@open-mercato/core 0.6.8-develop.7043.1.b0199a62c6 → 0.6.8-develop.7047.1.32ab5fcb07

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7043.1.b0199a62c6",
+  "version": "0.6.8-develop.7047.1.32ab5fcb07",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7043.1.b0199a62c6",
-    "@open-mercato/shared": "0.6.8-develop.7043.1.b0199a62c6",
-    "@open-mercato/ui": "0.6.8-develop.7043.1.b0199a62c6",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7047.1.32ab5fcb07",
+    "@open-mercato/shared": "0.6.8-develop.7047.1.32ab5fcb07",
+    "@open-mercato/ui": "0.6.8-develop.7047.1.32ab5fcb07",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7043.1.b0199a62c6",
-    "@open-mercato/shared": "0.6.8-develop.7043.1.b0199a62c6",
-    "@open-mercato/ui": "0.6.8-develop.7043.1.b0199a62c6",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7047.1.32ab5fcb07",
+    "@open-mercato/shared": "0.6.8-develop.7047.1.32ab5fcb07",
+    "@open-mercato/ui": "0.6.8-develop.7047.1.32ab5fcb07",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/helpers/integration/api.ts

@@ -148,21 +148,25 @@ export async function postForm(
  * The `request` fixture keeps a cookie jar, and `/api/auth/login` sets `auth_token`
  * on it. Every later call through that fixture therefore carries the LAST logged-in
  * user's session, even one that deliberately sends no Authorization header or an
- * `ApiKey` one. Whether that cookie is stored at all depends on the deployment:
- * the login route marks it `secure` only when `NODE_ENV === 'production'`, so a lane
- * that serves the app with any other NODE_ENV over http keeps it while a production
- * lane silently drops it.
+ * `ApiKey` one.
  *
  * A spec asserting "no credentials are rejected" or "this API key alone decides
- * access" must not depend on which lane it happens to run in — it must issue the
- * request from a jar that never saw a login. TC-DOCUMENTS-009 and TC-DOCUMENTS-018
- * both failed in the standalone lane for exactly that reason while passing in the
- * ephemeral one.
+ * access" must therefore issue the request from a jar that never saw a login,
+ * rather than assuming the fixture's jar is empty. TC-DOCUMENTS-009 and
+ * TC-DOCUMENTS-018 both observably failed in the standalone lane — with the
+ * replayed cookie visible in the trace — while passing in the ephemeral one, and
+ * routing them through this helper fixed both.
  */
 export async function withCredentialIsolatedRequest<T>(
   use: (request: APIRequestContext) => Promise<T>,
 ): Promise<T> {
-  const context = await playwrightRequest.newContext(BASE_URL ? { baseURL: BASE_URL } : {});
+  // A hand-built context does not inherit the project's `use.baseURL` the way the
+  // `request` fixture does, so it has to repeat the config's own resolution — otherwise
+  // a relative path throws here on any run that leaves BASE_URL unset, while the same
+  // path works through the fixture.
+  const context = await playwrightRequest.newContext({
+    baseURL: BASE_URL ?? 'http://localhost:3000',
+  });
   try {
     return await use(context);
   } finally {

package/src/modules/customer_accounts/api/admin/domain-mappings.ts

@@ -14,6 +14,7 @@ import {
 import { registerDomainSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import {
   DomainMappingService,
+  DomainMappingOrgScopeError,
   type ResolveResult,
 } from '@open-mercato/core/modules/customer_accounts/services/domainMappingService'
 import { DomainMapping } from '@open-mercato/core/modules/customer_accounts/data/entities'
@@ -142,6 +143,12 @@ export async function POST(req: Request) {
         { status: 409 },
       )
     }
+    if (err instanceof DomainMappingOrgScopeError) {
+      return NextResponse.json(
+        { ok: false, error: 'Organization was not found in the current tenant.' },
+        { status: 400 },
+      )
+    }
     const message = err instanceof Error ? err.message : 'Failed to register domain'
     return NextResponse.json({ ok: false, error: message }, { status: 500 })
   }

package/src/modules/customer_accounts/services/domainMappingService.ts

@@ -9,9 +9,17 @@ import {
 import { Organization } from '@open-mercato/core/modules/directory/data/entities'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { normalizeHostname, tryNormalizeHostname } from '@open-mercato/core/modules/customer_accounts/lib/hostname'
+import { findOrganizationInTenant } from '@open-mercato/core/modules/customer_accounts/lib/organizationLookup'
 import { platformDomains } from '@open-mercato/core/modules/customer_accounts/lib/platformDomains'
 import { detectProxy, isInKnownProxyRange } from '@open-mercato/core/modules/customer_accounts/lib/proxyRanges'
 
+export class DomainMappingOrgScopeError extends Error {
+  constructor(organizationId: string) {
+    super(`[internal] organizationId ${organizationId} does not belong to the caller's tenant`)
+    this.name = 'DomainMappingOrgScopeError'
+  }
+}
+
 const DOMAIN_ROUTING_TAG = 'domain_routing'
 const RESOLVE_KEY_PREFIX = 'domain_routing:resolve'
 const ACTIVE_BY_ORG_KEY_PREFIX = 'domain_routing:active-by-org'
@@ -269,6 +277,8 @@ export class DomainMappingService {
 
   async register(input: RegisterInput): Promise<DomainMapping> {
     const hostname = normalizeHostname(input.hostname)
+    const organization = await findOrganizationInTenant(this.em, input.organizationId, input.tenantId)
+    if (!organization) throw new DomainMappingOrgScopeError(input.organizationId)
 
     let replacesDomain: DomainMapping | null = null
     if (input.replacesDomainId) {

package/src/modules/sales/api/documents/factory.ts

@@ -26,7 +26,6 @@ import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
 import { parseIdsParam } from '@open-mercato/shared/lib/crud/ids'
 import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { recalculateOrderTotalsForDisplay } from '../../commands/returns'
 import { parseDecryptedFieldValue } from '@open-mercato/shared/lib/encryption/tenantDataEncryptionService'
 
 type DocumentKind = 'order' | 'quote'
@@ -616,46 +615,6 @@ export function buildDocumentCrudOptions(binding: DocumentBinding) {
       afterList: async (payload: any, ctx: CrudCtx) => {
         await attachTags(payload, { ...ctx, bindingKind: binding.kind })
         await attachChannelNames(payload, ctx)
-        if (binding.kind === 'order' && Array.isArray(payload?.items) && payload.items.length === 1) {
-          const item = payload.items[0] as Record<string, unknown>
-          const orderId = typeof item?.id === 'string' ? item.id : null
-          const tenantId = typeof item?.tenantId === 'string' ? item.tenantId : ctx?.auth?.tenantId ?? null
-          const organizationId =
-            typeof item?.organizationId === 'string' ? item.organizationId : ctx?.selectedOrganizationId ?? ctx?.auth?.orgId ?? null
-          if (orderId && tenantId && organizationId) {
-            const requestEm = ctx?.container?.resolve?.('em') as import('@mikro-orm/postgresql').EntityManager | undefined
-            // Display-only totals recalculation: run on a forked EntityManager so
-            // the order/line/adjustment entities loaded here never enter the
-            // request's Unit of Work. This guarantees a GET can never flush an
-            // UPDATE (and thus never advance `updated_at`), which would otherwise
-            // surface as a spurious optimistic-lock 409 in another tab.
-            const em = requestEm?.fork()
-            if (em) {
-              const totals = await recalculateOrderTotalsForDisplay(
-                em,
-                ctx.container,
-                orderId,
-                { tenantId, organizationId },
-              )
-              if (totals) {
-                Object.assign(item, {
-                  subtotalNetAmount: totals.subtotalNetAmount,
-                  subtotalGrossAmount: totals.subtotalGrossAmount,
-                  discountTotalAmount: totals.discountTotalAmount,
-                  taxTotalAmount: totals.taxTotalAmount,
-                  shippingNetAmount: totals.shippingNetAmount,
-                  shippingGrossAmount: totals.shippingGrossAmount,
-                  surchargeTotalAmount: totals.surchargeTotalAmount,
-                  grandTotalNetAmount: totals.grandTotalNetAmount,
-                  grandTotalGrossAmount: totals.grandTotalGrossAmount,
-                  paidTotalAmount: totals.paidTotalAmount,
-                  refundedTotalAmount: totals.refundedTotalAmount,
-                  outstandingAmount: totals.outstandingAmount,
-                })
-              }
-            }
-          }
-        }
       },
     },
   }

package/src/modules/sales/commands/returns.ts

@@ -198,8 +198,10 @@ function buildCalculationContext(order: SalesOrder) {
 }
 
 /**
- * Recalculates order totals (including line-scoped return adjustments) for display.
- * Returns the totals object to merge into an order API response, or null if order not found.
+ * Recalculates order totals (including line-scoped return adjustments) from lines and
+ * adjustments. Do not merge this into GET /api/sales/orders responses: provider
+ * calculators re-emit shipping/payment fees on top of already-persisted adjustments
+ * and make list vs detail totals diverge (#5438). Persist via commands instead.
  */
 export async function recalculateOrderTotalsForDisplay(
   em: EntityManager,