@open-mercato/core 0.7.1-develop.7137.1.26575786c0 → 0.7.1-develop.7148.1.3076e5ccf7

package/src/modules/integrations/backend/integrations/[id]/page.tsx

@@ -58,6 +58,7 @@ import {
   type SecretFieldsConfigured,
 } from '../credential-secret-fields'
 import { isValidCredentialUrl } from '../../../lib/credentials-field-validation'
+import { useIntegrationCredentialsFeatureAccess } from '../useIntegrationCredentialsFeatureAccess'
 
 type CredentialField = IntegrationCredentialField
 type BuiltInIntegrationDetailTab = 'credentials' | 'version' | 'health' | 'logs' | 'data-sync-schedule'
@@ -65,6 +66,11 @@ type IntegrationDetailTab = BuiltInIntegrationDetailTab | string
 
 const UNSUPPORTED_CREDENTIAL_FIELD_TYPES = new Set<CredentialFieldType>(['oauth', 'ssh_keypair'])
 
+// `/api/integrations/{id}/credentials` requires `integrations.credentials.manage`, so a viewer
+// without the grant gets an expected 403 that the permission notice already explains. Opting out
+// of the global forbidden handling keeps it from raising an "Access denied" flash and throwing.
+const credentialsRequestHeaders = { 'x-om-forbidden-redirect': '0' } as const
+
 function isEditableCredentialField(field: CredentialField): boolean {
   return !UNSUPPORTED_CREDENTIAL_FIELD_TYPES.has(field.type)
 }
@@ -463,6 +469,10 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
   const [activeTab, setActiveTab] = React.useState<IntegrationDetailTab>('credentials')
 
   const credentialsFormId = React.useId()
+  const {
+    isLoading: isLoadingCredentialsAccess,
+    canManageCredentials,
+  } = useIntegrationCredentialsFeatureAccess()
 
   const resolveCurrentIntegrationId = React.useCallback(() => {
     return integrationId ?? (
@@ -516,7 +526,7 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
       updatedAt?: string | null
     }>(
       `/api/integrations/${encodeURIComponent(currentIntegrationId)}/credentials`,
-      undefined,
+      { headers: credentialsRequestHeaders },
       { fallback: null },
     )
     if (call.ok && call.result) {
@@ -1032,7 +1042,10 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
     ? 'border-status-success-border bg-status-success-bg text-status-success-text'
     : 'border-status-neutral-border bg-status-neutral-bg text-status-neutral-text'
 
-  const showCredentialActions = showCredentialsTab && activeTab === 'credentials' && credentialFormFields.length > 0
+  const showCredentialActions = showCredentialsTab
+    && activeTab === 'credentials'
+    && credentialFormFields.length > 0
+    && canManageCredentials
 
   React.useEffect(() => {
     setActiveTab(resolveRequestedIntegrationDetailTab(searchParams?.get('tab'), visibleTabIds))
@@ -1280,6 +1293,14 @@ export default function IntegrationDetailPage({ params }: IntegrationDetailPageP
                   <p className="text-sm text-muted-foreground">
                     {t('integrations.detail.credentials.notConfigured')}
                   </p>
+                ) : isLoadingCredentialsAccess ? (
+                  <div className="flex justify-center py-8"><Spinner /></div>
+                ) : !canManageCredentials ? (
+                  <EmptyState
+                    size="sm"
+                    icon={<Key className="h-8 w-8" aria-hidden="true" />}
+                    title={t('integrations.detail.credentials.noPermission', 'You do not have permission to manage credentials for this integration.')}
+                  />
                 ) : (
                   <CrudForm<Record<string, unknown>>
                     key={`${resolvedIntegration.id}:${credentialsFormKey}`}

package/src/modules/integrations/backend/integrations/useIntegrationCredentialsFeatureAccess.ts

@@ -0,0 +1,50 @@
+"use client"
+
+import * as React from 'react'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+import { hasFeature } from '@open-mercato/shared/security/features'
+
+type FeatureCheckResponse = {
+  granted?: string[]
+}
+
+export function useIntegrationCredentialsFeatureAccess() {
+  const [granted, setGranted] = React.useState<string[]>([])
+  const [isLoading, setIsLoading] = React.useState(true)
+
+  React.useEffect(() => {
+    let cancelled = false
+
+    async function load() {
+      try {
+        const call = await apiCall<FeatureCheckResponse>('/api/auth/feature-check', {
+          method: 'POST',
+          headers: { 'content-type': 'application/json' },
+          body: JSON.stringify({
+            features: ['integrations.credentials.manage'],
+          }),
+        })
+
+        if (!cancelled) {
+          setGranted(Array.isArray(call.result?.granted) ? call.result.granted : [])
+        }
+      } catch {
+        if (!cancelled) setGranted([])
+      } finally {
+        if (!cancelled) setIsLoading(false)
+      }
+    }
+
+    void load()
+
+    return () => {
+      cancelled = true
+    }
+  }, [])
+
+  return {
+    isLoading,
+    granted,
+    canManageCredentials: hasFeature(granted, 'integrations.credentials.manage'),
+  }
+}

package/src/modules/integrations/i18n/de.json

@@ -11,6 +11,7 @@
   "integrations.detail.back": "Zurück zu Integrationen",
   "integrations.detail.backToList": "Zurück zu Integrationen",
   "integrations.detail.credentials.bundleShared": "Gemeinsame Zugangsdaten aus Paket: {bundle}",
+  "integrations.detail.credentials.noPermission": "Sie haben keine Berechtigung, die Zugangsdaten für diese Integration zu verwalten.",
   "integrations.detail.credentials.notConfigured": "Noch keine Zugangsdaten konfiguriert",
   "integrations.detail.credentials.save": "Zugangsdaten speichern",
   "integrations.detail.credentials.saveError": "Zugangsdaten konnten nicht gespeichert werden",

package/src/modules/integrations/i18n/en.json

@@ -11,6 +11,7 @@
   "integrations.detail.back": "Back to Integrations",
   "integrations.detail.backToList": "Back to integrations",
   "integrations.detail.credentials.bundleShared": "Shared credentials from bundle: {bundle}",
+  "integrations.detail.credentials.noPermission": "You do not have permission to manage credentials for this integration.",
   "integrations.detail.credentials.notConfigured": "No credentials configured yet",
   "integrations.detail.credentials.save": "Save Credentials",
   "integrations.detail.credentials.saveError": "Failed to save credentials",

package/src/modules/integrations/i18n/es.json

@@ -11,6 +11,7 @@
   "integrations.detail.back": "Volver a integraciones",
   "integrations.detail.backToList": "Volver a integraciones",
   "integrations.detail.credentials.bundleShared": "Credenciales compartidas del paquete: {bundle}",
+  "integrations.detail.credentials.noPermission": "No tiene permiso para gestionar las credenciales de esta integración.",
   "integrations.detail.credentials.notConfigured": "No hay credenciales configuradas",
   "integrations.detail.credentials.save": "Guardar credenciales",
   "integrations.detail.credentials.saveError": "No se pudieron guardar las credenciales",

package/src/modules/integrations/i18n/ko.json

@@ -11,6 +11,7 @@
   "integrations.detail.back": "통합으로 돌아가기",
   "integrations.detail.backToList": "통합 목록으로 돌아가기",
   "integrations.detail.credentials.bundleShared": "번들에서 공유된 자격 증명: {bundle}",
+  "integrations.detail.credentials.noPermission": "이 통합의 자격 증명을 관리할 권한이 없습니다.",
   "integrations.detail.credentials.notConfigured": "아직 구성된 자격 증명이 없습니다",
   "integrations.detail.credentials.save": "자격 증명 저장",
   "integrations.detail.credentials.saveError": "자격 증명 저장에 실패했습니다",

package/src/modules/integrations/i18n/pl.json

@@ -11,6 +11,7 @@
   "integrations.detail.back": "Powrót do integracji",
   "integrations.detail.backToList": "Wróć do integracji",
   "integrations.detail.credentials.bundleShared": "Współdzielone dane z pakietu: {bundle}",
+  "integrations.detail.credentials.noPermission": "Nie masz uprawnień do zarządzania danymi uwierzytelniającymi tej integracji.",
   "integrations.detail.credentials.notConfigured": "Brak skonfigurowanych danych",
   "integrations.detail.credentials.save": "Zapisz dane",
   "integrations.detail.credentials.saveError": "Nie udało się zapisać danych",

package/src/modules/messages/api/route.ts

@@ -22,6 +22,7 @@ import {
   composeSourceHintSchema,
   resolveComposeSourceChannelType,
 } from '../lib/composeSourceChannelType'
+import { resolveMessageActionData } from '../lib/actions'
 import { MESSAGE_ATTACHMENT_ENTITY_ID } from '../lib/constants'
 import { getMessageType } from '../lib/message-types-registry'
 import { validateMessageObjectsForType } from '../lib/object-validation'
@@ -382,7 +383,7 @@ export async function GET(req: Request) {
         if (!message) return null
         const body = typeof message.body === 'string' ? message.body : ''
         const bodyPreview = body.substring(0, 150) + (body.length > 150 ? '...' : '')
-        const actionData = message.actionData ?? null
+        const actionData = resolveMessageActionData(message)
         return {
           ...(senderMetaById.get(row.sender_user_id)
             ? {

package/src/modules/sales/commands/documents.ts

@@ -134,6 +134,7 @@ import {
   mapOrderLineEntityToSnapshot,
   mapQuoteLineEntityToSnapshot,
   resolveUpsertDiscountFields,
+  resolveUpsertTotalsOrigin,
 } from "../lib/lineSnapshots";
 import { loadShippedQuantityByLine } from "../lib/shipments/snapshots";
 import { resolveDictionaryEntryValue, resolveCachedDictionaryEntryValue } from "../lib/dictionaries";
@@ -3038,6 +3039,13 @@ function isStoredRowSourcedLine(line: DocumentLineCreateInput): boolean {
   );
 }
 
+function isStoredRowSourcedTotalsLine(line: DocumentLineCreateInput): boolean {
+  return (
+    (line as Pick<SalesLineSnapshot, "totalsFromStoredRow">)
+      .totalsFromStoredRow === true
+  );
+}
+
 function createLineSnapshotFromInput(
   line: DocumentLineCreateInput,
   lineNumber: number,
@@ -3079,6 +3087,10 @@ function createLineSnapshotFromInput(
     ...(isStoredRowSourcedLine(line)
       ? { discountAmountFromStoredRow: true }
       : { discountAmountBasis: line.discountAmountBasis ?? "unit" }),
+    // Carried independently of the discount origin above: a line upsert can
+    // take its discount from the caller while its totals still come off the
+    // stored row, and only the caller half is worth reconciling (#5644).
+    ...(isStoredRowSourcedTotalsLine(line) ? { totalsFromStoredRow: true } : {}),
     discountPercent: line.discountPercent ?? null,
     taxRate: line.taxRate ?? null,
     taxAmount: line.taxAmount ?? null,
@@ -7240,6 +7252,7 @@ const orderLineUpsertCommand: CommandHandler<
         parsed.totalNetAmount ?? existingSnapshot?.totalNetAmount ?? null,
       totalGrossAmount:
         parsed.totalGrossAmount ?? existingSnapshot?.totalGrossAmount ?? null,
+      ...resolveUpsertTotalsOrigin(parsed.totalNetAmount, existingSnapshot),
       configuration:
         parsed.configuration ?? existingSnapshot?.configuration ?? null,
       promotionCode:
@@ -7737,6 +7750,7 @@ const quoteLineUpsertCommand: CommandHandler<
         parsed.totalNetAmount ?? existingSnapshot?.totalNetAmount ?? null,
       totalGrossAmount:
         parsed.totalGrossAmount ?? existingSnapshot?.totalGrossAmount ?? null,
+      ...resolveUpsertTotalsOrigin(parsed.totalNetAmount, existingSnapshot),
       configuration:
         parsed.configuration ?? existingSnapshot?.configuration ?? null,
       promotionCode:

package/src/modules/sales/lib/calculations.ts

@@ -1,3 +1,4 @@
+import { createLogger } from '@open-mercato/shared/lib/logger'
 import {
   type SalesAdjustmentDraft,
   type SalesCalculationContext,
@@ -11,6 +12,8 @@ import {
   type SalesTotalsCalculationHook,
 } from './types'
 
+const logger = createLogger('sales')
+
 function toNumber(value: unknown, fallback = 0): number {
   if (typeof value === 'number' && Number.isFinite(value)) return value
   if (typeof value === 'string' && value.trim() !== '' && !Number.isNaN(Number(value))) {
@@ -23,6 +26,12 @@ function round(value: number): number {
   return Math.round((value + Number.EPSILON) * 1e4) / 1e4
 }
 
+// The engine rounds to the 4 decimals the numeric columns carry, but callers
+// work in money at 2, so an exact comparison would report half a cent of
+// honest rounding as a mismatch. Half a minor unit is the widest divergence
+// that cannot be a real discrepancy and the narrowest that silences that noise.
+const NET_RECONCILIATION_TOLERANCE = 0.005
+
 function extractAdjustmentTaxRate(adjustment: SalesAdjustmentDraft): number | null {
   const metadata = (adjustment.metadata ?? {}) as Record<string, unknown>
   const candidate =
@@ -120,6 +129,38 @@ function buildBaseLineResult(line: SalesLineSnapshot): SalesLineCalculationResul
     netSubtotalBeforeDiscount,
   )
   const netSubtotal = Math.max(netSubtotalBeforeDiscount - discountTotal, 0)
+  // Unlike totalGrossAmount below, a supplied totalNetAmount is never honoured
+  // verbatim — net always comes from unitPriceNet/discount so it stays
+  // internally consistent with them. A caller-supplied value is still
+  // reconciled against the computed one so a divergence (e.g. a mis-read
+  // discount) surfaces instead of being silently discarded (#5644).
+  //
+  // Only a caller's value is reconciled: a snapshot rebuilt from a persisted
+  // row (`totalsFromStoredRow`) carries the engine's own previous output, and
+  // on a row the discount contract still has to heal that value is *supposed*
+  // to differ from the recomputed net. Warning about it would drown the caller
+  // signal this exists for in one line per line per recalculation.
+  if (line.totalsFromStoredRow !== true && line.totalNetAmount !== null && line.totalNetAmount !== undefined) {
+    const computedNetAmount = round(netSubtotal)
+    const suppliedNetAmount = toNumber(line.totalNetAmount, NaN)
+    if (!Number.isFinite(suppliedNetAmount)) {
+      // Falling back to the computed value here would compare equal and log
+      // nothing — the same silent discard #5644 exists to end.
+      logger.warn('Sales line totalNetAmount is not a finite number; the computed value is used', {
+        lineId: line.id ?? null,
+        productId: line.productId ?? null,
+        suppliedTotalNetAmount: line.totalNetAmount,
+        computedNetAmount,
+      })
+    } else if (Math.abs(round(suppliedNetAmount) - computedNetAmount) > NET_RECONCILIATION_TOLERANCE) {
+      logger.warn('Sales line totalNetAmount does not match the computed net amount; the computed value is used', {
+        lineId: line.id ?? null,
+        productId: line.productId ?? null,
+        suppliedTotalNetAmount: round(suppliedNetAmount),
+        computedNetAmount,
+      })
+    }
+  }
   const explicitTaxAmount = line.taxAmount !== null && line.taxAmount !== undefined
   let taxAmount = explicitTaxAmount
     ? toNumber(line.taxAmount, 0)

package/src/modules/sales/lib/lineSnapshots.ts

@@ -39,6 +39,11 @@ function mapPersistedLine(line: SalesOrderLine | SalesQuoteLine): SalesLineSnaps
     discountPercent: toNumeric(line.discountPercent),
     taxRate: toNumeric(line.taxRate),
     taxAmount: toNumeric(line.taxAmount),
+    // The totals below are the engine's own previous output read back off the
+    // row, not something a caller asserted, so they are not reconciled against
+    // the recomputed net (#5644) — on a legacy row that divergence is the
+    // discount contract healing itself, not a caller mistake.
+    totalsFromStoredRow: true,
     totalNetAmount: toNumeric(line.totalNetAmount),
     totalGrossAmount: toNumeric(line.totalGrossAmount),
     configuration: line.configuration ? cloneJson(line.configuration) : null,
@@ -96,3 +101,21 @@ export function resolveUpsertDiscountFields(
     discountAmountFromStoredRow: existingSnapshot != null,
   }
 }
+
+/**
+ * Decide whether the `totalNetAmount` an upsert payload ends up carrying is a
+ * caller assertion or a value that came back off the stored row.
+ *
+ * The upsert merges caller input over the existing snapshot, so the merged
+ * total has two possible origins and only the caller one is worth reconciling
+ * against the recomputed net (#5644): a value read back off the row is what the
+ * engine itself wrote last time, and on a legacy row it is exactly what
+ * recalculation is supposed to heal.
+ */
+export function resolveUpsertTotalsOrigin(
+  callerTotalNetAmount: number | null | undefined,
+  existingSnapshot: Pick<SalesLineSnapshot, 'totalNetAmount'> | null | undefined,
+): Pick<SalesLineSnapshot, 'totalsFromStoredRow'> {
+  if (callerTotalNetAmount !== null && callerTotalNetAmount !== undefined) return {}
+  return existingSnapshot != null ? { totalsFromStoredRow: true } : {}
+}

package/src/modules/sales/lib/types.ts

@@ -73,6 +73,15 @@ export type SalesLineSnapshot = {
   discountPercent?: number | null
   taxRate?: number | null
   taxAmount?: number | null
+  /**
+   * Set by entity-to-snapshot mappers ONLY. Marks `totalNetAmount` /
+   * `totalGrossAmount` as reconstructed from a persisted row, so they are the
+   * engine's own previous output rather than a caller assertion. That is what
+   * keeps the #5644 reconciliation a *caller* signal: a stored net is expected
+   * to diverge on a row the discount contract heals on the next pass. Never
+   * persisted; never accepted from a request.
+   */
+  totalsFromStoredRow?: boolean
   totalNetAmount?: number | null
   totalGrossAmount?: number | null
   configuration?: Record<string, unknown> | null

package/src/modules/workflows/migrations/Migration20260901120000_reindex_workflow_definitions.ts

@@ -0,0 +1,21 @@
+import { Migration } from '@mikro-orm/migrations';
+import { declareQueryIndexReindex } from '@open-mercato/shared/lib/query/migration-reindex';
+
+/**
+ * Catch-up reindex for `Migration20260428102318`, which renamed three seeded
+ * `workflow_definitions.workflow_id` values in raw SQL and never notified the query index. On
+ * every install that already applied it, `entity_indexes.doc` for `workflows:workflow_definition`
+ * still resolves those records by the pre-rename identifier — `checkout_simple_v1` rather than
+ * `workflows.checkout-demo`, and so on — which is exactly the identifier the rename removed.
+ *
+ * This migration executes no SQL — the declaration below is its entire payload.
+ */
+export const queryIndexReindexEntityTypes = declareQueryIndexReindex([
+  'workflows:workflow_definition',
+]);
+
+export class Migration20260901120000_reindex_workflow_definitions extends Migration {
+  override up(): void | Promise<void> {}
+
+  override down(): void | Promise<void> {}
+}