@open-mercato/core 0.7.1-develop.7131.1.20abf9e885 → 0.7.1-develop.7136.1.0f76137a1d

package/src/modules/warranty_claims/api/troubleshooting-guides/route.ts

@@ -2,6 +2,7 @@ import { z } from 'zod'
 import type { CrudCtx } from '@open-mercato/shared/lib/crud/factory'
 import { makeCrudRoute } from '@open-mercato/shared/lib/crud/factory'
 import { CrudHttpError } from '@open-mercato/shared/lib/crud/errors'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 import { parseBooleanFromUnknown } from '@open-mercato/shared/lib/boolean'
 import { buildIlikeTerm } from '@open-mercato/shared/lib/db/buildIlikeTerm'
 import { applyIdsFilter } from '../../lib/apiIdsFilter'
@@ -122,11 +123,24 @@ function toEntitySteps(value: unknown): Record<string, unknown> | null {
   if (value === undefined || value === null) return null
   const parsed = parseGuideSteps(value)
   if (!parsed) {
-    throw new CrudHttpError(400, { error: 'warranty_claims.errors.invalidTroubleshootingSteps' })
+    throw new CrudHttpError(400, { error: '[internal] troubleshooting steps reached the entity mapper unvalidated' })
   }
   return { prompt: parsed.prompt, options: parsed.options }
 }
 
+async function assertParsableGuideSteps(input: object): Promise<void> {
+  if (!hasOwn(input, 'steps')) return
+  const value = (input as { steps?: unknown }).steps
+  if (value === undefined || value === null || parseGuideSteps(value)) return
+  const { translate } = await resolveTranslations()
+  throw new CrudHttpError(400, {
+    error: translate(
+      'warranty_claims.errors.invalidTroubleshootingSteps',
+      'Troubleshooting steps must include a prompt and valid option branches.',
+    ),
+  })
+}
+
 function toTroubleshootingGuideEntityData(input: TroubleshootingGuideCreateInput): Record<string, unknown> {
   return {
     claimType: input.claimType ?? null,
@@ -238,6 +252,14 @@ const crud = makeCrudRoute<RawTroubleshootingGuideInput, RawTroubleshootingGuide
     schema: rawBodySchema,
     mapToEntity: (input, ctx) => toTroubleshootingGuideEntityData(parseCreateInput(input, ctx)),
   },
+  hooks: {
+    beforeCreate: async (input) => {
+      await assertParsableGuideSteps(input)
+    },
+    beforeUpdate: async (input) => {
+      await assertParsableGuideSteps(input)
+    },
+  },
   update: {
     schema: rawBodySchema,
     getId: (input) => {

package/src/modules/warranty_claims/api/vendor-recovery-suggestions/route.ts

@@ -43,6 +43,7 @@ type SuggestionsRouteContext = {
   tenantId: string
   organizationId: string
   scope: WarrantyClaimScope
+  translate: (key: string, fallback?: string) => string
   em: EntityManager
 }
 
@@ -79,6 +80,7 @@ async function resolveSuggestionsContext(req: Request): Promise<SuggestionsRoute
     tenantId: auth.tenantId,
     organizationId,
     scope: { tenantId: auth.tenantId, organizationId },
+    translate,
     em,
   }
 }
@@ -88,7 +90,7 @@ export async function GET(req: Request) {
     const context = await resolveSuggestionsContext(req)
     const url = new URL(req.url)
     const query = querySchema.parse(Object.fromEntries(url.searchParams))
-    const claim = await requireScopedClaim(context.em, query.claimId, context.scope)
+    const claim = await requireScopedClaim(context.em, query.claimId, context.scope, {}, context.translate('warranty_claims.errors.notFound', 'Claim not found.'))
     if (claim.claimType !== 'warranty' || (claim.status !== 'resolved' && claim.status !== 'closed')) {
       return NextResponse.json({ ok: true, result: { claimId: claim.id, suggestions: [] } })
     }

package/src/modules/warranty_claims/commands/shared.ts

@@ -80,14 +80,20 @@ export async function loadScopedClaim(
   )
 }
 
+/**
+ * `notFoundMessage` is passed to `assertFound` verbatim, so request-scoped callers
+ * must hand in an already-translated sentence; the key default only suits the
+ * command surface, which runs without a request locale.
+ */
 export async function requireScopedClaim(
   em: EntityManager,
   id: string,
   scope: WarrantyClaimScope,
   options: FindOneOptions<WarrantyClaim> = {},
+  notFoundMessage = 'warranty_claims.errors.notFound',
 ): Promise<WarrantyClaim> {
   const claim = await loadScopedClaim(em, id, scope, options)
-  return assertFound(claim, 'warranty_claims.errors.notFound')
+  return assertFound(claim, notFoundMessage)
 }
 
 export function appendClaimEvent(

package/src/modules/warranty_claims/lib/portalAuthGuard.ts

@@ -0,0 +1,30 @@
+import { NextResponse } from 'next/server'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
+import { getCustomerAuthFromRequest, type CustomerAuthContext } from '@open-mercato/core/modules/customer_accounts/lib/customerAuth'
+
+export type LinkedCustomerAuthContext = CustomerAuthContext & { customerEntityId: string }
+
+export async function resolveLinkedCustomerAuth(req: Request): Promise<LinkedCustomerAuthContext | Response> {
+  const auth = await getCustomerAuthFromRequest(req)
+  if (!auth) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      { ok: false, error: translate('warranty_claims.errors.unauthorized', 'Unauthorized') },
+      { status: 401 },
+    )
+  }
+  if (!auth.customerEntityId) {
+    const { translate } = await resolveTranslations()
+    return NextResponse.json(
+      {
+        ok: false,
+        error: translate(
+          'warranty_claims.errors.customerAccountNotLinked',
+          'Customer account is not linked to a customer record',
+        ),
+      },
+      { status: 403 },
+    )
+  }
+  return auth as LinkedCustomerAuthContext
+}