@open-mercato/core 0.6.8-develop.7093.1.700c5c8d96 → 0.6.8-develop.7095.1.465fbf8f80

package/.turbo/turbo-build.log

@@ -1,4 +1,4 @@
-[build:core] found 4346 entry points
+[build:core] found 4347 entry points
 [build:core] built successfully
 [build:core:generated] found 218 entry points
 [build:core:generated] built successfully

package/dist/modules/auth/api/feature-check.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { featureCheckRequestSchema } from "../data/validators.js";
 const metadata = {
   POST: { requireAuth: true }
@@ -31,13 +32,18 @@ async function POST(req) {
   }
   const container = await createRequestContainer();
   const rbac = container.resolve("rbacService");
-  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId });
+  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req });
+  const featureScope = {
+    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,
+    organizationId: featureContext.organizationId
+  };
+  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope);
   if (ok) {
     return NextResponse.json({ ok: true, granted: features, userId: auth.sub });
   }
   const granted = [];
   for (const f of features) {
-    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId });
+    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope);
     if (hasFeature) granted.push(f);
   }
   return NextResponse.json({ ok: false, granted, userId: auth.sub });

package/dist/modules/auth/api/feature-check.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/feature-check.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { featureCheckRequestSchema } from '../data/validators'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst featureCheckResponseSchema = z.object({\n  ok: z.boolean().describe('Indicates whether all requested features are granted'),\n  granted: z.array(z.string()).describe('Features the current user may access'),\n  userId: z.string().describe('ID of the authenticated user'),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown = {}\n  try {\n    body = await req.json()\n  } catch { /* malformed JSON \u2014 safeParse below will reject */ }\n\n  const parsed = featureCheckRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  }\n\n  const features = parsed.data.features\n  if (!features.length) {\n    return NextResponse.json({ ok: true, granted: [], userId: auth.sub })\n  }\n\n  const container = await createRequestContainer()\n  const rbac = (container.resolve('rbacService') as any)\n  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (ok) {\n    return NextResponse.json({ ok: true, granted: features, userId: auth.sub })\n  }\n\n  // Check individually to see which features are granted\n  const granted: string[] = []\n  for (const f of features) {\n    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId })\n    if (hasFeature) granted.push(f)\n  }\n\n  return NextResponse.json({ ok: false, granted, userId: auth.sub })\n}\n\nconst featureCheckMethodDoc: OpenApiMethodDoc = {\n  summary: 'Check feature grants for the current user',\n  description: 'Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/json',\n    schema: featureCheckRequestSchema,\n    description: 'Feature identifiers to evaluate.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Evaluation result',\n      schema: featureCheckResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 400,\n      description: 'Invalid request \u2014 features array missing, too large, or contains invalid entries',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n    {\n      status: 401,\n      description: 'Authentication required',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Check feature grants for the current user',\n  methods: {\n    POST: featureCheckMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,QAAQ,EAAE,SAAS,sDAAsD;AAAA,EAC/E,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,sCAAsC;AAAA,EAC5E,QAAQ,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAC5D,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI,OAAgB,CAAC;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAAqD;AAE7D,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpH,MAAI,IAAI;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,UAAU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5E;AAGA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,UAAU;AACxB,UAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACvH,QAAI,WAAY,SAAQ,KAAK,CAAC;AAAA,EAChC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,QAAQ,KAAK,IAAI,CAAC;AACnE;AAEA,MAAM,wBAA0C;AAAA,EAC9C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { featureCheckRequestSchema } from '../data/validators'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst featureCheckResponseSchema = z.object({\n  ok: z.boolean().describe('Indicates whether all requested features are granted'),\n  granted: z.array(z.string()).describe('Features the current user may access'),\n  userId: z.string().describe('ID of the authenticated user'),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown = {}\n  try {\n    body = await req.json()\n  } catch { /* malformed JSON \u2014 safeParse below will reject */ }\n\n  const parsed = featureCheckRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  }\n\n  const features = parsed.data.features\n  if (!features.length) {\n    return NextResponse.json({ ok: true, granted: [], userId: auth.sub })\n  }\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve<RbacService>('rbacService')\n  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })\n  const featureScope = {\n    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,\n    organizationId: featureContext.organizationId,\n  }\n  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope)\n  if (ok) {\n    return NextResponse.json({ ok: true, granted: features, userId: auth.sub })\n  }\n\n  // Check individually to see which features are granted\n  const granted: string[] = []\n  for (const f of features) {\n    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope)\n    if (hasFeature) granted.push(f)\n  }\n\n  return NextResponse.json({ ok: false, granted, userId: auth.sub })\n}\n\nconst featureCheckMethodDoc: OpenApiMethodDoc = {\n  summary: 'Check feature grants for the current user',\n  description: 'Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/json',\n    schema: featureCheckRequestSchema,\n    description: 'Feature identifiers to evaluate.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Evaluation result',\n      schema: featureCheckResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 400,\n      description: 'Invalid request \u2014 features array missing, too large, or contains invalid entries',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n    {\n      status: 401,\n      description: 'Authentication required',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Check feature grants for the current user',\n  methods: {\n    POST: featureCheckMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,QAAQ,EAAE,SAAS,sDAAsD;AAAA,EAC/E,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,sCAAsC;AAAA,EAC5E,QAAQ,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAC5D,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI,OAAgB,CAAC;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAAqD;AAE7D,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AACzD,QAAM,iBAAiB,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACzF,QAAM,eAAe;AAAA,IACnB,UAAU,eAAe,MAAM,YAAY,KAAK,YAAY;AAAA,IAC5D,gBAAgB,eAAe;AAAA,EACjC;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,YAAY;AACzE,MAAI,IAAI;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,UAAU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5E;AAGA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,UAAU;AACxB,UAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,CAAC,GAAG,YAAY;AAC5E,QAAI,WAAY,SAAQ,KAAK,CAAC;AAAA,EAChC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,QAAQ,KAAK,IAAI,CAAC;AACnE;AAEA,MAAM,wBAA0C;AAAA,EAC9C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/core",
-  "version": "0.6.8-develop.7093.1.700c5c8d96",
+  "version": "0.6.8-develop.7095.1.465fbf8f80",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -252,16 +252,16 @@
     "zod": "^4.4.3"
   },
   "peerDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7093.1.700c5c8d96",
-    "@open-mercato/shared": "0.6.8-develop.7093.1.700c5c8d96",
-    "@open-mercato/ui": "0.6.8-develop.7093.1.700c5c8d96",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7095.1.465fbf8f80",
+    "@open-mercato/shared": "0.6.8-develop.7095.1.465fbf8f80",
+    "@open-mercato/ui": "0.6.8-develop.7095.1.465fbf8f80",
     "react": "^19.0.0",
     "react-dom": "^19.0.0"
   },
   "devDependencies": {
-    "@open-mercato/ai-assistant": "0.6.8-develop.7093.1.700c5c8d96",
-    "@open-mercato/shared": "0.6.8-develop.7093.1.700c5c8d96",
-    "@open-mercato/ui": "0.6.8-develop.7093.1.700c5c8d96",
+    "@open-mercato/ai-assistant": "0.6.8-develop.7095.1.465fbf8f80",
+    "@open-mercato/shared": "0.6.8-develop.7095.1.465fbf8f80",
+    "@open-mercato/ui": "0.6.8-develop.7095.1.465fbf8f80",
     "@testing-library/dom": "^10.4.1",
     "@testing-library/jest-dom": "^7.0.0",
     "@testing-library/react": "^16.3.1",

package/src/modules/auth/api/feature-check.ts

@@ -3,6 +3,8 @@ import { z } from 'zod'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { featureCheckRequestSchema } from '../data/validators'
 
 export const metadata = {
@@ -37,8 +39,13 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
-  const rbac = (container.resolve('rbacService') as any)
-  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId })
+  const rbac = container.resolve<RbacService>('rbacService')
+  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })
+  const featureScope = {
+    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,
+    organizationId: featureContext.organizationId,
+  }
+  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope)
   if (ok) {
     return NextResponse.json({ ok: true, granted: features, userId: auth.sub })
   }
@@ -46,7 +53,7 @@ export async function POST(req: Request) {
   // Check individually to see which features are granted
   const granted: string[] = []
   for (const f of features) {
-    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId })
+    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope)
     if (hasFeature) granted.push(f)
   }