@open-mercato/core 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/dist/modules/auth/acl.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/modules/auth/acl.ts"],
-  "sourcesContent": ["// Module-level features declaration for RBAC\nexport const features = [\n  { id: 'auth.users.list', title: 'List users', module: 'auth' },\n  { id: 'auth.users.create', title: 'Create users', module: 'auth' },\n  { id: 'auth.users.edit', title: 'Edit users', module: 'auth' },\n  { id: 'auth.users.delete', title: 'Delete users', module: 'auth' },\n  { id: 'auth.roles.list', title: 'List roles', module: 'auth' },\n  { id: 'auth.roles.manage', title: 'Manage roles', module: 'auth' },\n  { id: 'auth.acl.manage', title: 'Manage ACLs', module: 'auth' },\n  { id: 'auth.sidebar.manage', title: 'Manage sidebar presets', module: 'auth' },\n]\n\nexport default features\n\n"],
-  "mappings": "AACO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,mBAAmB,OAAO,cAAc,QAAQ,OAAO;AAAA,EAC7D,EAAE,IAAI,qBAAqB,OAAO,gBAAgB,QAAQ,OAAO;AAAA,EACjE,EAAE,IAAI,mBAAmB,OAAO,cAAc,QAAQ,OAAO;AAAA,EAC7D,EAAE,IAAI,qBAAqB,OAAO,gBAAgB,QAAQ,OAAO;AAAA,EACjE,EAAE,IAAI,mBAAmB,OAAO,cAAc,QAAQ,OAAO;AAAA,EAC7D,EAAE,IAAI,qBAAqB,OAAO,gBAAgB,QAAQ,OAAO;AAAA,EACjE,EAAE,IAAI,mBAAmB,OAAO,eAAe,QAAQ,OAAO;AAAA,EAC9D,EAAE,IAAI,uBAAuB,OAAO,0BAA0B,QAAQ,OAAO;AAC/E;AAEA,IAAO,cAAQ;",
+  "sourcesContent": ["// Module-level features declaration for RBAC\nexport const features = [\n  { id: 'auth.users.list', title: 'List users', module: 'auth' },\n  {\n    id: 'auth.users.create',\n    title: 'Create users',\n    module: 'auth',\n    dependsOn: ['auth.users.list', 'auth.roles.list', 'directory.organizations.view'],\n  },\n  {\n    id: 'auth.users.edit',\n    title: 'Edit users',\n    module: 'auth',\n    dependsOn: ['auth.users.list', 'auth.roles.list'],\n  },\n  {\n    id: 'auth.users.delete',\n    title: 'Delete users',\n    module: 'auth',\n    dependsOn: ['auth.users.list'],\n  },\n  { id: 'auth.roles.list', title: 'List roles', module: 'auth' },\n  {\n    id: 'auth.roles.manage',\n    title: 'Manage roles',\n    module: 'auth',\n    dependsOn: ['auth.roles.list'],\n  },\n  {\n    id: 'auth.acl.manage',\n    title: 'Manage ACLs',\n    module: 'auth',\n    dependsOn: ['auth.users.list', 'auth.roles.list'],\n  },\n  { id: 'auth.sidebar.manage', title: 'Manage sidebar presets', module: 'auth' },\n]\n\nexport default features\n"],
+  "mappings": "AACO,MAAM,WAAW;AAAA,EACtB,EAAE,IAAI,mBAAmB,OAAO,cAAc,QAAQ,OAAO;AAAA,EAC7D;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,mBAAmB,mBAAmB,8BAA8B;AAAA,EAClF;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,mBAAmB,iBAAiB;AAAA,EAClD;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,iBAAiB;AAAA,EAC/B;AAAA,EACA,EAAE,IAAI,mBAAmB,OAAO,cAAc,QAAQ,OAAO;AAAA,EAC7D;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,iBAAiB;AAAA,EAC/B;AAAA,EACA;AAAA,IACE,IAAI;AAAA,IACJ,OAAO;AAAA,IACP,QAAQ;AAAA,IACR,WAAW,CAAC,mBAAmB,iBAAiB;AAAA,EAClD;AAAA,EACA,EAAE,IAAI,uBAAuB,OAAO,0BAA0B,QAAQ,OAAO;AAC/E;AAEA,IAAO,cAAQ;",
   "names": []
 }

package/dist/modules/auth/api/feature-check.js

@@ -2,6 +2,7 @@ import { NextResponse } from "next/server";
 import { z } from "zod";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { getAuthFromRequest } from "@open-mercato/shared/lib/auth/server";
+import { resolveFeatureCheckContext } from "@open-mercato/core/modules/directory/utils/organizationScope";
 import { featureCheckRequestSchema } from "../data/validators.js";
 const metadata = {
   POST: { requireAuth: true }
@@ -31,13 +32,18 @@ async function POST(req) {
   }
   const container = await createRequestContainer();
   const rbac = container.resolve("rbacService");
-  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId });
+  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req });
+  const featureScope = {
+    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,
+    organizationId: featureContext.organizationId
+  };
+  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope);
   if (ok) {
     return NextResponse.json({ ok: true, granted: features, userId: auth.sub });
   }
   const granted = [];
   for (const f of features) {
-    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId });
+    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope);
     if (hasFeature) granted.push(f);
   }
   return NextResponse.json({ ok: false, granted, userId: auth.sub });

package/dist/modules/auth/api/feature-check.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/feature-check.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { featureCheckRequestSchema } from '../data/validators'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst featureCheckResponseSchema = z.object({\n  ok: z.boolean().describe('Indicates whether all requested features are granted'),\n  granted: z.array(z.string()).describe('Features the current user may access'),\n  userId: z.string().describe('ID of the authenticated user'),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown = {}\n  try {\n    body = await req.json()\n  } catch { /* malformed JSON \u2014 safeParse below will reject */ }\n\n  const parsed = featureCheckRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  }\n\n  const features = parsed.data.features\n  if (!features.length) {\n    return NextResponse.json({ ok: true, granted: [], userId: auth.sub })\n  }\n\n  const container = await createRequestContainer()\n  const rbac = (container.resolve('rbacService') as any)\n  const ok = await rbac.userHasAllFeatures(auth.sub, features, { tenantId: auth.tenantId, organizationId: auth.orgId })\n  if (ok) {\n    return NextResponse.json({ ok: true, granted: features, userId: auth.sub })\n  }\n\n  // Check individually to see which features are granted\n  const granted: string[] = []\n  for (const f of features) {\n    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], { tenantId: auth.tenantId, organizationId: auth.orgId })\n    if (hasFeature) granted.push(f)\n  }\n\n  return NextResponse.json({ ok: false, granted, userId: auth.sub })\n}\n\nconst featureCheckMethodDoc: OpenApiMethodDoc = {\n  summary: 'Check feature grants for the current user',\n  description: 'Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/json',\n    schema: featureCheckRequestSchema,\n    description: 'Feature identifiers to evaluate.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Evaluation result',\n      schema: featureCheckResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 400,\n      description: 'Invalid request \u2014 features array missing, too large, or contains invalid entries',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n    {\n      status: 401,\n      description: 'Authentication required',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Check feature grants for the current user',\n  methods: {\n    POST: featureCheckMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AACnC,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,QAAQ,EAAE,SAAS,sDAAsD;AAAA,EAC/E,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,sCAAsC;AAAA,EAC5E,QAAQ,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAC5D,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI,OAAgB,CAAC;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAAqD;AAE7D,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACpH,MAAI,IAAI;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,UAAU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5E;AAGA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,UAAU;AACxB,UAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,CAAC,GAAG,EAAE,UAAU,KAAK,UAAU,gBAAgB,KAAK,MAAM,CAAC;AACvH,QAAI,WAAY,SAAQ,KAAK,CAAC;AAAA,EAChC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,QAAQ,KAAK,IAAI,CAAC;AACnE;AAEA,MAAM,wBAA0C;AAAA,EAC9C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport type { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport { resolveFeatureCheckContext } from '@open-mercato/core/modules/directory/utils/organizationScope'\nimport { featureCheckRequestSchema } from '../data/validators'\n\nexport const metadata = {\n  POST: { requireAuth: true },\n}\n\nconst featureCheckResponseSchema = z.object({\n  ok: z.boolean().describe('Indicates whether all requested features are granted'),\n  granted: z.array(z.string()).describe('Features the current user may access'),\n  userId: z.string().describe('ID of the authenticated user'),\n})\n\nexport async function POST(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) {\n    return NextResponse.json({ ok: false, error: 'Unauthorized' }, { status: 401 })\n  }\n\n  let body: unknown = {}\n  try {\n    body = await req.json()\n  } catch { /* malformed JSON \u2014 safeParse below will reject */ }\n\n  const parsed = featureCheckRequestSchema.safeParse(body)\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: 'Invalid request' }, { status: 400 })\n  }\n\n  const features = parsed.data.features\n  if (!features.length) {\n    return NextResponse.json({ ok: true, granted: [], userId: auth.sub })\n  }\n\n  const container = await createRequestContainer()\n  const rbac = container.resolve<RbacService>('rbacService')\n  const featureContext = await resolveFeatureCheckContext({ container, auth, request: req })\n  const featureScope = {\n    tenantId: featureContext.scope.tenantId ?? auth.tenantId ?? null,\n    organizationId: featureContext.organizationId,\n  }\n  const ok = await rbac.userHasAllFeatures(auth.sub, features, featureScope)\n  if (ok) {\n    return NextResponse.json({ ok: true, granted: features, userId: auth.sub })\n  }\n\n  // Check individually to see which features are granted\n  const granted: string[] = []\n  for (const f of features) {\n    const hasFeature = await rbac.userHasAllFeatures(auth.sub, [f], featureScope)\n    if (hasFeature) granted.push(f)\n  }\n\n  return NextResponse.json({ ok: false, granted, userId: auth.sub })\n}\n\nconst featureCheckMethodDoc: OpenApiMethodDoc = {\n  summary: 'Check feature grants for the current user',\n  description: 'Evaluates which of the requested features are available to the signed-in user within the active tenant / organization context.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/json',\n    schema: featureCheckRequestSchema,\n    description: 'Feature identifiers to evaluate.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Evaluation result',\n      schema: featureCheckResponseSchema,\n    },\n  ],\n  errors: [\n    {\n      status: 400,\n      description: 'Invalid request \u2014 features array missing, too large, or contains invalid entries',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n    {\n      status: 401,\n      description: 'Authentication required',\n      schema: z.object({ ok: z.literal(false), error: z.string() }),\n    },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Check feature grants for the current user',\n  methods: {\n    POST: featureCheckMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,8BAA8B;AACvC,SAAS,0BAA0B;AAEnC,SAAS,kCAAkC;AAC3C,SAAS,iCAAiC;AAEnC,MAAM,WAAW;AAAA,EACtB,MAAM,EAAE,aAAa,KAAK;AAC5B;AAEA,MAAM,6BAA6B,EAAE,OAAO;AAAA,EAC1C,IAAI,EAAE,QAAQ,EAAE,SAAS,sDAAsD;AAAA,EAC/E,SAAS,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,sCAAsC;AAAA,EAC5E,QAAQ,EAAE,OAAO,EAAE,SAAS,8BAA8B;AAC5D,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,MAAM;AACT,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChF;AAEA,MAAI,OAAgB,CAAC;AACrB,MAAI;AACF,WAAO,MAAM,IAAI,KAAK;AAAA,EACxB,QAAQ;AAAA,EAAqD;AAE7D,QAAM,SAAS,0BAA0B,UAAU,IAAI;AACvD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACnF;AAEA,QAAM,WAAW,OAAO,KAAK;AAC7B,MAAI,CAAC,SAAS,QAAQ;AACpB,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,CAAC,GAAG,QAAQ,KAAK,IAAI,CAAC;AAAA,EACtE;AAEA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AACzD,QAAM,iBAAiB,MAAM,2BAA2B,EAAE,WAAW,MAAM,SAAS,IAAI,CAAC;AACzF,QAAM,eAAe;AAAA,IACnB,UAAU,eAAe,MAAM,YAAY,KAAK,YAAY;AAAA,IAC5D,gBAAgB,eAAe;AAAA,EACjC;AACA,QAAM,KAAK,MAAM,KAAK,mBAAmB,KAAK,KAAK,UAAU,YAAY;AACzE,MAAI,IAAI;AACN,WAAO,aAAa,KAAK,EAAE,IAAI,MAAM,SAAS,UAAU,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC5E;AAGA,QAAM,UAAoB,CAAC;AAC3B,aAAW,KAAK,UAAU;AACxB,UAAM,aAAa,MAAM,KAAK,mBAAmB,KAAK,KAAK,CAAC,CAAC,GAAG,YAAY;AAC5E,QAAI,WAAY,SAAQ,KAAK,CAAC;AAAA,EAChC;AAEA,SAAO,aAAa,KAAK,EAAE,IAAI,OAAO,SAAS,QAAQ,KAAK,IAAI,CAAC;AACnE;AAEA,MAAM,wBAA0C;AAAA,EAC9C,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,IACA;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ,EAAE,OAAO,EAAE,IAAI,EAAE,QAAQ,KAAK,GAAG,OAAO,EAAE,OAAO,EAAE,CAAC;AAAA,IAC9D;AAAA,EACF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": []
 }

package/dist/modules/auth/api/login.js

@@ -194,13 +194,16 @@ async function handleLoginRequest(req) {
   const interceptedBody = interceptedResponse.body;
   const authTokenForCookie = typeof interceptedBody.token === "string" && interceptedBody.token.length > 0 ? interceptedBody.token : token;
   const refreshTokenForCookie = typeof interceptedBody.refreshToken === "string" ? interceptedBody.refreshToken : void 0;
+  const authTokenReplacedByInterceptor = authTokenForCookie !== token;
   const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode });
   res.cookies.set("auth_token", authTokenForCookie, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: accessTokenMaxAgeSeconds });
   if (remember && refreshTokenForCookie) {
     const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1e3);
     res.cookies.set("session_token", refreshTokenForCookie, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", expires: expiresAt });
-  } else if (!remember && authTokenForCookie === token) {
+  } else if (!remember && !authTokenReplacedByInterceptor) {
     res.cookies.set("session_token", sessionRefreshToken, { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: accessTokenMaxAgeSeconds });
+  } else if (authTokenReplacedByInterceptor) {
+    res.cookies.set("session_token", "", { httpOnly: true, path: "/", sameSite: "lax", secure: process.env.NODE_ENV === "production", maxAge: 0 });
   }
   return res;
 }

package/dist/modules/auth/api/login.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../src/modules/auth/api/login.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\nimport { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\n// Resolving translations can itself be what failed, so the generic message is\n// recovered defensively \u2014 the error path must never throw a second time.\nasync function resolveGenericLoginError(): Promise<string> {\n  try {\n    const { translate } = await resolveTranslations()\n    return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n  } catch {\n    return 'An error occurred. Please try again.'\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handleLoginRequest(req)\n  } catch (error) {\n    return handleAuthRouteError(error, {\n      scope: 'auth.login',\n      message: await resolveGenericLoginError(),\n    })\n  }\n}\n\nasync function handleLoginRequest(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok || user.isConfirmed === false) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && authTokenForCookie === token) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AAErC,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAIA,eAAe,2BAA4C;AACzD,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,UAAU,6BAA6B,sCAAsC;AAAA,EACtF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,mBAAmB,GAAG;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,qBAAqB,OAAO;AAAA,MACjC,OAAO;AAAA,MACP,SAAS,MAAM,yBAAyB;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBAAmB,KAAc;AAC9C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,OAAO;AAK9C,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAEJ,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,uBAAuB,OAAO;AACpD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiMethodDoc, OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { userLoginSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { signJwt } from '@open-mercato/shared/lib/auth/jwt'\nimport { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'\nimport type { EventBus } from '@open-mercato/events/types'\nimport { parseBooleanToken } from '@open-mercato/shared/lib/boolean'\nimport { emitAuthEvent } from '@open-mercato/core/modules/auth/events'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit, resetAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\nimport { runCustomRouteAfterInterceptors } from '@open-mercato/shared/lib/crud/custom-route-interceptor'\nimport { sanitizeRedirectPath } from '@open-mercato/core/modules/auth/lib/safeRedirect'\nimport { getAppBaseUrl } from '@open-mercato/shared/lib/url'\nimport { handleAuthRouteError } from '@open-mercato/core/modules/auth/api/routeError'\n\nconst loginRateLimitConfig = readEndpointRateLimitConfig('LOGIN', {\n  points: 5, duration: 60, blockDuration: 60, keyPrefix: 'login',\n})\nconst loginIpRateLimitConfig = readEndpointRateLimitConfig('LOGIN_IP', {\n  points: 20, duration: 60, blockDuration: 60, keyPrefix: 'login-ip',\n})\n\nexport const metadata = { requireAuth: false }\n\n// validation comes from userLoginSchema\n\ntype ParsedLoginForm = {\n  email: string\n  password: string\n  remember: boolean\n  tenantIdRaw: string\n  requiredRoles: string[]\n  redirectTo: string\n}\n\nfunction parseRequiredRoles(rawValue: string): string[] {\n  return rawValue\n    .split(',')\n    .map((value) => value.trim())\n    .filter(Boolean)\n}\n\nasync function parseLoginForm(req: Request): Promise<ParsedLoginForm> {\n  const rawContentType = req.headers.get('content-type') ?? ''\n  const contentType = rawContentType.split(';')[0].trim().toLowerCase()\n\n  try {\n    if (contentType === 'application/x-www-form-urlencoded') {\n      const body = await req.text()\n      const params = new URLSearchParams(body)\n      const requireRoleRaw = String(params.get('requireRole') ?? params.get('role') ?? '').trim()\n      return {\n        email: String(params.get('email') ?? ''),\n        password: String(params.get('password') ?? ''),\n        remember: parseBooleanToken(params.get('remember')) === true,\n        tenantIdRaw: String(params.get('tenantId') ?? params.get('tenant') ?? '').trim(),\n        requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n        redirectTo: String(params.get('redirect') ?? ''),\n      }\n    }\n\n    const form = await req.formData()\n    const requireRoleRaw = String(form.get('requireRole') ?? form.get('role') ?? '').trim()\n    return {\n      email: String(form.get('email') ?? ''),\n      password: String(form.get('password') ?? ''),\n      remember: parseBooleanToken(form.get('remember')?.toString()) === true,\n      tenantIdRaw: String(form.get('tenantId') ?? form.get('tenant') ?? '').trim(),\n      requiredRoles: requireRoleRaw ? parseRequiredRoles(requireRoleRaw) : [],\n      redirectTo: String(form.get('redirect') ?? ''),\n    }\n  } catch {\n    return {\n      email: '',\n      password: '',\n      remember: false,\n      tenantIdRaw: '',\n      requiredRoles: [],\n      redirectTo: '',\n    }\n  }\n}\n\n// Resolving translations can itself be what failed, so the generic message is\n// recovered defensively \u2014 the error path must never throw a second time.\nasync function resolveGenericLoginError(): Promise<string> {\n  try {\n    const { translate } = await resolveTranslations()\n    return translate('auth.login.errors.generic', 'An error occurred. Please try again.')\n  } catch {\n    return 'An error occurred. Please try again.'\n  }\n}\n\nexport async function POST(req: Request) {\n  try {\n    return await handleLoginRequest(req)\n  } catch (error) {\n    return handleAuthRouteError(error, {\n      scope: 'auth.login',\n      message: await resolveGenericLoginError(),\n    })\n  }\n}\n\nasync function handleLoginRequest(req: Request) {\n  const { translate } = await resolveTranslations()\n  const { email, password, remember, tenantIdRaw, requiredRoles, redirectTo } = await parseLoginForm(req)\n  // Rate limit \u2014 two layers, both checked before validation and DB work\n  const { error: rateLimitError, compoundKey: rateLimitCompoundKey } = await checkAuthRateLimit({\n    req, ipConfig: loginIpRateLimitConfig, compoundConfig: loginRateLimitConfig, compoundIdentifier: email,\n  })\n  if (rateLimitError) return rateLimitError\n  const parsed = userLoginSchema.pick({ email: true, password: true, tenantId: true }).safeParse({\n    email,\n    password,\n    tenantId: tenantIdRaw || undefined,\n  })\n  if (!parsed.success) {\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid credentials') }, { status: 400 })\n  }\n  const container = await createRequestContainer()\n  const auth = (container.resolve('authService') as AuthService)\n  const tenantId = parsed.data.tenantId ?? null\n  let user = null\n  if (tenantId) {\n    user = await auth.findUserByEmailAndTenant(parsed.data.email, tenantId)\n  } else {\n    const users = await auth.findUsersByEmail(parsed.data.email)\n    // Never disclose that an email is registered across multiple tenants \u2014 a\n    // password-independent 400-vs-401 response is an account/topology oracle\n    // (issue #2242). Treat an ambiguous match as no resolvable user and fall\n    // through to the uniform invalid-credentials path; tenant-selection\n    // guidance is delivered out-of-band via the activation/login link.\n    user = users.length === 1 ? users[0] : null\n  }\n  // Always verify the password \u2014 verifyPassword runs a constant-time bcrypt\n  // comparison even when the user is missing or has no hash \u2014 so unknown-email,\n  // wrong-password, and multi-tenant cases return an identical 401 with\n  // identical latency.\n  const ok = await auth.verifyPassword(user, parsed.data.password)\n  if (!user || !ok || user.isConfirmed === false) {\n    // The 401 body stays identical for every branch so the response never reveals\n    // which one fired. `reason` goes to the audit stream instead, where separating a\n    // deactivated account from a mistyped password is the whole point \u2014 otherwise\n    // repeated attempts against a disabled account look like ordinary fat-fingering.\n    let reason: string\n    if (user && user.isConfirmed === false) reason = 'account_deactivated'\n    else if (user?.passwordHash) reason = 'invalid_password'\n    else reason = 'invalid_credentials'\n    void emitAuthEvent('auth.login.failed', { email: parsed.data.email, reason }).catch(() => undefined)\n    return NextResponse.json({ ok: false, error: translate('auth.login.errors.invalidCredentials', 'Invalid email or password') }, { status: 401 })\n  }\n  // Optional role requirement\n  if (requiredRoles.length) {\n    const userRoleNames = await auth.getUserRoles(user, tenantId ?? (user.tenantId ? String(user.tenantId) : null))\n    const authorized = requiredRoles.some(r => userRoleNames.includes(r))\n    if (!authorized) {\n      return NextResponse.json({ ok: false, error: translate('auth.login.errors.permissionDenied', 'Not authorized for this area') }, { status: 403 })\n    }\n  }\n  await auth.updateLastLoginAt(user)\n  // Reset rate limit counter on successful login so legitimate users aren't penalized for prior typos\n  if (rateLimitCompoundKey) {\n    await resetAuthRateLimit(rateLimitCompoundKey, loginRateLimitConfig)\n  }\n  const resolvedTenantId = tenantId ?? (user.tenantId ? String(user.tenantId) : null)\n  const userRoleNames = await auth.getUserRoles(user, resolvedTenantId)\n  try {\n    const eventBus = (container.resolve('eventBus') as EventBus)\n    void eventBus.emitEvent('query_index.coverage.warmup', {\n      tenantId: resolvedTenantId,\n    }).catch(() => undefined)\n  } catch {\n    // optional warmup\n  }\n  const rememberMeDays = Number(process.env.REMEMBER_ME_DAYS || '30')\n  const accessTokenMaxAgeSeconds = 60 * 60 * 8\n  const sessionExpiresAt = remember\n    ? new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    : new Date(Date.now() + accessTokenMaxAgeSeconds * 1000)\n  const { session: loginSession, token: sessionRefreshToken } = await auth.createSession(user, sessionExpiresAt)\n  const token = signJwt({\n    sub: String(user.id),\n    sid: String(loginSession.id),\n    tenantId: resolvedTenantId,\n    orgId: user.organizationId ? String(user.organizationId) : null,\n    email: user.email,\n    roles: userRoleNames\n  })\n  void emitAuthEvent('auth.login.success', { id: String(user.id), email: user.email, tenantId: resolvedTenantId, organizationId: user.organizationId ? String(user.organizationId) : null }).catch(() => undefined)\n  const responseData: { ok: true; token: string; redirect: string; refreshToken?: string } = {\n    ok: true,\n    token,\n    redirect: sanitizeRedirectPath(redirectTo, getAppBaseUrl(req), '/backend'),\n  }\n  if (remember) {\n    responseData.refreshToken = sessionRefreshToken\n  }\n  const em = container.resolve('em')\n  const interceptedResponse = await runCustomRouteAfterInterceptors({\n    routePath: 'auth/login',\n    method: 'POST',\n    request: {\n      method: 'POST',\n      url: req.url,\n      body: {\n        email: parsed.data.email,\n        tenantId: parsed.data.tenantId ?? undefined,\n        remember,\n        requireRole: requiredRoles.length > 0 ? requiredRoles : undefined,\n      },\n      headers: Object.fromEntries(req.headers.entries()),\n    },\n    response: {\n      statusCode: 200,\n      body: responseData,\n      headers: {},\n    },\n    context: {\n      em,\n      container,\n    },\n  })\n  if (!interceptedResponse.ok) {\n    return NextResponse.json(interceptedResponse.body, { status: interceptedResponse.statusCode })\n  }\n\n  const interceptedBody = interceptedResponse.body\n  const authTokenForCookie = typeof interceptedBody.token === 'string' && interceptedBody.token.length > 0\n    ? interceptedBody.token\n    : token\n  const refreshTokenForCookie = typeof interceptedBody.refreshToken === 'string'\n    ? interceptedBody.refreshToken\n    : undefined\n\n  // An interceptor that swaps the issued token (the MFA challenge hands back a provisional\n  // `mfa_pending` token) has not completed authentication. Any `session_token` still in the\n  // browser from an earlier login would let `GET /api/auth/session/refresh` mint a full staff\n  // token and skip the outstanding second factor, so it is cleared alongside the swap.\n  const authTokenReplacedByInterceptor = authTokenForCookie !== token\n\n  const res = NextResponse.json(interceptedBody, { status: interceptedResponse.statusCode })\n  res.cookies.set('auth_token', authTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  if (remember && refreshTokenForCookie) {\n    const expiresAt = new Date(Date.now() + rememberMeDays * 24 * 60 * 60 * 1000)\n    res.cookies.set('session_token', refreshTokenForCookie, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', expires: expiresAt })\n  } else if (!remember && !authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', sessionRefreshToken, { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: accessTokenMaxAgeSeconds })\n  } else if (authTokenReplacedByInterceptor) {\n    res.cookies.set('session_token', '', { httpOnly: true, path: '/', sameSite: 'lax', secure: process.env.NODE_ENV === 'production', maxAge: 0 })\n  }\n  return res\n}\n\nconst loginRequestSchema = userLoginSchema.extend({\n  password: z.string().min(6).describe('User password'),\n  remember: z.enum(['on', '1', 'true']).optional().describe('Persist the session (submit `on`, `1`, or `true`).'),\n}).describe('Login form payload')\n\nconst loginSuccessSchema = z.object({\n  ok: z.literal(true),\n  token: z.string().describe('JWT token issued for subsequent API calls'),\n  redirect: z.string().nullable().describe('Next location the client should navigate to'),\n  refreshToken: z.string().optional().describe('Long-lived refresh token for obtaining new access tokens (only present when remember=true)'),\n})\n\nconst loginErrorSchema = z.object({\n  ok: z.literal(false),\n  error: z.string(),\n})\n\nconst loginMethodDoc: OpenApiMethodDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Validates the submitted credentials and issues a bearer token cookie for subsequent API calls.',\n  tags: ['Authentication & Accounts'],\n  requestBody: {\n    contentType: 'application/x-www-form-urlencoded',\n    schema: loginRequestSchema,\n    description: 'Form-encoded payload captured from the login form.',\n  },\n  responses: [\n    {\n      status: 200,\n      description: 'Authentication succeeded',\n      schema: loginSuccessSchema,\n    },\n  ],\n  errors: [\n    { status: 400, description: 'Validation failed', schema: loginErrorSchema },\n    { status: 401, description: 'Invalid credentials', schema: loginErrorSchema },\n    { status: 403, description: 'User lacks required role', schema: loginErrorSchema },\n    { status: 429, description: 'Too many login attempts', schema: rateLimitErrorSchema },\n  ],\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  summary: 'Authenticate user credentials',\n  description: 'Accepts login form submissions and manages cookie/session issuance.',\n  methods: {\n    POST: loginMethodDoc,\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,uBAAuB;AAChC,SAAS,8BAA8B;AAEvC,SAAS,eAAe;AACxB,SAAS,2BAA2B;AAEpC,SAAS,yBAAyB;AAClC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,oBAAoB,0BAA0B;AACvD,SAAS,uCAAuC;AAChD,SAAS,4BAA4B;AACrC,SAAS,qBAAqB;AAC9B,SAAS,4BAA4B;AAErC,MAAM,uBAAuB,4BAA4B,SAAS;AAAA,EAChE,QAAQ;AAAA,EAAG,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AACzD,CAAC;AACD,MAAM,yBAAyB,4BAA4B,YAAY;AAAA,EACrE,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAI,eAAe;AAAA,EAAI,WAAW;AAC1D,CAAC;AAEM,MAAM,WAAW,EAAE,aAAa,MAAM;AAa7C,SAAS,mBAAmB,UAA4B;AACtD,SAAO,SACJ,MAAM,GAAG,EACT,IAAI,CAAC,UAAU,MAAM,KAAK,CAAC,EAC3B,OAAO,OAAO;AACnB;AAEA,eAAe,eAAe,KAAwC;AACpE,QAAM,iBAAiB,IAAI,QAAQ,IAAI,cAAc,KAAK;AAC1D,QAAM,cAAc,eAAe,MAAM,GAAG,EAAE,CAAC,EAAE,KAAK,EAAE,YAAY;AAEpE,MAAI;AACF,QAAI,gBAAgB,qCAAqC;AACvD,YAAM,OAAO,MAAM,IAAI,KAAK;AAC5B,YAAM,SAAS,IAAI,gBAAgB,IAAI;AACvC,YAAMA,kBAAiB,OAAO,OAAO,IAAI,aAAa,KAAK,OAAO,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AAC1F,aAAO;AAAA,QACL,OAAO,OAAO,OAAO,IAAI,OAAO,KAAK,EAAE;AAAA,QACvC,UAAU,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,QAC7C,UAAU,kBAAkB,OAAO,IAAI,UAAU,CAAC,MAAM;AAAA,QACxD,aAAa,OAAO,OAAO,IAAI,UAAU,KAAK,OAAO,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,QAC/E,eAAeA,kBAAiB,mBAAmBA,eAAc,IAAI,CAAC;AAAA,QACtE,YAAY,OAAO,OAAO,IAAI,UAAU,KAAK,EAAE;AAAA,MACjD;AAAA,IACF;AAEA,UAAM,OAAO,MAAM,IAAI,SAAS;AAChC,UAAM,iBAAiB,OAAO,KAAK,IAAI,aAAa,KAAK,KAAK,IAAI,MAAM,KAAK,EAAE,EAAE,KAAK;AACtF,WAAO;AAAA,MACL,OAAO,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAAA,MACrC,UAAU,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,MAC3C,UAAU,kBAAkB,KAAK,IAAI,UAAU,GAAG,SAAS,CAAC,MAAM;AAAA,MAClE,aAAa,OAAO,KAAK,IAAI,UAAU,KAAK,KAAK,IAAI,QAAQ,KAAK,EAAE,EAAE,KAAK;AAAA,MAC3E,eAAe,iBAAiB,mBAAmB,cAAc,IAAI,CAAC;AAAA,MACtE,YAAY,OAAO,KAAK,IAAI,UAAU,KAAK,EAAE;AAAA,IAC/C;AAAA,EACF,QAAQ;AACN,WAAO;AAAA,MACL,OAAO;AAAA,MACP,UAAU;AAAA,MACV,UAAU;AAAA,MACV,aAAa;AAAA,MACb,eAAe,CAAC;AAAA,MAChB,YAAY;AAAA,IACd;AAAA,EACF;AACF;AAIA,eAAe,2BAA4C;AACzD,MAAI;AACF,UAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,WAAO,UAAU,6BAA6B,sCAAsC;AAAA,EACtF,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAEA,eAAsB,KAAK,KAAc;AACvC,MAAI;AACF,WAAO,MAAM,mBAAmB,GAAG;AAAA,EACrC,SAAS,OAAO;AACd,WAAO,qBAAqB,OAAO;AAAA,MACjC,OAAO;AAAA,MACP,SAAS,MAAM,yBAAyB;AAAA,IAC1C,CAAC;AAAA,EACH;AACF;AAEA,eAAe,mBAAmB,KAAc;AAC9C,QAAM,EAAE,UAAU,IAAI,MAAM,oBAAoB;AAChD,QAAM,EAAE,OAAO,UAAU,UAAU,aAAa,eAAe,WAAW,IAAI,MAAM,eAAe,GAAG;AAEtG,QAAM,EAAE,OAAO,gBAAgB,aAAa,qBAAqB,IAAI,MAAM,mBAAmB;AAAA,IAC5F;AAAA,IAAK,UAAU;AAAA,IAAwB,gBAAgB;AAAA,IAAsB,oBAAoB;AAAA,EACnG,CAAC;AACD,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,gBAAgB,KAAK,EAAE,OAAO,MAAM,UAAU,MAAM,UAAU,KAAK,CAAC,EAAE,UAAU;AAAA,IAC7F;AAAA,IACA;AAAA,IACA,UAAU,eAAe;AAAA,EAC3B,CAAC;AACD,MAAI,CAAC,OAAO,SAAS;AACnB,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,qBAAqB,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAC1I;AACA,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAQ,UAAU,QAAQ,aAAa;AAC7C,QAAM,WAAW,OAAO,KAAK,YAAY;AACzC,MAAI,OAAO;AACX,MAAI,UAAU;AACZ,WAAO,MAAM,KAAK,yBAAyB,OAAO,KAAK,OAAO,QAAQ;AAAA,EACxE,OAAO;AACL,UAAM,QAAQ,MAAM,KAAK,iBAAiB,OAAO,KAAK,KAAK;AAM3D,WAAO,MAAM,WAAW,IAAI,MAAM,CAAC,IAAI;AAAA,EACzC;AAKA,QAAM,KAAK,MAAM,KAAK,eAAe,MAAM,OAAO,KAAK,QAAQ;AAC/D,MAAI,CAAC,QAAQ,CAAC,MAAM,KAAK,gBAAgB,OAAO;AAK9C,QAAI;AACJ,QAAI,QAAQ,KAAK,gBAAgB,MAAO,UAAS;AAAA,aACxC,MAAM,aAAc,UAAS;AAAA,QACjC,UAAS;AACd,SAAK,cAAc,qBAAqB,EAAE,OAAO,OAAO,KAAK,OAAO,OAAO,CAAC,EAAE,MAAM,MAAM,MAAS;AACnG,WAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,wCAAwC,2BAA2B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAChJ;AAEA,MAAI,cAAc,QAAQ;AACxB,UAAMC,iBAAgB,MAAM,KAAK,aAAa,MAAM,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI,KAAK;AAC9G,UAAM,aAAa,cAAc,KAAK,OAAKA,eAAc,SAAS,CAAC,CAAC;AACpE,QAAI,CAAC,YAAY;AACf,aAAO,aAAa,KAAK,EAAE,IAAI,OAAO,OAAO,UAAU,sCAAsC,8BAA8B,EAAE,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IACjJ;AAAA,EACF;AACA,QAAM,KAAK,kBAAkB,IAAI;AAEjC,MAAI,sBAAsB;AACxB,UAAM,mBAAmB,sBAAsB,oBAAoB;AAAA,EACrE;AACA,QAAM,mBAAmB,aAAa,KAAK,WAAW,OAAO,KAAK,QAAQ,IAAI;AAC9E,QAAM,gBAAgB,MAAM,KAAK,aAAa,MAAM,gBAAgB;AACpE,MAAI;AACF,UAAM,WAAY,UAAU,QAAQ,UAAU;AAC9C,SAAK,SAAS,UAAU,+BAA+B;AAAA,MACrD,UAAU;AAAA,IACZ,CAAC,EAAE,MAAM,MAAM,MAAS;AAAA,EAC1B,QAAQ;AAAA,EAER;AACA,QAAM,iBAAiB,OAAO,QAAQ,IAAI,oBAAoB,IAAI;AAClE,QAAM,2BAA2B,KAAK,KAAK;AAC3C,QAAM,mBAAmB,WACrB,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI,IAC1D,IAAI,KAAK,KAAK,IAAI,IAAI,2BAA2B,GAAI;AACzD,QAAM,EAAE,SAAS,cAAc,OAAO,oBAAoB,IAAI,MAAM,KAAK,cAAc,MAAM,gBAAgB;AAC7G,QAAM,QAAQ,QAAQ;AAAA,IACpB,KAAK,OAAO,KAAK,EAAE;AAAA,IACnB,KAAK,OAAO,aAAa,EAAE;AAAA,IAC3B,UAAU;AAAA,IACV,OAAO,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI;AAAA,IAC3D,OAAO,KAAK;AAAA,IACZ,OAAO;AAAA,EACT,CAAC;AACD,OAAK,cAAc,sBAAsB,EAAE,IAAI,OAAO,KAAK,EAAE,GAAG,OAAO,KAAK,OAAO,UAAU,kBAAkB,gBAAgB,KAAK,iBAAiB,OAAO,KAAK,cAAc,IAAI,KAAK,CAAC,EAAE,MAAM,MAAM,MAAS;AAChN,QAAM,eAAqF;AAAA,IACzF,IAAI;AAAA,IACJ;AAAA,IACA,UAAU,qBAAqB,YAAY,cAAc,GAAG,GAAG,UAAU;AAAA,EAC3E;AACA,MAAI,UAAU;AACZ,iBAAa,eAAe;AAAA,EAC9B;AACA,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,sBAAsB,MAAM,gCAAgC;AAAA,IAChE,WAAW;AAAA,IACX,QAAQ;AAAA,IACR,SAAS;AAAA,MACP,QAAQ;AAAA,MACR,KAAK,IAAI;AAAA,MACT,MAAM;AAAA,QACJ,OAAO,OAAO,KAAK;AAAA,QACnB,UAAU,OAAO,KAAK,YAAY;AAAA,QAClC;AAAA,QACA,aAAa,cAAc,SAAS,IAAI,gBAAgB;AAAA,MAC1D;AAAA,MACA,SAAS,OAAO,YAAY,IAAI,QAAQ,QAAQ,CAAC;AAAA,IACnD;AAAA,IACA,UAAU;AAAA,MACR,YAAY;AAAA,MACZ,MAAM;AAAA,MACN,SAAS,CAAC;AAAA,IACZ;AAAA,IACA,SAAS;AAAA,MACP;AAAA,MACA;AAAA,IACF;AAAA,EACF,CAAC;AACD,MAAI,CAAC,oBAAoB,IAAI;AAC3B,WAAO,aAAa,KAAK,oBAAoB,MAAM,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AAAA,EAC/F;AAEA,QAAM,kBAAkB,oBAAoB;AAC5C,QAAM,qBAAqB,OAAO,gBAAgB,UAAU,YAAY,gBAAgB,MAAM,SAAS,IACnG,gBAAgB,QAChB;AACJ,QAAM,wBAAwB,OAAO,gBAAgB,iBAAiB,WAClE,gBAAgB,eAChB;AAMJ,QAAM,iCAAiC,uBAAuB;AAE9D,QAAM,MAAM,aAAa,KAAK,iBAAiB,EAAE,QAAQ,oBAAoB,WAAW,CAAC;AACzF,MAAI,QAAQ,IAAI,cAAc,oBAAoB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AACjL,MAAI,YAAY,uBAAuB;AACrC,UAAM,YAAY,IAAI,KAAK,KAAK,IAAI,IAAI,iBAAiB,KAAK,KAAK,KAAK,GAAI;AAC5E,QAAI,QAAQ,IAAI,iBAAiB,uBAAuB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,SAAS,UAAU,CAAC;AAAA,EAC3K,WAAW,CAAC,YAAY,CAAC,gCAAgC;AACvD,QAAI,QAAQ,IAAI,iBAAiB,qBAAqB,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,yBAAyB,CAAC;AAAA,EACvL,WAAW,gCAAgC;AACzC,QAAI,QAAQ,IAAI,iBAAiB,IAAI,EAAE,UAAU,MAAM,MAAM,KAAK,UAAU,OAAO,QAAQ,QAAQ,IAAI,aAAa,cAAc,QAAQ,EAAE,CAAC;AAAA,EAC/I;AACA,SAAO;AACT;AAEA,MAAM,qBAAqB,gBAAgB,OAAO;AAAA,EAChD,UAAU,EAAE,OAAO,EAAE,IAAI,CAAC,EAAE,SAAS,eAAe;AAAA,EACpD,UAAU,EAAE,KAAK,CAAC,MAAM,KAAK,MAAM,CAAC,EAAE,SAAS,EAAE,SAAS,oDAAoD;AAChH,CAAC,EAAE,SAAS,oBAAoB;AAEhC,MAAM,qBAAqB,EAAE,OAAO;AAAA,EAClC,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,OAAO,EAAE,SAAS,2CAA2C;AAAA,EACtE,UAAU,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,6CAA6C;AAAA,EACtF,cAAc,EAAE,OAAO,EAAE,SAAS,EAAE,SAAS,4FAA4F;AAC3I,CAAC;AAED,MAAM,mBAAmB,EAAE,OAAO;AAAA,EAChC,IAAI,EAAE,QAAQ,KAAK;AAAA,EACnB,OAAO,EAAE,OAAO;AAClB,CAAC;AAED,MAAM,iBAAmC;AAAA,EACvC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,MAAM,CAAC,2BAA2B;AAAA,EAClC,aAAa;AAAA,IACX,aAAa;AAAA,IACb,QAAQ;AAAA,IACR,aAAa;AAAA,EACf;AAAA,EACA,WAAW;AAAA,IACT;AAAA,MACE,QAAQ;AAAA,MACR,aAAa;AAAA,MACb,QAAQ;AAAA,IACV;AAAA,EACF;AAAA,EACA,QAAQ;AAAA,IACN,EAAE,QAAQ,KAAK,aAAa,qBAAqB,QAAQ,iBAAiB;AAAA,IAC1E,EAAE,QAAQ,KAAK,aAAa,uBAAuB,QAAQ,iBAAiB;AAAA,IAC5E,EAAE,QAAQ,KAAK,aAAa,4BAA4B,QAAQ,iBAAiB;AAAA,IACjF,EAAE,QAAQ,KAAK,aAAa,2BAA2B,QAAQ,qBAAqB;AAAA,EACtF;AACF;AAEO,MAAM,UAA2B;AAAA,EACtC,SAAS;AAAA,EACT,aAAa;AAAA,EACb,SAAS;AAAA,IACP,MAAM;AAAA,EACR;AACF;",
   "names": ["requireRoleRaw", "userRoleNames"]
 }

package/dist/modules/auth/api/reset/validate.js

@@ -0,0 +1,55 @@
+import { validatePasswordResetTokenSchema } from "@open-mercato/core/modules/auth/data/validators";
+import { NextResponse } from "next/server";
+import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
+import { z } from "zod";
+import { rateLimitErrorSchema } from "@open-mercato/shared/lib/ratelimit/helpers";
+import { readEndpointRateLimitConfig } from "@open-mercato/shared/lib/ratelimit/config";
+import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
+const resetValidateRateLimitConfig = readEndpointRateLimitConfig("RESET_VALIDATE", {
+  points: 10,
+  duration: 300,
+  keyPrefix: "reset-validate"
+});
+async function POST(req) {
+  const form = await req.formData();
+  const token = String(form.get("token") ?? "");
+  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig });
+  if (rateLimitError) return rateLimitError;
+  const parsed = validatePasswordResetTokenSchema.safeParse({ token });
+  if (!parsed.success) return NextResponse.json({ ok: true, valid: false });
+  const container = await createRequestContainer();
+  const auth = container.resolve("authService");
+  const valid = await auth.isPasswordResetTokenValid(parsed.data.token);
+  return NextResponse.json({ ok: true, valid });
+}
+const metadata = { requireAuth: false };
+const passwordResetValidateResponseSchema = z.object({
+  ok: z.literal(true),
+  valid: z.boolean()
+});
+const openApi = {
+  tag: "Authentication & Accounts",
+  summary: "Check a password reset token",
+  methods: {
+    POST: {
+      summary: "Check whether a password reset token is still usable",
+      description: "Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.",
+      requestBody: {
+        contentType: "application/x-www-form-urlencoded",
+        schema: validatePasswordResetTokenSchema
+      },
+      responses: [
+        { status: 200, description: "Token state resolved", schema: passwordResetValidateResponseSchema }
+      ],
+      errors: [
+        { status: 429, description: "Too many token validation attempts", schema: rateLimitErrorSchema }
+      ]
+    }
+  }
+};
+export {
+  POST,
+  metadata,
+  openApi
+};
+//# sourceMappingURL=validate.js.map

package/dist/modules/auth/api/reset/validate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../../src/modules/auth/api/reset/validate.ts"],
+  "sourcesContent": ["import { validatePasswordResetTokenSchema } from '@open-mercato/core/modules/auth/data/validators'\nimport { NextResponse } from 'next/server'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { AuthService } from '@open-mercato/core/modules/auth/services/authService'\nimport { z } from 'zod'\nimport { rateLimitErrorSchema } from '@open-mercato/shared/lib/ratelimit/helpers'\nimport { readEndpointRateLimitConfig } from '@open-mercato/shared/lib/ratelimit/config'\nimport { checkAuthRateLimit } from '@open-mercato/core/modules/auth/lib/rateLimitCheck'\n\nconst resetValidateRateLimitConfig = readEndpointRateLimitConfig('RESET_VALIDATE', {\n  points: 10, duration: 300, keyPrefix: 'reset-validate',\n})\n\nexport async function POST(req: Request) {\n  const form = await req.formData()\n  const token = String(form.get('token') ?? '')\n  // Rate limit by IP \u2014 checked before validation and DB work\n  const { error: rateLimitError } = await checkAuthRateLimit({ req, ipConfig: resetValidateRateLimitConfig })\n  if (rateLimitError) return rateLimitError\n  const parsed = validatePasswordResetTokenSchema.safeParse({ token })\n  // A malformed token is reported as simply not valid: the caller learns nothing\n  // it could not learn by posting the same token to /api/auth/reset/confirm.\n  if (!parsed.success) return NextResponse.json({ ok: true, valid: false })\n  const container = await createRequestContainer()\n  const auth = container.resolve<AuthService>('authService')\n  const valid = await auth.isPasswordResetTokenValid(parsed.data.token)\n  return NextResponse.json({ ok: true, valid })\n}\n\nexport const metadata = { requireAuth: false }\n\nconst passwordResetValidateResponseSchema = z.object({\n  ok: z.literal(true),\n  valid: z.boolean(),\n})\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Check a password reset token',\n  methods: {\n    POST: {\n      summary: 'Check whether a password reset token is still usable',\n      description: 'Reports whether a reset token exists, is unused, and has not expired, so the reset page can render a terminal state instead of a form the token can never submit. The token is never consumed and the response never distinguishes unknown, used, and expired tokens.',\n      requestBody: {\n        contentType: 'application/x-www-form-urlencoded',\n        schema: validatePasswordResetTokenSchema,\n      },\n      responses: [\n        { status: 200, description: 'Token state resolved', schema: passwordResetValidateResponseSchema },\n      ],\n      errors: [\n        { status: 429, description: 'Too many token validation attempts', schema: rateLimitErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,wCAAwC;AACjD,SAAS,oBAAoB;AAE7B,SAAS,8BAA8B;AAEvC,SAAS,SAAS;AAClB,SAAS,4BAA4B;AACrC,SAAS,mCAAmC;AAC5C,SAAS,0BAA0B;AAEnC,MAAM,+BAA+B,4BAA4B,kBAAkB;AAAA,EACjF,QAAQ;AAAA,EAAI,UAAU;AAAA,EAAK,WAAW;AACxC,CAAC;AAED,eAAsB,KAAK,KAAc;AACvC,QAAM,OAAO,MAAM,IAAI,SAAS;AAChC,QAAM,QAAQ,OAAO,KAAK,IAAI,OAAO,KAAK,EAAE;AAE5C,QAAM,EAAE,OAAO,eAAe,IAAI,MAAM,mBAAmB,EAAE,KAAK,UAAU,6BAA6B,CAAC;AAC1G,MAAI,eAAgB,QAAO;AAC3B,QAAM,SAAS,iCAAiC,UAAU,EAAE,MAAM,CAAC;AAGnE,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,IAAI,MAAM,OAAO,MAAM,CAAC;AACxE,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,OAAO,UAAU,QAAqB,aAAa;AACzD,QAAM,QAAQ,MAAM,KAAK,0BAA0B,OAAO,KAAK,KAAK;AACpE,SAAO,aAAa,KAAK,EAAE,IAAI,MAAM,MAAM,CAAC;AAC9C;AAEO,MAAM,WAAW,EAAE,aAAa,MAAM;AAE7C,MAAM,sCAAsC,EAAE,OAAO;AAAA,EACnD,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,OAAO,EAAE,QAAQ;AACnB,CAAC;AAEM,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,MAAM;AAAA,MACJ,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,wBAAwB,QAAQ,oCAAoC;AAAA,MAClG;AAAA,MACA,QAAQ;AAAA,QACN,EAAE,QAAQ,KAAK,aAAa,sCAAsC,QAAQ,qBAAqB;AAAA,MACjG;AAAA,IACF;AAAA,EACF;AACF;",
+  "names": []
+}

package/dist/modules/auth/api/roles/acl/route.js

@@ -5,7 +5,6 @@ import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
 import { logCrudAccess } from "@open-mercato/shared/lib/crud/factory";
 import { isCrudHttpError } from "@open-mercato/shared/lib/crud/errors";
 import { enforceCommandOptimisticLockWithGuards } from "@open-mercato/shared/lib/crud/optimistic-lock-command";
-import { withAtomicFlush } from "@open-mercato/shared/lib/commands/flush";
 import { RoleAcl, Role } from "@open-mercato/core/modules/auth/data/entities";
 import { resolveIsSuperAdmin } from "@open-mercato/core/modules/auth/lib/tenantAccess";
 import {
@@ -13,6 +12,9 @@ import {
   assertActorCanModifySuperAdminRoleTarget,
   normalizeGrantFeatureList
 } from "@open-mercato/core/modules/auth/lib/grantChecks";
+import {
+  AUTH_ROLE_ACL_UPDATE_COMMAND_ID
+} from "@open-mercato/core/modules/auth/commands/acl";
 const getSchema = z.object({
   roleId: z.string().uuid(),
   tenantId: z.string().uuid().optional()
@@ -149,7 +151,7 @@ async function PUT(req) {
       throw err;
     }
   }
-  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId });
+  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId });
   if (acl) {
     try {
       await enforceCommandOptimisticLockWithGuards(container, {
@@ -162,17 +164,10 @@ async function PUT(req) {
       if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
       throw err;
     }
-  } else {
-    acl = em.create(RoleAcl, {
-      role,
-      tenantId: targetTenantId,
-      createdAt: /* @__PURE__ */ new Date(),
-      isSuperAdmin: false
-    });
   }
-  const existingIsSuperAdmin = !!acl.isSuperAdmin;
-  const existingFeatures = normalizeGrantFeatureList(acl.featuresJson);
-  const existingOrganizations = normalizeOrganizations(acl.organizationsJson);
+  const existingIsSuperAdmin = !!acl?.isSuperAdmin;
+  const existingFeatures = normalizeGrantFeatureList(acl?.featuresJson);
+  const existingOrganizations = normalizeOrganizations(acl?.organizationsJson);
   const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin;
   const requestedFeatures = parsed.data.features === void 0 ? existingFeatures : normalizeGrantFeatureList(parsed.data.features);
   const requestedOrganizations = parsed.data.organizations === void 0 ? existingOrganizations : normalizeOrganizations(parsed.data.organizations);
@@ -191,27 +186,27 @@ async function PUT(req) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status });
     throw err;
   }
-  const aclToPersist = acl;
-  await withAtomicFlush(
-    em,
-    [
-      () => {
-        aclToPersist.organizationsJson = requestedOrganizations;
-        aclToPersist.isSuperAdmin = requestedIsSuperAdmin;
-        aclToPersist.featuresJson = requestedFeatures;
-        em.persist(aclToPersist);
-      }
-    ],
-    { transaction: true }
-  );
-  if (targetTenantId) {
-    await rbacService.invalidateTenantCache(targetTenantId);
-    try {
-      const cache = container.resolve("cache");
-      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`]);
-    } catch {
-    }
-  }
+  const commandBus = container.resolve("commandBus");
+  const isForeignTenant = targetTenantId !== (auth.tenantId ?? null);
+  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null;
+  const commandCtx = {
+    container,
+    auth: isForeignTenant ? { ...auth, orgId: null } : auth,
+    organizationScope: null,
+    selectedOrganizationId: actorOrgId,
+    organizationIds: actorOrgId ? [actorOrgId] : null,
+    request: req
+  };
+  await commandBus.execute(AUTH_ROLE_ACL_UPDATE_COMMAND_ID, {
+    input: {
+      roleId: String(role.id),
+      tenantId: targetTenantId,
+      isSuperAdmin: requestedIsSuperAdmin,
+      features: requestedFeatures,
+      organizations: requestedOrganizations
+    },
+    ctx: commandCtx
+  });
   return NextResponse.json({
     ok: true,
     sanitized: false

package/dist/modules/auth/api/roles/acl/route.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../../../../src/modules/auth/api/roles/acl/route.ts"],
-  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport { withAtomicFlush } from '@open-mercato/shared/lib/commands/flush'\nimport { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminRoleTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\n\ntype TaggableCache = { deleteByTags?: (tags: string[]) => Promise<void> | void }\n\nconst getSchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  roleId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst roleAclResponseSchema = z.object({\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst roleAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst roleAclErrorSchema = z.object({ error: z.string() })\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    roleId: url.searchParams.get('roleId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = container.resolve('em') as EntityManager\n  const authTenantId = auth.tenantId ?? null\n  const roleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    roleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, roleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let tenantScope = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== tenantScope) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) tenantScope = parsed.data.tenantId\n    else return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (!tenantScope && !isSuperAdmin) tenantScope = authTenantId ?? null\n\n  if (!isSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminRoleTarget({\n        em,\n        rbacService: container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: tenantScope,\n        organizationId: auth.orgId ?? null,\n        targetRoleId: parsed.data.roleId,\n        actorIsSuperAdmin: false,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = tenantScope\n    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })\n    : null\n  const response = acl\n    ? {\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.roleId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.role_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId: tenantScope,\n    query: { roleId: parsed.data.roleId, tenantId: tenantScope },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const rbacService = container.resolve('rbacService') as RbacService\n  const authTenantId = auth.tenantId ?? null\n  const putRoleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    putRoleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, putRoleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let targetTenantId = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== targetTenantId) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) {\n      targetTenantId = parsed.data.tenantId\n    } else {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n  if (!targetTenantId && !isSuperAdmin) targetTenantId = authTenantId ?? null\n  if (!targetTenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!isSuperAdmin && targetTenantId !== authTenantId) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  if (!isSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminRoleTarget({\n        em,\n        rbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        targetRoleId: parsed.data.roleId,\n        actorIsSuperAdmin: false,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  let acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })\n  // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same\n  // role's features in parallel cannot silently clobber each other (#2055). The\n  // check is strictly additive \u2014 when the client sends no expected-version header\n  // it is a no-op. Skipped when the ACL row does not exist yet (first grant has\n  // no prior version to conflict with).\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.role_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  } else {\n    acl = em.create(RoleAcl, {\n      role,\n      tenantId: targetTenantId,\n      createdAt: new Date(),\n      isSuperAdmin: false,\n    })\n  }\n\n  const existingIsSuperAdmin = !!acl.isSuperAdmin\n  const existingFeatures = normalizeGrantFeatureList(acl.featuresJson)\n  const existingOrganizations = normalizeOrganizations(acl.organizationsJson)\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n  const requestedFeatures = parsed.data.features === undefined\n    ? existingFeatures\n    : normalizeGrantFeatureList(parsed.data.features)\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  try {\n    await assertActorCanGrantAcl({\n      em,\n      rbacService,\n      actorUserId: auth.sub,\n      tenantId: targetTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Persist the ACL mutation inside a transaction so the role-permission write\n  // commits atomically (proper ACL-edit transaction handling).\n  const aclToPersist = acl\n  await withAtomicFlush(\n    em,\n    [\n      () => {\n        aclToPersist.organizationsJson = requestedOrganizations\n        aclToPersist.isSuperAdmin = requestedIsSuperAdmin\n        aclToPersist.featuresJson = requestedFeatures\n        em.persist(aclToPersist)\n      },\n    ],\n    { transaction: true },\n  )\n\n  // Invalidate cache for all users in this tenant since role ACL changed\n  if (targetTenantId) {\n    await rbacService.invalidateTenantCache(targetTenantId)\n    // Sidebar nav caches depend on RBAC; invalidate tenant scope nav caches\n    try {\n      const cache = container.resolve('cache') as TaggableCache | undefined\n      if (cache?.deleteByTags) await cache.deleteByTags([`rbac:tenant:${targetTenantId}`])\n    } catch {}\n  }\n  \n  return NextResponse.json({\n    ok: true,\n    sanitized: false,\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Role ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch role ACL',\n      description: 'Returns the feature and organization assignments associated with a role within the current tenant.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'Role ACL entry', schema: roleAclResponseSchema },\n        { status: 400, description: 'Invalid role id', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update role ACL',\n      description: 'Replaces the feature list, super admin flag, and optional organization assignments for a role.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'Role ACL updated', schema: roleAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
-  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,8CAA8C;AACvD,SAAS,uBAAuB;AAChC,SAAS,SAAS,YAAY;AAE9B,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAIP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEzD,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,aAAsC,EAAE,IAAI,OAAO,KAAK,OAAO;AACrE,MAAI,CAAC,gBAAgB,cAAc;AACjC,eAAW,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,UAAU;AAC9C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,cAAc,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC1E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,aAAa;AAChE,QAAI,gBAAgB,OAAO,KAAK,aAAa,aAAc,eAAc,OAAO,KAAK;AAAA,QAChF,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,CAAC,eAAe,CAAC,aAAc,eAAc,gBAAgB;AAEjE,MAAI,CAAC,gBAAgB,KAAK,KAAK;AAC7B,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA,aAAa,UAAU,QAAQ,aAAa;AAAA,QAC5C,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,cACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,YAAY,CAAC,IACzD;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAE9E,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B,UAAU;AAAA,IACV,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU,YAAY;AAAA,IAC3D,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,gBAAyC,EAAE,IAAI,OAAO,KAAK,OAAO;AACxE,MAAI,CAAC,gBAAgB,cAAc;AACjC,kBAAc,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,aAAa;AACjD,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,iBAAiB,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC7E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,gBAAgB;AACnE,QAAI,gBAAgB,OAAO,KAAK,aAAa,cAAc;AACzD,uBAAiB,OAAO,KAAK;AAAA,IAC/B,OAAO;AACL,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,CAAC,aAAc,kBAAiB,gBAAgB;AACvE,MAAI,CAAC,eAAgB,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3F,MAAI,CAAC,gBAAgB,mBAAmB,cAAc;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,gBAAgB,KAAK,KAAK;AAC7B,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,MAAI,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,eAAe,CAAC;AAMtE,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF,OAAO;AACL,UAAM,GAAG,OAAO,SAAS;AAAA,MACvB;AAAA,MACA,UAAU;AAAA,MACV,WAAW,oBAAI,KAAK;AAAA,MACpB,cAAc;AAAA,IAChB,CAAC;AAAA,EACH;AAEA,QAAM,uBAAuB,CAAC,CAAC,IAAI;AACnC,QAAM,mBAAmB,0BAA0B,IAAI,YAAY;AACnE,QAAM,wBAAwB,uBAAuB,IAAI,iBAAiB;AAC1E,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAC1D,QAAM,oBAAoB,OAAO,KAAK,aAAa,SAC/C,mBACA,0BAA0B,OAAO,KAAK,QAAQ;AAClD,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAIA,QAAM,eAAe;AACrB,QAAM;AAAA,IACJ;AAAA,IACA;AAAA,MACE,MAAM;AACJ,qBAAa,oBAAoB;AACjC,qBAAa,eAAe;AAC5B,qBAAa,eAAe;AAC5B,WAAG,QAAQ,YAAY;AAAA,MACzB;AAAA,IACF;AAAA,IACA,EAAE,aAAa,KAAK;AAAA,EACtB;AAGA,MAAI,gBAAgB;AAClB,UAAM,YAAY,sBAAsB,cAAc;AAEtD,QAAI;AACF,YAAM,QAAQ,UAAU,QAAQ,OAAO;AACvC,UAAI,OAAO,aAAc,OAAM,MAAM,aAAa,CAAC,eAAe,cAAc,EAAE,CAAC;AAAA,IACrF,QAAQ;AAAA,IAAC;AAAA,EACX;AAEA,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
+  "sourcesContent": ["import { NextResponse } from 'next/server'\nimport { z } from 'zod'\nimport type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'\nimport { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'\nimport { createRequestContainer } from '@open-mercato/shared/lib/di/container'\nimport { logCrudAccess } from '@open-mercato/shared/lib/crud/factory'\nimport { isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'\nimport { enforceCommandOptimisticLockWithGuards } from '@open-mercato/shared/lib/crud/optimistic-lock-command'\nimport type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'\nimport { RoleAcl, Role } from '@open-mercato/core/modules/auth/data/entities'\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport { resolveIsSuperAdmin } from '@open-mercato/core/modules/auth/lib/tenantAccess'\nimport { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'\nimport {\n  assertActorCanGrantAcl,\n  assertActorCanModifySuperAdminRoleTarget,\n  normalizeGrantFeatureList,\n} from '@open-mercato/core/modules/auth/lib/grantChecks'\nimport {\n  AUTH_ROLE_ACL_UPDATE_COMMAND_ID,\n  type AclUpdateResult,\n  type RoleAclUpdateInput,\n} from '@open-mercato/core/modules/auth/commands/acl'\n\nconst getSchema = z.object({\n  roleId: z.string().uuid(),\n  tenantId: z.string().uuid().optional(),\n})\nconst putSchema = z.object({\n  roleId: z.string().uuid(),\n  isSuperAdmin: z.boolean().optional(),\n  features: z.array(z.string()).optional(),\n  organizations: z.array(z.string()).nullable().optional(),\n  tenantId: z.string().uuid().optional(),\n})\n\nexport const metadata = {\n  GET: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n  PUT: { requireAuth: true, requireFeatures: ['auth.acl.manage'] },\n}\n\nconst roleAclResponseSchema = z.object({\n  isSuperAdmin: z.boolean(),\n  features: z.array(z.string()),\n  organizations: z.array(z.string()).nullable(),\n  updatedAt: z.string().nullable(),\n})\n\nconst roleAclUpdateResponseSchema = z.object({\n  ok: z.literal(true),\n  sanitized: z.boolean(),\n})\n\nconst roleAclErrorSchema = z.object({ error: z.string() })\n\nexport async function GET(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const url = new URL(req.url)\n  const parsed = getSchema.safeParse({\n    roleId: url.searchParams.get('roleId'),\n    tenantId: url.searchParams.get('tenantId') || undefined,\n  })\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const em = container.resolve('em') as EntityManager\n  const authTenantId = auth.tenantId ?? null\n  const roleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    roleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, roleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let tenantScope = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== tenantScope) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) tenantScope = parsed.data.tenantId\n    else return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n  if (!tenantScope && !isSuperAdmin) tenantScope = authTenantId ?? null\n\n  if (!isSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminRoleTarget({\n        em,\n        rbacService: container.resolve('rbacService') as RbacService,\n        actorUserId: auth.sub,\n        tenantId: tenantScope,\n        organizationId: auth.orgId ?? null,\n        targetRoleId: parsed.data.roleId,\n        actorIsSuperAdmin: false,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = tenantScope\n    ? await em.findOne(RoleAcl, { role, tenantId: tenantScope })\n    : null\n  const response = acl\n    ? {\n        isSuperAdmin: !!acl.isSuperAdmin,\n        features: Array.isArray(acl.featuresJson) ? acl.featuresJson : [],\n        organizations: Array.isArray(acl.organizationsJson) ? acl.organizationsJson : null,\n        updatedAt: acl.updatedAt instanceof Date ? acl.updatedAt.toISOString() : null,\n      }\n    : { isSuperAdmin: false, features: [], organizations: null, updatedAt: null }\n\n  await logCrudAccess({\n    container,\n    auth,\n    request: req,\n    items: [{ id: parsed.data.roleId, ...response }],\n    idField: 'id',\n    resourceKind: 'auth.role_acl',\n    organizationId: auth.orgId ?? null,\n    tenantId: tenantScope,\n    query: { roleId: parsed.data.roleId, tenantId: tenantScope },\n    accessType: 'read:item',\n  })\n\n  return NextResponse.json(response)\n}\n\nexport async function PUT(req: Request) {\n  const auth = await getAuthFromRequest(req)\n  if (!auth) return NextResponse.json({ error: 'Unauthorized' }, { status: 401 })\n  const body = await req.json().catch(() => ({}))\n  const parsed = putSchema.safeParse(body)\n  if (!parsed.success) return NextResponse.json({ error: 'Invalid input' }, { status: 400 })\n  const container = await createRequestContainer()\n  const em = container.resolve('em') as EntityManager\n  const isSuperAdmin = await resolveIsSuperAdmin({ auth, container })\n  const rbacService = container.resolve('rbacService') as RbacService\n  const authTenantId = auth.tenantId ?? null\n  const putRoleFilter: Record<string, unknown> = { id: parsed.data.roleId }\n  if (!isSuperAdmin && authTenantId) {\n    putRoleFilter.$or = [{ tenantId: authTenantId }, { tenantId: null }]\n  }\n  const role = await em.findOne(Role, putRoleFilter)\n  if (!role) return NextResponse.json({ error: 'Not found' }, { status: 404 })\n\n  const roleTenantId = role?.tenantId ? String(role.tenantId) : null\n\n  let targetTenantId = parsed.data.tenantId ?? roleTenantId ?? authTenantId ?? null\n  if (parsed.data.tenantId && parsed.data.tenantId !== targetTenantId) {\n    if (isSuperAdmin || parsed.data.tenantId === authTenantId) {\n      targetTenantId = parsed.data.tenantId\n    } else {\n      return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n    }\n  }\n  if (!targetTenantId && !isSuperAdmin) targetTenantId = authTenantId ?? null\n  if (!targetTenantId) return NextResponse.json({ error: 'Tenant required' }, { status: 400 })\n\n  if (!isSuperAdmin && targetTenantId !== authTenantId) {\n    return NextResponse.json({ error: 'Forbidden' }, { status: 403 })\n  }\n\n  if (!isSuperAdmin && auth.sub) {\n    try {\n      await assertActorCanModifySuperAdminRoleTarget({\n        em,\n        rbacService,\n        actorUserId: auth.sub,\n        tenantId: targetTenantId,\n        organizationId: auth.orgId ?? null,\n        targetRoleId: parsed.data.roleId,\n        actorIsSuperAdmin: false,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const acl = await em.findOne(RoleAcl, { role, tenantId: targetTenantId })\n  // Optimistic lock: refuse a stale ACL overwrite so two admins editing the same\n  // role's features in parallel cannot silently clobber each other (#2055). The\n  // check is strictly additive \u2014 when the client sends no expected-version header\n  // it is a no-op. Skipped when the ACL row does not exist yet (first grant has\n  // no prior version to conflict with).\n  if (acl) {\n    try {\n      await enforceCommandOptimisticLockWithGuards(container, {\n        resourceKind: 'auth.role_acl',\n        resourceId: acl.id,\n        current: acl.updatedAt ?? null,\n        request: req,\n      })\n    } catch (err) {\n      if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n      throw err\n    }\n  }\n\n  const existingIsSuperAdmin = !!acl?.isSuperAdmin\n  const existingFeatures = normalizeGrantFeatureList(acl?.featuresJson)\n  const existingOrganizations = normalizeOrganizations(acl?.organizationsJson)\n  const requestedIsSuperAdmin = parsed.data.isSuperAdmin ?? existingIsSuperAdmin\n  const requestedFeatures = parsed.data.features === undefined\n    ? existingFeatures\n    : normalizeGrantFeatureList(parsed.data.features)\n  const requestedOrganizations = parsed.data.organizations === undefined\n    ? existingOrganizations\n    : normalizeOrganizations(parsed.data.organizations)\n\n  try {\n    await assertActorCanGrantAcl({\n      em,\n      rbacService,\n      actorUserId: auth.sub,\n      tenantId: targetTenantId,\n      organizationId: auth.orgId ?? null,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    })\n  } catch (err) {\n    if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })\n    throw err\n  }\n\n  // Route the write through the command bus so the permission change lands in\n  // the action log. The command owns the transactional write and the RBAC cache\n  // invalidation that used to live here.\n  const commandBus = container.resolve('commandBus') as CommandBus\n  // A super admin may edit a role in another tenant. The actor's organization\n  // belongs to *their* tenant, and the command bus resolves the log row's\n  // organization as `metadata.organizationId ?? ctx.selectedOrganizationId ??\n  // ctx.auth.orgId` \u2014 a `??` chain, so a handler cannot express \"explicitly no\n  // organization\" on its own. Strip the organization from the context instead,\n  // otherwise the entry is stamped (target tenant, actor's foreign organization)\n  // and `ActionLogService` \u2014 which filters organization with strict equality \u2014\n  // can never surface it for anyone.\n  const isForeignTenant = targetTenantId !== (auth.tenantId ?? null)\n  const actorOrgId = isForeignTenant ? null : auth.orgId ?? null\n  const commandCtx: CommandRuntimeContext = {\n    container,\n    auth: isForeignTenant ? { ...auth, orgId: null } : auth,\n    organizationScope: null,\n    selectedOrganizationId: actorOrgId,\n    organizationIds: actorOrgId ? [actorOrgId] : null,\n    request: req,\n  }\n  await commandBus.execute<RoleAclUpdateInput, AclUpdateResult>(AUTH_ROLE_ACL_UPDATE_COMMAND_ID, {\n    input: {\n      roleId: String(role.id),\n      tenantId: targetTenantId,\n      isSuperAdmin: requestedIsSuperAdmin,\n      features: requestedFeatures,\n      organizations: requestedOrganizations,\n    },\n    ctx: commandCtx,\n  })\n\n  return NextResponse.json({\n    ok: true,\n    sanitized: false,\n  })\n}\n\nfunction normalizeOrganizations(organizations: unknown): string[] | null {\n  if (!Array.isArray(organizations)) return null\n  return normalizeGrantFeatureList(organizations)\n}\n\nexport const openApi: OpenApiRouteDoc = {\n  tag: 'Authentication & Accounts',\n  summary: 'Role ACL management',\n  methods: {\n    GET: {\n      summary: 'Fetch role ACL',\n      description: 'Returns the feature and organization assignments associated with a role within the current tenant.',\n      query: getSchema,\n      responses: [\n        { status: 200, description: 'Role ACL entry', schema: roleAclResponseSchema },\n        { status: 400, description: 'Invalid role id', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n    PUT: {\n      summary: 'Update role ACL',\n      description: 'Replaces the feature list, super admin flag, and optional organization assignments for a role.',\n      requestBody: {\n        contentType: 'application/json',\n        schema: putSchema,\n      },\n      responses: [\n        { status: 200, description: 'Role ACL updated', schema: roleAclUpdateResponseSchema },\n        { status: 400, description: 'Invalid payload', schema: roleAclErrorSchema },\n        { status: 401, description: 'Unauthorized', schema: roleAclErrorSchema },\n        { status: 403, description: 'Insufficient privileges to modify ACL', schema: roleAclErrorSchema },\n        { status: 404, description: 'Role not found', schema: roleAclErrorSchema },\n      ],\n    },\n  },\n}\n"],
+  "mappings": "AAAA,SAAS,oBAAoB;AAC7B,SAAS,SAAS;AAElB,SAAS,0BAA0B;AACnC,SAAS,8BAA8B;AACvC,SAAS,qBAAqB;AAC9B,SAAS,uBAAuB;AAChC,SAAS,8CAA8C;AAEvD,SAAS,SAAS,YAAY;AAE9B,SAAS,2BAA2B;AAEpC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,OACK;AACP;AAAA,EACE;AAAA,OAGK;AAEP,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AACD,MAAM,YAAY,EAAE,OAAO;AAAA,EACzB,QAAQ,EAAE,OAAO,EAAE,KAAK;AAAA,EACxB,cAAc,EAAE,QAAQ,EAAE,SAAS;AAAA,EACnC,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EACvC,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS,EAAE,SAAS;AAAA,EACvD,UAAU,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS;AACvC,CAAC;AAEM,MAAM,WAAW;AAAA,EACtB,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AAAA,EAC/D,KAAK,EAAE,aAAa,MAAM,iBAAiB,CAAC,iBAAiB,EAAE;AACjE;AAEA,MAAM,wBAAwB,EAAE,OAAO;AAAA,EACrC,cAAc,EAAE,QAAQ;AAAA,EACxB,UAAU,EAAE,MAAM,EAAE,OAAO,CAAC;AAAA,EAC5B,eAAe,EAAE,MAAM,EAAE,OAAO,CAAC,EAAE,SAAS;AAAA,EAC5C,WAAW,EAAE,OAAO,EAAE,SAAS;AACjC,CAAC;AAED,MAAM,8BAA8B,EAAE,OAAO;AAAA,EAC3C,IAAI,EAAE,QAAQ,IAAI;AAAA,EAClB,WAAW,EAAE,QAAQ;AACvB,CAAC;AAED,MAAM,qBAAqB,EAAE,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,CAAC;AAEzD,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,MAAM,IAAI,IAAI,IAAI,GAAG;AAC3B,QAAM,SAAS,UAAU,UAAU;AAAA,IACjC,QAAQ,IAAI,aAAa,IAAI,QAAQ;AAAA,IACrC,UAAU,IAAI,aAAa,IAAI,UAAU,KAAK;AAAA,EAChD,CAAC;AACD,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,aAAsC,EAAE,IAAI,OAAO,KAAK,OAAO;AACrE,MAAI,CAAC,gBAAgB,cAAc;AACjC,eAAW,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EAClE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,UAAU;AAC9C,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,cAAc,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC1E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,aAAa;AAChE,QAAI,gBAAgB,OAAO,KAAK,aAAa,aAAc,eAAc,OAAO,KAAK;AAAA,QAChF,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EACvE;AACA,MAAI,CAAC,eAAe,CAAC,aAAc,eAAc,gBAAgB;AAEjE,MAAI,CAAC,gBAAgB,KAAK,KAAK;AAC7B,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA,aAAa,UAAU,QAAQ,aAAa;AAAA,QAC5C,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,cACR,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,YAAY,CAAC,IACzD;AACJ,QAAM,WAAW,MACb;AAAA,IACE,cAAc,CAAC,CAAC,IAAI;AAAA,IACpB,UAAU,MAAM,QAAQ,IAAI,YAAY,IAAI,IAAI,eAAe,CAAC;AAAA,IAChE,eAAe,MAAM,QAAQ,IAAI,iBAAiB,IAAI,IAAI,oBAAoB;AAAA,IAC9E,WAAW,IAAI,qBAAqB,OAAO,IAAI,UAAU,YAAY,IAAI;AAAA,EAC3E,IACA,EAAE,cAAc,OAAO,UAAU,CAAC,GAAG,eAAe,MAAM,WAAW,KAAK;AAE9E,QAAM,cAAc;AAAA,IAClB;AAAA,IACA;AAAA,IACA,SAAS;AAAA,IACT,OAAO,CAAC,EAAE,IAAI,OAAO,KAAK,QAAQ,GAAG,SAAS,CAAC;AAAA,IAC/C,SAAS;AAAA,IACT,cAAc;AAAA,IACd,gBAAgB,KAAK,SAAS;AAAA,IAC9B,UAAU;AAAA,IACV,OAAO,EAAE,QAAQ,OAAO,KAAK,QAAQ,UAAU,YAAY;AAAA,IAC3D,YAAY;AAAA,EACd,CAAC;AAED,SAAO,aAAa,KAAK,QAAQ;AACnC;AAEA,eAAsB,IAAI,KAAc;AACtC,QAAM,OAAO,MAAM,mBAAmB,GAAG;AACzC,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,eAAe,GAAG,EAAE,QAAQ,IAAI,CAAC;AAC9E,QAAM,OAAO,MAAM,IAAI,KAAK,EAAE,MAAM,OAAO,CAAC,EAAE;AAC9C,QAAM,SAAS,UAAU,UAAU,IAAI;AACvC,MAAI,CAAC,OAAO,QAAS,QAAO,aAAa,KAAK,EAAE,OAAO,gBAAgB,GAAG,EAAE,QAAQ,IAAI,CAAC;AACzF,QAAM,YAAY,MAAM,uBAAuB;AAC/C,QAAM,KAAK,UAAU,QAAQ,IAAI;AACjC,QAAM,eAAe,MAAM,oBAAoB,EAAE,MAAM,UAAU,CAAC;AAClE,QAAM,cAAc,UAAU,QAAQ,aAAa;AACnD,QAAM,eAAe,KAAK,YAAY;AACtC,QAAM,gBAAyC,EAAE,IAAI,OAAO,KAAK,OAAO;AACxE,MAAI,CAAC,gBAAgB,cAAc;AACjC,kBAAc,MAAM,CAAC,EAAE,UAAU,aAAa,GAAG,EAAE,UAAU,KAAK,CAAC;AAAA,EACrE;AACA,QAAM,OAAO,MAAM,GAAG,QAAQ,MAAM,aAAa;AACjD,MAAI,CAAC,KAAM,QAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3E,QAAM,eAAe,MAAM,WAAW,OAAO,KAAK,QAAQ,IAAI;AAE9D,MAAI,iBAAiB,OAAO,KAAK,YAAY,gBAAgB,gBAAgB;AAC7E,MAAI,OAAO,KAAK,YAAY,OAAO,KAAK,aAAa,gBAAgB;AACnE,QAAI,gBAAgB,OAAO,KAAK,aAAa,cAAc;AACzD,uBAAiB,OAAO,KAAK;AAAA,IAC/B,OAAO;AACL,aAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,IAClE;AAAA,EACF;AACA,MAAI,CAAC,kBAAkB,CAAC,aAAc,kBAAiB,gBAAgB;AACvE,MAAI,CAAC,eAAgB,QAAO,aAAa,KAAK,EAAE,OAAO,kBAAkB,GAAG,EAAE,QAAQ,IAAI,CAAC;AAE3F,MAAI,CAAC,gBAAgB,mBAAmB,cAAc;AACpD,WAAO,aAAa,KAAK,EAAE,OAAO,YAAY,GAAG,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AAEA,MAAI,CAAC,gBAAgB,KAAK,KAAK;AAC7B,QAAI;AACF,YAAM,yCAAyC;AAAA,QAC7C;AAAA,QACA;AAAA,QACA,aAAa,KAAK;AAAA,QAClB,UAAU;AAAA,QACV,gBAAgB,KAAK,SAAS;AAAA,QAC9B,cAAc,OAAO,KAAK;AAAA,QAC1B,mBAAmB;AAAA,MACrB,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,MAAM,MAAM,GAAG,QAAQ,SAAS,EAAE,MAAM,UAAU,eAAe,CAAC;AAMxE,MAAI,KAAK;AACP,QAAI;AACF,YAAM,uCAAuC,WAAW;AAAA,QACtD,cAAc;AAAA,QACd,YAAY,IAAI;AAAA,QAChB,SAAS,IAAI,aAAa;AAAA,QAC1B,SAAS;AAAA,MACX,CAAC;AAAA,IACH,SAAS,KAAK;AACZ,UAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,YAAM;AAAA,IACR;AAAA,EACF;AAEA,QAAM,uBAAuB,CAAC,CAAC,KAAK;AACpC,QAAM,mBAAmB,0BAA0B,KAAK,YAAY;AACpE,QAAM,wBAAwB,uBAAuB,KAAK,iBAAiB;AAC3E,QAAM,wBAAwB,OAAO,KAAK,gBAAgB;AAC1D,QAAM,oBAAoB,OAAO,KAAK,aAAa,SAC/C,mBACA,0BAA0B,OAAO,KAAK,QAAQ;AAClD,QAAM,yBAAyB,OAAO,KAAK,kBAAkB,SACzD,wBACA,uBAAuB,OAAO,KAAK,aAAa;AAEpD,MAAI;AACF,UAAM,uBAAuB;AAAA,MAC3B;AAAA,MACA;AAAA,MACA,aAAa,KAAK;AAAA,MAClB,UAAU;AAAA,MACV,gBAAgB,KAAK,SAAS;AAAA,MAC9B,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB,CAAC;AAAA,EACH,SAAS,KAAK;AACZ,QAAI,gBAAgB,GAAG,EAAG,QAAO,aAAa,KAAK,IAAI,MAAM,EAAE,QAAQ,IAAI,OAAO,CAAC;AACnF,UAAM;AAAA,EACR;AAKA,QAAM,aAAa,UAAU,QAAQ,YAAY;AASjD,QAAM,kBAAkB,oBAAoB,KAAK,YAAY;AAC7D,QAAM,aAAa,kBAAkB,OAAO,KAAK,SAAS;AAC1D,QAAM,aAAoC;AAAA,IACxC;AAAA,IACA,MAAM,kBAAkB,EAAE,GAAG,MAAM,OAAO,KAAK,IAAI;AAAA,IACnD,mBAAmB;AAAA,IACnB,wBAAwB;AAAA,IACxB,iBAAiB,aAAa,CAAC,UAAU,IAAI;AAAA,IAC7C,SAAS;AAAA,EACX;AACA,QAAM,WAAW,QAA6C,iCAAiC;AAAA,IAC7F,OAAO;AAAA,MACL,QAAQ,OAAO,KAAK,EAAE;AAAA,MACtB,UAAU;AAAA,MACV,cAAc;AAAA,MACd,UAAU;AAAA,MACV,eAAe;AAAA,IACjB;AAAA,IACA,KAAK;AAAA,EACP,CAAC;AAED,SAAO,aAAa,KAAK;AAAA,IACvB,IAAI;AAAA,IACJ,WAAW;AAAA,EACb,CAAC;AACH;AAEA,SAAS,uBAAuB,eAAyC;AACvE,MAAI,CAAC,MAAM,QAAQ,aAAa,EAAG,QAAO;AAC1C,SAAO,0BAA0B,aAAa;AAChD;AAEO,MAAM,UAA2B;AAAA,EACtC,KAAK;AAAA,EACL,SAAS;AAAA,EACT,SAAS;AAAA,IACP,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,OAAO;AAAA,MACP,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,sBAAsB;AAAA,QAC5E,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,IACA,KAAK;AAAA,MACH,SAAS;AAAA,MACT,aAAa;AAAA,MACb,aAAa;AAAA,QACX,aAAa;AAAA,QACb,QAAQ;AAAA,MACV;AAAA,MACA,WAAW;AAAA,QACT,EAAE,QAAQ,KAAK,aAAa,oBAAoB,QAAQ,4BAA4B;AAAA,QACpF,EAAE,QAAQ,KAAK,aAAa,mBAAmB,QAAQ,mBAAmB;AAAA,QAC1E,EAAE,QAAQ,KAAK,aAAa,gBAAgB,QAAQ,mBAAmB;AAAA,QACvE,EAAE,QAAQ,KAAK,aAAa,yCAAyC,QAAQ,mBAAmB;AAAA,QAChG,EAAE,QAAQ,KAAK,aAAa,kBAAkB,QAAQ,mBAAmB;AAAA,MAC3E;AAAA,IACF;AAAA,EACF;AACF;",
   "names": []
 }

package/dist/modules/auth/api/session/refresh.js

@@ -1,6 +1,6 @@
 import { NextResponse } from "next/server";
 import { createRequestContainer } from "@open-mercato/shared/lib/di/container";
-import { signJwt } from "@open-mercato/shared/lib/auth/jwt";
+import { isMfaPendingJwtPayload, signJwt, verifyJwt } from "@open-mercato/shared/lib/auth/jwt";
 import { resolveTranslations } from "@open-mercato/shared/lib/i18n/server";
 import { refreshSessionRequestSchema } from "@open-mercato/core/modules/auth/data/validators";
 import { checkAuthRateLimit } from "@open-mercato/core/modules/auth/lib/rateLimitCheck";
@@ -26,6 +26,17 @@ function parseCookie(req, name) {
   const m = cookie.match(new RegExp("(?:^|;\\s*)" + name + "=([^;]+)"));
   return m ? decodeURIComponent(m[1]) : null;
 }
+function carriesMfaPendingToken(req) {
+  const authHeader = (req.headers.get("authorization") || "").trim();
+  const bearer = authHeader.toLowerCase().startsWith("bearer ") ? authHeader.slice(7).trim() : null;
+  const token = bearer || parseCookie(req, "auth_token");
+  if (!token) return false;
+  try {
+    return isMfaPendingJwtPayload(verifyJwt(token));
+  } catch {
+    return false;
+  }
+}
 function buildStaffJwtClaims({ user, roles, session }) {
   return {
     sub: String(user.id),
@@ -57,6 +68,11 @@ async function GET(req) {
   const url = new URL(req.url);
   const baseUrl = resolveTrustedRedirectBase(req) ?? url.origin;
   const redirectTo = sanitizeRedirectPath(url.searchParams.get("redirect"), baseUrl, "/");
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      buildSafeRedirectResponse(req, "/login?redirect=" + encodeURIComponent(redirectTo))
+    );
+  }
   const token = parseCookie(req, "session_token");
   if (!token) {
     return clearStaffAuthCookies(
@@ -94,6 +110,14 @@ async function POST(req) {
     compoundIdentifier: token ?? void 0
   });
   if (rateLimitError) return rateLimitError;
+  if (carriesMfaPendingToken(req)) {
+    return clearStaffAuthCookies(
+      NextResponse.json({
+        ok: false,
+        error: translate("auth.session.refresh.errors.invalidToken", "Invalid or expired refresh token")
+      }, { status: 401 })
+    );
+  }
   if (!token) {
     return clearStaffAuthCookies(
       NextResponse.json({