@open-mercato/core 0.6.8-develop.7099.1.7ba2771d06 → 0.7.0

package/src/modules/audit_logs/lib/display-helpers.tsx

@@ -33,9 +33,9 @@ export function renderValue(value: unknown, fallback: string) {
   if (typeof value === 'boolean') return <span>{value ? 'true' : 'false'}</span>
   if (typeof value === 'number' || typeof value === 'bigint') return <span>{String(value)}</span>
   if (value instanceof Date) return <span>{value.toISOString()}</span>
-  if (typeof value === 'string') return <span className="wrap-anywhere">{value}</span>
+  if (typeof value === 'string') return <span className="break-words">{value}</span>
   return (
-    <pre className="max-h-40 overflow-y-auto whitespace-pre-wrap wrap-anywhere rounded-md bg-muted/50 px-2 py-1 text-xs leading-5 text-muted-foreground">
+    <pre className="max-h-40 overflow-y-auto whitespace-pre-wrap break-words rounded-md bg-muted/50 px-2 py-1 text-xs leading-5 text-muted-foreground">
       {safeStringify(value)}
     </pre>
   )
@@ -76,53 +76,43 @@ export type ChangedFieldsTableProps = {
 }
 
 export function ChangedFieldsTable({ changeRows, noneLabel, t, beforeLabel, afterLabel }: ChangedFieldsTableProps) {
-  const beforeHeading = beforeLabel ?? t('audit_logs.actions.details.before')
-  const afterHeading = afterLabel ?? t('audit_logs.actions.details.after')
   return (
     <section>
       <h3 className="text-sm font-semibold">
         {t('audit_logs.actions.details.changed_fields')}
       </h3>
       {changeRows.length ? (
-        <div className="@container/changes mt-2">
-          <div className="overflow-x-auto rounded-lg border">
-            <table className="block w-full divide-y text-sm @lg/changes:table @lg/changes:min-w-full">
-              <thead className="hidden bg-muted/50 @lg/changes:table-header-group">
-                <tr>
-                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                    {t('audit_logs.actions.details.field')}
-                  </th>
-                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                    {beforeHeading}
-                  </th>
-                  <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
-                    {afterHeading}
-                  </th>
+        <div className="mt-2 overflow-x-auto rounded-lg border">
+          <table className="min-w-full divide-y text-sm">
+            <thead className="bg-muted/50">
+              <tr>
+                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                  {t('audit_logs.actions.details.field')}
+                </th>
+                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                  {beforeLabel ?? t('audit_logs.actions.details.before')}
+                </th>
+                <th scope="col" className="px-4 py-2 text-left font-medium text-muted-foreground">
+                  {afterLabel ?? t('audit_logs.actions.details.after')}
+                </th>
+              </tr>
+            </thead>
+            <tbody className="divide-y">
+              {changeRows.map((row) => (
+                <tr key={row.field} className="align-top">
+                  <td className="px-4 py-2 align-top font-medium">
+                    {humanizeField(normalizeChangeField(row.field))}
+                  </td>
+                  <td className="px-4 py-2">
+                    {renderValue(row.from, noneLabel)}
+                  </td>
+                  <td className="px-4 py-2">
+                    {renderValue(row.to, noneLabel)}
+                  </td>
                 </tr>
-              </thead>
-              <tbody className="block divide-y @lg/changes:table-row-group">
-                {changeRows.map((row) => (
-                  <tr key={row.field} className="block px-4 py-3 align-top @lg/changes:table-row @lg/changes:p-0">
-                    <td className="block font-medium @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2 @lg/changes:align-top">
-                      {humanizeField(normalizeChangeField(row.field))}
-                    </td>
-                    <td className="mt-2 block @lg/changes:mt-0 @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2">
-                      <span className="mb-0.5 block text-xs font-medium uppercase tracking-wide text-muted-foreground @lg/changes:hidden">
-                        {beforeHeading}
-                      </span>
-                      {renderValue(row.from, noneLabel)}
-                    </td>
-                    <td className="mt-2 block @lg/changes:mt-0 @lg/changes:table-cell @lg/changes:px-4 @lg/changes:py-2">
-                      <span className="mb-0.5 block text-xs font-medium uppercase tracking-wide text-muted-foreground @lg/changes:hidden">
-                        {afterHeading}
-                      </span>
-                      {renderValue(row.to, noneLabel)}
-                    </td>
-                  </tr>
-                ))}
-              </tbody>
-            </table>
-          </div>
+              ))}
+            </tbody>
+          </table>
         </div>
       ) : (
         <p className="mt-2 text-sm text-muted-foreground">

package/src/modules/audit_logs/services/actionLogService.ts

@@ -5,7 +5,6 @@ import { ActionLog } from '@open-mercato/core/modules/audit_logs/data/entities'
 import {
   actionLogCreateSchema,
   actionLogListSchema,
-  uuid,
   type ActionLogCreateInput,
   type ActionLogListQuery,
 } from '@open-mercato/core/modules/audit_logs/data/validators'
@@ -35,55 +34,6 @@ const SORT_FIELDS = {
   createdAt: 'action_logs.created_at',
 } as const
 const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
-// Mirrors what `uuid` (`data/validators.ts`) accepts — versions 1-8 plus the nil and
-// max UUIDs — and is used only when the zod runtime is unavailable, so the actor
-// sanitizer can never reject a value `actionLogCreateSchema` would have accepted.
-export const SCHEMA_UUID_REGEX = /^(?:[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-8][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}|00000000-0000-0000-0000-000000000000|ffffffff-ffff-ffff-ffff-ffffffffffff)$/
-const API_KEY_ACTOR_PREFIX = 'api_key:'
-const SYSTEM_ACTOR_PREFIX = 'system:'
-// `context.systemActor` names the automated principal behind an entry; `context.source`
-// (read by `deriveActionLogSource`) names the channel it arrived through. They are
-// siblings on purpose and never contradict each other: an entry carrying `systemActor`
-// has a null actor column, which already derives the `system` source.
-const SYSTEM_ACTOR_CONTEXT_KEY = 'systemActor'
-const SYSTEM_ACTOR_REFERENCE_MAX_LENGTH = 255
-
-function toNullableUuid(value: unknown): string | null {
-  return typeof value === 'string' && UUID_REGEX.test(value) ? value : null
-}
-
-function isSchemaUuid(value: string): boolean {
-  if (runtimeValidationAvailable === false) return SCHEMA_UUID_REGEX.test(value)
-
-  try {
-    return uuid.safeParse(value).success
-  } catch (err) {
-    if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
-    return SCHEMA_UUID_REGEX.test(value)
-  }
-}
-
-function readActorCandidate(value: unknown): string | null {
-  if (typeof value !== 'string') return null
-  const trimmed = value.trim()
-  return trimmed.length > 0 ? trimmed : null
-}
-
-function normalizeActorUserId(value: unknown): string | null {
-  const candidate = readActorCandidate(value)
-  if (!candidate) return null
-  const unwrapped = candidate.startsWith(API_KEY_ACTOR_PREFIX)
-    ? candidate.slice(API_KEY_ACTOR_PREFIX.length)
-    : candidate
-
-  return isSchemaUuid(unwrapped) ? unwrapped : null
-}
-
-function toSystemActorReference(candidate: string): string | null {
-  if (!candidate.startsWith(SYSTEM_ACTOR_PREFIX)) return null
-  if (candidate.length === SYSTEM_ACTOR_PREFIX.length) return null
-  return candidate.slice(0, SYSTEM_ACTOR_REFERENCE_MAX_LENGTH)
-}
 
 type ActionLogProjectionBackfillOptions = {
   batchSize?: number
@@ -252,7 +202,6 @@ export class ActionLogService {
   }
 
   private parseCreateInput(input: ActionLogCreateInput): ActionLogCreateInput {
-    const sanitized = this.sanitizeActor(input)
     let data: ActionLogCreateInput
     const schema = actionLogCreateSchema as typeof actionLogCreateSchema & { _zod?: unknown }
     const canValidate = Boolean(schema && typeof schema.parse === 'function')
@@ -260,7 +209,7 @@ export class ActionLogService {
 
     if (shouldValidate) {
       try {
-        data = schema.parse(sanitized)
+        data = schema.parse(input)
         runtimeValidationAvailable = true
       } catch (err) {
         if (!isZodRuntimeMissing(err) && !validationWarningLogged) {
@@ -268,34 +217,15 @@ export class ActionLogService {
           logger.warn('Falling back to permissive action log payload parser', { err })
         }
         if (isZodRuntimeMissing(err)) runtimeValidationAvailable = false
-        data = this.normalizeInput(sanitized)
+        data = this.normalizeInput(input)
       }
     } else {
-      data = this.normalizeInput(sanitized)
+      data = this.normalizeInput(input)
     }
 
     return data
   }
 
-  private sanitizeActor(input: ActionLogCreateInput): ActionLogCreateInput {
-    if (!input) return input
-    const candidate = readActorCandidate(input.actorUserId)
-    const actorUserId = normalizeActorUserId(candidate)
-    const systemActorReference = candidate && !actorUserId ? toSystemActorReference(candidate) : null
-
-    if (!systemActorReference) {
-      if (actorUserId === (input.actorUserId ?? null)) return input
-      return { ...input, actorUserId }
-    }
-
-    const context = isRecord(input.context) ? { ...input.context } : {}
-    if (context[SYSTEM_ACTOR_CONTEXT_KEY] === undefined) {
-      context[SYSTEM_ACTOR_CONTEXT_KEY] = systemActorReference
-    }
-
-    return { ...input, actorUserId, context }
-  }
-
   private createLogEntity(fork: EntityManager, data: ActionLogCreateInput): ActionLog {
     const projection = deriveActionLogProjection({
       actorUserId: data.actorUserId ?? null,
@@ -356,6 +286,13 @@ export class ActionLogService {
       }
     }
 
+    const UUID_REGEX = /^[0-9a-fA-F]{8}-[0-9a-fA-F]{4}-[1-5][0-9a-fA-F]{3}-[89abAB][0-9a-fA-F]{3}-[0-9a-fA-F]{12}$/
+    const toNullableUuid = (value: unknown) => {
+      if (typeof value !== 'string' || value.length === 0) return null
+      const candidate = value.startsWith('api_key:') ? value.slice('api_key:'.length) : value
+      return UUID_REGEX.test(candidate) ? candidate : null
+    }
+
     const normalizeRecordLike = (value: unknown): ActionLogCreateInput['changes'] => {
       if (value === null) return null
       if (Array.isArray(value)) return value
@@ -372,7 +309,7 @@ export class ActionLogService {
     return {
       tenantId: toNullableUuid(input.tenantId),
       organizationId: toNullableUuid(input.organizationId),
-      actorUserId: normalizeActorUserId(input.actorUserId),
+      actorUserId: toNullableUuid(input.actorUserId),
       commandId: typeof input.commandId === 'string' && input.commandId.length > 0 ? input.commandId : 'unknown',
       actionLabel: toOptionalString(input.actionLabel) ?? undefined,
       resourceKind: toOptionalString(input.resourceKind) ?? undefined,

package/src/modules/auth/acl.ts

@@ -1,38 +1,14 @@
 // Module-level features declaration for RBAC
 export const features = [
   { id: 'auth.users.list', title: 'List users', module: 'auth' },
-  {
-    id: 'auth.users.create',
-    title: 'Create users',
-    module: 'auth',
-    dependsOn: ['auth.users.list', 'auth.roles.list', 'directory.organizations.view'],
-  },
-  {
-    id: 'auth.users.edit',
-    title: 'Edit users',
-    module: 'auth',
-    dependsOn: ['auth.users.list', 'auth.roles.list'],
-  },
-  {
-    id: 'auth.users.delete',
-    title: 'Delete users',
-    module: 'auth',
-    dependsOn: ['auth.users.list'],
-  },
+  { id: 'auth.users.create', title: 'Create users', module: 'auth' },
+  { id: 'auth.users.edit', title: 'Edit users', module: 'auth' },
+  { id: 'auth.users.delete', title: 'Delete users', module: 'auth' },
   { id: 'auth.roles.list', title: 'List roles', module: 'auth' },
-  {
-    id: 'auth.roles.manage',
-    title: 'Manage roles',
-    module: 'auth',
-    dependsOn: ['auth.roles.list'],
-  },
-  {
-    id: 'auth.acl.manage',
-    title: 'Manage ACLs',
-    module: 'auth',
-    dependsOn: ['auth.users.list', 'auth.roles.list'],
-  },
+  { id: 'auth.roles.manage', title: 'Manage roles', module: 'auth' },
+  { id: 'auth.acl.manage', title: 'Manage ACLs', module: 'auth' },
   { id: 'auth.sidebar.manage', title: 'Manage sidebar presets', module: 'auth' },
 ]
 
 export default features
+

package/src/modules/auth/api/feature-check.ts

@@ -3,8 +3,6 @@ import { z } from 'zod'
 import type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
-import type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
-import { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import { featureCheckRequestSchema } from '../data/validators'
 
 export const metadata = {
@@ -39,13 +37,8 @@ export async function POST(req: Request) {
   }
 
   const container = await createRequestContainer()
-  const rbac = container.resolve<RbacService>('rbacService')
-  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })
-  const featureScope = {
-    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,
-    organizationId: featureContext.organizationId,
-  }
-  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope)
+  const rbac = (container.resolve('rbacService') as any)
+  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId })
   if (ok) {
     return NextResponse.json({ ok: true, granted: features, userId: auth.sub })
   }
@@ -53,7 +46,7 @@ export async function POST(req: Request) {
   // Check individually to see which features are granted
   const granted: string[] = []
   for (const f of features) {
-    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope)
+    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId })
     if (hasFeature) granted.push(f)
   }
 

package/src/modules/auth/api/login.ts

@@ -15,6 +15,7 @@ import { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modul
 import { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'
 import { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'
 import { getAppBaseUrl } from '@open-mercato/shared/lib/url'
+import { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'
 
 const loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {
   points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',
@@ -84,7 +85,29 @@ async function parseLoginForm(req: Request): Promise<ParsedLoginForm> {
   }
 }
 
+// Resolving translations can itself be what failed, so the generic message is
+// recovered defensively — the error path must never throw a second time.
+async function resolveGenericLoginError(): Promise<string> {
+  try {
+    const { translate } = await resolveTranslations()
+    return translate('auth.login.errors.generic', 'An error occurred. Please try again.')
+  } catch {
+    return 'An error occurred. Please try again.'
+  }
+}
+
 export async function POST(req: Request) {
+  try {
+    return await handleLoginRequest(req)
+  } catch (error) {
+    return handleAuthRouteError(error, {
+      scope: 'auth.login',
+      message: await resolveGenericLoginError(),
+    })
+  }
+}
+
+async function handleLoginRequest(req: Request) {
   const { translate } = await resolveTranslations()
   const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)
   // Rate limit — two layers, both checked before validation and DB work
@@ -215,21 +238,13 @@ export async function POST(req: Request) {
     ? interceptedBody.refreshToken
     : undefined
 
-  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional
-  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the
-  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff
-  // token and skip the outstanding second factor, so it is cleared alongside the swap.
-  const authTokenReplacedByInterceptor = authTokenForCookie !== token
-
   const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })
   res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })
   if (remember && refreshTokenForCookie) {
     const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)
     res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })
-  } else if (!remember && !authTokenReplacedByInterceptor) {
+  } else if (!remember && authTokenForCookie === token) {
     res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })
-  } else if (authTokenReplacedByInterceptor) {
-    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })
   }
   return res
 }

package/src/modules/auth/api/roles/acl/route.ts

@@ -6,7 +6,7 @@ import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'
 import { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'
-import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
+import { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'
 import { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'
@@ -16,11 +16,8 @@ import {
   assertActorCanModifySuperAdminRoleTarget,
   normalizeGrantFeatureList,
 } from '@open-mercato/core/modules/auth/lib/grantChecks'
-import {
-  AUTH_ROLE_ACL_UPDATE_COMMAND_ID,
-  type AclUpdateResult,
-  type RoleAclUpdateInput,
-} from '@open-mercato/core/modules/auth/commands/acl'
+
+type TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }
 
 const getSchema = z.object({
   roleId: z.string().uuid(),
@@ -178,7 +175,7 @@ export async function PUT(req: Request) {
     }
   }
 
-  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
+  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })
   // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same
   // role's features in parallel cannot silently clobber each other (#2055). The
   // check is strictly additive — when the client sends no expected-version header
@@ -196,11 +193,18 @@ export async function PUT(req: Request) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
       throw err
     }
+  } else {
+    acl = em.create(RoleAcl, {
+      role,
+      tenantId: targetTenantId,
+      createdAt: new Date(),
+      isSuperAdmin: false,
+    })
   }
 
-  const existingIsSuperAdmin = !!acl?.isSuperAdmin
-  const existingFeatures = normalizeGrantFeatureList(acl?.featuresJson)
-  const existingOrganizations = normalizeOrganizations(acl?.organizationsJson)
+  const existingIsSuperAdmin = !!acl.isSuperAdmin
+  const existingFeatures = normalizeGrantFeatureList(acl.featuresJson)
+  const existingOrganizations = normalizeOrganizations(acl.organizationsJson)
   const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin
   const requestedFeatures = parsed.data.features === undefined
     ? existingFeatures
@@ -225,39 +229,32 @@ export async function PUT(req: Request) {
     throw err
   }
 
-  // Route the write through the command bus so the permission change lands in
-  // the action log. The command owns the transactional write and the RBAC cache
-  // invalidation that used to live here.
-  const commandBus = container.resolve('commandBus') as CommandBus
-  // A super admin may edit a role in another tenant. The actor's organization
-  // belongs to *their* tenant, and the command bus resolves the log row's
-  // organization as `metadata.organizationId ?? ctx.selectedOrganizationId ??
-  // ctx.auth.orgId` — a `??` chain, so a handler cannot express "explicitly no
-  // organization" on its own. Strip the organization from the context instead,
-  // otherwise the entry is stamped (target tenant, actor's foreign organization)
-  // and `ActionLogService` — which filters organization with strict equality —
-  // can never surface it for anyone.
-  const isForeignTenant = targetTenantId !== (auth.tenantId ?? null)
-  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null
-  const commandCtx: CommandRuntimeContext = {
-    container,
-    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
-    organizationScope: null,
-    selectedOrganizationId: actorOrgId,
-    organizationIds: actorOrgId ? [actorOrgId] : null,
-    request: req,
-  }
-  await commandBus.execute<RoleAclUpdateInput, AclUpdateResult>(AUTH_ROLE_ACL_UPDATE_COMMAND_ID, {
-    input: {
-      roleId: String(role.id),
-      tenantId: targetTenantId,
-      isSuperAdmin: requestedIsSuperAdmin,
-      features: requestedFeatures,
-      organizations: requestedOrganizations,
-    },
-    ctx: commandCtx,
-  })
+  // Persist the ACL mutation inside a transaction so the role-permission write
+  // commits atomically (proper ACL-edit transaction handling).
+  const aclToPersist = acl
+  await withAtomicFlush(
+    em,
+    [
+      () => {
+        aclToPersist.organizationsJson = requestedOrganizations
+        aclToPersist.isSuperAdmin = requestedIsSuperAdmin
+        aclToPersist.featuresJson = requestedFeatures
+        em.persist(aclToPersist)
+      },
+    ],
+    { transaction: true },
+  )
 
+  // Invalidate cache for all users in this tenant since role ACL changed
+  if (targetTenantId) {
+    await rbacService.invalidateTenantCache(targetTenantId)
+    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches
+    try {
+      const cache = container.resolve('cache') as TaggableCache | undefined
+      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`])
+    } catch {}
+  }
+  
   return NextResponse.json({
     ok: true,
     sanitized: false,

package/src/modules/auth/api/routeError.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server'
+import { createLogger } from '@open-mercato/shared/lib/logger'
+
+const logger = createLogger('auth.api')
+
+export type AuthRouteErrorOptions = {
+  /** Stable identifier for the failing route, e.g. `auth.login`. Logged, never returned. */
+  scope: string
+  /** Already-translated, user-safe message. Must not describe the underlying failure. */
+  message: string
+}
+
+/**
+ * Last-resort handler for an unexpected throw inside a public auth route.
+ *
+ * Without this, an infrastructure failure (database unreachable, DI container
+ * unable to build, a missing signing secret) escapes the handler and Next.js
+ * answers with a bare 500 carrying no body at all — nothing for the client to
+ * render and nothing in the response to tell an operator what broke. The
+ * failure then looks identical to a bug in the route itself.
+ *
+ * The cause is logged server-side under a stable scope so it is greppable in
+ * deployment logs; the response stays deliberately generic, because auth
+ * responses must never let an unauthenticated caller distinguish one failure
+ * from another.
+ */
+export function handleAuthRouteError(error: unknown, options: AuthRouteErrorOptions): NextResponse {
+  logger.error('Unhandled auth route error', { err: error, scope: options.scope })
+  return NextResponse.json({ ok: false, error: options.message }, { status: 500 })
+}

package/src/modules/auth/api/session/refresh.ts

@@ -2,7 +2,7 @@ import { NextResponse } from 'next/server'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
-import { isMfaPendingJwtPayload, signJwt, verifyJwt } from '@open-mercato/shared/lib/auth/jwt'
+import { signJwt } from '@open-mercato/shared/lib/auth/jwt'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { refreshSessionRequestSchema } from '@open-mercato/core/modules/auth/data/validators'
 import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
@@ -25,23 +25,6 @@ function parseCookie(req: Request, name: string): string | null {
   return m ? decodeURIComponent(m[1]) : null
 }
 
-// Both handlers are `requireAuth: false`, so the dispatcher's MFA-pending gate never inspects
-// this route's caller. Minting a full staff JWT for a browser that is still holding a provisional
-// `mfa_pending` token would hand it the access the outstanding second factor is meant to withhold,
-// so the pending credential is checked here directly. `refreshFromSessionToken` itself has no MFA
-// awareness — it validates only the token hash and expiry.
-function carriesMfaPendingToken(req: Request): boolean {
-  const authHeader = (req.headers.get('authorization') || '').trim()
-  const bearer = authHeader.toLowerCase().startsWith('bearer ') ? authHeader.slice(7).trim() : null
-  const token = bearer || parseCookie(req, 'auth_token')
-  if (!token) return false
-  try {
-    return isMfaPendingJwtPayload(verifyJwt(token))
-  } catch {
-    return false
-  }
-}
-
 type RefreshedSession = NonNullable<Awaited<ReturnType<AuthService['refreshFromSessionToken']>>>
 
 // Scope claims must stay absent rather than stringified when the user has no tenant/org:
@@ -81,11 +64,6 @@ export async function GET(req: Request) {
   const url = new URL(req.url)
   const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin
   const redirectTo = sanitizeRedirectPath(url.searchParams.get('redirect'), baseUrl, '/')
-  if (carriesMfaPendingToken(req)) {
-    return clearStaffAuthCookies(
-      buildSafeRedirectResponse(req, '/login?redirect=' + encodeURIComponent(redirectTo))
-    )
-  }
   const token = parseCookie(req, 'session_token')
   if (!token) {
     return clearStaffAuthCookies(
@@ -128,15 +106,6 @@ export async function POST(req: Request) {
   })
   if (rateLimitError) return rateLimitError
 
-  if (carriesMfaPendingToken(req)) {
-    return clearStaffAuthCookies(
-      NextResponse.json({
-        ok: false,
-        error: translate('auth.session.refresh.errors.invalidToken', 'Invalid or expired refresh token'),
-      }, { status: 401 })
-    )
-  }
-
   if (!token) {
     return clearStaffAuthCookies(
       NextResponse.json({