@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/auth/components/AclEditor.tsx

@@ -4,10 +4,14 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import Link from 'next/link'
 import { hasFeature, matchFeature } from '@open-mercato/shared/security/features'
-import { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'
+import { useT } from '@open-mercato/shared/lib/i18n/context'
 import type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'
 import { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'
 
+function toTitleCase(value: string): string {
+  return value.replace(/[-_.]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase())
+}
+
 function normalizeFeatureArray(input: unknown): string[] {
   if (!Array.isArray(input)) return []
   const dedup = new Set<string>()
@@ -26,16 +30,12 @@ function isTenantRestrictedFeature(feature: string): boolean {
   return false
 }
 
-function formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {
+function formatWildcardLabel(moduleId: string, wildcard: string): string {
   if (!wildcard.endsWith('.*')) return wildcard
   const prefix = `${moduleId}.`
   const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)
-  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')
-  const group = suffix
-    .split('.')
-    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase()))
-    .join(' / ')
-  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })
+  if (!suffix) return 'All features'
+  return `All ${suffix.split('.').map(toTitleCase).join(' / ')}`
 }
 
 type Feature = { id: string; title: string; module: string; dependsOn?: string[] }
@@ -257,28 +257,19 @@ export function AclEditor({
   const grouped = React.useMemo(() => {
     const moduleMap = new Map<string, string>()
     for (const m of modules) {
-      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))
+      moduleMap.set(m.id, m.title)
     }
     const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()
     for (const f of features) {
       const moduleId = f.module
       const moduleTitle = moduleMap.get(moduleId) || moduleId
-      const localizedFeature = {
-        ...f,
-        title: t(`auth.acl.features.${f.id}`, f.title),
-      }
       if (!map.has(moduleId)) {
         map.set(moduleId, { moduleId, moduleTitle, features: [] })
       }
-      map.get(moduleId)!.features.push(localizedFeature)
+      map.get(moduleId)!.features.push(f)
     }
     return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))
-  }, [features, modules, t])
-
-  const localizedFeatures = React.useMemo(
-    () => grouped.flatMap((group) => group.features),
-    [grouped],
-  )
+  }, [features, modules])
 
   const hasGlobalWildcard = granted.includes('*')
   const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0
@@ -314,28 +305,22 @@ export function AclEditor({
 
   const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)
 
-  if (loading) {
-    return (
-      <div className="text-sm text-muted-foreground">
-        {t('auth.acl.loading', 'Loading access control…')}
-      </div>
-    )
-  }
+  if (loading) return <div className="text-sm text-muted-foreground">Loading ACL…</div>
 
   const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled
 
   return (
     <div className="space-y-4">
       {showRoleBanner && (
-        <div className="rounded-lg border border-status-info-border bg-status-info-bg p-4">
-          <div className="text-sm font-medium text-status-info-text mb-2">
-            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}
+        <div className="rounded-lg border border-blue-200 bg-blue-50 p-4">
+          <div className="text-sm font-medium text-blue-900 mb-2">
+            Permissions inherited from roles
           </div>
-          <div className="text-sm text-status-info-text mb-3">
-            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}
+          <div className="text-sm text-blue-700 mb-3">
+            This user currently inherits permissions from their assigned roles.
             {roleDetails.length > 0 && (
               <span>
-                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}
+                {' '}Assigned roles:{' '}
                 {roleDetails.map((role, idx) => {
                   const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`
                   const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId
@@ -344,7 +329,7 @@ export function AclEditor({
                       {idx > 0 && ', '}
                       <Link 
                         href={`/backend/roles/${roleId}/edit`}
-                        className="font-semibold text-status-info-text underline"
+                        className="font-semibold text-blue-900 underline hover:text-blue-950 transition-colors"
                       >
                         {roleName}
                       </Link>
@@ -362,8 +347,8 @@ export function AclEditor({
               checked={overrideEnabled} 
               onChange={(e) => setOverrideEnabled(e.target.checked)} 
             />
-            <label htmlFor="overrideAcl" className="text-sm text-status-info-text font-medium">
-              {t('auth.acl.inherited.override', 'Override permissions for this user only')}
+            <label htmlFor="overrideAcl" className="text-sm text-blue-900 font-medium">
+              Override permissions for this user only
             </label>
           </div>
         </div>
@@ -379,39 +364,31 @@ export function AclEditor({
               disabled={!actorIsSuperAdmin}
               onChange={(e) => setIsSuperAdmin(!!e.target.checked)}
             />
-            <label htmlFor="isSuperAdmin" className="text-sm">
-              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}
-            </label>
+            <label htmlFor="isSuperAdmin" className="text-sm">Super Admin (all features)</label>
           </div>
           {!actorIsSuperAdmin && (
-            <p className="text-xs text-muted-foreground">
-              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}
-            </p>
+            <p className="text-xs text-muted-foreground">Only super administrators can change this option.</p>
           )}
       {!isSuperAdmin && (
         <>
           {hasGlobalWildcard && (
-            <div className="rounded border border-status-info-border bg-status-info-bg p-3">
-              <div className="text-sm font-medium text-status-info-text">
-                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}
-              </div>
-              <div className="text-xs text-status-info-text mt-1">
-                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}
-              </div>
+            <div className="rounded border border-blue-200 bg-blue-50 p-3">
+              <div className="text-sm font-medium text-blue-900">Global wildcard (*) enabled</div>
+              <div className="text-xs text-blue-700 mt-1">This grants access to all features in the system.</div>
               <Button
                 variant="outline"
                 size="sm"
                 className="mt-2"
                 onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}
               >
-                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}
+                Remove global wildcard
               </Button>
             </div>
           )}
           {!hasGlobalWildcard && (
             <AclDependencyDiagnosticsPanel
               granted={granted}
-              catalog={localizedFeatures as readonly FeatureDescriptor[]}
+              catalog={features as readonly FeatureDescriptor[]}
               onGrantedChange={updateGranted}
               hideUnknownReferences={process.env.NODE_ENV === 'production'}
             />
@@ -456,13 +433,8 @@ export function AclEditor({
                         onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} 
                       />
                       <label htmlFor={`module-${group.moduleId}`} className="text-sm text-muted-foreground">
-                        {t('auth.acl.allModuleFeatures', 'All')}{' '}
-                        {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-status-info-text">({group.moduleId}.*)</span> : ''}
-                        {moduleRestricted ? (
-                          <span className="ml-2 text-xs font-medium text-muted-foreground">
-                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}
-                          </span>
-                        ) : null}
+                        All {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-blue-600">({group.moduleId}.*)</span> : ''}
+                        {moduleRestricted ? <span className="ml-2 text-xs font-medium text-muted-foreground">(manage via super admin)</span> : null}
                       </label>
                     </div>
                   </div>
@@ -487,7 +459,7 @@ export function AclEditor({
                                 htmlFor={`wildcard-${wildcard}`}
                                 className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}
                               >
-                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}
+                                {formatWildcardLabel(group.moduleId, wildcard)}{' '}
                                 <span className="text-muted-foreground text-xs font-mono">({wildcard})</span>
                                 {wildcardRestricted ? (
                                   <span className="ml-2 text-xs font-medium text-muted-foreground">
@@ -563,9 +535,7 @@ export function AclEditor({
               <div className="text-sm font-medium mb-2">
                 {t('auth.acl.organizationsScope', 'Organizations scope')}
               </div>
-              <div className="text-xs text-muted-foreground mb-2">
-                {t('auth.acl.organizationsScopeHint', 'Empty means all organizations. Select one or more to restrict access.')}
-              </div>
+              <div className="text-xs text-muted-foreground mb-2">Empty = all organizations. Select one or more to restrict.</div>
               <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
                 {orgOptions.map((o) => {
                   const checked = organizations == null ? false : (organizations || []).includes(o.id)
@@ -587,7 +557,7 @@ export function AclEditor({
                 <Button variant="outline" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>
               </div>
               {showOrganizationWarning && (
-                <div className="mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text">
+                <div className="mt-3 rounded border border-amber-200 bg-amber-50 px-3 py-2 text-sm text-amber-900">
                   {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}
                 </div>
               )}

package/src/modules/auth/data/entities.ts

@@ -269,10 +269,7 @@ export class RoleAcl {
   @Property({ name: 'is_super_admin', type: 'boolean', default: false })
   isSuperAdmin: boolean = false
 
-  // Visible organizations within the tenant. `null` or the `__all__` sentinel means every
-  // organization. An EMPTY array is a deny-all scope for human principals — it projects to an
-  // empty accessible set so scoped reads and deletes fail closed (#4033). API-key principals
-  // read an empty list as "inherit the key's own organization binding" instead.
+  // Visible organizations within the tenant; null/empty means all organizations
   @Property({ name: 'organizations_json', type: 'json', nullable: true })
   organizationsJson?: string[] | null
 

package/src/modules/auth/data/validators.ts

@@ -20,10 +20,6 @@ export const confirmPasswordResetSchema = z.object({
   password: passwordSchema,
 })
 
-export const validatePasswordResetTokenSchema = z.object({
-  token: z.string().min(10),
-})
-
 export const refreshSessionRequestSchema = z.object({
   refreshToken: z.string().min(1),
 })
@@ -132,7 +128,6 @@ export const featureCheckRequestSchema = z.object({
 export type UserLoginInput = z.infer<typeof userLoginSchema>
 export type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>
 export type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>
-export type ValidatePasswordResetTokenInput = z.infer<typeof validatePasswordResetTokenSchema>
 export type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>
 export type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>
 export type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>

package/src/modules/auth/di.ts

@@ -2,7 +2,6 @@ import { asClass, asFunction } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
-import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import {
@@ -10,55 +9,26 @@ import {
   isRbacDefaultCacheEnabled,
   resetRbacFallbackCache,
 } from '@open-mercato/core/modules/auth/services/rbacDefaultCache'
-import { DefaultAuthPrincipalService } from './services/principalService'
 
 export { resetRbacFallbackCache }
 
-function resolveOptionalCache(container: AppContainer): CacheStrategy | undefined {
-  try {
-    return container.hasRegistration('cache')
-      ? container.resolve<CacheStrategy>('cache')
-      : undefined
-  } catch {
-    return undefined
-  }
-}
-
-function resolveOptionalOrganizationHierarchyService(
-  container: AppContainer,
-): OrganizationHierarchyService | undefined {
-  try {
-    if (!container.hasRegistration('organizationHierarchyService')) return undefined
-    const candidate = container.resolve<OrganizationHierarchyService>('organizationHierarchyService')
-    return typeof candidate?.resolveAncestorIds === 'function' ? candidate : undefined
-  } catch {
-    return undefined
-  }
-}
-
 export function register(container: AppContainer) {
   // Register or override core auth service
   container.register({ authService: asClass(AuthService).scoped() })
-  container.register({
-    authPrincipalService: asFunction(function authPrincipalServiceFactory(em: EntityManager) {
-      return new DefaultAuthPrincipalService(
-        em,
-        resolveOptionalOrganizationHierarchyService(container),
-      )
-    }).scoped(),
-  })
-  // Resolve optional infrastructure lazily so Auth still works when Directory
-  // is disabled and in lean CLI/test containers without a CacheStrategy.
-  // Setting `OM_RBAC_DEFAULT_CACHE=on` opts into the in-process fallback;
-  // an explicitly registered cache always wins.
-  container.register({
-    rbacService: asFunction(function rbacServiceFactory(em: EntityManager) {
-      const configuredCache = resolveOptionalCache(container)
-      return new RbacService(
-        em,
-        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : undefined),
-        resolveOptionalOrganizationHierarchyService(container),
-      )
-    }).scoped(),
-  })
+  // RBAC service. The bare `asClass(...).scoped()` registration matches
+  // develop and is the default. Setting `OM_RBAC_DEFAULT_CACHE=on` opts
+  // into the in-process LRU fallback for deployments that don't wire a
+  // shared CacheStrategy (CLI scripts, lean test bootstraps). Production
+  // bootstraps that already register `cache` via `@open-mercato/cache`
+  // preempt this fallback because the container's existing `cache`
+  // registration wins when `RbacService` reaches for it.
+  if (isRbacDefaultCacheEnabled()) {
+    container.register({
+      rbacService: asFunction((cradle: { em: EntityManager; cache?: CacheStrategy }) => {
+        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache())
+      }).scoped(),
+    })
+  } else {
+    container.register({ rbacService: asClass(RbacService).scoped() })
+  }
 }

package/src/modules/auth/frontend/reset/[token]/page.tsx

@@ -4,22 +4,17 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { useEffect, useState } from 'react'
-import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
-import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'
 
-type TokenState = 'checking' | 'usable' | 'expired'
-
 export default function ResetWithTokenPage({ params }: { params: { token: string } }) {
   const router = useRouter()
   const t = useT()
   const [error, setError] = useState<string | null>(null)
   const [submitting, setSubmitting] = useState(false)
   const [clientReady, setClientReady] = useState(false)
-  const [tokenState, setTokenState] = useState<TokenState>('checking')
   const passwordPolicy = getPasswordPolicy()
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)
   const passwordDescription = passwordRequirements
@@ -30,30 +25,6 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     setClientReady(true)
   }, [])
 
-  useEffect(() => {
-    let cancelled = false
-    async function checkToken() {
-      const body = new FormData()
-      body.set('token', params.token)
-      // Fail open whenever the check cannot answer — an unreachable or failing
-      // endpoint must not strand a user holding a perfectly good link, and the
-      // confirm endpoint still rejects a dead token on submit.
-      try {
-        const { ok, result } = await apiCall<{ ok?: boolean; valid?: boolean }>(
-          '/api/auth/reset/validate',
-          { method: 'POST', body },
-        )
-        if (cancelled) return
-        setTokenState(ok && result?.valid === false ? 'expired' : 'usable')
-      } catch {
-        if (cancelled) return
-        setTokenState('usable')
-      }
-    }
-    void checkToken()
-    return () => { cancelled = true }
-  }, [params.token])
-
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault()
     setError(null)
@@ -95,51 +66,6 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     }
   }
 
-  if (tokenState === 'checking') {
-    return (
-      <div className="min-h-svh flex items-center justify-center p-4">
-        <Card className="w-full max-w-sm">
-          <CardHeader>
-            <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>
-          </CardHeader>
-          <CardContent>
-            <div className="flex items-center gap-2 text-sm text-muted-foreground" data-auth-token-state="checking">
-              <Spinner size="sm" />
-              <span>{t('auth.reset.token.checking', 'Checking your reset link...')}</span>
-            </div>
-          </CardContent>
-        </Card>
-      </div>
-    )
-  }
-
-  if (tokenState === 'expired') {
-    return (
-      <div className="min-h-svh flex items-center justify-center p-4">
-        <Card className="w-full max-w-sm">
-          <CardHeader>
-            <CardTitle>{t('auth.reset.token.expiredTitle', 'This reset link is no longer valid')}</CardTitle>
-            <CardDescription>
-              {t('auth.reset.token.expiredSubtitle', 'It has already been used or has expired. Request a new link to set your password.')}
-            </CardDescription>
-          </CardHeader>
-          <CardContent>
-            <div className="grid gap-3" data-auth-token-state="expired">
-              <Button asChild className="w-full">
-                <Link href="/reset">{t('auth.reset.token.requestNew', 'Request a new link')}</Link>
-              </Button>
-              <div className="text-center">
-                <Link href="/login" className="text-xs text-muted-foreground underline">
-                  {t('auth.reset.backToLogin', 'Back to login')}
-                </Link>
-              </div>
-            </div>
-          </CardContent>
-        </Card>
-      </div>
-    )
-  }
-
   return (
     <div className="min-h-svh flex items-center justify-center p-4">
       <Card className="w-full max-w-sm">