@open-mercato/core 0.7.1-develop.7178.1.ab93fbaf4e → 0.7.1-develop.7179.1.e8c03264b6

package/src/helpers/integration/timesheetFixtures.ts

@@ -2,16 +2,46 @@ import { expect, type APIRequestContext } from '@playwright/test'
 import { apiRequest } from './api'
 import { deleteStaffEntityIfExists } from './staffFixtures'
 
+export type CreateTimeProjectFixtureInput = {
+  /**
+   * Required in practice: US-B1 makes a customer mandatory on project create, so a
+   * call without it cannot succeed. Pass an id from `customers.customer_entities`;
+   * `createCompanyFixture` returns one.
+   *
+   * It is typed optional only because this module is published as
+   * `@open-mercato/core/helpers/integration/timesheetFixtures`, and tightening the
+   * parameter would break every third-party spec at compile time with no
+   * deprecation window. The check below turns the omission into a named error
+   * instead of the 422 that six in-repo specs hit (T2.10).
+   */
+  customerId?: string
+  name?: string
+  code?: string
+}
+
+/**
+ * Creates a time project. `input.customerId` must be supplied — see the type above
+ * for why it is not enforced by the compiler.
+ */
 export async function createTimeProjectFixture(
   request: APIRequestContext,
   token: string,
-  input?: { name?: string; code?: string },
+  input?: CreateTimeProjectFixtureInput,
 ): Promise<string> {
+  const customerId = input?.customerId
+  if (!customerId) {
+    throw new Error(
+      '[internal] createTimeProjectFixture requires input.customerId: a customer is mandatory on ' +
+        'POST /api/staff/timesheets/time-projects, and there is no safe default to fall back to. ' +
+        'Create one first (e.g. createCompanyFixture from crmFixtures) and pass its id.',
+    )
+  }
   const response = await apiRequest(request, 'POST', '/api/staff/timesheets/time-projects', {
     token,
     data: {
       name: input?.name ?? `QA Project ${Date.now()}`,
       code: input?.code ?? `QA-${Date.now()}`,
+      customerId,
       projectType: 'internal',
       status: 'active',
     },

package/src/modules/auth/README.md

@@ -9,7 +9,7 @@ Features:
   - `mercato auth seed-roles`
   - `mercato auth add-org --name <org>`
   - `mercato auth setup --orgName <org> --email <e> --password <p> [--roles superadmin,admin] [--skip-password-policy]`
-  - `mercato auth sync-role-acls [--tenant <tenantId>] [--no-superadmin]` — re-applies each enabled module's `defaultRoleFeatures` to existing tenants. Idempotent and additive (existing custom features are preserved). Run after deploying new module features to ensure existing tenants pick them up; without `--tenant` it iterates every tenant.
+  - `mercato auth sync-role-acls [--tenant <tenantId>] [--no-superadmin]` — re-applies each enabled module's `defaultRoleFeatures` (staff roles) **and** `defaultCustomerRoleFeatures` (customer/portal roles) to existing tenants. Idempotent and additive (existing custom features are preserved; no role or ACL row is created). Run after deploying new module features to ensure existing tenants pick them up; without `--tenant` it iterates every tenant. The portal half is skipped in deployments without the `customer_accounts` module.
 
 DB entities used (defined in root schema):
 - `users` with: `email`, `password_hash`, `is_confirmed`, `last_login_at`, `organization_id`, timestamps.

package/src/modules/auth/cli.ts

@@ -21,7 +21,7 @@ import type { KmsService, TenantDek } from '@open-mercato/shared/lib/encryption/
 import crypto from 'node:crypto'
 import { formatPasswordRequirements, getPasswordPolicy, validatePassword } from '@open-mercato/shared/lib/auth/passwordPolicy'
 import { parseBooleanToken } from '@open-mercato/shared/lib/boolean'
-import { getCliModules } from '@open-mercato/shared/modules/registry'
+import { getCliModules, type Module } from '@open-mercato/shared/modules/registry'
 
 async function resolveTenantScopedRole(em: any, name: string, normalizedTenantId: string | null) {
   const existing = await em.findOne(Role, { name, tenantId: normalizedTenantId })
@@ -784,6 +784,34 @@ const setPassword: ModuleCli = {
   },
 }
 
+/**
+ * The portal half of the same sync.
+ *
+ * Staff roles pick up a module's newly declared features here; customer roles used
+ * to pick theirs up only at tenant bootstrap, so a portal feature that shipped
+ * after a tenant existed never reached that tenant's `Buyer`/`Viewer` roles and the
+ * page stayed invisible to every real customer. `customer_accounts` owns those
+ * entities and is optional, so it is reached through a guarded dynamic import: a
+ * deployment without the module syncs its staff roles exactly as before.
+ */
+async function syncCustomerRoleAcls(
+  em: EntityManager,
+  tenantId: string,
+  modules: Module[],
+): Promise<{ updatedRoleSlugs: string[]; addedFeatures: string[] } | null> {
+  let ensure: typeof import('@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls').ensureDefaultCustomerRoleAcls
+  try {
+    ;({ ensureDefaultCustomerRoleAcls: ensure } = await import(
+      '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'
+    ))
+  } catch {
+    // The portal module is not part of this deployment; staff roles are still synced.
+    return null
+  }
+  // Deliberately outside the guard: a failure of the sync itself is a real error.
+  return ensure(em, tenantId, modules)
+}
+
 const syncRoleAcls: ModuleCli = {
   command: 'sync-role-acls',
   async run(rest) {
@@ -841,7 +869,13 @@ const syncRoleAcls: ModuleCli = {
     for (const tenantId of targetTenantIds) {
       await ensureDefaultRoleAcls(em, tenantId, modules, { includeSuperadminRole })
       await ensureCustomRoleAcls(em, tenantId, modules)
+      const portal = await syncCustomerRoleAcls(em, tenantId, modules)
       console.log(`✅ Synced role ACLs for tenant ${tenantId}`)
+      if (portal && portal.addedFeatures.length) {
+        console.log(
+          `   ↳ portal roles ${portal.updatedRoleSlugs.join(', ')} gained ${portal.addedFeatures.join(', ')}`,
+        )
+      }
     }
   },
 }

package/src/modules/auth/i18n/de.json

@@ -277,6 +277,13 @@
   "auth.acl.features.staff.timesheets.manage_own": "Create/edit/delete own entries",
   "auth.acl.features.staff.timesheets.projects.manage": "Manage time projects",
   "auth.acl.features.staff.timesheets.projects.view": "View time projects",
+  "auth.acl.features.staff.timesheets.rates.view": "Sätze und Kosten ansehen",
+  "auth.acl.features.staff.timesheets.reports.manage": "Kundenberichte erstellen/bearbeiten",
+  "auth.acl.features.staff.timesheets.reports.unlock": "Berichtete Einträge entsperren",
+  "auth.acl.features.staff.timesheets.reports.view": "Kundenberichte ansehen",
+  "auth.acl.features.staff.timesheets.settings.manage": "Zeiterfassungseinstellungen verwalten",
+  "auth.acl.features.staff.timesheets.tasks.manage": "Aufgaben erstellen/bearbeiten",
+  "auth.acl.features.staff.timesheets.tasks.view": "Aufgaben ansehen",
   "auth.acl.features.staff.timesheets.view": "View own time entries",
   "auth.acl.features.staff.view": "View employees",
   "auth.acl.features.storage_providers.manage": "Manage storage providers",

package/src/modules/auth/i18n/en.json

@@ -277,6 +277,13 @@
   "auth.acl.features.staff.timesheets.manage_own": "Create/edit/delete own entries",
   "auth.acl.features.staff.timesheets.projects.manage": "Manage time projects",
   "auth.acl.features.staff.timesheets.projects.view": "View time projects",
+  "auth.acl.features.staff.timesheets.rates.view": "View rates and cost",
+  "auth.acl.features.staff.timesheets.reports.manage": "Create/edit customer reports",
+  "auth.acl.features.staff.timesheets.reports.unlock": "Unlock reported entries",
+  "auth.acl.features.staff.timesheets.reports.view": "View customer reports",
+  "auth.acl.features.staff.timesheets.settings.manage": "Manage time tracking settings",
+  "auth.acl.features.staff.timesheets.tasks.manage": "Create/edit tasks",
+  "auth.acl.features.staff.timesheets.tasks.view": "View tasks",
   "auth.acl.features.staff.timesheets.view": "View own time entries",
   "auth.acl.features.staff.view": "View employees",
   "auth.acl.features.storage_providers.manage": "Manage storage providers",

package/src/modules/auth/i18n/es.json

@@ -277,6 +277,13 @@
   "auth.acl.features.staff.timesheets.manage_own": "Create/edit/delete own entries",
   "auth.acl.features.staff.timesheets.projects.manage": "Manage time projects",
   "auth.acl.features.staff.timesheets.projects.view": "View time projects",
+  "auth.acl.features.staff.timesheets.rates.view": "Ver tarifas y costes",
+  "auth.acl.features.staff.timesheets.reports.manage": "Crear/editar informes de cliente",
+  "auth.acl.features.staff.timesheets.reports.unlock": "Desbloquear entradas reportadas",
+  "auth.acl.features.staff.timesheets.reports.view": "Ver informes de cliente",
+  "auth.acl.features.staff.timesheets.settings.manage": "Gestionar ajustes de control horario",
+  "auth.acl.features.staff.timesheets.tasks.manage": "Crear/editar tareas",
+  "auth.acl.features.staff.timesheets.tasks.view": "Ver tareas",
   "auth.acl.features.staff.timesheets.view": "View own time entries",
   "auth.acl.features.staff.view": "View employees",
   "auth.acl.features.storage_providers.manage": "Manage storage providers",

package/src/modules/auth/i18n/ko.json

@@ -277,6 +277,13 @@
   "auth.acl.features.staff.timesheets.manage_own": "Create/edit/delete own entries",
   "auth.acl.features.staff.timesheets.projects.manage": "Manage time projects",
   "auth.acl.features.staff.timesheets.projects.view": "View time projects",
+  "auth.acl.features.staff.timesheets.rates.view": "요율 및 비용 보기",
+  "auth.acl.features.staff.timesheets.reports.manage": "고객 리포트 생성/편집",
+  "auth.acl.features.staff.timesheets.reports.unlock": "보고된 항목 잠금 해제",
+  "auth.acl.features.staff.timesheets.reports.view": "고객 리포트 보기",
+  "auth.acl.features.staff.timesheets.settings.manage": "시간 추적 설정 관리",
+  "auth.acl.features.staff.timesheets.tasks.manage": "작업 생성/편집",
+  "auth.acl.features.staff.timesheets.tasks.view": "작업 보기",
   "auth.acl.features.staff.timesheets.view": "View own time entries",
   "auth.acl.features.staff.view": "View employees",
   "auth.acl.features.storage_providers.manage": "Manage storage providers",

package/src/modules/auth/i18n/pl.json

@@ -277,6 +277,13 @@
   "auth.acl.features.staff.timesheets.manage_own": "Twórz, edytuj i usuwaj własne wpisy",
   "auth.acl.features.staff.timesheets.projects.manage": "Zarządzaj projektami czasu pracy",
   "auth.acl.features.staff.timesheets.projects.view": "Wyświetl projekty czasu pracy",
+  "auth.acl.features.staff.timesheets.rates.view": "Podgląd stawek i kosztów",
+  "auth.acl.features.staff.timesheets.reports.manage": "Tworzenie/edycja raportów klienta",
+  "auth.acl.features.staff.timesheets.reports.unlock": "Odblokowanie zaraportowanych wpisów",
+  "auth.acl.features.staff.timesheets.reports.view": "Podgląd raportów klienta",
+  "auth.acl.features.staff.timesheets.settings.manage": "Zarządzanie ustawieniami śledzenia czasu",
+  "auth.acl.features.staff.timesheets.tasks.manage": "Tworzenie/edycja zadań",
+  "auth.acl.features.staff.timesheets.tasks.view": "Podgląd zadań",
   "auth.acl.features.staff.timesheets.view": "Wyświetl własne wpisy czasu pracy",
   "auth.acl.features.staff.view": "Wyświetl pracowników",
   "auth.acl.features.storage_providers.manage": "Zarządzaj dostawcami pamięci masowej",

package/src/modules/auth/lib/backendChrome.tsx

@@ -220,6 +220,7 @@ const defaultGroupOrder = [
   'wms.nav.group',
   'resources.nav.group',
   'staff.nav.group',
+  'staff.time_tracking.nav.group',
   'entities.nav.group',
   'directory.nav.group',
   'attachments.nav.group',

package/src/modules/customer_accounts/lib/customerRoleAcls.ts

@@ -0,0 +1,79 @@
+/**
+ * Merging every enabled module's `setup.defaultCustomerRoleFeatures` into the
+ * `CustomerRoleAcl` rows a tenant already has.
+ *
+ * The staff side of this has always had two entry points: tenant bootstrap, and
+ * `mercato auth sync-role-acls` for tenants that already existed when a module
+ * declared a new feature. The customer side only ever ran at bootstrap, so a
+ * portal feature shipped after a tenant was created never reached the `Buyer` and
+ * `Viewer` roles that tenant is actually using — the page was simply invisible to
+ * every real customer until somebody granted it by hand. It lives here rather than
+ * in `setup.ts` so both entry points can call the same merge.
+ *
+ * Additive and idempotent: a feature is only ever added, never removed, and a role
+ * or ACL row that does not exist is skipped rather than created — seeding roles is
+ * `seedDefaultRoles`' job.
+ */
+
+import type { EntityManager } from '@mikro-orm/postgresql'
+import type { Module } from '@open-mercato/shared/modules/registry'
+import {
+  CustomerRole,
+  CustomerRoleAcl,
+} from '@open-mercato/core/modules/customer_accounts/data/entities'
+
+export type CustomerRoleAclSyncResult = {
+  /** Role slugs whose ACL row gained at least one feature. */
+  updatedRoleSlugs: string[]
+  /** Features added, across every role, deduplicated — what to report to an operator. */
+  addedFeatures: string[]
+}
+
+export async function ensureDefaultCustomerRoleAcls(
+  em: EntityManager,
+  tenantId: string,
+  modules: Module[],
+): Promise<CustomerRoleAclSyncResult> {
+  const featuresByRole: Record<string, string[]> = {}
+
+  for (const mod of modules) {
+    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures
+    if (!customerRoleFeatures) continue
+    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {
+      if (!features || !features.length) continue
+      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []
+      featuresByRole[roleSlug].push(...features)
+    }
+  }
+
+  const result: CustomerRoleAclSyncResult = { updatedRoleSlugs: [], addedFeatures: [] }
+  const roleSlugs = Object.keys(featuresByRole)
+  if (!roleSlugs.length) return result
+
+  const added = new Set<string>()
+  for (const roleSlug of roleSlugs) {
+    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })
+    if (!role) continue
+
+    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })
+    if (!acl) continue
+
+    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
+    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))
+    const changed =
+      merged.length !== currentFeatures.length ||
+      merged.some((value, index) => value !== currentFeatures[index])
+    if (!changed) continue
+
+    const known = new Set(currentFeatures)
+    acl.featuresJson = merged
+    em.persist(acl)
+    result.updatedRoleSlugs.push(roleSlug)
+    for (const feature of merged) {
+      if (!known.has(feature)) added.add(feature)
+    }
+  }
+  result.addedFeatures = Array.from(added)
+  await em.flush()
+  return result
+}

package/src/modules/customer_accounts/setup.ts

@@ -1,7 +1,7 @@
 import type { ModuleSetupConfig, DefaultCustomerRoleFeatures } from '@open-mercato/shared/modules/setup'
 import type { EntityManager } from '@mikro-orm/postgresql'
-import type { Module } from '@open-mercato/shared/modules/registry'
 import { hash } from 'bcryptjs'
+import { ensureDefaultCustomerRoleAcls } from '@open-mercato/core/modules/customer_accounts/lib/customerRoleAcls'
 import { hashForLookup } from '@open-mercato/shared/lib/encryption/aes'
 import { EXAMPLE_PORTAL_ACCOUNTS } from '@open-mercato/core/modules/customer_accounts/lib/exampleAccounts'
 import {
@@ -142,50 +142,6 @@ const DEFAULT_CUSTOMER_ROLE_FEATURES = Object.fromEntries(
   DEFAULT_ROLES.map((role) => [role.slug, [...role.acl.features]]),
 )
 
-/**
- * Collect defaultCustomerRoleFeatures from all enabled modules and merge
- * them into the corresponding CustomerRoleAcl records.
- */
-async function ensureDefaultCustomerRoleAcls(
-  em: EntityManager,
-  tenantId: string,
-  modules: Module[],
-): Promise<void> {
-  const featuresByRole: Record<string, string[]> = {}
-
-  for (const mod of modules) {
-    const customerRoleFeatures = mod.setup?.defaultCustomerRoleFeatures
-    if (!customerRoleFeatures) continue
-    for (const [roleSlug, features] of Object.entries(customerRoleFeatures)) {
-      if (!features || !features.length) continue
-      if (!featuresByRole[roleSlug]) featuresByRole[roleSlug] = []
-      featuresByRole[roleSlug].push(...features)
-    }
-  }
-
-  const roleSlugs = Object.keys(featuresByRole)
-  if (!roleSlugs.length) return
-
-  for (const roleSlug of roleSlugs) {
-    const role = await em.findOne(CustomerRole, { tenantId, slug: roleSlug, deletedAt: null })
-    if (!role) continue
-
-    const acl = await em.findOne(CustomerRoleAcl, { role: role.id as any, tenantId })
-    if (!acl) continue
-
-    const currentFeatures = Array.isArray(acl.featuresJson) ? acl.featuresJson : []
-    const merged = Array.from(new Set([...currentFeatures, ...featuresByRole[roleSlug]]))
-    const changed =
-      merged.length !== currentFeatures.length ||
-      merged.some((value, index) => value !== currentFeatures[index])
-    if (changed) {
-      acl.featuresJson = merged
-      em.persist(acl)
-    }
-  }
-  await em.flush()
-}
-
 async function seedDefaultRoles(em: EntityManager, scope: SeedScope): Promise<void> {
   for (const roleDef of DEFAULT_ROLES) {
     const existing = await em.findOne(CustomerRole, {