@open-mercato/core 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/modules/auth/components/AclEditor.tsx

@@ -4,14 +4,10 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
 import Link from 'next/link'
 import { hasFeature, matchFeature } from '@open-mercato/shared/security/features'
-import { useT } from '@open-mercato/shared/lib/i18n/context'
+import { useT, type TranslateFn } from '@open-mercato/shared/lib/i18n/context'
 import type { FeatureDescriptor } from '@open-mercato/shared/security/aclDependencies'
 import { AclDependencyDiagnosticsPanel } from './AclDependencyDiagnosticsPanel'
 
-function toTitleCase(value: string): string {
-  return value.replace(/[-_.]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase())
-}
-
 function normalizeFeatureArray(input: unknown): string[] {
   if (!Array.isArray(input)) return []
   const dedup = new Set<string>()
@@ -30,12 +26,16 @@ function isTenantRestrictedFeature(feature: string): boolean {
   return false
 }
 
-function formatWildcardLabel(moduleId: string, wildcard: string): string {
+function formatWildcardLabel(t: TranslateFn, moduleId: string, wildcard: string): string {
   if (!wildcard.endsWith('.*')) return wildcard
   const prefix = `${moduleId}.`
   const suffix = wildcard.startsWith(prefix) ? wildcard.slice(prefix.length, -2) : wildcard.slice(0, -2)
-  if (!suffix) return 'All features'
-  return `All ${suffix.split('.').map(toTitleCase).join(' / ')}`
+  if (!suffix) return t('auth.acl.wildcards.allFeatures', 'All features')
+  const group = suffix
+    .split('.')
+    .map((segment) => segment.replace(/[-_]/g, ' ').replace(/\b\w/g, (char) => char.toUpperCase()))
+    .join(' / ')
+  return t('auth.acl.wildcards.allGroup', 'All permissions in {group}', { group })
 }
 
 type Feature = { id: string; title: string; module: string; dependsOn?: string[] }
@@ -257,19 +257,28 @@ export function AclEditor({
   const grouped = React.useMemo(() => {
     const moduleMap = new Map<string, string>()
     for (const m of modules) {
-      moduleMap.set(m.id, m.title)
+      moduleMap.set(m.id, t(`auth.acl.modules.${m.id}`, m.title))
     }
     const map = new Map<string, { moduleId: string; moduleTitle: string; features: Feature[] }>()
     for (const f of features) {
       const moduleId = f.module
       const moduleTitle = moduleMap.get(moduleId) || moduleId
+      const localizedFeature = {
+        ...f,
+        title: t(`auth.acl.features.${f.id}`, f.title),
+      }
       if (!map.has(moduleId)) {
         map.set(moduleId, { moduleId, moduleTitle, features: [] })
       }
-      map.get(moduleId)!.features.push(f)
+      map.get(moduleId)!.features.push(localizedFeature)
     }
     return Array.from(map.values()).sort((a, b) => a.moduleTitle.localeCompare(b.moduleTitle))
-  }, [features, modules])
+  }, [features, modules, t])
+
+  const localizedFeatures = React.useMemo(
+    () => grouped.flatMap((group) => group.features),
+    [grouped],
+  )
 
   const hasGlobalWildcard = granted.includes('*')
   const hasOrganizationRestriction = Array.isArray(organizations) && organizations.length > 0
@@ -305,22 +314,28 @@ export function AclEditor({
 
   const isFeatureChecked = (featureId: string) => hasFeature(granted, featureId)
 
-  if (loading) return <div className="text-sm text-muted-foreground">Loading ACL…</div>
+  if (loading) {
+    return (
+      <div className="text-sm text-muted-foreground">
+        {t('auth.acl.loading', 'Loading access control…')}
+      </div>
+    )
+  }
 
   const showRoleBanner = kind === 'user' && !hasCustomAcl && !overrideEnabled
 
   return (
     <div className="space-y-4">
       {showRoleBanner && (
-        <div className="rounded-lg border border-blue-200 bg-blue-50 p-4">
-          <div className="text-sm font-medium text-blue-900 mb-2">
-            Permissions inherited from roles
+        <div className="rounded-lg border border-status-info-border bg-status-info-bg p-4">
+          <div className="text-sm font-medium text-status-info-text mb-2">
+            {t('auth.acl.inherited.title', 'Permissions inherited from roles')}
           </div>
-          <div className="text-sm text-blue-700 mb-3">
-            This user currently inherits permissions from their assigned roles.
+          <div className="text-sm text-status-info-text mb-3">
+            {t('auth.acl.inherited.description', 'This user currently inherits permissions from their assigned roles.')}
             {roleDetails.length > 0 && (
               <span>
-                {' '}Assigned roles:{' '}
+                {' '}{t('auth.acl.inherited.assignedRoles', 'Assigned roles:')}{' '}
                 {roleDetails.map((role, idx) => {
                   const roleId = typeof role?.id === 'string' && role.id.length > 0 ? role.id : `role-${idx}`
                   const roleName = typeof role?.name === 'string' && role.name.length > 0 ? role.name : roleId
@@ -329,7 +344,7 @@ export function AclEditor({
                       {idx > 0 && ', '}
                       <Link 
                         href={`/backend/roles/${roleId}/edit`}
-                        className="font-semibold text-blue-900 underline hover:text-blue-950 transition-colors"
+                        className="font-semibold text-status-info-text underline"
                       >
                         {roleName}
                       </Link>
@@ -347,8 +362,8 @@ export function AclEditor({
               checked={overrideEnabled} 
               onChange={(e) => setOverrideEnabled(e.target.checked)} 
             />
-            <label htmlFor="overrideAcl" className="text-sm text-blue-900 font-medium">
-              Override permissions for this user only
+            <label htmlFor="overrideAcl" className="text-sm text-status-info-text font-medium">
+              {t('auth.acl.inherited.override', 'Override permissions for this user only')}
             </label>
           </div>
         </div>
@@ -364,31 +379,39 @@ export function AclEditor({
               disabled={!actorIsSuperAdmin}
               onChange={(e) => setIsSuperAdmin(!!e.target.checked)}
             />
-            <label htmlFor="isSuperAdmin" className="text-sm">Super Admin (all features)</label>
+            <label htmlFor="isSuperAdmin" className="text-sm">
+              {t('auth.acl.superAdmin.label', 'Super Admin (all features)')}
+            </label>
           </div>
           {!actorIsSuperAdmin && (
-            <p className="text-xs text-muted-foreground">Only super administrators can change this option.</p>
+            <p className="text-xs text-muted-foreground">
+              {t('auth.acl.superAdmin.hint', 'Only super administrators can change this option.')}
+            </p>
           )}
       {!isSuperAdmin && (
         <>
           {hasGlobalWildcard && (
-            <div className="rounded border border-blue-200 bg-blue-50 p-3">
-              <div className="text-sm font-medium text-blue-900">Global wildcard (*) enabled</div>
-              <div className="text-xs text-blue-700 mt-1">This grants access to all features in the system.</div>
+            <div className="rounded border border-status-info-border bg-status-info-bg p-3">
+              <div className="text-sm font-medium text-status-info-text">
+                {t('auth.acl.globalWildcard.title', 'Global wildcard (*) enabled')}
+              </div>
+              <div className="text-xs text-status-info-text mt-1">
+                {t('auth.acl.globalWildcard.description', 'This grants access to all features in the system.')}
+              </div>
               <Button
                 variant="outline"
                 size="sm"
                 className="mt-2"
                 onClick={() => updateGranted((prev) => prev.filter((x) => x !== '*'))}
               >
-                Remove global wildcard
+                {t('auth.acl.globalWildcard.remove', 'Remove global wildcard')}
               </Button>
             </div>
           )}
           {!hasGlobalWildcard && (
             <AclDependencyDiagnosticsPanel
               granted={granted}
-              catalog={features as readonly FeatureDescriptor[]}
+              catalog={localizedFeatures as readonly FeatureDescriptor[]}
               onGrantedChange={updateGranted}
               hideUnknownReferences={process.env.NODE_ENV === 'production'}
             />
@@ -433,8 +456,13 @@ export function AclEditor({
                         onChange={(e) => toggleModuleWildcard(group.moduleId, e.target.checked)} 
                       />
                       <label htmlFor={`module-${group.moduleId}`} className="text-sm text-muted-foreground">
-                        All {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-blue-600">({group.moduleId}.*)</span> : ''}
-                        {moduleRestricted ? <span className="ml-2 text-xs font-medium text-muted-foreground">(manage via super admin)</span> : null}
+                        {t('auth.acl.allModuleFeatures', 'All')}{' '}
+                        {moduleWildcard && !hasGlobalWildcard ? <span className="font-medium text-status-info-text">({group.moduleId}.*)</span> : ''}
+                        {moduleRestricted ? (
+                          <span className="ml-2 text-xs font-medium text-muted-foreground">
+                            {t('auth.acl.manageViaSuperAdmin', '(manage via super admin)')}
+                          </span>
+                        ) : null}
                       </label>
                     </div>
                   </div>
@@ -459,7 +487,7 @@ export function AclEditor({
                                 htmlFor={`wildcard-${wildcard}`}
                                 className={`text-sm ${disabled ? 'text-muted-foreground' : ''}`}
                               >
-                                {formatWildcardLabel(group.moduleId, wildcard)}{' '}
+                                {formatWildcardLabel(t, group.moduleId, wildcard)}{' '}
                                 <span className="text-muted-foreground text-xs font-mono">({wildcard})</span>
                                 {wildcardRestricted ? (
                                   <span className="ml-2 text-xs font-medium text-muted-foreground">
@@ -535,7 +563,9 @@ export function AclEditor({
               <div className="text-sm font-medium mb-2">
                 {t('auth.acl.organizationsScope', 'Organizations scope')}
               </div>
-              <div className="text-xs text-muted-foreground mb-2">Empty = all organizations. Select one or more to restrict.</div>
+              <div className="text-xs text-muted-foreground mb-2">
+                {t('auth.acl.organizationsScopeHint', 'Empty means all organizations. Select one or more to restrict access.')}
+              </div>
               <div className="grid grid-cols-1 md:grid-cols-2 gap-2">
                 {orgOptions.map((o) => {
                   const checked = organizations == null ? false : (organizations || []).includes(o.id)
@@ -557,7 +587,7 @@ export function AclEditor({
                 <Button variant="outline" onClick={() => setOrganizations(null)}>{t('auth.acl.allowAllOrganizations', 'Allow all organizations')}</Button>
               </div>
               {showOrganizationWarning && (
-                <div className="mt-3 rounded border border-amber-200 bg-amber-50 px-3 py-2 text-sm text-amber-900">
+                <div className="mt-3 rounded border border-status-warning-border bg-status-warning-bg px-3 py-2 text-sm text-status-warning-text">
                   {t('auth.acl.organizationWarning', 'Organization restrictions are saved only when at least one feature override is selected. Add a feature or enable a module wildcard before saving.')}
                 </div>
               )}

package/src/modules/auth/data/entities.ts

@@ -269,7 +269,10 @@ export class RoleAcl {
   @Property({ name: 'is_super_admin', type: 'boolean', default: false })
   isSuperAdmin: boolean = false
 
-  // Visible organizations within the tenant; null/empty means all organizations
+  // Visible organizations within the tenant. `null` or the `__all__` sentinel means every
+  // organization. An EMPTY array is a deny-all scope for human principals — it projects to an
+  // empty accessible set so scoped reads and deletes fail closed (#4033). API-key principals
+  // read an empty list as "inherit the key's own organization binding" instead.
   @Property({ name: 'organizations_json', type: 'json', nullable: true })
   organizationsJson?: string[] | null
 

package/src/modules/auth/data/validators.ts

@@ -20,6 +20,10 @@ export const confirmPasswordResetSchema = z.object({
   password: passwordSchema,
 })
 
+export const validatePasswordResetTokenSchema = z.object({
+  token: z.string().min(10),
+})
+
 export const refreshSessionRequestSchema = z.object({
   refreshToken: z.string().min(1),
 })
@@ -128,6 +132,7 @@ export const featureCheckRequestSchema = z.object({
 export type UserLoginInput = z.infer<typeof userLoginSchema>
 export type RequestPasswordResetInput = z.infer<typeof requestPasswordResetSchema>
 export type ConfirmPasswordResetInput = z.infer<typeof confirmPasswordResetSchema>
+export type ValidatePasswordResetTokenInput = z.infer<typeof validatePasswordResetTokenSchema>
 export type RefreshSessionRequestInput = z.infer<typeof refreshSessionRequestSchema>
 export type SidebarPreferencesInput = z.infer<typeof sidebarPreferencesInputSchema>
 export type SidebarVariantSettingsInput = z.infer<typeof sidebarVariantSettingsSchema>

package/src/modules/auth/di.ts

@@ -2,6 +2,7 @@ import { asClass, asFunction } from 'awilix'
 import type { AppContainer } from '@open-mercato/shared/lib/di/container'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { CacheStrategy } from '@open-mercato/cache'
+import type { OrganizationHierarchyService } from '@open-mercato/shared/lib/auth/principal-service'
 import { AuthService } from '@open-mercato/core/modules/auth/services/authService'
 import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
 import {
@@ -9,26 +10,55 @@ import {
   isRbacDefaultCacheEnabled,
   resetRbacFallbackCache,
 } from '@open-mercato/core/modules/auth/services/rbacDefaultCache'
+import { DefaultAuthPrincipalService } from './services/principalService'
 
 export { resetRbacFallbackCache }
 
+function resolveOptionalCache(container: AppContainer): CacheStrategy | undefined {
+  try {
+    return container.hasRegistration('cache')
+      ? container.resolve<CacheStrategy>('cache')
+      : undefined
+  } catch {
+    return undefined
+  }
+}
+
+function resolveOptionalOrganizationHierarchyService(
+  container: AppContainer,
+): OrganizationHierarchyService | undefined {
+  try {
+    if (!container.hasRegistration('organizationHierarchyService')) return undefined
+    const candidate = container.resolve<OrganizationHierarchyService>('organizationHierarchyService')
+    return typeof candidate?.resolveAncestorIds === 'function' ? candidate : undefined
+  } catch {
+    return undefined
+  }
+}
+
 export function register(container: AppContainer) {
   // Register or override core auth service
   container.register({ authService: asClass(AuthService).scoped() })
-  // RBAC service. The bare `asClass(...).scoped()` registration matches
-  // develop and is the default. Setting `OM_RBAC_DEFAULT_CACHE=on` opts
-  // into the in-process LRU fallback for deployments that don't wire a
-  // shared CacheStrategy (CLI scripts, lean test bootstraps). Production
-  // bootstraps that already register `cache` via `@open-mercato/cache`
-  // preempt this fallback because the container's existing `cache`
-  // registration wins when `RbacService` reaches for it.
-  if (isRbacDefaultCacheEnabled()) {
-    container.register({
-      rbacService: asFunction((cradle: { em: EntityManager; cache?: CacheStrategy }) => {
-        return new RbacService(cradle.em, cradle.cache ?? createRbacFallbackCache())
-      }).scoped(),
-    })
-  } else {
-    container.register({ rbacService: asClass(RbacService).scoped() })
-  }
+  container.register({
+    authPrincipalService: asFunction(function authPrincipalServiceFactory(em: EntityManager) {
+      return new DefaultAuthPrincipalService(
+        em,
+        resolveOptionalOrganizationHierarchyService(container),
+      )
+    }).scoped(),
+  })
+  // Resolve optional infrastructure lazily so Auth still works when Directory
+  // is disabled and in lean CLI/test containers without a CacheStrategy.
+  // Setting `OM_RBAC_DEFAULT_CACHE=on` opts into the in-process fallback;
+  // an explicitly registered cache always wins.
+  container.register({
+    rbacService: asFunction(function rbacServiceFactory(em: EntityManager) {
+      const configuredCache = resolveOptionalCache(container)
+      return new RbacService(
+        em,
+        configuredCache ?? (isRbacDefaultCacheEnabled() ? createRbacFallbackCache() : undefined),
+        resolveOptionalOrganizationHierarchyService(container),
+      )
+    }).scoped(),
+  })
 }

package/src/modules/auth/frontend/reset/[token]/page.tsx

@@ -4,17 +4,22 @@ import { Button } from '@open-mercato/ui/primitives/button'
 import { PasswordInput } from '@open-mercato/ui/primitives/password-input'
 import { Label } from '@open-mercato/ui/primitives/label'
 import { useEffect, useState } from 'react'
+import Link from 'next/link'
 import { useRouter } from 'next/navigation'
 import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { Spinner } from '@open-mercato/ui/primitives/spinner'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'
 
+type TokenState = 'checking' | 'usable' | 'expired'
+
 export default function ResetWithTokenPage({ params }: { params: { token: string } }) {
   const router = useRouter()
   const t = useT()
   const [error, setError] = useState<string | null>(null)
   const [submitting, setSubmitting] = useState(false)
   const [clientReady, setClientReady] = useState(false)
+  const [tokenState, setTokenState] = useState<TokenState>('checking')
   const passwordPolicy = getPasswordPolicy()
   const passwordRequirements = formatPasswordRequirements(passwordPolicy, t)
   const passwordDescription = passwordRequirements
@@ -25,6 +30,30 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     setClientReady(true)
   }, [])
 
+  useEffect(() => {
+    let cancelled = false
+    async function checkToken() {
+      const body = new FormData()
+      body.set('token', params.token)
+      // Fail open whenever the check cannot answer — an unreachable or failing
+      // endpoint must not strand a user holding a perfectly good link, and the
+      // confirm endpoint still rejects a dead token on submit.
+      try {
+        const { ok, result } = await apiCall<{ ok?: boolean; valid?: boolean }>(
+          '/api/auth/reset/validate',
+          { method: 'POST', body },
+        )
+        if (cancelled) return
+        setTokenState(ok && result?.valid === false ? 'expired' : 'usable')
+      } catch {
+        if (cancelled) return
+        setTokenState('usable')
+      }
+    }
+    void checkToken()
+    return () => { cancelled = true }
+  }, [params.token])
+
   async function onSubmit(e: React.FormEvent<HTMLFormElement>) {
     e.preventDefault()
     setError(null)
@@ -66,6 +95,51 @@ export default function ResetWithTokenPage({ params }: { params: { token: string
     }
   }
 
+  if (tokenState === 'checking') {
+    return (
+      <div className="min-h-svh flex items-center justify-center p-4">
+        <Card className="w-full max-w-sm">
+          <CardHeader>
+            <CardTitle>{t('auth.reset.title', 'Set a new password')}</CardTitle>
+          </CardHeader>
+          <CardContent>
+            <div className="flex items-center gap-2 text-sm text-muted-foreground" data-auth-token-state="checking">
+              <Spinner size="sm" />
+              <span>{t('auth.reset.token.checking', 'Checking your reset link...')}</span>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    )
+  }
+
+  if (tokenState === 'expired') {
+    return (
+      <div className="min-h-svh flex items-center justify-center p-4">
+        <Card className="w-full max-w-sm">
+          <CardHeader>
+            <CardTitle>{t('auth.reset.token.expiredTitle', 'This reset link is no longer valid')}</CardTitle>
+            <CardDescription>
+              {t('auth.reset.token.expiredSubtitle', 'It has already been used or has expired. Request a new link to set your password.')}
+            </CardDescription>
+          </CardHeader>
+          <CardContent>
+            <div className="grid gap-3" data-auth-token-state="expired">
+              <Button asChild className="w-full">
+                <Link href="/reset">{t('auth.reset.token.requestNew', 'Request a new link')}</Link>
+              </Button>
+              <div className="text-center">
+                <Link href="/login" className="text-xs text-muted-foreground underline">
+                  {t('auth.reset.backToLogin', 'Back to login')}
+                </Link>
+              </div>
+            </div>
+          </CardContent>
+        </Card>
+      </div>
+    )
+  }
+
   return (
     <div className="min-h-svh flex items-center justify-center p-4">
       <Card className="w-full max-w-sm">