@open-mercato/core 0.6.8-develop.7051.1.2e20648fd5 → 0.6.8-develop.7056.1.1a563a270d

package/src/modules/customers/api/people/check-phone/route.ts

@@ -3,9 +3,12 @@ import { z } from 'zod'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
-import type { EntityManager } from '@mikro-orm/postgresql'
+import type { EntityManager, FilterQuery } from '@mikro-orm/postgresql'
 import { CustomerEntity } from '../../../data/entities'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { isTenantDataEncryptionEnabled } from '@open-mercato/shared/lib/encryption/toggles'
+import { MATCH_CANDIDATE_LIMIT } from '../../../lib/findPeopleByAddresses'
 
 const querySchema = z.object({
   digits: z
@@ -18,6 +21,10 @@ export const metadata = {
   GET: { requireAuth: true, requireFeatures: ['customers.people.view'] },
 }
 
+function normalizePhoneDigits(value: string | null | undefined): string {
+  return typeof value === 'string' ? value.replace(/\D/g, '') : ''
+}
+
 export async function GET(req: Request) {
   const url = new URL(req.url)
   const rawQuery: Record<string, string | null> = { digits: url.searchParams.get('digits') }
@@ -45,18 +52,76 @@ export async function GET(req: Request) {
     return NextResponse.json({ match: null })
   }
 
-  const qb = em.createQueryBuilder(CustomerEntity, 'person')
-  qb.select(['person.id', 'person.displayName'])
-  qb.where({ kind: 'person', deletedAt: null })
-  qb.andWhere('person.primary_phone is not null')
-  qb.andWhere("regexp_replace(person.primary_phone, '\\D', '', 'g') = ?", [parse.data.digits])
+  // SQL fast path, gated on the encryption toggle: it can only match stored
+  // plaintext digits, so running it while tenant data encryption is enabled
+  // (the default) would pay a per-row scan that provably returns nothing.
+  // When encryption is off it serves the pre-encryption single-query behavior,
+  // including legacy plaintext rows. Encrypted rows written before the toggle
+  // was turned off are not resolvable by either path by design; plaintext
+  // legacy rows under an enabled toggle still resolve through the decrypted
+  // scan below, where decryption no-ops on non-ciphertext values.
+  if (!isTenantDataEncryptionEnabled()) {
+    const qb = em.createQueryBuilder(CustomerEntity, 'person')
+    qb.select(['person.id', 'person.displayName'])
+    qb.where({ kind: 'person', deletedAt: null })
+    qb.andWhere('person.primary_phone is not null')
+    qb.andWhere("regexp_replace(person.primary_phone, '\\D', '', 'g') = ?", [parse.data.digits])
+    if (auth.tenantId) {
+      qb.andWhere({ tenantId: auth.tenantId })
+    }
+    qb.andWhere({ organizationId: { $in: Array.from(allowedOrgIds) } })
+    qb.limit(1)
+
+    const fastMatch = await qb.getSingleResult()
+    if (fastMatch) {
+      return NextResponse.json({
+        match: {
+          id: fastMatch.id,
+          displayName: fastMatch.displayName,
+        },
+      })
+    }
+  }
+
+  // Encryption-on path: primary_phone holds random-IV ciphertext, so digit
+  // normalization must run in application code over decrypted rows instead of
+  // SQL against the stored column (issue #3840).
+  // Encryption-on path: primary_phone holds random-IV ciphertext, so digit
+  // normalization must run in application code over decrypted rows instead of
+  // SQL against the stored column (issue #3840). The scan is bounded newest-
+  // first and projected to the columns the route uses plus tenantId/
+  // organizationId, which the decryption path reads per row to resolve each
+  // row's own key (a request-level fallback cannot cover multi-org scans or
+  // null-tenant sessions). A primary_phone blind index is the exact O(1)
+  // follow-up (#5515).
+  const where: FilterQuery<CustomerEntity> = {
+    kind: 'person',
+    deletedAt: null,
+    primaryPhone: { $ne: null },
+    organizationId: { $in: Array.from(allowedOrgIds) },
+  }
   if (auth.tenantId) {
-    qb.andWhere({ tenantId: auth.tenantId })
+    where.tenantId = auth.tenantId
   }
-  qb.andWhere({ organizationId: { $in: Array.from(allowedOrgIds) } })
-  qb.limit(1)
 
-  const match = await qb.getSingleResult()
+  const candidates = await findWithDecryption(
+    em,
+    CustomerEntity,
+    where,
+    {
+      limit: MATCH_CANDIDATE_LIMIT,
+      orderBy: { createdAt: 'DESC' },
+      fields: ['id', 'displayName', 'primaryPhone', 'tenantId', 'organizationId'],
+    },
+    {
+      tenantId: auth.tenantId ?? null,
+      organizationId: scope?.selectedId ?? auth.orgId ?? null,
+    },
+  )
+
+  const match = candidates.find(
+    (candidate) => normalizePhoneDigits(candidate.primaryPhone) === parse.data.digits,
+  )
   if (!match) {
     return NextResponse.json({ match: null })
   }

package/src/modules/customers/lib/findPeopleByAddresses.ts

@@ -32,13 +32,15 @@ export interface MatchedPerson {
 }
 
 /**
- * Max person rows scanned by the in-memory fallback match. `primary_email` is
- * GDPR-encrypted with a random IV (see `customers/encryption.ts`), so it cannot
- * be filtered by value in SQL when tenant data encryption is on — recent rows are
- * decrypted and compared in memory instead. Bounded to keep the inbound path cheap;
- * a `primary_email` blind-index (hash) column is the follow-up if tenants outgrow it.
+ * Max rows scanned by in-memory fallback matches over encrypted contact
+ * columns (`primary_email` here, `primary_phone` in the check-phone route).
+ * These columns are GDPR-encrypted with a random IV (see
+ * `customers/encryption.ts`), so they cannot be filtered by value in SQL when
+ * tenant data encryption is on — fallbacks decrypt recent rows and compare in
+ * memory instead. Bounded to keep interactive lookups cheap; a blind-index
+ * (hash) column per field is the follow-up if tenants outgrow it (#5515).
  */
-const MATCH_CANDIDATE_LIMIT = 500
+export const MATCH_CANDIDATE_LIMIT = 500
 
 /**
  * Batch lookup of CustomerEntity rows (kind='person') whose `primaryEmail`

package/src/modules/messages/api/openapi.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import {
   attachmentIdsPayloadSchema,
+  composeMessageRequestSchema,
   composeMessageSchema,
   executeActionSchema,
   forwardMessageSchema,
@@ -283,6 +284,7 @@ export {
   messageObjectSchema,
   messageRecipientSchema,
   composeMessageSchema,
+  composeMessageRequestSchema,
   listMessagesSchema,
   forwardMessageSchema,
   replyMessageSchema,

package/src/modules/messages/api/route.ts

@@ -17,6 +17,11 @@ import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 import { User } from '../../auth/data/entities'
 import { Message, MessageObject } from '../data/entities'
 import { composeMessageSchema, listMessagesSchema, type ListMessagesInput } from '../data/validators'
+import {
+  composeRequiresChannelTypeResolution,
+  composeSourceHintSchema,
+  resolveComposeSourceChannelType,
+} from '../lib/composeSourceChannelType'
 import { MESSAGE_ATTACHMENT_ENTITY_ID } from '../lib/constants'
 import { getMessageType } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
@@ -27,7 +32,7 @@ import { resolveUserFeatures, runMessageMutationGuardAfterSuccess, runMessageMut
 import { findMessageIdsBySearchTokens } from '../lib/searchLookup'
 import { MessageCommandExecuteResult } from '../commands/shared'
 import {
-  composeMessageSchema as composeSchema,
+  composeMessageRequestSchema as composeSchema,
   composeResponseSchema,
   listMessagesSchema as listSchema,
   messageListItemSchema,
@@ -445,7 +450,31 @@ export async function POST(req: Request) {
   const { ctx, scope } = await resolveMessageContext(req)
   const commandBus = ctx.container.resolve('commandBus') as CommandBus
   const body = await req.json().catch(() => ({}))
-  const input = composeMessageSchema.parse(body)
+
+  // #4975: whether `externalEmail` is required depends on the channel this
+  // message originates from, so the channel type has to be established BEFORE
+  // validation. It is resolved server-side from the referenced conversation or
+  // parent message and any client-sent `sourceChannelType` is dropped —
+  // otherwise a caller could waive the requirement by asserting its own type.
+  // An unresolvable source stays `undefined`, which the validator fails closed on.
+  // Only the "public, non-draft, no address" branch of the validator reads the
+  // answer, so every other compose skips the lookup instead of discarding it.
+  const sourceHint = composeRequiresChannelTypeResolution(body)
+    ? composeSourceHintSchema.safeParse(body)
+    : null
+  const sourceChannelType = sourceHint?.success
+    ? await resolveComposeSourceChannelType(
+        ctx.container,
+        { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null },
+        sourceHint.data,
+      )
+    : undefined
+  const { sourceChannelType: _clientSuppliedChannelType, ...clientBody } =
+    (body ?? {}) as Record<string, unknown>
+  const input = composeMessageSchema.parse({
+    ...clientBody,
+    ...(sourceChannelType ? { sourceChannelType } : {}),
+  })
 
   const isPublicVisibility = input.visibility === 'public'
   const sendViaEmail = isPublicVisibility ? true : input.sendViaEmail

package/src/modules/messages/data/validators.ts

@@ -1,6 +1,7 @@
 import { z } from 'zod'
 import { parseBooleanFlag } from '@open-mercato/shared/lib/boolean'
 import { sanitizeRichTextHref } from '@open-mercato/shared/lib/html/sanitizeRichText'
+import { channelTypeRequiresExternalEmail } from '../lib/channel-sender-identity'
 
 function collectDuplicateRecipientIds(
   recipients: Array<{ userId: string }>,
@@ -99,13 +100,22 @@ export const messageActionDataSchema = z.object({
   expiresAt: z.string().datetime().optional(),
 })
 
-export const composeMessageSchema = z.object({
+const composeMessageBaseSchema = z.object({
   type: z.string().optional().default('default'),
   visibility: z.enum(['public', 'internal']).nullable().optional(),
   sourceEntityType: z.string().min(1).optional(),
   sourceEntityId: z.string().uuid().optional(),
   externalEmail: z.string().email().optional(),
   externalName: z.string().min(1).max(255).optional(),
+  /**
+   * Channel type the message originates from, when the caller knows it (#4975).
+   * Non-email channels (Discord, Slack, SMS…) have senders with no address, so
+   * `externalEmail` is not required for them. Resolved server-side — the HTTP
+   * route strips any client-sent value and derives it from the referenced
+   * conversation or parent message, so a caller cannot waive the requirement by
+   * asserting its own channel type.
+   */
+  sourceChannelType: z.string().min(1).max(64).optional(),
   recipients: z.array(messageRecipientSchema).max(100).optional().default([]),
   subject: z.string().max(500).optional().default(''),
   body: z.string().max(50000).optional().default(''),
@@ -118,7 +128,14 @@ export const composeMessageSchema = z.object({
   sendViaEmail: z.boolean().optional().default(false),
   parentMessageId: z.string().uuid().optional(),
   isDraft: z.boolean().optional().default(false),
-}).superRefine((value, ctx) => {
+})
+
+type ComposeMessageRefinementValue = Omit<
+  z.infer<typeof composeMessageBaseSchema>,
+  'sourceChannelType'
+> & { sourceChannelType?: string }
+
+function refineComposeMessage(value: ComposeMessageRefinementValue, ctx: z.RefinementCtx): void {
   const isDraft = value.isDraft ?? false
   const visibility = value.visibility ?? 'internal'
   const recipientCount = value.recipients.length
@@ -128,7 +145,10 @@ export const composeMessageSchema = z.object({
 
   if (!isDraft) {
     if (visibility === 'public') {
-      if (!hasExternalEmail) {
+      // #4975: an external correspondent is only guaranteed to have an address
+      // on an email-typed channel. `channelTypeRequiresExternalEmail` fails
+      // closed, so an unknown or absent channel type keeps the original rule.
+      if (!hasExternalEmail && channelTypeRequiresExternalEmail(value.sourceChannelType)) {
         ctx.addIssue({
           code: z.ZodIssueCode.custom,
           path: ['externalEmail'],
@@ -176,7 +196,26 @@ export const composeMessageSchema = z.object({
   }
 
   validateDefaultWithObjectsPayload(value, ctx)
-})
+}
+
+/**
+ * Full compose contract, including the server-resolved `sourceChannelType`.
+ * Used by the `messages.messages.compose` command and by the HTTP route AFTER
+ * it has resolved the channel type itself.
+ */
+export const composeMessageSchema = composeMessageBaseSchema.superRefine(refineComposeMessage)
+
+/**
+ * Client-facing compose contract — the same rules minus `sourceChannelType`,
+ * which is never accepted from a request body (#4975). Published in OpenAPI so
+ * the documented request shape matches what `POST /api/messages` actually reads:
+ * the route discards any client-sent channel type, resolves the real one from
+ * the referenced conversation or parent message, and only then validates against
+ * {@link composeMessageSchema}.
+ */
+export const composeMessageRequestSchema = composeMessageBaseSchema
+  .omit({ sourceChannelType: true })
+  .superRefine(refineComposeMessage)
 
 export const updateDraftSchema = z.object({
   type: z.string().optional(),

package/src/modules/messages/lib/channel-sender-identity.ts

@@ -0,0 +1,55 @@
+/**
+ * How the hub decides whether an external correspondent must be identified by an
+ * email address.
+ *
+ * Background (#4975): `composeMessageSchema` used to require `externalEmail` for
+ * every non-draft message with `visibility: 'public'` — which is every message
+ * from an external sender. That assumption holds only for email-typed channels.
+ * A Discord sender is a snowflake and has no address at all, so inbound Discord
+ * failed validation deterministically and the ingest job died in the queue while
+ * the channel still reported `Connected`.
+ *
+ * Variant A of the spec's § Open decision — hub sender-identity contract makes
+ * the requirement conditional on the originating channel type, and **fails
+ * closed**: only a channel type this list positively recognizes as non-email
+ * waives the requirement. An unrecognized, empty or absent channel type keeps
+ * the pre-existing behaviour, so no current caller changes and a typo'd or
+ * caller-asserted type cannot quietly switch a validation rule off.
+ *
+ * For these channels the sender identity is not lost — it is carried by
+ * `ExternalMessage.sender_identifier` and joined 1:1 to the platform message
+ * through `MessageChannelLink`.
+ *
+ * Adding a channel type here is additive and non-breaking: it only widens the
+ * set of inputs the hub accepts.
+ */
+const NON_EMAIL_SENDER_CHANNEL_TYPES = new Set([
+  'discord',
+  'slack',
+  'teams',
+  'telegram',
+  'signal',
+  'whatsapp',
+  'messenger',
+  'instagram',
+  'sms',
+  'push',
+])
+
+/**
+ * True when a message originating from `channelType` must carry an
+ * `externalEmail` to be composed with `visibility: 'public'`.
+ *
+ * Fail-closed by design — see the note above.
+ */
+export function channelTypeRequiresExternalEmail(channelType?: string | null): boolean {
+  if (typeof channelType !== 'string') return true
+  const normalized = channelType.trim().toLowerCase()
+  if (!normalized) return true
+  return !NON_EMAIL_SENDER_CHANNEL_TYPES.has(normalized)
+}
+
+/** The recognized non-email channel types, for tests and diagnostics. */
+export function listNonEmailSenderChannelTypes(): string[] {
+  return Array.from(NON_EMAIL_SENDER_CHANNEL_TYPES).sort((left, right) => left.localeCompare(right))
+}

package/src/modules/messages/lib/composeSourceChannelType.ts

@@ -0,0 +1,95 @@
+import { z } from 'zod'
+
+/**
+ * Entity type a channel-backed conversation is exposed under on a message's
+ * `sourceEntityType`. Written by `communication_channels`' inbound ingest.
+ */
+const EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE = 'communication_channels.external_conversation'
+
+/**
+ * The only parts of a compose body this resolution needs. Read defensively from
+ * the raw request body, before the body is validated, because the validation
+ * outcome itself depends on the answer (#4975).
+ */
+export const composeSourceHintSchema = z.object({
+  sourceEntityType: z.string().optional(),
+  sourceEntityId: z.string().uuid().optional(),
+  parentMessageId: z.string().uuid().optional(),
+})
+
+export type ComposeSourceHint = z.infer<typeof composeSourceHintSchema>
+
+/**
+ * Whether the compose validator can consult a resolved channel type at all.
+ *
+ * `sourceChannelType` is read in exactly one branch — a non-draft, public
+ * message that carries no address. Every internal reply, every draft and every
+ * public message that already supplies an address ignores it, so resolving it
+ * for them is a DI resolve plus a database round-trip whose answer is
+ * discarded. Mirrors `refineComposeMessage` and reads the raw body defensively,
+ * because this runs before validation. Skipping resolution yields `undefined`,
+ * which is already the fail-closed value.
+ */
+export function composeRequiresChannelTypeResolution(body: unknown): boolean {
+  if (!body || typeof body !== 'object') return false
+  const raw = body as Record<string, unknown>
+  if (raw.visibility !== 'public') return false
+  if (raw.isDraft === true) return false
+  const externalEmail = raw.externalEmail
+  return !(typeof externalEmail === 'string' && externalEmail.trim().length > 0)
+}
+
+type ResolveChannelTypeService = (
+  container: ContainerLike,
+  scope: { tenantId: string; organizationId: string | null },
+  reference: { externalConversationId?: string | null; messageId?: string | null },
+) => Promise<string | null>
+
+type ContainerLike = { resolve: <T = unknown>(name: string) => T }
+
+function tryResolveChannelTypeService(
+  container: ContainerLike,
+): ResolveChannelTypeService | undefined {
+  try {
+    return container.resolve<ResolveChannelTypeService>('communicationChannelsResolveChannelType')
+  } catch {
+    // `communication_channels` is optional: without it no message can originate
+    // from a channel, so "unknown" is both correct and fail-closed.
+    return undefined
+  }
+}
+
+/**
+ * Resolve the channel type a compose request originates from, server-side.
+ *
+ * Never derived from the request body's own `sourceChannelType` — that would let
+ * any caller waive the `externalEmail` requirement by asserting a channel type.
+ * It is looked up from the conversation the message is being composed on, or
+ * from the parent message it replies to.
+ *
+ * Returns `undefined` when nothing can be established, which the compose
+ * validator treats as "unknown" and therefore keeps the pre-#4975 rule.
+ */
+export async function resolveComposeSourceChannelType(
+  container: ContainerLike,
+  scope: { tenantId: string; organizationId: string | null },
+  hint: ComposeSourceHint,
+): Promise<string | undefined> {
+  const externalConversationId =
+    hint.sourceEntityType === EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE
+      ? hint.sourceEntityId ?? null
+      : null
+  const messageId = hint.parentMessageId ?? null
+  if (!externalConversationId && !messageId) return undefined
+
+  const resolveChannelType = tryResolveChannelTypeService(container)
+  if (!resolveChannelType) return undefined
+
+  const channelType = await resolveChannelType(container, scope, {
+    externalConversationId,
+    messageId,
+  })
+  return channelType ?? undefined
+}
+
+export { EXTERNAL_CONVERSATION_SOURCE_ENTITY_TYPE }

package/src/modules/warranty_claims/api/assignees/route.ts

@@ -40,12 +40,12 @@ export function parseRequestedIds(raw: string): string[] {
 }
 
 export async function GET(req: Request) {
+  const { translate } = await resolveTranslations()
   try {
     const url = new URL(req.url)
     const parsedQuery = querySchema.parse(Object.fromEntries(url.searchParams))
     const container = await createRequestContainer()
     const auth = await getAuthFromRequest(req)
-    const { translate } = await resolveTranslations()
     if (!auth || !auth.tenantId) {
       throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
     }
@@ -75,10 +75,10 @@ export async function GET(req: Request) {
       return NextResponse.json(error.body, { status: error.status })
     }
     if (error instanceof z.ZodError) {
-      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
     logger.error('[warranty_claims] Failed to resolve assignee display names', { error })
-    return NextResponse.json({ error: 'warranty_claims.errors.load_failed' }, { status: 500 })
+    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })
   }
 }
 

package/src/modules/warranty_claims/api/portal/claims/route.ts

@@ -153,12 +153,13 @@ function serializePortalClaim(claim: WarrantyClaim, lines: WarrantyClaimLine[])
 }
 
 async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
+  const { translate } = await resolveTranslations()
   const auth = await getCustomerAuthFromRequest(req)
   if (!auth) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
   if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.customerAccountNotLinked', 'Customer account is not linked to a customer record') }, { status: 403 })
   }
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -264,6 +265,7 @@ async function validatePortalOrderOwnership(
   context: PortalContext,
   input: PortalIntakeInput,
 ): Promise<OrderValidationResult | Response> {
+  const { translate } = await resolveTranslations()
   const orderLineIds = Array.from(new Set(input.lines.flatMap((line) => line.orderLineId ? [line.orderLineId] : [])))
   const orderLinesById = await loadOwnedOrderLines(context, orderLineIds)
   const orderIds = new Set<string>()
@@ -273,7 +275,7 @@ async function validatePortalOrderOwnership(
   let resolvedOrder = input.orderId ? (ordersById.get(input.orderId) ?? null) : null
   if (input.orderId) {
     if (!resolvedOrder) {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderNotOwned' }, { status: 404 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderNotOwned', 'Order not found.') }, { status: 404 })
     }
   }
 
@@ -282,10 +284,9 @@ async function validatePortalOrderOwnership(
     const resolvedLine = orderLinesById.get(line.orderLineId)
     const lineOrder = resolvedLine ? ordersById.get(resolvedLine.orderId) : null
     if (!resolvedLine || !lineOrder) {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderLineMismatch' }, { status: 404 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') }, { status: 404 })
     }
     if (resolvedOrder && lineOrder.id !== resolvedOrder.id) {
-      const { translate } = await resolveTranslations()
       return NextResponse.json(
         { ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') },
         { status: 400 },
@@ -337,7 +338,8 @@ export async function GET(req: Request) {
     serialNumber: url.searchParams.get('serialNumber') ?? undefined,
   })
   if (!query.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const { page, pageSize, search, status, stateGroup, serialNumber } = query.data
   const where = buildPortalOwnedClaimWhere(context)
@@ -415,15 +417,16 @@ export async function POST(req: Request) {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { translate } = await resolveTranslations()
   let body: unknown
   try {
     body = await req.json()
   } catch {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const parsed = portalIntakeInputSchema.safeParse(body)
   if (!parsed.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const ownership = await validatePortalOrderOwnership(context, parsed.data)
   if (ownership instanceof Response) return ownership
@@ -487,7 +490,7 @@ export async function POST(req: Request) {
     )
     const claimId = createResult.result?.claimId
     if (typeof claimId !== 'string') {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.save_failed' }, { status: 500 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })
     }
     try {
       await commandBus.execute<{ id: string; actorCustomerId: string }, { claimId: string }>(