@open-mercato/core 0.7.1-develop.7130.1.fef2396fd8 → 0.7.1-develop.7135.1.19bf969756

package/src/modules/warranty_claims/api/sales-return/route.ts

@@ -5,7 +5,9 @@ import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
 import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/directory/utils/organizationScope'
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -54,24 +56,23 @@ export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.returns.create'] },
 }
 
-function translateKey(key: string): string {
-  return key
-}
-
 function toRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
 }
 
-async function resolveActionContext(req: Request): Promise<ActionRouteContext> {
+async function resolveActionContext(
+  req: Request,
+  translate: ActionRouteContext['translate'],
+): Promise<ActionRouteContext> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
   const organizationId = scope?.selectedId ?? auth.orgId ?? null
   if (!organizationId) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.organization_required' })
+    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })
   }
   return {
     ctx: {
@@ -84,7 +85,7 @@ async function resolveActionContext(req: Request): Promise<ActionRouteContext> {
     },
     tenantId: auth.tenantId,
     organizationId,
-    translate: translateKey,
+    translate,
   }
 }
 
@@ -110,7 +111,7 @@ async function runGuard(
 ): Promise<RouteMutationGuardResult> {
   const userId = context.ctx.auth?.sub
   if (!userId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   return runRouteMutationGuards({
     container: context.ctx.container,
@@ -130,8 +131,9 @@ async function runGuard(
 }
 
 export async function POST(req: Request) {
+  const { translate } = await resolveTranslations()
   try {
-    const context = await resolveActionContext(req)
+    const context = await resolveActionContext(req, translate)
     const requestInput = toSalesReturnRequest(toRecord(await readJsonSafe(req, {})))
     const guarded = await runGuard(req, context, requestInput)
     if (!guarded.ok) {
@@ -143,16 +145,20 @@ export async function POST(req: Request) {
       'warranty_claims.claim.create_sales_return',
       { input: toCommandInput(guardedInput, context), ctx: context.ctx },
     )
-    if (!result) throw new CrudHttpError(400, { error: 'warranty_claims.errors.save_failed' })
+    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })
     await guarded.runAfterSuccess()
     return NextResponse.json({ salesReturnId: result.salesReturnId, skippedLineIds: result.skippedLineIds })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     if (err instanceof z.ZodError) {
-      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
     logger.error('warranty_claims.sales-return.post failed', { err })
-    return NextResponse.json({ error: 'warranty_claims.errors.save_failed' }, { status: 500 })
+    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })
   }
 }
 

package/src/modules/warranty_claims/api/settings-general/route.ts

@@ -7,6 +7,7 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { runRouteMutationGuards } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
@@ -165,6 +166,10 @@ export async function PUT(req: Request) {
     })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })

package/src/modules/warranty_claims/api/submit/route.ts

@@ -6,6 +6,7 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
@@ -118,6 +119,10 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })

package/src/modules/warranty_claims/api/transition/route.ts

@@ -6,6 +6,7 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
@@ -116,6 +117,10 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: true, claimId: result?.claimId ?? commandInput.id })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })

package/src/modules/warranty_claims/api/troubleshooting-guides/route.ts

@@ -2,6 +2,7 @@ import { z } from 'zod'
 import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { parseBooleanFromUnknown } from '@open-mercato/shared/lib/boolean'
 import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { applyIdsFilter } from '../../lib/apiIdsFilter'
@@ -122,11 +123,24 @@ function toEntitySteps(value: unknown): Record<string, unknown> | null {
   if (value === undefined || value === null) return null
   const parsed = parseGuideSteps(value)
   if (!parsed) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.invalidTroubleshootingSteps' })
+    throw new CrudHttpError(400, { error: '[internal] troubleshooting steps reached the entity mapper unvalidated' })
   }
   return { prompt: parsed.prompt, options: parsed.options }
 }
 
+async function assertParsableGuideSteps(input: object): Promise<void> {
+  if (!hasOwn(input, 'steps')) return
+  const value = (input as { steps?: unknown }).steps
+  if (value === undefined || value === null || parseGuideSteps(value)) return
+  const { translate } = await resolveTranslations()
+  throw new CrudHttpError(400, {
+    error: translate(
+      'warranty_claims.errors.invalidTroubleshootingSteps',
+      'Troubleshooting steps must include a prompt and valid option branches.',
+    ),
+  })
+}
+
 function toTroubleshootingGuideEntityData(input: TroubleshootingGuideCreateInput): Record<string, unknown> {
   return {
     claimType: input.claimType ?? null,
@@ -238,6 +252,14 @@ const crud = makeCrudRoute<RawTroubleshootingGuideInput, RawTroubleshootingGuide
     schema: rawBodySchema,
     mapToEntity: (input, ctx) => toTroubleshootingGuideEntityData(parseCreateInput(input, ctx)),
   },
+  hooks: {
+    beforeCreate: async (input) => {
+      await assertParsableGuideSteps(input)
+    },
+    beforeUpdate: async (input) => {
+      await assertParsableGuideSteps(input)
+    },
+  },
   update: {
     schema: rawBodySchema,
     getId: (input) => {

package/src/modules/warranty_claims/api/vendor-recovery/route.ts

@@ -6,6 +6,7 @@ import { resolveOrganizationScopeForRequest } from '@open-mercato/core/modules/d
 import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
@@ -120,6 +121,10 @@ export async function POST(req: Request) {
     return NextResponse.json({ ok: true, claimId: createdClaimId })
   } catch (err) {
     if (isCrudHttpError(err)) return NextResponse.json(err.body, { status: err.status })
+    const interceptorRejection = getCommandInterceptorHttpRejection(err)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     const { translate } = await resolveTranslations()
     if (err instanceof z.ZodError) {
       return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })

package/src/modules/warranty_claims/api/vendor-recovery-suggestions/route.ts

@@ -43,6 +43,7 @@ type SuggestionsRouteContext = {
   tenantId: string
   organizationId: string
   scope: WarrantyClaimScope
+  translate: (key: string, fallback?: string) => string
   em: EntityManager
 }
 
@@ -79,6 +80,7 @@ async function resolveSuggestionsContext(req: Request): Promise<SuggestionsRoute
     tenantId: auth.tenantId,
     organizationId,
     scope: { tenantId: auth.tenantId, organizationId },
+    translate,
     em,
   }
 }
@@ -88,7 +90,7 @@ export async function GET(req: Request) {
     const context = await resolveSuggestionsContext(req)
     const url = new URL(req.url)
     const query = querySchema.parse(Object.fromEntries(url.searchParams))
-    const claim = await requireScopedClaim(context.em, query.claimId, context.scope)
+    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))
     if (claim.claimType !== 'warranty' || (claim.status !== 'resolved' && claim.status !== 'closed')) {
       return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions: [] } })
     }

package/src/modules/warranty_claims/commands/shared.ts

@@ -80,14 +80,20 @@ export async function loadScopedClaim(
   )
 }
 
+/**
+ * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers
+ * must hand in an already-translated sentence; the key default only suits the
+ * command surface, which runs without a request locale.
+ */
 export async function requireScopedClaim(
   em: EntityManager,
   id: string,
   scope: WarrantyClaimScope,
   options: FindOneOptions<WarrantyClaim> = {},
+  notFoundMessage = 'warranty_claims.errors.notFound',
 ): Promise<WarrantyClaim> {
   const claim = await loadScopedClaim(em, id, scope, options)
-  return assertFound(claim, 'warranty_claims.errors.notFound')
+  return assertFound(claim, notFoundMessage)
 }
 
 export function appendClaimEvent(

package/src/modules/warranty_claims/lib/portalAuthGuard.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+
+export type LinkedCustomerAuthContext = CustomerAuthContext & { customerEntityId: string }
+
+export async function resolveLinkedCustomerAuth(req: Request): Promise<LinkedCustomerAuthContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  if (!auth) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      { ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') },
+      { status: 401 },
+    )
+  }
+  if (!auth.customerEntityId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      {
+        ok: false,
+        error: translate(
+          'warranty_claims.errors.customerAccountNotLinked',
+          'Customer account is not linked to a customer record',
+        ),
+      },
+      { status: 403 },
+    )
+  }
+  return auth as LinkedCustomerAuthContext
+}

package/src/modules/wms/api/sales-orders/[salesOrderId]/warehouse-assignment/route.ts

@@ -17,6 +17,7 @@ import { createLogger } from '@open-mercato/shared/lib/logger'
 import { salesOrderWarehouseAssignBodySchema } from '../../../../data/validators'
 import { loadSalesOrderWarehouseAssignmentView } from '../../../../lib/salesOrderWarehouseAssignment'
 import { executeWmsCustomPostRoute } from '../../../inventory/helpers'
+import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 
 const logger = createLogger('wms')
 
@@ -241,6 +242,10 @@ export async function DELETE(
     }
     return NextResponse.json(intercepted.body, { status: intercepted.statusCode })
   } catch (error) {
+    const interceptorRejection = getCommandInterceptorHttpRejection(error)
+    if (interceptorRejection) {
+      return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
+    }
     if (error instanceof CrudHttpError) {
       return NextResponse.json(error.body, { status: error.status })
     }