": "timestamptz",
+          "unsigned": false,
+          "autoincrement": false,
+          "primary": false,
+          "nullable": true,
+          "length": 6,
+          "mappedType": "datetime"
+        }
+      },
+      "name": "user_devices",
+      "schema": "public",
+      "indexes": [
+        {
+          "keyName": "user_devices_tenant_user_idx",
+          "columnNames": [
+            "tenant_id",
+            "user_id"
+          ],
+          "composite": true,
+          "constraint": false,
+          "primary": false,
+          "unique": false
+        },
+        {
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
+          "keyName": "user_devices_tenant_org_user_device_active_unique",
+          "primary": false,
+          "unique": false,
+          "expression": "create unique index \"user_devices_tenant_org_user_device_active_unique\" on \"user_devices\" (\"tenant_id\", \"organization_id\", \"user_id\", \"device_id\") nulls not distinct where deleted_at is null"
+        },
+        {
+          "keyName": "user_devices_pkey",
+          "columnNames": [
+            "id"
+          ],
+          "composite": false,
+          "constraint": true,
+          "primary": true,
+          "unique": true
+        }
+      ],
+      "checks": [],
+      "foreignKeys": {},
+      "nativeEnums": {}
+    }
+  ],
+  "nativeEnums": {}
+}

package/src/modules/devices/migrations/Migration20260602120000.ts

@@ -0,0 +1,15 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260602120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`create table "user_devices" ("id" uuid not null default gen_random_uuid(), "tenant_id" uuid not null, "organization_id" uuid null, "user_id" uuid not null, "device_id" text not null, "platform" text not null, "client_app_version" text null, "os_version" text null, "push_token" text null, "push_provider" text null, "push_token_updated_at" timestamptz null, "last_seen_at" timestamptz not null, "created_at" timestamptz not null, "updated_at" timestamptz not null, "deleted_at" timestamptz null, constraint "user_devices_pkey" primary key ("id"));`);
+    this.addSql(`create index "user_devices_tenant_user_idx" on "user_devices" ("tenant_id", "user_id");`);
+    this.addSql(`create unique index "user_devices_tenant_user_device_active_unique" on "user_devices" ("tenant_id", "user_id", "device_id") where deleted_at is null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop table if exists "user_devices" cascade;`);
+  }
+
+}

package/src/modules/devices/migrations/Migration20260630120000.ts

@@ -0,0 +1,20 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// Make device identity organization-aware: replace the (tenant, user, device) active-unique index
+// with (tenant, org, user, device). organization_id is nullable, so coalesce null to the nil UUID —
+// otherwise Postgres treats NULLs as distinct and would allow duplicate null-org rows for the same
+// (tenant, user, device). Split out as its own migration so existing databases that already ran the
+// table-creation migration pick up the new index instead of silently keeping the old one.
+export class Migration20260630120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`drop index if exists "user_devices_tenant_user_device_active_unique";`);
+    this.addSql(`create unique index "user_devices_tenant_org_user_device_active_unique" on "user_devices" ("tenant_id", coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid), "user_id", "device_id") where deleted_at is null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "user_devices_tenant_org_user_device_active_unique";`);
+    this.addSql(`create unique index "user_devices_tenant_user_device_active_unique" on "user_devices" ("tenant_id", "user_id", "device_id") where deleted_at is null;`);
+  }
+
+}

package/src/modules/devices/migrations/Migration20260701120000.ts

@@ -0,0 +1,13 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260701120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "user_devices" add column "locale" text null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`alter table "user_devices" drop column "locale";`);
+  }
+
+}

package/src/modules/devices/migrations/Migration20260721120000.ts

@@ -0,0 +1,18 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// Simplify the device active-unique index: replace the nil-UUID coalesce sentinel with a native
+// NULLS NOT DISTINCT clause (Postgres 15+). Both express the same intent — dedupe null-org rows for
+// the same (tenant, user, device) — but NULLS NOT DISTINCT drops the magic sentinel entirely.
+export class Migration20260721120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`drop index if exists "user_devices_tenant_org_user_device_active_unique";`);
+    this.addSql(`create unique index "user_devices_tenant_org_user_device_active_unique" on "user_devices" ("tenant_id", "organization_id", "user_id", "device_id") nulls not distinct where deleted_at is null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "user_devices_tenant_org_user_device_active_unique";`);
+    this.addSql(`create unique index "user_devices_tenant_org_user_device_active_unique" on "user_devices" ("tenant_id", coalesce("organization_id", '00000000-0000-0000-0000-000000000000'::uuid), "user_id", "device_id") where deleted_at is null;`);
+  }
+
+}

package/src/modules/devices/setup.ts

@@ -0,0 +1,11 @@
+import type { ModuleSetupConfig } from '@open-mercato/shared/modules/setup'
+
+export const setup: ModuleSetupConfig = {
+  defaultRoleFeatures: {
+    superadmin: ['devices.*'],
+    admin: ['devices.*'],
+    employee: ['devices.view', 'devices.manage'],
+  },
+}
+
+export default setup

package/src/modules/entities/cli.ts

@@ -1,4 +1,5 @@
 import { getCliModules, getDefaultEncryptionMaps, type Module, type ModuleCli } from '@open-mercato/shared/modules/registry'
+import type { ModuleEncryptionMap } from '@open-mercato/shared/modules/encryption'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { CacheStrategy } from '@open-mercato/cache/types'
 import { CustomEntity, CustomFieldDef, EncryptionMap } from './data/entities'
@@ -280,8 +281,17 @@ function getSystemScopedEntityIds(): Set<string> {
   )
 }
 
-async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
-  for (const spec of getDefaultEncryptionMaps(resolveEncryptionMapModules())) {
+// Idempotently upsert a specific set of encryption-map specs for one (tenant, org) scope. Exported so
+// upgrade actions can backfill a newly-added encrypted entity for pre-existing tenants (whose maps were
+// seeded once at tenant creation and never re-run) without depending on the full CLI module registry.
+export async function upsertEncryptionMapSpecs(
+  em: any,
+  tenantId: string,
+  organizationId: string | null,
+  specs: ModuleEncryptionMap[],
+  logger: (msg: string) => void = () => {},
+) {
+  for (const spec of specs) {
     if (spec.keyScope === 'system') {
       logger(`Skipping ${spec.entityId}: system-scoped map, resolved from module code rather than a tenant row.`)
       continue
@@ -312,6 +322,10 @@ async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: s
   }
 }
 
+async function upsertEncryptionMaps(em: any, tenantId: string, organizationId: string | null, logger: (msg: string) => void) {
+  await upsertEncryptionMapSpecs(em, tenantId, organizationId, getDefaultEncryptionMaps(resolveEncryptionMapModules()), logger)
+}
+
 const seedEncryptionMaps: ModuleCli = {
   command: 'seed-encryption',
   async run(rest) {

package/src/modules/entities/migrations/Migration20260722120000.ts

@@ -0,0 +1,38 @@
+import { Migration } from '@mikro-orm/migrations';
+
+// Backfill the `devices:user_device` encryption map for every pre-existing (tenant, org) scope that
+// already has active encryption maps. The devices push-token feature adds a new encrypted entity, but
+// encryption maps are seeded only at tenant creation (`entities seed-encryption`) — so without this an
+// existing tenant that upgrades has no map for the device entity, `encryptEntityPayload` no-ops, and
+// `push_token` is written as PLAINTEXT. Restricting the insert to scopes that ALREADY have maps mirrors
+// what seed-encryption does and correctly skips tenants with encryption disabled (which have no maps at
+// all). Idempotent via the NOT EXISTS guard, so it matches the runtime `upsertEncryptionMapSpecs` helper
+// and the `devices.seed-push-token-encryption-map` upgrade action; re-runs are a no-op.
+export class Migration20260722120000 extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`
+      insert into "encryption_maps" ("id", "entity_id", "tenant_id", "organization_id", "fields_json", "is_active", "created_at", "updated_at")
+      select gen_random_uuid(), 'devices:user_device', src."tenant_id", src."organization_id", '[{"field":"push_token"}]'::jsonb, true, now(), now()
+      from (
+        select distinct "tenant_id", "organization_id"
+        from "encryption_maps"
+        where "is_active" = true and "deleted_at" is null
+      ) src
+      where not exists (
+        select 1 from "encryption_maps" existing
+        where existing."entity_id" = 'devices:user_device'
+          and existing."tenant_id" is not distinct from src."tenant_id"
+          and existing."organization_id" is not distinct from src."organization_id"
+          and existing."deleted_at" is null
+      );
+    `);
+  }
+
+  override async down(): Promise<void> {
+    // Reverts the feature's encryption map. `devices:user_device` maps have no source other than this
+    // feature, so deleting them all returns the schema to its pre-feature state.
+    this.addSql(`delete from "encryption_maps" where "entity_id" = 'devices:user_device';`);
+  }
+
+}

package/src/modules/inbox_ops/i18n/de.json

@@ -192,5 +192,6 @@
   "inbox_ops.translate.show_original": "Original anzeigen",
   "inbox_ops.translate.translate": "\u00dcbersetzen",
   "inbox_ops.untitled_proposal": "Unbenannter Vorschlag",
-  "inbox_ops.view_in_messages": "In Nachrichten anzeigen"
+  "inbox_ops.view_in_messages": "In Nachrichten anzeigen",
+  "notifications.categories.inbox_ops": "Posteingang"
 }