@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/dist/modules/wms/components/backend/warehouseFormOptions.js

@@ -1,66 +0,0 @@
-import { buildCountryOptions, resolveCountryName } from "@open-mercato/shared/lib/location/countries";
-const OPTION_LIMIT = 100;
-function matchesQuery(haystack, query) {
-  return haystack.toLowerCase().includes(query.toLowerCase());
-}
-function countryOptionFromStored(value, locale) {
-  const trimmed = value.trim();
-  const code = trimmed.toUpperCase();
-  const label = resolveCountryName(code, { locale });
-  if (label && label !== code) {
-    return { value: code, label };
-  }
-  return { value: trimmed, label: trimmed };
-}
-function formatWarehouseCountryLabel(value, locale) {
-  const trimmed = value?.trim();
-  if (!trimmed) return "\u2014";
-  return countryOptionFromStored(trimmed, locale).label;
-}
-function timezoneOptionFromStored(value) {
-  const trimmed = value.trim();
-  return { value: trimmed, label: trimmed };
-}
-async function loadCountryOptions(query, locale) {
-  const options = buildCountryOptions({ locale }).map((entry) => ({
-    value: entry.code,
-    label: entry.label
-  }));
-  const term = query?.trim();
-  const filtered = term ? options.filter((option) => matchesQuery(option.label, term) || matchesQuery(option.value, term)) : options;
-  return filtered.slice(0, OPTION_LIMIT);
-}
-function resolveLocalTimeZone() {
-  try {
-    return Intl.DateTimeFormat().resolvedOptions().timeZone || void 0;
-  } catch {
-    return void 0;
-  }
-}
-function listSupportedTimeZones() {
-  try {
-    const intlWithSupportedValues = Intl;
-    if (typeof intlWithSupportedValues.supportedValuesOf !== "function") return [];
-    return intlWithSupportedValues.supportedValuesOf("timeZone").filter(Boolean);
-  } catch {
-    return [];
-  }
-}
-async function loadTimezoneOptions(query) {
-  const localZone = resolveLocalTimeZone();
-  const preferred = localZone && localZone !== "UTC" ? ["UTC", localZone] : ["UTC"];
-  const zones = /* @__PURE__ */ new Set([...preferred, ...listSupportedTimeZones()]);
-  const rest = Array.from(zones).filter((tz) => !preferred.includes(tz));
-  const allTz = [...preferred, ...rest];
-  const term = query?.trim();
-  const filtered = term ? allTz.filter((tz) => matchesQuery(tz, term)) : allTz;
-  return filtered.slice(0, OPTION_LIMIT).map((tz) => ({ value: tz, label: tz }));
-}
-export {
-  countryOptionFromStored,
-  formatWarehouseCountryLabel,
-  loadCountryOptions,
-  loadTimezoneOptions,
-  timezoneOptionFromStored
-};
-//# sourceMappingURL=warehouseFormOptions.js.map

package/dist/modules/wms/components/backend/warehouseFormOptions.js.map

@@ -1,7 +0,0 @@
-{
-  "version": 3,
-  "sources": ["../../../../../src/modules/wms/components/backend/warehouseFormOptions.ts"],
-  "sourcesContent": ["import type { CrudFieldOption } from '@open-mercato/ui/backend/CrudForm'\nimport { buildCountryOptions, resolveCountryName } from '@open-mercato/shared/lib/location/countries'\n\nconst OPTION_LIMIT = 100\n\nfunction matchesQuery(haystack: string, query: string): boolean {\n  return haystack.toLowerCase().includes(query.toLowerCase())\n}\n\nexport function countryOptionFromStored(value: string, locale?: string): CrudFieldOption {\n  const trimmed = value.trim()\n  const code = trimmed.toUpperCase()\n  const label = resolveCountryName(code, { locale })\n  if (label && label !== code) {\n    return { value: code, label }\n  }\n  return { value: trimmed, label: trimmed }\n}\n\nexport function formatWarehouseCountryLabel(value: string | null | undefined, locale?: string): string {\n  const trimmed = value?.trim()\n  if (!trimmed) return '\u2014'\n  return countryOptionFromStored(trimmed, locale).label\n}\n\nexport function timezoneOptionFromStored(value: string): CrudFieldOption {\n  const trimmed = value.trim()\n  return { value: trimmed, label: trimmed }\n}\n\nexport async function loadCountryOptions(query?: string, locale?: string): Promise<CrudFieldOption[]> {\n  const options = buildCountryOptions({ locale }).map((entry) => ({\n    value: entry.code,\n    label: entry.label,\n  }))\n  const term = query?.trim()\n  const filtered = term\n    ? options.filter((option) => matchesQuery(option.label, term) || matchesQuery(option.value, term))\n    : options\n  return filtered.slice(0, OPTION_LIMIT)\n}\n\nfunction resolveLocalTimeZone(): string | undefined {\n  try {\n    return Intl.DateTimeFormat().resolvedOptions().timeZone || undefined\n  } catch {\n    return undefined\n  }\n}\n\nfunction listSupportedTimeZones(): string[] {\n  try {\n    const intlWithSupportedValues = Intl as typeof Intl & { supportedValuesOf?: (input: 'timeZone') => string[] }\n    if (typeof intlWithSupportedValues.supportedValuesOf !== 'function') return []\n    return intlWithSupportedValues.supportedValuesOf('timeZone').filter(Boolean)\n  } catch {\n    return []\n  }\n}\n\nexport async function loadTimezoneOptions(query?: string): Promise<CrudFieldOption[]> {\n  const localZone = resolveLocalTimeZone()\n  const preferred = localZone && localZone !== 'UTC' ? ['UTC', localZone] : ['UTC']\n  const zones = new Set<string>([...preferred, ...listSupportedTimeZones()])\n  const rest = Array.from(zones).filter((tz) => !preferred.includes(tz))\n  const allTz = [...preferred, ...rest]\n  const term = query?.trim()\n  const filtered = term\n    ? allTz.filter((tz) => matchesQuery(tz, term))\n    : allTz\n  return filtered.slice(0, OPTION_LIMIT).map((tz) => ({ value: tz, label: tz }))\n}\n"],
-  "mappings": "AACA,SAAS,qBAAqB,0BAA0B;AAExD,MAAM,eAAe;AAErB,SAAS,aAAa,UAAkB,OAAwB;AAC9D,SAAO,SAAS,YAAY,EAAE,SAAS,MAAM,YAAY,CAAC;AAC5D;AAEO,SAAS,wBAAwB,OAAe,QAAkC;AACvF,QAAM,UAAU,MAAM,KAAK;AAC3B,QAAM,OAAO,QAAQ,YAAY;AACjC,QAAM,QAAQ,mBAAmB,MAAM,EAAE,OAAO,CAAC;AACjD,MAAI,SAAS,UAAU,MAAM;AAC3B,WAAO,EAAE,OAAO,MAAM,MAAM;AAAA,EAC9B;AACA,SAAO,EAAE,OAAO,SAAS,OAAO,QAAQ;AAC1C;AAEO,SAAS,4BAA4B,OAAkC,QAAyB;AACrG,QAAM,UAAU,OAAO,KAAK;AAC5B,MAAI,CAAC,QAAS,QAAO;AACrB,SAAO,wBAAwB,SAAS,MAAM,EAAE;AAClD;AAEO,SAAS,yBAAyB,OAAgC;AACvE,QAAM,UAAU,MAAM,KAAK;AAC3B,SAAO,EAAE,OAAO,SAAS,OAAO,QAAQ;AAC1C;AAEA,eAAsB,mBAAmB,OAAgB,QAA6C;AACpG,QAAM,UAAU,oBAAoB,EAAE,OAAO,CAAC,EAAE,IAAI,CAAC,WAAW;AAAA,IAC9D,OAAO,MAAM;AAAA,IACb,OAAO,MAAM;AAAA,EACf,EAAE;AACF,QAAM,OAAO,OAAO,KAAK;AACzB,QAAM,WAAW,OACb,QAAQ,OAAO,CAAC,WAAW,aAAa,OAAO,OAAO,IAAI,KAAK,aAAa,OAAO,OAAO,IAAI,CAAC,IAC/F;AACJ,SAAO,SAAS,MAAM,GAAG,YAAY;AACvC;AAEA,SAAS,uBAA2C;AAClD,MAAI;AACF,WAAO,KAAK,eAAe,EAAE,gBAAgB,EAAE,YAAY;AAAA,EAC7D,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,SAAS,yBAAmC;AAC1C,MAAI;AACF,UAAM,0BAA0B;AAChC,QAAI,OAAO,wBAAwB,sBAAsB,WAAY,QAAO,CAAC;AAC7E,WAAO,wBAAwB,kBAAkB,UAAU,EAAE,OAAO,OAAO;AAAA,EAC7E,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAsB,oBAAoB,OAA4C;AACpF,QAAM,YAAY,qBAAqB;AACvC,QAAM,YAAY,aAAa,cAAc,QAAQ,CAAC,OAAO,SAAS,IAAI,CAAC,KAAK;AAChF,QAAM,QAAQ,oBAAI,IAAY,CAAC,GAAG,WAAW,GAAG,uBAAuB,CAAC,CAAC;AACzE,QAAM,OAAO,MAAM,KAAK,KAAK,EAAE,OAAO,CAAC,OAAO,CAAC,UAAU,SAAS,EAAE,CAAC;AACrE,QAAM,QAAQ,CAAC,GAAG,WAAW,GAAG,IAAI;AACpC,QAAM,OAAO,OAAO,KAAK;AACzB,QAAM,WAAW,OACb,MAAM,OAAO,CAAC,OAAO,aAAa,IAAI,IAAI,CAAC,IAC3C;AACJ,SAAO,SAAS,MAAM,GAAG,YAAY,EAAE,IAAI,CAAC,QAAQ,EAAE,OAAO,IAAI,OAAO,GAAG,EAAE;AAC/E;",
-  "names": []
-}

package/src/modules/api_keys/di.ts

@@ -1,7 +0,0 @@
-import { asClass } from 'awilix'
-import type { AppContainer } from '@open-mercato/shared/lib/di/container'
-import { DefaultApiKeyPrincipalService } from './services/principalService'
-
-export function register(container: AppContainer) {
-  container.register({ apiKeyPrincipalService: asClass(DefaultApiKeyPrincipalService).scoped() })
-}

package/src/modules/api_keys/services/principalService.ts

@@ -1,33 +0,0 @@
-import type { FilterQuery } from '@mikro-orm/core'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { ApiKeyPrincipalService, PrincipalScope } from '@open-mercato/shared/lib/auth/principal-service'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { ApiKey } from '../data/entities'
-
-function normalizeIds(ids: unknown): string[] {
-  if (!Array.isArray(ids)) return []
-  return Array.from(new Set(ids
-    .map((id) => typeof id === 'string' ? id.trim() : '')
-    .filter(Boolean)))
-}
-
-export class DefaultApiKeyPrincipalService implements ApiKeyPrincipalService {
-  constructor(private readonly em: EntityManager) {}
-
-  async resolveAssignedRoleIds(apiKeyId: string, scope: PrincipalScope): Promise<string[]> {
-    const apiKey = await findOneWithDecryption(
-      this.em,
-      ApiKey,
-      {
-        id: apiKeyId,
-        tenantId: scope.tenantId,
-        deletedAt: null,
-        $or: [{ organizationId: null }, { organizationId: scope.organizationId }],
-      } as FilterQuery<ApiKey>,
-      { fields: ['rolesJson', 'expiresAt'] as const },
-      scope,
-    )
-    if (!apiKey || (apiKey.expiresAt && apiKey.expiresAt.getTime() <= Date.now())) return []
-    return normalizeIds(apiKey.rolesJson)
-  }
-}

package/src/modules/attachments/lib/attachment-service.ts

@@ -1,468 +0,0 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
-import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-import { Attachment, AttachmentPartition } from '../data/entities'
-import { assertAttachmentScopeInvariant, checkAttachmentAccess } from './access'
-import type { StorageDriverFactory } from './drivers'
-import { buildAttachmentFileUrl } from './imageUrls'
-import {
-  isScopedAttachmentUploadError,
-  type ScopedAttachmentUploadErrorCode,
-  type ScopedAttachmentUploadService,
-} from './scoped-upload-service'
-import { readAttachmentMetadata, type AttachmentAssignment } from './metadata'
-import {
-  buildAttachmentContentDisposition,
-  canRenderInlineAttachment,
-  hasDangerousExecutableExtension,
-} from './security'
-import {
-  isMultipartRequestWithinUploadLimit,
-  resolveAttachmentMaxBytes,
-  resolveAttachmentMultipartMaxBytes,
-} from './upload-limits'
-
-const logger = createLogger('attachments').child({ component: 'attachment-service' })
-
-type AttachmentErrorMessage = {
-  key: string
-  fallback: string
-}
-
-/**
- * The scoped upload service reports failures as machine codes. Each maps to the
- * translation key the public attachment route uses for the same condition, and
- * the key is resolved server-side before it reaches the response body — clients
- * render the `error` field verbatim, so handing them a raw key would surface
- * `attachments.errors.quotaExceeded` as the user-facing message.
- */
-const SCOPED_UPLOAD_ERROR_MESSAGES: Record<ScopedAttachmentUploadErrorCode, AttachmentErrorMessage> = {
-  dangerous_executable: {
-    key: 'attachments.errors.dangerousExecutable',
-    fallback: 'Executable file types are not allowed as attachments.',
-  },
-  max_upload_size: {
-    key: 'attachments.errors.maxUploadSize',
-    fallback: 'Attachment exceeds the maximum upload size.',
-  },
-  active_content: {
-    key: 'attachments.errors.activeContentBlocked',
-    fallback: 'Active content uploads are not allowed.',
-  },
-  partition_unavailable: {
-    key: 'attachments.errors.partitionUnavailable',
-    fallback: 'Attachment partition is not available for this scope.',
-  },
-  quota_exceeded: {
-    key: 'attachments.errors.quotaExceeded',
-    fallback: 'Attachment storage quota exceeded for this tenant.',
-  },
-  quota_target_exists: {
-    key: 'attachments.errors.storagePathExists',
-    fallback: 'The target storage path already exists.',
-  },
-  quota_unavailable: {
-    key: 'attachments.errors.quotaUnavailable',
-    fallback: 'Storage quota accounting is unavailable.',
-  },
-  quota_recovery_unsupported: {
-    key: 'attachments.errors.quotaRecoveryUnsupported',
-    fallback: 'Storage driver cannot participate in quota recovery.',
-  },
-  storage_failed: {
-    key: 'attachments.errors.storageFailed',
-    fallback: 'Failed to store the attachment file.',
-  },
-  persistence_failed: {
-    key: 'attachments.errors.persistenceFailed',
-    fallback: 'Failed to persist attachment.',
-  },
-}
-
-const UPLOAD_FAILED_MESSAGE: AttachmentErrorMessage = {
-  key: 'attachments.errors.uploadFailed',
-  fallback: 'Attachment upload failed.',
-}
-
-const UPLOAD_SERVICE_UNAVAILABLE_MESSAGE: AttachmentErrorMessage = {
-  key: 'attachments.errors.uploadServiceUnavailable',
-  fallback: 'The attachment upload service is not available.',
-}
-
-async function translateAttachmentError(message: AttachmentErrorMessage): Promise<string> {
-  const { t } = await resolveTranslations()
-  return t(message.key, message.fallback)
-}
-
-export type AttachmentOwner = {
-  entityId: string
-  recordId: string
-}
-
-export type CreateScopedAttachmentInput = AttachmentOwner & {
-  tenantId: string
-  organizationId: string
-  partitionCode: string
-  fileName: string
-  declaredMimeType?: string | null
-  buffer: Buffer
-  assignments?: AttachmentAssignment[]
-  /**
-   * Persists a module-owned link inside the same transaction as the Attachment
-   * row. The callback receives only the generated id, never an Attachment
-   * entity or storage implementation.
-   */
-  persistLink?: (tx: EntityManager, attachmentId: string) => Promise<void> | void
-}
-
-export type CreatedScopedAttachment = {
-  id: string
-  url: string
-  fileName: string
-  mimeType: string
-  fileSize: number
-}
-
-export type ReadScopedAttachmentInput = {
-  attachmentId: string
-  auth: NonNullable<AuthContext>
-  expectedOwner: AttachmentOwner
-  expectedAssignment?: AttachmentAssignment
-  expectedPartitionCode?: string
-  requirePrivatePartition?: boolean
-  forceDownload?: boolean
-}
-
-export type ReadScopedAttachmentResult = {
-  buffer: Buffer
-  contentType: string
-  contentDisposition: string
-  fileName: string
-  mimeType: string
-}
-
-export type ReleaseScopedAttachmentInput = {
-  attachmentId: string
-  tenantId: string
-  organizationId: string
-  expectedOwner: AttachmentOwner
-  /**
-   * Required: releasing an attachment deletes the row *and* the provider bytes,
-   * so the caller must name the one assignment it owns. The release only
-   * proceeds when that assignment is the attachment's sole reference.
-   */
-  expectedAssignment: AttachmentAssignment
-  expectedPartitionCode?: string
-}
-
-export type AttachmentProviderCleanup = () => Promise<void>
-
-export interface AttachmentService {
-  validateUpload(input: {
-    contentLength?: string | null
-    fileName?: string
-    fileSize?: number
-  }): void
-  readUploadForm?(request: Request): Promise<FormData>
-  createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment>
-  readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult>
-  releaseScoped?(
-    input: ReleaseScopedAttachmentInput,
-    options?: { em?: EntityManager; flush?: boolean },
-  ): Promise<AttachmentProviderCleanup | void>
-}
-
-async function readRequestBodyWithinLimit(request: Request, maxBytes: number): Promise<Uint8Array> {
-  const reader = request.body?.getReader()
-  if (!reader) throw new CrudHttpError(400, { error: 'File is required' })
-  const chunks: Uint8Array[] = []
-  let totalBytes = 0
-  try {
-    while (true) {
-      const { done, value } = await reader.read()
-      if (done) break
-      totalBytes += value.byteLength
-      if (totalBytes > maxBytes) {
-        await reader.cancel()
-        throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
-      }
-      chunks.push(value)
-    }
-  } finally {
-    reader.releaseLock()
-  }
-  const body = new Uint8Array(totalBytes)
-  let offset = 0
-  for (const chunk of chunks) {
-    body.set(chunk, offset)
-    offset += chunk.byteLength
-  }
-  return body
-}
-
-
-function assignmentMatches(candidate: AttachmentAssignment, expected: AttachmentAssignment): boolean {
-  return candidate.type === expected.type && candidate.id === expected.id
-}
-
-function partitionMatchesScope(
-  partition: AttachmentPartition,
-  tenantId: string | null | undefined,
-  organizationId: string | null | undefined,
-): boolean {
-  const partitionTenantId = partition.tenantId ?? null
-  const partitionOrganizationId = partition.organizationId ?? null
-  if (partitionTenantId === null && partitionOrganizationId === null) return true
-  if (partitionTenantId === null || partitionOrganizationId === null) return false
-  return partitionTenantId === tenantId && partitionOrganizationId === organizationId
-}
-
-export class DefaultAttachmentService implements AttachmentService {
-  /**
-   * The scoped upload service is supplied as a *resolver*, not an instance:
-   * resolving it eagerly would drag its own dependencies (notably `dataEngine`)
-   * into every container that merely constructs an `attachmentService`, even
-   * one that never uploads. `createScoped` requires it — module uploads must
-   * share the one reservation ledger rather than run a parallel quota
-   * mechanism — so its absence surfaces there, at the call that needs it.
-   */
-  constructor(
-    private readonly em: EntityManager,
-    private readonly storageDriverFactory: StorageDriverFactory,
-    private readonly resolveScopedUploadService?: (() => ScopedAttachmentUploadService | null) | null,
-  ) {}
-
-  validateUpload(input: {
-    contentLength?: string | null
-    fileName?: string
-    fileSize?: number
-  }): void {
-    if (!isMultipartRequestWithinUploadLimit(input.contentLength ?? null)) {
-      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
-    }
-    if (input.fileName && hasDangerousExecutableExtension(input.fileName)) {
-      throw new CrudHttpError(400, { error: 'Executable file types are not allowed as attachments.' })
-    }
-    if (typeof input.fileSize === 'number' && input.fileSize > resolveAttachmentMaxBytes(null)) {
-      throw new CrudHttpError(413, { error: 'Attachment exceeds the maximum upload size.' })
-    }
-  }
-
-  async readUploadForm(request: Request): Promise<FormData> {
-    this.validateUpload({ contentLength: request.headers.get('content-length') })
-    const contentType = request.headers.get('content-type') ?? ''
-    if (!contentType.toLowerCase().includes('multipart/form-data')) {
-      throw new CrudHttpError(400, { error: 'Expected multipart/form-data' })
-    }
-    const body = await readRequestBodyWithinLimit(request, resolveAttachmentMultipartMaxBytes())
-    const responseBody = body.buffer.slice(body.byteOffset, body.byteOffset + body.byteLength) as ArrayBuffer
-    try {
-      return await new Response(responseBody, { headers: { 'content-type': contentType } }).formData()
-    } catch {
-      throw new CrudHttpError(400, { error: 'Invalid multipart/form-data' })
-    }
-  }
-
-  async createScoped(input: CreateScopedAttachmentInput): Promise<CreatedScopedAttachment> {
-    assertAttachmentScopeInvariant(input)
-    this.validateUpload({ fileName: input.fileName, fileSize: input.buffer.length })
-
-    // Delegate to the platform's scoped upload service rather than repeating its
-    // work. It owns the fenced quota lease (reserve → storing → stored →
-    // complete) that the recovery worker reconciles, writes to the provider
-    // outside the database transaction, and emits the attachment CRUD side
-    // effects. The previous implementation here ran a *second*, independent
-    // quota mechanism on a different advisory-lock key that counted only
-    // committed rows, so it could not see an in-flight reservation from the
-    // public attachment route and the two paths could jointly exceed a tenant's
-    // quota — and it wrote to storage inside the transaction, so a crash before
-    // commit left bytes nothing accounted for.
-    let uploadService: ScopedAttachmentUploadService | null = null
-    try {
-      uploadService = this.resolveScopedUploadService?.() ?? null
-    } catch (error) {
-      logger.error('Scoped attachment upload service could not be resolved', { err: error })
-    }
-    if (!uploadService) {
-      throw new CrudHttpError(500, {
-        error: await translateAttachmentError(UPLOAD_SERVICE_UNAVAILABLE_MESSAGE),
-      })
-    }
-
-    let attachment: Attachment
-    try {
-      attachment = await uploadService.upload({
-        tenantId: input.tenantId,
-        organizationId: input.organizationId,
-        entityId: input.entityId,
-        recordId: input.recordId,
-        fileName: input.fileName,
-        buffer: input.buffer,
-        declaredMimeType: input.declaredMimeType ?? null,
-        assignments: input.assignments,
-        partitionCode: input.partitionCode,
-        requirePrivatePartition: true,
-        persistLink: input.persistLink,
-      })
-    } catch (error) {
-      if (isScopedAttachmentUploadError(error)) {
-        const message = SCOPED_UPLOAD_ERROR_MESSAGES[error.code] ?? UPLOAD_FAILED_MESSAGE
-        throw new CrudHttpError(error.status, { error: await translateAttachmentError(message) })
-      }
-      throw error
-    }
-
-    return {
-      id: attachment.id,
-      url: attachment.url ?? buildAttachmentFileUrl(attachment.id),
-      fileName: attachment.fileName,
-      mimeType: attachment.mimeType,
-      fileSize: attachment.fileSize,
-    }
-  }
-
-  async readScoped(input: ReadScopedAttachmentInput): Promise<ReadScopedAttachmentResult> {
-    // Scope the lookup at the database boundary so a foreign-tenant row is
-    // never materialized, then keep checkAttachmentAccess below as defense in
-    // depth. This service only ever stores fully scoped rows, so global rows
-    // and super-admin status deliberately do not widen the requested scope —
-    // a super admin reads another tenant's attachment by switching scope, not
-    // by bypassing the filter.
-    const attachment = await findOneWithDecryption(
-      this.em,
-      Attachment,
-      {
-        id: input.attachmentId,
-        tenantId: input.auth.tenantId ?? null,
-        organizationId: input.auth.orgId ?? null,
-      },
-      undefined,
-      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },
-    )
-    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })
-    const partition = await findOneWithDecryption(
-      this.em,
-      AttachmentPartition,
-      { code: attachment.partitionCode },
-      undefined,
-      { tenantId: input.auth.tenantId, organizationId: input.auth.orgId },
-    )
-    if (!partition) throw new CrudHttpError(500, { error: 'Attachment partition is not configured' })
-
-    const access = checkAttachmentAccess(input.auth, attachment, partition, { requireAuthForPublic: true })
-    if (!access.ok) {
-      throw new CrudHttpError(access.status, { error: access.status === 401 ? 'Unauthorized' : 'Forbidden' })
-    }
-    if (!partitionMatchesScope(partition, input.auth.tenantId, input.auth.orgId)) {
-      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this scope' })
-    }
-    if (input.requirePrivatePartition && partition.isPublic) {
-      throw new CrudHttpError(403, { error: 'Attachment partition is not accessible for this resource' })
-    }
-    if (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode) {
-      throw new CrudHttpError(404, { error: 'Attachment not found' })
-    }
-    if (
-      attachment.entityId !== input.expectedOwner.entityId ||
-      attachment.recordId !== input.expectedOwner.recordId
-    ) {
-      throw new CrudHttpError(404, { error: 'Attachment not found' })
-    }
-    if (input.expectedAssignment) {
-      const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []
-      if (!assignments.some((candidate) => assignmentMatches(candidate, input.expectedAssignment!))) {
-        throw new CrudHttpError(404, { error: 'Attachment not found' })
-      }
-    }
-
-    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, {
-      tenantId: attachment.tenantId ?? '',
-      organizationId: attachment.organizationId ?? '',
-    })
-    let result: Awaited<ReturnType<typeof driver.read>>
-    try {
-      result = await driver.read(attachment.partitionCode, attachment.storagePath)
-    } catch {
-      throw new CrudHttpError(404, { error: 'File not available' })
-    }
-
-    const mimeType = attachment.mimeType || 'application/octet-stream'
-    const renderInline = !input.forceDownload && canRenderInlineAttachment(mimeType)
-    return {
-      buffer: result.buffer,
-      contentType: renderInline ? result.contentType ?? mimeType : 'application/octet-stream',
-      contentDisposition: buildAttachmentContentDisposition(
-        attachment.fileName,
-        renderInline ? 'inline' : 'attachment',
-      ),
-      fileName: attachment.fileName,
-      mimeType,
-    }
-  }
-
-  async releaseScoped(
-    input: ReleaseScopedAttachmentInput,
-    options: { em?: EntityManager; flush?: boolean } = {},
-  ): Promise<AttachmentProviderCleanup | void> {
-    const em = options.em ?? this.em
-    // The type makes `expectedAssignment` mandatory, but this service is handed
-    // out through untyped DI resolution and consumed through structural ports in
-    // other packages, so the shared-reference guard is enforced at runtime too:
-    // without it a caller could destroy an attachment other records still link.
-    const expectedAssignment = input.expectedAssignment
-    if (!expectedAssignment) {
-      throw new CrudHttpError(500, {
-        error: 'Attachment release requires the expected assignment of the releasing record',
-      })
-    }
-    const isInTransaction = (em as { isInTransaction?: () => boolean }).isInTransaction
-    if (
-      options.flush !== false
-      && typeof isInTransaction === 'function'
-      && isInTransaction.call(em)
-    ) {
-      throw new CrudHttpError(500, {
-        error: 'Attachment release inside an ambient transaction requires flush: false and deferred provider cleanup',
-      })
-    }
-    const scope = { tenantId: input.tenantId, organizationId: input.organizationId }
-    const attachment = await findOneWithDecryption(
-      em,
-      Attachment,
-      {
-        id: input.attachmentId,
-        tenantId: input.tenantId,
-        organizationId: input.organizationId,
-      },
-      undefined,
-      scope,
-    )
-    if (!attachment) throw new CrudHttpError(404, { error: 'Attachment not found' })
-    if (
-      attachment.entityId !== input.expectedOwner.entityId
-      || attachment.recordId !== input.expectedOwner.recordId
-      || (input.expectedPartitionCode && attachment.partitionCode !== input.expectedPartitionCode)
-    ) {
-      throw new CrudHttpError(404, { error: 'Attachment not found' })
-    }
-    const assignments = readAttachmentMetadata(attachment.storageMetadata).assignments ?? []
-    if (!assignments.some((candidate) => assignmentMatches(candidate, expectedAssignment))) {
-      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })
-    }
-    if (assignments.some((candidate) => !assignmentMatches(candidate, expectedAssignment))) {
-      throw new CrudHttpError(409, { error: 'Attachment is still referenced by another record' })
-    }
-
-    const driver = await this.storageDriverFactory.resolveForPartition(attachment.partitionCode, scope)
-    const deleteProviderBytes = () => driver.delete(attachment.partitionCode, attachment.storagePath)
-    em.remove(attachment)
-    if (options.flush === false) {
-      return deleteProviderBytes
-    }
-    await em.flush()
-    await deleteProviderBytes()
-  }
-}

package/src/modules/auth/api/reset/validate.ts

@@ -1,57 +0,0 @@
-import { validatePasswordResetTokenSchema } from '@open-mercato/core/modules/auth/data/validators'
-import { NextResponse } from 'next/server'
-import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
-import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
-import { z } from 'zod'
-import { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'
-import { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'
-import { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'
-
-const resetValidateRateLimitConfig = readEndpointRateLimitConfig('RESET_VALIDATE', {
-  points: 10, duration: 300, keyPrefix: 'reset-validate',
-})
-
-export async function POST(req: Request) {
-  const form = await req.formData()
-  const token = String(form.get('token') ?? '')
-  // Rate limit by IP — checked before validation and DB work
-  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig })
-  if (rateLimitError) return rateLimitError
-  const parsed = validatePasswordResetTokenSchema.safeParse({ token })
-  // A malformed token is reported as simply not valid: the caller learns nothing
-  // it could not learn by posting the same token to /api/auth/reset/confirm.
-  if (!parsed.success) return NextResponse.json({ ok: true, valid: false })
-  const container = await createRequestContainer()
-  const auth = container.resolve<AuthService>('authService')
-  const valid = await auth.isPasswordResetTokenValid(parsed.data.token)
-  return NextResponse.json({ ok: true, valid })
-}
-
-export const metadata = { requireAuth: false }
-
-const passwordResetValidateResponseSchema = z.object({
-  ok: z.literal(true),
-  valid: z.boolean(),
-})
-
-export const openApi: OpenApiRouteDoc = {
-  tag: 'Authentication & Accounts',
-  summary: 'Check a password reset token',
-  methods: {
-    POST: {
-      summary: 'Check whether a password reset token is still usable',
-      description: 'Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.',
-      requestBody: {
-        contentType: 'application/x-www-form-urlencoded',
-        schema: validatePasswordResetTokenSchema,
-      },
-      responses: [
-        { status: 200, description: 'Token state resolved', schema: passwordResetValidateResponseSchema },
-      ],
-      errors: [
-        { status: 429, description: 'Too many token validation attempts', schema: rateLimitErrorSchema },
-      ],
-    },
-  },
-}