@open-mercato/core 0.6.8-develop.7100.1.fbf66fca35 → 0.7.0

package/src/modules/auth/services/principalService.ts

@@ -1,266 +0,0 @@
-import type { FilterQuery } from '@mikro-orm/core'
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { sql } from 'kysely'
-import type {
-  AuthPrincipalLabel,
-  AuthPrincipalRolePage,
-  AuthPrincipalService,
-  OrganizationHierarchyService,
-  PrincipalScope,
-} from '@open-mercato/shared/lib/auth/principal-service'
-import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'
-import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { Role, RoleAcl, User, UserRole } from '../data/entities'
-import { listSuperAdminUserIds } from '../lib/grantChecks'
-import { resolveRoleOrganizationScope, roleAclGrantsPrincipalOrganization } from './roleOrganizationScope'
-
-const MAX_ROLE_PAGE_SIZE = 100
-const MAX_ROLE_RESULTS = 1_000
-
-type AuthPrincipalDatabase = {
-  roles: {
-    id: string
-    tenant_id: string
-    name: string
-    deleted_at: Date | null
-  }
-  role_acls: {
-    role_id: string
-    tenant_id: string
-    organizations_json: string[] | null
-    deleted_at: Date | null
-  }
-}
-
-function normalizeIds(ids: string[]): string[] {
-  return Array.from(new Set(ids.map((id) => id.trim()).filter(Boolean)))
-}
-
-function relationId(value: unknown): string | null {
-  if (typeof value === 'string') return value.trim() || null
-  if (!value || typeof value !== 'object') return null
-  const id = (value as { id?: unknown }).id
-  return typeof id === 'string' && id.trim().length > 0 ? id.trim() : null
-}
-
-export class DefaultAuthPrincipalService implements AuthPrincipalService {
-  constructor(
-    private readonly em: EntityManager,
-    private readonly organizationHierarchyService?: OrganizationHierarchyService,
-  ) {}
-
-  async principalExists(input: {
-    type: 'user' | 'role'
-    id: string
-    scope: PrincipalScope
-  }): Promise<boolean> {
-    if (input.type === 'role') {
-      return (await this.filterActiveRoleIds([input.id], input.scope)).includes(input.id)
-    }
-    return Boolean(await findOneWithDecryption(
-      this.em,
-      User,
-      {
-        id: input.id,
-        tenantId: input.scope.tenantId,
-        deletedAt: null,
-        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],
-      } as FilterQuery<User>,
-      { fields: ['id'] as const },
-      input.scope,
-    ))
-  }
-
-  async resolveActiveUserRoleIds(userId: string, scope: PrincipalScope): Promise<string[]> {
-    const links = await findWithDecryption(
-      this.em,
-      UserRole,
-      {
-        user: userId,
-        deletedAt: null,
-        role: { tenantId: scope.tenantId, deletedAt: null },
-      } as FilterQuery<UserRole>,
-      { fields: ['role'] as const },
-      scope,
-    )
-    return this.filterActiveRoleIds(
-      normalizeIds(links.flatMap((link) => {
-        const id = relationId(link.role)
-        return id ? [id] : []
-      })),
-      scope,
-    )
-  }
-
-  async filterActiveRoleIds(roleIds: string[], scope: PrincipalScope): Promise<string[]> {
-    const ids = normalizeIds(roleIds)
-    if (ids.length === 0) return []
-    const roles = await findWithDecryption(
-      this.em,
-      Role,
-      { id: { $in: ids }, tenantId: scope.tenantId, deletedAt: null } as FilterQuery<Role>,
-      { fields: ['id'] as const },
-      scope,
-    )
-    const activeIds = normalizeIds(roles.map((role) => role.id))
-    if (activeIds.length === 0) return []
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      scope.tenantId,
-      scope.organizationId,
-    )
-    const acls = await findWithDecryption(
-      this.em,
-      RoleAcl,
-      {
-        tenantId: scope.tenantId,
-        role: { $in: activeIds },
-        deletedAt: null,
-      } as FilterQuery<RoleAcl>,
-      { fields: ['role', 'organizationsJson'] as const },
-      scope,
-    )
-    const eligibilityById = new Map<string, boolean>()
-    for (const acl of acls) {
-      const id = relationId(acl.role)
-      if (!id) continue
-      eligibilityById.set(
-        id,
-        eligibilityById.get(id) === true || roleAclGrantsPrincipalOrganization(acl, roleOrganizationScope),
-      )
-    }
-    // A tenant role without an ACL remains a valid explicit-share principal.
-    // Only an existing ACL can restrict that role away from this organization.
-    return activeIds.filter((id) => eligibilityById.get(id) !== false)
-  }
-
-  async resolveLabels(input: {
-    type: 'user' | 'role'
-    ids: string[]
-    scope: PrincipalScope
-  }): Promise<AuthPrincipalLabel[]> {
-    const ids = normalizeIds(input.ids)
-    if (ids.length === 0) return []
-    if (input.type === 'role') {
-      const eligibleIds = await this.filterActiveRoleIds(ids, input.scope)
-      if (eligibleIds.length === 0) return []
-      const roles = await findWithDecryption(
-        this.em,
-        Role,
-        { id: { $in: eligibleIds }, tenantId: input.scope.tenantId, deletedAt: null } as FilterQuery<Role>,
-        { fields: ['id', 'name'] as const },
-        input.scope,
-      )
-      return roles.map((role) => ({ id: role.id, label: role.name, secondary: null }))
-    }
-    const users = await findWithDecryption(
-      this.em,
-      User,
-      {
-        id: { $in: ids },
-        tenantId: input.scope.tenantId,
-        deletedAt: null,
-        $or: [{ organizationId: null }, { organizationId: input.scope.organizationId }],
-      } as FilterQuery<User>,
-      { fields: ['id', 'name', 'email'] as const },
-      input.scope,
-    )
-    return users.map((user) => ({
-      id: user.id,
-      label: user.name?.trim() || user.email,
-      secondary: user.name?.trim() && user.email !== user.name.trim() ? user.email : null,
-    }))
-  }
-
-  async queryActiveRolePage(input: {
-    scope: PrincipalScope
-    search?: string
-    excludedIds?: string[]
-    page: number
-    pageSize: number
-  }): Promise<AuthPrincipalRolePage> {
-    const page = Math.max(1, Math.floor(input.page))
-    const pageSize = Math.min(MAX_ROLE_PAGE_SIZE, Math.max(1, Math.floor(input.pageSize)))
-    const offset = (page - 1) * pageSize
-    const excludedIds = normalizeIds(input.excludedIds ?? [])
-    const roleOrganizationScope = await resolveRoleOrganizationScope(
-      this.organizationHierarchyService,
-      input.scope.tenantId,
-      input.scope.organizationId,
-    )
-    const db = this.em.getKysely<AuthPrincipalDatabase>()
-    let eligibleRoles = db
-      .selectFrom('roles as r')
-      .where('r.tenant_id', '=', input.scope.tenantId)
-      .where('r.deleted_at', 'is', null)
-
-    if (roleOrganizationScope) {
-      const allowedOrganizations = Array.from(roleOrganizationScope)
-      const organizationPredicates = [
-        sql<boolean>`ra.organizations_json is null`,
-        sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify(['__all__'])}::jsonb`,
-        ...allowedOrganizations.map((organizationId) => (
-          sql<boolean>`ra.organizations_json::jsonb @> ${JSON.stringify([organizationId])}::jsonb`
-        )),
-      ]
-      const organizationAllowed = sql<boolean>`(${sql.join(organizationPredicates, sql` or `)})`
-      eligibleRoles = eligibleRoles.where(sql<boolean>`(
-        not exists (
-          select 1
-          from role_acls as ra_any
-          where ra_any.role_id = r.id
-            and ra_any.tenant_id = ${input.scope.tenantId}
-            and ra_any.deleted_at is null
-        )
-        or exists (
-          select 1
-          from role_acls as ra
-          where ra.role_id = r.id
-            and ra.tenant_id = ${input.scope.tenantId}
-            and ra.deleted_at is null
-            and ${organizationAllowed}
-        )
-      )`)
-    }
-    if (input.search?.trim()) {
-      const searchPattern = `%${escapeLikePattern(input.search.trim())}%`
-      eligibleRoles = eligibleRoles.where(sql<boolean>`r.name ilike ${searchPattern}`)
-    }
-    if (excludedIds.length > 0) {
-      eligibleRoles = eligibleRoles.where('r.id', 'not in', excludedIds)
-    }
-
-    const boundedRoleIds = eligibleRoles
-      .select('r.id')
-      .limit(MAX_ROLE_RESULTS)
-      .as('bounded_roles')
-    const countQuery = db
-      .selectFrom(boundedRoleIds)
-      .select(sql<string>`count(*)`.as('count'))
-    const pageQuery = eligibleRoles
-      .select(['r.id', 'r.name'])
-      .orderBy('r.id', 'asc')
-      .limit(offset < MAX_ROLE_RESULTS ? Math.min(pageSize, MAX_ROLE_RESULTS - offset) : 0)
-      .offset(Math.min(offset, MAX_ROLE_RESULTS))
-
-    const [rows, countRow] = await Promise.all([
-      pageQuery.execute() as Promise<Array<{ id: string; name: string }>>,
-      countQuery.executeTakeFirst() as Promise<{ count?: string | number } | undefined>,
-    ])
-    const parsedTotal = Number(countRow?.count ?? 0)
-    const total = Number.isFinite(parsedTotal)
-      ? Math.min(MAX_ROLE_RESULTS, Math.max(0, Math.floor(parsedTotal)))
-      : 0
-
-    return {
-      items: rows.map((role) => ({ id: role.id, label: role.name, secondary: null })),
-      page,
-      pageSize,
-      total,
-    }
-  }
-
-  async listSuperAdminUserIds(tenantId: string): Promise<string[]> {
-    return Array.from(await listSuperAdminUserIds(this.em, tenantId))
-  }
-}

package/src/modules/auth/services/roleOrganizationScope.ts

@@ -1,70 +0,0 @@
-import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
-import type { RoleAcl } from '../data/entities'
-
-export type RoleOrganizationScope = ReadonlySet<string> | null
-
-function normalizeId(value: unknown): string | null {
-  return typeof value === 'string' && value.trim().length > 0 ? value.trim() : null
-}
-
-export async function resolveRoleOrganizationScope(
-  hierarchyService: OrganizationHierarchyService | null | undefined,
-  tenantId: string | null | undefined,
-  organizationId: string | null | undefined,
-): Promise<RoleOrganizationScope> {
-  const selectedId = normalizeId(organizationId)
-  if (!selectedId) return null
-  const normalizedTenantId = normalizeId(tenantId)
-  if (!normalizedTenantId) return new Set()
-
-  const ids = new Set<string>([selectedId])
-  // Auth remains independently usable when Directory is disabled: exact-org
-  // grants still apply, while parent-to-descendant expansion fails closed.
-  if (!hierarchyService) return ids
-
-  const ancestorIds = await hierarchyService.resolveAncestorIds({
-    tenantId: normalizedTenantId,
-    organizationId: selectedId,
-  })
-  // A registered Directory seam can prove an invalid/wrong-tenant selection.
-  // Fail closed for restricted roles in that case.
-  if (ancestorIds === null) return new Set()
-  for (const ancestorId of ancestorIds) {
-    const normalized = normalizeId(ancestorId)
-    if (normalized) ids.add(normalized)
-  }
-  return ids
-}
-
-export function roleAclAllowsOrganization(
-  acl: Pick<RoleAcl, 'organizationsJson'>,
-  scope: RoleOrganizationScope,
-): boolean {
-  if (!scope) return true
-  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null
-  if (!organizations || organizations.length === 0 || organizations.includes('__all__')) return true
-  return organizations.some((organizationId) => scope.has(organizationId))
-}
-
-/**
- * Principal eligibility — which roles may be selected as, or resolved into, an explicit share
- * target — follows the human-principal deny-all contract instead: an empty allowlist grants no
- * organization reach, so such a role must not become a share principal here (#4033).
- *
- * This deliberately differs from `roleAclAllowsOrganization` above, which governs *feature*
- * evaluation and keeps the wider "an empty list applies everywhere" meaning, and from the
- * API-key projection, where an empty list means "inherit the key's own organization binding".
- * Without this split a user who reaches an organization through a second role could inherit
- * viewer/editor access from a share assigned to a deny-all role.
- */
-export function roleAclGrantsPrincipalOrganization(
-  acl: Pick<RoleAcl, 'organizationsJson'>,
-  scope: RoleOrganizationScope,
-): boolean {
-  if (!scope) return true
-  const organizations = Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null
-  if (!organizations) return true
-  if (organizations.length === 0) return false
-  if (organizations.includes('__all__')) return true
-  return organizations.some((organizationId) => scope.has(organizationId))
-}

package/src/modules/communication_channels/lib/outbound-recipient.ts

@@ -1,71 +0,0 @@
-import { z } from 'zod'
-import type { ChannelCapabilities } from './adapter'
-
-/**
- * Upper bound shared by both recipient shapes. 320 is the RFC 5321 maximum for
- * an email address (64 local + `@` + 255 domain); provider-native identifiers
- * are far shorter, so one ceiling covers both.
- */
-export const MAX_OUTBOUND_RECIPIENT_LENGTH = 320
-
-const emailRecipientSchema = z.string().email()
-
-/**
- * Characters a provider-native recipient may contain. This is an allowlist, not a
- * denylist, because the recipient reaches adapters that interpolate it into a REST
- * path (Discord posts to `/channels/{recipient}/messages`), and a denylist fails
- * open on every character nobody thought of — percent-encoded separators
- * (`%2F`, `%2e%2e%2f`) and control bytes (NUL, DEL) all walked through the
- * previous `[\r\n\s/\\?#]` class. An allowlist fails closed instead: the worst
- * case is a provider whose identifier alphabet needs widening, which is a
- * reviewable one-line change rather than a silent path-steering primitive.
- *
- * The set covers every provider-native identifier shape the hub has to carry
- * today — Discord snowflakes (digits), Slack-style ids (alphanumerics), and email
- * addresses, since `'provider-native'` must never narrow what `'email'` accepts.
- */
-const PROVIDER_NATIVE_ALLOWED = /^[A-Za-z0-9._:@+-]+$/
-
-export type OutboundRecipientCheck = { ok: true } | { ok: false; error: string }
-
-/**
- * Validate an outbound recipient against the provider's declared recipient
- * shape.
- *
- * The hub used to hard-wire `z.string().email()` on every outbound endpoint,
- * which left providers whose recipients are not email addresses with no product
- * path to send at all (#4976). Validation now follows the adapter's
- * `capabilities.recipientFormat`, defaulting to `'email'` so every existing
- * provider keeps byte-identical behavior.
- */
-export function validateOutboundRecipient(
-  recipient: unknown,
-  capabilities: Pick<ChannelCapabilities, 'recipientFormat'> | null | undefined,
-): OutboundRecipientCheck {
-  if (typeof recipient !== 'string' || recipient.length === 0) {
-    return { ok: false, error: 'Recipient is required' }
-  }
-  if (recipient.length > MAX_OUTBOUND_RECIPIENT_LENGTH) {
-    return {
-      ok: false,
-      error: `Recipient must be at most ${MAX_OUTBOUND_RECIPIENT_LENGTH} characters`,
-    }
-  }
-  if (capabilities?.recipientFormat !== 'provider-native') {
-    return emailRecipientSchema.safeParse(recipient).success
-      ? { ok: true }
-      : { ok: false, error: 'Recipient must be a valid email address' }
-  }
-  if (!PROVIDER_NATIVE_ALLOWED.test(recipient)) {
-    return {
-      ok: false,
-      error: 'Recipient may only contain letters, digits, and the characters . _ : @ + -',
-    }
-  }
-  // `.` is allowed (email addresses need it), so traversal still has to be
-  // rejected explicitly even though the separators it would need are not.
-  if (recipient.includes('..')) {
-    return { ok: false, error: 'Recipient must not contain ".."' }
-  }
-  return { ok: true }
-}

package/src/modules/communication_channels/lib/resolve-channel-type.ts

@@ -1,99 +0,0 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import type { AppContainer } from '@open-mercato/shared/lib/di/container'
-import { findOneWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { createLogger } from '@open-mercato/shared/lib/logger'
-import { CommunicationChannel, ExternalConversation, MessageChannelLink } from '../data/entities'
-
-const logger = createLogger('communication_channels').child({ component: 'resolve-channel-type' })
-
-export type ChannelTypeScope = {
-  tenantId: string
-  organizationId: string | null
-}
-
-export type ChannelTypeReference = {
-  /** `ExternalConversation.id`, as carried by a message's `sourceEntityId`. */
-  externalConversationId?: string | null
-  /** A platform `messages.message` id that may be linked to a channel. */
-  messageId?: string | null
-}
-
-/**
- * Resolve the channel type behind a platform message or conversation (#4975).
- *
- * Cross-module callers (the `messages` compose route) need to know whether an
- * external correspondent is reachable by email before validating a compose
- * payload, but `messages` may not reach into this module's entities. They
- * resolve this facade from DI instead — mirroring `communicationChannelsSendAsUser`
- * — and treat a `null` result as "unknown", which the messages validator
- * handles fail-closed.
- *
- * Always tenant/organization scoped: a reference that does not resolve inside
- * the caller's scope is reported as unknown rather than looked up globally.
- */
-export async function resolveChannelType(
-  container: AppContainer,
-  scope: ChannelTypeScope,
-  reference: ChannelTypeReference,
-): Promise<string | null> {
-  const em = (container.resolve('em') as EntityManager).fork()
-  const dscope = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
-  const baseFilter = { tenantId: scope.tenantId, organizationId: scope.organizationId ?? null }
-
-  let externalConversationId = reference.externalConversationId ?? null
-
-  if (!externalConversationId && reference.messageId) {
-    // The message is linked to a channel directly — `MessageChannelLink` carries
-    // a denormalized channel type, so this is the cheapest hop when it exists.
-    const link = await findOneWithDecryption(
-      em,
-      MessageChannelLink,
-      { messageId: reference.messageId, ...baseFilter },
-      undefined,
-      dscope,
-    )
-    if (link?.channelType) return link.channelType
-    externalConversationId = link?.externalConversationId ?? null
-  }
-
-  if (!externalConversationId) return null
-
-  const conversation = await findOneWithDecryption(
-    em,
-    ExternalConversation,
-    { id: externalConversationId, ...baseFilter },
-    undefined,
-    dscope,
-  )
-  if (!conversation?.channelId) return null
-
-  const channel = await findOneWithDecryption(
-    em,
-    CommunicationChannel,
-    { id: conversation.channelId, ...baseFilter, deletedAt: null },
-    undefined,
-    dscope,
-  )
-  return channel?.channelType ?? null
-}
-
-/**
- * Same contract, but never throws: a lookup failure degrades to "unknown" so a
- * transient database error cannot turn into a 500 on an otherwise valid compose.
- * Unknown is the safe answer — the messages validator fails closed on it.
- */
-export async function resolveChannelTypeSafely(
-  container: AppContainer,
-  scope: ChannelTypeScope,
-  reference: ChannelTypeReference,
-): Promise<string | null> {
-  try {
-    return await resolveChannelType(container, scope, reference)
-  } catch (err) {
-    logger.warn('channel type resolution failed, treating the channel as unknown', { err })
-    return null
-  }
-}
-
-/** DI service type for cross-module callers (resolve `communicationChannelsResolveChannelType`). */
-export type ResolveChannelTypeService = typeof resolveChannelTypeSafely

package/src/modules/customers/backend/customers/deals/pipeline/components/toneClasses.ts

@@ -1,21 +0,0 @@
-import type { FilterOptionTone } from '@open-mercato/shared/lib/query/advanced-filter'
-
-// Saturated icon tokens shared by the kanban lane accent bar and the status filter
-// pills, so both surfaces render the same tone identically (#5107 review).
-export const TONE_DOT_CLASS: Record<FilterOptionTone, string> = {
-  success: 'bg-status-success-icon',
-  error: 'bg-status-error-icon',
-  warning: 'bg-status-warning-icon',
-  info: 'bg-status-info-icon',
-  neutral: 'bg-status-neutral-icon',
-  brand: 'bg-brand-violet',
-  pink: 'bg-status-pink-icon',
-}
-
-export function toneToDotClass(
-  tone: FilterOptionTone | null | undefined,
-  fallback = 'bg-status-neutral-icon',
-): string {
-  if (tone && tone in TONE_DOT_CLASS) return TONE_DOT_CLASS[tone]
-  return fallback
-}

package/src/modules/customers/lib/calendar/participantIdentity.ts

@@ -1,17 +0,0 @@
-/**
- * The one canonical actor key for a calendar participant.
- *
- * A staff/customer attendee is identified by `userId`. An external guest has no
- * record in the system, so the normalized email is the only stable identity it
- * carries. Mapping, dedupe, conflict detection and the editor's conflict-probe
- * dependency key all derive their key from here, so a guest is treated as the
- * same actor across events instead of dropping out of actor comparisons.
- *
- * Returns `null` for a participant with neither — such a participant cannot be
- * compared to any other and must never collide with one that can.
- */
-export function participantActorKey(participant: { userId?: string; email?: string }): string | null {
-  if (participant.userId) return `user:${participant.userId}`
-  const email = participant.email?.trim().toLowerCase()
-  return email ? `email:${email}` : null
-}

package/src/modules/customers/lib/closureStage.ts

@@ -1,76 +0,0 @@
-import type { EntityManager } from '@mikro-orm/postgresql'
-import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { CustomerPipelineStage } from '../data/entities'
-
-export type DealClosureOutcome = 'won' | 'lost'
-
-export type PipelineStageSnapshot = {
-  id: string
-  pipelineId: string
-  label: string
-  order: number
-}
-
-// Stage labels that mark a pipeline as terminal for a given closure outcome. Matching is
-// label-based because stages are tenant-configurable rows; see #5107.
-export const TERMINAL_PIPELINE_STAGE_LABELS: Record<DealClosureOutcome, ReadonlySet<string>> = {
-  won: new Set(['won', 'win', 'closed won', 'closed win']),
-  lost: new Set(['lost', 'loose', 'closed lost', 'closed loose']),
-}
-
-/**
- * Map a deal status spelling (UI `win`/`loose` or AI `won`/`lost`) to its closure
- * outcome. Case-insensitive because callers such as the AI tool pass free-form model
- * text through, while every persisted status is lower-case.
- */
-export function dealClosureOutcomeFromStatus(status: string | null | undefined): DealClosureOutcome | null {
-  const normalized = typeof status === 'string' ? status.trim().toLowerCase() : status
-  if (normalized === 'win' || normalized === 'won') return 'won'
-  if (normalized === 'loose' || normalized === 'lost') return 'lost'
-  return null
-}
-
-export function normalizePipelineStageLabel(value: string): string {
-  return value
-    .trim()
-    .toLowerCase()
-    .replace(/[^a-z0-9]+/g, ' ')
-    .trim()
-}
-
-/**
- * Resolve the terminal stage of the deal's pipeline for a closure outcome, so every
- * writer (command, AI tool preview) agrees on where a closed deal lands (#5107).
- */
-export async function loadClosurePipelineStageSnapshot(
-  em: EntityManager,
-  input: {
-    pipelineId: string | null
-    closureOutcome: DealClosureOutcome
-    tenantId: string
-    organizationId: string
-  },
-): Promise<PipelineStageSnapshot | null> {
-  if (!input.pipelineId) return null
-
-  const stages = await findWithDecryption(
-    em,
-    CustomerPipelineStage,
-    {
-      pipelineId: input.pipelineId,
-      tenantId: input.tenantId,
-      organizationId: input.organizationId,
-    },
-    { orderBy: { order: 'ASC' } },
-    { tenantId: input.tenantId, organizationId: input.organizationId },
-  )
-  const aliases = TERMINAL_PIPELINE_STAGE_LABELS[input.closureOutcome]
-  const stage = stages.find((candidate) => aliases.has(normalizePipelineStageLabel(candidate.label)))
-  if (!stage) return null
-  return {
-    id: stage.id,
-    pipelineId: stage.pipelineId,
-    label: stage.label,
-    order: stage.order,
-  }
-}

package/src/modules/customers/lib/detailReadAccess.ts

@@ -1,35 +0,0 @@
-import { NextResponse } from 'next/server'
-import {
-  isOrganizationReadAccessAllowed,
-  type OrganizationReadAccessInput,
-} from '@open-mercato/core/modules/directory/utils/organizationScopeGuard'
-
-/**
- * Single-record customers detail routes (person / company / deal) must not leak
- * whether a record exists through the organization-scope check.
- *
- * The API dispatcher already enforces each route's `metadata.requireFeatures`
- * before the handler runs, returning a uniform `403` for callers who lack the
- * grant — so that path never distinguishes an existing id from a missing one.
- * The only remaining existence signal is the *post-load* organization guard: a
- * caller who holds the feature but whose scope excludes the record's
- * organization previously received `403` (record exists in another org) while a
- * non-existent id received `404`. That 403-vs-404 split is an existence oracle
- * (issue #5504).
- *
- * Collapse the organization-scope denial into the route's own not-found
- * response so an out-of-scope caller cannot tell "exists in an organization you
- * cannot see" from "does not exist" — the shape the api_keys hardening
- * (#4033 / PR-4051) established. Sharing this decision keeps the three customers
- * detail routes from drifting apart again.
- *
- * @returns the `404` response to return when read access is denied, or `null`
- * when the caller may read the record.
- */
-export function denyCustomerDetailReadAsNotFound(
-  input: OrganizationReadAccessInput,
-  notFoundMessage: string,
-): NextResponse | null {
-  if (isOrganizationReadAccessAllowed(input)) return null
-  return NextResponse.json({ error: notFoundMessage }, { status: 404 })
-}