@open-mercato/core 0.6.8-develop.6998.1.d2bc46c56c → 0.6.8-develop.7001.1.03608ab252

package/src/modules/attachments/lib/scoped-upload-service.ts

@@ -0,0 +1,257 @@
+import { randomUUID } from 'node:crypto'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { DataEngine } from '@open-mercato/shared/lib/data/engine'
+import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+import { Attachment, AttachmentPartition } from '../data/entities'
+import { attachmentCrudEvents, attachmentCrudIndexer } from './crud'
+import type { StorageDriverFactory } from './drivers'
+import { buildAttachmentFileUrl } from './imageUrls'
+import { ensureDefaultPartitions, resolveDefaultPartitionCode } from './partitions'
+import { extractAttachmentContent } from './textExtraction'
+import { requestOcrProcessing } from './ocrQueue'
+import { OcrService, shouldUseLlmOcr } from './ocrService'
+import { assertAttachmentScopeInvariant } from './access'
+import {
+  mergeAttachmentMetadata,
+  upsertAssignment,
+  type AttachmentAssignment,
+} from './metadata'
+import {
+  detectAttachmentMimeType,
+  hasDangerousExecutableExtension,
+  isActiveContentAttachment,
+  sanitizeUploadedFileName,
+} from './security'
+import { resolveAttachmentMaxBytes } from './upload-limits'
+import type { AttachmentQuotaService } from './quota-service'
+
+const logger = createLogger('attachments')
+
+export type ScopedAttachmentUploadErrorCode =
+  | 'dangerous_executable'
+  | 'max_upload_size'
+  | 'active_content'
+  | 'partition_unavailable'
+  | 'quota_exceeded'
+  | 'quota_target_exists'
+  | 'quota_unavailable'
+  | 'quota_recovery_unsupported'
+  | 'storage_failed'
+  | 'persistence_failed'
+
+export class ScopedAttachmentUploadError extends Error {
+  constructor(
+    public readonly code: ScopedAttachmentUploadErrorCode,
+    public readonly status: number,
+  ) {
+    super(code)
+    this.name = 'ScopedAttachmentUploadError'
+  }
+}
+
+export type ScopedAttachmentUploadInput = {
+  tenantId: string
+  organizationId: string
+  entityId: string
+  recordId: string
+  fileName: string
+  declaredMimeType?: string | null
+  buffer: Buffer
+  tags?: string[]
+  assignments?: AttachmentAssignment[]
+  partitionCode?: string | null
+  maxBytes?: number
+}
+
+type QuotaRecoveryScheduler = (
+  payload: { reservationId: string; tenantId: string; organizationId: string },
+  delayMs: number,
+) => Promise<void>
+
+export class ScopedAttachmentUploadService {
+  constructor(private readonly deps: {
+    em: EntityManager
+    dataEngine?: DataEngine | null
+    storageDriverFactory: StorageDriverFactory
+    attachmentQuotaService: AttachmentQuotaService
+    attachmentQuotaRecoveryScheduler: QuotaRecoveryScheduler
+  }) {}
+
+  async upload(input: ScopedAttachmentUploadInput): Promise<Attachment> {
+    const safeName = sanitizeUploadedFileName(input.fileName)
+    if (hasDangerousExecutableExtension(safeName)) {
+      throw new ScopedAttachmentUploadError('dangerous_executable', 400)
+    }
+    if (input.buffer.length > (input.maxBytes ?? resolveAttachmentMaxBytes())) {
+      throw new ScopedAttachmentUploadError('max_upload_size', 413)
+    }
+    const mimeType = detectAttachmentMimeType(input.buffer, safeName, input.declaredMimeType ?? '')
+    if (isActiveContentAttachment(input.buffer, safeName, mimeType)) {
+      throw new ScopedAttachmentUploadError('active_content', 400)
+    }
+
+    const { em, storageDriverFactory, attachmentQuotaService, attachmentQuotaRecoveryScheduler } = this.deps
+    await ensureDefaultPartitions(em)
+    const partitionCode = input.partitionCode ?? resolveDefaultPartitionCode(input.entityId)
+    const partition = await em.findOne(AttachmentPartition, {
+      code: partitionCode,
+      $or: [
+        { tenantId: null, organizationId: null },
+        { tenantId: input.tenantId, organizationId: input.organizationId },
+      ],
+    })
+    if (!partition) throw new ScopedAttachmentUploadError('partition_unavailable', 400)
+
+    const driver = await storageDriverFactory.resolveForPartition(partition.code, {
+      tenantId: input.tenantId,
+      organizationId: input.organizationId,
+    })
+    const preparedStoragePath = driver.prepareStoragePath?.({
+      partitionCode: partition.code,
+      orgId: input.organizationId,
+      tenantId: input.tenantId,
+      fileName: safeName,
+    })
+    if (!preparedStoragePath) {
+      throw new ScopedAttachmentUploadError('quota_recovery_unsupported', 500)
+    }
+
+    let reservation: { id: string; leaseToken: string; expiresAt: Date } | null = null
+    try {
+      reservation = await attachmentQuotaService.reserve({
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+        bytes: input.buffer.length,
+        source: 'attachment',
+        storageDriver: driver.key,
+        storagePath: preparedStoragePath,
+        partitionCode: partition.code,
+      })
+      await attachmentQuotaRecoveryScheduler({
+        reservationId: reservation.id,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      }, Math.max(1_000, reservation.expiresAt.getTime() - Date.now()))
+      await attachmentQuotaService.beginStorage(reservation.id, reservation.leaseToken)
+    } catch (error) {
+      if (reservation) {
+        await attachmentQuotaService.release(reservation.id, reservation.leaseToken).catch(() => undefined)
+      }
+      const code = (error as { code?: unknown })?.code
+      if (code === 'quota_exceeded') throw new ScopedAttachmentUploadError('quota_exceeded', 413)
+      if (code === 'quota_target_exists') throw new ScopedAttachmentUploadError('quota_target_exists', 409)
+      throw new ScopedAttachmentUploadError('quota_unavailable', 500)
+    }
+
+    if (!reservation) throw new ScopedAttachmentUploadError('quota_unavailable', 500)
+
+    let storedPath = preparedStoragePath
+    try {
+      const stored = await driver.store({
+        partitionCode: partition.code,
+        orgId: input.organizationId,
+        tenantId: input.tenantId,
+        fileName: safeName,
+        buffer: input.buffer,
+        storagePath: preparedStoragePath,
+      })
+      storedPath = stored.storagePath
+      await attachmentQuotaService.markStored(reservation.id, reservation.leaseToken)
+    } catch (error) {
+      await this.compensateStorage(driver, partition.code, storedPath, reservation)
+      logger.error('Scoped attachment storage failed', { err: error })
+      throw new ScopedAttachmentUploadError('storage_failed', 500)
+    }
+
+    let extractedContent: string | null = null
+    const wantsLlmOcr = partition.requiresOcr && shouldUseLlmOcr(mimeType, safeName)
+    const ocrService = wantsLlmOcr ? new OcrService() : null
+    const useLlmOcr = Boolean(wantsLlmOcr && ocrService?.available)
+    if (partition.requiresOcr && !useLlmOcr) {
+      try {
+        const { filePath, cleanup } = await driver.toLocalPath(partition.code, storedPath)
+        try {
+          extractedContent = await extractAttachmentContent({ filePath, mimeType })
+        } finally {
+          await cleanup().catch(() => undefined)
+        }
+      } catch (error) {
+        logger.error('Scoped attachment text extraction failed', { err: error })
+      }
+    }
+
+    let assignments = input.assignments?.slice() ?? []
+    assignments = upsertAssignment(assignments, { type: input.entityId, id: input.recordId })
+    const metadata = mergeAttachmentMetadata(null, {
+      assignments,
+      tags: input.tags ?? [],
+    })
+    const attachmentId = randomUUID()
+    let attachment!: Attachment
+
+    try {
+      await em.transactional(async (tx) => {
+        attachment = tx.create(Attachment, {
+          id: attachmentId,
+          entityId: input.entityId,
+          recordId: input.recordId,
+          organizationId: input.organizationId,
+          tenantId: input.tenantId,
+          fileName: safeName,
+          mimeType,
+          fileSize: input.buffer.length,
+          partitionCode: partition.code,
+          storageDriver: partition.storageDriver || 'local',
+          storagePath: storedPath,
+          url: buildAttachmentFileUrl(attachmentId),
+          content: extractedContent,
+          storageMetadata: metadata,
+        })
+        assertAttachmentScopeInvariant({ tenantId: attachment.tenantId, organizationId: attachment.organizationId })
+        await tx.persist(attachment).flush()
+        await attachmentQuotaService.completeAttachment(reservation.id, reservation.leaseToken, tx)
+      })
+    } catch (error) {
+      await this.compensateStorage(driver, partition.code, storedPath, reservation)
+      logger.error('Scoped attachment persistence failed', { err: error })
+      throw new ScopedAttachmentUploadError('persistence_failed', 500)
+    }
+
+    if (useLlmOcr) {
+      requestOcrProcessing(em, attachment, driver, storedPath).catch((error) => {
+        logger.error('Scoped attachment OCR scheduling failed', { err: error })
+      })
+    }
+    if (this.deps.dataEngine) {
+      await emitCrudSideEffects({
+        dataEngine: this.deps.dataEngine,
+        action: 'created',
+        entity: attachment,
+        identifiers: {
+          id: attachment.id,
+          organizationId: attachment.organizationId ?? null,
+          tenantId: attachment.tenantId ?? null,
+        },
+        events: attachmentCrudEvents,
+        indexer: attachmentCrudIndexer,
+      })
+      await this.deps.dataEngine.flushOrmEntityChanges()
+    }
+    return attachment
+  }
+
+  private async compensateStorage(
+    driver: Awaited<ReturnType<StorageDriverFactory['resolveForPartition']>>,
+    partitionCode: string,
+    storagePath: string,
+    reservation: { id: string; leaseToken: string },
+  ): Promise<void> {
+    try {
+      await (driver.deleteStrict?.(partitionCode, storagePath) ?? driver.delete(partitionCode, storagePath))
+      await this.deps.attachmentQuotaService.release(reservation.id, reservation.leaseToken)
+    } catch (error) {
+      logger.error('Scoped attachment compensation failed', { err: error })
+    }
+  }
+}

package/src/modules/attachments/lib/target-access-service.ts

@@ -0,0 +1,57 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Attachment, AttachmentPartition } from '../data/entities'
+import { checkAttachmentAccess } from './access'
+import { readAttachmentMetadata } from './metadata'
+
+export type AttachmentRecordTarget = {
+  entityId: string
+  recordId: string
+}
+
+export type AttachmentTargetAccessInput = {
+  attachmentId: string
+  tenantId: string
+  organizationId: string
+  auth: Exclude<AuthContext, null>
+  targets: AttachmentRecordTarget[]
+}
+
+export class AttachmentTargetAccessService {
+  constructor(private readonly em: EntityManager) {}
+
+  async canAccessLinkedTarget(input: AttachmentTargetAccessInput): Promise<boolean> {
+    if (!input.targets.length) return false
+    const attachment = await findOneWithDecryption(
+      this.em,
+      Attachment,
+      {
+        id: input.attachmentId,
+        tenantId: input.tenantId,
+        organizationId: input.organizationId,
+      },
+      {},
+      { tenantId: input.tenantId, organizationId: input.organizationId },
+    )
+    if (!attachment) return false
+
+    const partition = await this.em.findOne(AttachmentPartition, {
+      code: attachment.partitionCode,
+      $or: [
+        { tenantId: null, organizationId: null },
+        { tenantId: input.tenantId, organizationId: input.organizationId },
+      ],
+    })
+    if (!partition) return false
+    if (!checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true }).ok) return false
+
+    const metadata = readAttachmentMetadata(attachment.storageMetadata)
+    return input.targets.some((target) => (
+      (attachment.entityId === target.entityId && attachment.recordId === target.recordId)
+      || metadata.assignments?.some((assignment) => (
+        assignment.type === target.entityId && assignment.id === target.recordId
+      )) === true
+    ))
+  }
+}

package/src/modules/auth/api/logout.ts

@@ -3,6 +3,21 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
 import { verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
 import { buildSafeRedirectResponse } from '@open-mercato/core/modules/auth/lib/requestRedirect'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
+
+type AuthTokenClaims = {
+  userId: string | null
+  sessionId: string | null
+  tenantId: string | null
+  organizationId: string | null
+}
+
+const emptyAuthTokenClaims: AuthTokenClaims = Object.freeze({
+  userId: null,
+  sessionId: null,
+  tenantId: null,
+  organizationId: null,
+})
 
 function parseCookie(req: Request, name: string): string | null {
   const cookie = req.headers.get('cookie') || ''
@@ -10,34 +25,55 @@ function parseCookie(req: Request, name: string): string | null {
   return m ? decodeURIComponent(m[1]) : null
 }
 
-function extractSessionIdFromAuthToken(token: string | null): string | null {
-  if (!token) return null
+function readStringClaim(payload: Record<string, unknown>, key: string): string | null {
+  const value = payload[key]
+  return typeof value === 'string' && value.length > 0 ? value : null
+}
+
+function extractAuthTokenClaims(token: string | null): AuthTokenClaims {
+  if (!token) return emptyAuthTokenClaims
   try {
     const payload = verifyJwt(token) as Record<string, unknown> | null
-    if (!payload) return null
-    const sid = payload.sid
-    return typeof sid === 'string' && sid.length > 0 ? sid : null
+    if (!payload) return emptyAuthTokenClaims
+    return {
+      userId: readStringClaim(payload, 'sub'),
+      sessionId: readStringClaim(payload, 'sid'),
+      tenantId: readStringClaim(payload, 'tenantId'),
+      organizationId: readStringClaim(payload, 'orgId'),
+    }
   } catch {
-    return null
+    return emptyAuthTokenClaims
   }
 }
 
 export async function POST(req: Request) {
   const sessToken = parseCookie(req, 'session_token')
   const authToken = parseCookie(req, 'auth_token')
-  const sessionId = extractSessionIdFromAuthToken(authToken)
-  if (sessToken || sessionId) {
+  const claims = extractAuthTokenClaims(authToken)
+  let sessionRevoked = false
+  if (sessToken || claims.sessionId) {
     try {
       const c = await createRequestContainer()
       const auth = c.resolve<AuthService>('authService')
-      if (sessionId) {
-        await auth.deleteSessionById(sessionId)
+      if (claims.sessionId) {
+        await auth.deleteSessionById(claims.sessionId)
       }
       if (sessToken) {
         await auth.deleteSessionByToken(sessToken)
       }
+      sessionRevoked = true
     } catch {}
   }
+  if (claims.userId) {
+    void emitAuthEvent('auth.logout', {
+      id: claims.userId,
+      tenantId: claims.tenantId,
+      organizationId: claims.organizationId,
+      sessionId: claims.sessionId,
+      sessionRevoked,
+      at: new Date().toISOString(),
+    }, { persistent: true }).catch(() => undefined)
+  }
   const res = buildSafeRedirectResponse(req, '/login')
   res.cookies.set('auth_token', '', { path: '/', maxAge: 0 })
   res.cookies.set('session_token', '', { path: '/', maxAge: 0 })

package/src/modules/auth/api/reset/confirm.ts

@@ -11,6 +11,7 @@ import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers
 import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
 import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
 
 const logger = createLogger('auth').child({ component: 'reset-confirm' })
 
@@ -33,6 +34,12 @@ export async function POST(req: Request) {
   const auth = c.resolve<AuthService>('authService')
   const user = await auth.confirmPasswordReset(parsed.data.token, parsed.data.password)
   if (!user) return NextResponse.json({ ok: false, error: 'Invalid or expired token' }, { status: 400 })
+  void emitAuthEvent('auth.password.reset.completed', {
+    id: String(user.id),
+    tenantId: user.tenantId ? String(user.tenantId) : null,
+    organizationId: user.organizationId ? String(user.organizationId) : null,
+    at: new Date().toISOString(),
+  }, { persistent: true }).catch(() => undefined)
   try {
     const tenantId = user.tenantId ? String(user.tenantId) : null
     if (tenantId) {

package/src/modules/auth/api/reset.ts

@@ -15,6 +15,7 @@ import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/
 import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
 import { mapSecurityEmailUrlError, toSecurityEmailUrl } from '@open-mercato/shared/lib/url'
 import { createLogger } from '@open-mercato/shared/lib/logger'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
 
 const logger = createLogger('auth').child({ component: 'reset' })
 
@@ -57,6 +58,12 @@ export async function POST(req: Request) {
   if (!resReq) return NextResponse.json({ ok: true })
   const { user, token } = resReq
   const resetUrl = resetUrlTemplate.replace('__token__', token)
+  void emitAuthEvent('auth.password.reset.requested', {
+    id: String(user.id),
+    tenantId: user.tenantId ? String(user.tenantId) : null,
+    organizationId: user.organizationId ? String(user.organizationId) : null,
+    at: new Date().toISOString(),
+  }, { persistent: true }).catch(() => undefined)
 
   const { translate } = await resolveTranslations()
   const subject = translate('auth.email.resetPassword.subject', 'Reset your password')

package/src/modules/auth/commands/users.ts

@@ -35,6 +35,7 @@ import { buildNotificationFromType } from '@open-mercato/core/modules/notificati
 import { resolveNotificationService } from '@open-mercato/core/modules/notifications/lib/notificationService'
 import notificationTypes from '@open-mercato/core/modules/auth/notifications'
 import { buildPasswordSchema } from '@open-mercato/shared/lib/auth/passwordPolicy'
+import { emitAuthEvent } from '@open-mercato/core/modules/auth/events'
 import { sendEmail } from '@open-mercato/shared/lib/email/send'
 import InviteUserEmail from '@open-mercato/core/modules/auth/emails/InviteUserEmail'
 import { INVITE_TOKEN_TTL_MS } from '@open-mercato/core/modules/auth/lib/inviteToken'
@@ -724,6 +725,27 @@ const updateUserCommand: CommandHandler<Record<string, unknown>, User> = {
       indexer: userCrudIndexer,
     })
 
+    if (hashed) {
+      const actorId = ctx.auth?.sub ? String(ctx.auth.sub) : null
+      // `system` covers a command invocation with no auth context and one running under
+      // `ctx.systemActor`. Without it those writes would be indistinguishable from an
+      // administrator setting someone else's password, which is exactly the case security
+      // alerting escalates on. Password writes that never reach this command — `mercato
+      // auth set-password`, tenant provisioning — set `passwordHash` directly and emit
+      // nothing, so a subscriber cannot treat this event as covering every credential change.
+      const changedBy = ctx.systemActor === true || !actorId
+        ? 'system'
+        : actorId === identifiers.id ? 'self' : 'admin'
+      void emitAuthEvent('auth.password.changed', {
+        id: identifiers.id,
+        tenantId: identifiers.tenantId,
+        organizationId: identifiers.organizationId,
+        changedBy,
+        changedById: actorId,
+        at: new Date().toISOString(),
+      }, { persistent: true }).catch(() => undefined)
+    }
+
     if (Array.isArray(parsed.roles) && rolesBefore) {
       const rolesAfter = await loadUserRoleNames(em, String(user.id))
       const { assigned, revoked } = diffRoleChanges(rolesBefore, rolesAfter)

package/src/modules/auth/events.ts

@@ -19,9 +19,24 @@ const events = [
   // Authentication events
   { id: 'auth.login.success', label: 'Login Successful', category: 'lifecycle' },
   { id: 'auth.login.failed', label: 'Login Failed', category: 'lifecycle' },
+  // The logout and password payloads below identify the user by `id` only. They are
+  // emitted with `{ persistent: true }`, so the whole payload is serialized into the
+  // durable events queue, while `email` is encrypted at rest under the `auth:user`
+  // encryption map — a subscriber that needs the address resolves it with
+  // `findOneWithDecryption` under the tenant's own key.
+  // `sessionRevoked` reports that server-side revocation ran without throwing, not that
+  // a session row was removed: a session that had already expired still reports `true`.
   { id: 'auth.logout', label: 'User Logged Out', category: 'lifecycle' },
+  // `changedBy` discriminates who performed the write: `self` (the account owner),
+  // `admin` (another authenticated user) or `system` (an `auth.users.update` carrying no
+  // auth context, or running under `ctx.systemActor`). `changedById` carries the actor id
+  // whenever there is one. Password writes that bypass the command emit nothing at all —
+  // `mercato auth set-password` and tenant provisioning both set `passwordHash` directly.
   { id: 'auth.password.changed', label: 'Password Changed', category: 'lifecycle' },
   { id: 'auth.password.reset.requested', label: 'Password Reset Requested', category: 'lifecycle' },
+  // Also emitted when an invited user sets their initial password: invitation
+  // emails link to /reset/<token> and post to the same confirm endpoint, so
+  // those completions arrive with no preceding `auth.password.reset.requested`.
   { id: 'auth.password.reset.completed', label: 'Password Reset Completed', category: 'lifecycle' },
 ] as const
 

package/src/modules/customers/api/companies/route.ts

@@ -91,6 +91,7 @@ const crud = makeCrudRoute({
     tenantField: 'tenantId',
     softDeleteField: 'deletedAt',
   },
+  enrichers: { entityId: 'customers.company' },
   indexer: {
     entityType: E.customers.customer_entity,
   },

package/src/modules/customers/backend/customers/companies-v2/[id]/page.tsx

@@ -305,7 +305,9 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
         .filter((widget) => (widget.placement?.kind ?? 'tab') === 'tab')
         .map((widget) => {
           const tabId = widget.placement?.groupId ?? widget.widgetId
-          const label = widget.placement?.groupLabel ?? widget.module.metadata.title ?? tabId
+          const label = widget.placement?.groupLabel
+            ? t(widget.placement.groupLabel, widget.placement.groupLabel)
+            : widget.module.metadata.title ?? tabId
           const priority = typeof widget.placement?.priority === 'number' ? widget.placement.priority : 0
           const render = () => (
             <widget.module.Widget
@@ -317,7 +319,7 @@ export default function CompanyDetailV2Page({ params }: { params?: { id?: string
           return { id: tabId, label, priority, render }
         })
         .sort((a, b) => b.priority - a.priority),
-    [data, injectedTabWidgets, injectionContext],
+    [data, injectedTabWidgets, injectionContext, t],
   )
 
   const injectedTabMap = React.useMemo(() => new Map(injectedTabs.map((tab) => [tab.id, tab.render])), [injectedTabs])

package/src/modules/customers/backend/customers/people-v2/[id]/page.tsx

@@ -308,7 +308,9 @@ export default function PersonDetailV2Page({ params }: { params?: { id?: string
         .filter((widget) => (widget.placement?.kind ?? 'tab') === 'tab')
         .map((widget) => {
           const tabId = widget.placement?.groupId ?? widget.widgetId
-          const label = widget.placement?.groupLabel ?? widget.module.metadata.title ?? tabId
+          const label = widget.placement?.groupLabel
+            ? t(widget.placement.groupLabel, widget.placement.groupLabel)
+            : widget.module.metadata.title ?? tabId
           const priority = typeof widget.placement?.priority === 'number' ? widget.placement.priority : 0
           const render = () => (
             <widget.module.Widget
@@ -320,7 +322,7 @@ export default function PersonDetailV2Page({ params }: { params?: { id?: string
           return { id: tabId, label, priority, render }
         })
         .sort((a, b) => b.priority - a.priority),
-    [data, injectedTabWidgets, injectionContext],
+    [data, injectedTabWidgets, injectionContext, t],
   )
 
   const injectedTabMap = React.useMemo(() => new Map(injectedTabs.map((tab) => [tab.id, tab.render])), [injectedTabs])