@open-mercato/core 0.6.8-develop.7013.1.48f7adca80 → 0.6.8-develop.7016.1.4ed7b1e49d

package/src/modules/customers/lib/personCompanies.ts

@@ -56,6 +56,136 @@ async function requireCompany(
   return company
 }
 
+export type CompanyPersonUnionEntry = {
+  entity: CustomerEntity
+  profile: CustomerPersonProfile | null
+  linkedAt: string | null
+}
+
+/**
+ * Resolve "people belonging to this company" as the union of active
+ * `CustomerPersonCompanyLink` rows and `CustomerPersonProfile.company`
+ * profile-only assignments (data that never got a link row, e.g. from
+ * migrated CRM imports). This is the single source of truth for both the
+ * company People tab list and its badge count — see #5114.
+ */
+export async function loadCompanyPeopleUnion(
+  em: EntityManager,
+  company: CustomerEntity,
+  scope: { tenantId?: string | null; organizationId?: string | null },
+): Promise<CompanyPersonUnionEntry[]> {
+  const decryptionScope = {
+    tenantId: scope.tenantId ?? company.tenantId ?? null,
+    organizationId: scope.organizationId ?? company.organizationId ?? null,
+  }
+  const relatedPeopleById = new Map<string, CompanyPersonUnionEntry>()
+
+  const companyLinkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+    em,
+    { company: company.id, organizationId: company.organizationId, tenantId: company.tenantId },
+    'customers.companies.loadCompanyPeopleUnion',
+  )
+  const companyLinks = filterActivePersonCompanyLinks(
+    await findWithDecryption(
+      em,
+      CustomerPersonCompanyLink,
+      companyLinkWhere,
+      { populate: ['person', 'person.personProfile'], orderBy: { isPrimary: 'desc', createdAt: 'asc' } },
+      decryptionScope,
+    ),
+  )
+  companyLinks.forEach((link) => {
+    const entity = typeof link.person === 'string' ? null : link.person
+    if (!entity || entity.kind !== 'person' || entity.deletedAt) return
+    const personProfile =
+      entity.personProfile && typeof entity.personProfile !== 'string' ? entity.personProfile : null
+    relatedPeopleById.set(entity.id, {
+      entity,
+      profile: personProfile,
+      linkedAt: link.createdAt instanceof Date ? link.createdAt.toISOString() : null,
+    })
+  })
+
+  const profiles = await findWithDecryption(
+    em,
+    CustomerPersonProfile,
+    {
+      company: company.id,
+      tenantId: company.tenantId,
+      organizationId: company.organizationId,
+      entity: { deletedAt: null },
+    },
+    { populate: ['entity'] },
+    decryptionScope,
+  )
+  profiles.forEach((entry) => {
+    const entity = entry.entity as CustomerEntity | null
+    if (!entity || entity.kind !== 'person' || entity.deletedAt) return
+    if (!relatedPeopleById.has(entity.id)) {
+      relatedPeopleById.set(entity.id, {
+        entity,
+        profile: entry ?? null,
+        linkedAt: entry.createdAt instanceof Date ? entry.createdAt.toISOString() : null,
+      })
+    }
+  })
+
+  return Array.from(relatedPeopleById.values())
+}
+
+/**
+ * Count-only sibling of `loadCompanyPeopleUnion` for the company People badge, which
+ * needs the size of the union and nothing else. Both queries project just the foreign
+ * key column and push the `kind: 'person'` / `deletedAt: null` predicates into the
+ * WHERE clause, so no person row is hydrated and no PII is decrypted to produce a
+ * number — `findWithDecryption` is deliberately not used here because the projections
+ * select no encrypted column.
+ */
+export async function countCompanyPeopleUnion(
+  em: EntityManager,
+  company: CustomerEntity,
+): Promise<number> {
+  const personIds = new Set<string>()
+
+  const companyLinkWhere = await withActiveCustomerPersonCompanyLinkFilter(
+    em,
+    {
+      company: company.id,
+      organizationId: company.organizationId,
+      tenantId: company.tenantId,
+      person: { kind: 'person', deletedAt: null },
+    },
+    'customers.companies.countCompanyPeopleUnion',
+  )
+  const companyLinks = filterActivePersonCompanyLinks(
+    await em.find(CustomerPersonCompanyLink, companyLinkWhere as any, {
+      fields: ['person', 'deletedAt'],
+    } as any),
+  )
+  companyLinks.forEach((link) => {
+    const personId = typeof link.person === 'string' ? link.person : link.person?.id
+    if (personId) personIds.add(personId)
+  })
+
+  const profiles = await em.find(
+    CustomerPersonProfile,
+    {
+      company: company.id,
+      tenantId: company.tenantId,
+      organizationId: company.organizationId,
+      entity: { kind: 'person', deletedAt: null },
+    } as any,
+    { fields: ['entity'] } as any,
+  )
+  profiles.forEach((entry) => {
+    const entity = entry.entity as CustomerEntity | string | null
+    const entityId = typeof entity === 'string' ? entity : entity?.id
+    if (entityId) personIds.add(entityId)
+  })
+
+  return personIds.size
+}
+
 export async function loadPersonCompanyLinks(
   em: EntityManager,
   person: CustomerEntity,
@@ -298,7 +428,12 @@ export async function removePersonCompanyLink(
 
   if (!link) {
     if (profile.company && typeof profile.company !== 'string' && profile.company.id === linkId) {
-      profile.company = null
+      // Profile-only assignment: no link row backs it, so only the legacy field is
+      // cleared. It must keep mirroring the primary link the way every other detach
+      // path leaves it, so promote a remaining primary link instead of nulling blindly.
+      const primary = existingLinks.find((entry) => entry.isPrimary) ?? null
+      const primaryCompany = primary ? resolveLinkedCompany(primary) : null
+      profile.company = primaryCompany ?? null
       return
     }
     throw notFound('Company link not found')

package/src/modules/directory/di.ts

@@ -1,6 +1,18 @@
+import { asClass, asFunction } from 'awilix'
+import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
+import { DefaultOrganizationScopeService } from './services/organizationScopeService'
+import { DefaultOrganizationHierarchyService } from './services/organizationHierarchyService'
+
+type OrganizationScopeRbac = ConstructorParameters<typeof DefaultOrganizationScopeService>[1]
 
 export function register(container: AppContainer) {
-  // Directory module has no services yet; placeholder for future overrides
+  container.register({
+    organizationHierarchyService: asClass(DefaultOrganizationHierarchyService).scoped(),
+    organizationScopeService: asFunction((cradle: { em: EntityManager; rbacService: OrganizationScopeRbac }) =>
+      new DefaultOrganizationScopeService(cradle.em, cradle.rbacService, container),
+    )
+      .scoped()
+      .proxy(),
+  })
 }
-

package/src/modules/directory/services/organizationHierarchyService.ts

@@ -0,0 +1,34 @@
+import type { FilterQuery } from '@mikro-orm/core'
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
+import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { Organization } from '../data/entities'
+
+function normalizeIds(values: unknown): string[] {
+  if (!Array.isArray(values)) return []
+  return Array.from(new Set(values
+    .map((value) => typeof value === 'string' ? value.trim() : '')
+    .filter(Boolean)))
+}
+
+export class DefaultOrganizationHierarchyService implements OrganizationHierarchyService {
+  constructor(private readonly em: EntityManager) {}
+
+  async resolveAncestorIds(input: {
+    tenantId: string
+    organizationId: string
+  }): Promise<string[] | null> {
+    const organization = await findOneWithDecryption(
+      this.em,
+      Organization,
+      {
+        id: input.organizationId,
+        tenant: input.tenantId,
+        deletedAt: null,
+      } as FilterQuery<Organization>,
+      { fields: ['id', 'ancestorIds'] },
+      { tenantId: input.tenantId, organizationId: input.organizationId },
+    )
+    return organization ? normalizeIds(organization.ancestorIds) : null
+  }
+}

package/src/modules/directory/services/organizationScopeService.ts

@@ -0,0 +1,85 @@
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { AwilixContainer } from 'awilix'
+import type {
+  OrganizationScopeService,
+  OrganizationScopeRequest,
+} from '@open-mercato/shared/lib/auth/principal-service'
+import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import { resolveOrganizationScope, resolveOrganizationScopeForRequest } from '../utils/organizationScope'
+
+type OrganizationScopeRbac = {
+  invalidateUserCache(userId: string): Promise<void>
+  loadAcl(
+    userId: string,
+    scope: { tenantId: string | null; organizationId: string | null },
+  ): Promise<{ isSuperAdmin: boolean; features: string[]; organizations: string[] | null }>
+}
+
+export class DefaultOrganizationScopeService implements OrganizationScopeService {
+  constructor(
+    private readonly em: EntityManager,
+    private readonly rbac: OrganizationScopeRbac,
+    private readonly container: AwilixContainer,
+  ) {}
+
+  resolve(input: {
+    auth: AuthContext | null | undefined
+    selectedId?: string | null
+    tenantId?: string | null
+    freshAcl?: boolean
+  }) {
+    const auth = input.auth
+    if (input.freshAcl && auth?.sub) {
+      return this.resolveFresh({
+        auth,
+        selectedId: input.selectedId,
+        tenantId: input.tenantId,
+      }).then((result) => result.scope)
+    }
+    return resolveOrganizationScope({
+      em: this.em,
+      rbac: this.rbac as Parameters<typeof resolveOrganizationScope>[0]['rbac'],
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+
+  async resolveFresh(input: {
+    auth: NonNullable<AuthContext>
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    await this.rbac.invalidateUserCache(input.auth.sub)
+    const acl = await this.rbac.loadAcl(input.auth.sub, {
+      tenantId: input.tenantId ?? input.auth.tenantId ?? null,
+      organizationId: input.selectedId ?? input.auth.orgId ?? null,
+    })
+    const freshRbac: Parameters<typeof resolveOrganizationScope>[0]['rbac'] = {
+      loadAcl: async () => acl,
+    }
+    const scope = await resolveOrganizationScope({
+      em: this.em,
+      rbac: freshRbac,
+      auth: input.auth,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+    return { scope, acl }
+  }
+
+  resolveForRequest(input: {
+    auth: AuthContext | null | undefined
+    request?: OrganizationScopeRequest
+    selectedId?: string | null
+    tenantId?: string | null
+  }) {
+    return resolveOrganizationScopeForRequest({
+      container: this.container,
+      auth: input.auth,
+      request: input.request,
+      selectedId: input.selectedId,
+      tenantId: input.tenantId,
+    })
+  }
+}

package/src/modules/directory/utils/organizationScope.ts

@@ -5,6 +5,7 @@ import { Organization } from '@open-mercato/core/modules/directory/data/entities
 import { isAllOrganizationsSelection } from '@open-mercato/core/modules/directory/constants'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
+import type { OrganizationScope } from '@open-mercato/shared/lib/auth/principal-service'
 import { getCurrentCacheTenant, runWithCacheTenant, type CacheStrategy } from '@open-mercato/cache'
 import { parseSelectedOrganizationCookie, parseSelectedTenantCookie } from './scopeCookies'
 import { createLogger } from '@open-mercato/shared/lib/logger'
@@ -13,19 +14,7 @@ const logger = createLogger('directory').child({ component: 'org-scope-cache' })
 
 export { parseSelectedOrganizationCookie, parseSelectedTenantCookie }
 
-export type OrganizationScope = {
-  selectedId: string | null
-  filterIds: string[] | null
-  allowedIds: string[] | null
-  tenantId: string | null
-  // True when the caller explicitly selected a concrete organization (cookie /
-  // selectedId param) that could not be honored — it does not exist for the
-  // tenant or is not accessible. Reads degrade gracefully (filterIds/selectedId
-  // fall back to the caller's accessible orgs), but writes MUST fail loudly on
-  // this so a record never lands under an org the caller did not intend. Absent
-  // (undefined) means the selection — if any — was honored.
-  selectionRejected?: boolean
-}
+export type { OrganizationScope }
 
 // Phase 4 — short-TTL cache for resolveOrganizationScopeForRequest.
 // OrganizationScope is a pure function of (userId, tenantId, selectedOrgId,
@@ -249,8 +238,8 @@ export async function resolveOrganizationScope({
   tenantId: tenantIdOverride,
 }: {
   em: EntityManager
-  rbac: RbacService
-  auth: AuthContext
+  rbac: Pick<RbacService, 'loadAcl'>
+  auth: AuthContext | null | undefined
   selectedId?: string | null
   tenantId?: string | null
 }): Promise<OrganizationScope> {

package/src/modules/warranty_claims/api/portal/attachments/route.ts

@@ -19,7 +19,7 @@ import { readAttachmentMetadata } from '@open-mercato/core/modules/attachments/l
 import { clearAttachmentThumbnailCache } from '@open-mercato/core/modules/attachments/lib/thumbnailCache'
 import { isMultipartRequestWithinUploadLimit } from '@open-mercato/core/modules/attachments/lib/upload-limits'
 import {
-  ScopedAttachmentUploadError,
+  isScopedAttachmentUploadError,
   type ScopedAttachmentUploadErrorCode,
 } from '@open-mercato/core/modules/attachments/lib/scoped-upload-service'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -413,7 +413,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
       tags: [CUSTOMER_VISIBLE_ATTACHMENT_TAG],
     })
   } catch (error) {
-    if (error instanceof ScopedAttachmentUploadError) {
+    if (isScopedAttachmentUploadError(error)) {
       const { t } = await resolveTranslations()
       const [key, fallback] = ATTACHMENT_ERROR_TRANSLATIONS[error.code]
         ?? ['warranty_claims.portal.detail.attachmentError', 'Attachment upload failed.']

package/src/modules/workflows/lib/activity-executor.ts

@@ -22,6 +22,7 @@ import {
   type HostLookup,
 } from '@open-mercato/shared/lib/url-safety'
 import { parseBooleanWithDefault } from '@open-mercato/shared/lib/boolean'
+import { isPrivateCrossProcessBroadcastEvent } from '@open-mercato/shared/modules/events'
 import { callWebhookConfigSchema } from '../data/validators'
 import { WorkflowActivityJob, WORKFLOW_ACTIVITIES_QUEUE_NAME } from './activity-queue-types'
 import { logWorkflowEvent } from './event-logger'
@@ -578,6 +579,14 @@ export async function executeEmitEvent(
     throw new Error('EMIT_EVENT requires "eventName" field')
   }
 
+  // Workflow definitions are tenant-managed input. Private cross-process
+  // events coordinate trusted server state (for example closing an in-memory
+  // collaboration room), so allowing a workflow to name one would turn a
+  // regular event activity into a cross-process invalidation primitive.
+  if (isPrivateCrossProcessBroadcastEvent(eventName)) {
+    throw new Error(`EMIT_EVENT cannot emit private cross-process event "${eventName}"`)
+  }
+
   // Emissions are fire-and-forget and no subscriber validates the payload shape,
   // so an unresolved `{{context.x}}` here is even quieter than on the command
   // path — it ships the literal template to every consumer. Fail loudly instead.