@open-mercato/core 0.6.8-develop.7054.1.3c75040822 → 0.6.8-develop.7057.1.61440fc3bc

package/src/modules/eudr/commands/statements.ts

@@ -580,9 +580,6 @@ const createStatementCommand: CommandHandler<ScopedStatementCreateInput, Stateme
     if (parsed.status !== undefined && parsed.status !== 'draft') {
       throw new CrudHttpError(400, { error: 'eudr.errors.invalidTransition' })
     }
-    if (parsed.referenceIssuedAt !== undefined) {
-      throw new CrudHttpError(400, { error: 'eudr.errors.referenceIssuedAtImmutable' })
-    }
 
     const entityManager = (ctx.container.resolve('em') as EntityManager).fork()
     let record!: EudrDueDiligenceStatement

package/src/modules/eudr/data/validators.ts

@@ -46,6 +46,11 @@ export const GEOJSON_TYPES = ['Feature', 'FeatureCollection', 'Point', 'Polygon'
 
 const uuid = () => z.string().uuid()
 const geoJsonSizeLimit = 1_048_576
+// Two conventions for server-managed fields on these entities: fields listed below
+// are never advertised as create inputs, so a client sending a real value is rejected
+// (`rejectServerComputedFields` tolerates a null/undefined no-op echo). A field that
+// WAS advertised in the create schema — statements' `referenceIssuedAt` — is instead
+// dropped from the create schema, so it is stripped rather than rejected (#5508).
 const serverComputedSubmissionFields = ['completenessScore', 'missingFields'] as const
 const serverComputedPlotFields = ['validationWarnings', 'computedArea'] as const
 const serverComputedRiskAssessmentFields = ['countryRisks', 'overallTier', 'isSimplified', 'assessedByName'] as const
@@ -64,12 +69,16 @@ const orderSnapshotSchema = z.object({
   orderNumber: z.string().max(255).optional().nullable(),
 })
 
+// A whole-object POST echoes server-computed fields back with their no-op value
+// (a fresh draft's `submittedAt` is null), so tolerate a null/undefined echo and
+// reject only a meaningful attempt to set server-owned state (#5508).
 function rejectServerComputedFields(fields: readonly string[]): z.ZodType<unknown> {
   return z.unknown().superRefine((input, context) => {
     if (input === null || typeof input !== 'object' || Array.isArray(input)) return
     const record = input as Record<string, unknown>
     for (const field of fields) {
       if (!(field in record)) continue
+      if (record[field] === null || record[field] === undefined) continue
       context.addIssue({
         code: z.ZodIssueCode.custom,
         path: [field],
@@ -333,7 +342,13 @@ const statementBaseSchema = z.object({
   notes: z.string().max(5000).optional().nullable(),
 })
 
-export const statementCreateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(statementBaseSchema)
+// referenceIssuedAt is server-managed (only set at the submitted->available
+// transition) and is never a create input, so it is dropped from the create
+// schema. A whole-object POST that echoes it (null or a value) is accepted and
+// the field ignored, instead of a self-contradictory 400 (#5508).
+export const statementCreateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(
+  statementBaseSchema.omit({ referenceIssuedAt: true }),
+)
 
 export const statementUpdateSchema = rejectServerComputedFields(serverComputedStatementFields).pipe(
   z

package/src/modules/warranty_claims/api/assignees/route.ts

@@ -40,12 +40,12 @@ export function parseRequestedIds(raw: string): string[] {
 }
 
 export async function GET(req: Request) {
+  const { translate } = await resolveTranslations()
   try {
     const url = new URL(req.url)
     const parsedQuery = querySchema.parse(Object.fromEntries(url.searchParams))
     const container = await createRequestContainer()
     const auth = await getAuthFromRequest(req)
-    const { translate } = await resolveTranslations()
     if (!auth || !auth.tenantId) {
       throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
     }
@@ -75,10 +75,10 @@ export async function GET(req: Request) {
       return NextResponse.json(error.body, { status: error.status })
     }
     if (error instanceof z.ZodError) {
-      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
     logger.error('[warranty_claims] Failed to resolve assignee display names', { error })
-    return NextResponse.json({ error: 'warranty_claims.errors.load_failed' }, { status: 500 })
+    return NextResponse.json({ error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })
   }
 }
 

package/src/modules/warranty_claims/api/portal/claims/route.ts

@@ -153,12 +153,13 @@ function serializePortalClaim(claim: WarrantyClaim, lines: WarrantyClaimLine[])
 }
 
 async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
+  const { translate } = await resolveTranslations()
   const auth = await getCustomerAuthFromRequest(req)
   if (!auth) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') }, { status: 401 })
   }
   if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.customerAccountNotLinked', 'Customer account is not linked to a customer record') }, { status: 403 })
   }
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
@@ -264,6 +265,7 @@ async function validatePortalOrderOwnership(
   context: PortalContext,
   input: PortalIntakeInput,
 ): Promise<OrderValidationResult | Response> {
+  const { translate } = await resolveTranslations()
   const orderLineIds = Array.from(new Set(input.lines.flatMap((line) => line.orderLineId ? [line.orderLineId] : [])))
   const orderLinesById = await loadOwnedOrderLines(context, orderLineIds)
   const orderIds = new Set<string>()
@@ -273,7 +275,7 @@ async function validatePortalOrderOwnership(
   let resolvedOrder = input.orderId ? (ordersById.get(input.orderId) ?? null) : null
   if (input.orderId) {
     if (!resolvedOrder) {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderNotOwned' }, { status: 404 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderNotOwned', 'Order not found.') }, { status: 404 })
     }
   }
 
@@ -282,10 +284,9 @@ async function validatePortalOrderOwnership(
     const resolvedLine = orderLinesById.get(line.orderLineId)
     const lineOrder = resolvedLine ? ordersById.get(resolvedLine.orderId) : null
     if (!resolvedLine || !lineOrder) {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.orderLineMismatch' }, { status: 404 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') }, { status: 404 })
     }
     if (resolvedOrder && lineOrder.id !== resolvedOrder.id) {
-      const { translate } = await resolveTranslations()
       return NextResponse.json(
         { ok: false, error: translate('warranty_claims.errors.orderLineMismatch', 'Order line does not belong to the selected order') },
         { status: 400 },
@@ -337,7 +338,8 @@ export async function GET(req: Request) {
     serialNumber: url.searchParams.get('serialNumber') ?? undefined,
   })
   if (!query.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    const { translate } = await resolveTranslations()
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const { page, pageSize, search, status, stateGroup, serialNumber } = query.data
   const where = buildPortalOwnedClaimWhere(context)
@@ -415,15 +417,16 @@ export async function POST(req: Request) {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { translate } = await resolveTranslations()
   let body: unknown
   try {
     body = await req.json()
   } catch {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const parsed = portalIntakeInputSchema.safeParse(body)
   if (!parsed.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const ownership = await validatePortalOrderOwnership(context, parsed.data)
   if (ownership instanceof Response) return ownership
@@ -487,7 +490,7 @@ export async function POST(req: Request) {
     )
     const claimId = createResult.result?.claimId
     if (typeof claimId !== 'string') {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.save_failed' }, { status: 500 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })
     }
     try {
       await commandBus.execute<{ id: string; actorCustomerId: string }, { claimId: string }>(