@open-mercato/core 0.7.1-develop.7154.1.981330c924 → 0.7.1-develop.7171.1.9b31dbba45

package/src/modules/customer_accounts/api/admin/demo-accounts.ts

@@ -0,0 +1,149 @@
+import { NextResponse } from 'next/server'
+import { compare as bcryptCompare } from 'bcryptjs'
+import { z } from 'zod'
+import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
+import { getAuthFromRequest } from '@open-mercato/shared/lib/auth/server'
+import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
+import { RbacService } from '@open-mercato/core/modules/auth/services/rbacService'
+import { CustomerUser, CustomerUserRole } from '@open-mercato/core/modules/customer_accounts/data/entities'
+import { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'
+import { findWithDecryption } from '@open-mercato/shared/lib/encryption/find'
+import { lookupHashCandidates } from '@open-mercato/shared/lib/encryption/aes'
+import type { EntityManager } from '@mikro-orm/postgresql'
+
+const FEATURE = 'customer_accounts.view'
+
+export const metadata = {
+  GET: { requireAuth: true, requireFeatures: [FEATURE] },
+}
+
+/**
+ * Reports which of the `seedExamples` portal accounts can actually be logged into
+ * in the caller's organization. An installation initialized with `--no-examples`,
+ * or an organization the examples were never seeded into, gets an empty list so
+ * the admin UI can hide the demo-credentials sections entirely (#5669).
+ *
+ * The surfaces this feeds claim "these credentials work", so mere existence is not
+ * enough: the lookup applies the same guards `api/login.ts` enforces (active,
+ * email-verified, not soft-deleted) and the advertised password is compared
+ * against the stored hash, so an account that was deactivated or whose password
+ * was changed since seeding drops out instead of being advertised.
+ */
+export async function GET(req: Request) {
+  const auth = await getAuthFromRequest(req)
+  if (!auth) {
+    return NextResponse.json({ ok: false, error: 'Authentication required' }, { status: 401 })
+  }
+
+  const container = await createRequestContainer()
+  const rbacService = container.resolve('rbacService') as RbacService
+  const hasAccess = await rbacService.userHasAllFeatures(auth.sub, [FEATURE], { tenantId: auth.tenantId, organizationId: auth.orgId })
+  if (!hasAccess) {
+    return NextResponse.json({ ok: false, error: 'Insufficient permissions' }, { status: 403 })
+  }
+
+  const em = container.resolve('em') as EntityManager
+
+  // Emails are stored encrypted, so the seeded addresses are matched through the
+  // deterministic lookup hash (both the current and the legacy candidate).
+  const accountByHash = new Map<string, (typeof EXAMPLE_PORTAL_ACCOUNTS)[number]>()
+  for (const account of EXAMPLE_PORTAL_ACCOUNTS) {
+    for (const candidate of lookupHashCandidates(account.email)) {
+      accountByHash.set(candidate, account)
+    }
+  }
+
+  const seededUsers = await findWithDecryption(
+    em,
+    CustomerUser,
+    {
+      emailHash: { $in: Array.from(accountByHash.keys()) },
+      tenantId: auth.tenantId,
+      organizationId: auth.orgId,
+      isActive: true,
+      emailVerifiedAt: { $ne: null },
+      deletedAt: null,
+    } as any,
+    undefined,
+    { tenantId: auth.tenantId, organizationId: auth.orgId },
+  )
+
+  const loginableUsers: typeof seededUsers = []
+  for (const user of seededUsers) {
+    const account = accountByHash.get(user.emailHash as string)
+    if (!account || !user.passwordHash) continue
+    if (await bcryptCompare(account.password, user.passwordHash)) loginableUsers.push(user)
+  }
+
+  if (loginableUsers.length === 0) {
+    return NextResponse.json({ ok: true, items: [] })
+  }
+
+  const roleLinks = await findWithDecryption(
+    em,
+    CustomerUserRole,
+    { user: { $in: loginableUsers.map((user) => user.id) } as any, deletedAt: null } as any,
+    { populate: ['role'] },
+    { tenantId: auth.tenantId, organizationId: auth.orgId },
+  )
+
+  const rolesByUserId = new Map<string, Array<{ id: string; name: string; slug: string }>>()
+  for (const link of roleLinks) {
+    const role = link.role
+    if (!role || role.deletedAt) continue
+    const entry = { id: role.id, name: role.name, slug: role.slug }
+    const bucket = rolesByUserId.get(link.user.id)
+    if (bucket) bucket.push(entry)
+    else rolesByUserId.set(link.user.id, [entry])
+  }
+
+  const seenEmails = new Set<string>()
+  const items: Array<{ email: string; password: string; roles: Array<{ id: string; name: string; slug: string }> }> = []
+  for (const user of loginableUsers) {
+    const account = accountByHash.get(user.emailHash as string)
+    if (!account || seenEmails.has(account.email)) continue
+    seenEmails.add(account.email)
+    items.push({
+      email: account.email,
+      password: account.password,
+      roles: rolesByUserId.get(user.id) ?? [],
+    })
+  }
+
+  // Keep the response ordered like the seed list so the admin table is stable.
+  const orderByEmail = new Map(EXAMPLE_PORTAL_ACCOUNTS.map((account, index) => [account.email, index]))
+  items.sort((a, b) => (orderByEmail.get(a.email) ?? 0) - (orderByEmail.get(b.email) ?? 0))
+
+  return NextResponse.json({ ok: true, items })
+}
+
+const demoAccountSchema = z.object({
+  email: z.string().email(),
+  password: z.string(),
+  roles: z.array(z.object({ id: z.string().uuid(), name: z.string(), slug: z.string() })),
+})
+
+const errorSchema = z.object({ ok: z.literal(false), error: z.string() })
+
+const getMethodDoc: OpenApiMethodDoc = {
+  summary: 'List seeded demo portal accounts (admin)',
+  description:
+    'Returns the example-data portal accounts that exist in the caller’s organization and can still be logged into with the credentials the seeding hook created them with. Accounts that were deactivated, left unverified, soft-deleted, or had their password changed are omitted, as is every account when example data was not seeded.',
+  tags: ['Customer Accounts Admin'],
+  responses: [{
+    status: 200,
+    description: 'Seeded demo accounts present in the current organization',
+    schema: z.object({ ok: z.literal(true), items: z.array(demoAccountSchema) }),
+  }],
+  errors: [
+    { status: 401, description: 'Not authenticated', schema: errorSchema },
+    { status: 403, description: 'Insufficient permissions', schema: errorSchema },
+  ],
+}
+
+export const openApi: OpenApiRouteDoc = {
+  summary: 'Seeded demo portal accounts (admin)',
+  methods: {
+    GET: getMethodDoc,
+  },
+}

package/src/modules/customer_accounts/api/invitations/accept.ts

@@ -3,11 +3,15 @@ import { z } from 'zod'
 import type { OpenApiRouteDoc, OpenApiMethodDoc } from '@open-mercato/shared/lib/openapi'
 import { invitationAcceptSchema } from '@open-mercato/core/modules/customer_accounts/data/validators'
 import { createRequestContainer } from '@open-mercato/shared/lib/di/container'
-import { CustomerInvitationService } from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
+import {
+  CustomerInvitationService,
+  isCustomerInvitationEmailConflictError,
+} from '@open-mercato/core/modules/customer_accounts/services/customerInvitationService'
 import { CustomerSessionService } from '@open-mercato/core/modules/customer_accounts/services/customerSessionService'
 import { CustomerRbacService } from '@open-mercato/core/modules/customer_accounts/services/customerRbacService'
 import { emitCustomerAccountsEvent } from '@open-mercato/core/modules/customer_accounts/events'
 import { getClientIp } from '@open-mercato/shared/lib/ratelimit/helpers'
+import { resolveTranslations } from '@open-mercato/shared/lib/i18n/server'
 
 export const metadata: { path?: string; requireAuth?: boolean } = { requireAuth: false }
 
@@ -29,11 +33,23 @@ export async function POST(req: Request) {
   const customerSessionService = container.resolve('customerSessionService') as CustomerSessionService
   const customerRbacService = container.resolve('customerRbacService') as CustomerRbacService
 
-  const result = await customerInvitationService.acceptInvitation(
-    parsed.data.token,
-    parsed.data.password,
-    parsed.data.displayName,
-  )
+  let result: Awaited<ReturnType<typeof customerInvitationService.acceptInvitation>>
+  try {
+    result = await customerInvitationService.acceptInvitation(
+      parsed.data.token,
+      parsed.data.password,
+      parsed.data.displayName,
+    )
+  } catch (error) {
+    if (isCustomerInvitationEmailConflictError(error)) {
+      const { translate } = await resolveTranslations()
+      return NextResponse.json({
+        ok: false,
+        error: translate('customer_accounts.errors.emailAlreadyExists', 'An account with this email address already exists'),
+      }, { status: 409 })
+    }
+    throw error
+  }
   if (!result) {
     return NextResponse.json({ ok: false, error: 'Invalid or expired invitation' }, { status: 400 })
   }
@@ -117,6 +133,7 @@ const methodDoc: OpenApiMethodDoc = {
   ],
   errors: [
     { status: 400, description: 'Invalid or expired invitation', schema: errorSchema },
+    { status: 409, description: 'An account with this email address already exists', schema: errorSchema },
   ],
 }
 

package/src/modules/customer_accounts/backend/customer_accounts/settings/CustomerAccountsSettingsPageClient.tsx

@@ -6,12 +6,7 @@ import { FormHeader } from '@open-mercato/ui/backend/forms'
 import { Button } from '@open-mercato/ui/primitives/button'
 import { useT } from '@open-mercato/shared/lib/i18n/context'
 import { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'
-
-const DEMO_CREDENTIALS = [
-  { email: 'alice.johnson@example.com', password: 'Password123!', role: 'Portal Admin' },
-  { email: 'bob.smith@example.com', password: 'Password123!', role: 'Buyer' },
-  { email: 'carol.white@example.com', password: 'Password123!', role: 'Viewer' },
-] as const
+import { useDemoPortalAccounts } from '../useDemoPortalAccounts'
 
 export type CustomerAccountsSettingsPageClientProps = {
   portalOrigin: string
@@ -20,6 +15,7 @@ export type CustomerAccountsSettingsPageClientProps = {
 
 export function CustomerAccountsSettingsPageClient({ portalOrigin, portalOrgSlug = null }: CustomerAccountsSettingsPageClientProps) {
   const t = useT()
+  const { accounts: demoAccounts } = useDemoPortalAccounts()
 
   const portalUrl = useMemo(() => buildPortalUrlPattern(portalOrigin), [portalOrigin])
   const portalRootUrl = useMemo(
@@ -73,43 +69,49 @@ export function CustomerAccountsSettingsPageClient({ portalOrigin, portalOrgSlug
           </p>
         </div>
 
-        <div className="rounded-lg border p-4 space-y-3">
-          <h3 className="text-sm font-semibold">
-            {t('customer_accounts.settings.demo_credentials.title', 'Demo Credentials')}
-          </h3>
-          <div className="overflow-x-auto">
-            <table className="w-full text-sm">
-              <thead>
-                <tr className="border-b text-left">
-                  <th className="pb-2 pr-4 font-medium text-muted-foreground">
-                    {t('customer_accounts.settings.demo_credentials.email', 'Email')}
-                  </th>
-                  <th className="pb-2 pr-4 font-medium text-muted-foreground">
-                    {t('customer_accounts.settings.demo_credentials.password', 'Password')}
-                  </th>
-                  <th className="pb-2 font-medium text-muted-foreground">
-                    {t('customer_accounts.settings.demo_credentials.role', 'Role')}
-                  </th>
-                </tr>
-              </thead>
-              <tbody>
-                {DEMO_CREDENTIALS.map((cred) => (
-                  <tr key={cred.email} className="border-b last:border-0">
-                    <td className="py-2 pr-4 font-mono text-xs">{cred.email}</td>
-                    <td className="py-2 pr-4 font-mono text-xs">{cred.password}</td>
-                    <td className="py-2 text-xs">{cred.role}</td>
+        {demoAccounts.length > 0 ? (
+          <div className="rounded-lg border p-4 space-y-3">
+            <h3 className="text-sm font-semibold">
+              {t('customer_accounts.settings.demo_credentials.title', 'Demo Credentials')}
+            </h3>
+            <div className="overflow-x-auto">
+              <table className="w-full text-sm">
+                <thead>
+                  <tr className="border-b text-left">
+                    <th className="pb-2 pr-4 font-medium text-muted-foreground">
+                      {t('customer_accounts.settings.demo_credentials.email', 'Email')}
+                    </th>
+                    <th className="pb-2 pr-4 font-medium text-muted-foreground">
+                      {t('customer_accounts.settings.demo_credentials.password', 'Password')}
+                    </th>
+                    <th className="pb-2 font-medium text-muted-foreground">
+                      {t('customer_accounts.settings.demo_credentials.role', 'Role')}
+                    </th>
                   </tr>
-                ))}
-              </tbody>
-            </table>
+                </thead>
+                <tbody>
+                  {demoAccounts.map((account) => (
+                    <tr key={account.email} className="border-b last:border-0">
+                      <td className="py-2 pr-4 font-mono text-xs">{account.email}</td>
+                      <td className="py-2 pr-4 font-mono text-xs">{account.password}</td>
+                      <td className="py-2 text-xs">
+                        {account.roles.length > 0
+                          ? account.roles.map((role) => role.name).join(', ')
+                          : t('customer_accounts.settings.demo_credentials.no_role', 'No role assigned')}
+                      </td>
+                    </tr>
+                  ))}
+                </tbody>
+              </table>
+            </div>
+            <p className="text-xs text-muted-foreground">
+              {t(
+                'customer_accounts.settings.demo_credentials.note',
+                'These accounts were created automatically for this organization by the example-data seeding step during setup.',
+              )}
+            </p>
           </div>
-          <p className="text-xs text-muted-foreground">
-            {t(
-              'customer_accounts.settings.demo_credentials.note',
-              'These credentials are only available if example data was seeded during setup.',
-            )}
-          </p>
-        </div>
+        ) : null}
 
         <div className="rounded-lg border p-4 space-y-3">
           <h3 className="text-sm font-semibold">

package/src/modules/customer_accounts/backend/customer_accounts/useDemoPortalAccounts.ts

@@ -0,0 +1,42 @@
+"use client"
+
+import * as React from 'react'
+import { apiCall } from '@open-mercato/ui/backend/utils/apiCall'
+
+export type DemoPortalAccount = {
+  email: string
+  password: string
+  roles: Array<{ id: string; name: string; slug: string }>
+}
+
+type DemoAccountsResponse = {
+  items?: DemoPortalAccount[]
+}
+
+/**
+ * Loads the example-data portal accounts that exist in the current organization.
+ * Callers render demo credentials only for what comes back, so an installation
+ * started with `--no-examples` shows nothing at all (#5669). A failed lookup
+ * resolves to an empty list — never to a hardcoded fallback.
+ */
+export function useDemoPortalAccounts(): { accounts: DemoPortalAccount[] } {
+  const [accounts, setAccounts] = React.useState<DemoPortalAccount[]>([])
+
+  React.useEffect(() => {
+    let cancelled = false
+    async function load() {
+      try {
+        const call = await apiCall<DemoAccountsResponse>('/api/customer_accounts/admin/demo-accounts')
+        if (cancelled) return
+        const items = call.ok && Array.isArray(call.result?.items) ? call.result!.items : []
+        setAccounts(items)
+      } catch {
+        if (!cancelled) setAccounts([])
+      }
+    }
+    load()
+    return () => { cancelled = true }
+  }, [])
+
+  return { accounts }
+}

package/src/modules/customer_accounts/backend/customer_accounts/users/PortalUsersPageClient.tsx

@@ -22,6 +22,7 @@ import { useGuardedMutation } from '@open-mercato/ui/backend/injection/useGuarde
 import { ListEmptyState } from '@open-mercato/ui/backend/filters/ListEmptyState'
 import type { FilterDef, FilterValues } from '@open-mercato/ui/backend/FilterBar'
 import { buildPortalRootUrl, buildPortalUrlPattern } from '../../../lib/portalUrl'
+import { useDemoPortalAccounts } from '../useDemoPortalAccounts'
 
 type UserRow = {
   id: string
@@ -248,6 +249,7 @@ export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: Po
   const [reloadToken, setReloadToken] = React.useState(0)
   const [roleOptions, setRoleOptions] = React.useState<Array<{ value: string; label: string; id: string }>>([])
   const [createDialogOpen, setCreateDialogOpen] = React.useState(false)
+  const { accounts: demoAccounts } = useDemoPortalAccounts()
 
   const { runMutation, retryLastMutation } = useGuardedMutation<{
     entityType: string
@@ -506,9 +508,14 @@ export function PortalUsersPageClient({ portalOrigin, portalOrgSlug = null }: Po
                 url: buildPortalUrlPattern(portalOrigin),
               })}
             </p>
-            <p className="mt-0.5 text-xs text-status-info-text">
-              {t('customer_accounts.admin.portalInfo.credentials', 'Demo credentials: alice.johnson@example.com / Password123!')}
-            </p>
+            {demoAccounts.length > 0 ? (
+              <p className="mt-0.5 text-xs text-status-info-text">
+                {t('customer_accounts.admin.portalInfo.credentials', 'Seeded demo credentials: {email} / {password}', {
+                  email: demoAccounts[0].email,
+                  password: demoAccounts[0].password,
+                })}
+              </p>
+            ) : null}
           </div>
           <div className="flex shrink-0 flex-col gap-2">
             <Button

package/src/modules/customer_accounts/data/entities.ts

@@ -13,7 +13,11 @@ export const DOMAIN_STATUSES: readonly DomainStatus[] = [
 ] as const
 
 @Entity({ tableName: 'customer_users' })
-@Unique({ properties: ['tenantId', 'emailHash'], name: 'customer_users_tenant_email_hash_uniq' })
+@Index({
+  name: 'customer_users_tenant_email_hash_uniq',
+  expression:
+    'create unique index "customer_users_tenant_email_hash_uniq" on "customer_users" ("tenant_id", "email_hash") where "deleted_at" is null',
+})
 export class CustomerUser {
   @PrimaryKey({ type: 'uuid', defaultRaw: 'gen_random_uuid()' })
   id!: string

package/src/modules/customer_accounts/i18n/de.json

@@ -133,7 +133,7 @@
   "customer_accounts.admin.portalFeatures.users.manage.description": "Ermöglicht das Bearbeiten von Rollen und das Entfernen von Teammitgliedern",
   "customer_accounts.admin.portalFeatures.users.view": "Teammitglieder anzeigen",
   "customer_accounts.admin.portalFeatures.users.view.description": "Ermöglicht das Anzeigen anderer Teammitglieder in der Organisation",
-  "customer_accounts.admin.portalInfo.credentials": "Demo credentials: alice.johnson@example.com / Password123!",
+  "customer_accounts.admin.portalInfo.credentials": "Geseedete Demo-Zugangsdaten: {email} / {password}",
   "customer_accounts.admin.portalInfo.description": "Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.",
   "customer_accounts.admin.portalInfo.open": "Open Portal",
   "customer_accounts.admin.portalInfo.openConfiguration": "Open Configuration",
@@ -274,6 +274,7 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.errors.emailAlreadyExists": "Es existiert bereits ein Konto mit dieser E-Mail-Adresse",
   "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
   "customer_accounts.invitation.email.cta": "Accept invitation",
   "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
@@ -307,7 +308,8 @@
   "customer_accounts.search.badge.customerUser": "Kundenbenutzer",
   "customer_accounts.settings.back": "Kundenbenutzer",
   "customer_accounts.settings.demo_credentials.email": "Email",
-  "customer_accounts.settings.demo_credentials.note": "These credentials are only available if example data was seeded during setup.",
+  "customer_accounts.settings.demo_credentials.no_role": "Keine Rolle zugewiesen",
+  "customer_accounts.settings.demo_credentials.note": "Diese Konten wurden während der Einrichtung automatisch für diese Organisation durch den Schritt zum Seeden der Beispieldaten erstellt.",
   "customer_accounts.settings.demo_credentials.password": "Password",
   "customer_accounts.settings.demo_credentials.role": "Role",
   "customer_accounts.settings.demo_credentials.title": "Demo Credentials",

package/src/modules/customer_accounts/i18n/en.json

@@ -133,7 +133,7 @@
   "customer_accounts.admin.portalFeatures.users.manage.description": "Allows editing roles and removing team members",
   "customer_accounts.admin.portalFeatures.users.view": "View team members",
   "customer_accounts.admin.portalFeatures.users.view.description": "Allows viewing other team members in the organization",
-  "customer_accounts.admin.portalInfo.credentials": "Demo credentials: alice.johnson@example.com / Password123!",
+  "customer_accounts.admin.portalInfo.credentials": "Seeded demo credentials: {email} / {password}",
   "customer_accounts.admin.portalInfo.description": "Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.",
   "customer_accounts.admin.portalInfo.open": "Open Portal",
   "customer_accounts.admin.portalInfo.openConfiguration": "Open Configuration",
@@ -274,6 +274,7 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.errors.emailAlreadyExists": "An account with this email address already exists",
   "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
   "customer_accounts.invitation.email.cta": "Accept invitation",
   "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
@@ -307,7 +308,8 @@
   "customer_accounts.search.badge.customerUser": "Customer user",
   "customer_accounts.settings.back": "Customer Users",
   "customer_accounts.settings.demo_credentials.email": "Email",
-  "customer_accounts.settings.demo_credentials.note": "These credentials are only available if example data was seeded during setup.",
+  "customer_accounts.settings.demo_credentials.no_role": "No role assigned",
+  "customer_accounts.settings.demo_credentials.note": "These accounts were created automatically for this organization by the example-data seeding step during setup.",
   "customer_accounts.settings.demo_credentials.password": "Password",
   "customer_accounts.settings.demo_credentials.role": "Role",
   "customer_accounts.settings.demo_credentials.title": "Demo Credentials",

package/src/modules/customer_accounts/i18n/es.json

@@ -133,7 +133,7 @@
   "customer_accounts.admin.portalFeatures.users.manage.description": "Permite editar roles y eliminar miembros del equipo",
   "customer_accounts.admin.portalFeatures.users.view": "Ver miembros del equipo",
   "customer_accounts.admin.portalFeatures.users.view.description": "Permite ver a otros miembros del equipo en la organización",
-  "customer_accounts.admin.portalInfo.credentials": "Demo credentials: alice.johnson@example.com / Password123!",
+  "customer_accounts.admin.portalInfo.credentials": "Credenciales de demostración sembradas: {email} / {password}",
   "customer_accounts.admin.portalInfo.description": "Manage customer portal accounts. Customers can self-register, log in, and access orders, quotes, and invoices through the portal.",
   "customer_accounts.admin.portalInfo.open": "Open Portal",
   "customer_accounts.admin.portalInfo.openConfiguration": "Open Configuration",
@@ -274,6 +274,7 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL certificate issue",
   "customer_accounts.domainMapping.tls.retryButton": "Retry SSL",
   "customer_accounts.domainMapping.verifyNow": "Check Now",
+  "customer_accounts.errors.emailAlreadyExists": "Ya existe una cuenta con esta dirección de correo electrónico",
   "customer_accounts.invitation.email.body": "Use this secure invitation link to create your password and access the customer portal.",
   "customer_accounts.invitation.email.cta": "Accept invitation",
   "customer_accounts.invitation.email.hint": "This invitation link expires in 72 hours. If you did not expect this invitation, you can ignore this email.",
@@ -307,7 +308,8 @@
   "customer_accounts.search.badge.customerUser": "Usuario de cliente",
   "customer_accounts.settings.back": "Usuarios de clientes",
   "customer_accounts.settings.demo_credentials.email": "Email",
-  "customer_accounts.settings.demo_credentials.note": "These credentials are only available if example data was seeded during setup.",
+  "customer_accounts.settings.demo_credentials.no_role": "Sin rol asignado",
+  "customer_accounts.settings.demo_credentials.note": "Estas cuentas se crearon automáticamente para esta organización mediante el paso de carga de datos de ejemplo durante la configuración.",
   "customer_accounts.settings.demo_credentials.password": "Password",
   "customer_accounts.settings.demo_credentials.role": "Role",
   "customer_accounts.settings.demo_credentials.title": "Demo Credentials",

package/src/modules/customer_accounts/i18n/ko.json

@@ -133,7 +133,7 @@
   "customer_accounts.admin.portalFeatures.users.manage.description": "역할 편집 및 팀 구성원 제거 허용",
   "customer_accounts.admin.portalFeatures.users.view": "팀원 보기",
   "customer_accounts.admin.portalFeatures.users.view.description": "조직의 다른 팀 구성원을 볼 수 있습니다.",
-  "customer_accounts.admin.portalInfo.credentials": "데모 자격 증명: alice.johnson@example.com / password123",
+  "customer_accounts.admin.portalInfo.credentials": "시드된 데모 자격 증명: {email} / {password}",
   "customer_accounts.admin.portalInfo.description": "고객 포털 계정을 관리합니다. 고객은 셀프 등록, 로그인을 할 수 있으며 포털을 통해 주문, 견적, 인보이스에 접근할 수 있습니다.",
   "customer_accounts.admin.portalInfo.open": "포털 열기",
   "customer_accounts.admin.portalInfo.openConfiguration": "구성 열기",
@@ -274,6 +274,7 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "SSL 인증서 문제",
   "customer_accounts.domainMapping.tls.retryButton": "SSL 재시도",
   "customer_accounts.domainMapping.verifyNow": "지금 확인",
+  "customer_accounts.errors.emailAlreadyExists": "이 이메일 주소로 등록된 계정이 이미 있습니다",
   "customer_accounts.invitation.email.body": "이 보안 초대 링크를 사용하여 비밀번호를 생성하고 고객 포털에 액세스하세요.",
   "customer_accounts.invitation.email.cta": "초대 수락",
   "customer_accounts.invitation.email.hint": "이 초대 링크는 72시간 후에 만료됩니다. 이 초대를 예상하지 못했다면 이 이메일을 무시해도 됩니다.",
@@ -307,7 +308,8 @@
   "customer_accounts.search.badge.customerUser": "고객 사용자",
   "customer_accounts.settings.back": "고객 사용자",
   "customer_accounts.settings.demo_credentials.email": "이메일",
-  "customer_accounts.settings.demo_credentials.note": "이 자격 증명은 설정 중 예제 데이터가 시드된 경우에만 사용할 수 있습니다.",
+  "customer_accounts.settings.demo_credentials.no_role": "할당된 역할 없음",
+  "customer_accounts.settings.demo_credentials.note": "이 계정은 설정 중 예제 데이터 시딩 단계에서 이 조직을 위해 자동으로 생성되었습니다.",
   "customer_accounts.settings.demo_credentials.password": "비밀번호",
   "customer_accounts.settings.demo_credentials.role": "역할",
   "customer_accounts.settings.demo_credentials.title": "데모 자격 증명",

package/src/modules/customer_accounts/i18n/pl.json

@@ -133,7 +133,7 @@
   "customer_accounts.admin.portalFeatures.users.manage.description": "Umożliwia edycję ról i usuwanie członków zespołu",
   "customer_accounts.admin.portalFeatures.users.view": "Wyświetlanie członków zespołu",
   "customer_accounts.admin.portalFeatures.users.view.description": "Umożliwia przeglądanie innych członków zespołu w organizacji",
-  "customer_accounts.admin.portalInfo.credentials": "Dane demonstracyjne: alice.johnson@example.com / Password123!",
+  "customer_accounts.admin.portalInfo.credentials": "Zaseedowane dane demonstracyjne: {email} / {password}",
   "customer_accounts.admin.portalInfo.description": "Zarządzaj kontami portalu klienta. Klienci mogą sami się rejestrować, logować oraz przeglądać zamówienia, oferty i faktury w portalu.",
   "customer_accounts.admin.portalInfo.open": "Otwórz portal",
   "customer_accounts.admin.portalInfo.openConfiguration": "Otwórz konfigurację",
@@ -274,6 +274,7 @@
   "customer_accounts.domainMapping.tls.diagnostics.title": "Problem z certyfikatem SSL",
   "customer_accounts.domainMapping.tls.retryButton": "Ponów SSL",
   "customer_accounts.domainMapping.verifyNow": "Sprawdź teraz",
+  "customer_accounts.errors.emailAlreadyExists": "Konto z tym adresem e-mail już istnieje",
   "customer_accounts.invitation.email.body": "Użyj bezpiecznego linku zaproszenia, aby utworzyć hasło i uzyskać dostęp do portalu klienta.",
   "customer_accounts.invitation.email.cta": "Przyjmij zaproszenie",
   "customer_accounts.invitation.email.hint": "Ten link zaproszenia wygasa po 72 godzinach. Jeśli nie spodziewasz się tego zaproszenia, możesz zignorować tę wiadomość.",
@@ -307,7 +308,8 @@
   "customer_accounts.search.badge.customerUser": "Użytkownik klienta",
   "customer_accounts.settings.back": "Użytkownicy klientów",
   "customer_accounts.settings.demo_credentials.email": "E-mail",
-  "customer_accounts.settings.demo_credentials.note": "Te dane są dostępne tylko wtedy, gdy podczas konfiguracji zaseedowano dane przykładowe.",
+  "customer_accounts.settings.demo_credentials.no_role": "Brak przypisanej roli",
+  "customer_accounts.settings.demo_credentials.note": "Te konta zostały utworzone automatycznie dla tej organizacji przez krok seedowania danych przykładowych podczas konfiguracji.",
   "customer_accounts.settings.demo_credentials.password": "Hasło",
   "customer_accounts.settings.demo_credentials.role": "Rola",
   "customer_accounts.settings.demo_credentials.title": "Dane demonstracyjne",

package/src/modules/customer_accounts/lib/exampleAccounts.ts

@@ -0,0 +1,18 @@
+export type ExamplePortalAccount = {
+  email: string
+  displayName: string
+  password: string
+  roleSlug: string
+}
+
+/**
+ * Portal accounts created by the module's `seedExamples` hook. Setup seeds from
+ * this list and the admin demo-credentials endpoint reports against it, so the
+ * advertised credentials can never drift from the seeded ones (#3198) and are
+ * only surfaced for accounts that actually exist in the current scope (#5669).
+ */
+export const EXAMPLE_PORTAL_ACCOUNTS: readonly ExamplePortalAccount[] = [
+  { email: 'alice.johnson@example.com', displayName: 'Alice Johnson', password: 'Password123!', roleSlug: 'portal_admin' },
+  { email: 'bob.smith@example.com', displayName: 'Bob Smith', password: 'Password123!', roleSlug: 'buyer' },
+  { email: 'carol.white@example.com', displayName: 'Carol White', password: 'Password123!', roleSlug: 'viewer' },
+] as const

package/src/modules/customer_accounts/migrations/.snapshot-open-mercato.json

@@ -1821,15 +1821,13 @@
           "unique": true
         },
         {
-          "columnNames": [
-            "tenant_id",
-            "email_hash"
-          ],
-          "composite": true,
-          "constraint": true,
           "keyName": "customer_users_tenant_email_hash_uniq",
+          "columnNames": [],
+          "composite": false,
+          "constraint": false,
           "primary": false,
-          "unique": true
+          "unique": false,
+          "expression": "create unique index \"customer_users_tenant_email_hash_uniq\" on \"customer_users\" (\"tenant_id\", \"email_hash\") where \"deleted_at\" is null"
         }
       ],
       "checks": [],

package/src/modules/customer_accounts/migrations/Migration20260827160000_customer_accounts.ts

@@ -0,0 +1,23 @@
+import { Migration } from '@mikro-orm/migrations';
+
+export class Migration20260827160000_customer_accounts extends Migration {
+
+  override async up(): Promise<void> {
+    this.addSql(`alter table "customer_users" drop constraint "customer_users_tenant_email_hash_uniq";`);
+    this.addSql(`create unique index "customer_users_tenant_email_hash_uniq" on "customer_users" ("tenant_id", "email_hash") where "deleted_at" is null;`);
+  }
+
+  override async down(): Promise<void> {
+    this.addSql(`drop index if exists "customer_users_tenant_email_hash_uniq";`);
+    // Once the partial index has been live, a soft-deleted row legitimately shares
+    // (tenant_id, email_hash) with a newer row — which is the point of this change —
+    // so the full constraint cannot be restored while both exist. Purge the losing
+    // soft-deleted duplicates first: this is destructive, but it only removes rows
+    // that were already logically deleted, and without it `down()` fails on exactly
+    // the data the migration enables. The surviving row is the active one, else the
+    // most recently created.
+    this.addSql(`delete from "customer_users" losing using "customer_users" winner where losing."deleted_at" is not null and losing."tenant_id" = winner."tenant_id" and losing."email_hash" = winner."email_hash" and losing."id" <> winner."id" and (winner."deleted_at" is null or winner."created_at" > losing."created_at" or (winner."created_at" = losing."created_at" and winner."id" > losing."id"));`);
+    this.addSql(`alter table "customer_users" add constraint "customer_users_tenant_email_hash_uniq" unique ("tenant_id", "email_hash");`);
+  }
+
+}