@open-mercato/core 0.7.1-develop.7131.1.20abf9e885 → 0.7.1-develop.7136.1.0f76137a1d

package/src/modules/communication_channels/lib/access-control.ts

@@ -59,6 +59,34 @@ export function channelOrgScopeWhereFromFilter(
   return { $or: [{ organizationId: { $in: organizationIds } }, { organizationId: null }] }
 }
 
+/**
+ * Ownership fragment for LISTING channels — the SQL-layer twin of
+ * {@link assertCanAccessChannel}.
+ *
+ * Routes have historically hardcoded one of the two halves of the rule: the
+ * admin channel list narrows to `user_id IS NULL`, the profile list narrows to
+ * `user_id = <caller>`. A provider-scoped listing needs both, because which half
+ * a channel falls into is decided by the connect flow the provider offers, not
+ * by the listing. Hardcoding `userId: null` is what made the Discord AI
+ * auto-reply panel structurally empty (#5602): every route the product exposes
+ * for connecting a Discord bot writes `user_id = auth.sub`, so the filter
+ * excluded the only channels that can exist.
+ *
+ * The clause admits exactly what the assert allows and nothing more — shared
+ * channels, plus the caller's own personal ones. It grants no admin bypass, in
+ * line with v1 strict owner-only: a personal mailbox stays invisible to everyone
+ * but its owner. An anonymous caller (no user id) sees shared channels only.
+ *
+ * Spread into a MikroORM `where`, or nest under `$and` when another fragment in
+ * the same query already claims `$or` (`channelOrgScopeWhereFromFilter` does).
+ */
+export function channelOwnerScopeWhere(
+  currentUserId: string | null | undefined,
+): Record<string, unknown> {
+  if (!currentUserId) return { userId: null }
+  return { $or: [{ userId: null }, { userId: currentUserId }] }
+}
+
 /**
  * Throws when the caller may not access a specific channel. Returns silently
  * when access is allowed.

package/src/modules/communication_channels/lib/system-user.ts

@@ -1,4 +1,5 @@
 import type { EntityManager } from '@mikro-orm/postgresql'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
 
 /**
  * Sentinel UUID — used as a last-resort `senderUserId` for inbound channel
@@ -31,6 +32,12 @@ export function systemUserEmail(tenantId: string): string {
  * sentinel. The inbound-processor must never refuse to ingest a message
  * because the channel-bot user doesn't exist.
  *
+ * That fail-soft design is also what hid #5599 for as long as it did — a broken
+ * lookup and an absent user produce the identical outcome — so the two
+ * properties the lookup depends on (the column it matches and the table it
+ * names) are pinned by `__tests__/system-user.test.ts` rather than left to the
+ * next reader to notice.
+ *
  * @param em            EntityManager scoped to the tenant.
  * @param tenantId      Tenant id for which to resolve the system user.
  * @param fallbackId    Optional caller-supplied fallback (e.g., the channel's
@@ -43,28 +50,39 @@ export async function resolveCommunicationChannelsSystemUserId(
 ): Promise<string> {
   try {
     const expectedEmail = systemUserEmail(tenantId)
-    // Untyped QB by design — the helper is intentionally cross-module
-    // (resolving an `auth.user` from the hub) and must not pull the User
-    // entity class. MikroORM v7's typed builder requires an entity ref;
-    // we keep the lookup table-name-driven so the helper compiles without
-    // a cross-module import. The mocks in `__tests__/system-user.test.ts`
-    // exercise this code path through a duck-typed `createQueryBuilder` stub.
-    type RawQueryBuilder = {
-      select: (fields: string[]) => RawQueryBuilder
-      where: (cond: Record<string, unknown>) => RawQueryBuilder
-      limit: (count: number) => RawQueryBuilder
-      execute: (mode: string) => Promise<unknown>
-    }
-    const qb = (
-      em as unknown as { createQueryBuilder: (table: string, alias: string) => RawQueryBuilder }
-    ).createQueryBuilder('auth.users', 'u')
-    const row = await qb
-      .select(['u.id'])
-      .where({ email: expectedEmail, tenant_id: tenantId })
-      .limit(1)
-      .execute('get')
-      .catch(() => null)
-    const id = (row as { id?: string } | null)?.id
+    // Match on `email_hash`, never on `email` (#5599). `users.email` is
+    // encrypted at rest with a per-row IV, so its ciphertext is
+    // non-deterministic and an equality filter against the plaintext can never
+    // hit — which is exactly why the tenant uniqueness index keys on
+    // `email_hash` instead (see `auth/data/entities.ts`). The candidate list
+    // covers both the keyed `v2:` digest and the legacy unkeyed one, so a
+    // deployment that has not yet backfilled still matches.
+    //
+    // The digests must be computed the same way `auth` writes them
+    // (`auth/lib/emailHash.ts` → `hashForLookup(email)`), i.e. with NO hash
+    // context. Reusing the shared primitive rather than importing the auth
+    // helper keeps this module free of a cross-module code dependency; the two
+    // must stay aligned if `auth` ever adopts a context.
+    const emailHashes = lookupHashCandidates(expectedEmail)
+
+    // Raw SQL against the table, not `createQueryBuilder('auth.users')`. That
+    // call names no registered entity — entities are discovered under their
+    // class names — so MikroORM reads the dot as a schema qualifier and looks
+    // for `users` in a schema named `auth`, which this project never creates
+    // (`Migration20251030150038` puts `users` in the default schema). The helper
+    // swallows every error by design, so the miss was indistinguishable from
+    // "no channel-bot user exists" and hid behind the same fallback as the
+    // plaintext-vs-ciphertext defect above. A parameterized statement names the
+    // table unambiguously and still pulls in no cross-module entity class,
+    // keeping the decoupling this helper was written for.
+    const placeholders = emailHashes.map(() => '?').join(', ')
+    const rows = await em
+      .getConnection()
+      .execute<Array<{ id?: string }>>(
+        `SELECT id FROM users WHERE email_hash IN (${placeholders}) AND tenant_id = ? AND deleted_at IS NULL LIMIT 1`,
+        [...emailHashes, tenantId],
+      )
+    const id = Array.isArray(rows) ? rows[0]?.id : undefined
     if (typeof id === 'string' && id.length > 0) return id
   } catch {
     // ignore — fall through to fallback

package/src/modules/warranty_claims/api/ai/assess/route.ts

@@ -9,6 +9,7 @@ import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -110,7 +111,7 @@ function isSuperAdmin(auth: CommandRuntimeContext['auth']): boolean {
 function buildAuthContext(context: AssessRouteContext): AiChatRequestContext {
   const userId = context.ctx.auth?.sub
   if (!userId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   return {
     tenantId: context.tenantId,
@@ -124,7 +125,7 @@ function buildAuthContext(context: AssessRouteContext): AiChatRequestContext {
 function buildAttachmentAuthContext(context: AssessRouteContext): Exclude<AuthContext, null> {
   const auth = context.ctx.auth
   if (!auth?.sub) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   return {
     ...auth,
@@ -134,16 +135,19 @@ function buildAttachmentAuthContext(context: AssessRouteContext): Exclude<AuthCo
   }
 }
 
-async function resolveAssessContext(req: Request): Promise<AssessRouteContext> {
+async function resolveAssessContext(
+  req: Request,
+  translate: AssessRouteContext['translate'],
+): Promise<AssessRouteContext> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
   const organizationId = scope?.selectedId ?? auth.orgId ?? null
   if (!organizationId) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.organization_required' })
+    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })
   }
   return {
     ctx: {
@@ -158,7 +162,7 @@ async function resolveAssessContext(req: Request): Promise<AssessRouteContext> {
     organizationId,
     container,
     em: container.resolve<EntityManager>('em').fork(),
-    translate: (key: string) => key,
+    translate,
   }
 }
 
@@ -173,7 +177,7 @@ async function runGuard(
 ): Promise<RouteMutationGuardResult> {
   const userId = context.ctx.auth?.sub
   if (!userId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   return runRouteMutationGuards({
     container: context.ctx.container,
@@ -197,6 +201,7 @@ async function loadScopedLine(
   scope: WarrantyClaimScope,
   claimId: string,
   lineId: string,
+  translate: AssessRouteContext['translate'],
 ): Promise<WarrantyClaimLine> {
   const line = await findOneWithDecryption(
     em,
@@ -212,7 +217,7 @@ async function loadScopedLine(
     scope,
   )
   if (!line) {
-    throw new CrudHttpError(404, { error: 'warranty_claims.errors.notFound' })
+    throw new CrudHttpError(404, { error: translate('warranty_claims.errors.notFound', 'Claim not found.') })
   }
   return line
 }
@@ -238,7 +243,7 @@ async function verifyAttachmentLinkedToTarget(
     ],
   }) : false
   if (!linked) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.attachmentNotLinked' })
+    throw new CrudHttpError(400, { error: context.translate('warranty_claims.errors.attachmentNotLinked', 'The attachment is not linked to this claim.') })
   }
 }
 
@@ -279,12 +284,13 @@ async function persistAssessmentPayload(
 }
 
 export async function POST(req: Request) {
+  const { translate } = await resolveTranslations()
   try {
-    const context = await resolveAssessContext(req)
+    const context = await resolveAssessContext(req, translate)
     const payload = toRecord(await readJsonSafe(req, {}))
     const parsed = toAssessInput(payload, context)
     if (parsed.kind === 'damage' && !parsed.lineId) {
-      throw new CrudHttpError(400, { error: 'warranty_claims.errors.invalidInput' })
+      throw new CrudHttpError(400, { error: translate('warranty_claims.errors.invalidInput', 'Invalid input') })
     }
 
     const guarded = parsed.lineId ? await runGuard(req, context, parsed as AssessBodyInput & { lineId: string }) : null
@@ -296,9 +302,9 @@ export async function POST(req: Request) {
 
     if (input.kind === 'damage') {
       if (!input.lineId) {
-        throw new CrudHttpError(400, { error: 'warranty_claims.errors.invalidInput' })
+        throw new CrudHttpError(400, { error: translate('warranty_claims.errors.invalidInput', 'Invalid input') })
       }
-      const line = await loadScopedLine(context.em, scope, input.claimId, input.lineId)
+      const line = await loadScopedLine(context.em, scope, input.claimId, input.lineId, translate)
       await verifyAttachmentLinkedToTarget(context, {
         attachmentId: input.attachmentId,
         claimId: input.claimId,
@@ -318,8 +324,8 @@ export async function POST(req: Request) {
       return NextResponse.json({ status: 'ok', assessment })
     }
 
-    await requireScopedClaim(context.em, input.claimId, scope)
-    const line = input.lineId ? await loadScopedLine(context.em, scope, input.claimId, input.lineId) : null
+    await requireScopedClaim(context.em, input.claimId, scope, {}, translate('warranty_claims.errors.notFound', 'Claim not found.'))
+    const line = input.lineId ? await loadScopedLine(context.em, scope, input.claimId, input.lineId, translate) : null
     await verifyAttachmentLinkedToTarget(context, {
       attachmentId: input.attachmentId,
       claimId: input.claimId,
@@ -350,10 +356,10 @@ export async function POST(req: Request) {
       return NextResponse.json({ status: 'aiUnavailable' })
     }
     if (err instanceof z.ZodError) {
-      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
     logger.error('warranty_claims.ai.assess.post failed', { err })
-    return NextResponse.json({ error: 'warranty_claims.errors.save_failed' }, { status: 500 })
+    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })
   }
 }
 

package/src/modules/warranty_claims/api/credit-memo/route.ts

@@ -7,6 +7,7 @@ import type { CommandBus, CommandRuntimeContext } from '@open-mercato/shared/lib
 import { CrudHttpError, isCrudHttpError } from '@open-mercato/shared/lib/crud/errors'
 import { getCommandInterceptorHttpRejection } from '@open-mercato/shared/lib/commands/errors'
 import { readJsonSafe } from '@open-mercato/shared/lib/http/readJsonSafe'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
 import { withScopedPayload } from '@open-mercato/shared/lib/api/scoped'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
@@ -59,24 +60,23 @@ export const metadata = {
   POST: { requireAuth: true, requireFeatures: ['warranty_claims.claim.manage', 'sales.credit_memos.manage'] },
 }
 
-function translateKey(key: string): string {
-  return key
-}
-
 function toRecord(value: unknown): Record<string, unknown> {
   return value && typeof value === 'object' && !Array.isArray(value) ? value as Record<string, unknown> : {}
 }
 
-async function resolveActionContext(req: Request): Promise<ActionRouteContext> {
+async function resolveActionContext(
+  req: Request,
+  translate: ActionRouteContext['translate'],
+): Promise<ActionRouteContext> {
   const container = await createRequestContainer()
   const auth = await getAuthFromRequest(req)
   if (!auth || !auth.tenantId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   const scope = await resolveOrganizationScopeForRequest({ container, auth, request: req })
   const organizationId = scope?.selectedId ?? auth.orgId ?? null
   if (!organizationId) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.organization_required' })
+    throw new CrudHttpError(400, { error: translate('warranty_claims.errors.organization_required', 'Organization context is required.') })
   }
   return {
     ctx: {
@@ -89,7 +89,7 @@ async function resolveActionContext(req: Request): Promise<ActionRouteContext> {
     },
     tenantId: auth.tenantId,
     organizationId,
-    translate: translateKey,
+    translate,
   }
 }
 
@@ -115,7 +115,7 @@ async function runGuard(
 ): Promise<RouteMutationGuardResult> {
   const userId = context.ctx.auth?.sub
   if (!userId) {
-    throw new CrudHttpError(401, { error: 'warranty_claims.errors.unauthorized' })
+    throw new CrudHttpError(401, { error: context.translate('warranty_claims.errors.unauthorized', 'Unauthorized') })
   }
   return runRouteMutationGuards({
     container: context.ctx.container,
@@ -135,8 +135,9 @@ async function runGuard(
 }
 
 export async function POST(req: Request) {
+  const { translate } = await resolveTranslations()
   try {
-    const context = await resolveActionContext(req)
+    const context = await resolveActionContext(req, translate)
     const requestInput = toCreditMemoRequest(toRecord(await readJsonSafe(req, {})))
     const guarded = await runGuard(req, context, requestInput)
     if (!guarded.ok) {
@@ -150,7 +151,7 @@ export async function POST(req: Request) {
       'warranty_claims.claim.create_credit_memo',
       { input: toCommandInput(guardedInput, context), ctx: context.ctx },
     )
-    if (!result) throw new CrudHttpError(400, { error: 'warranty_claims.errors.save_failed' })
+    if (!result) throw new CrudHttpError(400, { error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') })
     await guarded.runAfterSuccess()
     return NextResponse.json({
       creditMemoId: result.creditMemoId,
@@ -165,10 +166,10 @@ export async function POST(req: Request) {
       return NextResponse.json(interceptorRejection.body, { status: interceptorRejection.status })
     }
     if (err instanceof z.ZodError) {
-      return NextResponse.json({ error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
     logger.error('warranty_claims.credit-memo.post failed', { err })
-    return NextResponse.json({ error: 'warranty_claims.errors.save_failed' }, { status: 500 })
+    return NextResponse.json({ error: translate('warranty_claims.errors.save_failed', 'Failed to save warranty claim.') }, { status: 500 })
   }
 }
 

package/src/modules/warranty_claims/api/events/route.ts

@@ -131,7 +131,7 @@ export async function GET(req: Request) {
     const context = await resolveEventContext(req)
     const url = new URL(req.url)
     const query = eventListQuerySchema.parse({ claimId: url.searchParams.get('claimId') ?? undefined })
-    const claim = await requireScopedClaim(context.em, query.claimId, context.scope)
+    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))
     const events = await findWithDecryption(
       context.em,
       WarrantyClaimEvent,

package/src/modules/warranty_claims/api/portal/attachments/route.ts

@@ -9,7 +9,7 @@ import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mer
 import { emitCrudSideEffects } from '@open-mercato/shared/lib/commands/helpers'
 import { findOneWithDecryption, findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
 import { createLogger } from '@open-mercato/shared/lib/logger'
-import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import type { CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { Attachment, AttachmentPartition } from '@open-mercato/core/modules/attachments/data/entities'
 import { buildAttachmentImageUrl, slugifyAttachmentFileName } from '@open-mercato/core/modules/attachments/lib/imageUrls'
 import { StorageDriverFactory } from '@open-mercato/core/modules/attachments/lib/drivers'
@@ -28,6 +28,7 @@ import { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../commands/shared'
 import { CUSTOMER_VISIBLE_ATTACHMENT_TAG, isCustomerVisibleAttachment } from '../../../lib/attachmentVisibility'
 import { loadPortalOwnedClaim } from '../../../lib/portalClaimAccess'
 import { resolvePortalAttachmentUploadService } from '../../../lib/portalAttachmentUpload'
+import { resolveLinkedCustomerAuth } from '../../../lib/portalAuthGuard'
 
 const CLAIM_ATTACHMENT_ENTITY_ID = 'warranty_claims:warranty_claim'
 const logger = createLogger('warranty_claims').child({ route: 'portal-attachments' })
@@ -80,13 +81,9 @@ function toIso(value: Date | string | null | undefined): string | null {
 }
 
 async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
-  const auth = await getCustomerAuthFromRequest(req)
-  if (!auth) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
-  }
-  if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
-  }
+  const authOrResponse = await resolveLinkedCustomerAuth(req)
+  if (authOrResponse instanceof Response) return authOrResponse
+  const auth = authOrResponse
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   return {
@@ -240,19 +237,23 @@ async function deletePortalAttachment(context: PortalContext, attachment: Attach
   }
 }
 
-async function streamOwnedAttachment(context: PortalContext, attachmentId: string): Promise<Response> {
+async function streamOwnedAttachment(
+  context: PortalContext,
+  attachmentId: string,
+  translate: (key: string, fallback?: string) => string,
+): Promise<Response> {
   const owned = await loadOwnedVisibleAttachment(context, attachmentId)
   if (!owned) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const { attachment } = owned
   const partition = await context.em.findOne(AttachmentPartition, { code: attachment.partitionCode })
   if (!partition) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.load_failed' }, { status: 500 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.load_failed', 'Failed to load warranty claim data.') }, { status: 500 })
   }
   const access = checkAttachmentAccess(attachmentAuth(context), attachment, partition, { requireAuthForPublic: true })
   if (!access.ok) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const driver = await (await resolveStorageDriverFactory(context)).resolveForPartition(attachment.partitionCode, {
     tenantId: attachment.tenantId ?? '',
@@ -262,7 +263,7 @@ async function streamOwnedAttachment(context: PortalContext, attachmentId: strin
   try {
     buffer = (await driver.read(attachment.partitionCode, attachment.storagePath)).buffer
   } catch {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const headers: Record<string, string> = {
     'Cache-Control': 'private, max-age=60',
@@ -279,14 +280,15 @@ export async function GET(req: Request) {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { translate } = await resolveTranslations()
   const url = new URL(req.url)
   const attachmentId = url.searchParams.get('attachmentId')
   if (attachmentId) {
     const attachmentIdParsed = z.string().uuid().safeParse(attachmentId)
     if (!attachmentIdParsed.success) {
-      return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+      return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
     }
-    return streamOwnedAttachment(context, attachmentIdParsed.data)
+    return streamOwnedAttachment(context, attachmentIdParsed.data, translate)
   }
   const parsed = attachmentQuerySchema.safeParse({
     claimId: url.searchParams.get('claimId') ?? undefined,
@@ -294,11 +296,11 @@ export async function GET(req: Request) {
     pageSize: url.searchParams.get('pageSize') ?? undefined,
   })
   if (!parsed.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const claim = await loadOwnedClaim(context, parsed.data.claimId)
   if (!claim) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const filter = {
     entityId: CLAIM_ATTACHMENT_ENTITY_ID,
@@ -343,12 +345,12 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { t, translate } = await resolveTranslations()
   const contentType = req.headers.get('content-type') || ''
   if (!contentType.toLowerCase().includes('multipart/form-data')) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   if (!isMultipartRequestWithinUploadLimit(req.headers.get('content-length'))) {
-    const { t } = await resolveTranslations()
     return NextResponse.json({
       ok: false,
       error: t('attachments.errors.maxUploadSize', 'Attachment exceeds the maximum upload size.'),
@@ -364,15 +366,15 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
     ? z.string().uuid().safeParse(form.get('attachmentId') ?? undefined)
     : null
   if (!parsed.success || (replacement && !parsedAttachmentId?.success)) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const claim = await loadOwnedClaim(context, parsed.data.claimId)
   if (!claim) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const file = form.get('file')
   if (!(file instanceof File)) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.portal.detail.fileRequired' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.portal.detail.fileRequired', 'Choose a file before uploading.') }, { status: 400 })
   }
   const buffer = Buffer.from(await file.arrayBuffer())
 
@@ -381,7 +383,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
     ? await loadOwnedVisibleAttachment(context, attachmentId)
     : null
   if (replacement && (!replacementTarget || replacementTarget.claim.id !== claim.id)) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
 
   const guarded = await runPortalAttachmentGuard(req, context, claim.id, replacement ? 'update' : 'create', {
@@ -397,7 +399,7 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
 
   const uploadService = resolvePortalAttachmentUploadService(context.container)
   if (!uploadService) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.portal.detail.attachmentError' }, { status: 503 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.portal.detail.attachmentError', 'Attachment upload failed.') }, { status: 503 })
   }
 
   let attachment: Attachment
@@ -414,7 +416,6 @@ async function handleUpload(req: Request, replacement: boolean): Promise<Respons
     })
   } catch (error) {
     if (isScopedAttachmentUploadError(error)) {
-      const { t } = await resolveTranslations()
       const [key, fallback] = ATTACHMENT_ERROR_TRANSLATIONS[error.code]
         ?? ['warranty_claims.portal.detail.attachmentError', 'Attachment upload failed.']
       return NextResponse.json(
@@ -451,16 +452,17 @@ export async function DELETE(req: Request) {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { translate } = await resolveTranslations()
   const url = new URL(req.url)
   const parsed = deleteQuerySchema.safeParse({
     attachmentId: url.searchParams.get('attachmentId') ?? undefined,
   })
   if (!parsed.success) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.invalidInput' }, { status: 400 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.invalidInput', 'Invalid input') }, { status: 400 })
   }
   const owned = await loadOwnedVisibleAttachment(context, parsed.data.attachmentId)
   if (!owned) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const guarded = await runPortalAttachmentGuard(req, context, owned.claim.id, 'delete', {
     claimId: owned.claim.id,

package/src/modules/warranty_claims/api/portal/claims/[id]/route.ts

@@ -3,10 +3,12 @@ import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
-import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import type { CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import type { OpenApiRouteDoc } from '@open-mercato/shared/lib/openapi'
 import { WarrantyClaim, WarrantyClaimLine } from '../../../../data/entities'
 import { loadPortalOwnedClaim } from '../../../../lib/portalClaimAccess'
+import { resolveLinkedCustomerAuth } from '../../../../lib/portalAuthGuard'
 
 export const metadata = {
   GET: { requireAuth: false },
@@ -40,13 +42,9 @@ async function resolveClaimId(ctx: RouteContext): Promise<string | null> {
 }
 
 async function resolvePortalContext(req: Request): Promise<PortalContext | Response> {
-  const auth = await getCustomerAuthFromRequest(req)
-  if (!auth) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
-  }
-  if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
-  }
+  const authOrResponse = await resolveLinkedCustomerAuth(req)
+  if (authOrResponse instanceof Response) return authOrResponse
+  const auth = authOrResponse
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   return {
@@ -108,9 +106,10 @@ export async function GET(req: Request, ctx: RouteContext) {
   const contextOrResponse = await resolvePortalContext(req)
   if (contextOrResponse instanceof Response) return contextOrResponse
   const context = contextOrResponse
+  const { translate } = await resolveTranslations()
   const claimId = await resolveClaimId(ctx)
   if (!claimId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const scope = { tenantId: context.tenantId, organizationId: context.organizationId }
   const claim = await loadPortalOwnedClaim(
@@ -123,7 +122,7 @@ export async function GET(req: Request, ctx: RouteContext) {
     claimId,
   )
   if (!claim) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.notFound' }, { status: 404 })
+    return NextResponse.json({ ok: false, error: translate('warranty_claims.errors.notFound', 'Claim not found.') }, { status: 404 })
   }
   const lines = await findWithDecryption(
     context.em,

package/src/modules/warranty_claims/api/portal/claims/[id]/shared.ts

@@ -1,14 +1,14 @@
-import { NextResponse } from 'next/server'
 import { z } from 'zod'
 import type { EntityManager } from '@mikro-orm/postgresql'
 import type { AuthContext } from '@open-mercato/shared/lib/auth/server'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
 import type { CommandRuntimeContext } from '@open-mercato/shared/lib/commands'
 import { runRouteMutationGuards, type RouteMutationGuardResult } from '@open-mercato/shared/lib/crud/route-mutation-guard'
-import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+import type { CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
 import { WarrantyClaim } from '../../../../data/entities'
 import { WARRANTY_CLAIM_RESOURCE_KIND } from '../../../../commands/shared'
 import { loadPortalOwnedClaim } from '../../../../lib/portalClaimAccess'
+import { resolveLinkedCustomerAuth } from '../../../../lib/portalAuthGuard'
 
 export type PortalClaimActionRouteContext = { params: Promise<{ id: string }> }
 
@@ -34,13 +34,9 @@ export async function resolvePortalClaimId(ctx: PortalClaimActionRouteContext):
 }
 
 export async function resolvePortalActionContext(req: Request): Promise<PortalClaimActionContext | Response> {
-  const auth = await getCustomerAuthFromRequest(req)
-  if (!auth) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.unauthorized' }, { status: 401 })
-  }
-  if (!auth.customerEntityId) {
-    return NextResponse.json({ ok: false, error: 'warranty_claims.errors.customerAccountNotLinked' }, { status: 403 })
-  }
+  const authOrResponse = await resolveLinkedCustomerAuth(req)
+  if (authOrResponse instanceof Response) return authOrResponse
+  const auth = authOrResponse
   const container = await createRequestContainer()
   const em = container.resolve('em') as EntityManager
   const commandAuth: NonNullable<AuthContext> = {